参考教程视频 Java反序列化RMI专题-没有人比我更懂RMI
参考博客
JAVA安全基础（四）-- RMI机制 - 先知社区 (aliyun.com)
RMI应用概述
参考RMI应用概述
RMIClient首先去rmiregistry注册中心查找，RMIServer开启的端口。
之后连接RMIServer。
如果在RMIServer中，找不到，还可以去web中查找加载，这也产生了安全隐患。
流程图
DEMO
开两个项目一个RMIClient一个RMIServer
RMIClient
IRemoteObj.java 接口
public interface IRemoteObj extends Remote {
//sayHello就是客户端要调用的方法，需要抛出RemoteException
public String sayHello(String keywords) throws RemoteException;
}
RMIClient.java
public class RMIClient {
public static void main(String[] args) throws Exception {
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099); //链接注册中心
IRemoteObj remoteObj = (IRemoteObj) registry.lookup("remoteObj"); //寻找方法
remoteObj.sayHello("hello");
}
}
RMIServer
IRemoteObj.java 接口（和client一样的）
public interface IRemoteObj extends Remote {
//sayHello就是客户端要调用的方法，需要抛出RemoteException
public String sayHello(String keywords) throws RemoteException;
}
RemoteObjImpl.java (服务端需要将接口实现)
public class RemoteObjImpl extends UnicastRemoteObject implements IRemoteObj{
public RemoteObjImpl() throws RemoteException{
//UnicastRemoteObject.exportObject(this, 0); //如果不继承UnicastRemoteObject就需要手工导出
}
@Override
public String sayHello(String keywords) {
String upKeywords = keywords.toUpperCase();
System.out.println(upKeywords);
return upKeywords;
}
}
RMIServer.java （RMI服务端创建注册中心，开启端口）
public class RMIServer {
public static void main(String[] args) throws Exception {
RemoteObjImpl remoteObj = new RemoteObjImpl();
Registry registry = LocateRegistry.createRegistry(1099); //创建注册中心
registry.bind("remoteObj", remoteObj); //绑定
}
}
写好之后，可以自己测试下。
创建远程服务
跟一下RMIServer.java的RemoteObjImpl remoteObj = new RemoteObjImpl();
因为RemoteObjImpl()是有父类的，所以RemoteObjImpl()构造方法之前，会先执行其父类的构造函数。
各到父类UnicastRemoteObject的构造函数
//UnicastRemoteObject
protected UnicastRemoteObject(int port) throws RemoteException
{
this.port = port; //默认为0
exportObject((Remote) this, port);
}
跟进exportObject((Remote) this, port);
public static Remote exportObject(Remote obj, int port)
throws RemoteException
{
return exportObject(obj, new UnicastServerRef(port));
}
跟进new UnicastServerRef(port)
public UnicastServerRef(int port) {
super(new LiveRef(port)); //这个LiveRef很重要 //向父类构造参数也传了一个LiveRef
}
跟进LiveRef到
public LiveRef(ObjID objID, int port) {
this(objID, TCPEndpoint.getLocalEndpoint(port), true);
}
之后可以看下TCPEndpoint，里面有host，port等，像是个处理网络请求的封装。
之后LiveRef构造完成，UnicastServerRef(服务端)调用父类UnicastRef(客户端)构造方法传入一个LiveRef。
最后返回return exportObject(obj, new UnicastServerRef(port));
//UnicastRemoteObject
private static Remote exportObject(Remote obj, UnicastServerRef sref)
throws RemoteException
{
// if obj extends UnicastRemoteObject, set its ref.
if (obj instanceof UnicastRemoteObject) {
((UnicastRemoteObject) obj).ref = sref; //赋值
}
return sref.exportObject(obj, null, false); //调用UnicastServerRef中的exportObject方法
}
跟进UnicastServerRef中的exportObject方法
可以看到stub是一个LiveRef（UnicastRef客户端网络请求封装）的动态代理
接下来走到Target，跟进
Target target =
new Target(impl, this, stub, ref.getObjID(), permanent);
Target其实就是做了个封装。可以看到服务端和客户端的网络请求LiveRef是一个都是LiveRef@570
接下来的ref.exportObject(target);是具体的网络请求。可以跟下视频
TCPTransport的listen方法
他是把接口发布出去了，但是接口号是随机的，现在客户端还不知道服务端的接口。
关于接口的记录是在ObjectTable的
objTable.put(oe, target);
implTable.put(weakImpl, target);
完成的。
put之前还涉及到了一个，DGCImpl，这个在后面讲
if (DGCImpl.dgcLog.isLoggable(Log.VERBOSE)) {
DGCImpl.dgcLog.log(Log.VERBOSE, "add object " + oe);
}
创建注册中心+绑定
创建注册中心
跟下Registry registry = LocateRegistry.createRegistry(1099); //创建注册中心
public static Registry createRegistry(int port) throws RemoteException {
return new RegistryImpl(port);
}
之后跟下构造方法RegistryImpl(port);
public RegistryImpl(int port)
throws RemoteException
{
if (port == Registry.REGISTRY_PORT && System.getSecurityManager() != null) {
// grant permission for default port only.
try {
AccessController.doPrivileged(new PrivilegedExceptionAction<Void>() {
public Void run() throws RemoteException {
LiveRef lref = new LiveRef(id, port);
setup(new UnicastServerRef(lref));
return null;
}
}, null, new SocketPermission("localhost:"+port, "listen,accept"));
} catch (PrivilegedActionException pae) {
throw (RemoteException)pae.getException();
}
} else {
LiveRef lref = new LiveRef(id, port); //程序走到这里，新建一个LiveRef,端口是我们写的1099，id是默认值
setup(new UnicastServerRef(lref)); //之后调用服务端的构造方法，服务端里面又调用客户端的构造方法（和前面一样的）
}
}
接下来看setup
private void setup(UnicastServerRef uref)
throws RemoteException
{
/* Server ref must be created and assigned before remote
* object 'this' can be exported.
*/
ref = uref;
uref.exportObject(this, null, true); //这里注意看下和创建远程服务时return sref.exportObject(obj, null, false); 不一样的地方
//第三个参数对应过去是一个叫永久的属性
}
主要区别是第三个参数，
之后运行到
stub = Util.createProxy(implClass, getClientRef(), forceStubUse);
跟进Util.createProxy**（主要看）**
public static Remote createProxy(Class<?> implClass,
RemoteRef clientRef,
boolean forceStubUse)
throws StubNotFoundException
{
Class<?> remoteClass;
try {
remoteClass = getRemoteClass(implClass);
} catch (ClassNotFoundException ex ) {
throw new StubNotFoundException(
"object does not implement a remote interface: " +
implClass.getName());
}
if (forceStubUse ||
!(ignoreStubClasses || !stubClassExists(remoteClass))) //这个判断在创建远程服务时是false，但是现在（创建注册中心时）返回true，具体可以看下stubClassExists(remoteClass)
{
return createStub(remoteClass, clientRef); //到这儿就return了，不会执行到下面创建动态代理
}
final ClassLoader loader = implClass.getClassLoader();
final Class<?>[] interfaces = getRemoteInterfaces(implClass);
final InvocationHandler handler =
new RemoteObjectInvocationHandler(clientRef);
/* REMIND: private remote interfaces? */
try {
return AccessController.doPrivileged(new PrivilegedAction<Remote>() { //创建远程服务时会创建动态代理，但是现在（创建注册中心时）走不到这儿
public Remote run() {
return (Remote) Proxy.newProxyInstance(loader,
interfaces,
handler);
}});
} catch (IllegalArgumentException e) {
throw new StubNotFoundException("unable to create proxy", e);
}
}
stubClassExists
如图，Class.forName可以找到类，不会抛出异常，返回true
创建完stub返回exportObject，进入setSkeleton(impl); Skeleton，它从 Stub 中接收远程方法调用并传递给真实的目标类。之后会详细讲
public void setSkeleton(Remote impl) throws RemoteException {
if (!withoutSkeletons.containsKey(impl.getClass())) {
try {
skel = Util.createSkeleton(impl); //这个方法是在impl的ref中给skel赋值
} catch (SkeletonNotFoundException e) {
/*
* Ignore exception for skeleton class not found, because a
* skeleton class is not necessary with the 1.2 stub protocol.
* Remember that this impl's class does not have a skeleton
* class so we don't waste time searching for it again.
*/
withoutSkeletons.put(impl.getClass(), null);
}
}
}
之后流程与创建远程服务的是一样的
if (stub instanceof RemoteStub) {
setSkeleton(impl);
}
Target target =
new Target(impl, this, stub, ref.getObjID(), permanent); //封装Target
ref.exportObject(target); //开启socket，添加记录
hashToMethod_Map = hashToMethod_Maps.get(implClass);
return stub;
看下添加完的记录
能看到UnicastServerRef中skel赋值了，创建远程服务中skel为null
可以看出来，注册中心的本质也是一个远程服务。
绑定
跟下registry.bind("remoteObj", remoteObj);
//RegistryImpl
public void bind(String name, Remote obj)
throws RemoteException, AlreadyBoundException, AccessException
{
checkAccess("Registry.bind");
synchronized (bindings) { //这个bindings是个hashTable
Remote curr = bindings.get(name); //寻找有没有叫name的key
if (curr != null) //如果有则命名冲突抛出异常
throw new AlreadyBoundException(name);
bindings.put(name, obj);//没有的话把name，obj put到bindings中
}
}
总结
这里引用其他师傅画的流程图，方便理解创建的流程。
客户端请求注册中心-客户端（两个攻击点）
跟进LocateRegistry.getRegistry
Registry registry = LocateRegistry.getRegistry("127.0.0.1", 1099);
public static Registry getRegistry(String host, int port,
RMIClientSocketFactory csf) //传入"127.0.0.1", 1099， null
throws RemoteException
{
Registry registry = null;
if (port <= 0)
port = Registry.REGISTRY_PORT;
if (host == null || host.length() == 0) {
// If host is blank (as returned by "file:" URL in 1.0.2 used in
// java.rmi.Naming), try to convert to real local host name so
// that the RegistryImpl's checkAccess will not fail.
try {
host = java.net.InetAddress.getLocalHost().getHostAddress();
} catch (Exception e) {
// If that failed, at least try "" (localhost) anyway...
host = "";
}
}
LiveRef liveRef =
new LiveRef(new ObjID(ObjID.REGISTRY_ID),
new TCPEndpoint(host, port, csf, null),
false); //执行到这里 创建LiveRef
RemoteRef ref =
(csf == null) ? new UnicastRef(liveRef) : new UnicastRef2(liveRef); //new UnicastRef(liveRef), 将LiveRef赋值给客户端
return (Registry) Util.createProxy(RegistryImpl.class, ref, false); //这里很熟悉
}
return (Registry) Util.createProxy(RegistryImpl.class, ref, false); 这里很熟悉，这个方法是创建Stub用的。
这里面走的流程和服务端创建注册中心是一样的，创建的是一个RegistryImpl_Stub对象，不是动态代理。
接下来跟IRemoteObj remoteObj = (IRemoteObj) registry.lookup("remoteObj");
public Remote lookup(String var1) throws AccessException, NotBoundException, RemoteException {
try {
RemoteCall var2 = super.ref.newCall(this, operations, 2, 4905912898345647071L); //用newCall进行通信
try {
ObjectOutput var3 = var2.getOutputStream();
var3.writeObject(var1); //通过序列化，将要查找的"remoteObj" 写道输出流里面
} catch (IOException var18) {
throw new MarshalException("error marshalling arguments", var18);
}
super.ref.invoke(var2); //
Remote var23;
try {
ObjectInput var6 = var2.getInputStream();
var23 = (Remote)var6.readObject(); //获取输入流，将返回值进行反序列化
} catch (IOException var15) {
throw new UnmarshalException("error unmarshalling return", var15);
} catch (ClassNotFoundException var16) {
throw new UnmarshalException("error unmarshalling return", var16);
} finally {
super.ref.done(var2);
}
return var23;
} catch (RuntimeException var19) {
throw var19;
} catch (RemoteException var20) {
throw var20;
} catch (NotBoundException var21) {
throw var21;
} catch (Exception var22) {
throw new UnexpectedException("undeclared checked exception", var22);
}
}
这里有两个攻击点
-
var23 = (Remote)var6.readObject();这里有个反序列化方法，说明客户端和注册中心最终的信息交流是通过序列化的。我们可以构造注册中心攻击客户端。 -
super.ref.invoke(var2); 这个方法
跟进invoke方法看看，注意call.executeCall();这个方法客户端和服务端网络处理都是通过这个方法完成的
public void invoke(RemoteCall call) throws Exception {
try {
clientRefLog.log(Log.VERBOSE, "execute call");
call.executeCall();
} catch (RemoteException e) {
之后看StreamRemoteCall 的executeCall方法。有个隐藏的反序列化位置
// read return value
switch (returnType) {
case TransportConstants.NormalReturn:
break;
case TransportConstants.ExceptionalReturn: //如果程序进入这个case
Object ex;
try {
ex = in.readObject(); //则在这儿执行反序列化
} catch (Exception e) {
throw new UnmarshalException("Error unmarshaling return", e);
}
而且invoke(var2); 这个可利用点，会比1危害大。因为我们可以发现RegistryImpl_Stub的其他方法bind(), list(), rebind()中都有invoke方法。
最后客户端获取到的是服务端生成的IRemoteObj的代理
客户端请求服务端-客户端（一个攻击点）
接下来跟
remoteObj.sayHello("hello");
因为remoteObj是个动态代理类，（动态代理方法调用都是通过invoke实现的）。所以跟进去是RemoteObjectInvocationHandler的invoke方法。
之后调用了invokeRemoteMethod方法，方法内调用了UnicastRef的invoke方法。
UnicastRef的invoke方法中，marshalValue中把"hello"序列化。
之后调用了call.executeCall方法**（这一步执行完，服务端就可以看到打印的"HELLO"了）**
再往下看，因为我们调用的方法是有返回值的，返回HELLO。
如果方法是有返回值的，程序会执行到unmarshalValue(rtype, in);
这个方法中会调用反序列化方法，这又是一个攻击点。
protected static Object unmarshalValue(Class<?> type, ObjectInput in) //type是String
throws IOException, ClassNotFoundException
{
if (type.isPrimitive()) { //判断type是不是java的基本类型，String不是java的基本类型则进入else
if (type == int.class) {
return Integer.valueOf(in.readInt());
} else if (type == boolean.class) {
return Boolean.valueOf(in.readBoolean());
} else if (type == byte.class) {
return Byte.valueOf(in.readByte());
} else if (type == char.class) {
return Character.valueOf(in.readChar());
} else if (type == short.class) {
return Short.valueOf(in.readShort());
} else if (type == long.class) {
return Long.valueOf(in.readLong());
} else if (type == float.class) {
return Float.valueOf(in.readFloat());
} else if (type == double.class) {
return Double.valueOf(in.readDouble());
} else {
throw new Error("Unrecognized primitive type: " + type);
}
} else {
return in.readObject(); //反序列化，return HELLO
}
}
客户端请求注册中心-注册中心（一个攻击点）
这部分调试的是IRemoteObj remoteObj = (IRemoteObj) registry.lookup("remoteObj");客户端请求注册中心时，注册中心是如何处理客户端请求的。
由于我们要在服务端开启调试，我们要想想断点需要打在哪（这段可以跟下视频，代码调用太多）。
最后是找到TCPTransport的handleMessages方法，来处理客户端请求的。
//handleMessages
switch (op) {
case TransportConstants.Call:
// service incoming RMI call
RemoteCall call = new StreamRemoteCall(conn);
if (serviceCall(call) == false) //跟进
return;
break;
最后断点是在 Transport的serviceCall方法中
在前面的创建注册中心时，我们提到了Skeleton，它从 Stub 中接收远程方法调用并传递给真实的目标类。
注册中心是通过Skeleton和客户端的Stub进行交互的。下面跟一下代码
之后final Dispatcher disp = target.getDispatcher();从获取到的封装的Target中，拿到分发器dispatch。在这里我们能看到skel
跟进disp.dispatch(impl, call);，如果skel不是null，则进入oldDispatch方法。
跟进oldDispatch方法，最后会走到skel.dispatch(obj, call, op, hash);
这个方法里面很多case，对应着不同的方法。如果说我们现在传进来是2，对应的就是客户端的lookup(‘remoteObj’)方法。
这里存在反序列化，也是一个利用点
//RegistryImpl_Skel dispatch
case 2:
try {
var10 = var2.getInputStream();
var7 = (String)var10.readObject(); //反序列化，攻击点
} catch (IOException var89) {
throw new UnmarshalException("error unmarshalling arguments", var89);
} catch (ClassNotFoundException var90) {
throw new UnmarshalException("error unmarshalling arguments", var90);
} finally {
var2.releaseInputStream();
}
var8 = var6.lookup(var7); //lookup方法
try {
ObjectOutput var9 = var2.getResultStream(true);
var9.writeObject(var8);
break;
} catch (IOException var88) {
throw new MarshalException("error marshalling return", var88);
}
客户端请求服务端-服务端（一个攻击点）
在上一节，客户端从注册中心lookup到了服务端的动态代理。
接下来看服务端是怎么处理客户端的请求的（请求sayHello方法）
其实接下来收到的分发器是DGCImpl_Skel，这里先不看。往后看第三个请求。第三个请求的Target中stub就是客户端的动态代理了。
之后还是走分发器，但是这里skel为空不走oldDispatch了。
public void dispatch(Remote obj, RemoteCall call) throws IOException {
// positive operation number in 1.1 stubs;
// negative version number in 1.2 stubs and beyond...
int num;
long op;
try {
// read remote call header
ObjectInput in;
try {
in = call.getInputStream();
num = in.readInt();
if (num >= 0) { //num = -1 (num就是上一节讲的swith(var3) case的var3)，并且skel == null
if (skel != null) {
oldDispatch(obj, call, num);
return;
} else {
throw new UnmarshalException(
"skeleton class not found but required " +
"for client version");
}
}
op = in.readLong();
} catch (Exception readEx) {
throw new UnmarshalException("error unmarshalling call header",
readEx);
}
/*
* Since only system classes (with null class loaders) will be on
* the execution stack during parameter unmarshalling for the 1.2
* stub protocol, tell the MarshalInputStream not to bother trying
* to resolve classes using its superclasses's default method of
* consulting the first non-null class loader on the stack.
*/
MarshalInputStream marshalStream = (MarshalInputStream) in;
marshalStream.skipDefaultResolveClass();
Method method = hashToMethod_Map.get(op); //拿到方法 sayHello
if (method == null) {
throw new UnmarshalException("unrecognized method hash: " +
"method not supported by remote object");
}
// if calls are being logged, write out object id and operation
logCall(obj, method);
// unmarshal parameters
Class<?>[] types = method.getParameterTypes(); //方法的参数类型数组 String
Object[] params = new Object[types.length]; // 1
try {
unmarshalCustomCallData(in);
for (int i = 0; i < types.length; i++) {
params[i] = unmarshalValue(types[i], in); /这里比较重要，unmarshalValue在之前客户端请求服务端-客户端时也用到了，是用来反序列化的 拿到的是"hello"
}
} catch (java.io.IOException e) {
throw new UnmarshalException(
"error unmarshalling arguments", e);
} catch (ClassNotFoundException e) {
throw new UnmarshalException(
"error unmarshalling arguments", e);
} finally {
call.releaseInputStream();
}
// make upcall on remote object
Object result;
try {
result = method.invoke(obj, params); //调用sayHello方法 ， 观察到控制台打印 "HELLO"
} catch (InvocationTargetException e) {
throw e.getTargetException();
}
// marshal return value
try {
ObjectOutput out = call.getResultStream(true);
Class<?> rtype = method.getReturnType(); //方法返回值类型 这里是 String "HELLO"
if (rtype != void.class) {
marshalValue(rtype, result, out); //如果有返回值的话，需要进行序列化，并发送给客户端
}
} catch (IOException ex) {
throw new MarshalException("error marshalling return", ex);
/*
* This throw is problematic because when it is caught below,
* we attempt to marshal it back to the client, but at this
* point, a "normal return" has already been indicated,
* so marshalling an exception will corrupt the stream.
* This was the case with skeletons as well; there is no
* immediately obvious solution without a protocol change.
*/
}
} catch (Throwable e) {
logCallException(e);
ObjectOutput out = call.getResultStream(false);
if (e instanceof Error) {
e = new ServerError(
"Error occurred in server thread", (Error) e);
} else if (e instanceof RemoteException) {
e = new ServerException(
"RemoteException occurred in server thread",
(Exception) e);
}
if (suppressStackTraces) {
clearStackTraces(e);
}
out.writeObject(e);
} finally {
call.releaseInputStream(); // in case skeleton doesn't
call.releaseOutputStream();
}
}
unmarshalValue方法，里面的反序列化又是一个攻击点
客户端请求服务端-dgc
关于DGC是在put封装的Target时候出现的。
static void putTarget(Target target) throws ExportException {
ObjectEndpoint oe = target.getObjectEndpoint();
WeakRef weakImpl = target.getWeakImpl();
if (DGCImpl.dgcLog.isLoggable(Log.VERBOSE)) { //在这里调用DGCImpl的静态属性，触发DGCImpl初始化，执行它的静态代码块，放在下面了
DGCImpl.dgcLog.log(Log.VERBOSE, "add object " + oe);
}
synchronized (tableLock) {
/**
* Do nothing if impl has already been collected (see 6597112). Check while
* holding tableLock to ensure that Reaper cannot process weakImpl in between
* null check and put/increment effects.
*/
if (target.getImpl() != null) {
if (objTable.containsKey(oe)) {
throw new ExportException(
"internal error: ObjID already in use");
} else if (implTable.containsKey(weakImpl)) {
throw new ExportException("object already exported");
}
objTable.put(oe, target); //put
implTable.put(weakImpl, target);
if (!target.isPermanent()) {
incrementKeepAliveCount();
}
}
}
}
DGCImpl静态代码块
static {
/*
* "Export" the singleton DGCImpl in a context isolated from
* the arbitrary current thread context.
*/
AccessController.doPrivileged(new PrivilegedAction<Void>() {
public Void run() {
ClassLoader savedCcl =
Thread.currentThread().getContextClassLoader();
try {
Thread.currentThread().setContextClassLoader(
ClassLoader.getSystemClassLoader());
/*
* Put remote collector object in table by hand to prevent
* listen on port. (UnicastServerRef.exportObject would
* cause transport to listen.)
*/
try {
dgc = new DGCImpl();
ObjID dgcID = new ObjID(ObjID.DGC_ID);
LiveRef ref = new LiveRef(dgcID, 0);
UnicastServerRef disp = new UnicastServerRef(ref);
Remote stub =
Util.createProxy(DGCImpl.class,
new UnicastRef(ref), true); //这里和注册中心创建skel的时候非常像
disp.setSkeleton(dgc);
Permissions perms = new Permissions();
perms.add(new SocketPermission("*", "accept,resolve"));
ProtectionDomain[] pd = { new ProtectionDomain(null, perms) };
AccessControlContext acceptAcc = new AccessControlContext(pd);
Target target = AccessController.doPrivileged(
new PrivilegedAction<Target>() {
public Target run() {
return new Target(dgc, disp, stub, dgcID, true);
}
}, acceptAcc);
ObjectTable.putTarget(target); //调用了put，putTarget
} catch (RemoteException e) {
throw new Error(
"exception initializing server-side DGC", e);
}
} finally {
Thread.currentThread().setContextClassLoader(savedCcl);
}
return null;
}
});
}
主要看下这两句（结合创建注册中心时候的分析看）
在Util.createProxy，和创建注册中心一样可以找到DGCImpl_Stub，返回的是DGCImpl_Stub，而不是动态代理。
disp.setSkeleton(dgc);是设置skel。
Remote stub =
Util.createProxy(DGCImpl.class,
new UnicastRef(ref), true); //这里和注册中心创建skel的时候非常像
disp.setSkeleton(dgc);
DGCImpl_Stub和DGCImpl_Skel中存在readObject和ref.invoke()方法的地方都是存在攻击点的
标签：throw,序列化,return,流程,public,new,RMI,port,客户端 From： https://blog.csdn.net/weixin_45436292/article/details/140552529