记一次Shiro反序列化渗透测试 - enemy

Nmap scan report for xxx.xxx.1.59
Host is up (0.017s latency).
Not shown: 997 filtered ports
PORT     STATE  SERVICE    VERSION
80/tcp   open   http       nginx 1.18.0
|_http-server-header: nginx/1.18.0
443/tcp  open   ssl/https
| fingerprint-strings:
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, RTSPRequest:
|     HTTP/1.1 400
|     Date: Thu, 07 Jan 2021 11:52:52 GMT
|     Connection: close
|   FourOhFourRequest, HTTPOptions:
|     HTTP/1.1 404
|     Content-Length: 0
|     Date: Thu, 07 Jan 2021 11:52:47 GMT
|     Connection: close
|   GetRequest:
|     HTTP/1.1 404
|     Content-Length: 0
|     Date: Thu, 07 Jan 2021 11:52:46 GMT
|     Connection: close
|   Kerberos, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServerCookie, X11Probe:
|     HTTP/1.1 400
|     Date: Thu, 07 Jan 2021 11:52:53 GMT
|     Connection: close
|   tor-versions:
|     HTTP/1.1 400
|     Date: Thu, 07 Jan 2021 11:52:47 GMT
|_    Connection: close
|_http-title: Site doesn't have a title.
| ssl-cert: Subject: commonName=*.dzzgsw.com/organizationName=\xE4\xB8\xAD\xE5\x9B\xBD\xE5\xB7\xA5\xE4\xBA\xBA\xE5\x87\xBA\xE7\x89\x88\xE7\xA4\xBE/stateOrProvinceName=\xE5\x8C\x97\xE4\xBA\xAC\xE5\xB8\x82/countryName=CN
| Subject Alternative Name: DNS:*.dzzgsw.com, DNS:dzzgsw.com
| Not valid before: 2020-03-30T00:00:00
|_Not valid after:  2022-03-30T12:00:00
|_ssl-date: 2021-01-07T11:53:21+00:00; -18m38s from scanner time.
8080/tcp closed http-proxy

var fs = require('fs');
var webserver = require('webserver');
server = webserver.create();

var logfile = 'jsEncrypter.log';
var host = '127.0.0.1';
var port = '1664';

**/* 1.在这引入实现加密所有js文件,注意引入顺序和网页一致 */
//var wasSuccessful = phantom.injectJs('crypto-js.js');/* 引入实现加密的js文件*/**

// loadScript("script-2.js");
// loadScript("script-n.js");
/**********************************************/

function loadScript(scriptName) {
    var isSuccess = phantom.injectJs(scriptName);
    if(isSuccess){
        console.log("[*] load " + scriptName + " successful")
    }else{
        console.log("[!] load " + scriptName + " fail")
        console.log("[*] phantomjs server exit");
        phantom.exit();
    }
}

// var key = CryptoJS.enc.Utf8.parse("PBLUREBUWNXCXHRQ"); //16位
// var iv = CryptoJS.enc.Utf8.parse("1234567812345678");
function jsEncrypt(burp_payload){
    var new_payload;
    **/* 2.在这里编写调用加密函数进行加密的代码,并把结果赋值给new_payload */**
    **// 编辑 加密函数的位置**
    **/*********************************************************/**
    return new_payload;
}

console.log("[*] Phantomjs server for jsEncrypter started successfully!");
console.log("[*] address: http://"+host+":"+port);
console.log("[!] ^_^");

var service = server.listen(host+':'+port,function(request, response){
    try{
        if(request.method == 'POST'){
            var payload = request.post['payload'];
            var encrypt_payload = jsEncrypt(payload);
            var log = payload + ':' + encrypt_payload;
            console.log('[+] ' + log);
            fs.write(logfile,log + '\n', 'w+');
            response.statusCode = 200;
            response.setEncoding('UTF-8');
            response.write(encrypt_payload.toString());
            response.close();
        }else{
              response.statusCode = 200;
              response.setEncoding('UTF-8');
              response.write("^_^\n\rhello jsEncrypter!");
              response.close();
        }
    }catch(e){
        //console.log('[Error]'+e.message+' happen '+e.line+'line');
        console.log('\n-----------------Error Info--------------------');
        var fullMessage = "Message: "+e.toString() + ':'+ e.line;
        for (var p in e) {
            fullMessage += "\n" + p.toUpperCase() + ": " + e
;
        } 
        console.log(fullMessage);
        console.log('---------------------------------------------');
        response.statusCode = 200;
        response.setEncoding('UTF-8');
        response.write(fullMessage);
        response.close();
        console.log('[*] phantomJS exit!');
        phantom.exit();
    }   
});