mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-27 01:11:53 +08:00
Compare commits
8
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Chris Frohoff
|
2298d942e6 | ||
|
Chris Frohoff
|
ac3d16bbd9 | ||
|
Chris Frohoff
|
2874a69f61 | ||
|
Chris Frohoff
|
91b4266b13 | ||
|
Chris Frohoff
|
51110f9b71 | ||
|
Chris Frohoff
|
8eb5cbfbf6 | ||
|
YunLemon
|
d13299428d | ||
|
Chris Frohoff
|
79179e00b8 |
@@ -0,0 +1,40 @@
|
||||
name: publish jar
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "v*.*.*"
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
publish:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/setup-java@v3
|
||||
with:
|
||||
java-version: '8'
|
||||
distribution: 'adopt'
|
||||
cache: 'maven'
|
||||
- name: Set version
|
||||
run: mvn versions:set -DnewVersion=${{ github.ref_name }}
|
||||
- name: Build jar
|
||||
run: mvn -B clean package -DskipTests
|
||||
# - name: publish maven jar
|
||||
# run: mvn -B deploy -DskipTests -DrepositoryId=github
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
|
||||
- name: Rename artifact
|
||||
run: mv target/ysoserial-${{ github.ref_name }}-all.jar target/ysoserial-all.jar
|
||||
|
||||
- name: Publish GitHub release
|
||||
uses: softprops/action-gh-release@v1
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
with:
|
||||
files: target/ysoserial-all.jar
|
||||
@@ -26,6 +26,7 @@ after_script:
|
||||
grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
|
||||
|
||||
matrix:
|
||||
fast_finish: true
|
||||
allow_failures:
|
||||
- jdk: oraclejdk11
|
||||
- jdk: openjdk6
|
||||
|
||||
@@ -1,12 +1,8 @@
|
||||
|
||||
# ysoserial
|
||||
|
||||
[](
|
||||
https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](
|
||||
https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
|
||||
[](https://travis-ci.org/frohoff/ysoserial)
|
||||
[](https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar)
|
||||
[](https://travis-ci.com/frohoff/ysoserial)
|
||||
[](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
|
||||
|
||||
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
|
||||
@@ -103,14 +99,9 @@ $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 Common
|
||||
|
||||
## Installation
|
||||
|
||||
1. Download the latest jar from
|
||||
[JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
|
||||
[](
|
||||
https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
|
||||
[](https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar)
|
||||
|
||||
Note that GitHub-hosted releases were removed in compliance with the
|
||||
[GitHub Community Guidelines](
|
||||
https://help.github.com/articles/github-community-guidelines/#what-is-not-allowed)
|
||||
Download the [latest release jar](https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar) from GitHub releases.
|
||||
|
||||
## Building
|
||||
|
||||
|
||||
@@ -25,9 +25,9 @@
|
||||
<source>1.6</source>
|
||||
<target>1.6</target>
|
||||
<!-- ignore noisy internal api warnings -->
|
||||
<compilerArgument>-XDignore.symbol.file</compilerArgument>
|
||||
<fork>true</fork>
|
||||
</configuration>
|
||||
<compilerArgument>-XDignore.symbol.file</compilerArgument>
|
||||
<fork>true</fork>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<artifactId>maven-assembly-plugin</artifactId>
|
||||
@@ -39,8 +39,10 @@
|
||||
<mainClass>ysoserial.GeneratePayload</mainClass>
|
||||
</manifest>
|
||||
</archive>
|
||||
<descriptor>assembly.xml</descriptor>
|
||||
</configuration>
|
||||
<descriptors>
|
||||
<descriptor>assembly.xml</descriptor>
|
||||
</descriptors>
|
||||
</configuration>
|
||||
<executions>
|
||||
<execution>
|
||||
<id>make-assembly</id>
|
||||
@@ -52,20 +54,30 @@
|
||||
</executions>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<version>3.0.0-M1</version>
|
||||
<configuration>
|
||||
<trimStackTrace>false</trimStackTrace>
|
||||
<systemPropertyVariables>
|
||||
<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
|
||||
</systemPropertyVariables>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<version>3.0.0-M1</version>
|
||||
<configuration>
|
||||
<trimStackTrace>false</trimStackTrace>
|
||||
<systemPropertyVariables>
|
||||
<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
|
||||
</systemPropertyVariables>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
|
||||
<repositories>
|
||||
<repository>
|
||||
<id>central</id>
|
||||
<layout>default</layout>
|
||||
<url>https://repo.maven.apache.org/maven2/</url>
|
||||
</repository>
|
||||
<repository>
|
||||
<id>ysoserial-m2-repo</id>
|
||||
<layout>default</layout>
|
||||
<url>https://raw.githubusercontent.com/frohoff/ysoserial-m2-repo/master</url>
|
||||
</repository>
|
||||
<repository>
|
||||
<id>jenkins</id>
|
||||
<layout>default</layout>
|
||||
@@ -131,11 +143,11 @@
|
||||
<artifactId>commons-codec</artifactId>
|
||||
<version>1.9</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>commons-io</groupId>
|
||||
<artifactId>commons-io</artifactId>
|
||||
<version>2.6</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>commons-io</groupId>
|
||||
<artifactId>commons-io</artifactId>
|
||||
<version>2.6</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<artifactId>remoting</artifactId>
|
||||
<groupId>org.jenkins-ci.main</groupId>
|
||||
@@ -236,7 +248,7 @@
|
||||
<artifactId>commons-fileupload</artifactId>
|
||||
<version>1.3</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.wicket</groupId>
|
||||
<artifactId>wicket-util</artifactId>
|
||||
<version>6.23.0</version>
|
||||
@@ -266,11 +278,11 @@
|
||||
<artifactId>rome</artifactId>
|
||||
<version>1.0</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.python</groupId>
|
||||
<artifactId>jython-standalone</artifactId>
|
||||
<version>2.5.2</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.python</groupId>
|
||||
<artifactId>jython-standalone</artifactId>
|
||||
<version>2.5.2</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>rhino</groupId>
|
||||
<artifactId>js</artifactId>
|
||||
@@ -311,11 +323,11 @@
|
||||
<artifactId>slf4j-api</artifactId>
|
||||
<version>1.7.21</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.slf4j</groupId>
|
||||
<artifactId>slf4j-jdk14</artifactId>
|
||||
<version>1.7.21</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.slf4j</groupId>
|
||||
<artifactId>slf4j-jdk14</artifactId>
|
||||
<version>1.7.21</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.clojure</groupId>
|
||||
<artifactId>clojure</artifactId>
|
||||
@@ -326,55 +338,55 @@
|
||||
<artifactId>vaadin-server</artifactId>
|
||||
<version>7.7.14</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.aspectj</groupId>
|
||||
<artifactId>aspectjweaver</artifactId>
|
||||
<version>1.9.5</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.click</groupId>
|
||||
<artifactId>click-nodeps</artifactId>
|
||||
<version>2.3.0</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.aspectj</groupId>
|
||||
<artifactId>aspectjweaver</artifactId>
|
||||
<version>1.9.5</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.click</groupId>
|
||||
<artifactId>click-nodeps</artifactId>
|
||||
<version>2.3.0</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<profiles>
|
||||
<profile>
|
||||
<id>jdk6</id>
|
||||
<activation>
|
||||
<jdk>1.6</jdk>
|
||||
</activation>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<version>2.22.1</version>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>javax.el</groupId>
|
||||
<artifactId>javax.el-api</artifactId>
|
||||
<version>3.0.0</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
<!-- workaround for non-overlapping TLS versions in JDK6 and central repo
|
||||
https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
|
||||
<repositories>
|
||||
<repository>
|
||||
<id>repo1</id>
|
||||
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
|
||||
</repository>
|
||||
</repositories>
|
||||
<pluginRepositories>
|
||||
<pluginRepository>
|
||||
<id>repo1</id>
|
||||
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
|
||||
</pluginRepository>
|
||||
</pluginRepositories>
|
||||
</profile>
|
||||
<profile>
|
||||
<id>jdk6</id>
|
||||
<activation>
|
||||
<jdk>1.6</jdk>
|
||||
</activation>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<version>2.22.1</version>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>javax.el</groupId>
|
||||
<artifactId>javax.el-api</artifactId>
|
||||
<version>3.0.0</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
<!-- workaround for non-overlapping TLS versions in JDK6 and central repo
|
||||
https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
|
||||
<repositories>
|
||||
<repository>
|
||||
<id>repo1</id>
|
||||
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
|
||||
</repository>
|
||||
</repositories>
|
||||
<pluginRepositories>
|
||||
<pluginRepository>
|
||||
<id>repo1</id>
|
||||
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
|
||||
</pluginRepository>
|
||||
</pluginRepositories>
|
||||
</profile>
|
||||
|
||||
<profile>
|
||||
<id>hibernate5</id>
|
||||
@@ -389,11 +401,11 @@
|
||||
<artifactId>hibernate-core</artifactId>
|
||||
<version>5.0.7.Final</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>javax.el</groupId>
|
||||
<artifactId>javax.el-api</artifactId>
|
||||
<version>3.0.0</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>javax.el</groupId>
|
||||
<artifactId>javax.el-api</artifactId>
|
||||
<version>3.0.0</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</profile>
|
||||
|
||||
@@ -438,4 +450,11 @@
|
||||
</profile>
|
||||
|
||||
</profiles>
|
||||
<distributionManagement>
|
||||
<repository>
|
||||
<id>github</id>
|
||||
<name>GitHub Packages</name>
|
||||
<url>https://maven.pkg.github.com/frohoff/ysoserial</url>
|
||||
</repository>
|
||||
</distributionManagement>
|
||||
</project>
|
||||
|
||||
@@ -203,7 +203,7 @@ public class PayloadsTest {
|
||||
File[] jars = dependencies.length > 0
|
||||
? Maven.configureResolver()
|
||||
.withMavenCentralRepo(true)
|
||||
.withRemoteRepo("jenkins", "http://repo.jenkins-ci.org/public/", "default")
|
||||
.withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
|
||||
.resolve(dependencies).withoutTransitivity().asFile()
|
||||
: new File[0];
|
||||
URL[] urls = new URL[jars.length];
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
package ysoserial.test.util;
|
||||
|
||||
import org.junit.Test;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
|
||||
public class GadgetsTest {
|
||||
@Test
|
||||
public void test_createTemplatesImpl_noCompilationError() throws Exception {
|
||||
Gadgets.createTemplatesImpl("hostname");
|
||||
Gadgets.createTemplatesImpl("echo 'foobar'");
|
||||
Gadgets.createTemplatesImpl("echo \"foobar\"");
|
||||
Gadgets.createTemplatesImpl("\"`';\\");
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user