From 863dc87f786839916154ce19d8b32c5e98dbf452 Mon Sep 17 00:00:00 2001 From: jax777 Date: Mon, 6 May 2019 16:40:28 +0800 Subject: [PATCH] Update CommonsCollections5.java real Gadget chain: --- .../payloads/CommonsCollections5.java | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/src/main/java/ysoserial/payloads/CommonsCollections5.java b/src/main/java/ysoserial/payloads/CommonsCollections5.java index d765160..78c83ec 100644 --- a/src/main/java/ysoserial/payloads/CommonsCollections5.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections5.java @@ -24,22 +24,21 @@ import ysoserial.payloads.util.Reflections; /* Gadget chain: - ObjectInputStream.readObject() - AnnotationInvocationHandler.readObject() - Map(Proxy).entrySet() - AnnotationInvocationHandler.invoke() - LazyMap.get() - ChainedTransformer.transform() - ConstantTransformer.transform() - InvokerTransformer.transform() - Method.invoke() - Class.getMethod() - InvokerTransformer.transform() - Method.invoke() - Runtime.getRuntime() - InvokerTransformer.transform() - Method.invoke() - Runtime.exec() + ObjectInputStream.readObject() + BadAttributeValueExpException.readObject() + TiedMapEntry.toString() + LazyMap.get() + ChainedTransformer.transform() + ConstantTransformer.transform() + InvokerTransformer.transform() + Method.invoke() + Class.getMethod() + InvokerTransformer.transform() + Method.invoke() + Runtime.getRuntime() + InvokerTransformer.transform() + Method.invoke() + Runtime.exec() Requires: commons-collections