Breaking Through the Defense: From Conventional RASP Bypass to Dynamic ASM Hook Removal

📝RASP Confrontation

RASP attack and defense practice

introduce:

Runtime Application Self-Protection (RASP) is a technology that secures applications while they are running. Unlike traditional security solutions, such as web application firewalls (WAF) or static code analysis (SAST), RASP is an internal security control mechanism that is integrated directly into the application or the application's runtime environment. RASP technology can monitor the behavior of applications, detect and defend against malicious attacks in real time, and provide real-time security protection measures to ensure the security and stability of applications.

summary:

Actual attack and defense of RASP technology involves many aspects, including configuring and deploying RASP solutions, simulating and testing attack scenarios, and responding to and responding to security incidents. When deploying RASP, customized configurations need to be made based on the characteristics and security requirements of the application, including the types of security events to be monitored, defense strategies, and alert mechanisms. Subsequently, the effectiveness and performance of RASP are evaluated by simulating various attack scenarios such as SQL injection, cross-site scripting (XSS), and file inclusion. Once a security incident is detected, RASP will trigger corresponding defense mechanisms, such as intercepting malicious requests, recording logs, and sending alerts, while taking repair measures as soon as possible to reduce the impact and loss of the attack. Through actual offensive and defensive training and drills, the team can improve their understanding and application capabilities of RASP technology, enhance the security protection capabilities of applications, and effectively respond to evolving security threats.

Here are some RASP bypass methods:

JNI calls bypass-rasp

The underlying logic still directly calls java-native to call c++-lib and then executes the command. However, rasp-hook can only hook the java utilization chain, and it is difficult to capture the final usage logic of jni.

accomplish:

Let’s start with the Godzilla source code. Keywords loadLibrary native

BehinderClientSource\src\main\java\net\rebeyond\behinder\payload\java\LoadNativeLibrary.java

1. Define the jni.h header, use the jni of the header file to create a CommandExecution_exec, and compile the two files into linuxlib or windows-dll.

1. Define a classloader to load

1. Use classloader to load command execution classes

1. invoke execution or reflection loading classloader command execution class c++lib

ASM-agent blind javassist-rasp

Recently, ASM-RASP (Completed half of the content of openrasp. It only needs 600kb in size, while openrasp-engine needs 30M.), I thought of and tested this point

Principle: Use the method of ASM-agent→attch→java_web. Directly blind javassist-rasp. The principle is because ASM provides low-level operations on bytecode, allowing users to accurately control the structure and behavior of classes, while javassist operates bytecode at an abstract level and directly uses java code snippets to modify classes. In the final analysis, ASM is lower-level than javassist, and some r on the market asp, refer to Baidu openrasp, etc. all use javassist-rasp (hook-web-operation → check → modify bytecode). Therefore, we use ASM-agent to execute our de-operation bytecode before javassist-rasp → hook. This blinds it without causing javassist-rasp to go offline, or even blinds only part of the operation, so that most of its functions are retained.

Practical scenario: When we bypass-rasp to obtain web machine permissions, but we are worried that this bypass trick will be investigated and repaired. Then we can write our own ASM-agent to blind javassist-rasp

Specific implementation: check hook→http class→detect our attack traffic (for example, we customize the header ATTCK: yes in the request package)→methodvisitor does not modify the bytecode.

Related pictures:
1. Use the traditional openrasp-premain method to implement rasp and be able to perform interception

It will intercept and jump to the custom interception interface I used for openrasp testing (the IP was manually modified for temporary testing)

1. Use our asm-bypass-agent for attach

At this time visit the testing vulnerability range again

Successful bypass-openrasp

Related project links:‣

For questions about RASP confrontation guidance or use, you are welcome to leave a message in the comment area at the bottom and communicate together~