首页 > 编程语言 > 详细

安研 - Java - Jackson反序列化漏洞 - 调试分析

时间:2020-05-06 01:08:15      阅读:104      评论:0      收藏:0      [点我收藏+]

一、Jackson的基本用法

import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;

public class Hello {

    public static void main(String args[]) throws IOException {
        Person p = new Person();
        p.age = 1;
        p.name = "Econ";

        ObjectMapper mapper = new ObjectMapper();
        String json = mapper.writeValueAsString(p);
        System.out.println(json);
//        {"age":1,"name":"Econ"}
        Person p2 = mapper.readValue(json, Person.class);
        System.out.println(p2);
//        Person.age=1, Person.name=Econ
    }
}

class Person {
    public int age;
    public String name;

    @Override
    public String toString() {
        return String.format("Person.age=%d, Person.name=%s", age, name);
    }
}

 

二、基于DefaultTyping的序列化与反序列化

属性:

JAVA_LANG_OBJECT
OBJECT_AND_NON_CONCRETE
NON_CONCRETE_AND_ARRAYS
NON_FINAL

序列化:

import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;

public class Hello {

    public static void main(String args[]) throws IOException {
        Person p = new Person();
        p.age = 1;
        p.name = "Econ";
        p.object = new Dna();

        ObjectMapper mapper = new ObjectMapper();
        mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.JAVA_LANG_OBJECT);
        String json = mapper.writeValueAsString(p);
        System.out.println(json);
//        {"age":1,"name":"Econ","object":["Dna",{"length":1}]}
        Person p2 = mapper.readValue(json, Person.class);
        System.out.println(p2);
//        Person.age=1, Person.name=Econ
    }
}

class Person {
    public int age;
    public String name;
    public Object object;

    @Override
    public String toString() {

        return String.format("Person.age=%d, Person.name=%s", age, name, object == null ? "null" : object);
    }
}

class Dna {
    public int length = 1;
        }

反序列化:

import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;

public class Hello {

    public static void main(String args[]) throws IOException {
        Jacksonunserialize();

    }

    public static void Jacksonunserialize() throws IOException {
        String json = "{\"age\":1, \"name\":\"econ\"}";
        ObjectMapper mapper = new ObjectMapper();
        mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_CONCRETE_AND_ARRAYS);
        Person person = mapper.readValue(json, Person.class);
        System.out.println(person);
        //  Person.age=1, Person.name=econ
    }
}

class Person {
    public int age;
    public String name;

    @Override
    public String toString() {

        return String.format("Person.age=%d, Person.name=%s", age, name);
    }
}

反序列化调用栈分析

1.NativeConstructorAccessorImpl (sun.reflect)

2.DelegatingConstructorAccessorImpl (sun.reflect)
3.Constructor (java.lang.reflect)
4.AnnotatedConstructor (com.fasterxml.jackson.databind.introspect)
5.createUsingDefault, StdValueInstantiator (com.fasterxml.jackson.databind.deser.std)
6.vanillaDeserialize, BeanDeserializer (com.fasterxml.jackson.databind.deser)
7.BeanDeserializer(com.fasterxml.jackson.databind.deser)
8.AsArrayTypeDeserializer (com.fasterxml.jackson.databind.jsontype.impl)
9.deserializeTypedFromObject, AsArrayTypeDeserializer (com.fasterxml.jackson.databind.jsontype.impl)
10.deserializeWithType, BeanDeserializerBase (com.fasterxml.jackson.databind.deser)
11.deserialize,TypeWrappedDeserializer (com.fasterxml.jackson.databind.deser.impl)
12._readMapAndClose, ObjectMapper (com.fasterxml.jackson.databind)
13.readValue, ObjectMapper (com.fasterxml.jackson.databind)

技术分享图片

gadget类构造

class Dna {
    String cmd;

    Dna() {
        System.out.println("Dna.init()");
    }

    public void setCmd(String cmd) throws IOException {
        this.cmd = "calc.exe";
        System.out.println(String.format("Dna.setCmd(%s)", cmd));
        Runtime.getRuntime().exec(cmd);
    }
}

 

三、基于JsonTypeInfo的序列化与反序列化

 

 

安研 - Java - Jackson反序列化漏洞 - 调试分析

原文:https://www.cnblogs.com/AtesetEnginner/p/12833657.html

(0)
(0)
   
举报
评论 一句话评论(0
关于我们 - 联系我们 - 留言反馈 - 联系我们:wmxa8@hotmail.com
© 2014 bubuko.com 版权所有
打开技术之扣,分享程序人生!