Nytro Posted March 5, 2016 Report Posted March 5, 2016 Java Deserialization Attacks with Burp Eric Gruber | March 2, 2016 Introduction This blog is about Java deserialization and the Java Serial Killer Burp extension. If you want to download the extension and skip past all of this, head to the Github page here. The recent Java deserialization attack that was discovered has provided a large window of opportunity for penetration testers to gain access to the underlying systems that Java applications communicate with. For the majority of the applications we see, we can simply proxy the connection between the application and the server to view the serialized body of the HTTP request and HTTP response, assuming that HTTP is the protocol that is being used for communication. For this blog, HTTP is going to be assumed and to perform any type of proxying for HTTP, we will use Burp. Burp Proxy Here’s a simple example what a Burp proxied HTTP request with a serialized Java object in its body looks like: In this example we have a serialized object called State that is comprised of two Strings, capitol (spelled wrong in the example) and nicknames. From here, we can manipulate the request by sending it to the Repeater tab. Generating Serialized Exploits There are a few tools out there that will generate serialized Java objects that are able to exploit vulnerable software. I’m a big fan of Chris Frohoff’s ysoserial (https://github.com/frohoff/ysoserial.git). He has payload generators for nine exploitable software stacks at the time of me writing this. Simply running the jar file with the payload type and command to execute will generate the serialized object for you. Just make sure you output it to a file: java -jar ./ysoserial-0.0.4-all.jar CommonsCollections1 'ping netspi.com' > payload We can then copy the serialized output into Burp using the paste from file context menu item: Which will result in the following: Generating Serialized Exploits in Burp Ysoserial works well enough, but I like to optimize my exploitation steps whenever possible. This includes removing the need to go back and forth between the command line and Burp. So I created the Burp extension Java Serial Killer to perform the serialization for me. It essentially is a modified Repeater tab that uses the payload generation from ysoserial. To use Java Serial Killer, right click on a POST request with a serialized Java object in the body and select theSend to Java Serial Killer item. A new tab will appear in Burp with the request copied over into a new message editor window. In the Java Serial Killer tab there are buttons for sending requests, serializing the body, selecting a payload type, and setting the command to run. For an example, say we want to ping netspi.com using the CommonsCollections1 payload type, because we know it is running Commons-Collections 3.1. We just set the payload in the drop down menu and then type the command we want and press the serialize button. Pressing the little question mark button will also display the payload types and the software versions they are targeting if you need more information. We now have our command in a serialized object in the request. Pressing the Go button will send the request off and show the response on the right hand side. If you prefer to use Repeater, you can send it to that too. If you want to try another payload, simply select the new payload and hit serialize again. As Chris Frohoff adds more payloads, I plan to update Java Serial Killer accordingly. Conclusion I submitted the plugin to the Burp app store and I don't expect it to take too long to get approved, but if you want to try it out now, you can get it from our Github page (https://github.com/NetSPI/Burp-Extensions/releases). You will need to be running Java 8 for it to work. Sursa: https://blog.netspi.com/java-deserialization-attacks-burp/ Quote
