Exploit for Deserialization of Untrusted Data in Xstream

## https://sploitus.com/exploit?id=88781F74-2AD2-5F17-870A-6CB932998CA9
# Xstream-1.4.17

(The above Xstream demo environment was set up by me. The vulnerability exploitation environment is based on JDK1.8_u131. Currently, it supports local testing and HTTP remote sending of packets.)

XSTREAM <= 1.4.17 vulnerabilities can be reproduced (CVE-2021-39141, CVE-2021-39144, CVE-2021-39150, CVE-2021-39152).

No POC for this experiment is provided. Only the exploitation results are shown. To prevent malicious use, only the official POC is provided: http://x-stream.github.io/changes.html

### CVE-2021-39141 (RCE)
The attacker sets up an http service for access by the Exploit.class, then uses the marshalsec tool to set up an LDAP listener, as follows:

![1](https://user-images.githubusercontent.com/50495555/130566157-959b7c90-58a6-41a9-a920-2648ea1b9345.png)
Sending packets results in successful exploitation.

![2](https://user-images.githubusercontent.com/50495555/130566165-345a27c7-ea75-4d3a-8011-02b779e9f5f4.png)

### CVE-2021-39144 (RCE)
Sending packets results in successful exploitation.

![3](https://user-images.githubusercontent.com/50495555/130566170-333f18e9-60bb-4f86-b1ca-4f18fe7c00fc.png)

### CVE-2021-39150 (SSRF)
A Server-Side Forgery Request can be activated by unmarshalling with XStream to access data streams from an arbitrary URL that references a resource on an intranet or the local host. Sending packets results in successful exploitation.

![4](https://user-images.githubusercontent.com/50495555/130566177-2cbc2fa2-f437-4ac7-8834-d3bd9a63d16e.png)

### CVE-2021-39152 (SSRF)
All versions up to and including version 1.4.17 are affected. If using the version with Java runtime version 14 to 8, exploitation is possible.

![5](https://user-images.githubusercontent.com/50495555/130576671-dcdaa3db-81d1-4623-a1cc-7e520ef33edb.png)

Testing has found that internal and external IPs or domain names can only be resolved/checked once.

![1](https://user-images.githubusercontent.com/50495555/130576798-ac0c21e3-c049-4bdd-b5d9-22a6a800d25e.png)