ysoserial
ysoserial copied to clipboard
CLI improvements
This is my implementation of #23, allowing recursively nested payloads.
Changes include:
- Payload contents will now be bound automatically by a call to Utils.wire(). Command-line parameters will be used to fill in Bind variables according to their actual names in the code. For example,
@Bind private String commandcan be referenced using -command or any unambiguous subset, such as -c.ObjectPayloadhas been modified to add a no-argsgetObject, and the one-arg version has been marked@Deprecated. - For maximizing backwards compatibility, if only one parameter is given, and it's not a -switch, it will be assumed to mean "-command [param]".
-
GeneratePayloadhas also been adjusted to not error on no-arg payloads, such as the SerialDOS payload. -
@Bindhas a number of configuration options which can be used to filter which types of payloads are allowed and default values. If a default is provided, the -switch will be optional. -
GeneratePayloadwill now read options prior to the name of the payload, which can be used to adjust output format. For example, to output in ASCII hex format:java -jar ysoserial-whatever-all.jar -hex CommonsCollections1 -command "touch /tmp/hi-guys". Available formats are-hex,-raw, and-base64, as requested in #23. -
BeanUtilsWrapper1, borrowed from @pwntester's code, demonstrates nested payload generation.
I also added two new variants on existing payloads, CommonsCollections6, which works in JDK8_70+ with a security manager in place (unlike CC5), and CommonsCollectionsGroovy, which will run arbitrary Groovy code in the GroovyShell.
Also, POC of #10 coming shortly!
I will get to fixing the openjdk7 build once I get an environment set up with that installed. For what it's worth, it does build properly in openjdk8 (on Android!), so this is something 7-specific.