三，破解X-PACK
需要破解的jar包目录在
/usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.2.0.jar
使用反编译工具Luyten导入x-pack-core-7.2.0.jar文件，提取org.elasticsearch.license.LicenseVerifier和org.elasticsearch.xpack.core.XPackBuild
修改LicenseVerifier.java文件，如下为修改后的文件
package org.elasticsearch.license;
import java.nio.*;
import org.elasticsearch.common.bytes.*;
import java.security.*;
import java.util.*;
import org.elasticsearch.common.xcontent.*;
import org.apache.lucene.util.*;
import org.elasticsearch.core.internal.io.*;
import java.io.*;
public class LicenseVerifier
{
public static boolean verifyLicense(final License license, final byte[] publicKeyData) {
return true;
}
public static boolean verifyLicense(final License license) {
return true;
}
}
修改XPackBuild.java文件，如下为修改后的文件
package org.elasticsearch.xpack.core;
import org.elasticsearch.common.io.*;
import java.net.*;
import org.elasticsearch.common.*;
import java.nio.file.*;
import java.io.*;
import java.util.jar.*;
public class XPackBuild
{
public static final XPackBuild CURRENT;
private String shortHash;
private String date;
@SuppressForbidden(reason = "looks up path of xpack.jar directly")
static Path getElasticsearchCodebase() {
final URL url = XPackBuild.class.getProtectionDomain().getCodeSource().getLocation();
try {
return PathUtils.get(url.toURI());
}
catch (URISyntaxException bogus) {
throw new RuntimeException(bogus);
}
}
XPackBuild(final String shortHash, final String date) {
this.shortHash = shortHash;
this.date = date;
}
public String shortHash() {
return this.shortHash;
}
public String date() {
return this.date;
}
static {
final Path path = getElasticsearchCodebase();
String shortHash = null;
String date = null;
Label_0109: {
shortHash = "Unknown";
date = "Unknown";
}
CURRENT = new XPackBuild(shortHash, date);
}
}
编译LicenseVerifier.java
javac -cp "/usr/share/elasticsearch/lib/elasticsearch-7.2.0.jar
:/usr/share/elasticsearch/lib/lucene-core-8.0.0.jar
:/usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.2.0.jar
:/usr/share/elasticsearch/modules/x-pack-core/netty-common-4.1.35.Final.jar
:/usr/share/elasticsearch/lib/elasticsearch-core-7.2.0.jar" /mnt/LicenseVerifier.java
编译XPackBuild.java
javac -cp "/usr/share/elasticsearch/lib/elasticsearch-7.2.0.jar
:/usr/share/elasticsearch/lib/lucene-core-8.0.0.jar
:/usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.2.0.jar
:/usr/share/elasticsearch/modules/x-pack-core/netty-common-4.1.35.Final.jar
:/usr/share/elasticsearch/lib/elasticsearch-core-7.2.0.jar" /mnt/XPackBuild.java
编译完成后会生成LicenseVerifier.class和XPackBuild.class两个文件
将生成的两个文件替换原有的两个文件，把/usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.2.0.jar拷贝到/mnt/x-pack目录中
cp /usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.2.0.jar /mnt/x-pack
cd /mnt/x-pack
#解压x-pack-core-7.0.1.jar
jar -xvf x-pack-core-7.2.0.jar
#替换.class文件
cp /mnt/XPackBuild.class /mnt/x-pack/org/elasticsearch/xpack/core/
cp /mnt/LicenseVerifier.class /mnt/x-pack/org/elasticsearch/license/
打包新x-pack-core-7.2.0.jar文件
cd /mnt/x-pack
#删除临时拷贝过来的源文件
rm -rf x-pack-core-7.2.0.jar
jar cvf x-pack-core-7.2.0.jar .
将新生成的jar文件替换原有的jar文件
cp /mnt/x-pack/x-pack-core-7.2.0.jar /usr/share/elasticsearch/modules/x-pack-core/x-pack-core-7.2.0.jar
到ELK官网申请license，license格式为json文件，修改type、expiry_date_in_millis、分别修改成platinum、2855980923000
例：
{"license":
{
"uid":"edccad08-a967-491e-82db-5bdfcf98677b",
"type":"platinum",
"issue_date_in_millis":1573171200000,
"expiry_date_in_millis":2855980923000,
"max_nodes":100,
"issued_to":"louis zuo (mycompany)",
"issuer":"WebForm", "signature":"AAAAAwAAAA1Th3WJcIQbwJ9K2ZeOAAABmC9ZN0hjZDBGYnVyRXpCOW5Bb3FjZDAxOWpSbTVoMVZwUzRxVk1PSmkxaktJRVl5MUYvUWh3bHZVUTllbXNPbzBUemtnbWpBbmlWRmRZb25KNFlBR2x0TXc2K2p1Y1VtMG1UQU9TRGZVSGRwaEJGUjE3bXd3LzRqZ05iLzRteWFNekdxRGpIYlFwYkJiNUs0U1hTVlJKNVlXekMrSlVUdFIvV0FNeWdOYnlESDc3MWhlY3hSQmdKSjJ2ZTcvYlBFOHhPQlV3ZHdDQ0tHcG5uOElCaDJ4K1hob29xSG85N0kvTWV3THhlQk9NL01VMFRjNDZpZEVXeUtUMXIyMlIveFpJUkk2WUdveEZaME9XWitGUi9WNTZVQW1FMG1DenhZU0ZmeXlZakVEMjZFT2NvOWxpZGlqVmlHNC8rWVVUYzMwRGVySHpIdURzKzFiRDl4TmM1TUp2VTBOUlJZUlAyV0ZVL2kvVk10L0NsbXNFYVZwT3NSU082dFNNa2prQ0ZsclZ4NTltbU1CVE5lR09Bck93V2J1Y3c9PQAAAQCmmzAbpCeTGxOlClQ1xtSkoNiEK6E/XLWKukFazVKnPQZG6XBkabjzRPOzWKZ3ZYd4/aB9rFZsW9pmVKbWREmW5JM9QZBZuoS8QXLgN9PVGOlLjLjs6CjyojuL75rRTxSwWCsWOCnlQPtUxk0oBaTu78FiurpwZVQelIeQ1fCLNVSrK97LWcVa90JqkHtzk7maHwcyd7KAUsq+tB7p7NAuNFSTe+3gV6E12SLTnxunB49kDKdl83wbENxRPYTgIcNfvptlye/6xrM5oe+RdpINARMTBGGTeNBBKuKRcSOmpOxRS98lLNaFECByI/uKjCWnbAm7LZvkNha6BzVElAyb",
"start_date_in_millis":1573171200000}
}
导入license前关闭xpack的security和ssl，重启es
echo "xpack.security.enabled: false" >>/etc/es/elasticsearch/elasticsearch.yml
echo "xpack.security.transport.ssl.enabled: false" >>/etc/es/elasticsearch/elasticsearch.yml
加载license
curl -XPUT -u elastic 'http://192.168.1.223:9200/_xpack/license' -H "Content-Type: application/json" -d @louis-zuo-edccad08-a967-491e-82db-5bdfcf98677b-v5.json
#返回如下显示表示license写入成功
{"acknowledged":true,"license_status":"valid"}
导入license后开启xpack的security和ssl，重启es
echo "xpack.security.enabled: true" >>/etc/es/elasticsearch/elasticsearch.yml
echo "xpack.security.transport.ssl.enabled: true" >>/etc/es/elasticsearch/elasticsearch.yml
查询license到期日，x-pack破解完成
curl -XGET -u elastic:Zero@2019 http://192.168.1.223:9200/_license
{
"license" : {
"status" : "active",
"uid" : "edccad08-a967-491e-82db-5bdfcf98677b",
"type" : "platinum",
"issue_date" : "2019-11-08T00:00:00.000Z",
"issue_date_in_millis" : 1573171200000,
"expiry_date" : "2060-07-02T08:02:03.000Z",
"expiry_date_in_millis" : 2855980923000,
"max_nodes" : 100,
"issued_to" : "louis zuo (mycompany)",
"issuer" : "Web Form",
"start_date_in_millis" : 1573171200000
}
}
