Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix find_ysoserial_offsets.rb and incorrect serialVersionUID patching #13079

Merged
merged 2 commits into from Mar 13, 2020

Conversation

@wvu-r7
Copy link
Member

wvu-r7 commented Mar 13, 2020

/find_ysoserial_offsets.rb:39:in `generate_payload': undefined local variable or method `ysoserial_modified' for main:Object (NameError)
	from /find_ysoserial_offsets.rb:140:in `block in <main>'
	from /find_ysoserial_offsets.rb:137:in `each'
	from /find_ysoserial_offsets.rb:137:in `<main>'
Invalid payload type 'Payload'
Invalid payload type '-------'

I did not update data/ysoserial_payloads.json because it seems to break the CommonsBeanutils1 payload used in exploit/windows/http/desktopcentral_deserialization. We will have to address that in a later PR.

Fixes #11125 and #13071.

@wvu-r7 wvu-r7 force-pushed the wvu-r7:bug/ysoserial branch from e22161f to 07ca032 Mar 13, 2020
@smcintyre-r7 smcintyre-r7 self-assigned this Mar 13, 2020
@wvu-r7 wvu-r7 force-pushed the wvu-r7:bug/ysoserial branch from fd24bdf to 5480c22 Mar 13, 2020
@wvu-r7 wvu-r7 changed the title Fix find_ysoserial_offsets.rb and prettify JSON Fix find_ysoserial_offsets.rb and incorrect serialVersionUID patching Mar 13, 2020
This reverts commit eaf8554.
@wvu-r7 wvu-r7 force-pushed the wvu-r7:bug/ysoserial branch from 5480c22 to ddefafa Mar 13, 2020
@wvu-r7 wvu-r7 removed the easy label Mar 13, 2020
end

# XXX: This hardcoded value may change!
bytes.sub!("\xe3\xa1\x88\xea\x73\x22\xa4\x48", serial_version_uid)

This comment has been minimized.

Copy link
@wvu-r7

wvu-r7 Mar 13, 2020

Author Member

This won't work if the CommonsBeanutils1 payload in data/ysoserial_payloads.json is updated, nor will it work for other payloads in that file. I was mistaken about the frequency and distribution of serialVersionUID.

)

# XXX: Patch in expected serialVersionUID
serialized_payload[140, 8] = "\xcf\x8e\x01\x82\xfe\x4e\xf1\x7e"

This comment has been minimized.

Copy link
@wvu-r7

wvu-r7 Mar 13, 2020

Author Member

This should still work if the offset doesn't change after updating the CommonsBeanutils1 payload in data/ysoserial_payloads.json. However, the updated payload seems to be breaking for me regardless, so I'm not updating the file in this PR. We will have to address that later.

@smcintyre-r7

This comment has been minimized.

Copy link
Member

smcintyre-r7 commented Mar 13, 2020

Retested with the windows/http/desktopcentral_deserialization module and the tools/payloads/ysoserial./runme.sh tool. Both are working, with the module yielding a session and the tool updating the JSON data file. Thanks @wvu-r7 ! I'll land this in a moment.

@smcintyre-r7 smcintyre-r7 merged commit f208d54 into rapid7:master Mar 13, 2020
3 checks passed
3 checks passed
Metasploit Automation - Sanity Test Execution Successfully completed all tests.
Details
Metasploit Automation - Test Execution Successfully completed all tests.
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@smcintyre-r7

This comment has been minimized.

Copy link
Member

smcintyre-r7 commented Mar 13, 2020

Release Notes

This fixes a bug in the tool workflow which generates the data files for YSoSerial Java payloads.

@wvu-r7 wvu-r7 deleted the wvu-r7:bug/ysoserial branch Mar 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants
You can’t perform that action at this time.