Rabbitbong/node2shell

选用指南

AI 根据 README 整理 · 2026/10/25 14:56:11

适用场景

适用于在授权实验室环境中复现CVE-2026-111497漏洞、测试防御措施（如反向代理限制）以及对比补丁前后行为。

查看 README 依据

Imperva, [*"Node2Shell: From Brotli Data to Remote Code Execution"*](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/). The target is **Orbital**, a fictional bulk-ingestion app. The bug sits where it realistically would: a bulk import endpoint accepting large compressed batches (`POST /api/v1/import`, 50 MB limit scoped to that one route; other routes keep the default 100 KB). > **Authorized lab use only.** This targets a **patched** CVE for reproduction > and defense research. `poc.py` is loopback-only by construction

root. This lab does neither; `labcheck.sh` proves it (non-root `uid=1000(node)`, `ET_EXEC` non-PIE, `randomize_va_space=2`, and the libc base moving across worker lives). The probabilistic retry loop is the cost of not weakening the target.  ## Defensive A/B The same request against the **patched** container fails closed: the fixed decoder rejects the impossible switch (`ERR__ERROR_FORMAT_BLOCK_SWITCH`).

目标用户

面向安全研究人员，用于漏洞复现和防御研究。

查看 README 依据

Imperva, [*"Node2Shell: From Brotli Data to Remote Code Execution"*](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/). The target is **Orbital**, a fictional bulk-ingestion app. The bug sits where it realistically would: a bulk import endpoint accepting large compressed batches (`POST /api/v1/import`, 50 MB limit scoped to that one route; other routes keep the default 100 KB). > **Authorized lab use only.** This targets a **patched** CVE for reproduction > and defense research. `poc.py` is loopback-only by construction

使用方式

通过命令行使用，运行run.sh构建并启动易受攻击和已修补的容器，然后使用poc.py对目标端口发起利用。

查看 README 依据

> (`127.0.0.1` / `::1` / `localhost`). Never point it at anything you do not own.  ## Quickstart Requires Docker with linux/amd64 (the ROP profile is calibrated to the pinned node 24.22.0 x86-64 binary). ```sh ./run.sh # build + run: vuln :3000, patched :3002 python3 poc.py --port 3000 # exploit the vuln container -> uid=1000(node) python3 poc.py --port 3002 # patched build: FAILs closed ``` Browse the app at <http://localhost:3000/> and `/dashboard`. With the compose

部署要求

需要Docker支持linux/amd64架构，以及Python 3和可选的pwntools（用于--autoprofile功能）。

查看 README 依据

> (`127.0.0.1` / `::1` / `localhost`). Never point it at anything you do not own.  ## Quickstart Requires Docker with linux/amd64 (the ROP profile is calibrated to the pinned node 24.22.0 x86-64 binary). ```sh ./run.sh # build + run: vuln :3000, patched :3002 python3 poc.py --port 3000 # exploit the vuln container -> uid=1000(node) python3 poc.py --port 3002 # patched build: FAILs closed ``` Browse the app at <http://localhost:3000/> and `/dashboard`. With the compose

filename but not argv). It's **probabilistic**: up to 32 attempts per run (~1 in 7-10 land); a miss crashes the worker, the supervisor re-rolls ASLR, and `poc.py` retries. Re-run or `--sweep` if a run misses all attempts. **`--autoprofile`** ports the exploit to other vulnerable builds. The ROP chain is absolute addresses in a specific node binary; official binaries are non-PIE (`ET_EXEC`), so `build_profile.py` resolves the gadgets, PLT entries, and `.bss` straight from the ELF (or a docker image it extracts). Needs `pwntools`

已知限制

利用是概率性的，每次运行最多尝试32次，成功率约1/7-10；仅支持回环地址，且--exec只能执行单个无参数二进制。

查看 README 依据

filename but not argv). It's **probabilistic**: up to 32 attempts per run (~1 in 7-10 land); a miss crashes the worker, the supervisor re-rolls ASLR, and `poc.py` retries. Re-run or `--sweep` if a run misses all attempts. **`--autoprofile`** ports the exploit to other vulnerable builds. The ROP chain is absolute addresses in a specific node binary; official binaries are non-PIE (`ET_EXEC`), so `build_profile.py` resolves the gadgets, PLT entries, and `.bss` straight from the ELF (or a docker image it extracts). Needs `pwntools`