https://blog.p0l1st.top/categories/java%E5%AE%89%E5%85%A8/ p0l1st's blog Hugo 0.161.1 & FixIt v0.4.5 en-us p0l1st@venomsec.org (p0l1st) p0l1st@venomsec.org (p0l1st) Mon, 04 May 2026 14:05:53 +0800 https://blog.p0l1st.top/post/l3hctf2025-tellmewhy/ Mon, 04 May 2026 14:05:53 +0800p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/l3hctf2025-tellmewhy/ Java安全 <p>使用了solon框架，存在fastjson2依赖</p> <p><img loading="lazy" src='https://p0l1st.oss-cn-beijing.aliyuncs.com/img/202605041418923.png' alt="img"></p> <p>并且/baby/why路由可以反序列化</p> <p>存在反序列化黑名单</p> <p><img loading="lazy" src='https://p0l1st.oss-cn-beijing.aliyuncs.com/img/202605041418723.png' alt="img"></p> <ul> <li>javax.management.BadAttributeValueExpException</li> <li>javax.swing.event.EventListenerList</li> <li>javax.swing.UIDefaults$TextAndMnemonicHashMap</li> </ul> <p>目的是想要过滤可以触发<code>JsonArray.toString</code>的链子，常见的可以触发toString方法的链子如下：</p> <ul> <li>XString</li> </ul> <pre><code>Hashmap#readobject --&gt; XString#equals --&gt; JSONArray.toString</code></pre><ul> <li>HotSwappableTargetSource</li> </ul> <pre><code>HashMap#readObject -&gt; HotSwappableTargetSource#equals -&gt; XString#equals -&gt; JSONArray.toString</code></pre><ul> <li>BadAttributeValueExpException</li> </ul> <pre><code>BadAttributeValueExpException#readObject --&gt; JSONArray#toString</code></pre><ul> <li>EventListenerList</li> </ul> <pre><code>EventListenerList#readobject --&gt; UndoManager#toString --&gt; Vector#toString --&gt; JSONArray#toString</code></pre><ul> <li>TextAndMnemonicHashMap</li> </ul> <pre><code>hashmap#readObject--&gt; HashMap#putVal--&gt; AbstractMap#equals--&gt; TextAndMnemonicHashMap#get--&gt; JSONArray#toString</code></pre><p>那么在这里我们可以利用<code>XString</code>去触发<code>JsonArray.toString</code> 或者可以用tabby去跑一下</p> <h1 class="heading-element" id="fastjson2原生反序列化"><span>fastjson2原生反序列化</span> <a href="#fastjson2%e5%8e%9f%e7%94%9f%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%96" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>fastjson2.0.26之前有一条原生反序列化链</p> https://blog.p0l1st.top/post/polar%E9%9D%B6%E5%9C%BA-java/ Thu, 14 Aug 2025 18:28:34 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/polar%E9%9D%B6%E5%9C%BA-java/ Java安全 <h1 class="heading-element" id="ezjava"><span>ezjava</span> <a href="#ezjava" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p><img loading="lazy" src='https://p0l1st.oss-cn-beijing.aliyuncs.com/img/202508142105238.png' alt="img"></p>