nccgroup / freddy Goto Github PK

Automatically identify deserialisation issues in Java and .NET applications by using active and passive scans

Home Page: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/june/finding-deserialisation-issues-has-never-been-easier-freddy-the-serialisation-killer/

License: GNU Affero General Public License v3.0

Java 99.37% HTML 0.63%

freddy's Introduction

Freddy the Serial(isation) Killer - Deserialization Bug Finder

A Burp Suite extension to aid in detecting and exploiting serialisation libraries/APIs.

This useful extension was originally developed by Nick Bloor (@nickstadb) for NCC Group and is mainly based on the work of Alvaro Muñoz and Oleksandr Mirosh, Friday the 13th: JSON Attacks, which they presented at Black Hat USA 2017 and DEF CON 25. In their work they reviewed a range of JSON and XML serialisation libraries for Java and .NET and found that many of them support serialisation of arbitrary runtime objects and as a result are vulnerable in the same way as many serialisation technologies are - snippets of code (POP gadgets) that execute during or soon after deserialisation can be controlled using the properties of the serialized objects, often opening up the potential for arbitrary code or command execution.

Further modules supporting more formats including YAML and AMF are also included, based on the paper Java Unmarshaller Security - Turning your data into code execution and tool marshalsec by Moritz Bechler.

This Burp Suite extension implements both passive and active scanning to identify and exploit vulnerable libraries.

Freddy Features

Passive Scanning

Freddy can passively detect the use of potentially dangerous serialisation libraries and APIs by watching for type specifiers or other signatures in HTTP requests and by monitoring HTTP responses for exceptions issued by the target libraries. For example the library FastJson uses a JSON field $types to specify the type of the serialized object.

Active Scanning

Freddy includes active scanning functionality which attempts to both detect and, where possible, exploit affected libraries.

Active scanning attempts to detect the use of vulnerable libraries using three methods: exception-based, time-based, and Collaborator-based.

Exception Based

In exception-based active scanning, Freddy inserts data into the HTTP request that should trigger a known target-specific exception or error message. If this error message is observed in the application's response then an issue is raised.

Time Based

In some cases time-based payloads can be used for detection because operating system command execution is triggered during deserialisation and this action blocks execution until the OS command has finished executing. Freddy uses payloads containing ping [-n|-c] 21 127.0.0.1 in order to induce a time delay in these cases.

Collaborator Based

Collaborator-based payloads work either by issuing a nslookup command to resolve the Burp Suite Collaborator-generated domain name, or by attempting to load remote classes from the domain name into a Java application. Freddy checks for new Collaborator issues every 60 seconds and marks them in the issues list with RCE (Collaborator).

Supported Targets

The following targets are currently supported (italics are new in v2.0):

Java

BlazeDS AMF 0 (detection, RCE)
BlazeDS AMF 3 (detection, RCE)
BlazeDS AMF X (detection, RCE)
Burlap (detection, RCE)
Castor (detection, RCE)
FlexJson (detection)
Genson (detection)
Hessian (detection, RCE)
Jackson (detection, RCE)
JSON-IO (detection, RCE)
JYAML (detection, RCE)
Kryo (detection, RCE)
Kryo using StdInstantiatorStrategy (detection, RCE)
ObjectInputStream (detection, RCE)
Red5 AMF 0 (detection, RCE)
Red5 AMF 3 (detection, RCE)
SnakeYAML (detection, RCE)
XStream (detection, RCE)
XmlDecoder (detection, RCE)
YAMLBeans (detection, RCE)

.NET

BinaryFormatter (detection, RCE)
DataContractSerializer (detection, RCE)
DataContractJsonSerializer (detection, RCE)
FastJson (detection, RCE)
FsPickler JSON support (detection)
FsPickler XML support (detection)
JavascriptSerializer (detection, RCE)
Json.Net (detection, RCE)
LosFormatter (detection, RCE) - Note not a module itself, supported through ObjectStateFormatter
NetDataContractSerializer (detection, RCE)
ObjectStateFormatter (detection, RCE)
SoapFormatter (detection, RCE)
Sweet.Jayson (detection)
XmlSerializer (detection, RCE)

Released under agpl-3.0, see LICENSE for more information

Building freddy

Freddy uses the gradle build system. In order to build the jar, you only need to run gradle jar in the root. This will run the tests and if everything is correct will create the jar file in the build/libs directory.

freddy's People

Contributors

Stargazers

Watchers

Forkers

portswigger techlord-rce vysecurity 0c0c0f 5up3rc shengqi158 bipabo1l c002 kyawthiha7 iamtutu pygain11 mustash avaudioplayer orf53975 lx277856602 minkione w00t3k m00zh33 dannymas en0f sry309 jiangsi520 fjsnogueiracx ver007 nickstadb ch4p34un0ir hai0378 threezerobravoteam mmg1 1052847690 raystyle bravery9 kenanat archangel-m777 snollyg0st3r sasqwatch kaide0521 fashaikh osgirl superdong0 joincode bigbrobro modulexcite ibadr3 qsdj killvxk materaj2 stjordanis lw1988 sucof akshayjaing freeide michael1981 magiczer0 deepbreath axiom215 xceptioncode inboxs tgsyn attackgithub imulmul xmrseo arya772 wutenglan hello-xbugs anduinwrynn kakuye blockchainguard jieonestr 5l1v3r1 kiss404 coreyd97 fakefishinsky hamid-k abdilahrf runonceex functfan devsecops-src ramikan polling-repo-continua affilares standj7 hatchetxuexi nosorry gh0st0ne plenumlab bbhunter securityanalysts wh1tenoise istoliving huangzccn qq529952515

freddy's Issues

java.lang.OutOfMemoryError: GC overhead limit exceeded

I’m facing some memory problems during large Active scans, when I have Freddy enabled. It fails after a couple of hours, on a single thread.
I'm running Burp from CMD:
"C:\Program Files\BurpSuitePro\jre\bin\java.exe" -jar "C:\Program Files\BurpSuitePro\burpsuite_pro.jar" -Xmx6g -Djava.net.preferIPv4Stack=true

I'm running Burp on a single thread, with Private collaborator server configured. Every time I switch off this extension, everything works fine and memory imprint is not so large. At this moment, even with limiting java to 6GB, the Burp process takes 20+ GB. I would like to give you more information, so what else could I supply to you?
OS: Windows Server 2016, build 1607
RAM: 78GB
CPU: Intel Xeon E5-2683 v3 @ 2GHz

NullPointer during startup

Hi, when starting Burp and the extension was already in the list of extensions to be started, I get a

java.lang.NullPointerException
        at nb.freddy.FreddyCollaboratorThread.run(FreddyCollaboratorThread.java:68)

It's the most current release (2.2.1) and Burp 2.0.17.

Scanning Locations Not Specified

The extension, as ran on Kali fully up to date (7/12/2020) and Burp fully up to date (2020.6) when sending a request to Intruder and manually specifying locations to run autoscans on is injecting payloads into locations not specified.

To reproduce simply send a content-type application/json message with several parameter and value pairs and specify the locations and right click and sent to an auto-scan that is running or create a new one to send it to.

Observe requests being sent in the session tracer or by passing to another upstream proxy.

This is not desired behavior because it wastes time, and it could have potentially detrimental affects to the environment under test.

how to build the project

Hi,

The plugin is not in Burp BAPP anymore. Can you provide a jar file or provides details on how to build one?

Thanks.

Since the last update the extension doesn't report any issues

Tried to trigger the issue manually and didn't work, extension output tab clear, error tab clear

Scan any target
Copy a burpcollaborator from any request sent by the extension
Do nslookup burpcollaborator
Issue doesn't appear

java.lang.OutOfMemoryError: GC overhead limit exceeded

After some time of scanning the Java garbage collector drops an out of memory exception, probably because of an active scan:

java.lang.RuntimeException: java.lang.OutOfMemoryError: GC overhead limit exceeded
at burp.cb.a(Unknown Source)
at burp.xcf.makeHttpRequest(Unknown Source)
at burp.z3f.makeHttpRequest(Unknown Source)
at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:802)
at nb.freddy.Freddy.doActiveScan(Freddy.java:428)
at burp.jtc.run(Unknown Source)
at java.lang.Thread.run(Thread.java:748)

java.lang.IllegalStateException when Burpsuite Collaborator is disabled

Hi,

The extension crashes with java.lang.IllegalStateException when Burp Collaborator is explicitly disabled in the Project options ("Don't use Burp Collaborator" radio box) during an active scan.

java.lang.IllegalStateException: Burp Collaborator is disabled in the Project options
	at burp.uvf.a(Unknown Source)
	at burp.uvf.generatePayload(Unknown Source)
	at burp.zv.generatePayload(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:871)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:386)
	at burp.r5d.run(Unknown Source)
	at java.lang.Thread.run(Thread.java:748)

I've put together a monkey patch for this issue (i.e. it's too sketchy for a PR): master...tgsyn:no-burpcollab

Freddy version 2.2.2
BurpSuite version 1.7.37

Test cases

To ensure that the functionality stays stable there need to be some test cases.

Intruder Payloads not present

In the documentation it states that there are two Burp Intruder payload sets.

When I go to intruder, and choose "Payload Sets" and then "Payload Type". I do not see anything for Freddy. When I choose "Extension-generated" and then click "Select generator" I do not have Freddy as an option.

What Java Version does this plugin use ?

When I install this plugin,it has a errors.
java.lang.UnsupportedClassVersionError: burp/BurpExtender has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0 at java.lang.ClassLoader.defineClass1(Native Method) at java.lang.ClassLoader.defineClass(ClassLoader.java:763) at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142) at java.net.URLClassLoader.defineClass(URLClassLoader.java:467) at java.net.URLClassLoader.access$100(URLClassLoader.java:73) at java.net.URLClassLoader$1.run(URLClassLoader.java:368) at java.net.URLClassLoader$1.run(URLClassLoader.java:362) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:361) at java.lang.ClassLoader.loadClass(ClassLoader.java:424) at java.lang.ClassLoader.loadClass(ClassLoader.java:357) at java.lang.Class.forName0(Native Method) at java.lang.Class.forName(Class.java:348) at burp.dg3.a(Unknown Source) at burp.dg3.<init>(Unknown Source) at burp.b8r.a(Unknown Source) at burp.ba8.lambda$panelLoaded$0(Unknown Source) at java.lang.Thread.run(Thread.java:748) The extension could not be loaded because it requires a later version of Java. To use this extension you will need to start Burp with the required or later Java version.

not working in burp 2.1.0

Payloads using hostname instead of collaborator

Hi,

When I choose the Freddy - RCE Detection payloads in Intruder, the payload uses the hostname of the host I am testing instead of the Collaborator. This might be related to #5 since I also configured a private burp collaborator instance.

I am using the version that is in the BApp Store -> 2.0

Extension generated task deleted

During a pentest of a soap interface I started getting this error message in the logs:

	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:882)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:896)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
java.lang.RuntimeException: Extension generated task deleted
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at burp.djm.makeHttpRequest(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:882)
java.lang.RuntimeException: Extension generated task deleted
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at java.base/java.lang.Thread.run(Thread.java:834)
	at burp.cz0.run(Unknown Source)
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:832)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.lang.Thread.run(Thread.java:834)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:882)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at burp.cz0.run(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:832)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.lang.Thread.run(Thread.java:834)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:832)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:832)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
java.lang.RuntimeException: Extension generated task deleted
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at burp.djm.makeHttpRequest(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:896)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.lang.Thread.run(Thread.java:834)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:882)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:896)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:832)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)
java.lang.RuntimeException: Extension generated task deleted
	at burp.djm.makeHttpRequest(Unknown Source)
	at nb.freddy.modules.FreddyModuleBase.doActiveScan(FreddyModuleBase.java:882)
	at nb.freddy.Freddy.doActiveScan(Freddy.java:388)
	at burp.cz0.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)

Not sure how I can reproduce it, sorry to not have more right now. Using the latest and greatest Burp (2.0.16).

False Positive: Detected Deserialization RCE Jackson & JSON-IO found in .NET app

After executing an Active Scan on a web app built full-stack with .NET (ASP.NET MVC, ASP.NET Web API), Freddy reported confirmed findings on both "Detected Deserialization RCE: Jackson" and "Detected Deserialization RCE: JSON-IO" which are only applicable to vulnerable Java apps

how use

how use freddy? can u make a tutorial ?

Payloads not taking private collaborator server settings

Hi,
In Logger++, I noticed that burpcollaborator.net is being used, for example in payload:

However, I have Burp configured with Private Collaborator server location (true, only by IP address, whereas you use domain). The health check of the Collaborator instance is successful.
Also, this issue is shown in Alerts, because the official collaborator instance is not reachable from the environment I test, showing:

Could you please have a look and uphold the Private collaborator server deployment in Freddy payloads? Thanks:)

how install?

How to translate the generated jar file

I am a novice. I don't know how to translate the generated jar file.