GithubHelp home page GithubHelp logo

leew66884 / javarce Goto Github PK

View Code? Open in Web Editor NEW

This project forked from whoopsunix/javarce

0.0 0.0 0.0 279 KB

实战场景较通用的 Java Rce 相关漏洞的利用方式 | Common Exploitation Techniques for Java RCE Vulnerabilities in Real-World Scenarios

Home Page: https://github.com/Whoopsunix/JavaRce

C++ 0.12% Python 1.01% C 0.10% Java 98.71% PLpgSQL 0.05%

javarce's Introduction

JavaRceDemo

By. Whoopsunix

0x00 do what?

🚀 记录贴 对照实战场景梳理较通用的 Java Rce 相关漏洞的利用方式或知识点

🚩 对于实际环境遇到过的组件如有必要会针对可利用版本进行一个梳理 慢更

🚧 长期项目 不定期学习后更新......

🛰️ 部分利用已经集成在二开 ysoserial 项目中

🪝 PPPRASP 项目中对本项目给出的漏洞实现防护（仅实现关键函数的 HOOK，不作进一步处理）

目录

0x01 RceEcho

结合 java-object-searcher 工具挖掘命令回显 慢更版本适配

本项目主要给出反序列化 demo，jsp 的例子可以参考 Java-Rce-Echo

TomcatEcho

Version Test

  • 6.0.53
  • 7.0.59、7.0.109
  • 8.0.53、8.5.82
  • 9.0.65

SpringEcho

Version Test

  • spring-boot-starter-web
    • [2.2.x, 2.7.x]

JettyEcho

Version Test

  • 7.x、8.x、9.x、10.x 全版本

UndertowEcho

WildFly 默认容器用的 Undertow

Version Test

  • spring-boot-starter-undertow
    • 2.7.15

ResinEcho

Version Test

  • [4.0.52, 4.0.66]

OSEcho

  • windows
  • linux

0x02 MemShell

TomcatMemShell

Tomcat
内存马类型 Loader 测试版本
Filter ContextClassLoader 8 9
JMX 7 8 9
Thread 6 7 8 9
Servlet ContextClassLoader 8 9
JMX 7 8 9
Thread 7 8 9
Listener ContextClassLoader 8 9
JMX 7 8 9
Thread 7 8 9

SpringMemShell

Springboot2
内存马类型 Loader 测试版本
Controller WebApplicationContext [2.2.x, 2.7.x]

UndertowMemShell

Undertow
内存马类型 Loader 测试版本
Listener Thread 2.7.15
Filter Thread 2.7.15

ResinMemShell

内存马类型 Loader 测试版本
Listener Thread [4.0.52, 4.0.66]
Servlet Thread [4.0.52, 4.0.66]
Filter Thread [4.0.52, 4.0.66]

0x03 Command

执行Demo

参考 javaweb-sec 有很详细的例子

  • Runtime
  • ProcessBuilder
  • ProcessImpl
  • ProcessImpl & UnixProcess
  • ProcessImpl & UnixProcess by unsafe - Native
  • Thread
  • ScriptEngine
  • jni

执行结果输出（InputStream 处理Demo）

  • java.lang.StringBuilder
  • java.io.ByteArrayOutputStream
  • java.util.Scanner
  • java.io.BufferedReader
  • java.io.InputStream.readNBytes > JDK 9
  • org.springframework:spring-core
  • org.apache.commons:commons-io

0x04 Expression inject

OGNL

  • 普通执行demo、jsEngine：get、set方式
  • 有sout的回显 (Ps. 通过 Servlet 的回显移到 RceEcho 章节介绍)
    • 明文
    • 套一层base64加密
  • 探测用Payload
    • DNSLOG、HTTPLOG
    • 延时

EL

  • runtime 回显
  • jsEngine 回显
  • Scriptlet 标记写法（放在这里对照）

SPEL

  • runtime 回显
  • 探测用Payload
    • DNSLOG、HTTPLOG
    • 延时

0x05 JDBC Attack

参考 JDBC-Attack 、pyn3rd blog 、A New Attack Interface In Java Applications 、 Deserial_Sink_With_JDBC

  • Mysql
    • 文件读取
    • 反序列化
      • statementInterceptors、detectCustomCollations
  • PostgreSQL
    • CVE-2022-21724 RCE
      • AbstractXmlApplicationContext 实现类
    • 文件写入
      • loggerLevel / loggerFile
        • 原始方式写入 EL
        • 截断方式写入 jsp
  • H2database
    • RUNSCRIPT 远程sql加载
    • 代码执行
      • INIT转义分号
      • TriggerJS
      • Groovy
  • IBMDB2
    • JNDI
  • ModeShape
    • JNDI
  • Apache Derby
    • Serialize
  • Sqlite
    • RCE
  • dameng 达梦
    • JDNI
  • Oracle
    • JNDI
  • teradata
    • JDBC RCE

0x06 Serialization

Class load

  • AppClassLoader
  • URLCLassLoader
  • BCEL
  • TransletClassLoader
  • Unsafe
  • ReflectUtils
  • RhinoClassloader
  • ScriptEngineDemo

XMLSerialization

JarBean

  • 命令执行 Runtime、ProcessBuilder、js
  • 探测用Payload
    • DNSLOG、SOCKETLOG
    • 延时
  • JNDI
  • BCEL
  • RemoteJar

ConstructorEXP

通过构造方法触发RCE

  • xml

XStream

主要为 CVE 不具体展开，<= 1.4.17 的生成集成在 yso 项目中

0x07 文件读写 Demo

可用的文件读写方法，即 Java 数据流的各种操作方法

Stats

Alt

Thanks

感谢师傅们的研究 带来了很大的帮助 :)

https://github.com/javaweb-sec/javaweb-sec

https://github.com/yzddmr6/Java-Js-Engine-Payloads

https://github.com/su18/JDBC-Attack

https://pyn3rd.github.io/

https://forum.butian.net/share/886

https://github.com/woodpecker-appstore

https://www.yulegeyu.com/archives/

https://github.com/c0ny1/java-object-searcher

https://github.com/feihong-cs/Java-Rce-Echo

https://flowerwind.github.io/2021/10/11/tomcat6%E3%80%817%E3%80%818%E3%80%819%E5%86%85%E5%AD%98%E9%A9%AC/

https://github.com/luelueking/Deserial_Sink_With_JDBC

javarce's People

Contributors

whoopsunix avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.