-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Jython2 gadget #135
Add Jython2 gadget #135
Conversation
This version of Jython2 executes a command through os.system(). Based on Jython1 from @pwntester & @cschneider4711
Sorry for taking so long to reply. Can you confirm whether this works on Windows? The Windows appveyor builds seem to be failing. https://ci.appveyor.com/project/frohoff/ysoserial/build/job/u0ruvvdc4beehxlu |
Hi @frohoff, it was a bit of a struggle to compile, but the build works for me on Windows 10 with Oracle JRE 1.7.0_80. |
Are you able to confirm it achieves command execution on windows? Does the test pass on windows on your machine? |
I'm not sure why AppVeyor fails; from the 1.8.0 output it seems to me that PowerShell did run:
On a side note, this pull request pretty much does the same and the build doesn't fail: |
It looks like the windows issue is probably is caused by a bug in the RCE test harness that doesn't handle spaces in the temp dir. I'll try to fix that and then get this merged. |
* CommonsCollections8 payload (#116) * New gadgets (Struts2JasperReports - Atomikos - SpringJta) (#123) * added Atomikos gadget payload * added Atomikos gadget payload * naming * added spring-jta gadget * added strutsJasperReports gadget + tests * updated deps list on springJta * fixed authors * renaming * Add new payload in Commons Collections 3.2.1 (#125) * Add Jython2 gadget (#135) This version of Jython2 executes a command through os.system(). Based on Jython1 from @pwntester & @cschneider4711 Co-authored-by: Chris Frohoff <chris@frohoff.org> * Add scala and clojure payloads from a couple of years ago (#137) * Add some payloads for Scala * Add new clojure payload effecting versions since 1.8.0 * Fix infinite loop behavior of clojure2 payload. * add CommonsBeanutils2 (#163) * ceylon gadget (#173) Co-authored-by: navalorenzo <34750199+navalorenzo@users.noreply.github.com> Co-authored-by: Stefano Ciccone <sciccone@gdssecurity.com> Co-authored-by: 梅子酒 <960596293@qq.com> Co-authored-by: Yorick Koster <ykoster@users.noreply.github.com> Co-authored-by: Ian Haken <ihaken@netflix.com> Co-authored-by: k4n5ha0 <9199771@qq.com> Co-authored-by: supersache <42678777+supersache@users.noreply.github.com>
This version of Jython2 executes a command through os.system(). Based on Jython1 from @pwntester & @cschneider4711