When I tried
python magento_rce.py 'http://10.10.10.140/index.php/admin/' "id"
It returns
Traceback (most recent call last):
File "magento_rce.py", line 74, in <module>
tunnel = tunnel.group(1)
AttributeError: 'NoneType' object has no attribute 'group'
Look the code of magento_rce
request = br.open(url + 'block/tab_orders/period/7d/?isAjax=true', data='isAjax=false&form_key=' + key)
this param 2y is from a of /index.php/admin page,
it have 5 options: 24h/7d/1m/1y/2y,
Test all this option, but it always returns No Data Found instead.
So, this code can not work anymore
tunnel = re.search("src=\"(.*)\?ga=", request.read())
tunnel = tunnel.group(1)
Maybe it been so long a time, the database does not have data for this box.