前言: 仅研究 JDK 9+, JDK 8- 无研究意义
从 Java 9 开始, Java 引入了一个新的概念, 模块(Module). 模块的存在, 限制了反射技术, 在 JDK 16 中, 直接反射越权修改 java.base 甚至会得到错误 java.lang.reflect.InaccessibleObjectException, 对于某些需要的 devops 而言意味着无法完成预期操作
在阅读 java.lang.reflect.AccessibleObject 源码后, 有如下代码片段
/**
* If the given AccessibleObject is a {@code Constructor}, {@code Method}
* or {@code Field} then checks that its declaring class is in a package
* that can be accessed by the given caller of setAccessible.
*/
void checkCanSetAccessible(Class<?> caller) {
// do nothing, needs to be overridden by Constructor, Method, Field
}
final void checkCanSetAccessible(Class<?> caller, Class<?> declaringClass) {
checkCanSetAccessible(caller, declaringClass, true);
}
private boolean checkCanSetAccessible(Class<?> caller,
Class<?> declaringClass,
boolean throwExceptionIfDenied) {
if (caller == MethodHandle.class) {
throw new IllegalCallerException(); // should not happen
}
Module callerModule = caller.getModule();
Module declaringModule = declaringClass.getModule();
if (callerModule == declaringModule) return true;
if (callerModule == Object.class.getModule()) return true;
if (!declaringModule.isNamed()) return true;
String pn = declaringClass.getPackageName();
int modifiers;
if (this instanceof Executable) {
modifiers = ((Executable) this).getModifiers();
} else {
modifiers = ((Field) this).getModifiers();
}
// class is public and package is exported to caller
boolean isClassPublic = Modifier.isPublic(declaringClass.getModifiers());
if (isClassPublic && declaringModule.isExported(pn, callerModule)) {
// member is public
if (Modifier.isPublic(modifiers)) {
logIfExportedForIllegalAccess(caller, declaringClass);
return true;
}
// member is protected-static
if (Modifier.isProtected(modifiers)
&& Modifier.isStatic(modifiers)
&& isSubclassOf(caller, declaringClass)) {
logIfExportedForIllegalAccess(caller, declaringClass);
return true;
}
}
// package is open to caller
if (declaringModule.isOpen(pn, callerModule)) {
logIfOpenedForIllegalAccess(caller, declaringClass);
return true;
}
if (throwExceptionIfDenied) {
// not accessible
String msg = "Unable to make ";
if (this instanceof Field)
msg += "field ";
msg += this + " accessible: " + declaringModule + " does not \"";
if (isClassPublic && Modifier.isPublic(modifiers))
msg += "exports";
else
msg += "opens";
msg += " " + pn + "\" to " + callerModule;
InaccessibleObjectException e = new InaccessibleObjectException(msg);
if (printStackTraceWhenAccessFails()) {
e.printStackTrace(System.err);
}
throw e;
}
return false;
}
有两个关键判断逻辑: declaringModule.isExported(pn, callerModule), declaringModule.isOpen(pn, callerModule)
阅读 Module.java 后发现有 implAddExports 方法, 通过 IDEA 查找调用引用发现了 java.lang.System 有访问此方法的 JDK Internal API
private static void setJavaLangAccess() {
// Allow privileged classes outside of java.lang
SharedSecrets.setJavaLangAccess(new JavaLangAccess() {
public Module defineModule(ClassLoader loader,
ModuleDescriptor descriptor,
URI uri) {
return new Module(null, loader, descriptor, uri);
}
public Module defineUnnamedModule(ClassLoader loader) {
return new Module(loader);
}
public void addReads(Module m1, Module m2) {
m1.implAddReads(m2);
}
public void addReadsAllUnnamed(Module m) {
m.implAddReadsAllUnnamed();
}
public void addExports(Module m, String pn, Module other) {
m.implAddExports(pn, other);
}
public void addExportsToAllUnnamed(Module m, String pn) {
m.implAddExportsToAllUnnamed(pn);
}
public void addOpens(Module m, String pn, Module other) {
m.implAddOpens(pn, other);
}
public void addOpensToAllUnnamed(Module m, String pn) {
m.implAddOpensToAllUnnamed(pn);
}
public void addOpensToAllUnnamed(Module m, Set<String> concealedPackages, Set<String> exportedPackages) {
m.implAddOpensToAllUnnamed(concealedPackages, exportedPackages);
}
public void addUses(Module m, Class<?> service) {
m.implAddUses(service);
}
});
}
找到了 JDK 提供的后门之后, 我们只需要调用 SharedSecrets.getJavaLangAccess().addExports 就能开后门了....
不对，目前还无法调用 SharedSecrets, 还需要一些手段....
在 java.lang.reflect 中翻到了一个特别的东西, java.lang.reflect.Proxy, 她是破局的关键中心
抱着好奇的心里, 我尝试了使用 Proxy 实现 jdk.internal.access 中的一个接口玩玩
public static void main(String[] args) throws Exception {
var obj = Proxy.newProxyInstance(
Usffsa.class.getClassLoader(),
new Class[]{Class.forName("jdk.internal.access.JavaLangAccess")},
new InvocationHandler() {
@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
return null;
}
}
);
System.out.println(obj);
}
没想到, 运行成功了(eg: 没有对应权限(Exported)是不能实现对应接口的), 迎接着激动的心情, 输出了更多的详细信息
System.out.println(obj);
System.out.println(obj.getClass());
System.out.println(obj.getClass().getModule());
System.out.println(Object.class.getModule().isExported("jdk.internal.access", obj.getClass().getModule()));
null
class com.sun.proxy.jdk.proxy1.$Proxy0
module jdk.proxy1
true
破局点找到了, java.lang.reflect.Proxy 拥有打开模块访问的权利, 然后尝试对该模块进行注入
public static void main(String[] args) throws Exception {
var ccl = new ClassLoader(Usffsa.class.getClassLoader()) {
Class<?> defineClass(byte[] code) {
return defineClass(null, code, 0, code.length);
}
};
var obj = Proxy.newProxyInstance(
ccl,
new Class[]{Class.forName("jdk.internal.access.JavaLangAccess")},
(proxy, method, args1) -> null
);
var writer = new ClassWriter(0); // org.objectweb.asm.ClassWriter
writer.visit(Opcodes.V1_8, 0,
obj.getClass().getPackageName().replace('.', '/') + "/Test0",
null,
"java/lang/Object",
null
);
var injectedClass = ccl.defineClass(writer.toByteArray());
System.out.println("Proxy Module : " + obj.getClass().getModule());
System.out.println("Injected Module : " + injectedClass.getModule());
System.out.println("Is Same Module : " + (injectedClass.getModule() == obj.getClass().getModule()));
}
Proxy Module : module jdk.proxy1
Injected Module : module jdk.proxy1
Is Same Module : true
至此已经破开了 JVM 的模块限制的死局, 实际应用可参考 [Karlatemp/UnsafeAccessor]
