软件攻防赛现场赛上对justDeserialize攻击的几次尝试
前言
一个关于本地打通无数次但远程0次的故事
题目分析
题目直接给了一个反序列化的入口点
其中有两层防御
- 对我们的反序列化数据流中的明文进行简单判断过滤
- 使用了一个自定义反序列化类来对我们的反序列化数据流进行反序列化
其中自定义化反序列化类代码如下
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package com.example.ezjav.utils;
import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.InvalidClassException;
import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;
import java.util.ArrayList;
public class MyObjectInputStream extends ObjectInputStream {
private String[] denyClasses;
public MyObjectInputStream(ByteArrayInputStream var1) throws IOException {
super(var1);
ArrayList<String> classList = new ArrayList();
InputStream file = MyObjectInputStream.class.getResourceAsStream("/blacklist.txt");
BufferedReader var2 = new BufferedReader(new InputStreamReader(file));
String var4;
while((var4 = var2.readLine()) != null) {
classList.add(var4.trim());
}
this.denyClasses = new String[classList.size()];
classList.toArray(this.denyClasses);
}
protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
String className = desc.getName();
int var5 = this.denyClasses.length;
for(int var6 = 0; var6 < var5; ++var6) {
String denyClass = this.denyClasses[var6];
if (className.startsWith(denyClass)) {
throw new InvalidClassException("Unauthorized deserialization attempt", className);
}
}
return super.resolveClass(desc);
}
}
从blacklist中读取baned类，且在resolveClass中进行过滤
2025-03-24
