
module Intrigue

    module Issue
      class CentreonMalware < BaseIssue
        def self.generate(instance_details={})
        {
          added: "2021-02-16",
          name: "centreon_malware",
          pretty_name: "Centreon Malware/Web Shell",
          severity: 1,
          category: "compromise",
          status: "confirmed",
          description: "Centreon product is known to have been part of a targeted attack campaign associated with a group called Sandworm." +
          " Through a currently unkown attack vector, initial intrusion is achieved after which a PHP webshell malware is uploaded for persistence.",
          affected_software: [
            { :vendor => "Centreon", :product => "Centreon" }
          ],
          references: [
            { type: "description", uri: "https://www.zdnet.com/article/france-russian-state-hackers-targeted-centreon-servers-in-years-long-campaign/" },
            { type: "description", uri: "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf" }
          ],
          authors: ["shpendk"]
        }.merge!(instance_details)
        end
      end
    end

    module Task
      class CentreonMalware < BaseCheck
      def self.check_metadata
        {
          allowed_types: ["Uri"]
        }
      end

      # return truthy value to create an issue
      def check

        # checks for web shells
        uri = _get_entity_name
        paths = [
            "/search.php",
            "/centreon/search.php",
            "/modules/Discovery/include/DB−Drop.php",
            "/centreon/modules/Discovery/include/DB−Drop.php"
        ]

        # make requests
        paths.each do |p|
            res = http_request :get, "#{uri}#{p}"
            if res.response_code == 200
                return res.body_utf8
            end
        end

        _log "Target does not appear to be vulnerable!"
        return false
      end

      end
    end

    end