TL; DR
I whakaputaina he taonga tuku iho a Maven Central hei io.github.davidtimur:c2-lab i tukuna e iwa ngā tukunga, e waru o ēnei i whakahaere i tētahi kawenga urunga-mamao i te wā e whakahiatohia ana tētahi kaupapa i raro iho i whakanoho i te ipu ki tōna ara tukatuka-whakamōhiotanga. Kāore he waehere tono i hiahiatia hei kawemai. Kāore he raina pūtake i hiahiatia hei tohutoro. Kāore he tuhinga tāutanga, kāore he tauira i muri i te tāutanga, kāore hoki he matau huringa ora o tētahi momo hei tirotiro mā ngā taputapu.
Ko te wetereo whakatinanatanga he kōnae kotahi 46-paita i roto i te ipu: he rēhitatanga kaiwhakarato ratonga Java e whakaingoa ana i tētahi akomanga e whakatinana ana i javax.annotation.processing.Processor. Ka kitea aunoatia e te kaiwhakaemi Java aua rēhitatanga. Kia kitea, javac ka whakatū me te whakahaere i te akomanga hei wāhanga noa o te whakahiato. Ko te tikanga ko te taiao wā-oma o te kawenga ko te mīhini hanga, i tēnei wā kei te mahi te mīhini hanga i te mea kotahi e wātea ana hei mahi.
I roto i ngā tukunga e iwa, e toru ngā wā i hangaia anōtia ai te hongere whakahau-me-te-mana: he URL karanga-whakahoki i tukuna mai e te kaiwhakahaere, kātahi ka he anga whakamuri i runga i te kauhanga TCP ngrok, kātahi ka he hongere pōti HTTP e rua ngā nekehanga o ōna ara. I tāutahia e te tukunga whakamutunga he kaiwhakahaere whakawhirinaki TLS kore-whakahaere hei taunoa JVM, te whakaae i tētahi tiwhikete mō te roanga o te whakahiato.
I roto i te taonga tuku iho ngā kupu "C2 Lab Payload" me te raihana MIT. I ora tonu i runga i te Maven Central mō te wā katoa i mātakihia ai e mātou, ā, kua tangohia atu i muri mai, me tōna katoa io.github.davidtimur rōpū.
Anatomy: te kaiwhakaemi hei miihini whakahaere
Kei te wātea te anga tukatuka tuhipoka a Java kia taea ai e ngā whare pukapuka te whakaputa waehere i te wā whakahiato — te tikanga kei muri i a Lombok, Dagger, me te rārangi roa o ngā taputapu ORM me te raupapatanga. Ka whakapuakina e te tukatuka ia ia anō me te kōnae kuputuhi-mārama i roto i te ipu:
META-INF/ratonga/javax.annotation.processing.Tukatuka
Ko ngā ihirangi o taua kōnae i roto i ia tukunga kua pāngia, ā-kupu me te katoa:
io.github.davidtimur.c2lab.C2Processor
He rite tonu te rahi o te kōnae puta noa i ngā putanga 1.0.1 ki te 1.0.8, md5 7d2a08a5c8869a47eea9fa62487dfbe4. Kāore tēnei i roto i te Putanga 1.0.0.
A, no te javac Ina oma, ka matawaihia e ia te ara tukatuka-whakamōhiotanga mō ēnei tāurunga ratonga ka utaina ngā mea ka kitea e ia. Kāore he mea i roto i te kaupapa e whakahiatohia ana e hiahia ana ki te whakahua i te tukatuka, ki te tāpiri i tētahi mea, ki te whirihora rānei i tētahi mea. He rawaka te noho ki te ara. Koinei te āhuatanga e wehewehe ana i a JavacDoor mai i ngā tauira mekameka tuku e hangaia ana te nuinga o ngā taputapu:
He whakapuakitanga te matau tāuta i roto i tētahi whakaaturanga, ā, ko te whakaaturanga te mea tuatahi ka pānuihia e te tangata. Kei roto i te pūtake ka taea te pānui te utauta wā-kawemai. Kāore te rēhitatanga ratonga i te mea pai: he ingoa kōnae me te rārangi kotahi e whakaingoa ana i tētahi akomanga, ā, kei roto te whanonga i te bytecode kua whakahiatohia i tētahi whaiaronga tawhiti.
Mā te akomanga utauta tonu e tirotiro te kaihautū mā te tuku moni. Kei roto i ngā puna tūmau o ngā akomanga kua whakahiatohia /bin/sh, whoami, uru mai ki ahau -, pwd i te ara Unix me rārangi mahi i te ara Windows, me te whakawhitiHapaAroma hei whakakotahi i te putanga hapa o te tukanga tamaiti ki roto i te awa kua hopukina. E rua ngā tauira JSON e kawe ana i ngā hua mai i te kaihautū — he tohu rēhitatanga:
{"host":"%s","os":"%s","user":"%s","dir":"%s"}
te hunga i nohoia mai i te ingoa ingoa whakahau me te ingoa os, ingoa kaiwhakamahi, a te kaiwhakahaere.kaiwhakamahi ngā āhuatanga pūnaha, me te karangatanga hua:
{"version":"%s","host":"%s","time":"%s","output":"%s"}
He tino mārama rawa ngā tohu ahunga whakamua i mahue i roto i te putanga ake a te kaiwhakaemi: [C2] kua oti te whakahaerenga wā whakahiato, [C2] waea whakahoki i tukuna → HTTP , [C2] anga e hono ana ki .
E iwa ngā tukunga, e toru ngā whakatipuranga C2
Ehara ngā tukunga i te iwa tārua o te kawenga kotahi. He rārangi tāruarua noa iho, ā, mā te pānui i aua tukunga i runga i te raupapa ka kitea te hanga anō o te hongere i te wā e mau tonu ana te ara tuku.
E toru ngā kōrero o taua ripanga e tika ana kia tuhia, nā te mea ka rerekē ia kōrero me pēhea te pānui i te huinga taonga tuku iho.
Ka tae te wetere ki te 1.0.1, ehara i te 1.0.2. Kei te Tukunga 1.0.0 te arorau tirotiro me te karanga whakahoki ōrite engari kāore he kōnae ratonga, kāore hoki he kawemai tukatuka-tuhipoka; ka oma anake mēnā ka karangatia e tetahi. Mai i te 1.0.1 kei reira te kōnae ratonga, ā, ka kawemai ngā akomanga kua whakahiatohia. javax.annotation.processing.PutangaPūtakeTautokoKo tētahi aromatawai e whakataurite ana i ngā tukunga tīkiti e rua — 1.0.0 me 1.0.2 — ka whakatau tika i tētahi mea i rerekē, engari kāore i te tautuhia te wāhi.
Kei roto tonu i te tukunga kotahi te anga whakamuri. Kei roto i te Putanga 1.0.2 0.tcp.ngrok[.]io, te rārangi takiuru [C2] anga hono ki te 0.tcp.ngrok[.]io:19823, he haki taunekeneke anga-c2, me te kaiwhakamutu anga __END__Kāore he mea o roto i ngā putanga 1.0.3 kei roto i ēnei, engari ka tae atu ki tētahi kaihautū HTTPS. Mēnā ka tonohia kia whakaingoatia ngā putanga kua tohua anake, ka kīia he pito mutunga TCP kua mate, ā, ka mahue te hongere HTTP ora, kei roto i ngā putanga e ono i muri mai, kāore i whakahuatia.
Ka tangohia te manatoko kawe i te tukunga whakamutunga. Ka tāpirihia e te Putanga 1.0.8 tētahi akomanga e whakatinana ana javax.net.ssl.X509KaiwhakahaereTrust kāore he mahi a āna tikanga tirotiro tiwhikete, he manatoko ingoa manaaki pono tonu kua rēhitatia mā tautuhingaTaunoaIngoaManatūManatoko, Me he whakawhirinakiKatoa he mahinga e tāuta ana i ngā mea e rua hei taunoa mō te JVM. Ko te hua, mō te toenga o taua whakahiato, ka whakaaetia e te JVM tetahi tiwhikete mai i tētahi kaihautū — ehara i te mea mō te waka ake a te kawenga anake, engari mō tetahi atu mea ka mahia e te hanganga mā te TLS i muri mai.
Ko te hongere HTTP, i roto i ngā putanga e ono e whakamahi ana, e whakahaerehia ana e te kaihautū kotahi: tepu-tino-kaha-porangi.ngrok-kore[.]devKei roto i ia tono te pane whakatūpato-ngrok-tīpoka-pūtirotiro, e pehi ana i te whārangi whakawātea e mahi ana ngā kauhanga ngrok kore utu ki ngā pūtirotiro. Ka neke ngā huinga ara puta noa i ngā tukunga — /waho ngaro atu i te 1.0.7, ā, /cmd ka whakawhiti ki /pōti — engari kāore te kaihautū e rerekē.
Ko te kōrero mō te aukati i a koe anō
Ka whakatakotohia e ia POM mai i te 1.0.1 ki mua he tautohe a te kaiwhakaemi mō te hanganga ake o te taonga:
-proc:kāore
Ka whakakorehia e taua haki te tukatuka tuhipoka. Ko tōna pānga i konei he mea o muacise: ina whakahiatohia te kaupapa kei roto nei te tukatuka, kāore te tukatuka e rere.
He whakamahinga noa iho tēnei haki. Me karo te kaupapa e tuku ana i tētahi tukatuka tuhipoka i te whakamahi i taua tukatuka ki a ia anō i te wā whakaara, ā, e taunaki ana ngā tuhinga taputapu hanga i tēnei. Ki te tangohia anake, kāore he mea e whakaatu ana i tēnei.
Ahakoa te mahi a te tukatuka, e whakaahua ana i tētahi āhua rerekē: ka whakahaerehia te waehere i runga i ngā mīhini o te hunga katoa e whakahiato ana ki te taonga tuku iho, kaua i runga i te mīhini e hanga ana i te taonga tuku iho. Ka puta te haki i roto i te tukunga kotahi e whakauru ana i te kōnae ratonga — 1.0.1 — me ia tukunga i muri mai. Ko te hononga i waenga i "te tukunga ka tīmata te whakahaerenga wā-whakahiato" me "te tukunga ka whakawetohia te whakahaerenga wā-whakahiato ā-rohe" ko te tohu tātaritanga tino whai hua i roto i te huinga taonga tuku iho, ā, ka kitea i roto i te POM kuputuhi-mārama me te kore e wetewete i tetahi mea.
Ka kite tātou i te pānga, ā, ka mutu i reira. Kāore he mea i roto i ngā taonga tuku iho e kōrero ana mō te take i whakatūria ai te haki.
Me kōrero anō tētahi atu raraunga raraunga, ko te nuinga hei whakakore atu. Ka tapaina te kaupapa e te POM ko "C2 Lab Payload", ka whakaahuahia hei "taonga utauta taiwhanga C2", ā, ka raihanahia ki MIT. Ko te tapanga-ake o tēnei momo ka tukuna i ētahi wā hei taunakitanga he mahi rangahau te kete.ciskaua ki te riri ora, ā, i ētahi wā he tika taua pānui — he rerekē te kaupapa o tētahi manu kōnihi kua whakapuakina kāore he hanganga e taea te toro atu i tēnei. Kāore e pā ki konei. Ko tētahi whakaurunga mahi kua whakaputaina ki tētahi putunga tūmatanui, ka taea te toro atu e tētahi kaihoko, me ngā hanganga e tukuna atu ana kua hangaia anō kia toru ngā wā puta noa i ngā tukunga e iwa, he āheinga ora ahakoa te ingoa o ana raraunga. Kāore te ingoa i roto i te POM e whakarerekē i tetahi mea mō ngā mea e tupu ana i runga i tētahi mīhini e whakahiato ana ki a ia.
Ngā tohu mō te hanga mīhini
Mena ka whakahiatohia he kaihautū hanga ki tēnei taonga tuku iho, ka noho ngā taunakitanga ki roto i ngā rangitaki hanga me te ine whatunga, kaua ki roto i tētahi whakaurunga pumau ki te kōpae — ka oma te kawenga i roto i te tukanga whakahiato, ka puta atu me taua mea.
I roto i te ipu, i te keteroki putunga ā-rohe rānei
META-INF/services/javax.annotation.processing.Processorwhakaingoaio.github.davidtimur.c2lab.C2Processor- Kōnae ratonga md5
7d2a08a5c8869a47eea9fa62487dfbe4 - Ngā akomanga i raro i
io/github/davidtimur/c2lab/:C2Processor,C2Task,Task, ā, i te 1.0.8 te akomanga o rotoTask$1
Putanga i roto i te hanga
[C2] compile-time execution complete[C2] callback sent → HTTP[C2] callback failed:[C2] shell connected to- Pānui taunekeneke
c2-shell; kaiwhakamutu anga__END__
Te ine waea i roto i te tukanga
javachei matua mō/bin/sh -c(Unix) he kaiwhakamāori whakahau Windows rānei- Ngā whakahau a te tamaiti
whoami,uname -a,pwd(Unix) rāneitasklist(Windows) i mātuahia e te taahiraa whakahiato
I roto i te telemetry whatunga
- TCP puta atu ki
0.tcp.ngrok[.]io:19823(tukunga 1.0.2) - HTTPS ki
tableful-fervor-crazed.ngrok-free[.]dev, ngā ara/register,/cmd,/poll,/out(tukunga 1.0.3 ki te 1.0.8) - Pane tono
ngrok-skip-browser-warning: true - Tonoa ngā tinana e taurite ana
{"host":...,"os":...,"user":...,"dir":...}or{"version":...,"host":...,"time":...,"output":...}
I roto i te whirihoranga
- Taurangi taiao
CALLBACK,CALLBACK_URLāhuatanga pūnahacallback.url
Ngā raraunga a te kaiwhakaputa
- rōpū
io.github.davidtimur; wāhitau o te kaiwhakaputadavudboi999@gmail[.]comkī waitohuE520C345EF94423D
Me tirotiro anō te hanganga i whakahaere i te putanga 1.0.8. Nā te mea ka tāutahia e taua putanga he kaiwhakahaere whakawhirinaki whakaae hei taunoa whānui-JVM, ka haere tonu tetahi hononga TLS i hangaia i muri mai i roto i te JVM kotahi — te whakatau whakawhirinakitanga, te tukuake taonga, te taahiraa whakatinanatanga — me te kore whakamana tiwhikete. Kaua e kiia he manatoko te haere mai i taua matapihi.
He aha i hiahiatia ai he matawai rerekē mō ngā taonga kua whakahiatohia
He whakamātautau whai hua a JavacDoor nā te mea ka hinga i ngā whakaaro noa e rua i te wā kotahi, ā, kāore tetahi o ngā hapa e pā ana ki ngā taputapu a tētahi kaihoko.
Ko te whakaaro tuatahi ko te waehere morearea e whakaatu ana i a ia anō i roto i tētahi whakaaturanga. He nui ngā taputapu mekameka tuku e whakaritea ana i runga i te huringa ora hooks, nā te mea mō te npm me te PyPI koinei te wāhi e mahi ai te mahi. Kāore he matau a JavacDoor. Ko tana whakaoho he kōnae rēhita-ratonga ko tōna ingoa he atanga Java, ā, ko tōna ihirangi he ingoa akomanga. Hei hopu i tēnā i runga i te āhua tūmau me mahi koe i META-INF/ratonga/javax.annotation.processing.Tukatuka hei wāhi whakauru whakatinanatanga i roto i tōna ake mana, he rite ki te i muri i te tāutanga tuhinga — kātahi ka whai i te akomanga kua whakaingoatia ki roto i te bytecode. He tikanga kimi-aunoa tō ngā pūnaha rauropi o tēnei āhua, ā, he wāhi whakauru ia ahakoa ka whakarārangihia e te taputapu hei kotahi, kāore rānei.
Ko te whakaaro tuarua ko ngā aho kei roto i ngā kōnae pūtake. Mō tētahi ipu, ko ngā pito mutunga, ko ngā whakahau anga, ko ngā tauira JSON, me ngā tohu takiuru kei roto katoa i ngā puna tūmau o .akomanga ngā kōnae. Kāore he mea e kitea ana e te taputapu e hopu ana i te tuhinga - ehara i te mea he mea huna ngā aho, engari nā te mea kei roto i tētahi ipu rua hanganga kāore e taea te wetewete e te matawai tuhinga. I puta mai ngā tohu whatunga katoa i roto i tēnei pou i te wetewete puna-tonu. Ko tētahi o aua mea he mea kua oti te hanga https:// Kei roto i tētahi kōnae akomanga te URL e kitea whānuitia ana; kāore tonu e puta mai i te matawai tuhinga o ngā ihirangi ka taea te pānui o te ipu. Kāore he waehere hei whakakore i konei, he hōputu ipu anake hei pānui.
He rite tonu te āhua o ngā āputa e rua: i whakaarohia te whakatakotoranga o te taonga tuku iho he putea kōnae, kaua he hanganga me ngā tikanga kua tautuhia. Kāore i te ātaahua te whakatikatika - wetewetehia te ipu, whakarārangihia ngā pūwāhi whakauru kitea-aunoa o te pūnaha rauropi, ka whai i a rātou ki roto i te waehere whakahiato. Mō ngā whārite wā-hanga, he iti te utu o te tirotiro tuatoru, ā, he mea whakamiharo te tātaritanga: whakatauritehia te mahi a te taonga tuku iho ki ngā kaihoko ki ngā mea e whakawāteahia ana e ia. Ko te taonga tuku iho e rēhita ana i te tukatuka wā-whakahiato, ā, i te wā kotahi ka mono i te tukatuka wā-whakahiato mō tana ake hanganga kua kōrero ki a koe i tētahi mea mōna ake i roto i ngā rārangi e rua o te POM kuputuhi-mā.
Mō ngā tīma e whakamahi ana i ngā taonga tuku iho a Maven i ēnei rā, e toru ngā mahi whai hua e whai ake nei:
- Whakamahia te ara tukatuka-annotation hei rohe whakatinanatanga. Ko ngā whakawhirinakitanga e tau ana ki reira ka whakahaere i te waehere i roto i tō hanganga. Ki te kore he hanganga e hiahia ki te tukatuka i ngā tohu, -proc:kāore he rite tonu te whai huatanga o te parepare ki tōna āhua ā-rohe i konei; ki te mahi pērā, ka pinea te huinga tukatuka kia mārama, kaua e riro mai i te ara akomanga whakahiato.
- Ngā tukanga iti o te kaikohikohi rangitaki. He rerekē te taahiraa whakahiato e whakaputa ana i tētahi anga i te nuinga o ngā kaupapa, ā, he māmā noa te whakatūpato.
- Kaua e whakamahia ngā raraunga raraunga hei taunakitanga. Ehara i te rohe whānuitanga te "Lab", "test", "payload", me te "PoC" i roto i te ingoa mōkihi, i te whakaahuatanga rānei. Ko te taea te toro atu me te whanonga he rohe whānui.
I tangohia te taonga tuku iho me tōna rōpū katoa mai i Maven E whai ana a Central i tā mātou pūrongo; ka whakahokia mai e te ara taonga me te ara rōpū te 404, ā, kāore he taunga ōrite e pūrongohia ana e te taupū Central. Ka kati tēnei taonga. Kāore e kati te vector, he āhuatanga kua tuhia o te kaikohikohi Java, ā, e wātea ana ki te hunga katoa e whakaputa ana i tētahi ipu.
Tohutoro
Kāore tēnei pou e whakahua ana i ngā puna o waho. Ko ngā kitenga katoa he tātaritanga tūturu tuatahi o ngā ipu e iwa kua whakaputaina, i tangohia mai i Maven Central i mua i te tangohanga. Kāore he waehere mai i ngā taonga tuku iho i whakahaerehia i tētahi wā.
