‌Hadoop Yarn RPC 未授权访问

漏洞原理：

Hadoop Yarn RPC未授权访问是一类高危安全漏洞，攻击者无需身份认证即可通过默认开放的‌8032端口‌调用YARN ResourceManager的RPC接口，直接提交恶意应用并在集群节点上执行任意系统命令，完全接管大数据集群控制权。

import socket
import struct
import sys

def build_rpc_header(service_name_str):
    """
    构建 Hadoop RPC 握手头
    返回: 单个 bytes 对象
    """
    magic = b'hrpc'
    version = struct.pack('>B', 9)  # Version 9
    
    # 确保服务名是 bytes
    if isinstance(service_name_str, str):
        service_bytes = service_name_str.encode('utf-8')
    else:
        service_bytes = service_name_str
        
    # 计算长度并打包 (Big-endian unsigned int)
    length = struct.pack('>I', len(service_bytes))# ✅ 关键：使用 + 拼接所有部分，确保结果是单一的 bytes 对象
    header = magic + version + length + service_bytesreturn header

def check_yarn_rpc(host, port=8032):
    print(f"[*] Connecting to {host}:{port} ...")
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((host, port))
        
        service_name = "org.apache.hadoop.yarn.api.ApplicationClientProtocolPB"
        
        # 获取构建好的 bytes 头部
        rpc_header = build_rpc_header(service_name)# ✅ 发送数据：传入的是 bytes，绝不是 list
        sock.sendall(rpc_header)
        
        # 尝试接收响应
        response = sock.recv(1024)
        if response:
            print(f"[+] Success! Received {len(response)} bytes.")
            print(f"    Hex dump: {response[:20].hex()}")
            print("[!] Potential Vulnerability: Service responded to unauthenticated probe.")
        else:
            print("[-] Connected but no data received immediately.")
            print("[*] The port is open, but the service might be waiting for more data.")
            
        sock.close()
        
    except ConnectionRefusedError:
        print("[-] Connection refused. Port is closed or filtered.")
    except socket.timeout:
        print("[-] Connection timed out.")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    # ✅ 修复参数解析逻辑
    if len(sys.argv) > 1:
        target_host = sys.argv[1]  # 获取第一个参数 (IP)
        
        # 获取第二个参数 (Port)，如果不存在则默认 8032
        if len(sys.argv) > 2:
            try:
                target_port = int(sys.argv[2])  # ✅ 从列表中取单个元素转换
            except ValueError:
                print("[-] Invalid port number. Using default 8032.")
                target_port = 8032
        else:
            target_port = 8032
            
        check_yarn_rpc(target_host, target_port)
    else:
        print("Usage: python yarn_rpc_check.py <target_ip> [port]")
        print("Example: python yarn_rpc_check.py “192.168.1.100” 80

防护加固方案

• ‌网络层限制‌：通过安全组、VPC策略或iptables规则，仅允许内部管理网段访问8032端口，禁止直接暴露到公网。
• ‌启用身份认证‌：配置Kerberos认证机制，强制所有RPC请求必须完成身份校验才能访问资源。
• ‌最小权限配置‌：YARN服务使用低权限账户运行，限制容器内进程的系统操作权限，避免攻击者直接获取root权限。