Skip to content

4. Code Audit

4.1 Java Code Audit

SQL Injection (MyBatis)

  • order by ${time} / LIKE '%${stuName}%' / in (${id}) / directly invoked statements
  • OGNL injection: ${@java.lang.Runtime@getRuntime().exec("whoami")} → OgnlCache.getValue → parseExpression
  • Reference: OGNL Language Guide / Weaver e-mobile OGNL injection

Deserialization

  • fastjson (confirm a Commons Collections gadget chain exists) / Shiro / Log4j / JasperReports
  • Core: determine the gadget chain from dependency versions → know the principle + have a POC + be able to modify the POC (gadget chain)

SSTI (Thymeleaf)

  • SpEL expression execution
  • Prerequisites: unfiltered expressions + getValue/setValue + StandardEvaluationContext (default)
  • Payload: __$%7bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("calc.exe").getInputStream()).next()%7d__::.x

Component Weak Credentials / Unauthorized Access

  • Druid (unauthorized access + RCE) / swagger-ui / xxl-job

Filter Flaws

  • directory traversal → privilege escalation / XSS / combine black-box and white-box to probe unauthorized endpoints (simply analyze status codes)

Login Bypass

  • Path traversal: GET /api/admin/login/../../../api/userBill/export
  • Hardcoded secrets: inspect the token/cookie generation method → forge
  • Pseudo-random (same seed → predictable): JumpServer vulnerability analysis → django-simple-captcha seed issue

Unauthorized / Controllable-Privilege Endpoints

Basic WAF Bypass

  • Usually in the filter → bypass the WAF where the rules are loose / find endpoints not covered by the filter rules

4.2 Java Deserialization Fundamentals

ClassLoader hierarchy: Bootstrap (rt.jar → java.lang/java.io) → ExtClassLoader (PlatformClassLoader) → AppClassLoader (URLClassLoader) - Parent delegation: loadClass / findClass / findLoadedClass / defineClass (pass bytecode → loaded by the JVM) / resolveClass - Breaking parent delegation: a custom ClassLoader that overrides the loadClass method - BCEL ClassLoader: com.sun.org.apache.bcel (JDK < 8u251 rt.jar) → $$BCEL$$ encoding → decode → Parser → defineClass load - Tomcat7: org.apache.tomcat.dbcp.dbcp.BasicDataSource - Tomcat8+: org.apache.tomcat.dbcp.dbcp2.BasicDataSource

Command execution chain: TransformerChain → newTransformer/getOutputProperties → defineTransletClasses → bytecode in the _bytecodes field → defineClass → newInstance → static block / no-arg constructor

Serialization signature: 0xACED005

4.3 PHP Code Audit

TP architecture: runtime (page cache Cache::set/session/log → session id) / application (project source) / thinkphp (framework source) / vendor (composer extensions) / extend (manually added third-party libraries)

TP routing modes: - TP3: URL_MODEL (0 normal / 1 PATHINFO / 2 REWRITE / 3 compatible) - TP6: based on pathinfo and compatible mode, Route::get/rule/xxx configuration

Injection point table: | Method | Version | Vulnerability | |------|------|------| | parseKey(count/max) | 5.0.0/5.0.23/TP3 | unfiltered | | _parseOptions(PDO) | TP3 | direct concatenation | | parseWhereItem(bind) | TP≤3.2.4 | direct concatenation | | parseWhereItem(between) | TP 3.1.-3.2.0 | direct concatenation | | parseWhereItem(eq/neq/gt) | TP 3.2. | direct concatenation | | parseData(parseKey) | 5.0.13-5.0.15(inc/dec), 5.1.0-5.1.5(exp/inc/dec) | unfiltered | | betting / check-in / lottery wheel | - | business-logic injection points |

Full RCE chain: - Request::__construct variable overwrite + Request::input code execution (TP 5.0.0-5.0.23) - trace + forced routing / debug + url_route_on / $dispatch['method'] - $dispatch['module'] reflection to invoke arbitrary classes (TP 5.0.0-5.0.23, 5.1.0-5.1.30) - Windows::__destruct arbitrary file deletion - LoadLangPack multi-language RCE (TP 6.0.1-6.0.13) → pearcmd file inclusion - View::assign() template variable overwrite + file inclusion (TP 3.2.*, 5.0.0-5.0.18, 5.1.0-5.1.10)

Auth mechanisms: Route dynamic parameters / auth middleware (route whitelist) / beforeAction/afterAction / CAPTCHA / auth classes / RBAC third-party libraries

File operations: file_get_contents (arbitrary file read / SSRF) / curl / php://input (/etc/passwd) / extends auth classes (none → unauthorized but requires a reachable route) / is_dir/unlink (phar deserialization → CI4 / unlink deleting lock files is low value)

File upload: temporary files (race condition) / extension validation / phpinfo file write

XSS: htmlspecialchars does not escape single quotes by default / multiple encoding conversions / XSS against the admin backend (bank cards / XSS receiver platform)

4.4 .NET Site Code Audit

4.5 Java Memory Shell

  • Loading process: Tomcat architecture / loading security mechanisms
  • Prevalence / difference between reflection and shell

4.6 Commercially Encrypted PHP Code / IoT Device PHP Management Pages

  • Hook PHP DLL functions to dump plaintext
  • Memory dump of plaintext

4.7 Java Decompilation Tools

Tool URL
javadecompilers.com http://www.javadecompilers.com/
decompiler.com http://www.decompiler.com/
devtoolzone https://devtoolzone.com/decompiler/java
jdec https://jdec.herokuapp.com/
mobilefish https://www.mobilefish.com/services/java_decompiler/java_decompiler.php
javare.cn http://javare.cn/

4.8 Quick Code Audit Tools