Skip to content

Commit db05348

Browse files
GSBPGSBP
GSBP
authored and
GSBP
committed
“update”
1 parent 3048c47 commit db05348

File tree

21 files changed

+2438
-9
lines changed

21 files changed

+2438
-9
lines changed

‎.DS_Store‎

0 Bytes
Binary file not shown.

‎content/.DS_Store‎

0 Bytes
Binary file not shown.

‎content/post/2025suctf.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ draft = false
44
title = '2025-SUCTF-WP'
55
author='GSBP'
66
summary='2025年的第一场XCTF'
7+
categories=["WP"]
78

89
+++
910

‎content/post/JDK17打Jackson反序列化.md‎

Lines changed: 415 additions & 0 deletions
Large diffs are not rendered by default.

‎public/categories/index.html‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,38 @@ <h1>Categories</h1>
147147
<section class="card-container" >
148148

149149

150+
<div class="card">
151+
152+
<a href="http://localhost:1313/categories/wp/">
153+
</a>
154+
<div class="card-content has-text-centered">
155+
<div>
156+
<a class="title is-5 is-size-6-mobile" href="http://localhost:1313/categories/wp/">WP</a>
157+
158+
<strong>
159+
<sup style="font-size:16px;">2</sup>
160+
</strong>
161+
</div>
162+
</div>
163+
164+
</div>
165+
166+
<div class="card">
167+
168+
<a href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">
169+
</a>
170+
<div class="card-content has-text-centered">
171+
<div>
172+
<a class="title is-5 is-size-6-mobile" href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">Java安全</a>
173+
174+
<strong>
175+
<sup style="font-size:16px;">1</sup>
176+
</strong>
177+
</div>
178+
</div>
179+
180+
</div>
181+
150182

151183
</section>
152184

‎public/categories/index.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,21 @@
66
<description>Recent content in Categories on GSBP&#39;s Blog</description>
77
<generator>Hugo</generator>
88
<language>en-us</language>
9+
<lastBuildDate>Mon, 20 Jan 2025 03:02:14 +0800</lastBuildDate>
910
<atom:link href="http://localhost:1313/categories/index.xml" rel="self" type="application/rss+xml" />
11+
<item>
12+
<title>Java安全</title>
13+
<link>http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/</link>
14+
<pubDate>Mon, 20 Jan 2025 03:02:14 +0800</pubDate>
15+
<guid>http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/</guid>
16+
<description></description>
17+
</item>
18+
<item>
19+
<title>WP</title>
20+
<link>http://localhost:1313/categories/wp/</link>
21+
<pubDate>Mon, 20 Jan 2025 03:02:14 +0800</pubDate>
22+
<guid>http://localhost:1313/categories/wp/</guid>
23+
<description></description>
24+
</item>
1025
</channel>
1126
</rss>

‎public/categories/java安全/index.html‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
2+
<!DOCTYPE html>
3+
<html lang="en-us">
4+
<head><script src="/livereload.js?mindelay=10&amp;v=2&amp;port=1313&amp;path=livereload" data-no-instant defer></script>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
7+
<title>Java安全 | GSBP&#39;s Blog</title>
8+
<meta name="description"
9+
content="A CTFER &amp;&amp; JavaSecurity Researcher">
10+
<link rel="canonical" href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/" />
11+
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.7.4/css/bulma.min.css">
12+
13+
<link rel="stylesheet" href="http://localhost:1313/scss/style.min.badf012c7f163854e3d9c3287a1df0863ae1974f62e123bbf1f2948b58ed39cf.css">
14+
15+
<meta property="og:url" content="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">
16+
<meta property="og:site_name" content="GSBP&#39;s Blog">
17+
<meta property="og:title" content="Java安全">
18+
<meta property="og:description" content="A CTFER &amp;&amp; JavaSecurity Researcher">
19+
<meta property="og:locale" content="en_us">
20+
<meta property="og:type" content="website">
21+
22+
23+
<meta name="twitter:card" content="summary">
24+
<meta name="twitter:title" content="Java安全">
25+
<meta name="twitter:description" content="A CTFER &amp;&amp; JavaSecurity Researcher">
26+
27+
28+
29+
</head>
30+
<body><nav class="navbar is-light" role="navigation">
31+
<div class="container">
32+
<div class="navbar-brand">
33+
<a href="/" title="home" class="navbar-item">
34+
<span class="logo">
35+
<h1>GSBP&#39;s Blog</h1>
36+
</span>
37+
</a>
38+
39+
40+
<a id="theme-toggle" class="theme-toggle" href="#">
41+
<img src="http://localhost:1313/svg/sun.svg" alt="sun icon" class="theme-icon" />
42+
</a>
43+
44+
<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="false">
45+
<span aria-hidden="true"></span>
46+
<span aria-hidden="true"></span>
47+
<span aria-hidden="true"></span>
48+
</a>
49+
</div>
50+
51+
<div class="navbar-menu">
52+
<div class="navbar-start">
53+
54+
<a href="/about" class="navbar-item">About</a>
55+
56+
<a href="/post" class="navbar-item">Blog</a>
57+
58+
<a href="/categories" class="navbar-item">Categories</a>
59+
60+
<a href="/friend" class="navbar-item">Friends</a>
61+
62+
</div>
63+
64+
</div>
65+
<div class="search">
66+
<div id="fastSearch">
67+
<input id="searchInput" tabindex="0" placeholder="Search..">
68+
<ul id="searchResults">
69+
70+
</ul>
71+
</div>
72+
<a id="search-btn" style="display: inline-block;" href="# ">
73+
<div class="icon-search"><svg class="search-svg" xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="currentcolor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg></div>
74+
</a>
75+
</div>
76+
77+
<script src="/js/fuse.min.js"></script>
78+
<script src="/js/fastsearch.js"></script>
79+
80+
</div>
81+
</nav>
82+
83+
<script>
84+
85+
document.addEventListener('DOMContentLoaded', function() {
86+
var burger = document.querySelector('.navbar-burger');
87+
burger.addEventListener('click', function() {
88+
burger.classList.toggle('is-active');
89+
document.querySelector('.navbar-menu').classList.toggle('is-active');
90+
});
91+
});
92+
93+
94+
function setTheme(theme) {
95+
let body = document.body;
96+
let themeIcon = document.querySelector(".theme-icon");
97+
if (theme === "dark") {
98+
body.classList.add("dark-mode");
99+
themeIcon.src = "http:\/\/localhost:1313\/svg/moon.svg";
100+
themeIcon.alt = "moon icon";
101+
} else {
102+
body.classList.remove("dark-mode");
103+
themeIcon.src = "http:\/\/localhost:1313\/svg/sun.svg";
104+
themeIcon.alt = "sun icon";
105+
}
106+
107+
localStorage.setItem("theme", theme);
108+
}
109+
110+
111+
let theme = localStorage.getItem("theme") || "light";
112+
const isDarkMode = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
113+
if (isDarkMode) {
114+
115+
setTheme('dark');
116+
117+
} else {
118+
119+
setTheme('light');
120+
}
121+
setTheme(theme);
122+
123+
124+
document.getElementById("theme-toggle").addEventListener("click", function() {
125+
if (theme === "light") {
126+
theme = "dark";
127+
} else {
128+
theme = "light";
129+
}
130+
setTheme(theme);
131+
});
132+
133+
134+
135+
</script>
136+
137+
</header><main>
138+
<div class="container">
139+
<div class="section">
140+
<h2 class="archive-title">Category: Java安全</h2>
141+
</div>
142+
</div>
143+
<div class="each-category column is-centered">
144+
145+
146+
147+
148+
<article class="archive-item">
149+
<a href="http://localhost:1313/post/jdk17%E6%89%93jackson%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/" class="archive-item-link hover-underline-animation">JDK17打Jackson反序列化</a>
150+
<span class="archive-item-date">
151+
January 20, 2025
152+
</span>
153+
154+
</article>
155+
156+
157+
158+
</div>
159+
160+
</main><footer class="footer">
161+
<div class="content has-text-centered">
162+
<span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
163+
<span>
164+
Powered by
165+
<a href="https://gohugo.io/" target="_blank">Hugo</a> &
166+
<a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
167+
</span>
168+
</div>
169+
</footer></body>
170+
</html>
171+

‎public/categories/java安全/index.xml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
2+
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
3+
<channel>
4+
<title>Java安全 on GSBP&#39;s Blog</title>
5+
<link>http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/</link>
6+
<description>Recent content in Java安全 on GSBP&#39;s Blog</description>
7+
<generator>Hugo</generator>
8+
<language>en-us</language>
9+
<lastBuildDate>Mon, 20 Jan 2025 03:02:14 +0800</lastBuildDate>
10+
<atom:link href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/index.xml" rel="self" type="application/rss+xml" />
11+
<item>
12+
<title>JDK17打Jackson反序列化</title>
13+
<link>http://localhost:1313/post/jdk17%E6%89%93jackson%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/</link>
14+
<pubDate>Mon, 20 Jan 2025 03:02:14 +0800</pubDate>
15+
<guid>http://localhost:1313/post/jdk17%E6%89%93jackson%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/</guid>
16+
<description>&lt;h2 id=&#34;起因&#34;&gt;起因&lt;/h2&gt;&#xA;&lt;p&gt;本月五号的时候打了个软件攻防赛，里面有道java当时没做出来，用的ldapAttribute+Jackson死活没通，后面自己调试了一下，这里做个记录&lt;/p&gt;&#xA;&lt;h2 id=&#34;题目分析&#34;&gt;题目分析&lt;/h2&gt;&#xA;&lt;p&gt;题目名叫&lt;code&gt;JDBCParty&lt;/code&gt;,jdk版本是17，里面给了个接口源码如下&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt; @PostMapping({&amp;#34;/dbtest&amp;#34;})&#xA; public ResponseEntity&amp;lt;String&amp;gt; dbtest(String data) {&#xA; try {&#xA; User credentials = (User)Utils.deserialize(data);&#xA; Class.forName(this.driverClassName);&#xA;&#xA; try (Connection connection = DriverManager.getConnection(this.url, credentials.getUsername(), credentials.getPassword())) {&#xA; if (connection.isValid(5)) {&#xA; return ResponseEntity.ok(&amp;#34;connect success&amp;#34;);&#xA; } else {&#xA; return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(&amp;#34;connect failed&amp;#34;);&#xA; }&#xA; }&#xA; } catch (Exception e) {&#xA; e.printStackTrace();&#xA; return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(&amp;#34;connect failed &amp;#34; + e.getMessage());&#xA; }&#xA; }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;表面上是给了个JDBC的入口，但是我们能控的只有username和password，打不了jdbc。&lt;/p&gt;&#xA;&lt;p&gt;实际入口是那个反序列化，从这个反序列化里面做文章&lt;/p&gt;&#xA;&lt;p&gt;然后看看题目给的依赖&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;- &amp;#34;BOOT-INF/lib/spring-boot-3.3.5.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-boot-autoconfigure-3.3.5.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/logback-classic-1.5.11.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/logback-core-1.5.11.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/log4j-to-slf4j-2.23.1.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/log4j-api-2.23.1.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jul-to-slf4j-2.0.16.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jakarta.annotation-api-2.1.1.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/snakeyaml-2.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jackson-databind-2.17.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jackson-annotations-2.17.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jackson-core-2.17.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jackson-datatype-jdk8-2.17.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jackson-datatype-jsr310-2.17.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/jackson-module-parameter-names-2.17.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/tomcat-embed-core-10.1.31.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/tomcat-embed-el-10.1.31.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/tomcat-embed-websocket-10.1.31.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-web-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-beans-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/micrometer-observation-1.13.6.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/micrometer-commons-1.13.6.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-webmvc-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-aop-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-context-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-expression-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/thymeleaf-spring6-3.1.2.RELEASE.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/thymeleaf-3.1.2.RELEASE.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/attoparser-2.0.7.RELEASE.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/unbescape-1.1.6.RELEASE.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/slf4j-api-2.0.16.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-core-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-jcl-6.1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/ojdbc11-21.14.0.0.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/tomcat-jdbc-10.1.31.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/tomcat-juli-10.1.31.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-swing-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-anim-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-parser-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-svg-dom-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-awt-util-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/xmlgraphics-commons-2.6.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/commons-io-1.3.1.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/commons-logging-1.0.4.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-bridge-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-xml-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-css-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-dom-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/xalan-2.7.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/serializer-2.7.2.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/xml-apis-1.4.01.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-ext-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-gui-util-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-gvt-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-script-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-shared-resources-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-util-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-constants-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/batik-i18n-1.14.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/xml-apis-ext-1.3.04.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/fastjson2-2.0.37.jar&amp;#34;&#xA;- &amp;#34;BOOT-INF/lib/spring-boot-jarmode-tools-3.3.5.jar&amp;#34;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;有tomcat-jdbc,snakeYaml,EL,Jackson和fastjson2等等，题目指向性很强，就是让我们用一个JNDI通过Tomcat-JDBC打EL，snakeYaml表达式注入的操作&lt;/p&gt;</description>
17+
</item>
18+
</channel>
19+
</rss>

‎public/categories/java安全/page/1/index.html‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<!DOCTYPE html>
2+
<html lang="en-us">
3+
<head>
4+
<title>http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/</title>
5+
<link rel="canonical" href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">
6+
<meta name="robots" content="noindex">
7+
<meta charset="utf-8">
8+
<meta http-equiv="refresh" content="0; url=http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">
9+
</head>
10+
</html>

0 commit comments

Comments
 (0)