Zkar : A Java Serialization Protocol Analysis Tool Implement In Go

0
17

ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress, so no complete API document and contribution guide.

ZKar provides:

  • A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required
  • From the Java serialization protocol to a Go struct
  • A Go library that can manipulate the Java serialization data
  • WIP: ysoserial implement in Go
  • WIP: Java class bytecodes parser, viewer and manipulation
  • WIP: An implementation of RMI/LDAP in Go

Installing

Using ZKar is easy. use go get to install the ZKar along with the library and its dependencies:

go get -u github.com/phith0n/zkar

Next, use github.com/phith0n/zkar/* in your application:

package main
import (
“fmt”
“github.com/phith0n/zkar/serz”
“io/ioutil”
“log”
)
func main() {
data, _ := ioutil.ReadFile(“./testcases/ysoserial/CommonsCollections6.ser”)
serialization, err := serz.FromBytes(data)
if err != nil {
log.Fatal(“parse error”)
}
fmt.Println(serialization.ToString())
}

Command line utility tool

ZKar also provides a command line utility tool that you can use it directly:

$ go run main.go
NAME:
zkar – A Java serz tool
USAGE:
main [global options] command [command options] [arguments…]
COMMANDS:
generate generate Java serz attack payloads
dump parse the Java serz streams and dump the struct
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
–help, -h show help (default: false)

For example, you are able to dump the payload CommonsBeanutils3 from ysoserial like:

$ go run main.go dump -f “$(pwd)/testcases/ysoserial/CommonsBeanutils3.ser”

Tests

ZKar is a well-tested tool that passed all ysoserial generated gadgets parsing and rebuilding tests. It means that gadget generating by ysoserial can be parsed by ZKar, and parsed struts can be converted back into bytes string which is equal to the original one.

GadgetPackageParseRebuildParse Time
AspectJWeaverysoserial80.334µs
BeanShell1ysoserial782.613µs
C3P0ysoserial98.321µs
Click1ysoserial573.298µs
Clojureysoserial72.415µs
CommonsBeanutils1ysoserial461.15µs
CommonsCollections1ysoserial64.484µs
CommonsCollections2ysoserial508.918µs
CommonsCollections3ysoserial564.071µs
CommonsCollections4ysoserial535.449µs
CommonsCollections5ysoserial137.609µs
CommonsCollections6ysoserial68.753µs
CommonsCollections7ysoserial178.549µs
FileUpload1ysoserial35.39µs
Groovy1ysoserial150.991µs
Hibernate1ysoserial789.674µs
Hibernate2ysoserial168.624µs
JBossInterceptors1ysoserial632.581µs
JRMPClientysoserial32.967µs
JRMPListenerysoserial38.263µs
JSON1ysoserial2.157225ms
JavassistWeld1ysoserial468.596µs
Jdk7u21ysoserial355.01µs
Jython1ysoserial216.862µs
MozillaRhino1ysoserial1.775193ms
MozillaRhino2ysoserial409.124µs
Myfaces1ysoserial22.997µs
Myfaces2ysoserial38.131µs
ROMEysoserial485.804µs
Spring1ysoserial797.469µs
Spring2ysoserial358.041µs
URLDNSysoserial21.502µs
Vaadin1ysoserial438.729µs
Wicket1ysoserial23.509µs
JDK8u20*pwntester529.3µs

Notice: For parsing JDK8u20 payload, you should add --jdk8u20 flag to dump command. As the payload is not a valid serialized data stream, it’s necessary to tell ZKar patches the data through this flag.

LEAVE A REPLY

Please enter your comment!
Please enter your name here