mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-26 17:01:53 +08:00
fix build for jdk6
This commit is contained in:
@@ -311,6 +311,43 @@
|
|||||||
</dependencies>
|
</dependencies>
|
||||||
|
|
||||||
<profiles>
|
<profiles>
|
||||||
|
<profile>
|
||||||
|
<id>jdk6</id>
|
||||||
|
<activation>
|
||||||
|
<jdk>1.6</jdk>
|
||||||
|
</activation>
|
||||||
|
<build>
|
||||||
|
<plugins>
|
||||||
|
<plugin>
|
||||||
|
<groupId>org.apache.maven.plugins</groupId>
|
||||||
|
<artifactId>maven-surefire-plugin</artifactId>
|
||||||
|
<version>2.22.1</version>
|
||||||
|
</plugin>
|
||||||
|
</plugins>
|
||||||
|
</build>
|
||||||
|
<dependencies>
|
||||||
|
<dependency>
|
||||||
|
<groupId>javax.el</groupId>
|
||||||
|
<artifactId>javax.el-api</artifactId>
|
||||||
|
<version>3.0.0</version>
|
||||||
|
</dependency>
|
||||||
|
</dependencies>
|
||||||
|
<!-- workaround for non-overlapping TLS versions in JDK6 and central repo
|
||||||
|
https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
|
||||||
|
<repositories>
|
||||||
|
<repository>
|
||||||
|
<id>repo1</id>
|
||||||
|
<url>http://repo1.maven.org/maven2</url>
|
||||||
|
</repository>
|
||||||
|
</repositories>
|
||||||
|
<pluginRepositories>
|
||||||
|
<pluginRepository>
|
||||||
|
<id>repo1</id>
|
||||||
|
<url>http://repo1.maven.org/maven2</url>
|
||||||
|
</pluginRepository>
|
||||||
|
</pluginRepositories>
|
||||||
|
</profile>
|
||||||
|
|
||||||
<profile>
|
<profile>
|
||||||
<id>hibernate5</id>
|
<id>hibernate5</id>
|
||||||
<activation>
|
<activation>
|
||||||
|
|||||||
@@ -9,11 +9,7 @@ import java.rmi.registry.Registry;
|
|||||||
import java.rmi.server.RMIClientSocketFactory;
|
import java.rmi.server.RMIClientSocketFactory;
|
||||||
import java.security.cert.X509Certificate;
|
import java.security.cert.X509Certificate;
|
||||||
import java.util.concurrent.Callable;
|
import java.util.concurrent.Callable;
|
||||||
import javax.net.ssl.SSLContext;
|
import javax.net.ssl.*;
|
||||||
import javax.net.ssl.SSLEngine;
|
|
||||||
import javax.net.ssl.SSLSocketFactory;
|
|
||||||
import javax.net.ssl.TrustManager;
|
|
||||||
import javax.net.ssl.X509ExtendedTrustManager;
|
|
||||||
|
|
||||||
import ysoserial.payloads.CommonsCollections1;
|
import ysoserial.payloads.CommonsCollections1;
|
||||||
import ysoserial.payloads.ObjectPayload;
|
import ysoserial.payloads.ObjectPayload;
|
||||||
@@ -30,15 +26,11 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
|
|||||||
*/
|
*/
|
||||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||||
public class RMIRegistryExploit {
|
public class RMIRegistryExploit {
|
||||||
private static class TrustAllSSL extends X509ExtendedTrustManager {
|
private static class TrustAllSSL implements X509TrustManager {
|
||||||
private static final X509Certificate[] ANY_CA = {};
|
private static final X509Certificate[] ANY_CA = {};
|
||||||
public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
|
public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
|
||||||
public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
|
public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
|
||||||
public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
|
public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
|
||||||
public void checkServerTrusted(final X509Certificate[] c, final String t, final SSLEngine e) { /* Do nothing/accept all */ }
|
|
||||||
public void checkServerTrusted(final X509Certificate[] c, final String t, final Socket e) { /* Do nothing/accept all */ }
|
|
||||||
public void checkClientTrusted(final X509Certificate[] c, final String t, final SSLEngine e) { /* Do nothing/accept all */ }
|
|
||||||
public void checkClientTrusted(final X509Certificate[] c, final String t, final Socket e) { /* Do nothing/accept all */ }
|
|
||||||
}
|
}
|
||||||
|
|
||||||
private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
|
private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
|
||||||
@@ -61,7 +53,7 @@ public class RMIRegistryExploit {
|
|||||||
Registry registry = LocateRegistry.getRegistry(host, port);
|
Registry registry = LocateRegistry.getRegistry(host, port);
|
||||||
final String className = CommonsCollections1.class.getPackage().getName() + "." + args[2];
|
final String className = CommonsCollections1.class.getPackage().getName() + "." + args[2];
|
||||||
final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
|
final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
|
||||||
|
|
||||||
// test RMI registry connection and upgrade to SSL connection on fail
|
// test RMI registry connection and upgrade to SSL connection on fail
|
||||||
try {
|
try {
|
||||||
registry.list();
|
registry.list();
|
||||||
|
|||||||
Reference in New Issue
Block a user