A method for quickly generating an obfuscated deserialization attack payload

Abstract

The application provides a method for quickly generating an obfuscated deserialization attack payload, comprising the following steps: S1: target system analysis and deserialization protocol identification; S2: malicious class chain detection and utilization class confirmation; S3: automatic construction and adaptation of deserialization call chains; S4: payload obfuscation and execution logic hiding; S5: automatic testing, optimization and antivirus verification; S6: final attack payload generation and delivery adaptation; The application greatly reduces manual intervention, shortens the time for constructing an attack payload, and improves the accuracy and efficiency of construction; Through the obfuscation technology and the dynamic self-adaptive generation mechanism, the concealment of the payload is improved, and the payload can be effectively avoided from being detected by static analysis tools and anti-sandbox systems, thereby significantly improving the success rate of the attack; The application supports multiple languages and multiple protocols, can adaptively adjust the generated attack payload according to different target environments, and makes the attack payload have high universality and flexibility.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a method for quickly generating an obfuscated deserialization attack payload. BACKGROUND

[0002] With the wide application of various distributed systems, microservice architectures and remote invocation mechanisms, serialization and deserialization mechanisms have become common data transmission and state maintenance means in modern software systems. Deserialization technology allows a program to restore external input data to an object structure, thereby enabling the reconstruction of remote data structures and the triggering of execution logic. However, direct deserialization processing without sufficient verification of the safety of the input data can easily be exploited by attackers to construct malicious object chains to trigger arbitrary code execution, thereby forming a deserialization vulnerability. Such vulnerabilities have low attack thresholds, wide damage ranges and complex exploitation chains, and have become a high-frequency means of network security attacks in recent years, widely existing in Java, PHP, Python and other language environments.

[0003] To study and verify the existence of deserialization vulnerabilities, the construction of attack payloads is an indispensable key step in security testing and red team evaluation. In existing technologies, the construction of attack payloads has the following disadvantages:

[0004] High complexity of manually constructing attack payloads: a deep understanding of the object serialization structure of the target language, the vulnerability triggering logic and the bypass protection strategy is required, and security researchers often need to spend a lot of time and effort. When constructing complex object chains or obfuscated code, logical errors are likely to occur, affecting the effectiveness of the attack.

[0005] Gradual improvement of deserialization protection: with the enhancement of security protection mechanisms, traditional attack payloads are easily detected or intercepted, resulting in a decrease in attack efficiency. Researchers are required to constantly innovate and respond more flexibly to new security detection methods.

[0006] Lack of a general, automated payload construction tool: there is a lack of an automated deserialization attack payload generation mechanism that supports multiple language environments and has obfuscation capabilities. SUMMARY

[0007] The purpose of the present application is to solve the problems in the prior art and provide a method for quickly generating an obfuscated deserialization attack payload.

[0008] To achieve the above purpose, the present application adopts the following technical solutions:

[0009] A method for quickly generating an obfuscated deserialization attack payload, comprising the following steps:

[0010] S1: target system analysis and deserialization protocol identification;

[0011] The target system is dynamically probed to identify the entry of the deserialization vulnerability, and whether the target system supports different deserialization protocols is tested; and the version and configuration state of the deserialization library are inferred by analyzing error stack, framework Banner and other information, including the following sub-steps:

[0012] S11: Identify the deserialization entry;

[0013] The common deserialization entries of the target Web application, RPC interface, file upload point, etc. are dynamically probed, and whether the input parameters of each deserialization entry can trigger a deserialization vulnerability is checked to identify the deserialization entry with vulnerability;

[0014] S12: Test whether the target system supports different deserialization protocols;

[0015] The deserialization protocols include Java native serialization, Hessian, JSON, XML, etc.

[0016] The target system is sequentially sent a legal empty object structure conforming to the requirements of each protocol, if the target system responds with an abnormal stack or normal processing flow, the target system supports the deserialization protocol corresponding to the legal empty object structure, if the target system does not respond or crashes, the target system does not support the deserialization protocol corresponding to the legal empty object structure;

[0017] S13: Infer the version and configuration parameter state of the serialization library;

[0018] According to the error stack, framework Banner, type prefix and other information returned by the target system, the version and configuration parameter state of the deserialization library used by the target system are inferred;

[0019] S14: Judge whether the target system is configured with a black and white list mechanism;

[0020] The target system sends a test payload with a dangerous class to the target system according to the known dangerous class structure, and judges whether the target system is configured with a class white list or black list mechanism through echoing or DNS external result; if the target system prevents deserialization of the dangerous class or returns an error prompt, the target system is configured with a class white list or black list mechanism; otherwise, the target system is not configured with a class white list or black list mechanism;

[0021] S15: Deserialization trigger point log backtracking;

[0022] If an exception is thrown during the deserialization process, view the returned exception information, TraceID, etc., backtrack the target system log according to the exception information, TraceID, etc., which contains method name, class name, path, etc. information; extract the deserialization stack information according to the method name, class name, path, etc. information and infer the specific code location where the deserialization operation occurs; confirm whether there is a deserialization vulnerability, etc. by analyzing the code.

[0023] S2: malicious class chain detection and utilization class confirmation;

[0024] including the following sub-steps:

[0025] S21: detecting whether the target system loads a malicious class by using a DNS request;

[0026] Insert DNS query logic in the static code block of the malicious class to be detected through the static block of Java; construct a special serialization payload by taking the malicious class to be detected as a DNS prefix, and deliver the special serialization payload to the target system to monitor whether the target system generates a DNS request to determine whether the target system loads the malicious class, if there is a DNS request, it is determined that the malicious class exists in the target system, and the malicious class is marked as an attackable class; otherwise, the malicious class does not exist in the target system;

[0027] S22: use HTTP channel to detect the loading of the malicious class instead of DNS;

[0028] For environments without DNS access, use HTTP callback mechanism to record class loading requests, set a specific path in the class construction, and send the path to the server controlled by the attacker to replace the DNS channel for data transmission;

[0029] S23: obtain the class that is most likely to become the core node of the attack chain;

[0030] Monitor and record the network behavior, system response time, and whether an abnormal structure appears when the target system loads different classes, and score each class loading process according to the recorded network behavior, system response time, and whether an abnormal structure appears, and obtain the class with the highest score, which is the class that is most likely to become the core node of the attack chain.

[0031] S3: automatic construction and adaptation of deserialization call chain;

[0032] including the following sub-steps:

[0033] S31: match the attack chain template;

[0034] Obtaining the loaded class information in the target environment through dynamic reflection or bytecode analysis tools, and matching the appropriate predefined attack chain template based on the class information and the protocol support of the target environment;

[0035] S32: Dynamic reflection and class adaptation mechanism;

[0036] Using reflection or dynamic proxy technology to handle different class loaders; for multiple class loader environments, dynamically adjust the loader to access the target class;

[0037] If the target class is missing a method, dynamically call or construct an adapted class and method signature through reflection; and adjust the class path and method signature involved in the attack chain according to the actual situation of the target environment;

[0038] S33: Call chain redundancy node optimization processing;

[0039] Identify unnecessary nodes in the call chain, such as log construction and temporary variable construction, remove redundant nodes or combine multiple redundant nodes, optimize the length and trigger conditions of the call chain;

[0040] S34: FuzzDNS result auxiliary verification;

[0041] Record the log information of various class loading and method calling in the target environment through FuzzDNS technology, and verify each node of the generated attack chain to ensure that each node can be executed correctly in the target environment;

[0042] S35: Optimize attack chain through machine learning algorithm;

[0043] Based on historical attack chain execution samples, build a training data set, which contains the paths and execution results of different attack chains;

[0044] Use machine learning algorithm to train model, predict the shortest path and high confidence attack chain combination; through the model obtained by training, predict and generate efficient attack chain;

[0045] S36: Generate multi-layer nested and recursive call chain;

[0046] Through the nested and recursive chain generation mechanism, a multi-layer nested structure of "container class → trigger class → reflection class" is constructed, and a recursive call chain is constructed to adapt to deep structure analysis scenarios.

[0047] S4: Payload obfuscation and execution logic hiding;

[0048] Including the following sub-steps:

[0049] S41: Polymorphic structure generation mechanism;

[0050] Dynamic replacement of variable names, field names in call chain, construction structure deformation, etc. semantic variation objects using code obfuscation tools or custom scripts;

[0051] S42: Bytecode plug-in obfuscation;

[0052] Using bytecode operation libraries such as ASM or Javassist, insert meaningless operations to disturb the analysis of static bytecode by static analysis tools;

[0053] S43: Multi-layer encryption packaging and transmission obfuscation;

[0054] Using Base64 encoding, AES encryption, XOR, and other encryption and encoding methods, multi-layer encryption packaging of serialized results, and combining random prefix, encoding padding, etc. strategy in the transmission process, disguised as a legal data structure;

[0055] S44: Anti-sandbox / anti-RASP behavior injection;

[0056] Insert environment detection code to detect the current running environment, identify whether the running environment is in a sandbox, EDR, RASP, etc. controlled environment, if so, trigger early stop or self-destruction logic; The environment detection code includes System.getenv or java.lang.management, etc.;

[0057] S45: Protocol nesting and pseudo-structure generation;

[0058] Hide the actual malicious serialized data in the parameter name or data format of the request by disguising the malicious payload as a legal HTTP request or XML data;

[0059] S46: Dynamic JAR obfuscator integration;

[0060] Compile the attack code into a JAR file, dynamically compile and obfuscate it by integrating the JAR obfuscator, and dynamically inject the obfuscated JAR file code into the call chain to control the echo behavior.

[0061] S5: Automatic testing, optimization and kill-free verification;

[0062] Including the following sub-steps:

[0063] S51: Sandbox environment execution verification;

[0064] Execute the payload under multiple JVM versions, web application containers, record the execution results and exception stacks of the payload, and verify the effectiveness of the payload by checking whether it can reach a specific code path and whether it can trigger the expected vulnerability or behavior;

[0065] S52: Fuzzing variation generation mechanism;

[0066] Syntax-level mutation and byte-level mutation are performed on the executable payload;

[0067] S53: WAF / EDR interception simulation test;

[0068] Deploy the payload on a test platform containing security components such as WAF, OpenRASP, EDR, etc. to detect whether the payload is effectively intercepted, whether it triggers false positives or false negatives, and score according to the results;

[0069] S54: Environment difference compatibility test;

[0070] Execute the payload on different operating systems and JVM configurations, analyze the execution results under different configurations, mark risk points and provide suggestions for bypass measures;

[0071] S55: Call chain behavior tracking and sandbox comparison;

[0072] Use dynamic analysis tools such as Dynatrace, AppDynamics, Java Flight Recorder, etc. to track the call chain of the payload, compare the execution behavior of the payload with the simulation execution in the sandbox environment, analyze each step in the call chain, locate the execution deviation point, failure reason, echo characteristics, etc.

[0073] S6: Final attack payload generation and delivery adaptation;

[0074] Including the following sub-steps:

[0075] S61: Protocol format adaptation export;

[0076] Serialize the call chain into a legal structure supported by the target protocol, such as Java ObjectStream, Fastjson JSON, XStream XML, Hessian, and encapsulate the serialized call chain data;

[0077] S62: Delivery channel adaptation mechanism;

[0078] According to the characteristics of the target system, identify possible attack payload delivery channels; according to the selected delivery channel, modify the payload format or protocol to meet the transmission requirements of the channel; send the attack payload to the target system through the selected channel;

[0079] The channel includes HTTP parameter injection, file upload, WebSocket message, URL redirection, LDAP request, etc.

[0080] S63: Execution result verification mechanism;

[0081] The attacker judges whether the attack is successful according to whether the echo is echoed after triggering, whether the DNS record is generated, and whether the shell is rebounded, and if the attack is not successful, subsequent processing is carried out through self-destruction and re-throwing mechanisms.

[0082] Compared with the prior art, the method has the advantages that:

[0083] The method greatly reduces manual intervention, shortens the time for constructing the attack payload, and improves the accuracy and efficiency of construction.

[0084] The obfuscation technology and the dynamic self-adaptive generation mechanism improve the concealment of the payload, effectively avoid detection by static analysis tools and anti-sandbox systems, significantly improve the success rate of the attack, support multiple languages and multiple protocols, and adaptively adjust the generated attack payload according to different target environments, so that the attack payload has high universality and flexibility. BRIEF DESCRIPTION OF DRAWINGS

[0085] Figure 1 The method comprises the following steps. DETAILED DESCRIPTION

[0086] In order to further understand the purpose, structure, features, and functions of the present application, the following detailed description is provided in conjunction with the embodiments.

[0087] As shown in Figure 1 A method for quickly generating an obfuscated deserialization attack payload comprises the following steps:

[0088] S1: target system analysis and deserialization protocol identification;

[0089] The target system is dynamically detected to identify the entry of the deserialization vulnerability, test whether the target system supports different deserialization protocols, and analyze the error stack, framework Banner and other information to infer the version and configuration state of the deserialization library, including the following sub-steps:

[0090] S11: identify the deserialization entry;

[0091] The target Web application, RPC interface, file upload point and other common deserialization entries are dynamically detected to identify the deserialization entry with vulnerabilities by checking whether the input parameters of each deserialization entry can trigger the deserialization vulnerability.

[0092] S12: test whether the target system supports different deserialization protocols;

[0093] The deserialization protocols include Java native serialization, Hessian, JSON, XML, etc.

[0094] The target system is sent a legal empty object structure in sequence according to requirements of each protocol, if the target system responds to an abnormal stack or a normal processing flow, the target system supports the deserialization protocol corresponding to the legal empty object structure, if the target system does not respond or crashes, the target system does not support the deserialization protocol corresponding to the legal empty object structure;

[0095] S13: Speculate the serialization library version and configuration parameter state;

[0096] According to the error stack, framework Banner, type prefix and other information returned by the target system, the deserialization library version and configuration parameter state used by the target system are speculated;

[0097] Specifically, the error stack contains stack trace, error type and code location and other information, according to the version number or specific error information contained by the deserialization library during exception handling, the deserialization library version used is inferred;

[0098] The deserialization library version is extracted from the framework Banner by analyzing the response or error information;

[0099] Different versions of the deserialization library use different prefixes to identify the type of a class, and the deserialization library version is speculated according to the type prefix;

[0100] The configuration parameter state is speculated by analyzing the configuration related to the deserialization operation in the target system;

[0101] S14: Judge whether the target system is configured with a black and white list mechanism;

[0102] The target system constructs a test payload according to known dangerous classes, sends the test payload with dangerous classes to the target system, and judges whether the target system is configured with a class white list or black list mechanism through echo or DNS external results; if the target system prevents deserialization of dangerous classes or returns an error prompt, the target system is configured with a class white list or black list mechanism; otherwise, the target system is not configured with a class white list or black list mechanism;

[0103] S15: Deserialization trigger point log backtracking;

[0104] If an exception is thrown during the deserialization process, the returned exception information, TraceID and other information are viewed, the logs of the target system are backtracked according to the exception information, TraceID and other information, the logs contain method name, class name, path and other information; deserialization stack information is extracted according to the method name, class name, path and other information, and the specific code location where the deserialization operation occurs is inferred; by analyzing the code, it is confirmed whether there is a deserialization vulnerability or not.

[0105] By analyzing the deserialization protocol and vulnerability entry of the target system, the attacker can accurately identify the type of vulnerability that may exist in the system and design the attack payload accordingly; not limited to a certain deserialization protocol, the system can be determined whether it supports different types of protocols (such as Java native serialization, Hessian, JSON, XML, etc.) according to the response of the target system, and the attack surface coverage is improved.

[0106] S2: malicious class chain detection and utilization class confirmation;

[0107] Including the following sub-steps:

[0108] S21: detecting whether the target system loads the malicious class by using DNS request;

[0109] Through the static block of Java, the DNS query logic is inserted into the static code block of the malicious class to be detected; the malicious class to be detected is used as a DNS prefix to construct a special serialization payload, and the special serialization payload is delivered to the target system to monitor whether the target system generates a DNS request to determine whether the target system loads the malicious class, if there is a DNS request, it is determined that the malicious class exists in the target system, and the malicious class is marked as an attackable class; otherwise, the malicious class does not exist in the target system;

[0110] S22: use HTTP channel to detect the loading of the malicious class instead of DNS;

[0111] For environments without DNS access, use the HTTP callback mechanism to record class loading requests, set a specific path in the class construction, and send the path to the server controlled by the attacker to replace the DNS channel for data transmission;

[0112] S23: obtain the class that is most likely to become the core node of the attack chain;

[0113] Monitor and record the network behavior, system response time, and whether there is an abnormal structure of the target system when loading different classes, and score each class loading process according to the recorded network behavior, system response time, and whether there is an abnormal structure, and obtain the class with the highest score, which is the class that is most likely to become the core node of the attack chain.

[0114] Through the DNS request or HTTP callback mechanism, it can be remotely detected whether the target system loads a specific malicious class, and the effectiveness of the attack chain is ensured; by monitoring the behavior of the target system, the class that is most likely to become the core node of the attack chain is selected, thereby accelerating the efficiency of the attack.

[0115] S3: automatic construction and adaptation of deserialization call chain;

[0116] comprises the following sub-steps:

[0117] S31: Matching attack chain templates;

[0118] Obtain the loaded class information in the target environment through dynamic reflection or bytecode analysis tools, and match the appropriate predefined attack chain template based on the class information and the protocol support of the target environment;

[0119] For example, match the predefined attack chains such as CommonsCollections6 chain and Spring Core chain, and select the chain template that can best exploit the vulnerabilities of the target environment.

[0120] S32: Dynamic reflection and class adaptation mechanism;

[0121] Use reflection or dynamic proxy technology to handle different class loaders; for multiple class loader environments, dynamically adjust the loader to access the target class;

[0122] If the method is missing in the target class, dynamically call or construct an adapted class and method signature through reflection; and adjust the class path and method signature involved in the attack chain according to the actual situation of the target environment;

[0123] S33: Call chain redundancy node optimization processing;

[0124] Identify unnecessary nodes in the call chain, such as log construction and temporary variable construction, remove redundant nodes or combine multiple redundant nodes, and optimize the length and trigger conditions of the call chain;

[0125] S34: FuzzDNS result auxiliary verification;

[0126] Record the log information of various class loading and method calling in the target environment through FuzzDNS technology, and verify the generated attack chain node by node to ensure that each node can be executed correctly in the target environment;

[0127] S35: Optimize attack chain through machine learning algorithm;

[0128] Based on historical attack chain execution samples, build a training data set, which contains the paths and execution results of different attack chains;

[0129] Use machine learning algorithm to train the model, predict the shortest path and high confidence attack chain combination; through the model obtained by training, predict and generate efficient attack chain;

[0130] S36: Generate multi-layer nested and recursive call chain;

[0131] The multi-layer nested structure of "container class -> trigger class -> reflection class" is constructed through the nested and recursive chain generation mechanism, and the recursive call chain is constructed, which is suitable for deep structure parsing scenarios.

[0132] For example, when adapting to complex environments (such as deeply nested JSON structures), it can generate a call chain that triggers the FastjsonautoType vulnerability, increasing the ability to resist deep detection mechanisms.

[0133] Through dynamic reflection and bytecode analysis, an attack chain that adapts to the target environment is automatically constructed; the attack chain is adjusted according to system environment, vulnerability characteristics, protocol support, etc. to improve the likelihood of attack success; redundant nodes in the attack chain are optimized to make the attack path more concise and effective.

[0134] S4: Payload obfuscation and execution logic hiding;

[0135] Including the following sub-steps:

[0136] S41: Polymorphic structure generation mechanism;

[0137] Use code obfuscation tools or custom scripts to dynamically replace variable names, field names, and construct structure deformation semantic variation objects in the call chain;

[0138] S42: Bytecode instrumentation obfuscation;

[0139] Use ASM or Javassist bytecode manipulation libraries to insert meaningless operations to disrupt static analysis tools' analysis of static bytecode;

[0140] S43: Multi-layer encryption packaging and transmission obfuscation;

[0141] Use Base64 encoding, AES encryption, XOR, and other encryption and encoding methods to perform multi-layer encryption packaging on the serialized results, and combine random prefixes, encoding padding, and other strategies during transmission to disguise as legitimate data structures;

[0142] S44: Anti-sandbox / anti-RASP behavior injection;

[0143] Insert environment detection code to detect the current running environment and identify whether the running environment is in a sandbox, EDR, RASP, or other controlled environment. If so, trigger early stop or self-destruct logic; the environment detection code includes System.getenv or java.lang.management, etc.

[0144] S45: Protocol nesting and pseudo-structure generation;

[0145] The malicious payload is disguised as a legitimate HTTP request or XML data, and the actual malicious serialized data is hidden in the parameter name or data format of the request;

[0146] S46: Dynamic JAR obfuscator integration;

[0147] The attack code is compiled into a JAR file, which is dynamically compiled and obfuscated by integrating a JAR obfuscator, and the obfuscated JAR file code is dynamically injected into the call chain to control the echo behavior;

[0148] By obfuscating the code, encrypting the data, and inserting anti-sandbox / anti-RASP behaviors, the static analysis and sandbox detection are effectively evaded. The obfuscated structure and encrypted encapsulation disguise the malicious payload, increasing the difficulty of countermeasures for the target system. And through the anti-sandbox and anti-RASP behavior detection, the early protection mechanism in the restricted environment is identified and bypassed in advance.

[0149] S5: Automatic testing, optimization and kill-free verification;

[0150] Including the following sub-steps:

[0151] S51: Sandbox environment execution verification;

[0152] Execute the payload under multiple JVM versions and web application containers, record the execution results and exception stacks of the payload, and verify the effectiveness of the payload by checking whether it can reach a specific code path and whether it can trigger the expected vulnerability or behavior;

[0153] S52: Fuzzing mutation generation mechanism;

[0154] Perform syntax-level mutation and byte-level mutation on the executable payload;

[0155] Specifically, the syntax-level mutation varies the chain parameters or method call order in the payload to simulate different types of input and improve the generality of the payload;

[0156] The byte-level mutation directly modifies the bytecode by inserting invalid fields and other methods to improve the generality of the payload;

[0157] S53: WAF / EDR interception simulation test;

[0158] Deploy the payload on a test platform containing WAF, OpenRASP, EDR and other security components, detect whether the payload is effectively intercepted, whether it triggers false positives or false negatives, and score according to the results;

[0159] S54: Environment difference compatibility test;

[0160] Execute the payload on different operating systems, JVM configurations, analyze the execution results of different configurations, mark risk points and provide suggestions for bypass measures;

[0161] S55: Call chain behavior tracking and sandbox comparison;

[0162] Use dynamic analysis tools such as Dynatrace, AppDynamics, Java Flight Recorder, etc. to track the call chain of the payload, compare the execution behavior of the payload with the simulation in the sandbox environment, analyze each step in the call chain, locate the execution deviation point, failure reason, echo characteristics, etc.

[0163] Through sandbox environment, Fuzzing variation, WAF / EDR interception simulation, etc. can verify the effectiveness of the payload in different environments, ensure the feasibility of the attack; test and analyze the behavior of different operating systems, JVM configurations, optimize the attack payload, bypass specific protection mechanisms; through the Fuzzing variation generation mechanism, enhance the versatility of the payload in multiple target environments.

[0164] S6: Final attack payload generation and delivery adaptation;

[0165] Including the following sub-steps:

[0166] S61: Protocol format adaptation export;

[0167] Serializes the call chain into a legal structure supported by the target protocol, such as Java ObjectStream, Fastjson JSON, XStream XML, Hessian, and encapsulates the serialized call chain data;

[0168] S62: Delivery channel adaptation mechanism;

[0169] According to the characteristics of the target system, identify possible attack payload delivery channels; according to the selected delivery channel, modify the payload format or protocol to meet the transmission requirements of the channel; send the attack payload to the target system through the selected channel;

[0170] The channel includes HTTP parameter injection, file upload, WebSocket message, URL redirection, LDAP request, etc.

[0171] Specifically, the HTTP parameter injection injects the payload through URL parameters or POST request injection; the file upload sends malicious files to the target system through the file upload interface; the WebSocket message sends malicious messages to the target through the WebSocket connection; the URL redirection leads the user to the malicious website where the attack payload is located through HTTP redirection; the LDAP request communicates with the target system through the LDAP protocol and transmits malicious payloads;

[0172] S63: performing a result verification mechanism;

[0173] The attacker judges whether the attack is successful according to whether the echo is echoed after triggering, whether the DNS record is generated, and whether the reverse shell is online, and if the attack is not successful, subsequent processing is performed through a self-destruction and re-throw mechanism;

[0174] Specifically, echo detection: whether the attack is successfully executed is judged by checking the echo information after the attack is triggered, such as error prompts of the target system, response status codes, etc.

[0175] DNS record check: if the attack triggers a DNS request (such as reverse connection), check whether the DNS record has been generated; if the record exists, it means that the attack chain is successfully triggered;

[0176] Reverse shell detection: if the attack plan obtains remote control through a reverse shell, detect whether the reverse shell is successfully connected; whether the shell is online is judged by listening to the reverse connection port;

[0177] Self-destruction mechanism: if the attack fails, a self-destruction mechanism can be set to destroy the generated payload to avoid being tracked or detected;

[0178] Re-throw mechanism: if the first attack fails, the system reattempts the attack and adjusts the strategy or parameters as necessary to bypass protection.

[0179] According to the actual situation of the target system, select a suitable delivery channel (such as HTTP parameter injection, WebSocket message, LDAP request, etc.), increase the opportunity to successfully deliver the payload; if the attack fails, a self-destruction mechanism can be used to destroy the payload to avoid being tracked or analyzed; the re-throw mechanism can ensure that the attack is reattempted when the attack is not successful, improving the success rate of the attack.

[0180] The present application has been described by the above-mentioned related embodiments, however, the above-mentioned embodiments are only examples of implementing the present application. It must be pointed out that the disclosed embodiments do not limit the scope of the present application. On the contrary, modifications and refinements made without departing from the spirit and scope of the present application are within the scope of the patent protection of the present application.

Claims

1. A method for rapidly generating obfuscated deserialization attack payloads, characterized in that: Includes the following steps: S1: Target system analysis and deserialization protocol identification; The system performs dynamic probing of the target system, identifies entry points for deserialization vulnerabilities, tests whether the target system supports different deserialization protocols, and infers the version and configuration status of the deserialization library. S2: Malicious chain detection and exploitation confirmation; Detect whether the target system has loaded malicious classes, monitor and evaluate network behavior and system response during class loading, and identify the classes most likely to become core nodes in the attack chain; S3: Automatic construction and adaptation of deserialization call chains; Shorten the attack chain and verify the validity of each node; generate a call chain compatible with the target environment; S31: Matching attack chain template; Obtain the class information already loaded in the target environment, and match a suitable predefined attack chain template based on the class information and the protocol support of the target environment; S32: Dynamic reflection and class adaptation mechanism; Use reflection or dynamic proxy techniques to handle different class loaders; for environments with multiple class loaders, dynamically adjust the loader to access the target class. If a method is missing in the target class, a suitable class and method signature are dynamically invoked or constructed using reflection; and the class paths and method signatures involved in the attack chain are adjusted according to the actual situation of the target environment. S33: Optimize redundant nodes in the call chain; Identify unnecessary nodes in the call chain, remove redundant nodes or merge multiple redundant nodes, and optimize the call chain length and triggering conditions. S34: FuzzDNS results assist in verification; Record log information of various loading and method calls in the target environment, and verify the generated attack chain node by node to ensure that each node can be executed correctly in the target environment; S35: Optimizes attack chains through machine learning algorithms; A training dataset is constructed based on historical attack chain execution samples. The training dataset contains the paths and execution results of different attack chains. The model is trained using machine learning algorithms to predict the shortest path and high-confidence attack chain combinations; the trained model is then used to predict and generate efficient attack chains. S36: Generate multi-level nested and recursive call chains; A call chain is constructed through a nested and recursive chain generation mechanism to generate a call chain compatible with the target environment; S4: Load obfuscation and execution logic hiding; Use obfuscation techniques to hide the execution logic of the payload; S5: Performs automated testing, optimization, and antivirus evasion verification; Multi-environment verification and compatibility testing were conducted to evaluate the performance of the payload. S6: Final attack payload generation and delivery adaptation; The attack payload is serialized into the target protocol format and sent through an adapted delivery channel. The attack results are checked and a self-destruct or re-drop strategy is executed in case of failure.

2. The method for rapidly generating obfuscated deserialization attack payloads as described in claim 1, characterized in that: Step S1 includes the following sub-steps: S11: Identify the deserialization entry point; Dynamically detect common deserialization entry points by checking whether the input parameters of each deserialization entry point can trigger deserialization vulnerabilities, and identify deserialization entry points with vulnerabilities. S12: Test whether the target system supports different deserialization protocols; Valid empty object structures that meet the requirements of each protocol are sent to the target system in sequence. If the target system responds with an exception stack or normal processing flow, then the target system supports the deserialization protocol corresponding to the valid empty object structure. If the target system does not respond or crashes, then the target system does not support the deserialization protocol corresponding to the valid empty object structure. S13: Inferring the serialization library version and configuration parameter status; Based on the information returned by the target system, infer the version of the deserialization library used by the target system and the status of its configuration parameters; S14: Determine whether the target system has a blacklist / whitelist mechanism configured; The target system constructs test payloads based on known hazard classes. Test payloads with hazard classes are sent to the target system. The system determines whether the target system has configured a whitelist or blacklist mechanism by echoing or DNS out-of-band results. If the target system blocks the deserialization of dangerous classes or returns an error message, then the target system has a class whitelist or blacklist mechanism configured; otherwise, the target system has not configured a class whitelist or blacklist mechanism. S15: Deserialization trigger point log backtracking; If an exception is thrown during deserialization, the logs of the target system are traced back based on the exception information to extract the deserialization stack information and infer the specific code location where the deserialization operation occurred; by analyzing the code, it is confirmed whether a deserialization vulnerability exists.

3. The method for rapidly generating obfuscated deserialization attack payloads as described in claim 1, characterized in that: The specific details of step S2 are as follows: S21: Use DNS requests to detect whether the target system has loaded malicious classes; DNS query logic is inserted into the static code block of the malicious class to be detected; a special serialized payload is constructed using the malicious class to be detected as a DNS prefix, and the special serialized payload is delivered to the target system. The target system is monitored to determine whether it has loaded the malicious class. If a DNS request exists, it is determined that the malicious class exists in the target system and is marked as an attackable class; otherwise, the malicious class does not exist in the target system. S22: Use HTTP tunnels instead of DNS to detect the loading of malicious classes; In environments without DNS access, an HTTP callback mechanism is used to record class loading requests. A specific path is set in the class constructor, and the path is sent to the server controlled by the attacker to replace the DNS channel for data transmission. S23: Determine the class most likely to become the core node of the attack chain; The system monitors and records the network behavior, system response time, and any abnormal structures that occur when the target system loads different classes. Based on the recorded network behavior, system response time, and abnormal structures, the loading process of each class is scored, and the class with the highest score is identified as the most likely to become the core node of the attack chain.

4. The method for rapidly generating obfuscated deserialization attack payloads as described in claim 1, characterized in that: The specific details of step S4 are as follows: S41: Polymorphic structure generation mechanism; Use code obfuscation tools or custom scripts to dynamically replace variable names and field names in the call chain to construct semantically mutated objects. S42: Bytecode instrumentation obfuscation; Using bytecode manipulation libraries to insert meaningless operations disrupts the static analysis tools' analysis of static bytecode; S43: Multi-layered encryption encapsulation and transmission obfuscation; The serialization result is encapsulated with multiple layers of encryption, and during transmission, a strategy of random prefix and code padding is used to disguise it as a legitimate data structure. S44: Anti-sandbox / anti-RASP behavior injection; Insert environment detection code to detect the current runtime environment and identify whether the runtime environment is in a controlled environment. If so, trigger early stop or self-destruct logic; S45: Protocol nesting and masquerade structure generation; Disguising malicious payloads as legitimate HTTP requests or XML data, concealing the actual malicious serialized data within the request's parameter names or data formats; S46: Dynamic JAR obfuscator integration; The attack code is compiled into a JAR file, dynamically compiled and obfuscated by integrating a JAR obfuscator, and the obfuscated JAR file code is dynamically injected into the call chain to control the echo behavior.

5. The method for rapidly generating obfuscated deserialization attack payloads as described in claim 1, characterized in that: The specific details of step S5 are as follows: S51: Validation performed in a sandbox environment; Execute the payload, record the execution results and exception stack, and verify the validity of the payload by checking whether it can reach a specific code path and whether it can trigger the expected vulnerability or behavior. S52: Fuzzing mutation generation mechanism; Perform syntax-level and byte-level mutations on the executable payload; S53: WAF / EDR interception simulation test; Deploy the payload on a test platform that includes security components, test whether the payload is effectively intercepted, whether it triggers false alarms or false alarms, and score the results. S54: Environmental Compatibility Test; Execute the payload on different operating systems and JVM configurations, analyze the execution results under different configurations, mark risk points, and provide suggestions for bypass measures; S55: Call chain behavior tracing and sandbox comparison; Use dynamic analysis tools to trace the call chain of the payload and compare the execution behavior of the payload with the execution simulated in the sandbox environment.

6. The method for rapidly generating obfuscated deserialization attack payloads as described in claim 1, characterized in that: The specific details of step S6 are as follows: S61: Protocol format adaptation and export; The call chain is serialized into a valid structure of the target supported protocol, and the serialized call chain data is encapsulated. S62: Delivery Channel Adaptation Mechanism; Identify potential attack payload delivery channels based on the target system; modify the payload format or protocol to conform to the transmission requirements of the selected delivery channel; and send the attack payload to the target system through the selected channel. S63: Execution result verification mechanism; Attackers determine whether an attack is successful based on whether an echo is generated after the attack is triggered, whether a DNS record is generated, and whether a reverse shell is online. If the attack is unsuccessful, subsequent processing is carried out through self-destruction and re-drop mechanisms.

Images