https://blog.dansec.vip/tags/cc6/ Recent content in CC6 on Dan`s Blog Hugo zh-CN Tue, 06 Aug 2024 21:56:10 +0800 https://blog.dansec.vip/p/cc6demo/ Tue, 06 Aug 2024 21:56:10 +0800 https://blog.dansec.vip/p/cc6demo/ <h1 id="cc6链">CC6链</h1> <p>CC6 Demo学习，以及踩坑记录</p> <h2 id="cc6-demo">CC6 Demo</h2> <p>CC6能够解决CC1高版本无法利用的问题，先看看CC6链</p> <ul> <li>调用栈</li> </ul> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span><span class="lnt">13 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-java" data-lang="java"><span class="line"><span class="cl"><span class="cm">/* </span></span></span><span class="line"><span class="cl"><span class="cm"> Gadget chain: </span></span></span><span class="line"><span class="cl"><span class="cm"> java.io.ObjectInputStream.readObject() </span></span></span><span class="line"><span class="cl"><span class="cm"> java.util.HashMap.readObject() </span></span></span><span class="line"><span class="cl"><span class="cm"> java.util.HashMap.hash() </span></span></span><span class="line"><span class="cl"><span class="cm"> org.apache.commons.collections.keyvalue.TiedMapEntry.hashCode() </span></span></span><span class="line"><span class="cl"><span class="cm"> org.apache.commons.collections.keyvalue.TiedMapEntry.getValue() </span></span></span><span class="line"><span class="cl"><span class="cm"> org.apache.commons.collections.map.LazyMap.get() </span></span></span><span class="line"><span class="cl"><span class="cm"> org.apache.commons.collections.functors.ChainedTransformer.transform() </span></span></span><span class="line"><span class="cl"><span class="cm"> org.apache.commons.collections.functors.InvokerTransformer.transform() </span></span></span><span class="line"><span class="cl"><span class="cm"> java.lang.reflect.Method.invoke() </span></span></span><span class="line"><span class="cl"><span class="cm"> java.lang.Runtime.exec() </span></span></span><span class="line"><span class="cl"><span class="cm">*/</span><span class="w"> </span></span></span></code></pre></td></tr></table> </div> </div><p>第8行到最后的链路我们已经熟悉了。</p>