Elastic Stack组件elasticsearch XPack7.12.0插件破解激活方法
说明： elastic官方在elastic stack 6.4.2版本后就在elasticsearch中内置了X-Pack工具，因此下文破解X-Pack7.12.0的版本也是对应elastic stack7.12.0的版本。而X-Pack内置在elasticsearch包中，以下所有操作都是针对elasticsearch7.12.0包中进行的。
一、X-Pack是什么
X-pack是elasticsearch的一个扩展包，将安全，警告，监视，图形和报告功能捆绑在一个易于安装的软件包中，虽然x-pack被设计为一个无缝的工作，但是你可以轻松的启用或者关闭一些功能。
目前6.2及以下版本只能使用免费版，然而免费版的功能相当少。X-pack 的破解基本思路是先安装正常版本，之后替换破解的jar包来实现，目前只能破解到白金版，但已经够用了。更多版本功能介绍请查看官方版本订阅文档
上面提到X-Pack自6.4.2版本后已经内置到elasticsearch中，因此我们需要下载elasticsearch7.12.0最新版。
部署玩之后，我们可以查看自带x-pack的模版。
# 查看x-pack相关的模块
$ ls /usr/share/elasticsearch/modules | grep x-pack
我们需要破解的x-pack-core.7.12.0.jar也就位于x-pack-core目录下
二、下载反编译工具Luyten
破解X-Pack-core-7.12.0.jar需要反编译工具Luyten，我们可以前往下载地址下载Luyten工具。 我们这里下载Luyten.exe windows版本，下载下来后打开，并将x-pack-core.7.12.0.jar文件拖进去，即可展开jar包的源代码了。
三、修改X-Pack源码文件
在Luyten工具中我们需要把2个文件提取出来进行修改。org.elasticsearch.license.LicenseVerifier和org.elasticsearch.xpack.core.XPackBuild。
1、修改LicenseVerifier.java
LicenseVerifier中有两个静态方法，这就是验证授权文件是否有效的方法，我们把它修改为全部返回true.
package org.elasticsearch.license;
import java.nio.*;
import org.elasticsearch.common.bytes.*;
import java.security.*;
import java.util.*;
import org.elasticsearch.common.xcontent.*;
import org.apache.lucene.util.*;
import org.elasticsearch.core.internal.io.*;
import java.io.*;
public class LicenseVerifier
{
public static boolean verifyLicense(final License license, final byte[] publicKeyData) {
/* byte[] signedContent = null;
byte[] publicKeyFingerprint = null;
try {
final byte[] signatureBytes = Base64.getDecoder().decode(license.signature());
final ByteBuffer byteBuffer = ByteBuffer.wrap(signatureBytes);
final int version = byteBuffer.getInt();
final int magicLen = byteBuffer.getInt();
final byte[] magic = new byte[magicLen];
byteBuffer.get(magic);
final int hashLen = byteBuffer.getInt();
publicKeyFingerprint = new byte[hashLen];
byteBuffer.get(publicKeyFingerprint);
final int signedContentLen = byteBuffer.getInt();
signedContent = new byte[signedContentLen];
byteBuffer.get(signedContent);
final XContentBuilder contentBuilder = XContentFactory.contentBuilder(XContentType.JSON);
license.toXContent(contentBuilder, (ToXContent.Params)new ToXContent.MapParams((Map)Collections.singletonMap("license_spec_view", "true")));
final Signature rsa = Signature.getInstance("SHA512withRSA");
rsa.initVerify(CryptUtils.readPublicKey(publicKeyData));
final BytesRefIterator iterator = BytesReference.bytes(contentBuilder).iterator();
BytesRef ref;
while ((ref = iterator.next()) != null) {
rsa.update(ref.bytes, ref.offset, ref.length);
}
return rsa.verify(signedContent);
}
catch (IOException ex) {}
catch (NoSuchAlgorithmException ex2) {}
catch (SignatureException ex3) {}
catch (InvalidKeyException e) {
throw new IllegalStateException(e);
}
finally {
if (signedContent != null) {
Arrays.fill(signedContent, (byte)0);
}
}
*/
return true;
}
public static boolean verifyLicense(final License license) {
/*
byte[] publicKeyBytes;
try {
final InputStream is = LicenseVerifier.class.getResourceAsStream("/public.key");
try {
final ByteArrayOutputStream out = new ByteArrayOutputStream();
Streams.copy(is, (OutputStream)out);
publicKeyBytes = out.toByteArray();
if (is != null) {
is.close();
}
}
catch (Throwable t) {
if (is != null) {
try {
is.close();
}
catch (Throwable t2) {
t.addSuppressed(t2);
}
}
throw t;
}
}
catch (IOException ex) {
throw new IllegalStateException(ex);
}
//return verifyLicense(license, publicKeyBytes);
*/
return true;
}
}2、修改XPackBuild.java
XPackBuild中最后一个静态代码块中 try的部分全部删除，这部分会验证jar包是否被修改.
package org.elasticsearch.xpack.core;
import org.elasticsearch.common.io.*;
import java.net.*;
import org.elasticsearch.common.*;
import java.nio.file.*;
import java.io.*;
import java.util.jar.*;
public class XPackBuild
{
public static final XPackBuild CURRENT;
private String shortHash;
private String date;
@SuppressForbidden(reason = "looks up path of xpack.jar directly")
static Path getElasticsearchCodebase() {
final URL url = XPackBuild.class.getProtectionDomain().getCodeSource().getLocation();
try {
return PathUtils.get(url.toURI());
}
catch (URISyntaxException bogus) {
throw new RuntimeException(bogus);
}
}
XPackBuild(final String shortHash, final String date) {
this.shortHash = shortHash;
this.date = date;
}
public String shortHash() {
return this.shortHash;
}
public String date() {
return this.date;
}
static {
final Path path = getElasticsearchCodebase();
String shortHash = null;
String date = null;
Label_0109: {
/* if (path.toString().endsWith(".jar")) {
try {
final JarInputStream jar = new JarInputStream(Files.newInputStream(path, new OpenOption[0]));
try {
final Manifest manifest = jar.getManifest();
shortHash = manifest.getMainAttributes().getValue("Change");
date = manifest.getMainAttributes().getValue("Build-Date");
jar.close();
}
catch (Throwable t) {
try {
jar.close();
}
catch (Throwable t2) {
t.addSuppressed(t2);
}
throw t;
}
break Label_0109;
}
catch (IOException e) {
throw new RuntimeException(e);
}
}
*/
shortHash = "Unknown";
date = "Unknown";
}
CURRENT = new XPackBuild(shortHash, date);
}
}四、生成.class文件
上述LicenseVerifier.java和XPackBuild.java两个文件在本地电脑windows修改完成后，我们需要将其复制到elasticsearch服务器上并编译成class文件，然后打包到x-pack-core-7.12.0.jar中。我们这里将这2个文件放到了/opt目录下。
# 编译LicenseVerifier.java
$ javac -cp "/usr/share/elasticsearch/lib/elasticsearch-7.12.0.jar:/usr/share/elasticsearch/lib/lucene-core-8.0.0.jar:/usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.12.0.jar:/usr/share/elasticsearch/modules/x-pack-core/netty-common-4.1.32.Final.jar:/usr/share/elasticsearch/lib/elasticsearch-core-7.12.0.jar" /opt/LicenseVerifier.java
# 编译XPackBuild.java
$ javac -cp "/usr/share/elasticsearch/lib/elasticsearch-7.12.0.jar:/usr/share/elasticsearch/lib/lucene-core-8.0.0.jar:/usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.12.0.jar:/usr/share/elasticsearch/modules/x-pack-core/netty-common-4.1.32.Final.jar:/usr/share/elasticsearch/lib/elasticsearch-core-7.12.0.jar" /opt/XPackBuild.java
# 查看编译后的文件
$ ls /opt | grep .class
LicenseVerifier.class
XPackBuild.class
五、替换LicenseVerifier.class和XPackBuild.class
我们把/usr/share/elasticsearch/modules/x-pack-core目录下的x-pack-core-7.12.0.jar提取出来，放到一个临时的/elk/x-pack目录中。
$ cp /usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.12.0.jar /opt/x
$ cd /opt/x
# 解压x-pack-core-7.12.0.jar
$ jar -xvf x-pack-core-7.12.0.jar
# 替换.class文件
$ cp /opt/XPackBuild.class /opt/x-pack-core-7.12.0/org/elasticsearch/xpack/core/
$ cp /opt/LicenseVerifier.class /opt/x-pack-core-7.12.0/org/elasticsearch/license/六、打包新x-pack-core-7.12.0.jar文件
$ cd /opt/x
$ rm -rf x-pack-core-7.12.0.jar # 删除临时拷贝过来的源文件
$ jar cvf x-pack-core-7.0.1.jar . #“.”表示全选文件至此在/elk/x-pack目录下会新生成一个x-pack-core-7.12.0.jar文件。也就是破解后的文件。
七、替换x-pack-core-7.12.0.jar文件
我们将新生成的x-pack-core-7.12.0.jar文件文件替换掉源x-pack-core-7.12.0.jar文件。
cp /opt/x-pack-core-7.12.0/x-pack-core-7.12.0.jar /usr/share/elasticsearch/modules/x-pack-core/
rm -rf /elk/x-pack # 完成文件替换后该目录既可以删除了
```
## 申请License
完成以上步骤后，我们还需要去elastic官网申请一个license, [License申请地址](https://license.elastic.co/registration)，申请完成后，下载下来的License格式为json格式。并将该License的`type`、`expiry_date_in_millis`、`max_nodes`分别修改成`platinum`、`2524579200999`、`1000`。如下：
```json
{"license":
{
"uid":"f292d4a1-d8ff-4705-825e-4bacdbe4a8f2",
"type":"platinum",
"issue_date_in_millis":1558051200000,
"expiry_date_in_millis":2524579200999,
"max_nodes":1000,
"issued_to":"pyker",
"issuer":"Web Form",
"signature":"AAAAAwAAAA0BDSdRRybXrD5olNhIAAABmC9ZN0hjZDBGYnVyRXpCOW5Bb3FjZDAxOWpSbTVoMVZwUzRxVk1PSmkxaktJRVl5MUYvUWh3bHZVUTllbXNPbzBUemtnbWpBbmlWRmRZb25KNFlBR2x0TXc2K2p1Y1VtMG1UQU9TRGZVSGRwaEJGUjE3bXd3LzRqZ05iLzRteWFNekdxRGpIYlFwYkJiNUs0U1hTVlJKNVlXekMrSlVUdFIvV0FNeWdOYnlESDc3MWhlY3hSQmdKSjJ2ZTcvYlBFOHhPQlV3ZHdDQ0tHcG5uOElCaDJ4K1hob29xSG85N0kvTWV3THhlQk9NL01VMFRjNDZpZEVXeUtUMXIyMlIveFpJUkk2WUdveEZaME9XWitGUi9WNTZVQW1FMG1DenhZU0ZmeXlZakVEMjZFT2NvOWxpZGlqVmlHNC8rWVVUYzMwRGVySHpIdURzKzFiRDl4TmM1TUp2VTBOUlJZUlAyV0ZVL2kvVk10L0NsbXNFYVZwT3NSU082dFNNa2prQ0ZsclZ4NTltbU1CVE5lR09Bck93V2J1Y3c9PQAAAQBIx9DoWFvbf3iemo+ET9ydQ8037flEUdOZ6ks39p6Wc1dJJwI5XV3c1rosXO6MHDDbXNYpd2IIPrZ2AXHMgR1sG9xpnO5cN5//L6sFF3hXPAao/E58o4zZHGprk4ix7pharIbzvF9IlalhYUSEgTgi7uGDoi59rcnFcGV5g2E/yoOT+XA7Gvz1nm+oozvMvzbXBLFgPFSoAmYXS4OpuThTMmVMFDkcl58AE/hzS+1idND0qYmbHANx6BisAYyigzIVLzk2UxFWCmyqxPBLHJKrySMUhbZxIXqch9suYhj23uOk9M836FPN/J+HXiQl1Zj9uMp/zZKdjQB0DKoWYbiJ",
"start_date_in_millis":1617235200000
}
}我们将过期时间写到2050年，type改为platinum 白金版，这样我们就会拥有全部的x-pack功能。
八、配置elasticsearch安全协议
完成以上所有操作在启动elasticsearch前，我们需要配置elasticsearch的SSL/TLS安全协议,如果不配置的话，需要禁止security才能配置License。当License配置完成后我们需要再开启security，并开启SSL\TLS。
# 加载License到elasticsearch之前操作
$ echo "xpack.security.enabled: false" >> /usr/share/elasticsearch/config/elasticsearch.yml
$ ./bin/elasticsearch -d # 后台方式启动elasticsearch
# 加载License到elasticsearch之后操作
$ echo "xpack.security.transport.ssl.enabled: true" >> /usr/share/elasticsearch/config/elasticsearch.yml
$ sed -i 's/xpack.security.enabled: false/xpack.security.enabled: true/g' /usr/share/elasticsearch/config/elasticsearch.yml
$ kill -9 13023 && ./bin/elasticsearch -d # 重启elasticsearch九、加载License到elasticsearch
$ curl -XPUT -u elastic 'http://172.19.19.71:9200/_xpack/license' -H "Content-Type: application/json" -d @license.json
Enter host password for user 'elastic': # 提示输入elastic用户密码，当前无密码，所以直接回车
{"acknowledged":true,"license_status":"valid"} # license写入成功
十、查看License
$ curl -XGET -u elastic:BH@111111! http://172.19.19.71:9200/_license
{
"license" : {
"status" : "active",
"uid" : "537c5c48-c1dd-43ea-ab69-68d209d80c32",
"type" : "platinum",
"issue_date" : "2019-05-17T00:00:00.000Z",
"issue_date_in_millis" : 1558051200000,
"expiry_date" : "2049-12-31T16:00:00.999Z",
"expiry_date_in_millis" : 2524579200999,
"max_nodes" : 1000,
"issued_to" : "pyker",
"issuer" : "Web Form",
"start_date_in_millis" : 1558051200000
}
}
由结果可以看出x-pack到期时间为2049-12-31，破解完成。也可以在kibana web页面管理中查看破解详情。
十一、设置密码
现在我们可以使用x-pack铂金版的所有功能了，例如密码安全验证功能。
$ ./bin/elasticsearch-setup-passwords auto
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y
Changed password for user apm_system
PASSWORD apm_system = BH@111111!
Changed password for user kibana
PASSWORD kibana = BH@111111!
Changed password for user logstash_system
PASSWORD logstash_system = BH@111111!
Changed password for user beats_system
PASSWORD beats_system = BH@111111!
Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = BH@111111!
Changed password for user elastic
PASSWORD elastic = BH@111111！
本文是原创文章，采用 CC BY-NC-ND 4.0 协议，完整转载请注明来自 Lukey
阅读建议
评论
匿名评论
隐私政策
你无需删除空行，直接评论以获取最佳展示效果
