Home Page

From cab74a4eaaf4ec18433336c25afcea3fa390761b Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 24 Mar 2023 17:51:29 +0800 Subject: [PATCH 1/7] fix #70 --- java-sec-code.iml | 4 +- pom.xml | 9 +++- src/main/java/org/joychou/controller/Rce.java | 14 ++++++ src/main/java/org/joychou/controller/XXE.java | 2 +- src/main/resources/templates/index.html | 44 +++++++++---------- 5 files changed, 48 insertions(+), 25 deletions(-) diff --git a/java-sec-code.iml b/java-sec-code.iml index a20476ae..6946c265 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -212,7 +212,7 @@ - + @@ -228,5 +228,7 @@ + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 9ee03372..8da3449d 100644 --- a/pom.xml +++ b/pom.xml @@ -260,7 +260,7 @@ org.projectlombok lombok - 1.18.16 + 1.18.20 provided @@ -330,6 +330,13 @@ 1.4.13 + + + org.postgresql + postgresql + 42.3.1 + + diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java index 6d6a3417..a87a9672 100644 --- a/src/main/java/org/joychou/controller/Rce.java +++ b/src/main/java/org/joychou/controller/Rce.java @@ -1,6 +1,7 @@ package org.joychou.controller; import groovy.lang.GroovyShell; +import lombok.extern.slf4j.Slf4j; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RestController; @@ -14,6 +15,7 @@ import java.io.BufferedInputStream; import java.io.BufferedReader; import java.io.InputStreamReader; +import java.sql.DriverManager; /** @@ -21,6 +23,7 @@ * * @author JoyChou @ 2018-05-24 */ +@Slf4j @RestController @RequestMapping("/rce") public class Rce { @@ -128,5 +131,16 @@ public void groovyshell(String content) { groovyShell.evaluate(content); } + /** + * CVE-2022-21724 + */ + @RequestMapping("/postgresql") + public void postgresql(String jdbcUrlBase64) throws Exception{ + byte[] b = java.util.Base64.getDecoder().decode(jdbcUrlBase64); + String jdbcUrl = new String(b); + log.info(jdbcUrl); + DriverManager.getConnection(jdbcUrl); + } + } diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java index 36372727..08f3073e 100644 --- a/src/main/java/org/joychou/controller/XXE.java +++ b/src/main/java/org/joychou/controller/XXE.java @@ -234,7 +234,7 @@ public String DigesterSec(HttpServletRequest request) { * Use request.getInputStream to support UTF16 encoding. */ @RequestMapping(value = "/DocumentBuilder/vuln", method = RequestMethod.POST) - public String DocumentBuilderVuln01(HttpServletRequest request) { + public String DocumentBuilderVuln(HttpServletRequest request) { try { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); DocumentBuilder db = dbf.newDocumentBuilder(); diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html index 8511d5fd..057aa067 100644 --- a/src/main/resources/templates/index.html +++ b/src/main/resources/templates/index.html @@ -5,29 +5,29 @@ Home Page -

Hello .

Welcome to login java-sec-code application. Application Infomation

- Swagger - CmdInject - JSONP - Picture Upload - File Upload - Cors - PathTraversal - PathTraversal + * T(java.lang.Runtime).getRuntime().exec("open -a Calculator") */ - @GetMapping("/spel/vuln") - public String rce(String expression) { + @RequestMapping("/spel/vuln1") + public String spel_vuln1(String value) { ExpressionParser parser = new SpelExpressionParser(); - // fix method: SimpleEvaluationContext - return parser.parseExpression(expression).getValue().toString(); + return parser.parseExpression(value).getValue().toString(); + } + + /** + * Use Spel to execute cmd.

RememberMe

+ RememberMe +

Fix method by using class and method blacklist. It may exist bypass.

+ * + *

Default blacklist: + *

System.class.getName() + ".exit"
ProcessBuilder.class.getName() + ".start"
Method.class.getName() + ".invoke"
Class.class.getName() + ".forName"
ClassLoader.class.getName() + ".loadClass"
ClassLoader.class.getName() + ".findClass"
ClassLoader.class.getName() + ".defineClass"
ClassLoader.class.getName() + ".getSystemClassLoader"
javax.naming.InitialContext.lookup
com.sun.rowset.JdbcRowSetImpl.setDataSourceName
com.sun.rowset.JdbcRowSetImpl.setAutoCommit
QLExpressRunStrategy.class.getName() + ".setForbidInvokeSecurityRiskMethods"
jdk.jshell.JShell.create
javax.script.ScriptEngineManager.getEngineByName
org.springframework.jndi.JndiLocatorDelegate.lookup

+ *

+ */ + @Test + public void sec02() throws Exception { + System.out.println(poc); + ExpressRunner runner = new ExpressRunner(); + QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true); + IExpressContext context = new DefaultContext<>(); + Object r = runner.execute(poc, context, null, true, false); + System.out.println(r); + } + + + /** + *

Fix method by using sandbox.

+ */ + @Test + public void sec03() throws Exception { + System.out.println(poc); + ExpressRunner runner = new ExpressRunner(); + QLExpressRunStrategy.setSandBoxMode(true); + IExpressContext context = new DefaultContext<>(); + Object r = runner.execute(poc, context, null, true, false); + System.out.println(r); + } +} diff --git a/src/main/test/org/test/XStreamTest.java b/src/main/test/org/test/XStreamTest.java new file mode 100644 index 00000000..a5375ebf --- /dev/null +++ b/src/main/test/org/test/XStreamTest.java @@ -0,0 +1,70 @@ +package org.test; + +import com.thoughtworks.xstream.XStream; +import com.thoughtworks.xstream.io.xml.DomDriver; +import com.thoughtworks.xstream.security.AnyTypePermission; +import org.joychou.dao.User; +import org.junit.Test; + +public class XStreamTest { + + private static final String poc_xml = "\n" + + " foo\n" + + " \n" + + " java.lang.Comparable\n" + + " \n" + + " \n" + + " \n" + + " Open\n" + + " -a\n" + + " Calculator\n" + + " \n" + + " \n" + + " start\n" + + " \n" + + " \n" + + ""; + + + /** + * XStream basic usage. + */ + @Test + public void basicUsage() { + User user = new User(); + user.setId(0); + user.setUsername("admin"); + + XStream xstream = new XStream(new DomDriver()); + String xml = xstream.toXML(user); // Serialize + System.out.println(xml); + + // High version xstream needs set allowTypes + xstream.allowTypes(new Class[]{User.class}); + user = (User) xstream.fromXML(xml); // Deserialize + System.out.println(user.getId() + ": " + user.getUsername()); + } + + /** + * Command execute + */ + @Test + public void vuln01() { + System.out.println(poc_xml); + XStream xstream = new XStream(); + xstream.addPermission(AnyTypePermission.ANY); // Insecure configuration + xstream.fromXML(poc_xml); // Deserialize + } + + + /** + * Security code. XStream version: 1.4.20 + */ + @Test + public void sec01() { + System.out.println(poc_xml); + XStream xstream = new XStream(); + xstream.fromXML(poc_xml); // Deserialize + } + +} From 1d06b16c2a7acac439783e89e1882f82904edc9d Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 28 Jun 2024 09:48:48 +0800 Subject: [PATCH 6/7] Add alibaba recruitment. --- README.md | 10 ++-------- README_zh.md | 13 ++++++------- 2 files changed, 8 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 0e8c074b..a6b30f4d 100644 --- a/README.md +++ b/README.md @@ -205,12 +205,6 @@ Core developers : [JoyChou](https://github.com/JoyChou93), [liergou9981](https:/ Other developers: [lightless](https://github.com/lightless233), [Anemone95](https://github.com/Anemone95), [waderwu](https://github.com/waderwu). -## Donate +## Support -If you like the poject, you can donate to support me. With your support, I will be able to make `Java sec code` better 😎. - -### Alipay - -Scan the QRcode to support `Java sec code`. - - Alipay QRcode

+If you like the poject, you can star java-sec-code project to support me. With your support, I will be able to make `Java sec code` better 😎. diff --git a/README_zh.md b/README_zh.md index e2d5727c..b5c658c3 100644 --- a/README_zh.md +++ b/README_zh.md @@ -4,6 +4,10 @@ [英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) 😋 +## 招聘 + +[Alibaba招聘-安全攻防/研究（P5-P7）](https://github.com/JoyChou93/java-sec-code/wiki/Alibaba-Purple-Team-Job-Description) + ## 介绍该项目也可以叫做Java Vulnerability Code(Java漏洞代码)。 @@ -195,12 +199,7 @@ Tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会核心开发者： [JoyChou](https://github.com/JoyChou93).其他开发者：[lightless](https://github.com/lightless233), [Anemone95](https://github.com/Anemone95)。欢迎各位提交PR。 -## 捐赠 - -如果你喜欢这个项目，你可以捐款来支持我。有了你的支持，我将能够更好地制作`Java sec code`项目。 - -### Alipay +## 支持 -扫描支付宝二维码支持`Java sec code`。 +如果你喜欢这个项目，你可以star该项目支持我。有了你的支持，我将能够更好地制作`Java sec code`项目。 - Alipay QRcode

From 4711f4e186258c6e0dd5c3863e7c9592e7e9026a Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 28 Jun 2024 09:52:04 +0800 Subject: [PATCH 7/7] Add alibaba recruitment. --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index a6b30f4d..c1f2eb91 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,11 @@ Java sec code is a very powerful and friendly project for learning Java vulnerab [中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README_zh.md) 😋 +## Recruitment + +[Alibaba-Security attack and defense/research（P5-P7）](https://github.com/JoyChou93/java-sec-code/wiki/Alibaba-Purple-Team-Job-Description) + + ## Introduce This project can also be called Java vulnerability code.