archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-27 01:11:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: archive/ysoserial:fix_assembly
Branches Tags
archive/ysoserial:master archive/ysoserial:fix_assembly archive/ysoserial:gh-actions archive/ysoserial:newgadgets archive/ysoserial:escape_error_test archive/ysoserial:fix_jk6 archive/ysoserial:jdk6_jdk9 archive/ysoserial:multiarg
archive/ysoserial:v0.0.6 archive/ysoserial:vtesting.a.fix archive/ysoserial:vtest.renamed.release archive/ysoserial:vtest.the.releases archive/ysoserial:vtest.the.release archive/ysoserial:v0.0.5 archive/ysoserial:v0.0.4 archive/ysoserial:v0.0.3 archive/ysoserial:v0.0.2 archive/ysoserial:v0.0.1
..
compare: archive/ysoserial:escape_error_test
Branches Tags
archive/ysoserial:master archive/ysoserial:fix_assembly archive/ysoserial:gh-actions archive/ysoserial:newgadgets archive/ysoserial:escape_error_test archive/ysoserial:fix_jk6 archive/ysoserial:jdk6_jdk9 archive/ysoserial:multiarg
archive/ysoserial:v0.0.6 archive/ysoserial:vtesting.a.fix archive/ysoserial:vtest.renamed.release archive/ysoserial:vtest.the.releases archive/ysoserial:vtest.the.release archive/ysoserial:v0.0.5 archive/ysoserial:v0.0.4 archive/ysoserial:v0.0.3 archive/ysoserial:v0.0.2 archive/ysoserial:v0.0.1
1 Commits
fix_assembly .. escape_error_test
Author SHA1 Message Date
Chris Frohoff ee913411e8 minimal test for escaping issues in createTemplatesImpl 2021-08-17 15:51:10 -07:00
5 changed files with 96 additions and 147 deletions
Expand all files Collapse all files
.github/workflows/publish.yml
-40
View File
@@ -1,40 +0,0 @@
name: publish jar
on:
push:
tags:
- "v*.*.*"
permissions:
contents: write
jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
steps:
- uses: actions/checkout@v3
- uses: actions/setup-java@v3
with:
java-version: '8'
distribution: 'adopt'
cache: 'maven'
- name: Set version
run: mvn versions:set -DnewVersion=${{ github.ref_name }}
- name: Build jar
run: mvn -B clean package -DskipTests
# - name: publish maven jar
# run: mvn -B deploy -DskipTests -DrepositoryId=github
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Rename artifact
run: mv target/ysoserial-${{ github.ref_name }}-all.jar target/ysoserial-all.jar
- name: Publish GitHub release
uses: softprops/action-gh-release@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
files: target/ysoserial-all.jar
.travis.yml
-1
View File
@@ -26,7 +26,6 @@ after_script:
grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- -- grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
matrix: matrix:
fast_finish: true
allow_failures: allow_failures:
- jdk: oraclejdk11 - jdk: oraclejdk11
- jdk: openjdk6 - jdk: openjdk6
README.md
+13 -4
View File
@@ -1,8 +1,12 @@
# ysoserial # ysoserial
[![GitHub release](https://img.shields.io/github/downloads/frohoff/ysoserial/latest/total)](https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar) [![Join the chat at https://gitter.im/frohoff/ysoserial](
[![Travis Build Status](https://api.travis-ci.com/frohoff/ysoserial.svg?branch=master)](https://travis-ci.com/frohoff/ysoserial) https://badges.gitter.im/frohoff/ysoserial.svg)](
https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
[![Travis Build Status](https://api.travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
[![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master) [![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
@@ -99,9 +103,14 @@ $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 Common
## Installation ## Installation
[![GitHub release](https://img.shields.io/github/downloads/frohoff/ysoserial/latest/total)](https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar) 1. Download the latest jar from
[JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
Download the [latest release jar](https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar) from GitHub releases. Note that GitHub-hosted releases were removed in compliance with the
[GitHub Community Guidelines](
https://help.github.com/articles/github-community-guidelines/#what-is-not-allowed)
## Building ## Building
pom.xml
+82 -101
View File
@@ -25,9 +25,9 @@
<source>1.6</source> <source>1.6</source>
<target>1.6</target> <target>1.6</target>
<!-- ignore noisy internal api warnings --> <!-- ignore noisy internal api warnings -->
<compilerArgument>-XDignore.symbol.file</compilerArgument> <compilerArgument>-XDignore.symbol.file</compilerArgument>
<fork>true</fork> <fork>true</fork>
</configuration> </configuration>
</plugin> </plugin>
<plugin> <plugin>
<artifactId>maven-assembly-plugin</artifactId> <artifactId>maven-assembly-plugin</artifactId>
@@ -39,10 +39,8 @@
<mainClass>ysoserial.GeneratePayload</mainClass> <mainClass>ysoserial.GeneratePayload</mainClass>
</manifest> </manifest>
</archive> </archive>
<descriptors> <descriptor>assembly.xml</descriptor>
<descriptor>assembly.xml</descriptor> </configuration>
</descriptors>
</configuration>
<executions> <executions>
<execution> <execution>
<id>make-assembly</id> <id>make-assembly</id>
@@ -54,30 +52,20 @@
</executions> </executions>
</plugin> </plugin>
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId> <artifactId>maven-surefire-plugin</artifactId>
<version>3.0.0-M1</version> <version>3.0.0-M1</version>
<configuration> <configuration>
<trimStackTrace>false</trimStackTrace> <trimStackTrace>false</trimStackTrace>
<systemPropertyVariables> <systemPropertyVariables>
<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly> <java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
</systemPropertyVariables> </systemPropertyVariables>
</configuration> </configuration>
</plugin> </plugin>
</plugins> </plugins>
</build> </build>
<repositories> <repositories>
<repository>
<id>central</id>
<layout>default</layout>
<url>https://repo.maven.apache.org/maven2/</url>
</repository>
<repository>
<id>ysoserial-m2-repo</id>
<layout>default</layout>
<url>https://raw.githubusercontent.com/frohoff/ysoserial-m2-repo/master</url>
</repository>
<repository> <repository>
<id>jenkins</id> <id>jenkins</id>
<layout>default</layout> <layout>default</layout>
@@ -143,11 +131,11 @@
<artifactId>commons-codec</artifactId> <artifactId>commons-codec</artifactId>
<version>1.9</version> <version>1.9</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-io</groupId> <groupId>commons-io</groupId>
<artifactId>commons-io</artifactId> <artifactId>commons-io</artifactId>
<version>2.6</version> <version>2.6</version>
</dependency> </dependency>
<dependency> <dependency>
<artifactId>remoting</artifactId> <artifactId>remoting</artifactId>
<groupId>org.jenkins-ci.main</groupId> <groupId>org.jenkins-ci.main</groupId>
@@ -248,7 +236,7 @@
<artifactId>commons-fileupload</artifactId> <artifactId>commons-fileupload</artifactId>
<version>1.3</version> <version>1.3</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.wicket</groupId> <groupId>org.apache.wicket</groupId>
<artifactId>wicket-util</artifactId> <artifactId>wicket-util</artifactId>
<version>6.23.0</version> <version>6.23.0</version>
@@ -278,11 +266,11 @@
<artifactId>rome</artifactId> <artifactId>rome</artifactId>
<version>1.0</version> <version>1.0</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.python</groupId> <groupId>org.python</groupId>
<artifactId>jython-standalone</artifactId> <artifactId>jython-standalone</artifactId>
<version>2.5.2</version> <version>2.5.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>rhino</groupId> <groupId>rhino</groupId>
<artifactId>js</artifactId> <artifactId>js</artifactId>
@@ -323,11 +311,11 @@
<artifactId>slf4j-api</artifactId> <artifactId>slf4j-api</artifactId>
<version>1.7.21</version> <version>1.7.21</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.slf4j</groupId> <groupId>org.slf4j</groupId>
<artifactId>slf4j-jdk14</artifactId> <artifactId>slf4j-jdk14</artifactId>
<version>1.7.21</version> <version>1.7.21</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.clojure</groupId> <groupId>org.clojure</groupId>
<artifactId>clojure</artifactId> <artifactId>clojure</artifactId>
@@ -338,55 +326,55 @@
<artifactId>vaadin-server</artifactId> <artifactId>vaadin-server</artifactId>
<version>7.7.14</version> <version>7.7.14</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.aspectj</groupId> <groupId>org.aspectj</groupId>
<artifactId>aspectjweaver</artifactId> <artifactId>aspectjweaver</artifactId>
<version>1.9.5</version> <version>1.9.5</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.click</groupId> <groupId>org.apache.click</groupId>
<artifactId>click-nodeps</artifactId> <artifactId>click-nodeps</artifactId>
<version>2.3.0</version> <version>2.3.0</version>
</dependency> </dependency>
</dependencies> </dependencies>
<profiles> <profiles>
<profile> <profile>
<id>jdk6</id> <id>jdk6</id>
<activation> <activation>
<jdk>1.6</jdk> <jdk>1.6</jdk>
</activation> </activation>
<build> <build>
<plugins> <plugins>
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId> <artifactId>maven-surefire-plugin</artifactId>
<version>2.22.1</version> <version>2.22.1</version>
</plugin> </plugin>
</plugins> </plugins>
</build> </build>
<dependencies> <dependencies>
<dependency> <dependency>
<groupId>javax.el</groupId> <groupId>javax.el</groupId>
<artifactId>javax.el-api</artifactId> <artifactId>javax.el-api</artifactId>
<version>3.0.0</version> <version>3.0.0</version>
</dependency> </dependency>
</dependencies> </dependencies>
<!-- workaround for non-overlapping TLS versions in JDK6 and central repo <!-- workaround for non-overlapping TLS versions in JDK6 and central repo
https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ --> https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
<repositories> <repositories>
<repository> <repository>
<id>repo1</id> <id>repo1</id>
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) --> <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
</repository> </repository>
</repositories> </repositories>
<pluginRepositories> <pluginRepositories>
<pluginRepository> <pluginRepository>
<id>repo1</id> <id>repo1</id>
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) --> <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
</pluginRepository> </pluginRepository>
</pluginRepositories> </pluginRepositories>
</profile> </profile>
<profile> <profile>
<id>hibernate5</id> <id>hibernate5</id>
@@ -401,11 +389,11 @@
<artifactId>hibernate-core</artifactId> <artifactId>hibernate-core</artifactId>
<version>5.0.7.Final</version> <version>5.0.7.Final</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>javax.el</groupId> <groupId>javax.el</groupId>
<artifactId>javax.el-api</artifactId> <artifactId>javax.el-api</artifactId>
<version>3.0.0</version> <version>3.0.0</version>
</dependency> </dependency>
</dependencies> </dependencies>
</profile> </profile>
@@ -450,11 +438,4 @@
</profile> </profile>
</profiles> </profiles>
<distributionManagement>
<repository>
<id>github</id>
<name>GitHub Packages</name>
<url>https://maven.pkg.github.com/frohoff/ysoserial</url>
</repository>
</distributionManagement>
</project> </project>
src/test/java/ysoserial/test/payloads/PayloadsTest.java
+1 -1
View File
@@ -203,7 +203,7 @@ public class PayloadsTest {
File[] jars = dependencies.length > 0 File[] jars = dependencies.length > 0
? Maven.configureResolver() ? Maven.configureResolver()
.withMavenCentralRepo(true) .withMavenCentralRepo(true)
.withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default") .withRemoteRepo("jenkins", "http://repo.jenkins-ci.org/public/", "default")
.resolve(dependencies).withoutTransitivity().asFile() .resolve(dependencies).withoutTransitivity().asFile()
: new File[0]; : new File[0];
URL[] urls = new URL[jars.length]; URL[] urls = new URL[jars.length];