Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is my implementation of #23, allowing recursively nested payloads.
Changes include:
@Bind private String command
can be referenced using -command or any unambiguous subset, such as -c.ObjectPayload
has been modified to add a no-argsgetObject
, and the one-arg version has been marked@Deprecated
.GeneratePayload
has also been adjusted to not error on no-arg payloads, such as the SerialDOS payload.@Bind
has a number of configuration options which can be used to filter which types of payloads are allowed and default values. If a default is provided, the -switch will be optional.GeneratePayload
will now read options prior to the name of the payload, which can be used to adjust output format. For example, to output in ASCII hex format:java -jar ysoserial-whatever-all.jar -hex CommonsCollections1 -command "touch /tmp/hi-guys"
. Available formats are-hex
,-raw
, and-base64
, as requested in CLI improvements #23.BeanUtilsWrapper1
, borrowed from @pwntester's code, demonstrates nested payload generation.I also added two new variants on existing payloads,
CommonsCollections6
, which works in JDK8_70+ with a security manager in place (unlike CC5), andCommonsCollectionsGroovy
, which will run arbitrary Groovy code in the GroovyShell.Also, POC of #10 coming shortly!