Java DNS Deserialization, GadgetProbe and Java Deserialization Scanner
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
DNS request on deserialization
Darasa java.net.URL
linafanya kazi Serializable
, hii inamaanisha kwamba darasa hili linaweza kuandikwa.
Hii darasa lina tabia ya kushangaza. Kutoka kwenye hati: “Wenyeji wawili wanachukuliwa kuwa sawa ikiwa majina yote ya mwenyeji yanaweza kutatuliwa kuwa anwani sawa za IP.”
Basi, kila wakati kitu cha URL kinapoitisha yoyote ya kazi equals
au hashCode
ombi la DNS kupata Anwani ya IP litakuwa litatumwa.
Kuita kazi hashCode
kutoka kwa kitu cha URL ni rahisi sana, inatosha kuingiza kitu hiki ndani ya HashMap
ambacho kitakuwa kinachakatwa. Hii ni kwa sababu mwishoni mwa kazi readObject
kutoka HashMap
hii nambari inatekelezwa:
It is going the execute putVal
with every value inside the HashMap
. But, more relevant is the call to hash
with every value. This is the code of the hash
function:
Kama unavyoweza kuona, wakati wa deserialization ya HashMap
kazi hash
itatekelezwa na kila kitu na wakati wa utekelezaji wa hash
itaweza kutekelezwa .hashCode()
ya kitu. Hivyo, ikiwa unafanya deserialization ya HashMap
iliyokuwa na kitu cha URL, kitu cha URL kita tekeleza .hashCode()
.
Sasa, hebu tuangalie msimbo wa URLObject.hashCode()
:
Kama unavyoona, wakati URLObject
inatekeleza .hashCode()
inaitwa hashCode(this)
. Kuendelea unaweza kuona msimbo wa kazi hii:
You can see that a getHostAddress
is executed to the domain, kuanzisha ombi la DNS.
Therefore, this class can be kutumiwa vibaya in order to kuanzisha a ombio la DNS to kuonyesha that deserialization is possible, or even to kuondoa taarifa (you can append as subdomain the output of a command execution).
URLDNS payload code example
You can find the URDNS payload code from ysoserial here. However, just for make it easier to understand how to code it I created my own PoC (based on the one from ysoserial):
More information
Katika wazo la asili, mzigo wa makusanyo ya kawaida ulibadilishwa ili kutekeleza uchunguzi wa DNS, hii ilikuwa na uaminifu mdogo kuliko njia iliyopendekezwa, lakini hii ndiyo chapisho: https://www.gosecure.net/blog/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/
GadgetProbe
Unaweza kupakua GadgetProbe kutoka Duka la Burp Suite (Extender).
GadgetProbe itajaribu kubaini kama darasa la Java fulani lipo kwenye darasa la Java la seva ili uweze kujua kama lina udhaifu kwa exploit inayojulikana.
How does it work
GadgetProbe itatumia mzigo wa DNS wa sehemu ya awali lakini kabla ya kuendesha uchunguzi wa DNS itajaribu kufanya deserialization ya darasa lolote. Ikiwa darasa lolote lipo, uchunguzi wa DNS uta tumwa na GadgetProbe itakumbuka kwamba darasa hili lipo. Ikiwa ombio la DNS halijatumwa kamwe, hii inamaanisha kwamba darasa lolote halikufanywa deserialization kwa mafanikio hivyo labda halipo au halitambuliki/haliwezi kutumika.
Ndani ya github, GadgetProbe ina orodha za maneno zenye madarasa ya Java kwa ajili ya kupimwa.
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-75ac066e3db39effbb723a0bfc06cc9f3d85f198%252Fintruder4%2520%281%29%2520%281%29.gif%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=d710c093&sv=1)
More Information
Java Deserialization Scanner
Scanner hii inaweza kupakuliwa kutoka Duka la Burp App (Extender). Kiongezeo kina uwezo wa kupita na kazi.
Passive
Kwa kawaida inachunguza kwa njia ya kupita maombi yote na majibu yaliyotumwa ikiangalia baiti za uchawi za Java zilizosajiliwa na itawasilisha onyo la udhaifu ikiwa yoyote itapatikana:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-dd473120602f042a13ca176063ed9a5497fa5f1b%252Fimage%2520%28765%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=af37e678&sv=1)
Active
Manual Testing
Unaweza kuchagua ombi, bonyeza kulia na Send request to DS - Manual Testing
.
Kisha, ndani ya Deserialization Scanner Tab --> Manual testing tab unaweza kuchagua nukta ya kuingiza. Na anzisha upimaji (Chagua shambulio linalofaa kulingana na uandishi uliofanywa).
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-0b526479acce0fe251f09c7d7104c3bc73040171%252F3-1.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=5e0553&sv=1)
Hata kama hii inaitwa "Manual testing", ni otomatiki sana. Itakagua kiotomatiki kama deserialization ina udhaifu kwa mzigo wowote wa ysoserial ikichunguza maktaba zilizopo kwenye seva ya wavuti na itaonyesha zile zenye udhaifu. Ili kuangalia maktaba zenye udhaifu unaweza kuchagua kuanzisha Javas Sleeps, sleeps kupitia matumizi ya CPU, au kutumia DNS kama ilivyotajwa hapo awali.
Exploiting
Mara tu unapokuwa umepata maktaba yenye udhaifu unaweza kutuma ombi kwenye Exploiting Tab. Katika tab hii unapaswa kuchagua nukta ya kuingiza tena, na kuandika maktaba yenye udhaifu unayotaka kuunda mzigo kwa, na amri. Kisha, bonyeza tu kitufe cha Attack kinachofaa.
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-1cb2ee1425024eff539602a8df04038d960a7f1c%252F4.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=8d61a762&sv=1)
Java Deserialization DNS Exfil information
Fanya mzigo wako utekeleze kitu kama ifuatavyo:
More Information
Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze & fanya mazoezi ya GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated