Skip to content

Conversation

@drosenbauer
Copy link

This is my implementation of #23, allowing recursively nested payloads.

Changes include:

  • Payload contents will now be bound automatically by a call to Utils.wire(). Command-line parameters will be used to fill in Bind variables according to their actual names in the code. For example, @Bind private String command can be referenced using -command or any unambiguous subset, such as -c. ObjectPayload has been modified to add a no-args getObject, and the one-arg version has been marked @Deprecated.
  • For maximizing backwards compatibility, if only one parameter is given, and it's not a -switch, it will be assumed to mean "-command [param]".
  • GeneratePayload has also been adjusted to not error on no-arg payloads, such as the SerialDOS payload.
  • @Bind has a number of configuration options which can be used to filter which types of payloads are allowed and default values. If a default is provided, the -switch will be optional.
  • GeneratePayload will now read options prior to the name of the payload, which can be used to adjust output format. For example, to output in ASCII hex format: java -jar ysoserial-whatever-all.jar -hex CommonsCollections1 -command "touch /tmp/hi-guys". Available formats are -hex, -raw, and -base64, as requested in CLI improvements #23.
  • BeanUtilsWrapper1, borrowed from @pwntester's code, demonstrates nested payload generation.

I also added two new variants on existing payloads, CommonsCollections6, which works in JDK8_70+ with a security manager in place (unlike CC5), and CommonsCollectionsGroovy, which will run arbitrary Groovy code in the GroovyShell.

Also, POC of #10 coming shortly!

@drosenbauer
Copy link
Author

I will get to fixing the openjdk7 build once I get an environment set up with that installed. For what it's worth, it does build properly in openjdk8 (on Android!), so this is something 7-specific.

@drosenbauer drosenbauer mentioned this pull request May 21, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant