diff --git a/src/main/java/ysoserial/payloads/JRMPClient.java b/src/main/java/ysoserial/payloads/JRMPClient.java index d477beb..78c23f1 100644 --- a/src/main/java/ysoserial/payloads/JRMPClient.java +++ b/src/main/java/ysoserial/payloads/JRMPClient.java @@ -49,7 +49,7 @@ import ysoserial.payloads.util.PayloadRunner; @SuppressWarnings ( { "restriction" } ) -@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectSMTest") +@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectTest") @Authors({ Authors.MBECHLER }) public class JRMPClient extends PayloadRunner implements ObjectPayload { diff --git a/src/test/java/ysoserial/test/payloads/DnsLookupTest.java b/src/test/java/ysoserial/test/payloads/DnsLookupTest.java index 0ab18f3..e69c358 100644 --- a/src/test/java/ysoserial/test/payloads/DnsLookupTest.java +++ b/src/test/java/ysoserial/test/payloads/DnsLookupTest.java @@ -1,11 +1,15 @@ package ysoserial.test.payloads; import org.junit.Assert; +import sun.security.util.SecurityConstants; import ysoserial.payloads.URLDNS; import ysoserial.secmgr.SecurityManagers; import ysoserial.test.CustomTest; import ysoserial.test.util.Randomized; +import ysoserial.test.util.RecordingNameService; +import ysoserial.test.util.RecordingSecurityManager; +import java.net.SocketPermission; import java.security.Permission; import java.util.LinkedList; import java.util.List; @@ -16,27 +20,26 @@ public class DnsLookupTest implements CustomTest { @Override public void run(Callable payload) throws Exception { - final List lookups = new LinkedList(); - SecurityManager sm = new SecurityManager() { - @Override - public void checkConnect(String host, int port) { - if (port == -1) { - System.out.println(host); - lookups.add(host); - } - } - - @Override - public void checkPermission(Permission perm) {} - }; +// RecordingSecurityManager sm = new RecordingSecurityManager(); + RecordingNameService ns = new RecordingNameService(); +// Assert.assertFalse("should not have resolved domain", +// sm.getChecks().contains(new SocketPermission(testDomain, SecurityConstants.SOCKET_RESOLVE_ACTION))); + Assert.assertFalse("should not have resolved domain", ns.getLookups().contains(testDomain)); try { - SecurityManagers.wrapped(payload, sm).call(); +// SecurityManagers.wrapped(payload, sm).call(); + ns.install(); + payload.call(); } catch (Exception e) { e.printStackTrace(); + } finally { + ns.uninstall(); } - Assert.assertTrue(lookups.contains(testDomain)); + + Assert.assertTrue("should have resolved domain", ns.getLookups().contains(testDomain)); +// Assert.assertTrue("should have resolved domain", +// sm.getChecks().contains(new SocketPermission(testDomain, SecurityConstants.SOCKET_RESOLVE_ACTION))); } @Override @@ -45,7 +48,7 @@ public class DnsLookupTest implements CustomTest { } public static void main(String[] args) throws Exception { - PayloadsTest.testPayload(URLDNS.class, new Class[0]); + PayloadsTest.testPayload(URLDNS.class); } } diff --git a/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java b/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java index f55d57e..14fb664 100644 --- a/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java +++ b/src/test/java/ysoserial/test/payloads/JRMPListenerTest.java @@ -49,7 +49,7 @@ public class JRMPListenerTest implements CustomTest, NeedsAddlClasses { public static void main(String[] args) throws Exception { // ObjectInputFilters.disableDcgFilter(); - PayloadsTest.testPayload(JRMPListener.class, new Class[0]); + PayloadsTest.testPayload(JRMPListener.class); } public Class[] getAddlClasses() { diff --git a/src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java b/src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java index 3e7a04a..0b43aa4 100644 --- a/src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java +++ b/src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java @@ -8,8 +8,12 @@ import javax.management.BadAttributeValueExpException; import org.junit.Assert; import ysoserial.payloads.Atomikos; +import ysoserial.payloads.Hibernate2; +import ysoserial.payloads.JRMPClient; +import ysoserial.payloads.URLDNS; import ysoserial.test.CustomTest; import ysoserial.exploit.JRMPListener; +import ysoserial.test.util.ObjectInputFilters; /** @@ -31,16 +35,12 @@ public class JRMPReverseConnectTest implements CustomTest { public void run ( Callable payload ) throws Exception { - JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo")); + DnsLookupTest innerTest = new DnsLookupTest(); + JRMPListener l = new JRMPListener(port, new URLDNS().getObject(innerTest.getPayloadArgs())); Thread t = new Thread(l, "JRMP listener"); try { t.start(); - try { - payload.call(); - } - catch ( Exception e ) { - // ignore - } + innerTest.run(payload); Assert.assertTrue("Did not have connection", l.waitFor(1000)); } finally { @@ -53,10 +53,13 @@ public class JRMPReverseConnectTest implements CustomTest { public String getPayloadArgs () { return "rmi://localhost:" + port + "/ExportObject"; +// return "rmi:localhost:" + port; // old version +// return "localhost:" + port; } public static void main(String[] args) throws Exception { - PayloadsTest.testPayload(Atomikos.class); +// ObjectInputFilters.disableDcgFilter(); + PayloadsTest.testPayload(Hibernate2.class); } } diff --git a/src/test/java/ysoserial/test/util/RecordingNameService.java b/src/test/java/ysoserial/test/util/RecordingNameService.java new file mode 100644 index 0000000..c293aa3 --- /dev/null +++ b/src/test/java/ysoserial/test/util/RecordingNameService.java @@ -0,0 +1,42 @@ +package ysoserial.test.util; + +import sun.net.spi.nameservice.NameService; +import ysoserial.payloads.util.Reflections; + +import java.net.InetAddress; +import java.net.UnknownHostException; +import java.util.Collections; +import java.util.LinkedList; +import java.util.List; + +public class RecordingNameService implements NameService { + + private final List lookups = new LinkedList(); + + public List getLookups() { + return Collections.unmodifiableList(lookups); + } + + @Override + public InetAddress[] lookupAllHostAddr(String host) throws UnknownHostException { + lookups.add(host); + throw new UnknownHostException(); + } + + @Override + public String getHostByAddr(byte[] addr) throws UnknownHostException { + throw new UnknownHostException(); + } + + public void install() throws Exception { + getNameServices().add(this); + } + + public void uninstall() throws Exception { + getNameServices().remove(this); + } + + private static List getNameServices() throws Exception { + return (List) Reflections.getFieldValue(InetAddress.class, "nameServices"); + } +} diff --git a/src/test/java/ysoserial/test/util/RecordingSecurityManager.java b/src/test/java/ysoserial/test/util/RecordingSecurityManager.java new file mode 100644 index 0000000..39e5c9c --- /dev/null +++ b/src/test/java/ysoserial/test/util/RecordingSecurityManager.java @@ -0,0 +1,25 @@ +package ysoserial.test.util; + +import java.security.Permission; +import java.util.Collections; +import java.util.LinkedList; +import java.util.List; + +public class RecordingSecurityManager extends SecurityManager { + private final List checks = new LinkedList(); + + public List getChecks() { + return Collections.unmodifiableList(checks); + } + + @Override + public void checkPermission(Permission perm) { +// System.err.println("check " + perm); + checks.add(perm); + } + + @Override + public void checkPermission(Permission perm, Object context) { + checkPermission(perm); + } +}