It’s easier to Pirate with an
Atlas…sian
This guide will introduce running Jira locally and setting up an IntelliJ debugger to
identify code components and hypothetically, for educational purposes pirate
Jira.
⚠️ Disclaimer: This guide is for educational purposes only, it is not an
endorsement or instruction to pirate software, including Atlassian
products like Jira. Software piracy is illegal and unethical, violating
intellectual property rights and leading to legal consequences.
I am not a lawyer etc etc.
Part 1: Set-up Jira
Part 2: Set-up IntelliJ
Part 3: Finding the code to edit
Part 4: Edit & Recompile code
Part 5: Generate a fake license
Part 6: 🤑
Conclusion
Part 1: Set-up Jira
1. Download Jira: [Link]
center & unzip it
2. Install atlas plugin (this is how we will run Jira locally)
a. [Link]
the-atlassian-sdk-on-a-linux-or-mac-system/
b. [Link]
standalone/
It’s easier to Pirate with an Atlas…sian 1
3. Run Jira (make sure to change the version to match what you downloaded,
and take note of the debug port)
a. You should check nothing is running on the port Jira is about to start up on
( 1990 below), and the debug port ( 8983 below)
atlas-run-standalone --product jira --version 9.4.0 \
--jvmargs "-Xdebug \
-[Link]=false \
-[Link]=false \
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address
-Xmx3g -Xms512m \
-XX:MaxMetaspaceSize=512m \
-[Link]=true \
-[Link]=false" \
--server localhost -p 1990
4. Login with the provided “admin” “admin” creds
5. Trigger a server error by changing the “F” to “G” in the free license provided at
[Link]
🥳 Yay Jira is working properly!!!
Part 2: Set-up IntelliJ
1. Test things
2. Install IntelliJ, open Jira as a “project” via the [Link] file
a. For most people this will be located inside ~/amps-standalone-jira-
9.4.0/target/jira (or wherever you unzipped Jira)
3. Setup debugger
It’s easier to Pirate with an Atlas…sian 2
a. “Edit Configurations” → “+” → “Remote JVM Debug” → set the port to
8983 or whatever you selected above
b. [Link]
Select Edit Configurations
Select + then Remote JVM Debug
It’s easier to Pirate with an Atlas…sian 3
Ensure the port is set to 8983, everything else can stay the same
4. Locate the [Link] inside ~/amps-standalone-jira-9.4.0/target/jira
(I used finder file search)
5. Unzip the jar file with your favourite unzip tool (I used the terminal command
unzip -l [Link] )
6. Find [Link] inside the unzipped directory (I used ls | grep
[Link] )
7. Decompile the class file with IntelliJ
a. Settings Icon → Project Structure → Libraries → + → Add atlassian-extras-
[Link]
b. IntelliJ might need some time to index the files before the next step
It’s easier to Pirate with an Atlas…sian 4
1. [Link]
2. [Link]
8. Search for checkAndGetLicenseText function within IntellIJ (I used CMD+F)
9. Set a break-point within this function (I set mine at the line below)
Breakpoint set at verify()
Part 3: Finding the code to edit
1. Run the debugger by hitting the green bug
It’s easier to Pirate with an Atlas…sian 5
I called my debugger configuration “Jira debug”, you may have called yours something else
2. Recreate step 5 of part 1 (i.e. trigger the breakpoint). If the breakpoint gets set,
you should see something like the following in the debug console)
See the current variable state, this helps us figure out what input might be vulnerable!
3. “Step into” the verify function
There’s lots of debug options available, but we mostly want to step into functions, step over
functions (go to the next line), or resume the program state
It’s easier to Pirate with an Atlas…sian 6
4. “Step over” lines within the verify function util the exception is raised,
indicating where the license’s signature is verified
5. What if…
Part 4: Edit & Recompile code
✨ Left to the reader ✨
Part 5: Generate a fake license
✨ Left to the reader ✨
Part 6: 🤑
It’s easier to Pirate with an Atlas…sian 7
Conclusion
Don’t be scared of big code repos!
Hacking is the easiest when you use the tools made for developers to debug
things
Pirating is brat
Have fun hacking!
~ Giuliana
(I’m sorry I don’t use cool social medias, but you can message me on linkedIn and
I’ll probably reply)
It’s easier to Pirate with an Atlas…sian 8