Java unmarshalling Security-attack Hessian protocol __java

0x00 Hessian Protocol resolutionHessian is a lightweight Java deserialization framework, compared to Java native serialization, Hessian is more efficient and well suited for binary data transmission. Since it is a serialization/deserialization framework, Hessian also has a problem with deserialization command execution, which is reflected in the Marshalsec tool. Here's an interesting point, in the Hessian framework, the Ysoserial framework provides the gadget is not available, you will find that the Hessian generated serialization data, that is, the writeobject when the window directly to the error, this is why. Taking Groovy1 this gadget as an example, let's take a look at Ysoserial's gadgets performance in Hessian:

This code generated Groovy1 this object, and then dropped into the Hessian serialization and deserialization process, in fact, here in the writeobject part of the trigger Rce, became a day of their own vulnerabilities, why is this. In fact, this is related to the serialization implementation of Hessian, look at the source code:
When Hessian the object, it extracts the object's fields and then executes the serialization operation, noting that the membervalues get method is directly invoked, triggering the convertedclosure invoke method ahead of time. This results in a direct failure of the serialization process. These gadgets of Ysoserial are basically based on the native Java deserialization process, Hessian is a different library from native serialization, so ysoserial gadgets is not available here.
0x01 Gadget principle Analysis in order to attack the Hessian deserialization process, a special gadget is required, and there are 5 marshalsec available in the gadgets tool. respectively: Rome xbean Resin springpartiallycomparableadvisorholder springabstractbeanfactorypointcutadvisor Here to Rome this gadget analysis, the code is as follows:

(1) First create a Tostringbean object item, set its Beanclass and obj properties to Jdbcrowsetimpl (2) and then create a Equalsbean object root, put this item in (3) Finally, the root is placed in a hashmap, where the Jdkutil.makemap method uses reflection to create an array to prevent the gadget from triggering the put method to cause rce.

The Tostringbean object has a ToString method that calls the full getter method of its Beanclass field, set here to Jdbcrowsetimpl, A getter called Getdatabasemetadata of this class invokes the Connect method, which is to trigger the rce by means of lookup.

And Equalbean has a hashcode method, which is triggered by a hash (obj), which invokes the object's ToString () method.

Let's take a look at how the command execution is triggered, and the process is interesting. Hessian when dealing with map deserialization, the Mapdeserializer Readmap method is invoked, where the HashMap put method is invoked

The put method calls the hash (key) Compute object hash, which is actually called the Equalbean hashcode, and then calls the Tostringbean tostring method, All getter methods for Jdbcrowsetimpl are called in the Tostringbean.tostring method, where lookup is triggered when the Getdatabasemetadata method is invoked, which completes the Jndi triggering rce.

0x02 Dubbo Exploit Dubbo is an SOA framework for service management, registration, discovery, and invocation functions. The following diagram is the Dubbo diagram of each module:

It can be understood that the method above provider is called by consumer a method that is remotely invoked via RPC. Since it is a remote invocation, it is unavoidable to use object serialization and deserialization, and Dubbo is no exception. When configuring provider, you can select several different protocols, corresponding to different serialization methods, the default support Dubbo protocol, configured as follows:

Historically, this place has also been vulnerable, that is, from the consumer end of the method to specify Serialization=java to modify the provider end of the deserialization method for Java native deserialization, This allows you to use the gadgets in ysoserial to attack Dubbo, but the vulnerability was fixed in version 2.5.9. Today, however, we are directly attacking the process of Hessian deserialization. The attack scenario is as follows: Provider and registry are open to the outside world, and malicious consumer can execute arbitrary commands on provider machines through this attack method. The recurrence code is as follows:

The payload is constructed directly by hand, and can be triggered by invoking the remote method to pass the object past.
0x03 Summary of Marshal and Unmarshal is actually a much broader attack surface than traditional serialization because it involves many ways to save and restore objects, such as JSON, YAML, Hessian, and so on. and the implementation of each serialization is different, so gadgets is also more flexible and easy to find, you can foresee more than 2018 years will appear more gadgets to broaden the field of attack surface.