Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix find_ysoserial_offsets.rb and incorrect serialVersionUID patching #13079

Merged
merged 2 commits into from
Mar 13, 2020

Conversation

wvu
Copy link
Contributor

@wvu wvu commented Mar 13, 2020

/find_ysoserial_offsets.rb:39:in `generate_payload': undefined local variable or method `ysoserial_modified' for main:Object (NameError)
	from /find_ysoserial_offsets.rb:140:in `block in <main>'
	from /find_ysoserial_offsets.rb:137:in `each'
	from /find_ysoserial_offsets.rb:137:in `<main>'
Invalid payload type 'Payload'
Invalid payload type '-------'

I did not update data/ysoserial_payloads.json because it seems to break the CommonsBeanutils1 payload used in exploit/windows/http/desktopcentral_deserialization. We will have to address that in a later PR.

Fixes #11125 and #13071. See also: #11359.

@wvu wvu changed the title Fix find_ysoserial_offsets.rb and prettify JSON Fix find_ysoserial_offsets.rb and incorrect serialVersionUID patching Mar 13, 2020
end

# XXX: This hardcoded value may change!
bytes.sub!("\xe3\xa1\x88\xea\x73\x22\xa4\x48", serial_version_uid)
Copy link
Contributor Author

@wvu wvu Mar 13, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This won't work if the CommonsBeanutils1 payload in data/ysoserial_payloads.json is updated, nor will it work for other payloads in that file. I was mistaken about the frequency and distribution of serialVersionUID.

)

# XXX: Patch in expected serialVersionUID
serialized_payload[140, 8] = "\xcf\x8e\x01\x82\xfe\x4e\xf1\x7e"
Copy link
Contributor Author

@wvu wvu Mar 13, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should still work if the offset doesn't change after updating the CommonsBeanutils1 payload in data/ysoserial_payloads.json. However, the updated payload seems to be breaking for me regardless, so I'm not updating the file in this PR. We will have to address that later.

@smcintyre-r7
Copy link
Contributor

Retested with the windows/http/desktopcentral_deserialization module and the tools/payloads/ysoserial./runme.sh tool. Both are working, with the module yielding a session and the tool updating the JSON data file. Thanks @wvu-r7 ! I'll land this in a moment.

@smcintyre-r7 smcintyre-r7 merged commit f208d54 into rapid7:master Mar 13, 2020
@smcintyre-r7
Copy link
Contributor

Release Notes

This fixes a bug in the tool workflow which generates the data files for YSoSerial Java payloads.

@wvu wvu deleted the bug/ysoserial branch March 13, 2020 23:14
@tdoan-r7 tdoan-r7 added the rn-fix release notes fix label Apr 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants