From 2e6f61c03973d7b6a231d2a8eba48568d48fc8d8 Mon Sep 17 00:00:00 2001 From: Matthias Kaiser Date: Tue, 26 Jul 2016 17:11:11 +0200 Subject: [PATCH] Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. --- pom.xml | 20 +++++++++++++++++++ .../ysoserial/payloads/JBossInterceptors.java | 2 +- .../ysoserial/payloads/JavassistWeld1.java | 2 +- 3 files changed, 22 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 6ca2a26..c2820bb 100644 --- a/pom.xml +++ b/pom.xml @@ -272,6 +272,26 @@ jboss-interceptor-core 2.0.0.Final + + org.jboss.interceptor + jboss-interceptor-spi + 2.0.0.Final + + + javax.enterprise + cdi-api + 1.0-SP1 + + + javax.interceptor + javax.interceptor-api + 3.1 + + + org.slf4j + slf4j-api + 1.7.21 + diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors.java b/src/main/java/ysoserial/payloads/JBossInterceptors.java index 7493929..74b366e 100644 --- a/src/main/java/ysoserial/payloads/JBossInterceptors.java +++ b/src/main/java/ysoserial/payloads/JBossInterceptors.java @@ -25,7 +25,7 @@ import java.util.*; by @matthias_kaiser */ @SuppressWarnings({"rawtypes", "unchecked"}) -@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final" }) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) public class JBossInterceptors implements ObjectPayload { public Object getObject(final String command) throws Exception { diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java index dcd5e28..ed3b8e1 100644 --- a/src/main/java/ysoserial/payloads/JavassistWeld1.java +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -25,7 +25,7 @@ import java.util.*; by @matthias_kaiser */ @SuppressWarnings({"rawtypes", "unchecked"}) -@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1","org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) public class JavassistWeld1 implements ObjectPayload { public Object getObject(final String command) throws Exception {