ilatypov
commented
2 years ago Perhaps this was a bad Java 8 docker image (its versioning scheme indicates that it's a rolling tag).
I used a different image but saw lots of IllegalArgumentExceptions and javaassist.NotFoundExceptions. Not sure if my suppressing those was a good idea. I did not see a guessed signature yet.
diff --git a/Dockerfile b/Dockerfile
index 500b582..8d86236 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,4 @@
-FROM openjdk:8
-COPY . /rmiscout
-WORKDIR /rmiscout
-RUN ./gradlew shadowJar
-ENTRYPOINT ["./rmiscout.sh"]
-CMD ["-h"]
+FROM gradle:7.4-jdk8
+USER gradle
+ENV GRADLE_USER_HOME="/home/gradle/.gradle"
+
diff --git a/build.gradle b/build.gradle
index 0cdb6c7..1c73f0d 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,7 +1,12 @@
+buildscript {
+ dependencies {
+ classpath 'com.github.jengelman.gradle.plugins:shadow:2.0.4'
+ }
+}
+
plugins {
id 'java'
id 'application'
- id 'com.github.johnrengelman.shadow' version '2.0.4'
}
sourceCompatibility = 1.8
@@ -27,10 +32,13 @@ repositories {
}
dependencies {
- testCompile group: 'junit', name: 'junit', version: '4.12'
- compile group: 'org.javassist', name: 'javassist', version: '3.27.0-GA'
- compile group: 'net.sourceforge.argparse4j', name: 'argparse4j', version: '0.8.1'
+ testImplementation group: 'junit', name: 'junit', version: '4.12'
+ implementation group: 'org.javassist', name: 'javassist', version: '3.28.0-GA'
+ implementation group: 'net.sourceforge.argparse4j', name: 'argparse4j', version: '0.8.1'
implementation 'com.github.frohoff:ysoserial:master-SNAPSHOT'
implementation 'com.github.BishopFox:GadgetProbe:master-SNAPSHOT'
}
+
+apply plugin: 'com.github.johnrengelman.shadow'
+
diff --git a/rmiscout.sh b/rmiscout.sh
index 39eb628..c913ad7 100755
--- a/rmiscout.sh
+++ b/rmiscout.sh
@@ -1,6 +1,6 @@
#!/bin/bash
-if [[ ! -f build/libs/rmiscout-1.4-SNAPSHOT-all.jar ]]; then
- ./gradlew shadowJar
+if [[ ! -f build/libs/rmiscout-1.4-SNAPSHOT.jar ]]; then
+ gradle --info clean shadowJar
fi
-java -jar build/libs/rmiscout-1.4-SNAPSHOT-all.jar "$@"
+java -jar build/libs/rmiscout-1.4-SNAPSHOT.jar "$@" 2> /dev/null
diff --git a/src/main/java/com/bishopfox/rmiscout/RMIConnector.java b/src/main/java/com/bishopfox/rmiscout/RMIConnector.java
index 5b4cb0c..f9724de 100644
--- a/src/main/java/com/bishopfox/rmiscout/RMIConnector.java
+++ b/src/main/java/com/bishopfox/rmiscout/RMIConnector.java
@@ -359,7 +359,11 @@ public class RMIConnector implements Connector {
isActivationServer = true;
Field f = RemoteObject.class.getDeclaredField("ref");
f.setAccessible(true);
+ try {
ref = (RemoteRef) f.get(stub);
+ } catch (IllegalArgumentException e) {
+ System.err.println("Illegal argument: " + interfaceName);
+ }
} else {
Field f = Proxy.class.getDeclaredField("h");
f.setAccessible(true);
@@ -412,6 +416,7 @@ public class RMIConnector implements Connector {
// at sun.rmi.transport.StreamRemoteCall.executeCall(StreamRemoteCall.java:222)
Thread.sleep(10);
+ if (ref != null) {
// Invoke remote method
Object response = ref.invoke(stub, me, params, methodHash);
@@ -419,6 +424,9 @@ public class RMIConnector implements Connector {
System.out.println(Utilities.Colors.YELLOW + "Executed: " + methodSignature + Utilities.Colors.ENDC);
System.out.println("\tResponse [" + response.getClass() + "] = " + response.toString());
return true;
+ } else {
+ System.err.println("ref: null for method " + methodSignature);
+ }
} catch (IllegalArgumentException e) {
if (e.getMessage().contains("argument type") || e.getMessage().contains("ClassCast")) {
System.out.println(Utilities.Colors.GREEN + "Found: " + methodSignature + Utilities.Colors.ENDC);
@@ -470,7 +478,8 @@ public class RMIConnector implements Connector {
defaultClassPool.getCtClass(pair.getValue().getClass().getName()).detach();
}
} catch (NotFoundException e) {
- e.printStackTrace();
+ System.err.println("Not found: " + interfaceName);
+ // e.printStackTrace();
}
}My run.sh,
#! /bin/bash
set -x
rm -rf tmp
mkdir -p tmp
docker build -t rmiscout -f Dockerfile tmp
rm -rf tmp
# docker ps -aq | xargs docker rm
# docker volume ls -q | xargs docker volume rm
docker run -it --read-only --rm \
--tmpfs /tmp:exec \
-v buildrequisites:/home/gradle/.gradle \
-v "${PWD}:/home/gradle/rmiscout" \
-w /home/gradle/rmiscout \
--entrypoint ./rmiscout.sh \
rmiscout "$@"
Description of Bug
The Docker build operation does not work as expected.
What should the expected behavior be
Docker build successful.
Platform Affected
N/A
Steps to Reproduce