Legacy Archive Page
A static article list retained for compatibility with legacy pagination URLs.
JEP 290 0x01 What Is a JEP? JDK Enhancement Proposal, abbreviated JEP, is the process for proposing JDK enhancements. The index has reached JEP 415. This article focuses on JEP 290: what it is, what it does, and known bypass approaches. 0x02 What Is JEP 290? JEP 290 is described as Filter Incoming…
0x01 Preface As with the previous article, copy the demo and follow this analysis in a debugger. 0x02 Flow Analysis In Analysis of the Serialization Process, I noted that serialization writes an object to an I/O stream. It usually begins by creating an ObjectOutputStream…
Why did I start this official account? Traditional blogs no longer fully meet the needs of mobile readers. People increasingly prefer to use spare moments to read on their phones, which gave me the idea of creating a mobile platform. Blogging has been a habit of mine for nearly ten years, although my earlier writing appeared under another handle. When I was learning, I was deeply grateful to the people who willingly shared their knowledge, so once I became able to share what I had learned, I did not want to hold back…
0x01 Preface This article is detailed; copy the demo and follow in a debugger. 0x02 Flow Analysis Serialization writes an object to an I/O stream. It usually begins by creating ObjectOutputStream and calling its write…
0. Preface This article mainly translates the Object Serialization Stream Protocol and summarizes the serialization format. 1. Overview The stream format has the following design goals: a compact structure for efficient reading; the ability to use the stream structure and format without detailed knowledge of the stream or invoking class code; and access and manipulation only through the stream…
0x01 Preface The construction of the native JDK 7u21 gadget chain is a classic. After studying its structure and underlying ideas, I wrote this article as a set of notes. 0x02 Prerequisites The JDK 7u21 chain uses many fundamental Java concepts, principally Java reflection, dynamic class modification with Javassist, Java static class loading, Java dynamic proxies, and hash collisions. To make the article easier to follow, I will…
0x01 Preface. WeEngine CMS quietly fixed an SQL injection vulnerability in version 2.0. No analysis of the injection point could be found online, so this article examines its exploitation. 0x02 Affected versions. Testing shows the vulnerability in v1.5.2 from the official GitLee repository and a fix in 2.0, so at least v1.5.2 is affected…
0x00 Preface. Xu recently told me Qishi CMS had patched a problem in the global assign_resume_tpl function and asked whether it was exploitable. The official advisory points to /Application/Common/Controller/BaseController…
0x01 Preface During a recent Dianfeng Geek CTF, I encountered a web challenge hinting at register_argc_argv but could not solve it. I later asked yzddmr6 and searched Chinese security research, finding little. This PHP setting seemed worth documenting. My practical experience is limited, so additions are welcome…
0x01 Preface. Xu recently pointed out a path from a low-privilege FastAdmin backend account to a shell. This article analyzes it. Affected versions: V1.0.0.20191212 beta and earlier. 0x02 Authorization. The main difficulty is that low-privilege users cannot access shell-related features…