Skip to content

Commit a4a3d68

Browse files
author
“threedr3am”
committed
CVE-2020-11989 & op README.md
1 parent 38b7a16 commit a4a3d68

File tree

10 files changed

+260
-50
lines changed

10 files changed

+260
-50
lines changed

‎README.md‎

Lines changed: 76 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
*本项目仅用于安全研究，禁止使用本项目发起非法攻击，造成的后果使用者负责*
22

3+
这是一个个人用于复现、公开一些感兴趣、或者影响稍大的漏洞的项目，没有多少技术含量，权当个人技术笔记。
4+
35
---
46

57
### fastjson
6-
##### RCE
8+
9+
该模块主要记录一些fastjson的利用gadget，不过很多gadget并没有记录在案。
10+
11+
##### RCE相关
712
package：com.threedr3am.bug.fastjson.rce
813

914
1. com.threedr3am.bug.fastjson.rce.FastjsonSerialize(TemplatesImpl) 利用条件：fastjson <= 1.2.24 + Feature.SupportNonPublicField
@@ -14,19 +19,30 @@ package：com.threedr3am.bug.fastjson.rce
1419
6. com.threedr3am.bug.fastjson.rce.HadoopHikariPoc(HikariConfig) 利用条件：fastjson <= 1.2.62 RCE，需要开启AutoType
1520
7. com.threedr3am.bug.fastjson.rce.IbatisSqlmapPoc(JtaTransactionConfig) 利用条件：fastjson <= 1.2.62 RCE，需要开启AutoType
1621
8. com.threedr3am.bug.fastjson.rce.ShiroPoc(shiro-core) 利用条件：fastjson <= 1.2.66 RCE，需要开启AutoType
22+
...省略若干
1723

18-
##### SSRF
24+
##### SSRF相关
1925
package：com.threedr3am.bug.fastjson.ssrf
2026

2127
1. com.threedr3am.bug.fastjson.ssrf.ApacheCxfSSRFPoc(WadlGenerator) 利用条件：fastjson <= 1.2.66 SSRF，需要开启AutoType
2228
2. com.threedr3am.bug.fastjson.ssrf.ApacheCxfSSRFPoc2(SchemaHandler) 利用条件：fastjson <= 1.2.66 SSRF，需要开启AutoType
2329
3. com.threedr3am.bug.fastjson.ssrf.CommonsJellySSRFPoc(Embedded) 利用条件：fastjson <= 1.2.66 SSRF，需要开启AutoType
2430
4. com.threedr3am.bug.fastjson.ssrf.JREJeditorPaneSSRFPoc(JEditorPane) 利用条件：fastjson <= 1.2.66 SSRF，需要开启AutoType
31+
...省略若干
32+
33+
##### DNS域名解析相关
34+
package：com.threedr3am.bug.fastjson.dns
35+
36+
##### Dos拒绝服务相关
37+
package：com.threedr3am.bug.fastjson.dos
38+
39+
##### leak信息泄露相关
40+
package：com.threedr3am.bug.fastjson.leak
2541

2642
---
2743

2844
### jackson
29-
##### RCE
45+
##### RCE相关
3046
package：com.threedr3am.bug.jackson.rce
3147

3248
1. com.threedr3am.bug.jackson.rce.AnterosPoc
@@ -37,24 +53,32 @@ package：com.threedr3am.bug.jackson.rce
3753
6. com.threedr3am.bug.jackson.rce.IbatisSqlmapPoc
3854
7. com.threedr3am.bug.jackson.rce.JndiConverterPoc
3955
8. com.threedr3am.bug.jackson.rce.LogbackJndi
56+
...省略若干
4057

4158
##### SSRF
4259
package：com.threedr3am.bug.jackson.ssrf
60+
...省略若干
4361

4462
---
4563

4664
### dubbo
65+
66+
该模块主要记录dubbo相关的漏洞利用、安全加固等
67+
4768
1. com.threedr3am.bug.dubbo.RomePoc 利用条件：存在rome依赖
4869
2. com.threedr3am.bug.dubbo.ResinPoc 利用条件：存在com.caucho:quercus依赖
4970
3. com.threedr3am.bug.dubbo.XBeanPoc 利用条件：存在org.apache.xbean:xbean-naming依赖
5071
4. com.threedr3am.bug.dubbo.SpringAbstractBeanFactoryPointcutAdvisorPoc 利用条件：存在org.springframework:spring-aop依赖
5172

52-
#### dubbo/dubbo-hessian2-safe-reinforcement
73+
##### dubbo-hessian2-safe-reinforcement
5374
dubbo hessian2安全加固demo，使用黑名单方式禁止部分gadget
5475

5576
---
5677

5778
### padding-oracle-cbc
79+
80+
用Java实现padding-oracle-cbc攻击的一些实验代码记录
81+
5882
1. com.threedr3am.bug.paddingoraclecbc.PaddingOracle ```padding oracle java实现（多组密文实现）```
5983
2. com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC ```padding oracle cbc java实现（单组 <= 16bytes 密文实现）```
6084
3. com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC2 ```padding oracle cbc java实现（多组密文实现）```
@@ -63,29 +87,36 @@ dubbo hessian2安全加固demo，使用黑名单方式禁止部分gadget
6387
---
6488

6589
### xxe
66-
paclage：com.threedr3am.bug.xxe
90+
91+
各种XML解析组件导致XXE的复现，以及其fix代码记录
6792

6893
---
6994

7095
### commons-collections
71-
package：com.threedr3am.bug.collections
96+
97+
好几年前学习反序列化的时候瞎写的东西
7298

7399
---
74100

75-
### security-anager
76-
package：com.threedr3am.bug.security.manager
101+
### security-manager
102+
103+
java security manager的一些绕过实验代码
77104

78105
---
79106

80107
### rmi
81-
package：com.threedr3am.bug.rmi
108+
109+
rmi相关服务，以及其利用等
110+
82111

83112
---
84113

85114
### tomcat
115+
86116
tomcat相关漏洞
87117

88118
#### ajp-bug
119+
89120
tomcat ajp协议相关漏洞
90121
1. com.threedr3am.bug.tomcat.ajp 任意文件读取和jsp渲染RCE CVE-2020-1938
91122

@@ -101,6 +132,41 @@ cas相关漏洞
101132
---
102133

103134
### spring
135+
136+
一些Spring漏洞的复现实验代码记录
137+
104138
1. spring-actuator(jolokia、snake-yaml、h2-hikariCP、eureka)
105139
2. spring-cloud-config-server(CVE-2019-3799)
106-
3. spring-cloud-config-server(CVE-2020-5405)
140+
3. spring-cloud-config-server(CVE-2020-5405)
141+
4. spring-cloud-config-server(CVE-2020-5410)
142+
5. spring-session-data-redis RCE
143+
144+
### apache-poi
145+
146+
apache-poi excel解析漏洞相关记录
147+
148+
### feature
149+
150+
一些攻击的数据特征，本来想法是看看正则等能不能都检测到
151+
152+
### java-compile
153+
154+
java动态编译、操纵字节码的实现代码
155+
156+
### nexus
157+
158+
maven nexus的一些RCE、Auth Bypass漏洞的复现记录
159+
160+
### ShardingSphere-UI
161+
162+
ShardingSphere-UI的一些漏洞记录
163+
164+
1. CVE-2020-1947 (YAML反序列化RCE漏洞)
165+
166+
### shiro
167+
168+
记录了最近shiro被发现的一些认证bypass漏洞
169+
170+
1. bypass shiro <= 1.4.1
171+
2. bypass shiro <= 1.5.2 (CVE-2020-1957)
172+
3. bypass shiro <= 1.5.3 (CVE-2020-11989)

‎fastjson/src/main/java/com/threedr3am/bug/fastjson/test/Threedr3am.java‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎shiro/auth-bypass(shiro<1.5.3)/pom.xml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>1.5.22.RELEASE</version>
9+
<relativePath/>
10+
</parent>
11+
<modelVersion>4.0.0</modelVersion>
12+
13+
<artifactId>auth-bypass-cve-2020-11989</artifactId>
14+
15+
<dependencies>
16+
<dependency>
17+
<groupId>org.springframework.boot</groupId>
18+
<artifactId>spring-boot-starter-web</artifactId>
19+
</dependency>
20+
21+
<dependency>
22+
<groupId>org.apache.shiro</groupId>
23+
<artifactId>shiro-web</artifactId>
24+
<version>1.5.2</version>
25+
</dependency>
26+
<dependency>
27+
<groupId>org.apache.shiro</groupId>
28+
<artifactId>shiro-spring</artifactId>
29+
<version>1.5.2</version>
30+
</dependency>
31+
</dependencies>
32+
33+
</project>

‎shiro/auth-bypass(shiro<1.5.3)/src/main/java/me/threedr3am/bug/shiro/bypass/auth/Application.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package me.threedr3am.bug.shiro.bypass.auth;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
@SpringBootApplication
7+
public class Application {
8+
9+
public static void main(String[] args) {
10+
SpringApplication.run(Application.class, args);
11+
}
12+
13+
}

‎shiro/auth-bypass(shiro<1.5.3)/src/main/java/me/threedr3am/bug/shiro/bypass/auth/config/ShiroConfig.java‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package me.threedr3am.bug.shiro.bypass.auth.config;
2+
3+
import java.util.LinkedHashMap;
4+
import java.util.Map;
5+
import me.threedr3am.bug.shiro.bypass.auth.realm.MyRealm;
6+
import org.apache.shiro.mgt.SecurityManager;
7+
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
8+
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
9+
import org.springframework.context.annotation.Bean;
10+
import org.springframework.context.annotation.Configuration;
11+
12+
/**
13+
* @author threedr3am
14+
*/
15+
@Configuration
16+
public class ShiroConfig {
17+
@Bean
18+
MyRealm myRealm() {
19+
return new MyRealm();
20+
}
21+
22+
@Bean
23+
SecurityManager securityManager() {
24+
DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
25+
manager.setRealm(myRealm());
26+
return manager;
27+
}
28+
29+
@Bean
30+
ShiroFilterFactoryBean shiroFilterFactoryBean() {
31+
ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
32+
bean.setSecurityManager(securityManager());
33+
bean.setLoginUrl("/login");
34+
bean.setSuccessUrl("/index");
35+
bean.setUnauthorizedUrl("/unauthorizedurl");
36+
Map<String, String> map = new LinkedHashMap();
37+
map.put("/login", "anon");
38+
map.put("/aaaaa/**", "anon");
39+
map.put("/bypass/*", "authc");
40+
bean.setFilterChainDefinitionMap(map);
41+
return bean;
42+
}
43+
}

‎shiro/auth-bypass(shiro<1.5.3)/src/main/java/me/threedr3am/bug/shiro/bypass/auth/controller/BypassTestController.java‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package me.threedr3am.bug.shiro.bypass.auth.controller;
2+
3+
import org.springframework.web.bind.annotation.PathVariable;
4+
import org.springframework.web.bind.annotation.RequestMapping;
5+
import org.springframework.web.bind.annotation.RequestMethod;
6+
import org.springframework.web.bind.annotation.RestController;
7+
8+
/**
9+
* todo 这个洞利用价值不大，基本使用shiro做认证的系统，都会利用/** authc兜底
10+
* CVE-2020-11989
11+
*
12+
* todo-1. 通过访问 http://localhost:8080/bypass/bypass/aaa%252Faaa (两次编码的"aaa/aaa") 绕过接口/bypass的认证控制
13+
* * 漏洞点在于tomcat只会对url进行一次解码，而shiro进行了两次解码
14+
* * 两次解码后，路径变成 http://localhost:8080/bypass/bypass/aaa/aaa 绕过了权限 "/bypass/*" 的match
15+
*
16+
* todo-2. 通过访问 http://localhost:8080/;/bypass/bypass/111 绕过接口/bypass的认证控制
17+
* * 漏洞点在于shiro会对;分号进行截断，访问的 /;/bypass/bypass/111 变成了 / ，自然就绕过了权限 "/bypass/*" 的match
18+
* * server:
19+
* context-path: /bypass
20+
*
21+
* @author threedr3am
22+
*/
23+
@RestController
24+
public class BypassTestController {
25+
26+
/**
27+
* @return
28+
*/
29+
@RequestMapping(value = "/bypass/{id}", method = RequestMethod.GET)
30+
public String bypass(@PathVariable(name = "id") String id) {
31+
return "bypass1 -> " + id;
32+
}
33+
}

‎shiro/auth-bypass(shiro<1.5.3)/src/main/java/me/threedr3am/bug/shiro/bypass/auth/controller/LoginController.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package me.threedr3am.bug.shiro.bypass.auth.controller;
2+
3+
import org.apache.shiro.SecurityUtils;
4+
import org.apache.shiro.authc.AuthenticationException;
5+
import org.apache.shiro.authc.UsernamePasswordToken;
6+
import org.apache.shiro.subject.Subject;
7+
import org.springframework.web.bind.annotation.RequestMapping;
8+
import org.springframework.web.bind.annotation.RequestMethod;
9+
import org.springframework.web.bind.annotation.RestController;
10+
11+
/**
12+
* @author threedr3am
13+
*/
14+
@RestController
15+
public class LoginController {
16+
17+
@RequestMapping(value = "/login", method = RequestMethod.POST)
18+
public String login(String username, String password) {
19+
Subject subject = SecurityUtils.getSubject();
20+
try {
21+
subject.login(new UsernamePasswordToken(username, password));
22+
return "登录成功!";
23+
} catch (AuthenticationException e) {
24+
e.printStackTrace();
25+
return "登录失败!";
26+
}
27+
28+
}
29+
}

‎shiro/auth-bypass(shiro<1.5.3)/src/main/java/me/threedr3am/bug/shiro/bypass/auth/realm/MyRealm.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
package me.threedr3am.bug.shiro.bypass.auth.realm;
2+
3+
import org.apache.shiro.authc.AuthenticationException;
4+
import org.apache.shiro.authc.AuthenticationInfo;
5+
import org.apache.shiro.authc.AuthenticationToken;
6+
import org.apache.shiro.authc.SimpleAuthenticationInfo;
7+
import org.apache.shiro.authc.UnknownAccountException;
8+
import org.apache.shiro.authz.AuthorizationInfo;
9+
import org.apache.shiro.realm.AuthorizingRealm;
10+
import org.apache.shiro.subject.PrincipalCollection;
11+
12+
/**
13+
* @author threedr3am
14+
*/
15+
public class MyRealm extends AuthorizingRealm {
16+
@Override
17+
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
18+
return null;
19+
}
20+
@Override
21+
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
22+
String username = (String) token.getPrincipal();
23+
if (!"threedr3am".equals(username)) {
24+
throw new UnknownAccountException("账户不存在!");
25+
}
26+
return new SimpleAuthenticationInfo(username, "123456", getName());
27+
}
28+
}

0 commit comments

Comments
 (0)