diff --git a/src/main/java/ysoserial/Strings.java b/src/main/java/ysoserial/Strings.java index 861114f..d14651d 100644 --- a/src/main/java/ysoserial/Strings.java +++ b/src/main/java/ysoserial/Strings.java @@ -1,7 +1,5 @@ package ysoserial; -import org.apache.commons.lang.StringUtils; - import java.util.*; public class Strings { @@ -46,10 +44,6 @@ public class Strings { return lines; } - public static String randUUID() { - return UUID.randomUUID().toString().replaceAll("-", ""); - } - public static class ToStringComparator implements Comparator { public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); } } diff --git a/src/main/java/ysoserial/payloads/Myfaces1.java b/src/main/java/ysoserial/payloads/Myfaces1.java index 5c20423..b1a8291 100644 --- a/src/main/java/ysoserial/payloads/Myfaces1.java +++ b/src/main/java/ysoserial/payloads/Myfaces1.java @@ -56,7 +56,6 @@ public class Myfaces1 implements ObjectPayload, DynamicDependencies { "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9", "org.mortbay.jasper:apache-el:8.0.27", "javax.servlet:javax.servlet-api:3.1.0", - "com.nqzero:permit-reflect:0.3", // FIXME for custom deserializer // deps for mocking the FacesContext "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1" @@ -66,7 +65,6 @@ public class Myfaces1 implements ObjectPayload, DynamicDependencies { "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9", "de.odysseus.juel:juel-impl:2.2.7", "de.odysseus.juel:juel-api:2.2.7", "javax.servlet:javax.servlet-api:3.1.0", - "com.nqzero:permit-reflect:0.3", // FIXME for custom deserializer // deps for mocking the FacesContext "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1" diff --git a/src/test/java/ysoserial/test/payloads/DnsLookupTest.java b/src/test/java/ysoserial/test/payloads/DnsLookupTest.java index ea10e70..0ab18f3 100644 --- a/src/test/java/ysoserial/test/payloads/DnsLookupTest.java +++ b/src/test/java/ysoserial/test/payloads/DnsLookupTest.java @@ -1,22 +1,18 @@ package ysoserial.test.payloads; import org.junit.Assert; -import ysoserial.Strings; -import ysoserial.payloads.Scala; import ysoserial.payloads.URLDNS; import ysoserial.secmgr.SecurityManagers; import ysoserial.test.CustomTest; -import ysoserial.test.util.Files; -import ysoserial.test.util.OS; +import ysoserial.test.util.Randomized; -import java.io.File; import java.security.Permission; import java.util.LinkedList; import java.util.List; import java.util.concurrent.Callable; public class DnsLookupTest implements CustomTest { - private final String testDomain = Strings.randUUID(); + private final String testDomain = Randomized.randUUID(); @Override public void run(Callable payload) throws Exception { diff --git a/src/test/java/ysoserial/test/payloads/EmptyFileWriteTest.java b/src/test/java/ysoserial/test/payloads/EmptyFileWriteTest.java index b5c318c..64e1af0 100644 --- a/src/test/java/ysoserial/test/payloads/EmptyFileWriteTest.java +++ b/src/test/java/ysoserial/test/payloads/EmptyFileWriteTest.java @@ -1,21 +1,18 @@ package ysoserial.test.payloads; -import org.apache.commons.codec.binary.Base64; import org.junit.Assert; -import ysoserial.Strings; import ysoserial.payloads.Scala; import ysoserial.test.CustomTest; import ysoserial.test.util.Files; import ysoserial.test.util.OS; +import ysoserial.test.util.Randomized; -import java.io.BufferedReader; import java.io.File; -import java.io.FileReader; import java.util.concurrent.Callable; public class EmptyFileWriteTest implements CustomTest { - private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID()); - private final String testContent = Strings.randUUID(); + private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID()); + private final String testContent = Randomized.randUUID(); @Override public void run(Callable payload) throws Exception { diff --git a/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java b/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java index 9c3587e..580071a 100644 --- a/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java +++ b/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java @@ -7,6 +7,7 @@ import ysoserial.payloads.JRMPListener; import ysoserial.test.CustomTest; import ysoserial.test.util.Files; import ysoserial.test.util.ObjectInputFilters; +import ysoserial.test.util.Randomized; import java.io.File; import java.rmi.Remote; @@ -16,7 +17,7 @@ import java.util.concurrent.Callable; public class JRMPListenerTest implements CustomTest, NeedsAddlClasses { private final File testFile = Files.getTestFile(); - private final int port = 16000 + new Random().nextInt(16000); + private final int port = Randomized.randPort(); @Override public void run(Callable payload) throws Exception { diff --git a/src/test/java/ysoserial/test/payloads/MyfacesTest.java b/src/test/java/ysoserial/test/payloads/MyfacesTest.java index 86a450c..362a291 100644 --- a/src/test/java/ysoserial/test/payloads/MyfacesTest.java +++ b/src/test/java/ysoserial/test/payloads/MyfacesTest.java @@ -7,7 +7,6 @@ import java.net.URL; import java.util.HashMap; import java.util.Iterator; import java.util.Map; -import java.util.concurrent.Callable; import javax.el.BeanELResolver; import javax.el.ELContext; @@ -17,7 +16,6 @@ import javax.faces.context.FacesContext; import javax.servlet.ServletContext; import javax.servlet.ServletRequest; -import com.nqzero.permit.Permit; import org.apache.myfaces.el.CompositeELResolver; import org.apache.myfaces.el.unified.FacesELContext; import org.mockito.Matchers; @@ -26,10 +24,8 @@ import org.mockito.invocation.InvocationOnMock; import org.mockito.stubbing.Answer; import ysoserial.payloads.Myfaces2; -import ysoserial.payloads.util.Reflections; import ysoserial.test.CustomDeserializer; import ysoserial.Deserializer; -import ysoserial.test.WrappedTest; /** @@ -54,7 +50,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria public static final class MyfacesDeserializer extends Deserializer { public static Class[] getExtraDependencies () { return new Class[] { - MockRequestContext.class, MockELResolver.class, Reflections.class, Permit.class + MockRequestContext.class, MockELResolver.class, FacesContextSetter.class }; } @@ -63,19 +59,23 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria } + public static abstract class FacesContextSetter extends FacesContext { + public static void set(FacesContext fc) { + FacesContext.setCurrentInstance(fc); // protected + } + } + @Override public Object call () throws Exception { - java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class); - Reflections.setAccessible(setFC); ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader(); Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader()); FacesContext ctx = createMockFacesContext(); try { - setFC.invoke(null, ctx); + FacesContextSetter.set(ctx); return super.call(); } finally { - setFC.invoke(null, (FacesContext) null); + FacesContextSetter.set(null); Thread.currentThread().setContextClassLoader(oldTCCL); } } diff --git a/src/test/java/ysoserial/test/payloads/PythonUploadExecTest.java b/src/test/java/ysoserial/test/payloads/PythonUploadExecTest.java index e93b6bf..a0c17c3 100644 --- a/src/test/java/ysoserial/test/payloads/PythonUploadExecTest.java +++ b/src/test/java/ysoserial/test/payloads/PythonUploadExecTest.java @@ -1,18 +1,18 @@ package ysoserial.test.payloads; import org.junit.Assert; -import ysoserial.Strings; import ysoserial.test.CustomTest; import ysoserial.test.util.Files; import ysoserial.test.util.OS; +import ysoserial.test.util.Randomized; import java.io.File; import java.util.concurrent.Callable; public class PythonUploadExecTest implements CustomTest { - private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID()); - private final File srcPyFile = new File(OS.getTmpDir(), "ysoserial-test-src-" + Strings.randUUID() + ".py"); - private final File dstPyFile = new File(OS.getTmpDir(), "ysoserial-test-dst-" + Strings.randUUID() + ".py"); + private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID()); + private final File srcPyFile = new File(OS.getTmpDir(), "ysoserial-test-src-" + Randomized.randUUID() + ".py"); + private final File dstPyFile = new File(OS.getTmpDir(), "ysoserial-test-dst-" + Randomized.randUUID() + ".py"); private final String testCode = "open('" + testFile + "','w').close()"; { diff --git a/src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java b/src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java index 30b5736..228ce46 100644 --- a/src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java +++ b/src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java @@ -4,7 +4,6 @@ package ysoserial.test.payloads; import java.io.ByteArrayInputStream; import java.io.IOException; import java.io.Serializable; -import java.util.Random; import java.util.concurrent.Callable; import fi.iki.elonen.NanoHTTPD; @@ -15,6 +14,7 @@ import javassist.CtClass; import ysoserial.payloads.C3P0; import ysoserial.test.CustomTest; import ysoserial.test.WrappedTest; +import ysoserial.test.util.Randomized; /** @@ -23,7 +23,8 @@ import ysoserial.test.WrappedTest; */ public class RemoteClassLoadingTest extends CommandExecTest implements WrappedTest, CustomTest { - private int port = new Random().nextInt(65535-1024)+1024; + private int port = Randomized.randPort(); + private String className = "Exploit-" + System.currentTimeMillis(); diff --git a/src/test/java/ysoserial/test/payloads/SimpleFileWriteTest.java b/src/test/java/ysoserial/test/payloads/SimpleFileWriteTest.java index 3329260..144b294 100644 --- a/src/test/java/ysoserial/test/payloads/SimpleFileWriteTest.java +++ b/src/test/java/ysoserial/test/payloads/SimpleFileWriteTest.java @@ -2,10 +2,10 @@ package ysoserial.test.payloads; import org.apache.commons.codec.binary.Base64; import org.junit.Assert; -import ysoserial.Strings; import ysoserial.test.CustomTest; import ysoserial.test.util.Files; import ysoserial.test.util.OS; +import ysoserial.test.util.Randomized; import java.io.BufferedReader; import java.io.File; @@ -13,8 +13,8 @@ import java.io.FileReader; import java.util.concurrent.Callable; public class SimpleFileWriteTest implements CustomTest { - private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID()); - private final String testContent = Strings.randUUID(); + private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID()); + private final String testContent = Randomized.randUUID(); @Override public void run(Callable payload) throws Exception { diff --git a/src/test/java/ysoserial/test/payloads/SsrfTest.java b/src/test/java/ysoserial/test/payloads/SsrfTest.java index cfe8c91..d0764ef 100644 --- a/src/test/java/ysoserial/test/payloads/SsrfTest.java +++ b/src/test/java/ysoserial/test/payloads/SsrfTest.java @@ -4,9 +4,9 @@ import com.sun.net.httpserver.HttpExchange; import com.sun.net.httpserver.HttpHandler; import com.sun.net.httpserver.HttpServer; import org.junit.Assert; -import ysoserial.Strings; import ysoserial.payloads.Scala; import ysoserial.test.CustomTest; +import ysoserial.test.util.Randomized; import java.io.IOException; import java.net.InetSocketAddress; @@ -16,9 +16,9 @@ import java.util.Random; import java.util.concurrent.Callable; public class SsrfTest implements CustomTest { - int port = 16000 + new Random().nextInt(16000); + int port = Randomized.randPort(); String authority = "http://localhost:" + port; - String uri = "/?" + Strings.randUUID(); + String uri = "/?" + Randomized.randUUID(); @Override public String getPayloadArgs() { diff --git a/src/test/java/ysoserial/test/payloads/Struts2JasperReportsTest.java b/src/test/java/ysoserial/test/payloads/Struts2JasperReportsTest.java index 6c76447..932aa3e 100644 --- a/src/test/java/ysoserial/test/payloads/Struts2JasperReportsTest.java +++ b/src/test/java/ysoserial/test/payloads/Struts2JasperReportsTest.java @@ -9,6 +9,7 @@ import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider; import com.opensymphony.xwork2.inject.Container; import ysoserial.Deserializer; +import ysoserial.payloads.Struts2JasperReports; import ysoserial.test.CustomDeserializer; public class Struts2JasperReportsTest extends CommandExecTest implements CustomDeserializer { @@ -17,7 +18,7 @@ public class Struts2JasperReportsTest extends CommandExecTest implements CustomD public Class getCustomDeserializer() { return StrutsJasperReportsDeserializer.class; } - + /** * need to use a custom deserializer so that the action context gets set in the isolated class * @@ -25,18 +26,18 @@ public class Struts2JasperReportsTest extends CommandExecTest implements CustomD * */ public static final class StrutsJasperReportsDeserializer extends Deserializer { - + public StrutsJasperReportsDeserializer(byte[] bytes) { super(bytes); } - + @Override public Object call () throws Exception { ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME); configurationManager.addContainerProvider(new XWorkConfigurationProvider()); Configuration config = configurationManager.getConfiguration(); Container container = config.getContainer(); - + HashMap context = new HashMap(); context.put(ActionContext.CONTAINER, container); ActionContext.setContext(new ActionContext(context)); @@ -44,4 +45,8 @@ public class Struts2JasperReportsTest extends CommandExecTest implements CustomD } } + public static void main(String[] args) throws Exception { + PayloadsTest.testPayload(Struts2JasperReports.class); + } + } diff --git a/src/test/java/ysoserial/test/util/Files.java b/src/test/java/ysoserial/test/util/Files.java index 8e4e4c6..4743ae8 100644 --- a/src/test/java/ysoserial/test/util/Files.java +++ b/src/test/java/ysoserial/test/util/Files.java @@ -1,7 +1,5 @@ package ysoserial.test.util; -import ysoserial.Strings; - import java.io.File; import java.io.PrintWriter; @@ -24,6 +22,6 @@ public class Files { } public static File getTestFile() { - return new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID()); + return new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID()); } } diff --git a/src/test/java/ysoserial/test/util/Randomized.java b/src/test/java/ysoserial/test/util/Randomized.java new file mode 100644 index 0000000..ee1cbba --- /dev/null +++ b/src/test/java/ysoserial/test/util/Randomized.java @@ -0,0 +1,24 @@ +package ysoserial.test.util; + +import java.io.IOException; +import java.net.ServerSocket; +import java.util.Random; +import java.util.UUID; + +public class Randomized { + public static int randPort() { + while (true) { + int port = new Random().nextInt(65535 - 16384) + 16384; + try { + ServerSocket s = new ServerSocket(port); + s.setReuseAddress(true); + s.close(); + return port; + } catch (IOException e) {} + } + } + + public static String randUUID() { + return UUID.randomUUID().toString().replaceAll("-", ""); + } +}