Skip to content

Commit 7064a45

Browse files
author
threedr3am
committed
feat:cas-4.1 and 4.2 and 5.3骨架搭建完毕
使用cas，你需要熟悉overlays、idea project structure（即配置build输出目录和输出内容以及webapp目录配置）、tomcat deployment
1 parent 0f63165 commit 7064a45

File tree

19 files changed

+2546
-2
lines changed

19 files changed

+2546
-2
lines changed

‎README.md‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,68 @@
11
*本项目仅用于安全研究，禁止使用本项目发起非法攻击，造成的后果使用者负责*
22

3+
---
4+
35
### fastjson
46
1. com.threedr3am.bug.fastjson.FastjsonSerialize(TemplatesImpl) 利用条件：fastjson <= 1.2.24 + Feature.SupportNonPublicField
57
2. com.threedr3am.bug.fastjson.NoNeedAutoTypePoc 利用条件：fastjson < 1.2.48 不需要任何配置，默认配置通杀RCE
68
3. com.threedr3am.bug.fastjson.HikariConfigPoc(HikariConfig) 利用条件：fastjson <= 1.2.59 RCE，需要开启AutoType
79
4. com.threedr3am.bug.fastjson.CommonsProxyPoc(SessionBeanProvider) 利用条件：fastjson <= 1.2.61 RCE，需要开启AutoType
810

11+
---
12+
913
### jackson
1014
package：com.threedr3am.bug.jackson
1115

16+
---
17+
1218
### dubbo
1319
1. com.threedr3am.bug.dubbo.RomePoc 利用条件：存在rome依赖
1420
2. com.threedr3am.bug.dubbo.ResinPoc 利用条件：存在com.caucho:quercus依赖
1521
3. com.threedr3am.bug.dubbo.XBeanPoc 利用条件：存在org.apache.xbean:xbean-naming依赖
1622
4. com.threedr3am.bug.dubbo.SpringAbstractBeanFactoryPointcutAdvisorPoc 利用条件：存在org.springframework:spring-aop依赖
1723

18-
### dubbo/dubbo-hessian2-safe-reinforcement
24+
#### dubbo/dubbo-hessian2-safe-reinforcement
1925
dubbo hessian2安全加固demo，使用黑名单方式禁止部分gadget
2026

27+
---
28+
2129
### padding-oracle-cbc
2230
1. com.threedr3am.bug.paddingoraclecbc.PaddingOracle ```padding oracle java实现（多组密文实现）```
2331
2. com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC ```padding oracle cbc java实现（单组 <= 16bytes 密文实现）```
2432
3. com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC2 ```padding oracle cbc java实现（多组密文实现）```
2533
4. com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBCForShiro ```shiro padding oracle cbc java实现```
2634

35+
---
36+
2737
### xxe
2838
paclage：com.threedr3am.bug.xxe
2939

40+
---
41+
3042
### commons-collections
3143
package：com.threedr3am.bug.collections
3244

45+
---
46+
3347
### security-anager
3448
package：com.threedr3am.bug.security.manager
3549

50+
---
51+
3652
### rmi
3753
package：com.threedr3am.bug.rmi
3854

55+
---
56+
3957
### tomcat
4058
tomcat相关漏洞
4159

4260
#### ajp-bug
4361
tomcat ajp协议相关漏洞
44-
1. com.threedr3am.bug.tomcat.ajp 任意文件读取和jsp渲染RCE CVE-2020-1938
62+
1. com.threedr3am.bug.tomcat.ajp 任意文件读取和jsp渲染RCE CVE-2020-1938
63+
64+
---
65+
66+
### cas
67+
68+
cas相关漏洞

‎cas/4.1.7-4.2.x/pom.xml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<parent>
6+
<artifactId>cas</artifactId>
7+
<groupId>com.xyh</groupId>
8+
<version>1.0-SNAPSHOT</version>
9+
</parent>
10+
<modelVersion>4.0.0</modelVersion>
11+
12+
<artifactId>4.1.7-4.2.x</artifactId>
13+
14+
<build>
15+
<plugins>
16+
<plugin>
17+
<groupId>com.rimerosolutions.maven.plugins</groupId>
18+
<artifactId>wrapper-maven-plugin</artifactId>
19+
<version>0.0.4</version>
20+
</plugin>
21+
<plugin>
22+
<groupId>org.apache.maven.plugins</groupId>
23+
<artifactId>maven-war-plugin</artifactId>
24+
<version>2.6</version>
25+
<configuration>
26+
<warName>cas</warName>
27+
<overlays>
28+
<overlay>
29+
<groupId>org.jasig.cas</groupId>
30+
<artifactId>cas-server-webapp</artifactId>
31+
<excludes>
32+
<exclude>WEB-INF/cas.properties</exclude>
33+
<exclude>WEB-INF/classes/log4j2.xml</exclude>
34+
</excludes>
35+
</overlay>
36+
</overlays>
37+
</configuration>
38+
</plugin>
39+
<plugin>
40+
<groupId>org.apache.maven.plugins</groupId>
41+
<artifactId>maven-compiler-plugin</artifactId>
42+
<version>3.3</version>
43+
<configuration>
44+
<source>1.7</source>
45+
<target>1.7</target>
46+
</configuration>
47+
</plugin>
48+
<plugin>
49+
<groupId>org.eclipse.jetty</groupId>
50+
<artifactId>jetty-maven-plugin</artifactId>
51+
<version>${maven-jetty-plugin.version}</version>
52+
<configuration>
53+
<jettyXml>${basedir}/etc/jetty/jetty.xml,${basedir}/etc/jetty/jetty-ssl.xml,${basedir}/etc/jetty/jetty-https.xml</jettyXml>
54+
<systemProperties>
55+
<systemProperty>
56+
<name>org.eclipse.jetty.annotations.maxWait</name>
57+
<value>240</value>
58+
</systemProperty>
59+
</systemProperties>
60+
<webApp>
61+
<contextPath>/cas</contextPath>
62+
<overrideDescriptor>${basedir}/etc/jetty/web.xml</overrideDescriptor>
63+
</webApp>
64+
<webAppConfig>
65+
<allowDuplicateFragmentNames>true</allowDuplicateFragmentNames>
66+
</webAppConfig>
67+
<jvmArgs>-Dlog4j.configurationFile=/etc/cas/log4j2.xml -Xdebug -Xrunjdwp:transport=dt_socket,address=5000,server=y,suspend=n</jvmArgs>
68+
</configuration>
69+
</plugin>
70+
</plugins>
71+
<finalName>cas</finalName>
72+
</build>
73+
74+
<dependencies>
75+
<dependency>
76+
<groupId>org.jasig.cas</groupId>
77+
<artifactId>cas-server-webapp</artifactId>
78+
<version>${cas.version}</version>
79+
<type>war</type>
80+
<scope>runtime</scope>
81+
</dependency>
82+
</dependencies>
83+
84+
<properties>
85+
<cas.version>4.2.7</cas.version>
86+
<maven-jetty-plugin.version>9.3.6.v20151106</maven-jetty-plugin.version>
87+
<maven.compiler.source>1.7</maven.compiler.source>
88+
<maven.compiler.target>1.7</maven.compiler.target>
89+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
90+
</properties>
91+
92+
<repositories>
93+
<repository>
94+
<id>sonatype-releases</id>
95+
<url>http://oss.sonatype.org/content/repositories/releases/</url>
96+
</repository>
97+
<repository>
98+
<id>sonatype-snapshots</id>
99+
<url>https://oss.sonatype.org/content/repositories/snapshots/</url>
100+
</repository>
101+
<repository>
102+
<id>shibboleth-releases</id>
103+
<url>https://build.shibboleth.net/nexus/content/repositories/releases</url>
104+
</repository>
105+
</repositories>
106+
107+
</project>

‎cas/4.1.7-4.2.x/src/main/java/com/threedr3am/bug/cas/package-info.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
/**
2+
* @author threedr3am
3+
*/
4+
package com.threedr3am.bug.cas;

‎cas/4.1.7-4.2.x/src/main/resources/log4j2.xml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
<?xml version="1.0" encoding="UTF-8" ?>
2+
<!-- Specify the refresh internal in seconds. -->
3+
<Configuration monitorInterval="60">
4+
<Appenders>
5+
<Console name="console" target="SYSTEM_OUT">
6+
<PatternLayout pattern="%d %p [%c] - &lt;%m&gt;%n"/>
7+
</Console>
8+
<RollingFile name="file" fileName="cas.log" append="true"
9+
filePattern="cas-%d{yyyy-MM-dd-HH}-%i.log">
10+
<PatternLayout pattern="%d %p [%c] - %m%n"/>
11+
<Policies>
12+
<OnStartupTriggeringPolicy />
13+
<SizeBasedTriggeringPolicy size="10 MB"/>
14+
<TimeBasedTriggeringPolicy />
15+
</Policies>
16+
</RollingFile>
17+
<RollingFile name="auditlogfile" fileName="cas_audit.log" append="true"
18+
filePattern="cas_audit-%d{yyyy-MM-dd-HH}-%i.log">
19+
<PatternLayout pattern="%d %p [%c] - %m%n"/>
20+
<Policies>
21+
<OnStartupTriggeringPolicy />
22+
<SizeBasedTriggeringPolicy size="10 MB"/>
23+
<TimeBasedTriggeringPolicy />
24+
</Policies>
25+
</RollingFile>
26+
<RollingFile name="perfFileAppender" fileName="perfStats.log" append="true"
27+
filePattern="perfStats-%d{yyyy-MM-dd-HH}-%i.log">
28+
<PatternLayout pattern="%m%n"/>
29+
<Policies>
30+
<OnStartupTriggeringPolicy />
31+
<SizeBasedTriggeringPolicy size="10 MB"/>
32+
<TimeBasedTriggeringPolicy />
33+
</Policies>
34+
</RollingFile>
35+
</Appenders>
36+
<Loggers>
37+
<AsyncLogger name="org.jasig" level="info" additivity="false" includeLocation="true">
38+
<AppenderRef ref="console"/>
39+
<AppenderRef ref="file"/>
40+
</AsyncLogger>
41+
<AsyncLogger name="org.springframework" level="warn" />
42+
<AsyncLogger name="org.springframework.webflow" level="warn" />
43+
<AsyncLogger name="org.springframework.web" level="warn" />
44+
<AsyncLogger name="org.pac4j" level="warn" />
45+
<!--
46+
<AsyncLogger name="org.opensaml" level="debug" additivity="false">
47+
<AppenderRef ref="console"/>
48+
<AppenderRef ref="file"/>
49+
</AsyncLogger>
50+
<AsyncLogger name="org.ldaptive" level="debug" additivity="false">
51+
<AppenderRef ref="console"/>
52+
<AppenderRef ref="file"/>
53+
</AsyncLogger>
54+
<AsyncLogger name="com.hazelcast" level="debug" additivity="false">
55+
<AppenderRef ref="console"/>
56+
<AppenderRef ref="file"/>
57+
</AsyncLogger>
58+
-->
59+
<AsyncLogger name="org.apereo.cas.security" level="warn" additivity="false" includeLocation="true">
60+
<AppenderRef ref="console"/>
61+
<AppenderRef ref="file"/>
62+
</AsyncLogger>
63+
64+
<AsyncLogger name="perfStatsLogger" level="info" additivity="false" includeLocation="true">
65+
<AppenderRef ref="perfFileAppender"/>
66+
</AsyncLogger>
67+
68+
<AsyncLogger name="org.jasig.cas.web.flow" level="info" additivity="true" includeLocation="true">
69+
<AppenderRef ref="file"/>
70+
</AsyncLogger>
71+
<AsyncLogger name="org.jasig.inspektr.audit.support" level="info" includeLocation="true">
72+
<AppenderRef ref="auditlogfile"/>
73+
<AppenderRef ref="file"/>
74+
</AsyncLogger>
75+
<AsyncRoot level="error">
76+
<AppenderRef ref="console"/>
77+
</AsyncRoot>
78+
</Loggers>
79+
</Configuration>

0 commit comments

Comments
 (0)