Skip to content

[请求适配] 支持 BigInteger 打包方式 #86

@ReaJason

Description

@ReaJason

适配范围

Describe the scope you want to adapt to

Base64 流量对于 WAF 来说是很敏感的,虽然 BigInteger 的编码方式可能也进了规则库,但是部分工具支持 BigInteger 所以可以支持一下。

参考 pen4uin/java-memshell-generator/BigIntegerFormater.java 实现

代码和靶场实现

  1. fork 本仓库并打开 GitHub Actions(用于集成测试)
  2. 在 packer 模块中参考 BCELPacker 进行 BigIntegerPacker 的实现,并在 Packers 中注册,放在 BCEL 上面。
  3. 在 vul/vul-webapp 和 vul/vul-webapp-jakarta 模块中,参考 Base64ClassLoaderServlet 编写 BigIntegerClassLaoderServlet 的靶场,请求的路径为 /biginteger解析 BigInteger 并 defineClass 触发 RCE
  4. 参考 base64 的靶场请求方式在以下代码中添加 /biginteger 的请求发送方式。
    public static void injectIsOk(String url, String shellType, ShellTool shellTool, String content, Packers packer, GenericContainer<?> container) {
    switch (packer) {
    case JSP, ClassLoaderJSP, DefineClassJSP -> {
    String uploadEntry = url + "/upload";
    String filename = shellType + shellTool + packer + ".jsp";
    String shellUrl = url + "/" + filename;
    VulTool.uploadJspFileToServer(uploadEntry, filename, content);
    VulTool.urlIsOk(shellUrl);
    }
    case JSPX -> {
    String uploadEntry = url + "/upload";
    String filename = shellType + shellTool + ".jspx";
    String shellUrl = url + "/" + filename;
    VulTool.uploadJspFileToServer(uploadEntry, filename, content);
    VulTool.urlIsOk(shellUrl);
    }
    case ScriptEngine -> VulTool.postIsOk(url + "/js", content);
    case EL -> VulTool.postIsOk(url + "/el", content);
    case SpEL, SpELSpringIOUtils, SpELScriptEngine, SpELSpringUtils -> VulTool.postIsOk(url + "/spel", content);
    case OGNL, OGNLSpringIOUtils, OGNLScriptEngine, OGNLSpringUtils -> VulTool.postIsOk(url + "/ognl", content);
    case MVEL -> VulTool.postIsOk(url + "/mvel", content);
    case JXPath -> VulTool.postIsOk(url + "/jxpath", content);
    case JEXL -> VulTool.postIsOk(url + "/jexl2", content);
    case Aviator -> VulTool.postIsOk(url + "/aviator", content);
    case Groovy -> VulTool.postIsOk(url + "/groovy", content);
    case Rhino -> VulTool.postIsOk(url + "/rhino", content);
    case BeanShell -> VulTool.postIsOk(url + "/bsh", content);
    case JinJava -> VulTool.postIsOk(url + "/jinjava", content);
    case Freemarker -> VulTool.postIsOk(url + "/freemarker", content);
    case Velocity -> VulTool.postIsOk(url + "/velocity", content);
    case JavaDeserialize -> VulTool.postIsOk(url + "/java_deserialize", content);
    case JavaCommonsBeanutils16 -> VulTool.postIsOk(url + "/java_deserialize/cb161", content);
    case JavaCommonsBeanutils17 -> VulTool.postIsOk(url + "/java_deserialize/cb170", content);
    case JavaCommonsBeanutils18 -> VulTool.postIsOk(url + "/java_deserialize/cb183", content);
    case JavaCommonsBeanutils19 -> VulTool.postIsOk(url + "/java_deserialize/cb194", content);
    case JavaCommonsBeanutils110 -> VulTool.postIsOk(url + "/java_deserialize/cb110", content);
    case JavaCommonsCollections3 -> VulTool.postIsOk(url + "/java_deserialize/cc321", content);
    case JavaCommonsCollections4 -> VulTool.postIsOk(url + "/java_deserialize/cc40", content);
    case HessianDeserialize -> VulTool.postIsOk(url + "/hessian", content);
    case Hessian2Deserialize -> VulTool.postIsOk(url + "/hessian2", content);
    case XMLDecoderScriptEngine, XMLDecoderDefineClass -> VulTool.postIsOk(url + "/xmlDecoder", content);
    case Base64 -> VulTool.postIsOk(url + "/b64", content);
    case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content);
    case H2, H2JS, H2Javac -> VulTool.postIsOk(url + "/jdbc", content);
    default -> throw new IllegalStateException("Unexpected value: " + packer);

集成测试

  1. Tomcat 的内存马集成测试添加 BigInteger 的打包测试方法, 添加范围为以下,在以下代码文件中的 testPackers 中新增 BigInteger 的 Packers enum。
  2. 直接 push 由 GitHub Actions 进行集成测试(确保开启 fork 仓库的 GitHub Actions 功能),留意测试结果,可能部分环境不兼容,需要特别留意,尽可能进行兼容。
  3. 如果集成测试通过可直接 PR

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions