The objective of this lab is to identify and exploit a vulnerable web application to achieve Remote Code Execution (RCE). The assessment demonstrates the complete penetration testing process, including reconnaissance, vulnerability validation, exploitation, and post-exploitation verification in a controlled lab environment.
- Web application reconnaissance and enumeration
- Identifying web application vulnerabilities
- Remote Code Execution (RCE) exploitation
- Authentication bypass techniques (where applicable)
- Exploit research and validation
- Executing public proof-of-concept (PoC) exploits
- Session and cookie manipulation
- Command execution on a compromised target
- Verifying successful exploitation
- Documenting security findings and impact
- Nmap
- Burp Suite
- Firefox/Chrome Developer Tools
- Python
- Public Proof-of-Concept (PoC) exploit
- Linux Terminal (Kali Linux)
- Wappalyzer
==> This lab was completed as part of the TryHackMe room "React2Shell: CVE-2025-55182" link: https://tryhackme.com/room/react2shellcve202555182
Next, we perform an Nmap scan to discover the open ports and exposed services on the target system.
The scan results show that two ports are open:
- Port 22 – SSH (Secure Shell)
- Port 3000 – Web application
Next, open a web browser and access the application using port 3000.
Next, use Wappalyzer to fingerprint the target web application and identify the technologies, frameworks, and software versions it exposes. This information can help with technology identification and further vulnerability research.
The target web application is running Next.js version 16.0.6. Based on vulnerability research, this version is associated with CVE-2025-66478.
Next, clone the scanner repository from GitHub using the following command:
git clone https://github.com/SamSothavy/customized_exploit.git
The exploit is executed using Python, specifying the target URL and a command parameter to confirm remote command execution:
There are two methods available to compromise the target server:
- Raw Execution – Directly execute commands on the target system.
- Download with Auto-Execution – Download a payload to the target system and execute it automatically.
Both methods can be used depending on the lab scenario and exploitation approach.
Raw Execution
Port 4444 is opened to listen for incoming connections from the target system.
Then, we use a reverse shell script
Failed attempt
Encoded not working
The Raw Execution method was unsuccessful in this scenario.
Download with Auto-Execution
We create a .sh file that contains a reverse shell script.
Then, hosting it
We have successfully gained access to the target server.
We can also use Burp Suite
