System and method for Java RMI deserialization vulnerability detection

Abstract

The invention provides a Java RMI deserialization vulnerability detection method, which comprises the following steps: inputting a target IP address list to a scanning module, and detecting the network accessibility of each IP address in the target IP address list; if the network reachable IP address exists, detecting all ports of the IP address, and recording an open port number; service classification is carried out by identifying the service downloaded by the open port; if the service is classified as a Java RMI service, acquiring a system permission of an RMI server through a Java deserialization script; acquiring a voucher file of the RMI server by using the system authority of the RMI server, and analyzing the voucher file to obtain a ciphertext password of a host in RDP communication connection; decrypting the ciphertext password by using a mimikatz tool to obtain a plaintext password of the host; and generating a Java RMI deserialization vulnerability detection report according to the plaintext password.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a system, method, electronic device and storage medium for Java RMI deserialization vulnerability detection. Background Art

[0002] Java RMI service is Remote Method Invocation. It is a mechanism that enables an object on a Java virtual machine to call a method on an object on another Java virtual machine. In Java Web, RMI is used in many places to call each other. The RMI transmission process must use serialization and deserialization. If the RMI server port is developed externally and the server uses a library such as Apache Commons Collections, it will lead to remote command execution.

[0003] Vulnerability detection does not have the ability to automatically complete Java RMI deserialization vulnerability detection, making it difficult to deeply parse credential files, expand detection results, and horizontally mine vulnerabilities in hosts that are interconnected on the network.

[0004] A system, method, electronic device and storage medium for Java RMI deserialization vulnerability detection are proposed herein. Summary of the invention

[0005] The embodiments of the present disclosure aim to solve at least one of the technical problems existing in the prior art, and provide a system, method, electronic device and storage medium for Java RMI deserialization vulnerability detection.

[0006] In a first aspect of the present disclosure, a system for detecting Java RMI deserialization vulnerabilities is provided, comprising:

[0007] A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0008] Deserialization module, used to run Java deserialization scripts and obtain system permissions on the RMI server;

[0009] A parsing module, used to parse the credential file of the RMI server and decrypt the ciphertext password of the host;

[0010] The detection report module is used to generate Java RMI deserialization vulnerability detection reports.

[0011] A second aspect of the present disclosure provides a method for detecting Java RMI deserialization vulnerabilities, comprising:

[0012] Inputting a target IP address list into the scanning module, and detecting the network reachability of each IP address in the target IP address list;

[0013] If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0014] Classify services by identifying services running under open ports;

[0015] If the service is classified as a Java RMI service, obtain the system permissions of the RMI server through the Java deserialization script;

[0016] Using the system authority of the RMI server to obtain the credential file of the RMI server, and parsing the credential file to obtain the ciphertext password of the host connected by RDP communication;

[0017] Use the mimikatz tool to decrypt the ciphertext password to obtain the plaintext password of the host;

[0018] A Java RMI deserialization vulnerability detection report is generated according to the plaintext password.

[0019] In conjunction with the second aspect, if the service is classified as a Java RMI service, obtaining the system permissions of the RMI server through the Java deserialization script includes:

[0020] Get the Java Runtime class;

[0021] Obtain the getRuntime method from the Runtime class through the reflection mechanism;

[0022] Reflectively call the getRuntime method to obtain the Runtime object;

[0023] Reflectively call the exec method of the Runtime object and execute the system command systeminfo to obtain the system permissions of the RMI server.

[0024] In combination with the second aspect, the method of using the system authority of the RMI server to obtain the credential file of the RMI server, and parsing the credential file to obtain the ciphertext password of the host connected by the RDP communication includes:

[0025] pass

[0026] Use the dir / a%userprofile%\AppData\Local\Microsoft\Credentials\* command to view the credential file saved by the RMI server.

[0027] The credential file is parsed to obtain the ciphertext password of the host connected to the RDP communication.

[0028] In combination with the second aspect, the use of the mimikatz tool to decrypt the ciphertext password to obtain the plaintext password of the host includes:

[0029] Use the mimikatz tool to obtain the guidMasterKey credential id of the ciphertext password;

[0030] Query the Masterkey certificate mapped by the guidMasterKey certificate id, decrypt the Masterkey certificate, and obtain the plaintext password of the host.

[0031] According to a third aspect of the present disclosure, an electronic device is provided, including:

[0032] one or more processors;

[0033] A storage unit is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors can implement any of the above methods for Java RMI deserialization vulnerability detection.

[0034] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any of the above methods for Java RMI deserialization vulnerability detection can be implemented.

[0035] The present invention provides a system, method, electronic device and storage medium for Java RMI deserialization vulnerability detection, which automatically detects deserialization vulnerabilities in Java RMI services by integrating network scanning, port detection, service identification, Java deserialization script execution and credential file parsing functions, obtains and utilizes the permissions of the target system, further analyzes the credential files stored in the system to expand the detection scope, and finally generates a detailed vulnerability detection report. In this way, comprehensive detection and analysis of Java RMI deserialization vulnerabilities are achieved, detection efficiency and accuracy are improved, and system security is effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of the structure of a system for Java RMI deserialization vulnerability detection according to an embodiment of the present disclosure;

[0037] Figure 2 A flowchart of a method for detecting Java RMI deserialization vulnerabilities according to an embodiment of the present disclosure;

[0038] Figure 3 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present disclosure.

[0040] The terms used in the disclosed embodiments are only for the purpose of describing specific embodiments and are not intended to limit the disclosed embodiments. The singular forms of "a", "said" and "the" used in the disclosed embodiments and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0041] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the disclosed embodiments, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the disclosed embodiments, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0042] like Figure 1 FIG. 1 is a schematic diagram of the structure of a system for Java RMI deserialization vulnerability detection according to an embodiment of the present disclosure. The system includes:

[0043] The scanning module 110 is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0044] The deserialization module 120 is used to run the Java deserialization script to obtain the system permissions of the RMI server;

[0045] A parsing module 130, used to parse the credential file of the RMI server and decrypt the ciphertext password of the host;

[0046] The detection report module 140 is used to generate a Java RMI deserialization vulnerability detection report.

[0047] Specifically, the scanning module 110 is responsible for receiving a target IP address list input by a user, performing a network reachability detection on each IP address in the list, identifying an open port of the reachable IP address, and identifying a service running under the port.

[0048] Check whether the target IP address is reachable on the network by sending ICMP requests (such as Ping scan) or other detection methods. This step ensures that subsequent operations are only performed on hosts that are actually online.

[0049] Perform a full port scan on the reachable IP addresses, use TCP SYN scan or TCP Connect() scan, detect the openness of each port in turn, and record all open port numbers.

[0050] By sending specific packets to an open port and analyzing the returned response, the type of service running on the port is determined. The result of service identification will be used for further classification, such as identifying whether it is a Java RMI service.

[0051] The deserialization module 120 runs a Java deserialization script and uses the identified Java RMI service port to perform a deserialization attack, thereby obtaining the system permissions of the RMI server.

[0052] A specific Java deserialization script is run in the detector's RMI client. The script constructs a malicious object and exploits a deserialization vulnerability to execute arbitrary code.

[0053] By executing the deserialization script, the system permissions of the target RMI server are successfully obtained, usually obtaining the execution permission for operating system commands, such as obtaining detailed system information by executing the systeminfo command.

[0054] The deserialization module can support a variety of deserialization vulnerability exploitation tools (such as Ysoserial), and can be extended to support the detection of more Java deserialization vulnerabilities. In addition, multiple detection modes can be integrated to deal with different types of Java RMI services.

[0055] The parsing module 130 is responsible for further analyzing the RMI server that has obtained the authority, especially parsing the credential file saved by the RMI server and decrypting the ciphertext passwords of other hosts stored therein.

[0056] After obtaining the system permissions of the RMI server, use system commands (such as dir / a) to find and read the credential files stored in the system (such as the Windows Credentials file).

[0057] Use tools such as Mimikatz to decrypt the ciphertext passwords stored in the credential files and convert them into plaintext passwords for further access to other related hosts.

[0058] This module can add parsing support for various types of credential files (such as SSH key files, database connection credentials, etc.) to improve the success rate of decryption.

[0059] The detection report module 140 generates a complete Java RMI deserialization vulnerability detection report based on the information obtained by the aforementioned modules.

[0060] The results of all steps, including scanning, deserialization attack, and credential file parsing, are summarized into a detailed detection report. The report includes all detected hosts and their vulnerabilities, system permission acquisition, parsed plaintext passwords, risk assessment, and repair suggestions.

[0061] The report assesses the risk level of each detected vulnerability and provides corresponding repair suggestions to help users understand the severity of the vulnerability and how to repair it.

[0062] The report generation module can be combined with the automated reporting tool to make the report more intuitive, such as displaying the network topology and vulnerability distribution through charts. In addition, a historical comparison function can be added to compare the current detection results with the past detection results to help users understand the changes in security status.

[0063] Through the collaboration of these four modules, the system of the present invention can realize the whole process automation from target network scanning, vulnerability attack, data parsing to final report generation, which greatly improves the detection efficiency and accuracy of Java RMI deserialization vulnerabilities.

[0064] like Figure 2 FIG. 1 is a flow chart of a method for detecting Java RMI deserialization vulnerabilities according to an embodiment of the present disclosure. The method includes:

[0065] S201: Input a target IP address list to a scanning module, and detect the network reachability of each IP address in the target IP address list;

[0066] S202: If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0067] S203: Classifying services by identifying services running under open ports;

[0068] S204: If the service is classified as a Java RMI service, obtain the system permissions of the RMI server through a Java deserialization script;

[0069] S205: using the system authority of the RMI server to obtain the credential file of the RMI server, and parsing the credential file to obtain the ciphertext password of the host connected by RDP communication;

[0070] S206: Use the mimikatz tool to decrypt the ciphertext password to obtain the plaintext password of the host;

[0071] S207: Generate a Java RMI deserialization vulnerability detection report according to the plaintext password.

[0072] Specifically, S201: input a target IP address list into a scanning module, and detect the network reachability of each IP address in the target IP address list.

[0073] The user needs to enter a list of IP addresses of the target network, and the system uses the scanning module to check whether these IP addresses are reachable in the network one by one.

[0074] The user enters the IP address of the target network into the system. The scanning module detects the network reachability of the target IP by sending ICMP requests (such as Ping scans) or TCP handshakes. This step filters out online IP addresses and prepares for subsequent port scanning.

[0075] This step can be extended to improve the detection capability of hidden or isolated networks through multi-path detection or firewall bypass technology.

[0076] S202: If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers.

[0077] Aims to perform a comprehensive port scan of reachable IP addresses to determine which ports are open.

[0078] Use TCP SYN scan, TCP Connect() scan or UDP scan to detect each port from 1 to 65535 in turn and check its open status.

[0079] Record the detected open ports so that subsequent steps can use this information for service identification and classification.

[0080] More types of scanning technologies can be integrated, such as UDP scanning and service fingerprint analysis, to further improve the ability to identify hidden services. Support for firewall rule bypass and low-rate scanning technology can also be added to avoid being detected and blocked by the target network.

[0081] S203: Classify the services by identifying the services running under the open ports.

[0082] The system analyzes the services running on each open port in order to classify and identify the service type.

[0083] Send specific detection packets to open ports and identify the service type through the returned response. You can use tools such as Nmap's service detection function to identify the service type by analyzing the service's banner information or using a fingerprint database.

[0084] According to the identification results, the service is classified into a specific type (such as HTTP, FTP, SSH, etc.), especially to identify whether it is a Java RMI service.

[0085] It can increase the recognition capability of SSL / TLS encrypted services and expand support for new protocols such as HTTP / 2 and QUIC. It can also introduce AI or machine learning models to improve the accuracy and speed of service recognition.

[0086] S204: If the service is classified as a Java RMI service, the system permissions of the RMI server are obtained through a Java deserialization script.

[0087] When a port is identified as running a Java RMI service, the system will exploit the deserialization vulnerability to try to obtain system permissions for the service.

[0088] Run the Java deserialization script and construct a malicious object to trigger the deserialization vulnerability. This vulnerability allows attackers to execute arbitrary commands on the RMI server and obtain system permissions.

[0089] Through successful vulnerability exploitation, the system obtains the operating permissions of the RMI server and can execute arbitrary system commands, such as viewing system information, modifying configurations, or further launching attacks.

[0090] It can support multiple Java deserialization vulnerability exploitation scripts and tools to expand its scope of application. At the same time, it can also integrate detection bypass technology to deal with various anti-vulnerability exploitation measures, such as security sandboxes and firewalls.

[0091] S205: Using the system authority of the RMI server to obtain the credential file of the RMI server, and parsing the credential file to obtain the ciphertext password of the host connected to the RDP communication.

[0092] Using the obtained RMI server system permissions, it further obtains and parses the credential files stored in the system, especially the RDP connection credentials.

[0093] Search and obtain the stored credential file in the RMI server system, such as the Windows Credential file.

[0094] Use appropriate tools or commands (such as the dir / a command) to find the encrypted passwords stored in the credential file. Especially for RDP connections, the encrypted passwords are often used to remotely log in to other hosts.

[0095] It can be expanded to support more types of credential files (such as database connection credentials, SSH key files, etc.), and integrate multiple parsing tools to improve the parsing capabilities of various encrypted credential files.

[0096] S206: Use the mimikatz tool to decrypt the ciphertext password to obtain the plaintext password of the host.

[0097] The system uses the Mimikatz tool to decrypt the ciphertext password extracted from the credential file and obtain the plaintext password for the RDP connection.

[0098] Mimikatz decryption: Use the Mimikatz tool to decrypt the ciphertext password in the credential file. Mimikatz can extract and decrypt the credential data stored in the system.

[0099] After successful decryption, the system obtains the plaintext password required for the RDP connection, which can be used to further access other hosts in the network.

[0100] The use of decryption tools can be extended to support similar tools for other operating systems (such as Hashcat for Linux), and support for decryption of complex encryption algorithms can be added. In addition, multi-step authentication and vulnerability detection in multi-factor authentication environments can be combined.

[0101] S207: Generate a Java RMI deserialization vulnerability detection report according to the plaintext password.

[0102] The system generates a detailed report of the entire detection process, including detected vulnerabilities, obtained credentials, decrypted plaintext passwords, etc.

[0103] Aggregate the results of all previous steps into a detailed report. The report should include each host detected, vulnerabilities found and their exploits, credentials and passwords obtained, and a risk assessment for the entire network.

[0104] Based on the detection results, the risk level and repair suggestions for each vulnerability are provided to help users take measures to repair system vulnerabilities and ensure network security.

[0105] The report generation module can be further expanded into an automated report generation system that supports exporting to multiple formats (such as PDF, HTML, etc.) and can be integrated with vulnerability management systems. At the same time, a historical comparison function can also be added to help users understand the changing trends of security conditions.

[0106] Beneficial effects: Through the complete path of target network scanning, service identification, vulnerability exploitation, credential acquisition and decryption, to the final report generation, each step is closely linked to achieve in-depth detection and extended attack on Java RMI server-side vulnerabilities, providing security analysts with powerful tools and information to improve the efficiency of network security situation awareness and vulnerability repair.

[0107] Furthermore, if the service is classified as a Java RMI service, obtaining the system permissions of the RMI server through the Java deserialization script includes:

[0108] Get the Java Runtime class;

[0109] Obtain the getRuntime method from the Runtime class through the reflection mechanism;

[0110] Reflectively call the getRuntime method to obtain the Runtime object;

[0111] Reflectively call the exec method of the Runtime object and execute the system command systeminfo to obtain the system permissions of the RMI server.

[0112] The Runtime class is one of the core classes of Java, which provides operations related to the runtime of Java applications. Through this class, you can obtain system information, execute system commands, etc. The purpose of this step is to prepare the basis for subsequent operations.

[0113] Pass the first parameter into the Transformer function:

[0114] new ConstantTransformer(Runtime.class) is used to obtain the Runtime class.

[0115] Reflection allows Java code to access the properties and methods of a class at runtime. In this step, reflection is used to obtain the getRuntime() method from the Runtime class, which is used to obtain the runtime instance of the current Java application.

[0116] Pass the second parameter to the Transformer function:

[0117] New InvokerTransformer

[0118] ("getMethod",new Class[]{String.class,Class[].class},

[0119] newObject[]{"getRuntime",new Class[0]}), used to reflectively call the getMethod method, use the getMethod method to reflectively call the getRuntime method for the second time, and return the Runtime.getRuntime() method.

[0120] Once the getRuntime method is obtained, the next step is to call this method through reflection to obtain the Runtime instance of the current Java virtual machine. This instance provides the necessary context for executing system commands.

[0121] The getRuntime method is called reflectively to obtain the Runtime object.

[0122] Pass the third parameter into the Transformer function:

[0123] new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[0]}), is used to reflectively call the invoke method.

[0124] Then reflectively execute the Runtime.getRuntime() method to return the Runtime instantiation object.

[0125] Reflectively call the exec method of the Runtime object and execute the system command systeminfo.

[0126] Finally, the exec method of the Runtime object is called through reflection to execute the system command (here, systeminfo). This command is used to obtain detailed information about the operating system and its configuration, including the system version, installation date, memory, processor, etc. Successful execution of this command means that the system permissions of the RMI server have been successfully obtained.

[0127] When making a reflective call, you need to consider possible exceptions (such as NoSuchMethodException, IllegalAccessException, etc.). Implementing an appropriate error handling mechanism can ensure that the system can handle exceptions safely without causing service crashes.

[0128] Before executing the systeminfo command, you can check the current user's permissions to ensure that the command can be successfully executed. If the permissions are insufficient, the system can terminate the operation early and return the corresponding error message.

[0129] In addition to the fixed systeminfo command, the system can be designed to support dynamic input of other commands to perform user-defined system operations.

[0130] After executing systeminfo, the obtained system information can be further parsed and valuable data can be extracted. This data can be used for subsequent security analysis and risk assessment, such as identifying unpatched systems or insecure configurations.

[0131] After obtaining system permissions, the system can be designed to automatically conduct a more in-depth security assessment, including checking the system for other vulnerabilities, configuration errors, or potential security risks, to further enhance security.

[0132] Beneficial effects: Using Java deserialization scripts to obtain system permissions on the RMI server can effectively obtain information about the operating system, laying the foundation for subsequent security analysis and vulnerability detection. Combined with extended content, this process not only improves the efficiency and accuracy of detection, but also enhances the security protection capabilities of the system.

[0133] The method of using the system authority of the RMI server to obtain the credential file of the RMI server and parsing the credential file to obtain the ciphertext password of the host connected by the RDP communication includes:

[0134] pass

[0135] Use the dir / a%userprofile%\AppData\Local\Microsoft\Credentials\* command to view the credential file saved by the RMI server.

[0136] The credential file is parsed to obtain the ciphertext password of the host connected to the RDP communication.

[0137] Order

[0138] The purpose of dir / a%userprofile%\AppData\Local\Microsoft\Credentials\* is:

[0139] %userprofile% is an environment variable that represents the path to the home directory of the currently logged in user.

[0140] AppData\Local\Microsoft\Credentials is the default location for storing user credentials in Windows systems. This is where the encrypted passwords related to RDP connections are stored.

[0141] The / a option ensures that the command lists all files, including hidden and system files.

[0142] In addition to RDP credential files, Windows systems may also store other types of credentials (e.g., VPN connections, network shares, database connections, etc.). Extended detection can include searching for these credential files in paths such as AppData\Roaming\Microsoft\Credentials or C:\ProgramData\Microsoft\Windows\Credentials.

[0143] After extracting the ciphertext password, you can further compare it with known security vulnerability databases (such as CVE, NVD) to evaluate the security of the credentials and potential attack risks. In addition, you can generate a detailed report based on the extracted credentials to help users identify and fix security risks.

[0144] Monitoring mechanisms can be established to track access and modification of credential files to help detect potential malicious activities or abuse of permissions. When suspicious activities are detected, alerts can be automatically triggered and response procedures can be initiated.

[0145] Beneficial effects: Through the above steps and extensions, the ciphertext password of the RDP communication connection can be effectively obtained by using the system permissions of the RMI server to obtain and parse the credential file, providing important information for subsequent security assessment and vulnerability repair. This process not only enhances the security of the system, but also provides necessary protection measures for potential security threats.

[0146] The use of the mimikatz tool to decrypt the ciphertext password to obtain the plaintext password of the host includes:

[0147] Use the mimikatz tool to obtain the guidMasterKey credential id of the ciphertext password;

[0148] Query the Masterkey certificate mapped by the guidMasterKey certificate id, decrypt the Masterkey certificate, and obtain the plaintext password of the host.

[0149] Use the mimikatz tool to obtain the guidMasterKey credential id of the ciphertext password;

[0150] Mimikatz is used to extract credential information in Windows systems. Ciphertext passwords are usually associated with a unique identifier (guidMasterKey), which acts as an index in the credential storage. Through the mimikatz tool, this guidMasterKey credential ID can be extracted to prepare for the subsequent decryption process.

[0151] Query the Masterkey credential mapped to the guidMasterKey credential id:

[0152] Once the guidMasterKey credential id is obtained, the system needs to query the corresponding Masterkey credential. A Masterkey credential is a special type of credential used to store decryption keys associated with user ciphertext. Through the mapping relationship, the Masterkey credential corresponding to the credential id can be found.

[0153] Decrypt the Masterkey certificate to obtain the plaintext password of the host;

[0154] By using mimikatz, the system is able to access the contents of the Masterkey credential and use it to decrypt the ciphertext password associated with it. Once decrypted successfully, the plaintext password is obtained, which can be used for subsequent authentication or further system access.

[0155] In order to accurately obtain the ciphertext password, the system should be able to identify and locate the storage location of the credential file. The ciphertext password is usually stored in a specific path under the user directory, such as %userprofile%\AppData\Local\Microsoft\Credentials\. Providing a valid path check can increase the success rate.

[0156] When performing decryption operations, recording operation logs can help with post-auditing and tracking. The logs contain operation timestamps and related user information.

[0157] The plaintext passwords can be used for subsequent network penetration testing or security assessments. The system can use these passwords to try to connect to other network services to identify potential security risks and vulnerabilities.

[0158] Beneficial effects: By using the mimikatz tool to decrypt the ciphertext password and obtain the plaintext password, the system can provide the necessary information for further security analysis. This process not only improves the detection efficiency, but also lays the foundation for subsequent security assessments. Combined with the extended content, the detection and decryption process can be carried out more safely and efficiently, providing support for the security protection of the entire system.

[0159] The embodiments of the present disclosure provide a system, method, electronic device and storage medium for Java RMI deserialization vulnerability detection, which automatically detects deserialization vulnerabilities in Java RMI services by integrating network scanning, port detection, service identification, Java deserialization script execution and credential file parsing functions, obtains and utilizes the permissions of the target system, further analyzes the credential files stored in the system to expand the detection scope, and finally generates a detailed vulnerability detection report. In this way, comprehensive detection and analysis of Java RMI deserialization vulnerabilities are achieved, detection efficiency and accuracy are improved, and system security is effectively improved.

[0160] The electronic device 300 may be a desktop computer, a notebook, a PDA, a cloud server, or other electronic device. The electronic device 300 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of the electronic device 300 and does not constitute a limitation of the electronic device 300. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0161] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0162] The memory 302 may be an internal storage unit of the electronic device 300, for example, a hard disk or memory of the electronic device 300. The memory 302 may also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Further, the memory 302 may also include both an internal storage unit of the electronic device 300 and an external storage device. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0163] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present disclosure. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0164] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0165] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0166] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0167] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0168] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0169] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0170] The above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be included in the protection scope of the present disclosure.

Claims

1. A system for Java RMI deserialization vulnerability detection, characterized in that: include: A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service; Deserialization module, used to run Java deserialization scripts to obtain system permissions on the RM I server; A parsing module, used to parse the credential file of the RM I server and decrypt the ciphertext password of the host; The detection report module is used to generate Java RM I deserialization vulnerability detection reports.

2. A method for Java RMI deserialization vulnerability detection, characterized in that: include: Inputting a target IP address list into the scanning module, and detecting the network reachability of each IP address in the target IP address list; If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers; Classify services by identifying services running under open ports; If the service is classified as a Java RM I service, obtain the system permissions of the RM I server through the Java deserialization script; Using the system authority of the RMI server to obtain the credential file of the RMI server, and parsing the credential file to obtain the ciphertext password of the host connected by RDP communication; Use the mimikatz tool to decrypt the ciphertext password to obtain the plaintext password of the host; A Java RMI deserialization vulnerability detection report is generated according to the plaintext password.

3. A method for Java RMI deserialization vulnerability detection according to claim 2, characterized in that: If the service is classified as a Java RMI service, the system permissions of the RMI server are obtained through the Java deserialization script: Get the Java Runtime class; Obtain the getRuntime method from the Runtime class through the reflection mechanism; Reflectively call the getRuntime method to obtain the Runtime object; Reflectively call the exec method of the Runtime object and execute the system command systeminfo to obtain the system permissions of the RMI server.

4. A method for Java RMI deserialization vulnerability detection according to claim 2, characterized in that: The method of using the system authority of the RMI server to obtain the credential file of the RMI server and parsing the credential file to obtain the ciphertext password of the host connected by the RDP communication includes: pass Use the dir / a%userprofile%\AppData\Local\Microsoft\Credentials\* command to view the credential file saved by the RMI server. The credential file is parsed to obtain the ciphertext password of the host connected to the RDP communication.

5. A method for Java RMI deserialization vulnerability detection according to claim 2, characterized in that: The use of the mimikatz tool to decrypt the ciphertext password to obtain the plaintext password of the host includes: Use the mimikatz tool to obtain the guidMasterKey credential id of the ciphertext password; Query the Masterkey certificate mapped by the guidMasterKey certificate id, decrypt the Masterkey certificate, and obtain the plaintext password of the host.

6. An electronic device, characterized in that: include: one or more processors; A storage unit, used to store one or more programs, when the one or more programs are executed by the one or more processors, can enable the one or more processors to implement the method for JavaRM I deserialization vulnerability detection according to any one of claims 2 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting Java RM I deserialization vulnerabilities according to any one of claims 2 to 5 can be implemented.

Images