Skip to content

Commit

Permalink
Fix output bug in yso-integration
Browse files Browse the repository at this point in the history
  • Loading branch information
qtc-de committed Jun 9, 2024
1 parent 85d6d24 commit bdb8ce9
Showing 1 changed file with 50 additions and 24 deletions.
74 changes: 50 additions & 24 deletions src/eu/tneitzel/rmg/utils/YsoIntegration.java
Original file line number Diff line number Diff line change
Expand Up @@ -47,8 +47,8 @@
* @author Tobias Neitzel (@qtc_de)
*/
@SuppressWarnings("restriction")
public class YsoIntegration {

public class YsoIntegration
{
private static String[] bypassGadgets = new String[]{"JRMPClient2", "AnTrinh"};

/**
Expand All @@ -64,13 +64,18 @@ private static Object generateBypassGadget(String command)
Object payloadObject = null;
String[] split = command.split(":");

if(split.length != 2 || !split[1].matches("\\d+")) {
if (split.length != 2 || !split[1].matches("\\d+"))
{
ExceptionHandler.invalidListenerFormat(true);
}

try {
try
{
payloadObject = prepareAnTrinhGadget(split[0], Integer.valueOf(split[1]));
} catch (Exception e) {
}

catch (Exception e)
{
ExceptionHandler.unexpectedException(e, "bypass object", "generation", true);
}

Expand All @@ -88,7 +93,8 @@ private static URLClassLoader getClassLoader() throws MalformedURLException
{
File ysoJar = new File((String)RMGOption.YSO.getValue());

if( !ysoJar.exists() ) {
if (!ysoJar.exists())
{
ExceptionHandler.ysoNotPresent(RMGOption.YSO.getValue());
}

Expand All @@ -106,15 +112,21 @@ private static URLClassLoader getClassLoader() throws MalformedURLException
*/
private static InetAddress getLocalAddress(String host)
{

InetAddress addr = null;

try {
try
{
addr = InetAddress.getByName(host);

if (!addr.isAnyLocalAddress() && !addr.isLoopbackAddress())
{
NetworkInterface.getByInetAddress(addr);
}

}

} catch (SocketException | UnknownHostException e) {
catch (SocketException | UnknownHostException e)
{
Logger.eprintlnMixedYellow("Specified address", host, "seems not to be available on your host.");
Logger.eprintlnMixedBlue("Listener address is expected to be", "bound locally.");
ExceptionHandler.showStackTrace(e);
Expand All @@ -140,7 +152,8 @@ private static InetAddress getLocalAddress(String host)
*/
public static void createJRMPListener(String host, int port, Object payloadObject)
{
try {
try
{
InetAddress bindAddress = getLocalAddress(host);
URLClassLoader ucl = getClassLoader();

Expand All @@ -166,28 +179,38 @@ public static void createJRMPListener(String host, int port, Object payloadObjec

runMethod.invoke(jrmpListener, new Object[] {});
System.exit(0);
}

} catch( java.net.BindException e ) {
catch (java.net.BindException e)
{
ExceptionHandler.bindException(e);
}

} catch( java.lang.reflect.InvocationTargetException e) {

catch (java.lang.reflect.InvocationTargetException e)
{
Throwable t = ExceptionHandler.getCause(e);

if( t instanceof java.net.BindException) {
if (t instanceof java.net.BindException)
{
ExceptionHandler.bindException(e);
}

} else if( t instanceof java.lang.IllegalArgumentException) {
else if (t instanceof java.lang.IllegalArgumentException)
{
Logger.lineBreak();
Logger.printlnMixedYellow("Caught", "IllegalArgumentException", "during JRMPListener creation.");
Logger.printlnMixedBlue("Exception message:", t.getMessage());
Logger.eprintlnMixedYellow("Caught", "IllegalArgumentException", "during JRMPListener creation.");
Logger.eprintlnMixedBlue("Exception message:", t.getMessage());
RMGUtils.exit();
}

} else {
else
{
ExceptionHandler.unexpectedException(e, "JRMPListener", "creation", true);
}
}

} catch( Exception e ) {
catch (Exception e)
{
ExceptionHandler.unexpectedException(e, "JRMPListener", "creation", true);
}
}
Expand All @@ -202,26 +225,30 @@ public static void createJRMPListener(String host, int port, Object payloadObjec
*/
public static Object getPayloadObject(String gadget, String command)
{
if(Arrays.asList(bypassGadgets).contains(gadget)) {
if (Arrays.asList(bypassGadgets).contains(gadget))
{
return generateBypassGadget(command);
}

Object ysoPayload = null;

try {
try
{
URLClassLoader ucl = getClassLoader();

Class<?> yso = Class.forName("ysoserial.payloads.ObjectPayload$Utils", true, ucl);
Method method = yso.getDeclaredMethod("makePayloadObject", new Class[] {String.class, String.class});

Logger.print("Creating ysoserial payload...");
ysoPayload = method.invoke(null, new Object[] {gadget, command});
}

} catch( Exception e) {
catch (Exception e)
{
Logger.printlnPlain(" failed.");
Logger.eprintlnMixedYellow("Caught unexpected", e.getClass().getName(), "during gadget generation.");
Logger.eprintMixedBlue("You probably specified", "a wrong gadget name", "or an ");
Logger.printlnPlainBlue("invalid gadget argument.");
Logger.eprintlnPlainBlue("invalid gadget argument.");
ExceptionHandler.showStackTrace(e);
RMGUtils.exit();
}
Expand All @@ -230,7 +257,6 @@ public static Object getPayloadObject(String gadget, String command)
return ysoPayload;
}


/**
* The bypass technique implemented by this code was discovered by An Trinh (@_tint0) and a detailed analysis was
* provided by Hans-Martin Münch (@h0ng10). Certain portions of the code were copied from the corresponding blog post:
Expand Down

0 comments on commit bdb8ce9

Please sign in to comment.