qtc-de / beanshooter

JMX enumeration and attacking tool.
GNU General Public License v3.0
384 stars 46 forks source link

invoke args #11

Closed Stijn-Vdh closed 2 years ago

Stijn-Vdh commented 2 years ago

Why have java.lang.integer instead of just int? This blocks me from executing certain functions. I have been trying to find it in the source code but i cant' find it anywhere.

qtc-de commented 2 years ago

Hi @Stijn-Vdh :wave:

thanks for reporting :+1:

the underlying reason is that method arguments are parsed using a dynamically created function by javassist. The argument string is basically thrown into the following expression:

Object[] methodArgs = new Object[] { <ARGUMENTSTRING> };

Since javassist does not support boxing or unboxing, the following code does not work, despite being valid when directly compiled with Java:

Object[] methodArgs = new Object[] { 1, 2 };

This is the reason, why one needs to use object like arguments. Moreover, when dispatching MBean calls, the underlying function always expects an object array anyway (Object[]). Additionally, an array of associated types is passed to the call, to ensure that the arguments are marshaled correctly (to ensure that e.g. an Integer is marshaled as int if the invoked function signature requires this). beanshooter was not able to do this, as the desired function signature was unknown and only the function name was specified on the command line.

That being said, I agree that this behavior is very limiting and modified the invoke operation a little bit. The new version is already available on the development branch. The invoke action now does always require you to specify the targeted method signature within the --signature option. Arguments are no longer passed as a String, but each argument is passed individually. Moreover, wrapping primitive types into the corresponding object types occurs automatically (so you now can also specify a plain 1 instead of new Integer(1)).

Here is an example how the new invoke function looks like:

[qtc@devbox ~]$ beanshooter invoke 172.17.0.2 9010 'MLetExampleBean:name=ExampleBean,id=1' --signature 'primitiveTest(int a, long b, short c, boolean d)' 1 2L '(short)3' true
[+] Worked fine :D

You can find further examples within the README.md of the development branch. I leave the issue open until the changes are pushed to master :slightly_smiling_face:

Best Tobias